@decidio/sdk 0.2.2 → 0.3.3

package/dist/resume.js

@@ -5,8 +5,8 @@ import { userInfo } from "node:os";
 import { execFileSync } from "node:child_process";
 import { signConfirm, canonicalize as jcs, assertSafeTransport, carriesCredential } from "./signing.js";
 import { canonicalize as toCanonical, DecidioUnsafeArgumentsError } from "./canonical.js";
-import { readConfirmResponse, buildConfirmBody } from "./evidence.js";
-import { DecidioHttpError } from "./errors.js";
+import { readConfirmResponse, buildConfirmBody, tierConfirms, tombstoneTier } from "./evidence.js";
+import { DecidioHttpError, decisionIdProblem } from "./errors.js";
 const argsBindingBytes = (p) => Buffer.from(jcs({ decisionId: p.decisionId, action: p.action, amount: p.amount, ...(p.scope !== undefined ? { scope: p.scope } : {}), args: p.args }), "utf8");
 function signArgs(p, agentKey, webhookSecret) {
     const bytes = argsBindingBytes(p);
@@ -78,9 +78,9 @@ export function verifyEvidence(rec, agentKey, webhookSecret) {
     }
 }
 export const EXECUTION_STATES = [
-    "parked", "claimed_preinvoke", "invoking", "executed_unreported", "indeterminate", "reported",
+    "parked", "claimed_preinvoke", "discarded", "invoking", "executed_unreported", "indeterminate", "reported",
 ];
-export const NON_REPLAYABLE = ["invoking", "executed_unreported", "indeterminate", "reported"];
+export const NON_REPLAYABLE = ["discarded", "invoking", "executed_unreported", "indeterminate", "reported"];
 export class DecidioStaleAttemptError extends Error {
     decisionId;
     owner;
@@ -101,16 +101,47 @@ export class DecidioAlreadySettledError extends Error {
         this.name = "DecidioAlreadySettledError";
     }
 }
+export class DecidioRecoveryUnavailableError extends Error {
+    cause;
+    constructor(cause) {
+        super(`[decidio] recover(): the execution ledger could not be read (${cause?.message ?? cause}). Refusing to return an empty recovery list, which would read as "nothing is outstanding" — inspect the store; some actions may be awaiting a report.`);
+        this.cause = cause;
+        this.name = "DecidioRecoveryUnavailableError";
+    }
+}
+export class DecidioDeniedError extends Error {
+    decisionId;
+    verdict;
+    constructor(decisionId, verdict) {
+        super(`[decidio] ${decisionId}: this decision was DENIED (${verdict}) and a denial is terminal — refusing a state write that would move it back toward execution. Nothing may advance out of a denial; if this action should now proceed it needs a NEW request and a new approval.`);
+        this.decisionId = decisionId;
+        this.verdict = verdict;
+        this.name = "DecidioDeniedError";
+    }
+}
+function assertNotDenied(id, cur, next) {
+    if (cur.state === "discarded" && next !== "discarded")
+        throw new DecidioDeniedError(id, cur.verdict ?? "rejected");
+}
+function assertClaimedBy(id, cur, attemptId) {
+    if (cur.state !== "claimed_preinvoke" || cur.attemptId !== attemptId) {
+        throw new Error(`[decidio] ${id}: refusing to cross the invocation boundary — attempt ${attemptId} does not hold a claim on this decision (state ${cur.state}, held by ${cur.attemptId || "nobody"}). A claim is the only way to acquire ownership; call claim() and act on its result.`);
+    }
+}
 function assertNotSettled(id, cur, next) {
     if (cur.reconciled?.outcome === "committed" && (next === "executed_unreported" || next === "indeterminate")) {
         throw new DecidioAlreadySettledError(id);
     }
 }
 export const SETTLE_OUTCOMES = ["committed", "not_committed"];
-export function assertSettlable(id, state, outcome, hasObservedEvidence = true) {
+export function assertSettlable(id, state, outcome, opts = {}) {
+    const hasObservedEvidence = opts.hasObservedEvidence ?? true;
     if (!SETTLE_OUTCOMES.includes(outcome)) {
         throw new Error(`[decidio] ${id}: outcome must be "committed" or "not_committed", not ${JSON.stringify(outcome)}.`);
     }
+    if (state === "discarded") {
+        throw new Error(`[decidio] ${id}: this decision was DENIED by a human or a policy, and a denial is final — it cannot be reconciled, released or retried. Nothing ran, so there is no outcome to record. If this action should now proceed it needs a NEW request and a new approval.`);
+    }
     if (outcome === "committed") {
         if (state === "reported")
             throw new Error(`[decidio] ${id}: already reported — there is nothing left to reconcile.`);
@@ -126,6 +157,9 @@ export function assertSettlable(id, state, outcome, hasObservedEvidence = true)
             throw new Error(`[decidio] ${id}: this decision holds CAPTURED EVIDENCE of an execution — releasing it would re-run a proven write. Re-send the evidence with reconfirm("${id}") instead.`);
         if (state === "parked")
             throw new Error(`[decidio] ${id}: already parked — nothing to release.`);
+        if (state === "invoking" && opts.workerStopped !== true) {
+            throw new Error(`[decidio] ${id}: this decision is still INVOKING — the worker that claimed it may be running the action right now, and releasing it would let a second worker run the same approved action. Stop or confirm the death of that worker first, then say so explicitly: reconcile("${id}", { outcome: "not_committed", reason: …, workerStopped: true }). If you cannot confirm it stopped, treat the decision as possibly executed and reconcile it as "committed" once you have checked the downstream system.`);
+        }
     }
 }
 const rank = (s) => EXECUTION_STATES.indexOf(s);
@@ -135,11 +169,12 @@ export class MemoryPendingStore {
     rec(id) {
         return this.x.get(id) ?? { decisionId: id, state: "parked", attemptId: null, at: new Date().toISOString() };
     }
-    advance(id, attemptId, state, patch = {}) {
+    advance(id, attemptId, state, patch = {}, takeover = false) {
         const cur = this.rec(id);
-        if (cur.attemptId && cur.attemptId !== attemptId && rank(cur.state) >= rank("invoking")) {
+        if (!takeover && cur.attemptId && cur.attemptId !== attemptId) {
             throw new DecidioStaleAttemptError(id, cur.attemptId, cur.state);
         }
+        assertNotDenied(id, cur, state);
         assertNotSettled(id, cur, state);
         if (rank(state) < rank(cur.state)) {
             throw new Error(`[decidio] ${id}: refusing to move ${cur.state} → ${state}; execution state only ever advances.`);
@@ -152,7 +187,15 @@ export class MemoryPendingStore {
             this.x.set(p.decisionId, { decisionId: p.decisionId, state: "parked", attemptId: null, action: p.action, at: new Date().toISOString() });
     }
     async get(id) { return this.m.get(id) ?? null; }
-    async delete(id) { this.m.delete(id); }
+    async delete(id, attemptId) {
+        if (attemptId && !this.ownsPayload(id, attemptId))
+            return;
+        this.m.delete(id);
+    }
+    ownsPayload(id, attemptId) {
+        const owner = this.x.get(id)?.attemptId;
+        return !owner || owner === attemptId;
+    }
     async list() { return [...this.m.values()].filter((p) => this.rec(p.decisionId).state === "parked"); }
     async claim(id, attemptId) {
         if (!this.m.has(id))
@@ -162,59 +205,87 @@ export class MemoryPendingStore {
             return { ok: false, state: cur.state, reason: `already ${cur.state}` };
         if (cur.state === "claimed_preinvoke")
             return { ok: false, state: cur.state, reason: "claimed by another attempt" };
-        this.advance(id, attemptId, "claimed_preinvoke", { action: this.m.get(id)?.action });
+        this.advance(id, attemptId, "claimed_preinvoke", { action: this.m.get(id)?.action }, true);
         return { ok: true };
     }
-    async markInvoking(id, attemptId) { this.advance(id, attemptId, "invoking"); }
+    async markInvoking(id, attemptId) {
+        const cur = this.rec(id);
+        assertNotDenied(id, cur, "invoking");
+        assertClaimedBy(id, cur, attemptId);
+        this.advance(id, attemptId, "invoking");
+    }
     async recordExecuted(id, attemptId, evidence, evidenceSig, evidenceError) { this.advance(id, attemptId, "executed_unreported", { evidence, hasEvidence: true, evidenceSig, evidenceError }); }
     async markIndeterminate(id, attemptId, error) { this.advance(id, attemptId, "indeterminate", { error }); }
     async markReported(id, attemptId, confirmation) { this.advance(id, attemptId, "reported", { confirmation }); }
+    async markDiscarded(id, verdict, reason) { this.advance(id, this.x.get(id)?.attemptId ?? "", "discarded", { verdict, ...(reason ? { discardReason: reason } : {}) }); }
     async getExecution(id) { return this.x.get(id) ?? null; }
     async listExecutions() { return [...this.x.values()]; }
     async settle(id, outcome, opts = {}) {
         const cur = this.rec(id);
-        assertSettlable(id, cur.state, outcome, !cur.evidenceError);
+        assertSettlable(id, cur.state, outcome, { hasObservedEvidence: !cur.evidenceError, workerStopped: opts.workerStopped });
         const at = new Date().toISOString();
-        const reconciled = { outcome, reason: opts.reason, at };
+        const reconciled = { outcome, reason: opts.reason, at, ...(opts.workerStopped ? { workerStopped: true } : {}) };
         this.x.set(id, outcome === "committed"
             ? { ...cur, state: "executed_unreported", evidence: opts.evidence ?? null, hasEvidence: true, evidenceSig: opts.evidenceSig, evidenceError: undefined, reconciled, at }
             : { ...cur, state: "parked", attemptId: null, error: undefined, reconciled, at });
     }
     async releasePreinvoke(id, attemptId) {
         const cur = this.rec(id);
-        if (rank(cur.state) >= rank("invoking"))
-            throw new Error(`[decidio] ${id}: refusing to release a claim after invocation began (state ${cur.state}).`);
+        if (NON_REPLAYABLE.includes(cur.state))
+            throw new Error(`[decidio] ${id}: refusing to release this decision — its durable state is ${cur.state}, which is terminal or past the invocation boundary. releasePreinvoke only ever releases a claim nothing has acted on.`);
         if (cur.attemptId && cur.attemptId !== attemptId)
             return;
         this.x.set(id, { ...cur, state: "parked", attemptId: null, at: new Date().toISOString() });
     }
 }
+export function windowsPrincipal() {
+    const sysRoot = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
+    for (const exe of [join(sysRoot, "System32", "whoami.exe"), "whoami"]) {
+        try {
+            const out = execFileSync(exe, ["/user", "/fo", "csv", "/nh"], { encoding: "utf8" });
+            const m = out.match(/S-1-[0-9-]+/);
+            if (m)
+                return `*${m[0]}`;
+        }
+        catch { }
+    }
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return process.env.USERNAME ?? process.env.USER ?? "";
+    }
+}
+export function hardenFile(file) {
+    if (process.platform !== "win32")
+        return null;
+    try {
+        const principal = windowsPrincipal();
+        if (!principal)
+            return "could not determine the current user";
+        execFileSync("icacls", [file, "/inheritance:r", "/grant:r", `${principal}:F`, "/grant:r", "*S-1-5-18:F"], { stdio: "ignore" });
+        try {
+            readFileSync(file, "utf8");
+        }
+        catch (verifyError) {
+            try {
+                execFileSync("icacls", [file, "/inheritance:e"], { stdio: "ignore" });
+            }
+            catch { }
+            return `the restriction applied but this process could no longer read the file (${verifyError?.message ?? verifyError}), so it was rolled back`;
+        }
+        return null;
+    }
+    catch (e) {
+        return String(e?.message ?? e);
+    }
+}
 export function hardenDir(dir) {
     if (process.platform !== "win32")
         return;
     const warn = (why) => console.warn(`[decidio] WARNING: could not restrict ${dir} to owner-only (${why}). It keeps the directory's inherited permissions, so other accounts on this machine may be able to read parked action arguments. Move the pending store to a protected location, or set DECIDIO_PENDING_DIR to one.`);
     try {
-        const sid = (() => {
-            const sysRoot = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
-            for (const exe of [join(sysRoot, "System32", "whoami.exe"), "whoami"]) {
-                try {
-                    const out = execFileSync(exe, ["/user", "/fo", "csv", "/nh"], { encoding: "utf8" });
-                    const m = out.match(/S-1-[0-9-]+/);
-                    if (m)
-                        return m[0];
-                }
-                catch { }
-            }
-            return null;
-        })();
-        const principal = sid ? `*${sid}` : (() => {
-            try {
-                return userInfo().username;
-            }
-            catch {
-                return process.env.USERNAME ?? process.env.USER ?? "";
-            }
-        })();
+        const principal = windowsPrincipal();
         if (!principal)
             throw new Error("could not determine the current user");
         execFileSync("icacls", [dir, "/inheritance:r", "/grant:r", `${principal}:(OI)(CI)F`, "/grant:r", "*S-1-5-18:(OI)(CI)F"], { stdio: "ignore" });
@@ -250,14 +321,40 @@ export class FilePendingStore {
             this.migrateLegacy();
         }
         catch (e) {
-            console.error(`[decidio] could not upgrade the 0.1.x pending layout in ${dir} (${e?.message ?? e}). Entries written by 0.1.x may not appear in recover() — inspect the directory before assuming it is empty.`);
+            console.error(`[decidio] could not upgrade the older pending layout in ${dir} (${e?.message ?? e}). Entries written by an older SDK may not appear in recover() — inspect the directory before assuming it is empty.`);
         }
     }
     key(id) { return id.replace(/[^\w.-]/g, "_"); }
     path(id) { return join(this.dir, `${this.key(id)}.json`); }
-    statePath(id, s) { return join(this.dir, `${this.key(id)}.${s}`); }
-    writeAtomic(file, text) {
-        const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    revPath(key, n) { return join(this.dir, `${key}.rev.${n}`); }
+    markerPath(key, s) { return join(this.dir, `${key}.${s}`); }
+    listRevs(key, names) {
+        const prefix = `${key}.rev.`;
+        const out = [];
+        if (!names) {
+            try {
+                names = readdirSync(this.dir);
+            }
+            catch {
+                return out;
+            }
+        }
+        for (const name of names) {
+            if (!name.startsWith(prefix))
+                continue;
+            const tail = name.slice(prefix.length);
+            if (tail.length && /^\d+$/.test(tail))
+                out.push(Number(tail));
+        }
+        return out;
+    }
+    legacyMarkers(key, names) {
+        if (names)
+            return EXECUTION_STATES.filter((s) => names.includes(`${key}.${s}`));
+        return EXECUTION_STATES.filter((s) => existsSync(this.markerPath(key, s)));
+    }
+    writeTemp(target, text) {
+        const tmp = `${target}.${process.pid}.${randomUUID()}.tmp`;
         const fd = openSync(tmp, "w", 0o600);
         try {
             writeFileSync(fd, text);
@@ -266,73 +363,141 @@ export class FilePendingStore {
         finally {
             closeSync(fd);
         }
+        return tmp;
+    }
+    writeAtomic(file, text) {
+        const tmp = this.writeTemp(file, text);
         renameSync(tmp, file);
     }
-    resolve(id) {
+    readHead(id, names) {
+        const key = this.key(id);
+        for (let tries = 0; tries < 4; tries++) {
+            const revs = this.listRevs(key, names);
+            const markers = this.legacyMarkers(key, names);
+            names = undefined;
+            if (revs.length === 0) {
+                if (markers.length === 0)
+                    return { rec: null, rev: 0, corrupt: [] };
+                const legacy = this.resolveLegacyMarkers(key);
+                return { rec: legacy.rec, rev: 0, corrupt: legacy.corrupt };
+            }
+            if (markers.length) {
+                return { rec: null, rev: Math.max(...revs), corrupt: markers.map((s) => `${this.markerPath(key, s)}: a legacy state marker beside the revision chain — written by an older SDK after this directory was upgraded, or left by an interrupted upgrade; the two cannot be reconciled automatically`) };
+            }
+            const top = Math.max(...revs);
+            const f = this.revPath(key, top);
+            try {
+                const r = JSON.parse(readFileSync(f, "utf8"));
+                if (!r || typeof r !== "object" || !EXECUTION_STATES.includes(r.state)) {
+                    return { rec: null, rev: top, corrupt: [`${f}: the record carries no recognised state (${JSON.stringify(r?.state ?? null)})`] };
+                }
+                return { rec: r, rev: top, corrupt: [] };
+            }
+            catch (e) {
+                if (e?.code === "ENOENT")
+                    continue;
+                return { rec: null, rev: top, corrupt: [`${f}: ${e?.message ?? e}`] };
+            }
+        }
+        return { rec: null, rev: 0, corrupt: [`${key}: the revision chain changed under every read attempt`] };
+    }
+    _barrier(_op, _id, _next) { }
+    transition(id, op, compute) {
+        const key = this.key(id);
+        for (let attempt = 0; attempt < 16; attempt++) {
+            const { rec, rev, corrupt } = this.readHead(id);
+            if (corrupt.length)
+                throw new DecidioStateCorruptError(id, corrupt);
+            const next = compute(rec, rev);
+            if (next === null)
+                return null;
+            this._barrier(op, id, next.state);
+            const target = this.revPath(key, rev + 1);
+            const tmp = this.writeTemp(target, JSON.stringify(next, null, 2));
+            try {
+                linkSync(tmp, target);
+            }
+            catch (e) {
+                try {
+                    rmSync(tmp);
+                }
+                catch { }
+                if (e?.code === "EEXIST")
+                    continue;
+                throw e;
+            }
+            try {
+                rmSync(tmp);
+            }
+            catch { }
+            return next;
+        }
+        throw new Error(`[decidio] ${id}: could not publish a state transition after 16 attempts — another writer kept winning the next revision. Retry, or look for a process writing this decision in a loop.`);
+    }
+    resolveLegacyMarkers(key) {
         const corrupt = [];
         let best = null;
+        let denial = null;
         for (const s of EXECUTION_STATES) {
-            const f = this.statePath(id, s);
+            const f = this.markerPath(key, s);
             if (!existsSync(f))
                 continue;
             try {
                 const r = JSON.parse(readFileSync(f, "utf8"));
                 if (!best || rank(s) >= rank(best.state))
                     best = { ...r, state: s };
+                if (s === "discarded")
+                    denial = { ...r, state: "discarded" };
             }
             catch (e) {
                 corrupt.push(`${f}: ${e.message}`);
             }
         }
-        return { rec: best, corrupt };
+        if (!denial)
+            return { rec: best, corrupt };
+        const ran = best && rank(best.state) >= rank("invoking") ? best : null;
+        return { rec: ran ? { ...denial, executionDespiteDenial: { state: ran.state, at: ran.at, hasEvidence: !!ran.hasEvidence } } : denial, corrupt };
     }
-    setState(id, attemptId, state, patch = {}) {
-        const { rec, corrupt } = this.resolve(id);
-        if (corrupt.length)
-            throw new DecidioStateCorruptError(id, corrupt);
-        const cur = rec ?? { decisionId: id, state: "parked", attemptId: null, at: new Date().toISOString() };
-        if (cur.attemptId && cur.attemptId !== attemptId && rank(cur.state) >= rank("invoking")) {
-            throw new DecidioStaleAttemptError(id, cur.attemptId, cur.state);
-        }
-        assertNotSettled(id, cur, state);
-        if (rank(state) < rank(cur.state)) {
-            throw new Error(`[decidio] ${id}: refusing to move ${cur.state} → ${state}; execution state only ever advances.`);
-        }
-        const next = { ...cur, ...patch, decisionId: id, attemptId, state, at: new Date().toISOString() };
-        this.writeAtomic(this.statePath(id, state), JSON.stringify(next, null, 2));
-        for (const s of EXECUTION_STATES) {
-            if (s === state)
-                continue;
-            if (rank(s) >= rank(state))
-                continue;
-            const f = this.statePath(id, s);
-            try {
-                if (existsSync(f))
-                    rmSync(f);
-            }
-            catch { }
-        }
+    setState(id, attemptId, state, patch = {}, pre) {
+        this.transition(id, "advance", (rec) => {
+            const cur = rec ?? { decisionId: id, state: "parked", attemptId: null, at: new Date().toISOString() };
+            pre?.(cur);
+            if (cur.attemptId && cur.attemptId !== attemptId)
+                throw new DecidioStaleAttemptError(id, cur.attemptId, cur.state);
+            assertNotDenied(id, cur, state);
+            assertNotSettled(id, cur, state);
+            if (rank(state) < rank(cur.state))
+                throw new Error(`[decidio] ${id}: refusing to move ${cur.state} → ${state}; execution state only ever advances.`);
+            return { ...cur, ...patch, decisionId: id, attemptId, state, at: new Date().toISOString() };
+        });
     }
     async put(p) {
         this.writeAtomic(this.path(p.decisionId), JSON.stringify(p, null, 2));
-        if (!this.resolve(p.decisionId).rec) {
-            this.writeAtomic(this.statePath(p.decisionId, "parked"), JSON.stringify({ decisionId: p.decisionId, state: "parked", attemptId: null, action: p.action, at: new Date().toISOString() }, null, 2));
-        }
+        this.transition(p.decisionId, "put", (cur) => cur ? null
+            : { decisionId: p.decisionId, state: "parked", attemptId: null, action: p.action, at: new Date().toISOString() });
     }
     async get(id) {
         const f = this.path(id);
         return existsSync(f) ? JSON.parse(readFileSync(f, "utf8")) : null;
     }
-    async delete(id) { try {
-        if (existsSync(this.path(id)))
-            rmSync(this.path(id));
+    async delete(id, attemptId) {
+        if (attemptId) {
+            const owner = this.readHead(id).rec?.attemptId;
+            if (owner && owner !== attemptId)
+                return;
+        }
+        try {
+            if (existsSync(this.path(id)))
+                rmSync(this.path(id));
+        }
+        catch { }
     }
-    catch { } }
     async list() {
         if (!existsSync(this.dir))
             return [];
         const out = [];
-        for (const f of readdirSync(this.dir).filter((f) => f.endsWith(".json"))) {
+        const names = readdirSync(this.dir);
+        for (const f of names.filter((f) => f.endsWith(".json"))) {
             let p;
             try {
                 p = JSON.parse(readFileSync(join(this.dir, f), "utf8"));
@@ -341,7 +506,7 @@ export class FilePendingStore {
                 console.error(`[decidio] skipping unreadable parked entry ${f} (${e.message}) — the other parked actions still resume; inspect or delete this file.`);
                 continue;
             }
-            const { rec } = this.resolve(p.decisionId);
+            const { rec } = this.readHead(p.decisionId, names);
             if (!rec || rec.state === "parked")
                 out.push(p);
         }
@@ -350,53 +515,41 @@ export class FilePendingStore {
     async claim(id, attemptId) {
         if (!existsSync(this.path(id)))
             return { ok: false, reason: "no parked entry" };
-        const { rec, corrupt } = this.resolve(id);
-        if (corrupt.length)
-            throw new DecidioStateCorruptError(id, corrupt);
-        const state = rec?.state ?? "parked";
-        if (NON_REPLAYABLE.includes(state))
-            return { ok: false, state, reason: `already ${state}` };
-        if (state === "claimed_preinvoke")
-            return { ok: false, state, reason: "claimed by another attempt" };
-        const target = this.statePath(id, "claimed_preinvoke");
-        const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
-        const payload = JSON.stringify({ decisionId: id, state: "claimed_preinvoke", attemptId, action: rec?.action, at: new Date().toISOString() }, null, 2);
-        const fd = openSync(tmp, "w", 0o600);
-        try {
-            writeFileSync(fd, payload);
-            fsyncSync(fd);
-        }
-        finally {
-            closeSync(fd);
-        }
-        try {
-            linkSync(tmp, target);
-        }
-        catch {
-            try {
-                rmSync(tmp);
+        let refusal = null;
+        this.transition(id, "claim", (cur) => {
+            const state = cur?.state ?? "parked";
+            if (NON_REPLAYABLE.includes(state)) {
+                refusal = { ok: false, state, reason: `already ${state}` };
+                return null;
             }
-            catch { }
-            return { ok: false, state: "claimed_preinvoke", reason: "lost the claim race" };
-        }
-        try {
-            rmSync(tmp);
-        }
-        catch { }
-        try {
-            const p = this.statePath(id, "parked");
-            if (existsSync(p))
-                rmSync(p);
-        }
-        catch { }
-        return { ok: true };
+            if (state === "claimed_preinvoke") {
+                refusal = { ok: false, state, reason: "claimed by another attempt" };
+                return null;
+            }
+            return { ...(cur ?? {}), decisionId: id, state: "claimed_preinvoke", attemptId, action: cur?.action, at: new Date().toISOString() };
+        });
+        return refusal ?? { ok: true };
+    }
+    async markInvoking(id, attemptId) {
+        this.setState(id, attemptId, "invoking", {}, (cur) => {
+            assertNotDenied(id, cur, "invoking");
+            assertClaimedBy(id, cur, attemptId);
+        });
     }
-    async markInvoking(id, attemptId) { this.setState(id, attemptId, "invoking"); }
     async recordExecuted(id, attemptId, evidence, evidenceSig, evidenceError) { this.setState(id, attemptId, "executed_unreported", { evidence, hasEvidence: true, evidenceSig, evidenceError }); }
     async markIndeterminate(id, attemptId, error) { this.setState(id, attemptId, "indeterminate", { error }); }
     async markReported(id, attemptId, confirmation) { this.setState(id, attemptId, "reported", { confirmation }); }
+    async markDiscarded(id, verdict, reason) {
+        this.transition(id, "discard", (rec) => {
+            const cur = rec ?? { decisionId: id, state: "parked", attemptId: null, at: new Date().toISOString() };
+            assertNotSettled(id, cur, "discarded");
+            if (rank("discarded") < rank(cur.state))
+                throw new Error(`[decidio] ${id}: refusing to move ${cur.state} → discarded; execution state only ever advances.`);
+            return { ...cur, decisionId: id, attemptId: cur.attemptId ?? "", state: "discarded", verdict, ...(reason ? { discardReason: reason } : {}), at: new Date().toISOString() };
+        });
+    }
     async getExecution(id) {
-        const { rec, corrupt } = this.resolve(id);
+        const { rec, corrupt } = this.readHead(id);
         if (corrupt.length)
             throw new DecidioStateCorruptError(id, corrupt);
         return rec;
@@ -404,21 +557,26 @@ export class FilePendingStore {
     async listExecutions() {
         if (!existsSync(this.dir))
             return [];
-        const ids = new Set();
-        for (const name of readdirSync(this.dir)) {
+        const keys = new Set();
+        const names = readdirSync(this.dir);
+        for (const name of names) {
+            const m = /^(.*)\.rev\.\d+$/.exec(name);
+            if (m) {
+                keys.add(m[1]);
+                continue;
+            }
             const dot = name.lastIndexOf(".");
             if (dot < 0)
                 continue;
             const suffix = name.slice(dot + 1);
-            if (!EXECUTION_STATES.includes(suffix))
-                continue;
-            ids.add(name.slice(0, dot));
+            if (EXECUTION_STATES.includes(suffix))
+                keys.add(name.slice(0, dot));
         }
         const out = [];
-        for (const key of ids) {
-            const { rec, corrupt } = this.resolve(key);
+        for (const key of keys) {
+            const { rec, corrupt } = this.readHead(key, names);
             if (corrupt.length) {
-                out.push({ decisionId: key, state: "indeterminate", attemptId: null, error: `state files unreadable — ${corrupt.join("; ")}`, at: new Date().toISOString() });
+                out.push({ decisionId: rec?.decisionId ?? key, state: "indeterminate", attemptId: null, error: `state files unreadable — ${corrupt.join("; ")}`, at: new Date().toISOString() });
                 continue;
             }
             if (rec)
@@ -427,54 +585,92 @@ export class FilePendingStore {
         return out;
     }
     async settle(id, outcome, opts = {}) {
-        const { rec, corrupt } = this.resolve(id);
-        if (corrupt.length)
-            throw new DecidioStateCorruptError(id, corrupt);
-        const cur = rec ?? { decisionId: id, state: "parked", attemptId: null, at: new Date().toISOString() };
-        assertSettlable(id, cur.state, outcome, !cur.evidenceError);
-        const at = new Date().toISOString();
-        const next = outcome === "committed"
-            ? { ...cur, state: "executed_unreported", evidence: opts.evidence ?? null, hasEvidence: true, evidenceSig: opts.evidenceSig, evidenceError: undefined, reconciled: { outcome, reason: opts.reason, at }, at }
-            : { ...cur, state: "parked", attemptId: null, error: undefined, reconciled: { outcome, reason: opts.reason, at }, at };
-        this.writeAtomic(this.statePath(id, next.state), JSON.stringify(next, null, 2));
-        for (const st of EXECUTION_STATES) {
-            if (st === next.state)
-                continue;
-            try {
-                const f = this.statePath(id, st);
-                if (existsSync(f))
-                    rmSync(f);
-            }
-            catch { }
-        }
+        this.transition(id, "settle", (rec) => {
+            const cur = rec ?? { decisionId: id, state: "parked", attemptId: null, at: new Date().toISOString() };
+            assertSettlable(id, cur.state, outcome, { hasObservedEvidence: !cur.evidenceError, workerStopped: opts.workerStopped });
+            const at = new Date().toISOString();
+            const reconciled = { outcome, reason: opts.reason, at, ...(opts.workerStopped ? { workerStopped: true } : {}) };
+            return outcome === "committed"
+                ? { ...cur, state: "executed_unreported", evidence: opts.evidence ?? null, hasEvidence: true, evidenceSig: opts.evidenceSig, evidenceError: undefined, reconciled, at }
+                : { ...cur, state: "parked", attemptId: null, error: undefined, reconciled, at };
+        });
     }
     async releasePreinvoke(id, attemptId) {
-        const { rec } = this.resolve(id);
-        const state = rec?.state ?? "parked";
-        if (rank(state) >= rank("invoking"))
-            throw new Error(`[decidio] ${id}: refusing to release a claim after invocation began (state ${state}).`);
-        if (rec?.attemptId && rec.attemptId !== attemptId)
-            return;
-        this.writeAtomic(this.statePath(id, "parked"), JSON.stringify({ decisionId: id, state: "parked", attemptId: null, action: rec?.action, at: new Date().toISOString() }, null, 2));
-        try {
-            const c = this.statePath(id, "claimed_preinvoke");
-            if (existsSync(c))
-                rmSync(c);
-        }
-        catch { }
+        this.transition(id, "release", (rec) => {
+            const state = rec?.state ?? "parked";
+            if (NON_REPLAYABLE.includes(state))
+                throw new Error(`[decidio] ${id}: refusing to release this decision — its durable state is ${state}, which is terminal or past the invocation boundary. releasePreinvoke only ever releases a claim nothing has acted on.`);
+            if (rec?.attemptId && rec.attemptId !== attemptId)
+                return null;
+            if (state === "parked")
+                return null;
+            return { ...(rec ?? {}), decisionId: id, state: "parked", attemptId: null, action: rec?.action, at: new Date().toISOString() };
+        });
     }
     migrateLegacy() {
         if (!existsSync(this.dir))
-            return { migrated: 0, indeterminate: 0, reports: 0 };
-        let migrated = 0, indeterminate = 0;
+            return { migrated: 0, indeterminate: 0, reports: 0, chained: 0 };
+        let migrated = 0, indeterminate = 0, chained = 0;
+        const markerKeys = new Set();
+        for (const name of readdirSync(this.dir)) {
+            const dot = name.lastIndexOf(".");
+            if (dot < 0)
+                continue;
+            if (EXECUTION_STATES.includes(name.slice(dot + 1)))
+                markerKeys.add(name.slice(0, dot));
+        }
+        for (const key of markerKeys) {
+            if (this.listRevs(key).length)
+                continue;
+            const present = this.legacyMarkers(key);
+            const { rec, corrupt } = this.resolveLegacyMarkers(key);
+            if (corrupt.length || !rec) {
+                console.error(`[decidio] ${key}: the older state marker(s) for this decision could not be read (${corrupt.join("; ") || "no readable marker"}) — left in place; the decision reads as unreadable until a person inspects it.`);
+                continue;
+            }
+            const target = this.revPath(key, 1);
+            const tmp = this.writeTemp(target, JSON.stringify(rec, null, 2));
+            try {
+                linkSync(tmp, target);
+                chained++;
+            }
+            catch (e) {
+                if (e?.code !== "EEXIST") {
+                    try {
+                        rmSync(tmp);
+                    }
+                    catch { }
+                    throw e;
+                }
+            }
+            try {
+                rmSync(tmp);
+            }
+            catch { }
+            for (const s of present) {
+                try {
+                    rmSync(this.markerPath(key, s));
+                }
+                catch { }
+            }
+        }
+        if (chained)
+            console.error(`[decidio] upgraded ${chained} decision${chained === 1 ? "" : "s"} from the one-marker-per-state layout to the revision chain. Do not run an older SDK against this directory again: it would write markers this layout refuses to read.`);
         for (const name of readdirSync(this.dir)) {
             if (name.endsWith(".claimed")) {
                 const key = name.slice(0, -".claimed".length);
                 try {
                     const p = JSON.parse(readFileSync(join(this.dir, name), "utf8"));
-                    this.writeAtomic(this.statePath(p.decisionId, "indeterminate"), JSON.stringify({ decisionId: p.decisionId, state: "indeterminate", attemptId: null, action: p.action, error: "upgraded from 0.1.x while claimed — whether it ran is not knowable; reconcile it", at: new Date().toISOString() }, null, 2));
+                    const published = this.transition(p.decisionId, "migrate", (cur) => cur && NON_REPLAYABLE.includes(cur.state) ? null : ({
+                        ...(cur ?? {}), decisionId: p.decisionId, state: "indeterminate", attemptId: null, action: p.action,
+                        error: "upgraded from 0.1.x while claimed — whether it ran is not knowable; reconcile it", at: new Date().toISOString(),
+                    }));
+                    if (published === null) {
+                        renameSync(join(this.dir, name), join(this.dir, `${name}.migrated`));
+                        continue;
+                    }
                     this.writeAtomic(this.path(p.decisionId), JSON.stringify(p, null, 2));
-                    rmSync(join(this.dir, name));
+                    renameSync(join(this.dir, name), join(this.dir, `${name}.migrated`));
                     indeterminate++;
                 }
                 catch {
@@ -488,9 +684,10 @@ export class FilePendingStore {
                 const p = JSON.parse(readFileSync(join(this.dir, name), "utf8"));
                 if (!p?.decisionId)
                     continue;
-                if (this.resolve(p.decisionId).rec)
+                if (this.readHead(p.decisionId).rec)
                     continue;
-                this.writeAtomic(this.statePath(p.decisionId, "parked"), JSON.stringify({ decisionId: p.decisionId, state: "parked", attemptId: null, action: p.action, at: new Date().toISOString() }, null, 2));
+                this.transition(p.decisionId, "migrate", (cur) => cur ? null
+                    : { decisionId: p.decisionId, state: "parked", attemptId: null, action: p.action, at: new Date().toISOString() });
                 migrated++;
             }
             catch { }
@@ -498,7 +695,7 @@ export class FilePendingStore {
         if (indeterminate)
             console.error(`[decidio] upgraded ${indeterminate} in-flight 0.1.x entr${indeterminate === 1 ? "y" : "ies"} to INDETERMINATE — they will not auto-run; review them with guard.resume.recover().`);
         const reports = this.migrateLegacyReports();
-        return { migrated, indeterminate, reports };
+        return { migrated, indeterminate, reports, chained };
     }
     migrateLegacyReports() {
         const reportsDir = join(this.dir, "reports");
@@ -513,17 +710,18 @@ export class FilePendingStore {
                 const e = JSON.parse(readFileSync(file, "utf8"));
                 if (!e?.decisionId)
                     continue;
-                const existing = this.resolve(e.decisionId).rec;
-                if (existing && rank(existing.state) >= rank("executed_unreported")) {
-                    renameSync(file, `${file}.migrated`);
-                    continue;
-                }
-                this.writeAtomic(this.statePath(e.decisionId, "executed_unreported"), JSON.stringify({
-                    decisionId: e.decisionId, state: "executed_unreported", attemptId: null, action: e.action,
+                const published = this.transition(e.decisionId, "migrate", (cur) => cur && (cur.state === "discarded" || rank(cur.state) >= rank("executed_unreported")) ? null : ({
+                    ...(cur ?? {}), decisionId: e.decisionId, state: "executed_unreported", attemptId: null, action: e.action,
                     evidence: e.reported, hasEvidence: true, migratedFrom: "0.1.x report journal",
                     at: e.at ?? new Date().toISOString(),
-                }, null, 2));
+                }));
                 renameSync(file, `${file}.migrated`);
+                if (published === null) {
+                    const head = this.readHead(e.decisionId).rec;
+                    if (head?.state === "discarded")
+                        console.error(`[decidio] ${e.decisionId}: a 0.1.x execution report was found for a decision that was DENIED (${head.verdict ?? "rejected"}). It has NOT been added to the ledger — a denial is terminal and this report will not be sent. The file is kept as ${file}.migrated: if that action really ran, check the downstream system and correct it there.`);
+                    continue;
+                }
                 moved++;
             }
             catch {
@@ -615,6 +813,7 @@ async function statusOf(cfg, decisionId) {
 const V2_STORE_METHODS = [
     "put", "get", "delete", "list",
     "claim", "markInvoking", "recordExecuted", "markIndeterminate", "markReported",
+    "markDiscarded",
     "getExecution", "listExecutions", "releasePreinvoke", "settle",
 ];
 function assertStoreV2(store) {
@@ -622,7 +821,7 @@ function assertStoreV2(store) {
     if (!missing.length)
         return;
     throw new Error(`[decidio] this PendingStore is missing ${missing.length} required method${missing.length === 1 ? "" : "s"}: ${missing.join(", ")}.\n` +
-        `  0.2.0 makes the durable execution state machine MANDATORY (parked → claimed_preinvoke → invoking → executed_unreported | indeterminate → reported).\n` +
+        `  The durable execution state machine is MANDATORY (parked → claimed_preinvoke → invoking → executed_unreported | indeterminate → reported, plus the terminal "discarded" that a denial writes).\n` +
         `  The 0.1.x contract left claim() optional and fell back to a process-local guard, which cannot survive a restart — so it never carried the single-execution guarantee it appeared to. A store that cannot record that invocation BEGAN cannot prevent a committed action from running twice.\n` +
         `  Fix: implement the missing methods (see the PendingStore docs), or use the shipped FilePendingStore / MemoryPendingStore. Nothing was started.`);
 }
@@ -632,6 +831,7 @@ function webhookBody(o) {
         ok: true,
         outcome: {
             status: o.status, decisionId: o.decisionId,
+            ...(o.reason ? { reason: o.reason } : {}),
             ...(o.reportRecorded !== undefined ? { reportRecorded: o.reportRecorded } : {}),
             ...(o.executionConfirmed !== undefined ? { executionConfirmed: o.executionConfirmed } : {}),
             ...(o.evidenceTier ? { evidenceTier: o.evidenceTier } : {}),
@@ -679,7 +879,7 @@ export function createDecidioResume(opts) {
                 if (e instanceof DecidioStaleAttemptError) {
                     console.warn(`[decidio] ${decisionId}: this action finished, but the decision is now owned by a newer attempt — it was released for retry while this one was still running. This attempt's report is NOT being sent; the owning attempt reports. Your action DID run: if that means it ran twice, the release was premature.`);
                     try {
-                        await ctrl.store.delete(decisionId);
+                        await ctrl.store.delete(decisionId, attemptId);
                     }
                     catch { }
                     return { ...base, reportRecorded: false, executionConfirmed: false, confirmationRetryable: false, reportJournalled: false, diagnostic: `${decisionId} was released to a newer attempt while this one was running; this attempt's report was not sent. If your action is not idempotent, note that it has now run more than once.` };
@@ -687,11 +887,15 @@ export function createDecidioResume(opts) {
                 if (e instanceof DecidioAlreadySettledError) {
                     console.warn(`[decidio] ${decisionId}: this action finished, but an operator had already reconciled the decision as committed and Decidio has that report. This attempt's own report is NOT being sent — one decision, one report. If your result differs from what was reconciled, correct it in Decidio; do NOT re-run the action.`);
                     try {
-                        await ctrl.store.delete(decisionId);
+                        await ctrl.store.delete(decisionId, attemptId);
                     }
                     catch { }
                     return { ...base, reportRecorded: true, executionConfirmed: false, reportJournalled: true, diagnostic: `an operator settled ${decisionId} as committed while this attempt was running; their report stands and this one was not sent.` };
                 }
+                if (e instanceof DecidioDeniedError) {
+                    console.error(`[decidio] ${decisionId}: this decision is DENIED, so no execution report will be sent. If your action nevertheless ran, your store let a refused decision reach the handler — treat that as a defect in the store, and correct the downstream effect by hand.`);
+                    return { ...base, reportRecorded: false, executionConfirmed: false, confirmationRetryable: false, reportJournalled: false, diagnostic: `${decisionId} is denied; no report was sent.` };
+                }
                 console.error(`[decidio] ${decisionId}: the action RAN but its execution report could NOT be recorded (${e?.message ?? e}). If the report also fails to send, this execution is NOT locally recoverable — record the outcome from your own system.`);
             }
         }
@@ -704,7 +908,7 @@ export function createDecidioResume(opts) {
         }
         const deletePending = async () => {
             try {
-                await ctrl.store.delete(decisionId);
+                await ctrl.store.delete(decisionId, attemptId);
             }
             catch (e) {
                 console.warn(`[decidio] ${decisionId}: the parked payload could not be removed (${e?.message ?? e}). This is cleanup only — the execution ledger already records this decision as executed, so no process can run it again; remove the row at your convenience.`);
@@ -732,7 +936,7 @@ export function createDecidioResume(opts) {
             };
         }
         if (ev.reportRecorded)
-            await ctrl.store.markReported(decisionId, attemptId, ev.evidenceTier ?? "recorded").catch(() => { });
+            await ctrl.store.markReported(decisionId, attemptId, tombstoneTier(ev)).catch(() => { });
         const diagnostic = buildProblem
             ? `${ev.diagnostic ? ev.diagnostic + " " : ""}Also: the action's return value was not reportable (${buildProblem}), so an empty response was reported - map it with the \`evidence\` option to earn a confirming tier.`
             : ev.diagnostic;
@@ -743,11 +947,11 @@ export function createDecidioResume(opts) {
         return { ...base, reportRecorded: ev.reportRecorded, executionConfirmed: ev.executionConfirmed, ...(ev.evidenceTier ? { evidenceTier: ev.evidenceTier } : {}), ...(ev.executionReportVerified !== undefined ? { executionReportVerified: ev.executionReportVerified } : {}), ...(ev.executionReportReason ? { executionReportReason: ev.executionReportReason } : {}), ...(ev.confirmationRetryable !== undefined ? { confirmationRetryable: ev.confirmationRetryable } : {}), reportJournalled: journalled, ...(buildProblem ? { evidenceError: buildProblem } : {}), ...(diagnostic ? { diagnostic } : {}) };
     }
     const refusalWarned = new Set();
-    const refuseOnce = (decisionId, msg) => {
+    const refuseOnce = (decisionId, msg, tail) => {
         if (refusalWarned.has(decisionId))
             return;
         refusalWarned.add(decisionId);
-        console.error(msg + " (This prints once — the entry stays parked until you act.)");
+        console.error(msg + (tail ?? " (This prints once — the entry stays parked until you act.)"));
     };
     const ctrl = {
         ...opts,
@@ -766,6 +970,9 @@ export function createDecidioResume(opts) {
             registry.set(action, { fn, evidence: evidence ?? prev?.evidence, withContext: withContext ?? prev?.withContext });
         },
         async park(p) {
+            const idProblem = decisionIdProblem(p.decisionId);
+            if (idProblem)
+                throw new DecidioUnsafeArgumentsError(`[decidio] refusing to park ${JSON.stringify(p.decisionId ?? null)}: it is not a decision id this SDK will act on (${idProblem}). Nothing was parked and nothing will execute - a decision id comes from the gate's answer, verbatim.`, typeof p.decisionId === "string" ? p.decisionId : "");
             try {
                 toCanonical(p.args, "args");
             }
@@ -780,16 +987,16 @@ export function createDecidioResume(opts) {
         async resolve({ decisionId, verdict, reason }) {
             const finish = (o) => { if (o.status !== "unknown")
                 opts.onResolved?.(o); return o; };
+            const idProblem = decisionIdProblem(decisionId);
+            if (idProblem)
+                return { status: "unknown", decisionId: String(decisionId ?? ""), reason: `not a decision id this SDK will act on (${idProblem})` };
             const pending = await ctrl.store.get(decisionId);
             if (!pending)
                 return { status: "unknown", decisionId };
-            if (verdict === "rejected") {
-                await ctrl.store.delete(decisionId);
-                return finish({ status: "rejected", decisionId, action: pending.action, reason });
-            }
-            if (verdict === "blocked") {
+            if (verdict === "rejected" || verdict === "blocked") {
+                await ctrl.store.markDiscarded(decisionId, verdict, reason);
                 await ctrl.store.delete(decisionId);
-                return finish({ status: "blocked", decisionId, action: pending.action, reason });
+                return finish({ status: verdict, decisionId, action: pending.action, reason });
             }
             if (verdict !== "approved" && verdict !== "auto_approved")
                 return { status: "unknown", decisionId };
@@ -827,7 +1034,9 @@ export function createDecidioResume(opts) {
             const claim = await ctrl.store.claim(decisionId, attemptId);
             if (!claim.ok) {
                 if (claim.state && NON_REPLAYABLE.includes(claim.state)) {
-                    refuseOnce(decisionId, `[decidio] REFUSING to execute ${decisionId}: its durable state is ${claim.state} — invocation already began, so re-running it could duplicate a committed effect. Inspect it with guard.resume.recover(); settle it with guard.resume.reconcile("${decisionId}", …).`);
+                    refuseOnce(decisionId, claim.state === "discarded"
+                        ? `[decidio] REFUSING to execute ${decisionId}: it was DENIED (${(await ctrl.store.getExecution(decisionId))?.verdict ?? "rejected"}) and that answer is final. Nothing ran. A denial cannot be reconciled or retried — if this action should now proceed, it needs a NEW request and a new approval.`
+                        : `[decidio] REFUSING to execute ${decisionId}: its durable state is ${claim.state} — invocation already began, so re-running it could duplicate a committed effect. Inspect it with guard.resume.recover(); settle it with guard.resume.reconcile("${decisionId}", …).`, claim.state === "discarded" ? " (This prints once. The decision is closed — no action is needed.)" : undefined);
                     return finish({ status: claim.state === "indeterminate" ? "indeterminate" : "unknown", decisionId, action: pending.action, reason: claim.reason });
                 }
                 return { status: "unknown", decisionId };
@@ -877,7 +1086,7 @@ export function createDecidioResume(opts) {
                         }
                         const body = JSON.parse(raw || "{}");
                         const verdict = body.verdict;
-                        const outcome = await ctrl.resolve({ decisionId: String(body.decisionId), verdict, reason: body.reason });
+                        const outcome = await ctrl.resolve({ decisionId: body.decisionId, verdict, reason: body.reason });
                         res.statusCode = 200;
                         res.setHeader("content-type", "application/json");
                         res.end(JSON.stringify(webhookBody(outcome)));
@@ -903,7 +1112,7 @@ export function createDecidioResume(opts) {
                 }
                 try {
                     const body = JSON.parse(raw || "{}");
-                    const outcome = await ctrl.resolve({ decisionId: String(body.decisionId), verdict: body.verdict, reason: body.reason });
+                    const outcome = await ctrl.resolve({ decisionId: body.decisionId, verdict: body.verdict, reason: body.reason });
                     return new Response(JSON.stringify(webhookBody(outcome)), { status: 200, headers: { "content-type": "application/json" } });
                 }
                 catch (e) {
@@ -912,6 +1121,9 @@ export function createDecidioResume(opts) {
             };
         },
         async reconcile(decisionId, opts) {
+            const idProblem = decisionIdProblem(decisionId);
+            if (idProblem)
+                return { reportRecorded: false, executionConfirmed: false, diagnostic: `${JSON.stringify(decisionId ?? null)} is not a decision id this SDK will act on (${idProblem}). Nothing was settled.` };
             let entry;
             try {
                 entry = await ctrl.store.getExecution(decisionId);
@@ -933,7 +1145,7 @@ export function createDecidioResume(opts) {
                 ? signEvidence(decisionId, entry.attemptId ?? null, settleEvidence, ctrl.agentKey, ctrl.webhookSecret)
                 : undefined;
             try {
-                await ctrl.store.settle(decisionId, opts.outcome, { evidence: settleEvidence, reason: opts.reason, evidenceSig: settleSig });
+                await ctrl.store.settle(decisionId, opts.outcome, { evidence: settleEvidence, reason: opts.reason, evidenceSig: settleSig, workerStopped: opts.workerStopped });
             }
             catch (e) {
                 return { reportRecorded: false, executionConfirmed: false, diagnostic: `${e?.message ?? e}` };
@@ -957,13 +1169,16 @@ export function createDecidioResume(opts) {
                 return { reportRecorded: false, executionConfirmed: false, diagnostic: `the reconciled report for ${decisionId} did not reach Decidio (${e?.message ?? e}). The evidence IS recorded locally — call reconfirm("${decisionId}") when the service is healthy. Do NOT re-run the action.` };
             }
             if (ev.reportRecorded)
-                await ctrl.store.markReported(decisionId, entry.attemptId ?? "reconcile", ev.evidenceTier ?? "recorded").catch(() => { });
+                await ctrl.store.markReported(decisionId, entry.attemptId ?? "reconcile", tombstoneTier(ev)).catch(() => { });
             return {
                 ...ev,
                 diagnostic: `${ev.diagnostic ? `${ev.diagnostic} ` : ""}This report was RECONCILED BY AN OPERATOR${opts.reason ? ` (${opts.reason})` : ""}, not observed by the SDK: its tier reflects the evidence you supplied, not a return value this process saw.`,
             };
         },
         async reconfirm(decisionId, opts) {
+            const idProblem = decisionIdProblem(decisionId);
+            if (idProblem)
+                return { reportRecorded: false, executionConfirmed: false, diagnostic: `${JSON.stringify(decisionId ?? null)} is not a decision id this SDK will act on (${idProblem}). Nothing was sent.` };
             let entry;
             try {
                 entry = await ctrl.store.getExecution(decisionId);
@@ -972,11 +1187,20 @@ export function createDecidioResume(opts) {
                 return { reportRecorded: false, executionConfirmed: false, diagnostic: `the durable state for ${decisionId} could not be read (${e?.message ?? e}). Refusing to guess whether it executed — inspect the store; do NOT re-run the action to find out.` };
             }
             if (entry?.state === "reported") {
-                return { reportRecorded: true, executionConfirmed: false, evidenceTier: entry.confirmation, diagnostic: `${decisionId} was already reported (${entry.confirmation ?? "recorded"}) — nothing to re-send.` };
+                const confirmed = tierConfirms(entry.confirmation);
+                return { reportRecorded: true, executionConfirmed: confirmed, evidenceTier: entry.confirmation, diagnostic: `${decisionId} was already reported (${entry.confirmation ?? "recorded"}${confirmed ? ", a confirming tier" : ", not a confirming tier"}) — nothing to re-send.` };
             }
             if (entry?.state === "indeterminate") {
                 return { reportRecorded: false, executionConfirmed: false, diagnostic: `${decisionId} is INDETERMINATE: it was invoked and its outcome is unknown, so there is no captured result to re-send. Settle it with reconcile("${decisionId}", …) once you have checked the downstream system.` };
             }
+            if (entry?.state === "discarded") {
+                return {
+                    reportRecorded: false, executionConfirmed: false,
+                    diagnostic: entry.executionDespiteDenial
+                        ? `${decisionId} was DENIED (${entry.verdict ?? "rejected"}), and this store ALSO holds an execution marker for it (${entry.executionDespiteDenial.state} at ${entry.executionDespiteDenial.at}). A denial is terminal, so no report will be sent for it — but something may have run. Check the downstream system and correct it there; do NOT re-run the action.`
+                        : `${decisionId} was DENIED (${entry.verdict ?? "rejected"}) and nothing ran, so there is no execution report to send. A denial cannot be reconciled or retried.`,
+                };
+            }
             if (!entry || !entry.hasEvidence) {
                 return {
                     reportRecorded: false, executionConfirmed: false,
@@ -1013,17 +1237,18 @@ export function createDecidioResume(opts) {
                 return { reportRecorded: false, executionConfirmed: false, diagnostic: `the execution report for ${decisionId} still did not reach Decidio (${e?.message ?? e}). The recorded evidence is KEPT — call reconfirm("${decisionId}") again when the service is healthy. Your action already ran; do NOT re-run it.` };
             }
             if (ev.reportRecorded)
-                await ctrl.store.markReported(decisionId, entry.attemptId ?? "reconfirm", ev.evidenceTier ?? "recorded").catch(() => { });
+                await ctrl.store.markReported(decisionId, entry.attemptId ?? "reconfirm", tombstoneTier(ev)).catch(() => { });
             return ev;
         },
         async recover() {
             const items = [];
-            const execs = await ctrl.store.listExecutions().catch((e) => {
-                console.error(`[decidio] recover(): the execution ledger could not be read (${e?.message ?? e}). Nothing is reported rather than reporting a falsely empty recovery list.`);
-                return null;
-            });
-            if (execs === null)
-                return items;
+            let execs;
+            try {
+                execs = await ctrl.store.listExecutions();
+            }
+            catch (e) {
+                throw new DecidioRecoveryUnavailableError(e);
+            }
             for (const r of execs) {
                 const a = r.action ?? "(unknown action)";
                 switch (r.state) {
@@ -1037,7 +1262,7 @@ export function createDecidioResume(opts) {
                         break;
                     case "invoking":
                         items.push({ decisionId: r.decisionId, action: r.action, state: "indeterminate",
-                            guidance: `"${a}" was invoked at ${r.at} and this process died before recording the outcome, so whether it ran is unknown locally. It will NOT be retried automatically — reconcile it as above.` });
+                            guidance: `"${a}" was invoked at ${r.at} by attempt ${r.attemptId ?? "(unknown)"} and no outcome has been recorded since. That does NOT mean the worker died — it may still be running this action. It will not be retried automatically. Check that worker first: if it is gone, settle it with { outcome: "committed", evidence: … } once you have checked the downstream system, or release it with { outcome: "not_committed", reason: …, workerStopped: true }.` });
                         break;
                     case "claimed_preinvoke":
                         items.push({ decisionId: r.decisionId, action: r.action, state: "claimed_stalled",
@@ -1046,6 +1271,12 @@ export function createDecidioResume(opts) {
                     case "parked":
                         items.push({ decisionId: r.decisionId, action: r.action, state: "parked", guidance: `"${a}" is parked awaiting a human decision. Nothing has executed.` });
                         break;
+                    case "discarded":
+                        if (r.executionDespiteDenial) {
+                            items.push({ decisionId: r.decisionId, action: r.action, state: "denied_with_evidence",
+                                guidance: `"${a}" was DENIED (${r.verdict ?? "rejected"})${r.discardReason ? ` — ${r.discardReason}` : ""}, but this store also holds an execution marker for it (${r.executionDespiteDenial.state} at ${r.executionDespiteDenial.at}${r.executionDespiteDenial.hasEvidence ? ", with a captured result" : ""}). Nothing will run it and nothing will report it — a denial is terminal and cannot be reconciled. CHECK THE DOWNSTREAM SYSTEM: if the action really ran, correct it there.` });
+                        }
+                        break;
                     case "reported":
                         break;
                 }