@sema-agent/core 7.6.3 → 7.8.0

package/dist/core/auto-mode.js

@@ -32,67 +32,85 @@ export function createAutoModeDecider(opts) {
             }
         }
     };
-    return {
-        breakerOpen: () => open,
-        consecutiveFailures: () => consecutiveFailures,
-        async decide(input, signal) {
-            if (open)
-                return { kind: "unavailable", cause: "breaker_open" };
-            let timer;
-            const inner = new AbortController();
-            const onOuterAbort = () => inner.abort();
-            if (signal !== undefined) {
-                if (signal.aborted)
-                    inner.abort();
-                else
-                    signal.addEventListener("abort", onOuterAbort, { once: true });
-            }
+    const decide = async (input, signal) => {
+        const startedAt = performance.now();
+        const verdict = await decideUnreported(input, signal);
+        if (opts.onClassified !== undefined) {
             try {
-                const raw = await new Promise((resolve, reject) => {
-                    let settled = false;
-                    timer = setTimeout(() => {
-                        if (!settled) {
-                            settled = true;
-                            inner.abort();
-                            reject(new AutoModeTimeout());
-                        }
-                    }, timeoutMs);
-                    opts.classify(input, inner.signal).then((v) => {
-                        if (!settled) {
-                            settled = true;
-                            resolve(v);
-                        }
-                    }, (e) => {
-                        if (!settled) {
-                            settled = true;
-                            reject(e);
-                        }
-                    });
+                opts.onClassified({
+                    toolCallId: input.req.toolCallId,
+                    ms: Math.max(0, Math.round(performance.now() - startedAt)),
+                    verdict: verdict.kind,
+                    ...(verdict.kind === "unavailable" ? { cause: verdict.cause } : {}),
                 });
-                if (open)
-                    return { kind: "unavailable", cause: "breaker_open" };
-                const verdict = parseAutoModeResponse(raw);
-                if (verdict.kind === "parse_error")
-                    recordFailure("parse_error");
-                else
-                    consecutiveFailures = 0;
-                return verdict;
             }
-            catch (e) {
-                if (signal?.aborted)
-                    return { kind: "unavailable", cause: "error" };
-                const timedOut = e instanceof AutoModeTimeout;
-                recordFailure(timedOut ? "timeout" : "error");
-                return { kind: "unavailable", cause: timedOut ? "timeout" : "error" };
-            }
-            finally {
-                if (timer !== undefined)
-                    clearTimeout(timer);
-                if (signal !== undefined)
-                    signal.removeEventListener("abort", onOuterAbort);
+            catch {
             }
-        },
+        }
+        return verdict;
+    };
+    return {
+        breakerOpen: () => open,
+        consecutiveFailures: () => consecutiveFailures,
+        decide,
     };
+    async function decideUnreported(input, signal) {
+        if (open)
+            return { kind: "unavailable", cause: "breaker_open" };
+        let timer;
+        const inner = new AbortController();
+        const onOuterAbort = () => inner.abort();
+        if (signal !== undefined) {
+            if (signal.aborted)
+                inner.abort();
+            else
+                signal.addEventListener("abort", onOuterAbort, { once: true });
+        }
+        try {
+            const raw = await new Promise((resolve, reject) => {
+                let settled = false;
+                timer = setTimeout(() => {
+                    if (!settled) {
+                        settled = true;
+                        inner.abort();
+                        reject(new AutoModeTimeout());
+                    }
+                }, timeoutMs);
+                opts.classify(input, inner.signal).then((v) => {
+                    if (!settled) {
+                        settled = true;
+                        resolve(v);
+                    }
+                }, (e) => {
+                    if (!settled) {
+                        settled = true;
+                        reject(e);
+                    }
+                });
+            });
+            if (open)
+                return { kind: "unavailable", cause: "breaker_open" };
+            const verdict = parseAutoModeResponse(raw);
+            if (verdict.kind === "parse_error")
+                recordFailure("parse_error");
+            else
+                consecutiveFailures = 0;
+            return verdict;
+        }
+        catch (e) {
+            if (signal?.aborted)
+                return { kind: "unavailable", cause: "error" };
+            const timedOut = e instanceof AutoModeTimeout;
+            recordFailure(timedOut ? "timeout" : "error");
+            return { kind: "unavailable", cause: timedOut ? "timeout" : "error" };
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            if (signal !== undefined)
+                signal.removeEventListener("abort", onOuterAbort);
+        }
+    }
 }
 class AutoModeTimeout extends Error {
     constructor() {

package/dist/core/checkpoint-execution-record.d.ts

@@ -0,0 +1,110 @@
+/**
+ * The execution-outcome record's vocabulary (layer 0, beside the checkpoint store it serves): the closed
+ * answer set of `CheckpointStore.recordExecutionOutcome`, its one disposition table, the conflict error,
+ * the shared write disposition and reopen predicate every backend routes through, the structural
+ * equality the idempotency arm uses, and the one read face of the column. The column itself
+ * (`CheckpointRow.executionOutcome` / `executionAtMs`) and the verb's contract are declared on the store
+ * (`checkpoint-store.ts`); this module names no store type — the row facts it reads are spelled
+ * structurally — so the store reaches DOWN for it and nothing here reaches back.
+ */
+import { type AssertAllKeysHandled } from "./ask-origin.js";
+import type { GateOutcome } from "./gate-outcome.js";
+/**
+ * The closed answer set of `CheckpointStore.recordExecutionOutcome` — what the store did with the
+ * execution record it was handed. One word per way the write can end; a caller keys on the word, never
+ * on an absence:
+ *  - `recorded` — the CAS won: the row was `resolved` with no record yet, and now carries this one.
+ *  - `already_recorded` — the row already carries a record EQUAL to the one supplied (a retry of the
+ *    same write; idempotent, nothing changed). A record that DIFFERS is not a word — it is the
+ *    {@link ExecutionOutcomeConflictError} throw.
+ *  - `not_resolved` — the row exists in this scope but is not `resolved` (still pending, or expired):
+ *    there is no decision an execution could be the outcome of, so nothing was written.
+ *  - `absent` — no row under this token in this scope (a missing row and a wrong-scope row alike — the
+ *    isolation rule every verb of the store keeps).
+ */
+export declare const EXECUTION_OUTCOME_RECORD_WORDS: readonly ["recorded", "already_recorded", "not_resolved", "absent"];
+export type ExecutionOutcomeRecordWord = (typeof EXECUTION_OUTCOME_RECORD_WORDS)[number];
+/** Membership test for {@link ExecutionOutcomeRecordWord} — a deployment store answers across a process
+ *  boundary, so the consumer validating its word must not hand-roll the set. */
+export declare function isExecutionOutcomeRecordWord(v: unknown): v is ExecutionOutcomeRecordWord;
+/**
+ * The one disposition table over {@link ExecutionOutcomeRecordWord}: does this answer mean the row now
+ * carries NO execution record — i.e. the leg's disposition of the decided action is not on file? The
+ * engine's belt reads it to decide whether to announce `checkpoint.execution_outcome_unrecorded` (the
+ * execution result itself is never changed by the answer: the record is an account of what ran, not a
+ * gate on it). A new word must take a row here (the fence below reds `tsc` otherwise).
+ */
+export declare const EXECUTION_RECORD_LEAVES_ROW_UNRECORDED: {
+    readonly recorded: false;
+    readonly already_recorded: false;
+    readonly not_resolved: true;
+    readonly absent: true;
+};
+export type ExecutionRecordTableCoversEveryWord = AssertAllKeysHandled<Exclude<ExecutionOutcomeRecordWord, keyof typeof EXECUTION_RECORD_LEAVES_ROW_UNRECORDED>>;
+/**
+ * The read face of `CheckpointRow.executionOutcome`: what a reader of a resolved row can say about how
+ * the decided action was disposed. `executed` carries the record the resumed leg filed; `unknown` is the
+ * ONE meaning of the column's absence (the leg has not reached its resolution yet, the row was consumed
+ * by a worker that could not record, or the store answered `not_resolved`/`absent` and the engine
+ * announced it). Never `allowed` by default — the pre-execution decision lives on `resolvedOutcome`.
+ */
+export type ExecutionVerdict = {
+    kind: "executed";
+    gate: GateOutcome;
+} | {
+    kind: "unknown";
+};
+/**
+ * `CheckpointStore.recordExecutionOutcome` was handed a record for a row that already carries a DIFFERENT
+ * one. The record is physically immutable (see `CheckpointRow.executionOutcome`), so this is never
+ * resolved by overwriting: two different accounts of one execution mean the engine ran, or believes it
+ * ran, the same decided action twice — an engine defect the belt must surface, not a store condition it
+ * may absorb. Carries both records so the operator can read what was on file and what tried to replace
+ * it. Code `checkpoint.execution_outcome_conflict`; a deployment store may throw any error carrying the
+ * same `code` — the code is the contract, this class is its in-tree form.
+ */
+export declare class ExecutionOutcomeConflictError extends Error {
+    readonly code: "checkpoint.execution_outcome_conflict";
+    /** The record on file — a COPY: a backend hands this constructor its live row value, and a caller that
+     *  catches the error must not be able to rewrite the row through it (the record is immutable by CAS,
+     *  not by convention). */
+    readonly recorded: GateOutcome;
+    /** The record that tried to replace it — copied for the same reason. */
+    readonly attempted: GateOutcome;
+    constructor(recorded: GateOutcome, attempted: GateOutcome);
+}
+/** The row facts the record's disposition reads — spelled structurally so a backend can hand a partial
+ *  read-back (a Pg row) as easily as a full `Checkpoint`. */
+export interface ExecutionRecordRowFacts {
+    scope: string;
+    status: "pending" | "resolved" | "expired";
+    executionOutcome?: GateOutcome;
+}
+/** `true` iff the row carries an execution record — the reopen verbs' extra predicate (a settled action
+ *  is not re-openable) and the record verb's own idempotency read. Pure; shared by every backend. */
+export declare function checkpointExecutionRecorded(cp: Pick<ExecutionRecordRowFacts, "executionOutcome">): boolean;
+/** Structural equality of two execution records as the JSON they round-trip as — key-order insensitive
+ *  (a jsonb column reorders keys) and indifferent to freezing (the engine's record is minted frozen; a
+ *  store's copy is not). A record is a plain data graph by construction, so nothing here needs the
+ *  accessor/topology defences a caller-supplied value would. */
+export declare function sameExecutionRecord(a: GateOutcome, b: GateOutcome): boolean;
+/**
+ * THE one disposition of an execution-record write, shared by every backend so the CAS predicate
+ * `status = 'resolved' AND execution_outcome IS NULL` and its two idempotency/conflict arms cannot drift
+ * between stores (the same posture as the shared row predicate `checkpointRowMatches`). Pure: it decides
+ * what the write means for THIS row and this record; the backend keeps its own commit half (an in-place
+ * assignment, an appended ledger event, an `UPDATE … WHERE` that folds the same predicate into SQL).
+ *  - `commit` — the row is `resolved` in this scope with no record: write it (the answer is `recorded`).
+ *  - `already_recorded` / `not_resolved` / `absent` — the {@link ExecutionOutcomeRecordWord} to answer.
+ *  - `conflict` — the row carries a different record: throw {@link ExecutionOutcomeConflictError}.
+ * Order is load-bearing: a record on file is judged BEFORE the status arm, so a retry against a row whose
+ * status a concurrent verb has since moved still answers by the record it carries.
+ */
+export declare function executionRecordDisposition(cp: ExecutionRecordRowFacts | undefined, scope: string, gate: GateOutcome): "commit" | "conflict" | Exclude<ExecutionOutcomeRecordWord, "recorded">;
+/**
+ * The ONE read of `CheckpointRow.executionOutcome`: `executed` with the record when the row carries one,
+ * `unknown` otherwise. A consumer rebuilding a run from its rows (an audit face, a supervisor inbox after
+ * a stream break) reads this rather than the column, so "no column" and "column not yet written" have
+ * exactly one spelling between them and no reader invents a default disposition.
+ */
+export declare function executionVerdict(cp: Pick<ExecutionRecordRowFacts, "executionOutcome">): ExecutionVerdict;

package/dist/core/checkpoint-execution-record.js

@@ -0,0 +1,49 @@
+import {} from "./ask-origin.js";
+export const EXECUTION_OUTCOME_RECORD_WORDS = ["recorded", "already_recorded", "not_resolved", "absent"];
+const EXECUTION_OUTCOME_RECORD_WORD_SET = new Set(EXECUTION_OUTCOME_RECORD_WORDS);
+export function isExecutionOutcomeRecordWord(v) {
+    return EXECUTION_OUTCOME_RECORD_WORD_SET.has(v);
+}
+export const EXECUTION_RECORD_LEAVES_ROW_UNRECORDED = {
+    recorded: false,
+    already_recorded: false,
+    not_resolved: true,
+    absent: true,
+};
+export class ExecutionOutcomeConflictError extends Error {
+    code = "checkpoint.execution_outcome_conflict";
+    recorded;
+    attempted;
+    constructor(recorded, attempted) {
+        super("the checkpoint already carries an execution outcome that differs from the one being recorded — the record is immutable, so this is an engine defect (one decided action settled twice), not a retry");
+        this.name = "ExecutionOutcomeConflictError";
+        this.recorded = structuredClone(recorded);
+        this.attempted = structuredClone(attempted);
+    }
+}
+export function checkpointExecutionRecorded(cp) {
+    return cp.executionOutcome !== undefined;
+}
+export function sameExecutionRecord(a, b) {
+    return canonicalJson(a) === canonicalJson(b);
+}
+function canonicalJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "undefined";
+    if (Array.isArray(v))
+        return `[${v.map(canonicalJson).join(",")}]`;
+    const keys = Object.keys(v).filter((k) => v[k] !== undefined).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(v[k])}`).join(",")}}`;
+}
+export function executionRecordDisposition(cp, scope, gate) {
+    if (cp === undefined || cp.scope !== scope)
+        return "absent";
+    if (cp.executionOutcome !== undefined)
+        return sameExecutionRecord(cp.executionOutcome, gate) ? "already_recorded" : "conflict";
+    if (cp.status !== "resolved")
+        return "not_resolved";
+    return "commit";
+}
+export function executionVerdict(cp) {
+    return cp.executionOutcome !== undefined ? { kind: "executed", gate: cp.executionOutcome } : { kind: "unknown" };
+}

package/dist/core/checkpoint-store.d.ts

@@ -1,3 +1,5 @@
+import type { GateOutcome } from "./gate-outcome.js";
+import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type QuestionAnswer } from "./ask-question.js";
@@ -820,6 +822,36 @@ export type PendingAction = {
      * pre-1a.2 checkpoint (deserialized without it), in which case the resume skips the hash check.
      */
     boundInputHash: string;
+    /**
+     * design/388 §2.5 boundary ② (B18; additive — no checkpoint-version bump, the `previewWithheld`
+     * precedent: an optional group an older reader ignores): the IDENTITY of the row the park minted
+     * this action against, read off the leg's tool roster at the suspend station — `capabilityId`
+     * (engine-minted over {source, peer, name, contractId}), `contractId`, `shapeDigest`,
+     * `implementationRevision` — plus the roster `digest` of the leg that parked. The resume finds the
+     * same-name row on ITS leg and compares the FOUR identity members (`judgeParkedToolIdentity`): any
+     * mismatch is a replacement wearing the name and the resume refuses it
+     * (`resume.tool_contract_mismatch`, the `tool_unavailable` reopen family). All four ABSENT ⇒ a row
+     * minted before the members existed ⇒ the name-only path, never widened by their absence.
+     */
+    capabilityId?: string;
+    contractId?: string;
+    shapeDigest?: string;
+    implementationRevision?: string;
+    rosterDigest?: string;
+    /**
+     * design/388 B6 × B18 (additive; the identity group's precedent): the FACE the parked call was judged under —
+     * display `family` + declared `pathTarget` — off the same roster row at the same mint. The pre-CAS resume-edit
+     * recheck has no roster yet; it rebuilds the call face from these (`parkedCallFaceOf`) and judges the edit as
+     * the live gate judged the original (merge-seam H1: without them a caller slot fell to the catalog's slot for
+     * the NAME). Any member absent ⇒ pre-388 row ⇒ the recheck falls to the catalog, never a widened grant.
+     */
+    family?: import("./tool-face.js").ToolFamily;
+    pathTarget?: {
+        param: string;
+        aliases: string[];
+        access: "read" | "create" | "edit";
+        skillScopeEligible: boolean;
+    };
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -1062,7 +1094,7 @@ export interface CheckpointState {
     activeWorktree?: ActiveWorktreeSession;
     /**
      * Parent effective-policy inheritance (tighten-only): the durable projection of the run's
-     * {@link import("./runner/prepare-task.js").InheritedGate}. Only the serializable DATA half persists —
+     * {@link import("./runner/contracts.js").InheritedGate}. Only the serializable DATA half persists —
      * `ancestorRules` (each ancestor's session-rule snapshot: sessionId/principal/rev/rules, re-compiled on
      * resume against the resumed leg's env) and `shellGate` (the chain's max-rank shell doctrine). The OPAQUE
      * half (`parentConstraints` — live ToolPolicy/onAsk closures) CANNOT persist; `requiresParentConstraint`
@@ -1202,7 +1234,7 @@ export interface CheckpointState {
     /**
      * #281 件B follow-up — `true` iff the suspended leg ran as a DELEGATED CHILD (the trusted
      * `RunInternals.isDelegatedChild` fact, read off the leg's own minted
-     * {@link import("./runner/prepare-task.js").Prepared.hookIdentity} so a re-suspend chain carries it
+     * {@link import("./runner/contracts.js").Prepared.hookIdentity} so a re-suspend chain carries it
      * forward). Without it a deps-only resume (`resume(token, outcome, config)` — no trusted internals
      * re-supplied) re-minted the resumed leg's identity with `isDelegatedChild: false`, so the
      * delegation-lifecycle observer's emission gate stayed shut and the resumed leg emitted NEITHER
@@ -1743,6 +1775,26 @@ export interface CheckpointRow {
         scope: string;
         ttlMs?: number;
     };
+    /**
+     * @contract checkpoint.execution_outcome — the settlement record of how the DECIDED action was
+     * finally disposed on the resumed leg: the {@link GateOutcome} the resumed call's `tool_end` frame
+     * carried (an executed allow, a person's refusal delivered, or a post-CAS belt's veto of a person's
+     * yes), written by {@link CheckpointStore.recordExecutionOutcome} exactly once per row, on every
+     * resolution (an `allowed` disposition is recorded too — the column's absence has ONE meaning:
+     * the execution outcome is not known, never "it was allowed"). Independent of
+     * {@link resolvedOutcome}, which stays the immutable record of the DECISION: a row can read
+     * `resolvedOutcome.gateOutcome.disposition.kind === "allowed"` beside
+     * `executionOutcome.disposition = { kind: "denied", deniedBy: "policy" }` — the person approved,
+     * the deployment's belt refused the edited call — and a reader rebuilding the run from the row
+     * sees both facts instead of the pre-execution one alone. The record is physically immutable:
+     * a second write of a different record is a conflict, never an overwrite, and a row carrying one
+     * cannot be {@link CheckpointStore.reopen | reopened} (the action is settled; a reopen would
+     * re-run or re-decide work whose outcome is already on file). Read through
+     * `executionVerdict` (checkpoint-execution-record.ts). Present together with {@link executionAtMs}.
+     */
+    executionOutcome?: GateOutcome;
+    /** Epoch ms the store stamped {@link executionOutcome} at. Present iff `executionOutcome` is. */
+    executionAtMs?: number;
 }
 /**
  * design/80 assistant-scheduler seam #1: a LIGHTWEIGHT projection of one PENDING
@@ -1967,6 +2019,10 @@ export declare class CheckpointError extends Error {
      *  checkpoint exists. Surfaced instead of silently treating the failed reopen as committed, so the
      *  caller's compensation path settles the token as terminally consumed. */
      | "checkpoint.reopen_failed"
+    /** {@link CheckpointStore.recordExecutionOutcome} met a row that already carries a DIFFERENT
+     *  execution record — see `ExecutionOutcomeConflictError` (checkpoint-execution-record.ts), the
+     *  in-tree form of this code. Never a retry condition. */
+     | "checkpoint.execution_outcome_conflict"
     /** design/80 D-A: {@link CheckpointStore.setPendingSteer} was handed `text` containing a
      *  `</system-reminder>` close tag — it would escape the model-facing `<system-reminder>` wrapper a
      *  trusted steer rides on resume. Rejected fail-closed so a dirty steer NEVER enters {@link CheckpointState}
@@ -2151,6 +2207,10 @@ export declare class CheckpointError extends Error {
      *  checkpoint exists. Surfaced instead of silently treating the failed reopen as committed, so the
      *  caller's compensation path settles the token as terminally consumed. */
      | "checkpoint.reopen_failed"
+    /** {@link CheckpointStore.recordExecutionOutcome} met a row that already carries a DIFFERENT
+     *  execution record — see `ExecutionOutcomeConflictError` (checkpoint-execution-record.ts), the
+     *  in-tree form of this code. Never a retry condition. */
+     | "checkpoint.execution_outcome_conflict"
     /** design/80 D-A: {@link CheckpointStore.setPendingSteer} was handed `text` containing a
      *  `</system-reminder>` close tag — it would escape the model-facing `<system-reminder>` wrapper a
      *  trusted steer rides on resume. Rejected fail-closed so a dirty steer NEVER enters {@link CheckpointState}
@@ -2456,6 +2516,20 @@ export interface CheckpointStore {
         reopen: boolean;
         validatingLease?: boolean;
     };
+    /**
+     * The EXECUTION-OUTCOME declaration — REQUIRED, and required to be exactly `{ outcome: true }`: the
+     * store promises that {@link recordExecutionOutcome} is the real CAS this contract describes (the
+     * predicate, the four words, the conflict throw) and that {@link reopen} honours the record. Same
+     * "declaration, never duck-typing" posture as the three optional axes above, but not optional: the
+     * durable resume lane records how every decided action was disposed, and a store that cannot keep
+     * that record would leave every resolved row it holds silently unreadable on that axis. A store
+     * without the declaration is refused at the FIRST read of the store seat
+     * ({@link resolveCheckpointStore}, code `config.invalid_checkpoint_store`) — a JavaScript caller that
+     * satisfies no type is told at prepare what the type would have told it.
+     */
+    readonly execution: {
+        readonly outcome: true;
+    };
     /** Create-once. Throws {@link CheckpointError} `already_exists` on a token collision (never a silent
      *  overwrite — a reused token would clobber a live suspension). */
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
@@ -2505,8 +2579,35 @@ export interface CheckpointStore {
      * `tool_unavailable` (P-7: the approved tool vanished, the action may now be invalid → a human re-decides,
      * so a FRESH decision is allowed). The store RECORDS the reason on the row as {@link Checkpoint.reopenReason}
      * and PRESERVES the persisted winner across the reopen (never clears it).
+     *
+     * **A row that carries an execution record is NOT reopenable** (`… AND execution_outcome IS NULL` in the
+     * WHERE; `checkpointExecutionRecorded` is the shared predicate): the decided action's disposition is on
+     * file — see {@link CheckpointRow.executionOutcome} — and reopening it would either re-run an action that
+     * already ran or re-decide one already refused. Answers `false` like every other predicate miss; the
+     * reasons and the winner are untouched.
      */
     reopen?(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
+    /**
+     * Record how the DECIDED action was finally disposed on the resumed leg — the {@link GateOutcome} its
+     * `tool_end` frame carried (see {@link CheckpointRow.executionOutcome} for what the record means and why
+     * it is a column of its own beside the immutable decision). REQUIRED (declared by {@link execution}).
+     *
+     * The CAS: `UPDATE … SET execution_outcome=?, execution_at_ms=? WHERE token=? AND scope=? AND
+     * status='resolved' AND execution_outcome IS NULL`. The answer is a word of the closed
+     * `ExecutionOutcomeRecordWord` set — `recorded` (the CAS won), `already_recorded` (the row already
+     * carries an EQUAL record: a retry, idempotent), `not_resolved` (pending/expired: no decision to be the
+     * outcome of), `absent` (no such row in this scope). A row carrying a DIFFERENT record throws
+     * `ExecutionOutcomeConflictError` (`checkpoint.execution_outcome_conflict`) — the record is immutable
+     * and two accounts of one execution are an engine defect, never a store overwrite. Equality is
+     * structural over the record's JSON (key order and freezing are not part of the value —
+     * `sameExecutionRecord`); every backend takes its disposition from `executionRecordDisposition`
+     * (checkpoint-execution-record.ts) and keeps only the commit half itself.
+     *
+     * Never touches `status`, `rev`, `resolvedOutcome` or `reopenReason`: the record is a fact about the
+     * execution, not a transition of the decision. Its one effect on the row's other verbs is that
+     * {@link reopen} refuses a recorded row.
+     */
+    recordExecutionOutcome(token: CheckpointToken, scope: string, gate: GateOutcome): Promise<ExecutionOutcomeRecordWord>;
     /**
      * design/80 D-A: park a durable mid-task STEER on a DURABLY-SUSPENDED task's checkpoint. CAS-style update
      * `SET state.pendingSteerQueue=? WHERE token=? AND scope=? AND status='pending'`: returns `true` iff the
@@ -2692,6 +2793,12 @@ export declare function resolveCheckpointStore(spec: {
 }, deps: {
     checkpointStore?: CheckpointStore;
 }): CheckpointStore | undefined;
+/** The ONE refusal of a store seat whose {@link CheckpointStore} does not declare `execution = { outcome: true }`
+ *  (named by seat and by the store's constructor when it has one). Same door, same code, as the retired-`null`
+ *  refusal above: a configuration the run cannot honour is refused at the first read, never carried. */
+export declare function checkpointStoreExecutionUndeclared(seat: "TaskSpec.checkpointStore" | "RunnerDeps.checkpointStore", store: object): Error & {
+    code: "config.invalid_checkpoint_store";
+};
 /** The ONE refusal of the retired `checkpointStore: null` spelling (the resolver and the workflow baseline overlay both throw it). */
 export declare function retiredCheckpointStoreNull(): Error & {
     code: "config.invalid_checkpoint_store";
@@ -2803,6 +2910,10 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     readonly redecision: {
         readonly reopen: true;
     };
+    /** The execution-outcome record verb below is the contract's CAS, and `reopen` honours the record. */
+    readonly execution: {
+        readonly outcome: true;
+    };
     private cps;
     private fault;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
@@ -2855,6 +2966,7 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
      *  atomic unit this method exists to provide. (A wrapper that OMITS the member opts out
      *  cleanly: the consumer's presence probe then keeps the two-step path, hooks intact.) */
     claimTerminal(token: CheckpointToken, scope: string, intent: TerminalClaimIntent): Promise<TerminalClaimOutcome>;
+    recordExecutionOutcome(token: CheckpointToken, scope: string, gate: GateOutcome): Promise<ExecutionOutcomeRecordWord>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
     setPendingSteer(token: CheckpointToken, scope: string, steer: PendingSteerInput): Promise<boolean>;
     expire(token: CheckpointToken, scope: string): Promise<boolean>;

package/dist/core/checkpoint-store.js

@@ -4,6 +4,7 @@ import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./
 import { carriesBidiControls } from "./tool-policy.js";
 import { readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin } from "./ask-origin.js";
+import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -367,7 +368,26 @@ export function resolveCheckpointStore(spec, deps) {
         throw retiredCheckpointStoreNull();
     if (spec.checkpointStore === "disabled")
         return undefined;
-    return spec.checkpointStore ?? deps.checkpointStore;
+    if (spec.checkpointStore !== undefined) {
+        if (spec.checkpointStore.execution?.outcome !== true)
+            throw checkpointStoreExecutionUndeclared("TaskSpec.checkpointStore", spec.checkpointStore);
+        return spec.checkpointStore;
+    }
+    if (deps.checkpointStore !== undefined && deps.checkpointStore.execution?.outcome !== true) {
+        throw checkpointStoreExecutionUndeclared("RunnerDeps.checkpointStore", deps.checkpointStore);
+    }
+    return deps.checkpointStore;
+}
+export function checkpointStoreExecutionUndeclared(seat, store) {
+    const ctor = store.constructor?.name;
+    const name = typeof ctor === "string" && ctor.length > 0 && ctor !== "Object" ? ` (${ctor})` : "";
+    const e = new Error(`${seat}: the wired CheckpointStore${name} does not declare \`execution = { outcome: true }\` — the execution-outcome ` +
+        "record (recordExecutionOutcome, and reopen refusing a recorded row) is a required member of the store contract; " +
+        "a store without it cannot record how a resumed approval was disposed, so the run is refused here rather than " +
+        "resolving rows no reader can settle. Implement the verb and add the declaration (the in-tree stores and the " +
+        "store-contract kit are the reference).");
+    e.code = "config.invalid_checkpoint_store";
+    return e;
 }
 export function retiredCheckpointStoreNull() {
     const e = new Error('TaskSpec.checkpointStore: null is not a value any more — write checkpointStore: "disabled" to run without a ' +
@@ -540,6 +560,7 @@ export class InMemoryCheckpointStore {
     durability = "process-local";
     fidelity = "structured-clone";
     redecision = { reopen: true };
+    execution = { outcome: true };
     cps = new Map();
     fault = null;
     async put(token, cp) {
@@ -618,9 +639,21 @@ export class InMemoryCheckpointStore {
         }
         return out;
     }
+    async recordExecutionOutcome(token, scope, gate) {
+        const cp = this.cps.get(token);
+        const disposition = executionRecordDisposition(cp, scope, gate);
+        if (disposition === "conflict")
+            throw new ExecutionOutcomeConflictError(cp.executionOutcome, gate);
+        if (disposition !== "commit")
+            return disposition;
+        const record = structuredClone(gate);
+        cp.executionOutcome = record;
+        cp.executionAtMs = Date.now();
+        return "recorded";
+    }
     async reopen(token, scope, reason) {
         const cp = this.cps.get(token);
-        if (!checkpointRowMatches(cp, scope, "resolved")) {
+        if (!checkpointRowMatches(cp, scope, "resolved") || checkpointExecutionRecorded(cp)) {
             return false;
         }
         cp.status = "pending";

package/dist/core/context-edit.d.ts

@@ -130,28 +130,6 @@ export declare const MIN_CLEAR_SAVINGS_TOKENS = 20000;
 /** Minimum kept results — CC `EUs` :397710 `Math.max(1, keepRecent)`. See
  *  {@link ContextEditOptions.keepRecentToolResults} for why both degenerate ends are unusable. */
 export declare const MIN_KEEP_RECENT_TOOL_RESULTS = 1;
-/**
- * checklist #54 (CC microCompact.ts:41-50 `COMPACTABLE_TOOLS` parity): the INCLUSION whitelist of
- * tools whose results may be content-cleared by the stale-result pass. CC's set is exactly
- * { Read, Bash, PowerShell (SHELL_TOOL_NAMES), Grep, Glob, WebSearch, WebFetch, Edit, Write } —
- * cheap-to-regenerate I/O.
- *
- * RE-VERIFIED against the 2.1.250 corpus (design/374 slice 4, member-by-member — a set is exactly
- * the shape where "the count still matches" is not evidence): `eQt = new Set([wt, ...VD, Yo, Xo,
- * yO, Yr, tn, er])` at cli250.js:41714, whose aliases resolve to `wt`="Read", `VD`=[`Xe`="Bash",
- * `Nt`="PowerShell"], `Yo`="Grep", `Xo`="Glob", `yO`="WebSearch", `Yr`="WebFetch", `tn`="Edit",
- * `er`="Write" — nine members, byte-identical to the set below, zero drift from the 223 reading.
- * The exclusion side is the load-bearing half and is unchanged too: everything NOT here is
- * PRESERVED (Agent/Task/Skill/ToolSearch/TodoWrite/Monitor/SendMessage/NotebookEdit and ALL MCP
- * tools are never content-cleared by this pass, upstream or here).
- *
- * Everything else is PRESERVED: expensive/decision-bearing results
- * (Agent subagent reports, Task* registry state, TodoWrite acks, Monitor, MCP tools, custom
- * ToolSpecs) survive to the harder defenses (compaction summarizes them instead of blanking them).
- * PowerShell is kept for CC fidelity even though sema does not mount it. Overridable per call via
- * {@link ContextEditOptions.compactableTools} for custom-tool-heavy embedders.
- */
-export declare const COMPACTABLE_TOOLS: ReadonlySet<string>;
 export interface ContextEditOptions {
     /** Start clearing once estimated context tokens exceed this. */
     budgetTokens: number;

package/dist/core/context-edit.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { DEFAULT_CHARS_PER_TOKEN, estimateContextTokens, estimateTokens } from "../internal/harness.js";
 import { isToolResult } from "./message-utils.js";
 import { PERSISTED_OUTPUT_PREFIX, offloadPagebackHint } from "./tool-result-store.js";
+import { compactableToolNames } from "./tool-registry.js";
 const CLEARED_MARKER = "[tool result cleared to save context]";
 const CC_CLEARED_MARKER = "[Old tool result content cleared]";
 const LEGACY_CLEARED_EXTENDED_PREFIX = "[tool result cleared to save context —";
@@ -46,17 +47,7 @@ function resolveKeepRecentToolResults(value, defaultValue) {
     }
     return Math.max(MIN_KEEP_RECENT_TOOL_RESULTS, value);
 }
-export const COMPACTABLE_TOOLS = new Set([
-    "Read",
-    "Bash",
-    "PowerShell",
-    "Grep",
-    "Glob",
-    "WebSearch",
-    "WebFetch",
-    "Edit",
-    "Write",
-]);
+const COMPACTABLE_TOOLS = compactableToolNames();
 function soleMarkerText(m) {
     const content = m.content;
     if (!Array.isArray(content) || content.length !== 1)