@k2b/cloud 0.39.0 → 0.40.0

package/src/ai/action-review.ts

@@ -0,0 +1,101 @@
+import type {
+  CapabilityActionCallReview,
+  CapabilityActionPolicy,
+  CapabilityActionReceipt,
+  CapabilityActionReview,
+  CapabilityActionReviewData,
+  CapabilitySemanticLink,
+} from "../contracts/capabilities";
+
+/**
+ * What the chat stores about one Action call so that a reload shows the same question and receipt even after the app
+ * changed: the app's per-call review as it was when Cloud asked, or, for an app that still returns the old review shape,
+ * that review as literal text. Pure and browser-safe: the server stores it, the chat renders it.
+ */
+
+/** One old review detail: a label and its value, kept complete. */
+export type AiLegacyReviewRow = { label: string; value: string; format?: "date" | "date-time" };
+
+/**
+ * An old review (`message`, `details`, `links`) kept as literal text, never as a template: the message is the question,
+ * every inline or plain-text detail is a row without the 12-row bound, Markdown details are one Markdown block, and
+ * `summary` is the old success summary used as the receipt text.
+ */
+export type AiLegacyActionReview = {
+  legacy: {
+    question: string;
+    rows: AiLegacyReviewRow[];
+    markdown?: string;
+    summary?: string;
+    links?: CapabilitySemanticLink[];
+  };
+};
+
+/** A new review, with `ask` filled from the declared policy when the call itself names no reason. */
+export type AiStoredActionReview = CapabilityActionCallReview | AiLegacyActionReview;
+
+export const isLegacyActionReview = (review: AiStoredActionReview): review is AiLegacyActionReview => "legacy" in review;
+
+/** The old review shape as stored literal text. */
+export const legacyActionReview = (review: CapabilityActionReview): AiLegacyActionReview => {
+  const details = review.details ?? [];
+  // One Markdown block, each detail under its own label, so a reader keeps knowing which text belongs where.
+  const markdown = details
+    .filter((detail) => detail.format === "markdown" && detail.value.trim())
+    .map((detail) => `**${detail.label.replace(/([\\*_`[\]])/g, "\\$1")}**\n\n${detail.value}`)
+    .join("\n\n");
+  return {
+    legacy: {
+      question: review.message,
+      rows: details
+        .filter((detail) => detail.format !== "markdown")
+        .map((detail) => ({
+          label: detail.label,
+          value: detail.value,
+          ...(detail.format === "date" || detail.format === "date-time" ? { format: detail.format } : {}),
+        })),
+      ...(markdown ? { markdown } : {}),
+      ...(review.links?.length ? { links: review.links } : {}),
+    },
+  };
+};
+
+/** The review Cloud stores and shows for one call. */
+export const storedActionReview = (review: CapabilityActionReviewData, policy?: CapabilityActionPolicy | null): AiStoredActionReview => {
+  if (!("sentence" in review)) return legacyActionReview(review);
+  if (review.ask || !policy || !("ask" in policy)) return review;
+  return { ...review, ask: policy.ask };
+};
+
+/**
+ * The app's `check` Query after an outcome Cloud could not see. `checking` while it runs; `done` and `not_done` settle
+ * the call; `pending` means the app does not know yet; `failed` means the check itself gave no usable answer.
+ */
+export type AiActionCheckState = "checking" | "done" | "not_done" | "pending" | "failed";
+export type AiActionCheck = { state: AiActionCheckState; receipt?: CapabilityActionReceipt; at?: string };
+
+/** A settled outcome survives an open response; otherwise prefer the later timestamp, or incoming without both. */
+export const preferredActionCheck = (current: AiActionCheck | undefined, incoming: AiActionCheck): AiActionCheck => {
+  if (!current) return incoming;
+  const currentSettled = current.state === "done" || current.state === "not_done";
+  const incomingSettled = incoming.state === "done" || incoming.state === "not_done";
+  if (currentSettled !== incomingSettled) return currentSettled ? current : incoming;
+  return current.at && incoming.at && Date.parse(current.at) > Date.parse(incoming.at) ? current : incoming;
+};
+
+/** The framework's unknown-outcome codes, in persisted `CODE: message` or structured error results. */
+export const isUnknownActionOutcome = (result: unknown): boolean => {
+  const code =
+    typeof result === "string"
+      ? /^([A-Z][A-Z0-9_]{2,}):/.exec(result.trim())?.[1]
+      : result !== null && typeof result === "object" && "code" in result && typeof result.code === "string"
+        ? result.code
+        : undefined;
+  return code === "ACTION_OUTCOME_UNKNOWN" || code === "IDEMPOTENCY_UNCERTAIN" || code === "IDEMPOTENCY_IN_PROGRESS";
+};
+
+/**
+ * A `checking` claim older than this belonged to a worker or request that stopped and is open again: twice a Query's
+ * 15-second budget, plus a margin. Core takes such a claim over, and the card offers to check again.
+ */
+export const AI_TOOL_CHECK_STALE_MS = 2 * 15_000 + 30_000;

package/src/ai/background-review.ts

@@ -0,0 +1,72 @@
+import type { CapabilityActionPolicy, CapabilityActionReviewData } from "../contracts/capabilities";
+import { aiChatTasks } from "./chat-tasks";
+
+export class AiBackgroundApprovalRequiredError extends Error {
+  readonly code = "NEEDS_APPROVAL";
+
+  constructor(readonly action: string) {
+    super(
+      `NEEDS_APPROVAL: ${action} needs the user's approval every time, and routines never ask. Stop and say in one sentence what was missing.`,
+    );
+    this.name = "AiBackgroundApprovalRequiredError";
+  }
+}
+
+type BackgroundActionInput = {
+  turnId: string;
+  mandate: { id: string; revision: number };
+  appId: string;
+  capabilityId: string;
+  kind: "query" | "action";
+  args: unknown;
+  policy?: CapabilityActionPolicy;
+  approval?: "none" | "rememberable" | "always";
+  hasReview: boolean;
+  action: string;
+  review: () => Promise<CapabilityActionReviewData | null>;
+  signal?: AbortSignal;
+};
+
+/** Core routine gate. A review can narrow a mandate, never grant authority. */
+export const authorizeBackgroundActionWith = async (
+  input: BackgroundActionInput,
+  authorizeCapability: typeof aiChatTasks.authorizeCapability,
+): Promise<CapabilityActionReviewData | null> => {
+  // These declarations can never be granted to a routine. Stop with the approval state even if a stale grant exists.
+  if (input.kind === "action" && input.policy && (!("silent" in input.policy) || input.policy.routines === false)) {
+    await aiChatTasks.markNeedsApproval({ turnId: input.turnId, action: input.action });
+    throw new AiBackgroundApprovalRequiredError(input.action);
+  }
+  await authorizeCapability({
+    mandate: input.mandate,
+    appId: input.appId,
+    capabilityId: input.capabilityId,
+    kind: input.kind,
+    input: input.args,
+    approval: input.approval,
+    ...(input.policy ? { policy: input.policy } : {}),
+  });
+  if (input.kind === "query" || (!input.policy && input.approval === "none")) return null;
+  input.signal?.throwIfAborted();
+  if (!input.policy && input.approval !== "rememberable") {
+    await aiChatTasks.markNeedsApproval({ turnId: input.turnId, action: input.action });
+    throw new AiBackgroundApprovalRequiredError(input.action);
+  }
+  let review: CapabilityActionReviewData | null = null;
+  if (input.hasReview && !input.signal?.aborted) {
+    try {
+      review = await input.review();
+    } catch {
+      // An unavailable review cannot authorize an unattended effect.
+      input.signal?.throwIfAborted();
+    }
+  }
+  input.signal?.throwIfAborted();
+  if (review && (input.policy ? "sentence" in review && review.ask === undefined : !("sentence" in review) && review.approvalScope))
+    return review;
+  await aiChatTasks.markNeedsApproval({ turnId: input.turnId, action: input.action });
+  throw new AiBackgroundApprovalRequiredError(input.action);
+};
+
+export const authorizeBackgroundAction = (input: BackgroundActionInput): Promise<CapabilityActionReviewData | null> =>
+  authorizeBackgroundActionWith(input, aiChatTasks.authorizeCapability);

package/src/ai/capabilities.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import type { Tool, ToolContext, ToolResolver } from "@k2b/nessi";
 import { z } from "zod";
 import { resolveCapabilityActionWording, resolveCapabilityOperationTitle } from "../_internal/capabilities";
+import { capabilityReviewView } from "../_internal/capability-reviews";
 import {
   CAPABILITY_APPROVAL_REASON_FIELD,
   CAPABILITY_APPROVAL_REASON_MAX_CHARS,
@@ -13,8 +14,9 @@ import {
 import { HELP_READ_MAX_CHARS, HELP_SEARCH_MAX_LIMIT, readHelpArticle } from "../_internal/help-catalog";
 import {
   type CapabilityActionManifest,
-  type CapabilityActionReview,
+  type CapabilityActionReviewData,
   type CapabilityQueryManifest,
+  capabilityActionPolicy,
   cloudResourceRefAppId,
   LinkedCloudResourceReferenceSchema,
   resolveCapabilityResourceReader,
@@ -756,9 +758,14 @@ export const createLoadedAiCapabilityTools = (input: {
   actor: RequestActor;
   /** Locale of the turn; the approval text a person reads is worded in it. */
   locale?: string;
-  review?: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<CapabilityActionReview | null>;
-  authorizeBackground?: (entry: AiCapabilityCatalogEntry, args: unknown) => Promise<void>;
-  onReview?: (callId: string, review: CapabilityActionReview) => void;
+  review?: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<CapabilityActionReviewData | null>;
+  authorizeBackground?: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<void>;
+  onReview?: (
+    callId: string,
+    review: CapabilityActionReviewData,
+    approval: CapabilityActionManifest["approval"],
+    entry: AiCapabilityCatalogEntry,
+  ) => void | Promise<void>;
   execute: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<unknown>;
 }): AiRuntimeTool[] => {
   const byName = new Map(input.catalog.map((entry) => [entry.name, entry]));
@@ -769,7 +776,7 @@ export const createLoadedAiCapabilityTools = (input: {
       defineAiTool({
         name: entry.providerName,
         canonicalName: entry.name,
-        description: `${entry.title}. ${entry.description} Never retry ACTION_OUTCOME_UNKNOWN. Do not retry unchanged after INTERNAL or INVALID_APP_RESPONSE; report the provider error.`,
+        description: `${entry.title}. ${entry.description} Never retry ACTION_OUTCOME_UNKNOWN or NEEDS_APPROVAL. Never retry IDEMPOTENCY_UNCERTAIN or IDEMPOTENCY_IN_PROGRESS. After ACTION_NOT_DONE, ask the person before trying again. Do not retry unchanged after INTERNAL or INVALID_APP_RESPONSE; report the provider error.`,
         inputSchema: aiCapabilityInputSchema(
           offersApprovalReason(entry) ? withApprovalReason(entry.operation.inputSchema) : entry.operation.inputSchema,
         ),
@@ -779,16 +786,21 @@ export const createLoadedAiCapabilityTools = (input: {
         approval: "never",
       }).server(async (modelArgs, context) => {
         const args = withoutApprovalReason(entry, modelArgs);
-        await input.authorizeBackground?.(entry, args);
+        await input.authorizeBackground?.(entry, args, context);
         if (!input.authorizeBackground && entry.kind === "action" && (entry.operation as CapabilityActionManifest).approval !== "none") {
           const review = (await input.review?.(entry, args, context)) ?? null;
-          if (review && context.callId) input.onReview?.(context.callId, review);
+          if (review && context.callId)
+            await input.onReview?.(context.callId, review, "approval" in entry.operation ? entry.operation.approval : undefined, entry);
           // Text-only readers such as the CLI read what the card shows: the app's sentence, its review, and the model's reason.
           const locale = input.locale ?? DEFAULT_LOCALE;
           const message = capabilityApprovalText({
             appName: entry.display.appName,
             subject: capabilityActionSubject(aiCapabilityActionWording(entry, locale), args, { locale, timeZone: context.timeZone }),
-            review: review?.message,
+            review: review
+              ? capabilityReviewView(review, {
+                  timeZone: context.timeZone ?? "UTC",
+                }).message
+              : undefined,
             reason: offersApprovalReason(entry) ? capabilityApprovalReason(modelArgs) : null,
             locale,
           });
@@ -873,9 +885,14 @@ export const createAiToolResolver =
     locale?: string;
     maxLoadedTools?: number;
     execute?: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<unknown>;
-    review?: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<CapabilityActionReview | null>;
-    authorizeBackground?: (entry: AiCapabilityCatalogEntry, args: unknown) => Promise<void>;
-    onReview?: (callId: string, review: CapabilityActionReview) => void;
+    review?: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<CapabilityActionReviewData | null>;
+    authorizeBackground?: (entry: AiCapabilityCatalogEntry, args: unknown, context: ToolContext) => Promise<void>;
+    onReview?: (
+      callId: string,
+      review: CapabilityActionReviewData,
+      approval: CapabilityActionManifest["approval"],
+      entry: AiCapabilityCatalogEntry,
+    ) => void | Promise<void>;
     onPrepared?: (snapshot: {
       prepared: PreparedAiTools;
       presentations: Map<string, AiToolPresentation>;
@@ -907,6 +924,7 @@ export const createAiToolResolver =
           capabilityId: entry.operation.localId,
           kind: entry.kind,
           approval: entry.kind === "action" && "approval" in entry.operation ? entry.operation.approval : undefined,
+          capabilityPolicy: capabilityActionPolicy(entry.app.manifest, entry.operation.localId),
         }));
     const mandateExcluded = new Set(
       fullCapabilityCatalog.filter((entry) => !mandateAllows(entry)).flatMap((entry) => [entry.name, entry.providerName]),

package/src/ai/capability-execution.ts

@@ -1,8 +1,15 @@
 import { createHash } from "node:crypto";
 import type { ToolContext } from "@k2b/nessi";
+import { capabilityActionReceiptIssues, capabilityQueryChecksActionOutcome } from "../_internal/capability-reviews";
 import { type CapabilityDispatchDependencies, dispatchCapability } from "../api/capabilities";
 import { capabilityValueMeta, recordCapabilityExecution } from "../capabilities/executions";
-import { type CapabilityActionManifest, type CapabilityActionReview, CapabilityActionReviewSchema } from "../contracts/capabilities";
+import {
+  type CapabilityActionCallReview,
+  CapabilityActionCheckSchema,
+  type CapabilityActionManifest,
+  type CapabilityActionReviewData,
+  CapabilityActionReviewDataSchema,
+} from "../contracts/capabilities";
 import type { RequestActor } from "../server";
 import type { AccessSubject } from "../server/services/access";
 import { isAccountCategoryAllowed } from "../services/account-category-policy";
@@ -10,10 +17,14 @@ import { isAccountExpired } from "../services/account-model";
 import { accounts } from "../services/accounts";
 import { withoutAdminRole } from "../services/session/user";
 import { LOCALE_HEADER } from "../shared/locale";
+import type { AiActionCheck } from "./action-review";
 import type { AiCapabilityCatalogEntry } from "./capabilities";
+import { AiCapabilityExecutionError } from "./capability-result";
 import { aiToolAudit } from "./tool-audit";
 import type { AiConversationService } from "./types";
 
+export { AiCapabilityExecutionError, aiCapabilityCheckResult } from "./capability-result";
+
 type CapabilityActor = Extract<RequestActor, { kind: "user" }>;
 
 export const resolveAiCapabilityActor = async (input: {
@@ -38,17 +49,6 @@ export const resolveAiCapabilityActor = async (input: {
   return { actor: { kind: "user", user }, accessSubject: { type: "user", userId: user.id } };
 };
 
-export class AiCapabilityExecutionError extends Error {
-  constructor(
-    readonly code: string,
-    readonly status: number,
-    message: string,
-  ) {
-    super(`${code}: ${message}`);
-    this.name = "AiCapabilityExecutionError";
-  }
-}
-
 const idempotencyKey = (conversationId: string, callId: string): string =>
   `ai-${createHash("sha256").update(`${conversationId}\0${callId}`).digest("hex")}`;
 
@@ -71,13 +71,13 @@ const validationIssueText = (details: unknown): string => {
   return issues.length > 0 ? ` Input issues: ${issues.join("; ")}` : "";
 };
 
-const parseCapabilityResponse = async (response: Response): Promise<unknown> => {
+const parseCapabilityResponse = async (response: Response, dispatched: boolean): Promise<unknown> => {
   const body = (await response.json().catch(() => null)) as { code?: unknown; message?: unknown; details?: unknown } | null;
   if (response.ok) return body;
   const code = typeof body?.code === "string" ? body.code : "CAPABILITY_FAILED";
   const message = typeof body?.message === "string" ? body.message : "Capability execution failed";
   const issueText = code === "VALIDATION_FAILED" ? validationIssueText(body?.details) : "";
-  throw new AiCapabilityExecutionError(code, response.status, `${message}${issueText}`);
+  throw new AiCapabilityExecutionError(code, response.status, `${message}${issueText}`, dispatched);
 };
 
 type AiCapabilityCall = {
@@ -96,7 +96,10 @@ type AiCapabilityCall = {
   };
 };
 
-const dispatchAiCapability = async (input: AiCapabilityCall, review: boolean): Promise<unknown> => {
+const dispatchAiCapability = async (
+  input: Omit<AiCapabilityCall, "context"> & { context: Pick<ToolContext, "callId" | "signal"> },
+  review: boolean,
+): Promise<unknown> => {
   if (input.authority.accessSubject.type !== "user" || input.authority.accessSubject.userId !== input.authority.actor.user.id) {
     throw new Error("Cloud capability authority is inconsistent.");
   }
@@ -128,41 +131,71 @@ const dispatchAiCapability = async (input: AiCapabilityCall, review: boolean): P
     headers,
     signal: input.context.signal,
   });
-  return await parseCapabilityResponse(
-    await dispatch({
-      request,
-      kind: input.entry.kind === "query" ? "queries" : "actions",
-      origin: "assistant",
-      review,
-      appId: input.entry.appId,
-      capabilityId: input.entry.operation.localId,
-      input: input.args,
-      authority: {
-        actor: input.authority.actor,
-        accessSubject: input.authority.accessSubject,
-        credentialKind: "session",
-        scopes: [],
-      },
-      mandate: input.mandate
-        ? {
-            mandateId: input.mandate.id,
-            mandateRevision: input.mandate.revision,
-            ownerAppId: "core",
-            ...(!review && input.actionApproval ? { actionApproval: input.actionApproval } : {}),
-          }
-        : undefined,
-      dependencies: input.dependencies,
-    }),
-  );
+  let dispatched = false;
+  const response = await dispatch({
+    request,
+    kind: input.entry.kind === "query" ? "queries" : "actions",
+    origin: "assistant",
+    review,
+    appId: input.entry.appId,
+    capabilityId: input.entry.operation.localId,
+    input: input.args,
+    authority: {
+      actor: input.authority.actor,
+      accessSubject: input.authority.accessSubject,
+      credentialKind: "session",
+      scopes: [],
+    },
+    mandate: input.mandate
+      ? {
+          mandateId: input.mandate.id,
+          mandateRevision: input.mandate.revision,
+          ownerAppId: "core",
+          ...(!review && input.actionApproval ? { actionApproval: input.actionApproval } : {}),
+        }
+      : undefined,
+    dependencies: input.dependencies,
+    onUpstreamAttempt: () => {
+      dispatched = true;
+    },
+  });
+  return await parseCapabilityResponse(response, dispatched);
 };
 
-export const reviewAiCapability = async (input: AiCapabilityCall): Promise<CapabilityActionReview | null> => {
+export const reviewAiCapability = async (input: AiCapabilityCall): Promise<CapabilityActionReviewData | null> => {
   if (input.entry.kind !== "action" || !(input.entry.operation as CapabilityActionManifest).review) return null;
-  return CapabilityActionReviewSchema.parse(await dispatchAiCapability(input, true));
+  return CapabilityActionReviewDataSchema.parse(await dispatchAiCapability(input, true));
 };
 
 export const executeAiCapability = (input: AiCapabilityCall): Promise<unknown> => dispatchAiCapability(input, false);
 
+/** Run only the app-owned read-only outcome Query, once. Invalid answers stay unknown and remain recoverable. */
+export const checkAiCapability = async (
+  input: Omit<AiCapabilityCall, "args" | "actionApproval" | "context"> & {
+    context: Pick<ToolContext, "callId" | "signal">;
+    check: NonNullable<CapabilityActionCallReview["check"]>;
+    /** The app's catalog, in which the check Query is looked up; the caller builds it (no import cycle). */
+    catalog: readonly AiCapabilityCatalogEntry[];
+  },
+): Promise<AiActionCheck> => {
+  try {
+    const query = input.catalog.find(
+      (entry) => entry.appId === input.entry.appId && entry.kind === "query" && entry.operation.localId === input.check.query,
+    );
+    if (!query || "idempotency" in query.operation || !capabilityQueryChecksActionOutcome(query.operation))
+      throw new Error("Action outcome Query is unavailable.");
+    // The Action's audit keeps its own dispatch identity; the Query has its separate platform execution record.
+    const result = await dispatchAiCapability({ ...input, turnId: undefined, entry: query, args: input.check.input }, false);
+    if (!result || typeof result !== "object" || !("data" in result)) throw new Error("Invalid outcome check envelope.");
+    const checked = CapabilityActionCheckSchema.parse(result.data);
+    if (checked.receipt && capabilityActionReceiptIssues(checked.receipt, "links" in result ? result.links : undefined).length)
+      throw new Error("Invalid outcome check receipt.");
+    return { state: checked.outcome, ...(checked.receipt ? { receipt: checked.receipt } : {}), at: new Date().toISOString() };
+  } catch {
+    return { state: "failed", at: new Date().toISOString() };
+  }
+};
+
 /**
  * A rejected approval never reaches the dispatcher, so the assistant records
  * the same execution row the dispatcher would have written for the attempt.

package/src/ai/capability-result.ts

@@ -0,0 +1,95 @@
+import type { StoreEntry } from "@k2b/nessi";
+import type { AiActionCheck } from "./action-review";
+
+export class AiCapabilityExecutionError extends Error {
+  constructor(
+    readonly code: string,
+    readonly status: number,
+    message: string,
+    readonly dispatched: boolean = false,
+  ) {
+    super(`${code}: ${message}`);
+    this.name = "AiCapabilityExecutionError";
+  }
+}
+
+/** A check settles only what the app knows; it never authorizes another Action attempt. */
+export const aiCapabilityCheckResult = (check: AiActionCheck): unknown => {
+  if (check.state === "done")
+    return {
+      data: null,
+      ...(check.receipt ? { receipt: check.receipt } : {}),
+      outcomeCheck: "done",
+      message: "The app's check confirmed the Action happened. Do not run it again.",
+    };
+  if (check.state === "not_done")
+    throw new AiCapabilityExecutionError(
+      "ACTION_NOT_DONE",
+      409,
+      "The app's check confirmed nothing happened. Ask the person before trying again.",
+    );
+  throw new AiCapabilityExecutionError(
+    "ACTION_OUTCOME_UNKNOWN",
+    409,
+    check.state === "pending"
+      ? "The app does not know the outcome yet. Do not retry the Action."
+      : "The outcome check failed. Do not retry the Action.",
+  );
+};
+
+/** Project durable, settled checks into model history without changing the stored messages or retrying an Action. */
+export const projectSettledAiToolChecks = (
+  rows: readonly (StoreEntry & { meta?: { toolChecks?: Record<string, AiActionCheck> } | null })[],
+): StoreEntry[] => {
+  const entries = rows.map(({ seq, kind, message }) => ({ seq, kind, message }));
+  const missing = new Map<number, StoreEntry[]>();
+  for (const [index, row] of rows.entries()) {
+    if (row.message.role !== "assistant" || !row.meta?.toolChecks) continue;
+    for (const call of row.message.content) {
+      if (call.type !== "tool_call") continue;
+      const check = row.meta.toolChecks[call.id];
+      if (!check || (check.state !== "done" && check.state !== "not_done")) continue;
+      let resultIndex: number | undefined;
+      // Call IDs can be reused in another exchange; a check belongs only to this call's result.
+      for (let next = index + 1; next < rows.length; next++) {
+        const message = rows[next]!.message;
+        if (message.role === "user") break;
+        if (message.role === "assistant" && message.content.some((part) => part.type === "tool_call" && part.id === call.id)) break;
+        if (message.role === "tool_result" && message.callId === call.id) {
+          resultIndex = next;
+          break;
+        }
+      }
+      const existing = resultIndex !== undefined ? rows[resultIndex]!.message : undefined;
+      // A result that already agrees keeps its original data and receipt.
+      if (
+        existing?.role === "tool_result" &&
+        ((check.state === "done" && !existing.isError) ||
+          (check.state === "not_done" &&
+            existing.isError &&
+            typeof existing.result === "string" &&
+            existing.result.startsWith("ACTION_NOT_DONE:")))
+      )
+        continue;
+      let result: unknown;
+      let isError = false;
+      try {
+        result = aiCapabilityCheckResult(check);
+      } catch (error) {
+        if (!(error instanceof AiCapabilityExecutionError)) throw error;
+        result = error.message;
+        isError = true;
+      }
+      const message = { role: "tool_result" as const, callId: call.id, name: call.name, result, isError };
+      if (resultIndex !== undefined) {
+        entries[resultIndex] = { ...entries[resultIndex]!, message };
+      } else {
+        // A cut-off call has no result row. Share its sequence so compaction still checkpoints durable rows.
+        const answers = missing.get(index) ?? [];
+        answers.push({ seq: row.seq, kind: "message", message });
+        missing.set(index, answers);
+      }
+    }
+  }
+  return entries.flatMap((entry, index) => [entry, ...(missing.get(index) ?? [])]);
+};