@skrr-ai/cli 0.1.128 → 0.1.130

package/dist/lib/agentic-stream.js

@@ -206,7 +206,10 @@ async function discardTypeAhead(input, windowMs = exports.TYPE_AHEAD_DISCARD_MS)
         process.kill(process.pid, 'SIGINT');
 }
 const permissionGeneration = (event) => JSON.stringify([
-    event.sessionId, event.toolUseId, event.permissionBinding?.epoch, event.permissionBinding?.requestId,
+    event.sessionId,
+    event.toolUseId,
+    event.permissionBinding?.epoch,
+    event.permissionBinding?.requestId,
 ]);
 const PERMISSION_DETAIL_MAX = 400;
 /**
@@ -1523,7 +1526,8 @@ class AgenticStreamClient {
                 return; // a pure re-delivery — drop it whole
             const scoped = { ...event, envelopes: fresh };
             if (fresh.some((env) => env?.ev?.t === 'text' &&
-                env.ev?.publicProjection === 'lookback_answer_v1'))
+                env.ev?.publicProjection ===
+                    'lookback_answer_v1'))
                 this.publicProjection = 'lookback_answer_v1';
             // Note what never arrived before folding this batch in (OSK-7631,
             // OSK-13518). Checked against the FRESH set: a re-delivery carries old
@@ -1687,7 +1691,8 @@ class AgenticStreamClient {
         socket.on('execution:aborted', (event) => {
             if (!match(event))
                 return;
-            if (typeof event.permissionEpoch === 'string' && this.permissionEpochs.has(this.options.sessionId) &&
+            if (typeof event.permissionEpoch === 'string' &&
+                this.permissionEpochs.has(this.options.sessionId) &&
                 this.permissionEpochs.get(this.options.sessionId) !== event.permissionEpoch)
                 return;
             if (this.handover)
@@ -1698,7 +1703,8 @@ class AgenticStreamClient {
         socket.on('execution:cancelled', (event) => {
             if (!match(event))
                 return;
-            if (typeof event.permissionEpoch === 'string' && this.permissionEpochs.has(this.options.sessionId) &&
+            if (typeof event.permissionEpoch === 'string' &&
+                this.permissionEpochs.has(this.options.sessionId) &&
                 this.permissionEpochs.get(this.options.sessionId) !== event.permissionEpoch)
                 return;
             if (this.handover)
@@ -1731,7 +1737,10 @@ class AgenticStreamClient {
                 return;
             if (event.toolUseId) {
                 this.openPermissionPrompts.get(event.toolUseId)?.abort();
-                this.permissionGenerations.set(event.toolUseId, { key: permissionGeneration(event), bound: !!event.permissionBinding });
+                this.permissionGenerations.set(event.toolUseId, {
+                    key: permissionGeneration(event),
+                    bound: !!event.permissionBinding,
+                });
                 if (event.permissionBinding)
                     this.permissionEpochs.set(this.options.sessionId, event.permissionBinding.epoch);
             }
@@ -1765,21 +1774,27 @@ class AgenticStreamClient {
         // Runtime-authored application consent is exclusively an interactive app
         // decision. A TTY or --approve-tools is not that authenticated human lane.
         // Recognize malformed runtime asks too, so they never fall into generic grants.
-        if (event.purpose === 'runtime-elicitation' || event.runtimeElicitation !== undefined || event.toolName === 'ComputerUse') {
+        if (event.purpose === 'runtime-elicitation' ||
+            event.runtimeElicitation !== undefined ||
+            event.toolName === 'ComputerUse') {
             let message = 'This Computer Use request cannot be verified. Wait for a new request in the app.';
             let requestValid = false;
             try {
                 const runtime = event.runtimeElicitation;
                 (0, computer_use_1.assertComputerUseElicitationRequest)(runtime);
-                if (event.purpose !== 'runtime-elicitation' || event.toolName !== 'ComputerUse' ||
-                    event.toolUseId !== runtime.requestId || runtime.context.sessionId !== this.options.sessionId ||
+                if (event.purpose !== 'runtime-elicitation' ||
+                    event.toolName !== 'ComputerUse' ||
+                    event.toolUseId !== runtime.requestId ||
+                    runtime.context.sessionId !== this.options.sessionId ||
                     runtime.expiresAt <= Date.now())
                     throw new Error('Mismatched runtime permission');
                 const display = (text) => describePermissionTarget({ command: text }) ?? '';
-                message = [display(runtime.message),
+                message = [
+                    display(runtime.message),
                     `Choices in the app: ${runtime.options.map((option) => display(option.label)).join(' | ')}`,
                     `Expires: ${new Date(runtime.expiresAt).toISOString()}`,
-                    'Answer in the signed-in app. This CLI cannot grant or decline application access.'].join('\n');
+                    'Answer in the signed-in app. This CLI cannot grant or decline application access.',
+                ].join('\n');
                 requestValid = true;
             }
             catch {
@@ -1791,10 +1806,17 @@ class AgenticStreamClient {
             if (approvalUrl)
                 message += `\nOpen ${approvalUrl} and choose Review pending decisions.`;
             else
-                message += '\nOpen this conversation in the signed-in app and choose Review pending decisions.';
+                message +=
+                    '\nOpen this conversation in the signed-in app and choose Review pending decisions.';
             if (event.toolUseId)
                 this.browserPermissionRequests.add(event.toolUseId);
-            this.emit({ ...event, type: 'permission.browser_required', requestValid, approvalUrl, message });
+            this.emit({
+                ...event,
+                type: 'permission.browser_required',
+                requestValid,
+                approvalUrl,
+                message,
+            });
             return;
         }
         if (!this.options.approveTools || !this.socket) {
@@ -1803,7 +1825,10 @@ class AgenticStreamClient {
             // response was admitted. Tool execution is not confirmed.", which read like an approval.
             this.emit({ ...event, type: 'permission.denied', reason: 'noninteractive_or_not_enabled' });
             if (event.toolUseId) {
-                if (await this.sendBoundPermissionDecision(event, false, { reason: 'CLI was not started with --approve-tools', automatic: true }))
+                if (await this.sendBoundPermissionDecision(event, false, {
+                    reason: 'CLI was not started with --approve-tools',
+                    automatic: true,
+                }))
                     return;
                 this.socket?.emit('permission:deny', {
                     sessionId: this.options.sessionId,
@@ -1877,14 +1902,22 @@ class AgenticStreamClient {
         this.emit({ ...event, type: approved ? 'permission.approved' : 'permission.denied' });
     }
     replayPermissionDecision(event) {
-        if (!event.permissionBinding || event.decisionStatus === undefined || event.purpose === 'task-command-once' ||
-            event.purpose === 'runtime-elicitation' || event.runtimeElicitation !== undefined || event.toolName === 'ComputerUse')
+        if (!event.permissionBinding ||
+            event.decisionStatus === undefined ||
+            event.purpose === 'task-command-once' ||
+            event.purpose === 'runtime-elicitation' ||
+            event.runtimeElicitation !== undefined ||
+            event.toolName === 'ComputerUse')
             return false;
         const generation = permissionGeneration(event);
         if (event.toolUseId) {
             this.openPermissionPrompts.get(event.toolUseId)?.abort();
             this.openPermissionPrompts.delete(event.toolUseId);
-            this.permissionGenerations.set(event.toolUseId, { key: generation, bound: true, readonly: true });
+            this.permissionGenerations.set(event.toolUseId, {
+                key: generation,
+                bound: true,
+                readonly: true,
+            });
             this.permissionEpochs.set(this.options.sessionId, event.permissionBinding.epoch);
         }
         this.firstTimeSeen('permission', generation);
@@ -1892,11 +1925,18 @@ class AgenticStreamClient {
         const status = event.decisionStatus === 'recorded' ? 'recorded' : 'delivery_unconfirmed';
         if (this.firstTimeSeen('permission-receipt', `${generation}:${valid ? status : 'unknown'}`))
             this.emit({
-                ...event, type: status === 'recorded' ? 'permission.response_recorded' : 'permission.delivery_unconfirmed',
-                status, previouslyRecorded: valid, executionConfirmed: false, readonly: true,
+                ...event,
+                type: status === 'recorded'
+                    ? 'permission.response_recorded'
+                    : 'permission.delivery_unconfirmed',
+                status,
+                previouslyRecorded: valid,
+                executionConfirmed: false,
+                readonly: true,
                 message: status === 'recorded'
                     ? 'Response recorded. Waiting for execution to admit this response; no tool execution or continuing permission grant is confirmed.'
-                    : valid ? 'Response recorded; delivery unconfirmed. Check execution or Stop before starting a new turn.'
+                    : valid
+                        ? 'Response recorded; delivery unconfirmed. Check execution or Stop before starting a new turn.'
                         : 'Your response could not be confirmed. Check execution or Stop before starting a new turn.',
             });
         return true;
@@ -1906,7 +1946,9 @@ class AgenticStreamClient {
         if (!event.permissionBinding)
             return false;
         const generation = permissionGeneration(event);
-        const current = () => !this.closed && !!event.toolUseId && this.permissionGenerations.get(event.toolUseId)?.key === generation &&
+        const current = () => !this.closed &&
+            !!event.toolUseId &&
+            this.permissionGenerations.get(event.toolUseId)?.key === generation &&
             !this.permissionGenerations.get(event.toolUseId)?.readonly;
         if (!current())
             return true;
@@ -1923,27 +1965,54 @@ class AgenticStreamClient {
             const timer = setTimeout(() => finish({ type: 'permission.delivery_unconfirmed', message: unknown }), 10_000);
             try {
                 if (!this.socket?.connected) {
-                    finish({ type: 'permission.response_refused', message: 'The connection is offline. No response was sent.' });
+                    finish({
+                        type: 'permission.response_refused',
+                        message: 'The connection is offline. No response was sent.',
+                    });
                     return;
                 }
                 this.socket.emit(approved ? 'permission:approve' : 'permission:deny', {
-                    sessionId: this.options.sessionId, toolUseId: event.toolUseId, toolName: event.toolName,
-                    permissionBinding: event.permissionBinding, ...extra,
+                    sessionId: this.options.sessionId,
+                    toolUseId: event.toolUseId,
+                    toolName: event.toolName,
+                    permissionBinding: event.permissionBinding,
+                    ...extra,
                 }, (receipt) => {
                     const result = receipt?.result;
-                    if (receipt?.ok === false && ['invalid', 'unauthorized'].includes(receipt.error?.code || ''))
-                        finish({ type: 'permission.response_refused', message: receipt.error?.message || 'The response was refused. No new permission was granted.' });
+                    if (receipt?.ok === false &&
+                        ['invalid', 'unauthorized'].includes(receipt.error?.code || ''))
+                        finish({
+                            type: 'permission.response_refused',
+                            message: receipt.error?.message ||
+                                'The response was refused. No new permission was granted.',
+                        });
                     else if (receipt?.ok === false)
                         finish({ type: 'permission.delivery_unconfirmed', message: unknown });
                     else if (!result || result.toolUseId !== event.toolUseId)
                         finish({ type: 'permission.delivery_unconfirmed', message: unknown });
                     else if (result.status === 'closed')
-                        finish({ type: 'permission.response_refused', status: 'closed', message: 'This approval request is closed. No new permission was granted.' });
+                        finish({
+                            type: 'permission.response_refused',
+                            status: 'closed',
+                            message: 'This approval request is closed. No new permission was granted.',
+                        });
                     else if (result.status === 'delivery_unconfirmed')
-                        finish({ type: 'permission.delivery_unconfirmed', status: result.status, previouslyRecorded: result.previouslyRecorded === true,
-                            message: result.previouslyRecorded === true ? 'Response recorded; delivery unconfirmed. Check execution or Stop before starting a new turn.' : unknown });
-                    else if (receipt.ok === true && result.accepted === true && ['recorded', 'admitted'].includes(result.status || ''))
-                        finish({ type: 'permission.response_recorded', status: result.status, message: 'Response recorded. This does not confirm tool execution or a continuing permission grant.' });
+                        finish({
+                            type: 'permission.delivery_unconfirmed',
+                            status: result.status,
+                            previouslyRecorded: result.previouslyRecorded === true,
+                            message: result.previouslyRecorded === true
+                                ? 'Response recorded; delivery unconfirmed. Check execution or Stop before starting a new turn.'
+                                : unknown,
+                        });
+                    else if (receipt.ok === true &&
+                        result.accepted === true &&
+                        ['recorded', 'admitted'].includes(result.status || ''))
+                        finish({
+                            type: 'permission.response_recorded',
+                            status: result.status,
+                            message: 'Response recorded. This does not confirm tool execution or a continuing permission grant.',
+                        });
                     else
                         finish({ type: 'permission.delivery_unconfirmed', message: unknown });
                 });
@@ -1953,7 +2022,12 @@ class AgenticStreamClient {
             }
         });
         if (current())
-            this.emit({ ...event, ...result, decision: approved ? 'allow' : 'deny', executionConfirmed: false });
+            this.emit({
+                ...event,
+                ...result,
+                decision: approved ? 'allow' : 'deny',
+                executionConfirmed: false,
+            });
         return true;
     }
     async handleQuestion(event) {
@@ -2021,7 +2095,8 @@ class AgenticStreamClient {
     handlePermissionCancel(event) {
         const toolUseId = typeof event.toolUseId === 'string' ? event.toolUseId : undefined;
         const generation = toolUseId ? this.permissionGenerations.get(toolUseId) : undefined;
-        if (generation && (generation.bound || event.permissionBinding) &&
+        if (generation &&
+            (generation.bound || event.permissionBinding) &&
             (!event.permissionBinding || generation.key !== permissionGeneration(event)))
             return;
         const open = toolUseId ? this.openPermissionPrompts.get(toolUseId) : undefined;
@@ -2059,8 +2134,17 @@ class AgenticStreamClient {
         if (questionId)
             this.openQuestionPrompts.delete(questionId);
         open?.abort();
+        // `answered` is the server telling every surface that SOMEONE answered. When
+        // this client's own answer comes back as one there is nothing to report (it
+        // already printed `question.answered`); when another surface answered while
+        // this prompt was open, the prompt was just closed and that is worth saying.
+        if (event.reason === 'answered' && !open)
+            return;
         this.emit({
             ...event,
+            ...(event.reason === 'answered' && !event.message
+                ? { message: 'This question was answered in another window.' }
+                : {}),
             type: 'question.cancelled',
             promptClosed: Boolean(open),
         });
@@ -2207,10 +2291,11 @@ class AgenticStreamClient {
         // result, so there the line goes to stderr (OSK-13543).
         if (!this.options.jsonl && this.renderHandoverStatus(event))
             return;
-        if (event.type === 'permission.browser_required' && (this.options.quiet || !this.options.jsonl)) {
+        if (event.type === 'permission.browser_required' &&
+            (this.options.quiet || !this.options.jsonl)) {
             const output = this.options.quiet
-                ? this.options.statusOutput ?? process.stderr
-                : this.options.output ?? process.stdout;
+                ? (this.options.statusOutput ?? process.stderr)
+                : (this.options.output ?? process.stdout);
             output.write(`\n[application permission] ${String(event.message)}\n`);
             return;
         }
@@ -2292,7 +2377,11 @@ class AgenticStreamClient {
             output.write(`\n[${event.type}] ${describePermission(event)}\n`);
             this.renderedText = this.answerText();
         }
-        else if (['permission.response_recorded', 'permission.delivery_unconfirmed', 'permission.response_refused'].includes(event.type)) {
+        else if ([
+            'permission.response_recorded',
+            'permission.delivery_unconfirmed',
+            'permission.response_refused',
+        ].includes(event.type)) {
             output.write(`\n[permission] ${String(event.message ?? '')}\n`);
             this.renderedText = this.answerText();
         }
@@ -2317,7 +2406,8 @@ class AgenticStreamClient {
             output.write(`\n[question] ${why}\n`);
             this.renderedText = this.answerText();
         }
-        else if (event.type === 'permission.denied' && event.reason === 'noninteractive_or_not_enabled') {
+        else if (event.type === 'permission.denied' &&
+            event.reason === 'noninteractive_or_not_enabled') {
             // Said out loud, because nobody was asked and the agent will not say it plainly: this run
             // had no terminal to ask at and was not given --approve-tools, so the call was refused.
             output.write(`\n[permission] ${describePermission(event)} denied: nobody could be asked, and this run was not started with --approve-tools\n`);
@@ -2433,10 +2523,16 @@ class AgenticStreamClient {
             try {
                 const terminal = await reconcile();
                 if (terminal && typeof terminal.text === 'string' && terminal.text) {
-                    return { text: terminal.text, ...(terminal.publicProjection ? { publicProjection: terminal.publicProjection } : {}) };
+                    return {
+                        text: terminal.text,
+                        ...(terminal.publicProjection ? { publicProjection: terminal.publicProjection } : {}),
+                    };
                 }
                 if (terminal)
-                    empty = { text: '', ...(terminal.publicProjection ? { publicProjection: terminal.publicProjection } : {}) };
+                    empty = {
+                        text: '',
+                        ...(terminal.publicProjection ? { publicProjection: terminal.publicProjection } : {}),
+                    };
             }
             catch {
                 // No evidence either way; try again, then settle on the stream.
@@ -2498,8 +2594,9 @@ class AgenticStreamClient {
         // other way round).
         // (Compared as the reader sees it: the record holds a widget as its fallback sentence,
         // which is shorter than the block the stream carried, and the raw length would never lose.)
-        if (recorded && (recorded.publicProjection === 'lookback_answer_v1' ||
-            recorded.text.length > (0, widgetTerminalText_1.widgetsAsText)(this.accumulated, { final: true }).length)) {
+        if (recorded &&
+            (recorded.publicProjection === 'lookback_answer_v1' ||
+                recorded.text.length > (0, widgetTerminalText_1.widgetsAsText)(this.accumulated, { final: true }).length)) {
             this.accumulated = recorded.text;
             this.publicProjection = recorded.publicProjection;
         }

package/dist/lib/commitment-ledgers.js

@@ -45,7 +45,9 @@ function renderActionHistory(page, log) {
             status: text(row.status),
             check: text(row.checkId),
             // A failed or refused action's reason is the point of reading history.
-            why: [text(row.errorCode, ''), brief(row.errorMessage ?? row.reason)]
+            // A skipped action says why in `skippedReason` (a zero budget, a fenced Check), which this column
+            // never read, so every skipped row printed an empty WHY (OSK-21610).
+            why: [text(row.errorCode, ''), brief(row.errorMessage ?? row.skippedReason ?? row.reason)]
                 .filter(Boolean)
                 .join(' · '),
         })), [

package/dist/lib/commitments.d.ts

@@ -125,6 +125,18 @@ export type CommitmentPreflightReport = {
  * for an allowed activation or an older server that does not send the block.
  */
 export declare function activationRefusalLines(activation: CommitmentPreflightReport['activation']): string[];
+/**
+ * Whether the server's activation answer names this gate as one that refuses activation (OSK-21258).
+ * A gate can be advisory for a run (`admission: 'advisory'`) and still be what `resume` refuses with a
+ * 409; the gate list printed it `info (advisory: does not stop a run)` right under an "Activation:
+ * would be refused" section naming the same gate. Matches on the gate id, and on the reason too when
+ * both sides carry one, so a gate advisory for one reason is not promoted by another. An older server
+ * that sends no answer promotes nothing.
+ */
+export declare function gateRefusesActivation(activation: CommitmentPreflightReport['activation'], gate: {
+    id?: string;
+    reason?: string | null;
+}): boolean;
 /**
  * The lines every Commitment read surface prints for "whose permissions does a
  * run use?" — `show`, `effective-policy` and `preflight` share it so the three
@@ -1023,6 +1035,18 @@ export declare function describeCommitmentPriority(priority: CommitmentView['pri
  * stated: the id, and the command that says whether it is active (OSK-21242).
  */
 export declare function describeBoundCompass(commitment: Pick<CommitmentView, 'compassId' | 'agentId'>): string;
+/**
+ * The bound Compass, as `explain` prints it (OSK-21332). `explain` is where a person asks "why does
+ * this Commitment behave this way", and a bound Compass (or an archived one, which runs the
+ * Commitment on defaults) is part of the answer. The explain payload names neither the Compass nor
+ * its status, so the caller reads the Commitment itself, the same read `show` renders, and hands the
+ * result here: the line is `describeBoundCompass`, the one `show` prints, not a second wording.
+ *
+ * `null` means that read did not come back. It is said, not skipped: a silent skip is
+ * indistinguishable from "no Compass is bound". A Commitment bound to none prints nothing, as in
+ * `show`.
+ */
+export declare function explainCompassLines(commitmentId: string, commitment: Pick<CommitmentView, 'compassId' | 'agentId'> | null | undefined): string[];
 export declare function renderCommitmentSummary(commitment: CommitmentView, log: (line: string) => void, 
 /**
  * The most recent check, when the caller has one. Optional because pause /

package/dist/lib/commitments.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMMITMENT_CLI_EVALUATORS = exports.COMMITMENT_CREATE_KEYS = exports.COMMITMENT_REMEDIATION_ACTIONS = exports.COMMITMENT_FEEDBACK_KINDS = exports.commitmentApi = exports.commitmentPackApi = exports.MAX_COMMITMENT_INTERVAL_MS = exports.MIN_COMMITMENT_INTERVAL_MS = exports.COMMITMENT_EXECUTION_ISOLATION_MODES = exports.COMMITMENT_AUTHORABLE_CADENCE_MODES = exports.COMMITMENT_KIND_VALUES = exports.COMMITMENT_STATUSES = exports.COMMITMENT_CADENCE_MAX_TIMES = exports.COMMITMENT_CADENCE_TIME_PATTERN = exports.COMMITMENT_CADENCE_MODES = exports.COMMITMENT_TEMPLATE_IDS = exports.COMMITMENT_WATCHED_SOURCES = void 0;
 exports.activationRefusalLines = activationRefusalLines;
+exports.gateRefusesActivation = gateRefusesActivation;
 exports.permissionLines = permissionLines;
 exports.scheduleIssueLines = scheduleIssueLines;
 exports.retiredFieldsLine = retiredFieldsLine;
@@ -35,6 +36,7 @@ exports.renderCommitmentWriteWarnings = renderCommitmentWriteWarnings;
 exports.describeCommitmentRevision = describeCommitmentRevision;
 exports.describeCommitmentPriority = describeCommitmentPriority;
 exports.describeBoundCompass = describeBoundCompass;
+exports.explainCompassLines = explainCompassLines;
 exports.renderCommitmentSummary = renderCommitmentSummary;
 exports.describeWakeDecision = describeWakeDecision;
 exports.renderCheckList = renderCheckList;
@@ -124,6 +126,20 @@ function activationRefusalLines(activation) {
     }
     return lines;
 }
+/**
+ * Whether the server's activation answer names this gate as one that refuses activation (OSK-21258).
+ * A gate can be advisory for a run (`admission: 'advisory'`) and still be what `resume` refuses with a
+ * 409; the gate list printed it `info (advisory: does not stop a run)` right under an "Activation:
+ * would be refused" section naming the same gate. Matches on the gate id, and on the reason too when
+ * both sides carry one, so a gate advisory for one reason is not promoted by another. An older server
+ * that sends no answer promotes nothing.
+ */
+function gateRefusesActivation(activation, gate) {
+    if (!activation || activation.canActivate !== false || !gate?.id)
+        return false;
+    return (activation.blockers ?? []).some((blocker) => blocker.gate === gate.id &&
+        (!blocker.reason || !gate.reason || blocker.reason === gate.reason));
+}
 /**
  * The lines every Commitment read surface prints for "whose permissions does a
  * run use?" — `show`, `effective-policy` and `preflight` share it so the three
@@ -499,7 +515,8 @@ function unrecognizedCreateKeys(src) {
         if (known.includes(key) || SERVER_OWNED_CONTRACT_KEYS.has(key))
             continue;
         const near = key.length >= 4
-            ? known.find((candidate) => candidate.length >= 4 && editDistance(key.toLowerCase(), candidate.toLowerCase()) <= 2)
+            ? known.find((candidate) => candidate.length >= 4 &&
+                editDistance(key.toLowerCase(), candidate.toLowerCase()) <= 2)
             : undefined;
         if (near)
             typos.push({ key, suggestion: near });
@@ -521,7 +538,7 @@ function ignoredCreateKeysWarning(keys) {
     if (keys.length === 0)
         return null;
     return (`--from-json: ${keys.map((key) => `"${key}"`).join(', ')} ${keys.length === 1 ? 'is' : 'are'} not sent ` +
-        "(the CLI does not forward it), so the Commitment is built without it.");
+        '(the CLI does not forward it), so the Commitment is built without it.');
 }
 /**
  * Normalize a `--from-json` body into something the create endpoint accepts.
@@ -1291,6 +1308,25 @@ function describeBoundCompass(commitment) {
     const agent = commitment.agentId ?? '<agent-id>';
     return `Compass:   ${id} — status not shown here; an archived compass governs nothing: \`skrr compass show ${id} --agent ${agent}\``;
 }
+/**
+ * The bound Compass, as `explain` prints it (OSK-21332). `explain` is where a person asks "why does
+ * this Commitment behave this way", and a bound Compass (or an archived one, which runs the
+ * Commitment on defaults) is part of the answer. The explain payload names neither the Compass nor
+ * its status, so the caller reads the Commitment itself, the same read `show` renders, and hands the
+ * result here: the line is `describeBoundCompass`, the one `show` prints, not a second wording.
+ *
+ * `null` means that read did not come back. It is said, not skipped: a silent skip is
+ * indistinguishable from "no Compass is bound". A Commitment bound to none prints nothing, as in
+ * `show`.
+ */
+function explainCompassLines(commitmentId, commitment) {
+    if (!commitment) {
+        return [
+            `Compass:   not shown — the commitment could not be read just now; \`skrr commitments show ${commitmentId}\` prints it`,
+        ];
+    }
+    return commitment.compassId ? [describeBoundCompass(commitment)] : [];
+}
 function renderCommitmentSummary(commitment, log, 
 /**
  * The most recent check, when the caller has one. Optional because pause /
@@ -1809,6 +1845,9 @@ const CYCLE_GLYPH = {
     stopped: '●',
     quiet: '○',
     in_flight: '◌',
+    // An applied result whose agent said work is warranted and left nothing the platform can see
+    // (OSK-21608): not a tick, because the work is still owed, and not a stop, because it applied.
+    owed: '◐',
 };
 /** `MM-DD HH:MM` in the reader's local time; `-` when the time is unknown. */
 function cycleTime(value) {
@@ -1838,6 +1877,11 @@ function cycleSummary(cycle) {
         return `${question}  ${reason || gate} — ${fix || detail || 'stopped'}${moved}`;
     }
     if (cycle.outcome === 'advanced') {
+        if (cycle.owed) {
+            return cycle.advancementKinds?.length
+                ? `${cycle.advancementKinds.join(', ')} — ${data_provider_2.COMMITMENT_CYCLE_OWED_SENTENCE}`
+                : data_provider_2.COMMITMENT_CYCLE_OWED_SENTENCE;
+        }
         return cycle.advancementKinds?.length
             ? cycle.advancementKinds.join(', ')
             : 'applied an agent result';
@@ -1848,6 +1892,13 @@ function cycleSummary(cycle) {
     }
     return cycle.note || cycle.decision?.summary || cycle.decision?.posture || 'nothing to act on';
 }
+/** A record-only follow-through says what it is, and what it noted, instead of claiming progress. */
+function recordOnlyEchoSummary(cycle) {
+    const noted = cycle.advancementKinds?.length
+        ? ` (noted: ${cycle.advancementKinds.join(', ')})`
+        : '';
+    return `records the earlier run's outcome; no work of its own${noted}`;
+}
 /** Content-free rows admitted by the native sensor loader; licenses stay unknown. */
 function platformFetchLines(cycle) {
     const lines = [];
@@ -1879,8 +1930,17 @@ function formatCommitmentCycles(page) {
         return ['No cycles recorded yet.'];
     const lines = [];
     for (const cycle of cycles) {
-        const glyph = CYCLE_GLYPH[cycle.outcome] || '?';
-        lines.push(`${cycleTime(cycle.startedAt)}  ${glyph} ${String(cycle.outcome).padEnd(9)}  ${cycleWake(cycle).padEnd(18)}  ${cycleSummary(cycle)}`);
+        // A follow-through Check that only records the Run before it is not what the loop did, and
+        // `✓ advanced` above a stopped Run reads as if the work had moved (OSK-21240).
+        const echo = (0, data_provider_2.isRecordOnlyEchoCycle)(cycle);
+        const owed = !echo && cycle.outcome === 'advanced' && cycle.owed === true;
+        const glyph = echo
+            ? CYCLE_GLYPH.quiet
+            : owed
+                ? CYCLE_GLYPH.owed
+                : CYCLE_GLYPH[cycle.outcome] || '?';
+        const word = echo ? 'recorded' : owed ? 'owed' : String(cycle.outcome);
+        lines.push(`${cycleTime(cycle.startedAt)}  ${glyph} ${word.padEnd(9)}  ${cycleWake(cycle).padEnd(18)}  ${echo ? recordOnlyEchoSummary(cycle) : cycleSummary(cycle)}`);
         lines.push(...platformFetchLines(cycle));
         lines.push(...formatCycleLatency(cycle));
         for (const task of cycle.tasks || []) {

package/dist/lib/compasses.d.ts

@@ -134,6 +134,8 @@ export declare const compassApi: {
         data: CompassRevision[];
         /** True when the ledger holds rows older than this page. */
         has_more?: boolean;
+        /** How many revisions the ledger holds in all; absent from a server that predates it. */
+        total?: number;
     }>;
     trace: (id: string, query: Parameters<typeof withQuery>[1]) => Promise<CompassTrace>;
     revert: (id: string, body: Record<string, unknown>) => Promise<Compass>;

package/dist/lib/iso-instant.d.ts

@@ -0,0 +1,52 @@
+/**
+ * One reading of "an ISO-8601 UTC instant" for every CLI flag that takes one.
+ *
+ * `tasks remind --at` and `tasks schedule --at` each had their own: remind ran
+ * `new Date(value)` behind a `/^\d{4}-\d{2}-\d{2}T/` check, and schedule forwarded
+ * the string and printed the server's zod issue. `new Date()` is the wrong tool
+ * for an instant, in two ways that both stored a different time than the one
+ * typed and said nothing (OSK-21504, OSK-21506):
+ *
+ *   - a time with no zone is read in the zone of the MACHINE running the CLI, so
+ *     the same command stored different instants on different laptops;
+ *   - a day that does not exist overflows into the next month
+ *     (`2027-02-30` is `2027-03-02`).
+ *
+ * The rule here is the one `tasks schedule --help` already states and the server's
+ * `z.string().datetime()` enforces: a calendar-real date, a time with seconds, and
+ * a literal `Z`. A numeric offset is refused too, even though it names an instant:
+ * the two commands must agree, and the server's schedule door does not take one.
+ *
+ * Never reads the machine's zone. Pure.
+ */
+export type InstantProblem = 'not_a_date' | 'date_only' | 'no_zone' | 'numeric_offset' | 'not_a_real_date' | 'not_a_real_time';
+export type InstantParse = {
+    ok: true;
+    date: Date;
+    iso: string;
+} | {
+    ok: false;
+    problem: InstantProblem;
+    message: string;
+};
+/**
+ * Parse a flag value as a UTC instant, or say precisely what is wrong with it.
+ *
+ * `label` is what the user typed (`--at`, `scheduledFor`), so the message names
+ * their input rather than a REST field they never saw.
+ */
+export declare function parseUtcInstant(raw: string, label?: string): InstantParse;
+/** `2027-02-02T09:00:00Z` - the instant in UTC, whole seconds when there are no milliseconds. */
+export declare function formatUtcInstant(date: Date): string;
+/**
+ * `2027-02-02 01:00:00 PST` - the same instant on this machine's wall clock, with the
+ * zone NAMED. `toLocaleString()` printed neither the zone nor anything that mapped back
+ * to the instant that was typed (OSK-21505). `timeZone` is for tests and defaults to
+ * the machine's own.
+ */
+export declare function formatLocalInstant(date: Date, timeZone?: string): string;
+/**
+ * The instant for a person: UTC first (it is what was typed and what is stored), then the
+ * local reading with its zone name. A machine already on UTC gets the UTC form alone.
+ */
+export declare function describeInstant(date: Date, timeZone?: string): string;