@melra/runtime-core 0.3.0-alpha.14 → 0.3.0-alpha.16

package/dist/task-controller.js

@@ -15,9 +15,9 @@ function now() {
  * what the provider was asked to do is the key MELRA itself sent. Shaped like
  * an adapter result so one predicate type reads the same on both paths.
  */
-function reconciliationFacts(task, operation) {
+function reconciliationFacts(taskId, operation) {
     return {
-        taskId: task.id,
+        taskId,
         ...(operation.kind === "http"
             ? {
                 url: operation.url,
@@ -59,9 +59,10 @@ function certificateResult(task) {
  * Applied once, where the request is normalized, so the derived predicates flow
  * identically into the policy decision, the sealed payload, the persisted task
  * record, and verification. A caller that declared its own evidence is left
- * untouched — this only replaces an empty list.
+ * untouched — this only replaces an empty list. Exported for `melra policy
+ * test`, whose preview must decide on the request the server would.
  */
-function withDefaultEvidence(request) {
+export function withDefaultEvidence(request) {
     if (request.requiredEvidence.length > 0)
         return request;
     const derived = defaultEvidenceFor(request.operation);
@@ -83,6 +84,12 @@ export function capabilityUsageReader(store) {
         return { operations: drawn.operations, amountToday: drawn.amountInWindow };
     };
 }
+/** Statuses a task leaves only once: by starting, by a deny, or by a refusal. */
+const UNSTARTED = ["planned", "awaiting_approval"];
+/** Whether a task waits on a question only someone outside MELRA answers (#54). */
+function asksSemantic(request) {
+    return request.requiredEvidence.some((predicate) => predicate.type === "semantic");
+}
 /** The one browser action that reads each list. */
 const BROWSER_LIST_ACTIONS = [
     ["values", "select"],
@@ -96,6 +103,8 @@ export class TaskController {
     verifier;
     payloadCipher;
     active = new Map();
+    /** Each task running here, settled once it has ended (see `settled`). */
+    running = new Map();
     breaker;
     /** Whether approvals come only from an operator, out of band. */
     get enforced() {
@@ -132,10 +141,12 @@ export class TaskController {
     };
     /**
      * Draws by tasks between their re-check and their record, per grant and
-     * task. The durable draw is written only once work is verified, so without
-     * this two tasks running at once both saw the grant unspent: two operations
-     * against `maxOperations: 1`, a parallel workflow node overspending
-     * `dailyMax`.
+     * task. The durable draw is written only once the adapter has answered, so
+     * without this two tasks running at once both saw the grant unspent: two
+     * operations against `maxOperations: 1`, a parallel workflow node
+     * overspending `dailyMax`. Let go once the draw is written or the effect is
+     * known not to have run; one whose draw failed to write is held until
+     * recovery writes it (`drawGrant`).
      *
      * ponytail: held in this process. Two servers sharing one database can
      * still both pass a re-check at the same moment; a durable reservation row
@@ -206,13 +217,39 @@ export class TaskController {
             }
         }
         // Refused before anything is approved: a mutation run against evidence no
-        // registered verifier can check would end `partial` after the effect.
-        for (const predicate of parsed.requiredEvidence) {
+        // registered verifier can check would end `partial` after the effect, and
+        // one that could not be reconciled would stay parked for good. A stored
+        // step's reconciliation was never checked, and refusing it now would stop
+        // a run whose earlier steps already ran.
+        this.assertVerifiable(options.stored === true
+            ? parsed.requiredEvidence
+            : [...parsed.requiredEvidence, ...parsed.reconciliation], options);
+        // Read only against the facts known before the call, so a URL token they
+        // cannot fill (`{{json.id}}`: no response is read on this path) is
+        // refused every time it is asked, and the task would stay parked.
+        if (options.stored !== true) {
+            const facts = reconciliationFacts("00000000-0000-4000-8000-000000000000", parsed.operation);
+            for (const predicate of parsed.reconciliation) {
+                const refused = this.verifier.unfilledToken(predicate, facts);
+                if (refused !== undefined)
+                    throw new Error(`reconciliation_unanswerable:${refused}`);
+            }
+        }
+        return evaluatePolicy("00000000-0000-4000-8000-000000000000", parsed, this.policy, this.capabilityUsage).decision;
+    }
+    /** Refuses a predicate no registered verifier can check, or that it would refuse to. */
+    assertVerifiable(predicates, options = {}) {
+        for (const predicate of predicates) {
             if (!this.verifier.supports(predicate)) {
                 throw new Error(`evidence_verifier_unavailable:${predicate.type === "custom" ? predicate.verifier : predicate.type}`);
             }
+            // A file path the verifier refuses however often it is asked. New work
+            // only, like the reconciliation check: a run accepted before this
+            // check existed is not stopped at the step.
+            if (options.stored !== true && this.verifier.outsideWorkspace(predicate)) {
+                throw new Error("evidence_path_outside_workspace");
+            }
         }
-        return evaluatePolicy("00000000-0000-4000-8000-000000000000", parsed, this.policy, this.capabilityUsage).decision;
     }
     status(taskId) {
         const task = this.store.getTask(taskId);
@@ -231,7 +268,7 @@ export class TaskController {
         if (task.status === "recovery_required") {
             return await this.reconcile(taskId);
         }
-        if (!["planned", "awaiting_approval"].includes(task.status)) {
+        if (!UNSTARTED.includes(task.status)) {
             throw new Error(`task_not_executable:${task.status}`);
         }
         if (task.idempotencyKey !== undefined &&
@@ -239,7 +276,7 @@ export class TaskController {
             task.status = "cancelled";
             task.error = "duplicate_attempt_prevented";
             task.updatedAt = now();
-            this.store.saveTask(task);
+            this.leaveUnstarted(task);
             return this.finishWithoutReceipt(task, [
                 {
                     type: "idempotency",
@@ -255,7 +292,7 @@ export class TaskController {
             task.status = "policy_blocked";
             task.policyDecision = rechecked.decision;
             task.updatedAt = now();
-            this.store.saveTask(task);
+            this.leaveUnstarted(task);
             return this.finishWithoutReceipt(task, []);
         }
         if (rechecked.decision.outcome === "confirm") {
@@ -310,24 +347,44 @@ export class TaskController {
             }
         }
         task.policyDecision = rechecked.decision;
-        const controller = new AbortController();
-        this.active.set(task.id, controller);
-        this.store.inFlight.add(task.id);
         task.status = "running";
         task.mode = this.policy.mode;
         task.updatedAt = now();
         // Status and owner land in one write, so no running row is ever unowned.
-        this.store.saveTask(task, this.store.ownerId());
+        this.leaveUnstarted(task, this.store.ownerId());
+        const controller = new AbortController();
+        let ended;
+        this.running.set(task.id, new Promise((resolve) => (ended = resolve)));
+        this.active.set(task.id, controller);
+        this.store.inFlight.add(task.id);
         const startedAt = now();
         const classified = classifyOperation(request.operation);
         let timeout;
         let budgetExhausted = false;
         let shortCircuited = false;
+        let effectReturned = false;
+        let settled;
         if (rechecked.grantId !== undefined) {
             const held = this.reserved.get(rechecked.grantId) ?? new Map();
             held.set(task.id, classified.spend?.amount ?? 0);
             this.reserved.set(rechecked.grantId, held);
         }
+        // Charged whenever the adapter may have done the work, whatever the
+        // evidence says of it: `verified_success` is the evidence verdict only.
+        // Read off what the adapter gave back. It returned, whatever its `success`
+        // (a request answered 500 reached the far end, a command that exited 1
+        // ran), or it threw an outcome-unknown error (`OUTCOME_UNKNOWN_PREFIX`).
+        // Any other throw is an adapter saying nothing went out, and costs
+        // nothing; so does a refusal before it was called. Counting an effect
+        // that did not happen is preferred to a grant funding more than it says.
+        const charge = (ran) => {
+            if (rechecked.grantId === undefined)
+                return;
+            if (ran) {
+                this.store.recordCapabilityUse(rechecked.grantId, task.id, classified.spend?.amount ?? 0, now());
+            }
+            this.reserved.get(rechecked.grantId)?.delete(task.id);
+        };
         try {
             const opened = this.breaker.check(classified.target);
             if (opened !== undefined) {
@@ -342,6 +399,7 @@ export class TaskController {
             }, request.budget.maxDurationMs);
             timeout.unref();
             const result = await this.executeWithRetries(task, request, classified.effect, controller.signal);
+            effectReturned = true;
             const sanitizedResult = redactStructuredValue(result);
             task.status = "verifying";
             task.result = sanitizedResult.value;
@@ -367,52 +425,90 @@ export class TaskController {
                 : verification.evidence;
             const verified = actionSucceeded &&
                 (request.requiredEvidence.length === 0 || verification.verified);
-            if (verified &&
+            // Every check the kernel can make held; what is left is a question only
+            // someone outside answers (#54).
+            const awaitingJudgement = actionSucceeded &&
+                evidence.some((item) => item.type === "semantic") &&
+                evidence.every((item) => item.passed || item.type === "semantic");
+            // The effect ran and passed every kernel check, so it is committed now:
+            // a key that ran must not run again, even while it waits for its verdict.
+            const checksHeld = verified || awaitingJudgement;
+            if (checksHeld &&
                 task.idempotencyKey !== undefined &&
                 !this.store.commitIdempotency(task.idempotencyKey, task.id, task.attempt ?? 1, now())) {
                 task.status = "cancelled";
                 task.error = "duplicate_attempt_prevented";
             }
-            // Metered here and nowhere else: the same point idempotency commits, so a
-            // grant is drawn down by work that actually happened and was verified.
-            // A refusal, a failed verification, a duplicate collapsed just above —
-            // none of them reach this line, and none of them cost the caller a draw.
-            if (verified &&
-                task.status !== "cancelled" &&
-                rechecked.grantId !== undefined) {
-                this.store.recordCapabilityUse(rechecked.grantId, task.id, classified.spend?.amount ?? 0, now());
-            }
+            // The adapter returned, so the effect ran: drawn down for a `partial`,
+            // a `failed` or a duplicate collapsed just above as for a verified task.
+            charge(true);
             const receipt = this.createReceipt(task, request, classified.capability, classified.target, classified.effect, startedAt, actionSucceeded, result, evidence);
             this.store.saveReceipt(receipt);
             task.receiptIds.push(receipt.receiptId);
             if (task.status !== "cancelled") {
                 task.status = verified
                     ? "verified_success"
-                    : actionSucceeded
-                        ? "partial"
-                        : "failed";
+                    : awaitingJudgement
+                        ? "waiting_user"
+                        : actionSucceeded
+                            ? "partial"
+                            : "failed";
+            }
+            // Written in the same save as the status, so a waiting row always says
+            // what it waits on, and until when.
+            if (task.status === "waiting_user") {
+                const expiresAt = new Date(Date.now() + approvalTtl(this.policy)).toISOString();
+                task.judgements = request.requiredEvidence.flatMap((predicate, predicateIndex) => predicate.type === "semantic" ? [{ judgementId: randomUUID(), predicateIndex, expiresAt }] : []);
             }
             task.updatedAt = now();
+            // A wait lands with its certificate in one transaction: written apart, a
+            // peer's expiry between the two was overwritten by the second. Either
+            // failing writes neither, so `settled` stays unset for the catch.
+            if (task.status === "waiting_user") {
+                const certificate = this.store.transaction(() => {
+                    this.store.saveTask(task);
+                    return this.createAndSaveCertificate(task, evidence, true);
+                });
+                return { task, output: result, receipt, certificate };
+            }
             this.store.saveTask(task);
-            const certificate = this.createAndSaveCertificate(task, evidence);
-            return { task, output: result, receipt, certificate };
+            settled = { task, output: result, receipt };
+            const certificate = this.createAndSaveCertificate(task, evidence, true);
+            return { ...settled, certificate };
         }
         catch (error) {
+            // The outcome is recorded, beside its receipt and idempotency commit,
+            // and only the certificate summarising it failed to write. Rewriting it
+            // would contradict them, and an error would read as the effect not
+            // having happened, so the caller gets what was recorded. A workflow
+            // step's certificate is written by the run's next advance (`certify`).
+            if (settled !== undefined)
+                return settled;
             const rawMessage = error instanceof Error ? error.message : String(error);
-            const message = redactStructuredValue(rawMessage).value;
+            // Capped after redaction, which can lengthen it, at the 10,000 characters
+            // a workflow node's `error` holds: a longer one failed the node's write
+            // after the effect ran, and the next advance ran the step again.
+            const message = redactStructuredValue(rawMessage).value.slice(0, 10_000);
             const aborted = controller.signal.aborted;
             // A refusal by the breaker is not fresh evidence about the target, and an
             // operator's cancellation is not evidence about it at all. A budget that
-            // ran out is: the target did not answer in time.
-            if (!shortCircuited && (!aborted || budgetExhausted)) {
+            // ran out is: the target did not answer in time. Nor is anything after
+            // the adapter returned, which the target already answered.
+            if (!shortCircuited && !effectReturned && (!aborted || budgetExhausted)) {
                 this.breaker.recordFailure(classified.target);
             }
-            // Checked on the raw message and ahead of every other outcome, because it
-            // is the strongest thing known: the adapter says the effect may already
-            // have happened. `failed`, `cancelled` and `budget_exhausted` all assert
-            // more than that. Reads are exempt — a read that may or may not have run
-            // changed nothing either way, so there is nothing to reconcile.
-            const unknownOutcome = classified.effect !== "read" && isOutcomeUnknown(rawMessage);
+            // Paid for before the outcome is written, read or change alike. A draw
+            // that fails to write leaves the reservation held, and the task running
+            // for recovery to charge.
+            const ran = effectReturned || isOutcomeUnknown(rawMessage);
+            charge(ran);
+            // Ahead of every other outcome, because it is the strongest thing known:
+            // the effect may already have happened, either because the adapter says
+            // so or because it returned and a write after it failed. `failed`,
+            // `cancelled` and `budget_exhausted` all assert more than that. Reads
+            // are exempt — a read that may or may not have run changed nothing
+            // either way, so there is nothing to reconcile.
+            const unknownOutcome = classified.effect !== "read" && ran;
             task.status = unknownOutcome
                 ? "recovery_required"
                 : aborted
@@ -443,7 +539,7 @@ export class TaskController {
             this.store.saveReceipt(receipt);
             task.receiptIds.push(receipt.receiptId);
             this.store.saveTask(task);
-            const certificate = this.createAndSaveCertificate(task, evidence);
+            const certificate = this.createAndSaveCertificate(task, evidence, true);
             return { task, receipt, certificate };
         }
         finally {
@@ -451,10 +547,18 @@ export class TaskController {
                 clearTimeout(timeout);
             this.active.delete(task.id);
             this.store.inFlight.delete(task.id);
-            if (rechecked.grantId !== undefined)
-                this.reserved.get(rechecked.grantId)?.delete(task.id);
+            this.running.delete(task.id);
+            ended();
         }
     }
+    /**
+     * Resolves once a task this controller is running has ended, its outcome
+     * recorded: a cancel only signals the adapter to stop. At once for one it
+     * is not running.
+     */
+    settled(taskId) {
+        return this.running.get(taskId) ?? Promise.resolve();
+    }
     cancel(taskId) {
         const task = this.status(taskId);
         const controller = this.active.get(taskId);
@@ -462,13 +566,26 @@ export class TaskController {
             controller.abort(new Error("task_cancelled"));
             return task;
         }
-        if (["planned", "awaiting_approval"].includes(task.status)) {
+        if (UNSTARTED.includes(task.status)) {
             task.status = "cancelled";
             task.updatedAt = now();
-            this.store.saveTask(task);
+            // Started meanwhile by another process: it runs, so the caller is told
+            // what the task is now rather than that it was cancelled.
+            if (!this.store.saveTaskIf(task, UNSTARTED))
+                return this.status(taskId);
         }
         return task;
     }
+    /**
+     * Writes a task out of planned or awaiting_approval, unless a deny or an
+     * execute in another process got there after this one read it: that one
+     * stands, and this one is refused as it would have been had it read later.
+     */
+    leaveUnstarted(task, owner) {
+        if (!this.store.saveTaskIf(task, UNSTARTED, owner)) {
+            throw new Error(`task_not_executable:${this.status(task.id).status}`);
+        }
+    }
     async verifyPersisted(taskId, predicates) {
         const sealed = this.store.getTaskResult(taskId);
         const result = sealed === undefined
@@ -502,35 +619,67 @@ export class TaskController {
         }
         const request = this.loadRequest(taskId);
         const classified = classifyOperation(request.operation);
-        const park = (reason) => {
+        const park = (reason) => this.settleParked(taskId, () => {
             task.error = reason;
             task.updatedAt = now();
             this.store.saveTask(task);
             return { task };
-        };
+        });
+        // Its own commit already answers: every kernel check held, and only a
+        // write after it failed. Parked for good otherwise, with nothing declared.
+        const committed = this.settleParked(taskId, () => this.settleCommitted(task, request, classified));
+        if (committed !== undefined)
+            return committed;
+        // A provider can say whether an effect happened, never whether it is
+        // right: a task that declared a semantic predicate stays parked with its
+        // cause unchanged (#54).
+        if (asksSemantic(request))
+            return { task };
         if (request.reconciliation.length === 0) {
             return park("reconciliation_not_declared");
         }
-        const verification = await this.verifier.verify(request.reconciliation, reconciliationFacts(task, request.operation));
+        const verification = await this.verifier.verify(request.reconciliation, reconciliationFacts(task.id, request.operation));
+        // Refused by the kernel itself, it is refused again however often it is
+        // asked: the declaration needs fixing, which waiting on the provider will
+        // not do. Named, so a caller can tell the two apart.
+        const unanswerable = verification.evidence.filter((item) => item.unanswerable === true);
+        if (unanswerable.length > 0) {
+            const reason = `reconciliation_unanswerable:${unanswerable.map((item) => item.summary).join("; ")}`;
+            return park(redactStructuredValue(reason).value.slice(0, 10_000));
+        }
         // An unreachable provider did not say no. Resolving on this would be the
         // same lie as the `failed` this whole path exists to avoid.
         if (verification.evidence.some((item) => item.inconclusive === true)) {
             return park("reconciliation_inconclusive");
         }
         if (verification.verified) {
-            return this.resolveAsVerified(task, request, classified, verification.evidence, { reconciliation: "provider_state_confirms_effect" });
+            return this.settleParked(taskId, () => this.resolveAsVerified(task, request, classified, verification.evidence, { reconciliation: "provider_state_confirms_effect" }));
         }
         // The provider answered, and the answer is that it never happened. Only now
         // is `failed` a claim MELRA is entitled to make.
-        task.status = "failed";
-        task.error = "reconciliation_confirms_effect_not_applied";
-        task.updatedAt = now();
-        this.store.saveTask(task);
-        const receipt = this.createReceipt(task, request, classified.capability, classified.target, classified.effect, task.updatedAt, false, { reconciliation: "provider_state_denies_effect" }, verification.evidence, task.error);
-        this.store.saveReceipt(receipt);
-        task.receiptIds.push(receipt.receiptId);
-        const certificate = this.createAndSaveCertificate(task, verification.evidence);
-        return { task, receipt, certificate };
+        return this.settleParked(taskId, () => {
+            task.status = "failed";
+            task.error = "reconciliation_confirms_effect_not_applied";
+            task.updatedAt = now();
+            this.store.saveTask(task);
+            const receipt = this.createReceipt(task, request, classified.capability, classified.target, classified.effect, task.updatedAt, false, { reconciliation: "provider_state_denies_effect" }, verification.evidence, task.error);
+            this.store.saveReceipt(receipt);
+            task.receiptIds.push(receipt.receiptId);
+            const certificate = this.createAndSaveCertificate(task, verification.evidence);
+            return { task, receipt, certificate };
+        });
+    }
+    /**
+     * Writes a reconcile's answer in one transaction, and only while the task
+     * still waits for one. Two reconciles of one task (two melra_execute calls,
+     * or the sweep's recovery beside an agent's) each read it parked and ask
+     * the provider; written unconditionally, the slower answer, even one that
+     * could not reach the provider, overwrote a settle the other had recorded
+     * and dropped its receipt. Now the first stands, and the other writes
+     * nothing, not even a receipt, and returns the task as it now stands.
+     */
+    settleParked(taskId, write) {
+        return this.store.transaction(() => this.store.getTask(taskId)?.status === "recovery_required" ? write() : { task: this.status(taskId) });
     }
     /**
      * Settle a task as done on evidence gathered after the fact.
@@ -545,27 +694,78 @@ export class TaskController {
             this.store.getIdempotencyCommit(task.idempotencyKey) === undefined) {
             this.store.commitIdempotency(task.idempotencyKey, task.id, task.attempt ?? 1, now());
         }
-        // Read for the grant id only. The work is already done, so this is
-        // accounting rather than permission: a grant that has since run out still
-        // pays for what it authorised. Asked as if nothing were drawn, because
-        // policy names no grant at all for one that is now exhausted, and the
-        // effect then went uncharged.
-        const { grantId } = evaluatePolicy(task.id, request, this.policy, () => ({
-            operations: 0,
-            amountToday: 0,
-        }));
-        if (grantId !== undefined) {
-            this.store.recordCapabilityUse(grantId, task.id, classified.spend?.amount ?? 0, now());
-        }
+        this.drawGrant(task, request, classified);
         const receipt = this.createReceipt(task, request, classified.capability, classified.target, classified.effect, task.updatedAt, true, observed, evidence);
         this.store.saveReceipt(receipt);
         task.receiptIds.push(receipt.receiptId);
+        // Evidence gathered after the fact answers no question about meaning: a
+        // semantic task, its effect done and receipted, settles closed as at
+        // expiry (#54).
+        if (asksSemantic(request))
+            return { ...this.settleUnanswered(task), receipt };
         task.status = "verified_success";
         delete task.error;
         task.updatedAt = now();
         const certificate = this.createAndSaveCertificate(task, evidence);
         return { task, receipt, certificate };
     }
+    /**
+     * Draws the grant behind an effect already done, once per task however
+     * often asked. Policy is read for the grant id only: this is accounting
+     * rather than permission, so a grant that has since run out still pays for
+     * what it authorised. Asked as if nothing were drawn, because policy names
+     * no grant at all for one that is now exhausted, and the effect then went
+     * uncharged. A task that drew one already is left alone: policy read now
+     * names the first grant that matches, not the one execute drew once that
+     * was spent, and charging it too drew the task twice. Drawn, it lets go
+     * of a reservation `execute` held when its own draw failed to write.
+     */
+    drawGrant(task, request, classified) {
+        const grantId = this.store.hasCapabilityUse(task.id)
+            ? undefined
+            : evaluatePolicy(task.id, request, this.policy, () => ({
+                operations: 0,
+                amountToday: 0,
+            })).grantId;
+        if (grantId !== undefined) {
+            this.store.recordCapabilityUse(grantId, task.id, classified.spend?.amount ?? 0, now());
+        }
+        for (const held of this.reserved.values())
+            held.delete(task.id);
+    }
+    /**
+     * Settle a task whose idempotency key is committed to it. A key is
+     * committed only once every kernel check held, so whatever stopped the
+     * task came after the effect: an interruption, or a write that failed. One
+     * with a semantic question commits on entering `waiting_user`, so its
+     * commit never says the question was answered: it settles closed, as at
+     * expiry (#54).
+     */
+    settleCommitted(task, request, classified) {
+        if (task.idempotencyKey === undefined ||
+            this.store.getIdempotencyCommit(task.idempotencyKey)?.taskId !== task.id) {
+            return undefined;
+        }
+        if (asksSemantic(request)) {
+            // Settled already, it is left as it stands rather than certified again.
+            // Asked of the stored row: a peer may have settled it since `task` was
+            // read, and its status says `recovery_required` either way.
+            const stored = this.status(task.id);
+            if (stored.error === "semantic_judgement_expired")
+                return { task: stored };
+            // Cut off before it reached `waiting_user`, maybe before its draw too.
+            this.drawGrant(task, request, classified);
+            return this.settleUnanswered(task);
+        }
+        return this.resolveAsVerified(task, request, classified, [
+            {
+                type: "idempotency",
+                passed: true,
+                strength: evidenceStrength("idempotency"),
+                summary: "verified and committed before the interruption",
+            },
+        ], { recovery: "committed_before_interruption" });
+    }
     /**
      * With `failed`, each task that could not be recovered is recorded there by
      * id instead of the first failure being thrown at the end.
@@ -604,17 +804,64 @@ export class TaskController {
                 this.store.inFlight.delete(task.id);
             }
         }
+        this.expireJudgements(failures);
         if (failed === undefined && failures.size > 0)
             throw failures.values().next().value;
         return recovered;
     }
+    /**
+     * A waiting task whose judgements are past their `expiresAt` settles
+     * closed. Re-read and written in one transaction, so a peer settling the
+     * same task wins once.
+     *
+     * ponytail: runs on the startup pass and the 30 s recovery sweep, so a wait
+     * can outlive its `expiresAt` by one interval, or until a runtime next opens
+     * this data directory; a verdict tool must check `expiresAt` itself.
+     */
+    expireJudgements(failures) {
+        for (const listed of this.store.listExpiredJudgements(now())) {
+            try {
+                this.store.transaction(() => {
+                    const task = this.store.getTask(listed.id);
+                    if (task?.status === "waiting_user")
+                        this.settleUnanswered(task);
+                });
+            }
+            catch (error) {
+                failures.set(listed.id, error);
+            }
+        }
+    }
+    /**
+     * No answer is not a yes (#54). A task whose semantic question went
+     * unanswered, at expiry or cut off after its commit, settles closed: its
+     * effect ran, so a change is `recovery_required` (never `failed`) and a
+     * read is `partial`. Nothing runs here, so it writes no receipt: the
+     * certificate, replaced, carries the evidence of the task's last one, the
+     * live path's or the one recovery wrote.
+     */
+    settleUnanswered(task) {
+        const last = task.receiptIds[task.receiptIds.length - 1];
+        const receipt = last === undefined ? undefined : this.store.getReceipt(last);
+        const evidence = (receipt?.evidence ?? []).map((item) => item.type === "semantic"
+            ? { ...item, passed: false, inconclusive: true, summary: "semantic_judgement_expired" }
+            : item);
+        task.status = task.policyDecision.effect === "read" ? "partial" : "recovery_required";
+        task.error = "semantic_judgement_expired";
+        task.updatedAt = now();
+        return { task, certificate: this.createAndSaveCertificate(task, evidence) };
+    }
     async recoverTask(task) {
         const request = this.loadRequest(task.id);
         const classified = classifyOperation(request.operation);
+        // A semantic question cannot be observed again, and resolveAsVerified
+        // settles it closed; the rest must hold as for any other task, so a
+        // change with no key to commit is charged here too.
+        const observable = request.requiredEvidence.filter((predicate) => predicate.type !== "semantic");
         if (task.status === "verifying" &&
             classified.effect !== "read" &&
-            request.requiredEvidence.length > 0 &&
-            request.requiredEvidence.every((predicate) => ["file_exists", "file_absent", "file_hash"].includes(predicate.type))) {
+            observable.length > 0 &&
+            observable.every((predicate) => ["file_exists", "file_absent", "file_hash"].includes(predicate.type))) {
             // What the adapter reported before the crash, when it got that far.
             // Evidence alone is not success: a build that exited 1 beside a dist/
             // left by an earlier one would otherwise recover as verified.
@@ -623,14 +870,28 @@ export class TaskController {
                 ? undefined
                 : this.payloadCipher.open(sealed, `task:${task.id}:result`);
             const actionSucceeded = reported?.success !== false;
-            const verification = await this.verifier.verify(request.requiredEvidence, {});
-            if (actionSucceeded && verification.verified) {
+            // Against what the adapter reported, as the live path verifies: a
+            // move's own result is what tells a case-only rename's source is gone.
+            // Its semantic item, never passed, rides along unanswered as on the
+            // live receipt, and is the one item not required to pass.
+            const verification = await this.verifier.verify(request.requiredEvidence, reported ?? {});
+            if (actionSucceeded &&
+                verification.evidence.every((item) => item.passed || item.type === "semantic")) {
                 this.resolveAsVerified(task, request, classified, verification.evidence, {
                     recovery: "independent_reobservation",
                 });
                 return task;
             }
         }
+        // A read that verified and committed its key before the interruption is
+        // done. Run again, it would only be cancelled as a duplicate of itself,
+        // and a workflow reads a cancelled step as a denial. A task with a
+        // semantic question that committed settles closed, change or read.
+        if (classified.effect === "read" || asksSemantic(request)) {
+            const committed = this.settleCommitted(task, request, classified);
+            if (committed !== undefined)
+                return committed.task;
+        }
         const effect = classified.effect;
         task.status = effect === "read" ? "planned" : "recovery_required";
         task.error =
@@ -638,6 +899,10 @@ export class TaskController {
                 ? "interrupted_read_ready_for_retry"
                 : "interrupted_mutation_requires_reconciliation";
         task.updatedAt = now();
+        // Cut off mid-flight, read or change, it may have run, so it is paid for
+        // before it is parked, as `execute` pays for one. A read run again is the
+        // same task, so it draws nothing more, but its re-check counts this draw.
+        this.drawGrant(task, request, classified);
         this.store.saveTask(task);
         // A crash mid-flight is the same unknown a dropped reply is, so a task
         // that declared how to settle one gets asked here rather than waiting for
@@ -736,6 +1001,31 @@ export class TaskController {
             ...(certificate === undefined ? {} : { certificate }),
         };
     }
+    /**
+     * A task's certificate, written now for a `verified_success` task whose
+     * certificate failed to write after it was recorded: a workflow counts a
+     * step done only on its certificate. For a writer of the run, never a
+     * read. Only that status, because every other path to it writes the
+     * certificate before the task, and `execute`, which does not, writes it
+     * only if none is stored: whoever writes first, both hand out the same one.
+     * A write that fails again is left for the next writer.
+     */
+    certify(taskId) {
+        const certificate = this.store.getCertificateForTask(taskId);
+        if (certificate !== undefined)
+            return certificate;
+        const task = this.store.getTask(taskId);
+        const last = task?.receiptIds.at(-1);
+        const receipt = last === undefined ? undefined : this.store.getReceipt(last);
+        if (task?.status !== "verified_success" || receipt === undefined)
+            return undefined;
+        try {
+            return this.createAndSaveCertificate(task, receipt.evidence, true);
+        }
+        catch {
+            return undefined;
+        }
+    }
     /**
      * The mode a task's effect ran under: recorded when it started running, or,
      * for a task that started before that was recorded, the mode on its first
@@ -754,11 +1044,13 @@ export class TaskController {
         const approvalId = task.approvedBy?.approvalId ??
             (task.policyDecision.outcome === "confirm" ? task.approval?.approvalId : undefined);
         const sanitized = redactStructuredValue(result);
+        // A verifier's summary and source are stored text like any other.
+        const sanitizedEvidence = redactStructuredValue(evidence);
         const adapterRedactions = Array.isArray(result.redactions)
             ? result.redactions.filter((item) => typeof item === "string")
             : [];
         const redactions = [
-            ...new Set([...adapterRedactions, ...sanitized.redactions]),
+            ...new Set([...adapterRedactions, ...sanitized.redactions, ...sanitizedEvidence.redactions]),
         ];
         return {
             schemaVersion: "1.0.0",
@@ -792,7 +1084,7 @@ export class TaskController {
             endedAt: now(),
             success,
             observedEffect: sanitized.value,
-            evidence,
+            evidence: sanitizedEvidence.value,
             redactions,
             ...(error === undefined ? {} : { error }),
         };
@@ -827,16 +1119,20 @@ export class TaskController {
                 };
             }
             catch (error) {
-                lastError = error;
+                // An attempt that may have reached the far end outranks a later one
+                // saying nothing went out: the read may have run, so it is charged.
+                lastError = lastError instanceof Error && isOutcomeUnknown(lastError.message) ? lastError : error;
                 if (attempt >= maximumAttempts || signal.aborted)
-                    throw error;
+                    throw lastError;
             }
         }
         throw lastError instanceof Error
             ? lastError
             : new Error("execution_failed_without_error");
     }
-    createAndSaveCertificate(task, evidence) {
+    createAndSaveCertificate(task, evidence, 
+    // A task's first: one another writer stored meanwhile stays, and is used.
+    first = false) {
         const approvalChannel = task.approvedBy?.channel ??
             (task.policyDecision.outcome === "allow"
                 ? task.policyDecision.effect === "read"
@@ -853,16 +1149,19 @@ export class TaskController {
             result: certificateResult(task),
             policyVersion: task.policyDecision.policyVersion,
             receiptIds: task.receiptIds,
-            evidence,
+            // Redacted as a receipt's is, before the digest is taken. Redacting
+            // again changes nothing, so one written from a stored receipt's items
+            // (`certify`) says what one written from the verifier's would.
+            evidence: redactStructuredValue(evidence).value,
             createdAt: now(),
             ...(mode === undefined ? {} : { mode }),
             ...(approvalChannel === undefined ? {} : { approvalChannel }),
         });
-        task.certificateId = certificate.certificateId;
+        const stored = this.store.saveCertificate(certificate, { ifAbsent: first });
+        task.certificateId = stored.certificateId;
         task.updatedAt = now();
-        this.store.saveCertificate(certificate);
         this.store.saveTask(task);
-        return certificate;
+        return stored;
     }
     finishWithoutReceipt(task, evidence) {
         const certificate = this.createAndSaveCertificate(task, evidence);