@superjackfruitlabs/salaam 0.0.3 → 0.0.5

package/dist/src/agentpod-work.js

@@ -1,3 +1,8 @@
+import { BoardReads } from './board-reads.js';
+import { StationCheckpoints } from './station-checkpoints.js';
+import { requiredChecks } from './task-policy.js';
+import { RATE_LIMIT_STOP, RateLimitRetries } from './rate-limit-retries.js';
+import { planUpdate, toolMetadata, toolTitle } from './acp-outcome.js';
 import { canonical, digest, textDigest, ServiceError } from './protocol.js';
 import { DIAGNOSTIC_PROFILE, NATIVE_CAPABILITIES } from './worker-boundary.js';
 import { POLICY_DIGEST } from './config.js';
@@ -10,6 +15,8 @@ import { agentpodWorkAdmission, checkAgentPodWorkAdmission, } from './agentpod-w
  * adapter must supply its own session and independently admitted work identity.
  * This receipt records task admission, never successful work or permission to run.
  */
+/** Extra progression steps a strict grant may carry, only ever spent on re-running a step. */
+export const RERUN_ALLOWANCE = 3;
 export class AgentPodWork {
     store;
     authority;
@@ -38,6 +45,7 @@ export class AgentPodWork {
             objective: task.objective,
             constraints: task.constraints,
             acceptance: task.acceptance,
+            ...(task.completion_gate ? { completion_gate: task.completion_gate } : {}),
             deliverables: task.deliverables,
             limits: task.limits,
             steps: task.steps.map(({ key, title, instruction, depends_on, checks }) => ({
@@ -253,9 +261,12 @@ export class AgentPodWork {
                     offered,
                 })
                 : null;
-            if (!simple && !history)
+            const multi = !simple && !history
+                ? this.multiOfferReviewExpiry(root.session_id, task, runtime, offered)
+                : null;
+            if (!simple && !history && !multi)
                 throw new ServiceError('work_settlement_unsafe', 'Only exact expired unanswered unapplied work with closed historical evidence can be settled');
-            if (history)
+            if (history || multi)
                 this.store.event(root.session_id, 'agentpod.work_expiry_evidence', {
                     version: 1,
                     task_id: task.id,
@@ -265,7 +276,7 @@ export class AgentPodWork {
                         request_id: request,
                         work_request_id: workRequest,
                         producer_terminal_digest: terminalDigest,
-                        history,
+                        ...(history ? { history } : { several_review_offers: multi }),
                     }),
                 }, request);
             if (task.state !== 'cancelled')
@@ -289,6 +300,530 @@ export class AgentPodWork {
             return receipt;
         });
     }
+    /** Several unanswered review offers in one attempt: each one expired, or was invalidated by the
+     * owner's revocation (a hub restart), before anyone answered it. Every operation was cancelled
+     * before dispatch, the only station calls are closed reads, and nothing ran after the revoke. */
+    multiOfferReviewExpiry(session, task, runtime, offered) {
+        if (task.state !== 'blocked' ||
+            task.steps.some((s) => !['pending', 'cancelled'].includes(s.state)) ||
+            !runtime ||
+            runtime.auto_enabled ||
+            runtime.reserved_requests ||
+            runtime.reserved_tokens ||
+            runtime.verification_runs)
+            return null;
+        const attempts = this.store.db
+            .prepare('SELECT * FROM attempts WHERE session_id=?')
+            .all(session);
+        const attempt = attempts[0];
+        if (attempts.length !== 1 ||
+            !attempt ||
+            attempt.state !== 'cancelled' ||
+            attempt.resolved_by !== null ||
+            attempt.result !== null)
+            return null;
+        // Cancelled by the node's revocation of this session, which names exactly this attempt.
+        const cancellations = this.store.db
+            .prepare('SELECT * FROM cancellations WHERE attempt_id=?')
+            .all(String(attempt.id));
+        const revocations = this.store.db
+            .prepare('SELECT * FROM session_revocations WHERE session_id=?')
+            .all(session);
+        if (cancellations.length !== 1 ||
+            cancellations[0].requested_by !== 'agentpod-node' ||
+            revocations.length !== 1)
+            return null;
+        const revocation = JSON.parse(String(revocations[0].receipt));
+        if (revocation.revoked !== true ||
+            canonical(revocation.attempt_ids) !== canonical([attempt.id]) ||
+            canonical(revocation.unresolved_operations) !== canonical([]))
+            return null;
+        const events = this.store.db
+            .prepare('SELECT seq,kind,payload,causation_id FROM events WHERE session_id=? ORDER BY seq')
+            .all(session);
+        const one = (kind) => {
+            const found = events.filter((e) => e.kind === kind);
+            return found.length === 1 ? found[0] : null;
+        };
+        const requested = one('attempt.cancel_requested'), revoked = one('execution.revoked'), cancelled = one('attempt.cancelled');
+        if (!requested ||
+            !revoked ||
+            !cancelled ||
+            requested.causation_id !== 'agentpod-revocation' ||
+            !(Number(requested.seq) < Number(revoked.seq) && Number(revoked.seq) < Number(cancelled.seq)) ||
+            events.some((e) => e.kind === 'tool.started' && Number(e.seq) > Number(requested.seq)))
+            return null;
+        // Two or more review operations, all on this attempt, all cancelled before dispatch.
+        const ops = this.store.db
+            .prepare('SELECT * FROM operations WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        if (ops.length < 2 ||
+            !ops.some((op) => op.id === offered.operation_id) ||
+            ops.some((op) => op.kind !== 'review' ||
+                op.state !== 'cancelled_before_dispatch' ||
+                op.attempt_id !== attempt.id))
+            return null;
+        const of = (e) => JSON.parse(String(e.payload));
+        // The invalidations the revocation made: the contiguous block of invalidated approvals and
+        // their cancelled operations that ends at the revocation's own cancel request.
+        const block = new Set();
+        for (let n = events.indexOf(requested) - 1; n >= 0; n--) {
+            const e = events[n];
+            if (e.kind === 'operation.cancelled_before_dispatch')
+                continue;
+            if (e.kind !== 'approval.invalidated')
+                break;
+            block.add(String(of(e).approval_id));
+        }
+        const offers = [];
+        for (const op of ops) {
+            const approvals = this.store.db
+                .prepare('SELECT * FROM approvals WHERE operation_id=?')
+                .all(String(op.id));
+            const approval = approvals[0];
+            if (approvals.length !== 1 ||
+                !approval ||
+                approval.session_id !== session ||
+                approval.decision !== null ||
+                approval.operation_digest !== op.operation_digest)
+                return null;
+            if (approval.state === 'expired') {
+                const expired = events.findIndex((e) => e.kind === 'approval.expired' && of(e).approval_id === approval.id);
+                if (expired < 0 ||
+                    Number(approval.expires_at) > Date.now() ||
+                    events[expired + 1]?.kind !== 'operation.cancelled_before_dispatch' ||
+                    of(events[expired + 1]).operation_id !== op.id)
+                    return null;
+            }
+            else if (approval.state !== 'invalidated' || !block.has(String(approval.id)))
+                return null;
+            offers.push({ operation_id: op.id, approval_id: approval.id, state: approval.state });
+        }
+        // The decision being settled is one that expired unanswered, exactly as it was offered.
+        const settled = offers.find((o) => o.approval_id === offered.approval_id);
+        const approval = this.store.db
+            .prepare('SELECT * FROM approvals WHERE id=?')
+            .get(String(offered.approval_id));
+        if (settled?.state !== 'expired' ||
+            !approval ||
+            approval.operation_digest !== offered.operation_digest ||
+            approval.expires_at !== offered.expires_at)
+            return null;
+        const units = this.noLedgeredEffects(session, task, { operations: true, stationReads: true });
+        if (!units)
+            return null;
+        return {
+            revocation,
+            offers,
+            reads: this.store.db
+                .prepare('SELECT id,input_digest FROM station_calls WHERE session_id=? ORDER BY id')
+                .all(session),
+            unbound_stopped_units: units,
+        };
+    }
+    /** An attempt the request-budget control interrupted after its operator MCP calls kept failing:
+     * every call is journaled as failed or tool_error, the only station calls are closed reads, and
+     * no tool ran after the stop. The failed calls are preserved as the known effects. */
+    requestBudgetStopFailure(session, task, runtime, attempts) {
+        const reason = 'Required control failed: No model request budget remains', 
+        // Picked by state, never by row order; the count below rejects any other attempt.
+        attempt = attempts.find((a) => a.state === 'interrupted');
+        if (task.state !== 'blocked' ||
+            !runtime ||
+            runtime.auto_enabled ||
+            runtime.reserved_requests ||
+            runtime.reserved_tokens ||
+            runtime.verification_runs ||
+            attempts.length !== 1 ||
+            !attempt ||
+            attempt.error !== reason ||
+            attempt.resolved_by !== null ||
+            attempt.continues_attempt_id !== null ||
+            attempt.result !== null)
+            return null;
+        const steps = task.steps.filter((s) => s.attempt_id === attempt.id);
+        if (steps.length !== 1 ||
+            steps[0].state !== 'interrupted' ||
+            task.steps.some((s) => s !== steps[0] && (s.state !== 'pending' || s.attempt_id !== null)))
+            return null;
+        // Stopped by the budget control, not cancelled by anyone.
+        if (this.store.db
+            .prepare('SELECT 1 FROM cancellations WHERE attempt_id=?')
+            .get(String(attempt.id)))
+            return null;
+        const events = this.store.db
+            .prepare('SELECT seq,kind,payload FROM events WHERE session_id=? ORDER BY seq')
+            .all(session);
+        const of = (e) => JSON.parse(String(e.payload));
+        const unhealthy = events.filter((e) => e.kind === 'worker.unhealthy'), interrupted = events.filter((e) => e.kind === 'attempt.interrupted');
+        if (unhealthy.length !== 1 ||
+            interrupted.length !== 1 ||
+            of(unhealthy[0]).error !== reason ||
+            of(interrupted[0]).attempt_id !== attempt.id ||
+            of(interrupted[0]).error !== reason ||
+            Number(unhealthy[0].seq) >= Number(interrupted[0].seq))
+            return null;
+        // Tools: operator MCP (catalog reads, or a journaled failed call) and station reads, every one
+        // closed before the stop. Tools may run in parallel, and a call does not name its tool, so each
+        // call takes an open operator MCP tool that has none yet; a call with no such tool is refused.
+        const calls = [];
+        const open = new Map();
+        for (const e of events) {
+            if (!['tool.started', 'tool.finished', 'operator_mcp.call'].includes(String(e.kind)))
+                continue;
+            const payload = of(e);
+            if (Number(e.seq) >= Number(unhealthy[0].seq) || payload.attempt_id !== attempt.id)
+                return null;
+            if (e.kind === 'tool.started') {
+                if (!['salaam_operator_mcp', 'salaam_station', 'salaam_board'].includes(String(payload.tool)) ||
+                    typeof payload.tool_call_id !== 'string' ||
+                    !payload.tool_call_id ||
+                    payload.parent_tool_call_id)
+                    return null;
+                open.set(payload.tool_call_id, { tool: String(payload.tool), calls: 0 });
+            }
+            else if (e.kind === 'tool.finished') {
+                const started = open.get(String(payload.tool_call_id));
+                if (!started || payload.tool !== started.tool)
+                    return null;
+                open.delete(String(payload.tool_call_id));
+            }
+            else {
+                const free = [...open.values()].find((t) => t.tool === 'salaam_operator_mcp' && t.calls === 0);
+                if (!free || !['failed', 'tool_error'].includes(String(payload.outcome)))
+                    return null;
+                free.calls++;
+                calls.push({ seq: e.seq, ...payload });
+            }
+        }
+        if (open.size)
+            return null;
+        const units = this.noLedgeredEffects(session, task, { stationReads: true });
+        if (!units)
+            return null;
+        return {
+            unhealthy: unhealthy[0],
+            interrupted: interrupted[0],
+            operator_mcp_calls: calls,
+            reads: this.store.db
+                .prepare('SELECT id,input_digest FROM station_calls WHERE session_id=? ORDER BY id')
+                .all(session),
+            unbound_stopped_units: units,
+        };
+    }
+    /** An attempt the task runtime limit stopped while its approved workspace writes were all
+     * refused by the protected filesystem before their mutation boundary. Each write is journaled
+     * failed_definite: refused by the station helper after its approval, or (the one still waiting
+     * when the stop came) cancelled before dispatch with its approval invalidated. Every other
+     * station call is a closed read, every operator MCP call is closed inside its own tool, and no
+     * tool started after the stop. The refused writes and the reads are the known effects. */
+    runtimeStopRefusedWritesFailure(session, task, runtime, attempts) {
+        const reason = 'Task runtime limit reached', refused = 'Protected filesystem refused before its mutation boundary', notSent = 'Workspace apply was cancelled before dispatch', attempt = attempts[0];
+        if (task.state !== 'blocked' ||
+            !runtime ||
+            runtime.blocked_reason !== reason ||
+            runtime.started_at === null ||
+            !Number.isFinite(Number(runtime.started_at)) ||
+            Date.now() - Number(runtime.started_at) < task.limits.runtime_ms ||
+            runtime.auto_enabled ||
+            runtime.reserved_requests ||
+            runtime.reserved_tokens ||
+            runtime.verification_runs ||
+            attempts.length !== 1 ||
+            !attempt ||
+            attempt.state !== 'cancelled' ||
+            attempt.error !== 'Attempt aborted' ||
+            attempt.resolved_by !== null ||
+            attempt.continues_attempt_id !== null ||
+            attempt.result !== null)
+            return null;
+        const steps = task.steps.filter((s) => s.attempt_id === attempt.id);
+        if (steps.length !== 1 ||
+            steps[0].state !== 'cancelled' ||
+            task.steps.some((s) => s !== steps[0] && (s.state !== 'pending' || s.attempt_id !== null)))
+            return null;
+        // Stopped by the runtime limit's own task stop, not by anyone.
+        const cancellations = this.store.db
+            .prepare('SELECT * FROM cancellations WHERE attempt_id=?')
+            .all(String(attempt.id));
+        if (cancellations.length !== 1 || cancellations[0].requested_by !== 'task-stop')
+            return null;
+        const events = this.store.db
+            .prepare('SELECT seq,kind,payload FROM events WHERE session_id=? ORDER BY seq')
+            .all(session);
+        const of = (e) => JSON.parse(String(e.payload));
+        const blocks = events.filter((e) => e.kind === 'work_task.budget_blocked' && of(e).reason === reason), requested = events.filter((e) => e.kind === 'attempt.cancel_requested'), cancelled = events.filter((e) => e.kind === 'attempt.cancelled');
+        if (blocks.length !== 1 ||
+            requested.length !== 1 ||
+            cancelled.length !== 1 ||
+            of(requested[0]).attempt_id !== attempt.id ||
+            of(cancelled[0]).attempt_id !== attempt.id ||
+            !(Number(blocks[0].seq) < Number(requested[0].seq) &&
+                Number(requested[0].seq) < Number(cancelled[0].seq)))
+            return null;
+        // Every operation is a workspace write on this attempt that never crossed its boundary.
+        const ops = this.store.db
+            .prepare('SELECT * FROM operations WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        const calls = this.store.db
+            .prepare('SELECT * FROM station_calls WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        if (!ops.length)
+            return null;
+        const writes = [];
+        for (const op of ops) {
+            const approval = this.store.db
+                .prepare('SELECT * FROM approvals WHERE operation_id=?')
+                .get(String(op.id));
+            const linked = calls.filter((c) => c.operation_id === op.id);
+            const call = linked[0];
+            if (op.kind !== 'workspace' ||
+                op.attempt_id !== attempt.id ||
+                op.state !== 'failed_definite' ||
+                linked.length !== 1 ||
+                !call ||
+                call.kind !== 'patch' ||
+                call.attempt_id !== attempt.id ||
+                !approval ||
+                approval.operation_digest !== op.operation_digest)
+                return null;
+            if (op.error === refused) {
+                // Approved, sent, and refused by the helper before it could change anything.
+                if (approval.state !== 'decided' ||
+                    approval.decision !== 'approve' ||
+                    call.state !== 'failed' ||
+                    call.helper_state !== 'stopped' ||
+                    !call.result_json ||
+                    canonical(JSON.parse(String(call.result_json))) !==
+                        canonical({ code: 'station_files_changed' }))
+                    return null;
+            }
+            else if (op.error === notSent) {
+                // Still waiting when the stop came: never sent to the helper at all.
+                if (approval.state !== 'invalidated' ||
+                    call.state !== 'cancelled' ||
+                    call.helper_state !== 'none' ||
+                    call.result_json !== null)
+                    return null;
+            }
+            else
+                return null;
+            writes.push({
+                operation_id: op.id,
+                operation_digest: op.operation_digest,
+                error: op.error,
+                approval: approval.state,
+                call_id: call.id,
+                call_state: call.state,
+            });
+        }
+        // The remaining station calls are closed reads.
+        const reads = calls.filter((c) => c.operation_id === null);
+        if (reads.some((c) => c.kind !== 'read' || c.state !== 'returned'))
+            return null;
+        // Tools: station calls and operator MCP tools, every one closed, none started after the stop,
+        // each operator MCP call inside an open operator MCP tool that has no call yet.
+        const mcp = [];
+        const open = new Map();
+        for (const e of events) {
+            if (!['tool.started', 'tool.finished', 'operator_mcp.call'].includes(String(e.kind)))
+                continue;
+            const payload = of(e);
+            if (Number(e.seq) >= Number(cancelled[0].seq) || payload.attempt_id !== attempt.id)
+                return null;
+            if (e.kind === 'tool.started') {
+                if (Number(e.seq) >= Number(requested[0].seq) ||
+                    !['salaam_operator_mcp', 'salaam_station', 'salaam_board'].includes(String(payload.tool)) ||
+                    typeof payload.tool_call_id !== 'string' ||
+                    !payload.tool_call_id ||
+                    payload.parent_tool_call_id)
+                    return null;
+                open.set(payload.tool_call_id, { tool: String(payload.tool), calls: 0 });
+            }
+            else if (e.kind === 'tool.finished') {
+                const started = open.get(String(payload.tool_call_id));
+                if (!started || payload.tool !== started.tool)
+                    return null;
+                open.delete(String(payload.tool_call_id));
+            }
+            else {
+                const free = [...open.values()].find((t) => t.tool === 'salaam_operator_mcp' && t.calls === 0);
+                if (!free || !['returned', 'failed', 'tool_error'].includes(String(payload.outcome)))
+                    return null;
+                free.calls++;
+                mcp.push({ seq: e.seq, ...payload });
+            }
+        }
+        if (open.size)
+            return null;
+        const units = this.noLedgeredEffects(session, task, { operations: true, stationCalls: true });
+        if (!units)
+            return null;
+        return {
+            blocked: blocks[0],
+            cancel_requested: requested[0],
+            cancelled: cancelled[0],
+            refused_writes: writes,
+            reads: reads.map((c) => ({ id: c.id, input_digest: c.input_digest })),
+            operator_mcp_calls: mcp,
+            unbound_stopped_units: units,
+        };
+    }
+    /** An attempt the request-budget control interrupted after its approved work had succeeded:
+     * each workspace write approved, applied through exactly one returned patch call and recorded
+     * with that call's own receipt, and any review approved and read-only. Every other station call
+     * is a closed read or a returned check whose unit stopped with a complete proof, and no tool ran
+     * after the stop. The applied writes and the review are the known effects. */
+    requestBudgetStopKnownEffectsFailure(session, binding, task, runtime, attempts) {
+        const reason = 'Required control failed: No model request budget remains', attempt = attempts.find((a) => a.state === 'interrupted');
+        if (task.state !== 'blocked' ||
+            !runtime ||
+            runtime.auto_enabled ||
+            runtime.reserved_requests ||
+            runtime.reserved_tokens ||
+            runtime.verification_runs ||
+            attempts.length !== 1 ||
+            !attempt ||
+            attempt.error !== reason ||
+            attempt.resolved_by !== null ||
+            attempt.continues_attempt_id !== null ||
+            attempt.result !== null)
+            return null;
+        const steps = task.steps.filter((s) => s.attempt_id === attempt.id);
+        if (steps.length !== 1 ||
+            steps[0].state !== 'interrupted' ||
+            task.steps.some((s) => s !== steps[0] && (s.state !== 'pending' || s.attempt_id !== null)))
+            return null;
+        if (this.store.db
+            .prepare('SELECT 1 FROM cancellations WHERE attempt_id=?')
+            .get(String(attempt.id)))
+            return null;
+        const events = this.store.db
+            .prepare('SELECT seq,kind,payload FROM events WHERE session_id=? ORDER BY seq')
+            .all(session);
+        const of = (e) => JSON.parse(String(e.payload));
+        const unhealthy = events.filter((e) => e.kind === 'worker.unhealthy'), interrupted = events.filter((e) => e.kind === 'attempt.interrupted');
+        if (unhealthy.length !== 1 ||
+            interrupted.length !== 1 ||
+            of(unhealthy[0]).error !== reason ||
+            of(interrupted[0]).attempt_id !== attempt.id ||
+            of(interrupted[0]).error !== reason ||
+            Number(unhealthy[0].seq) >= Number(interrupted[0].seq))
+            return null;
+        const ops = this.store.db
+            .prepare('SELECT * FROM operations WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        const calls = this.store.db
+            .prepare('SELECT * FROM station_calls WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        if (!ops.length)
+            return null;
+        const root = digest(binding), effects = [];
+        for (const op of ops) {
+            const approval = this.store.db
+                .prepare('SELECT * FROM approvals WHERE operation_id=?')
+                .get(String(op.id));
+            const linked = calls.filter((c) => c.operation_id === op.id);
+            if (op.attempt_id !== attempt.id ||
+                op.state !== 'succeeded' ||
+                !approval ||
+                approval.state !== 'decided' ||
+                approval.decision !== 'approve' ||
+                approval.operation_digest !== op.operation_digest ||
+                !op.receipt)
+                return null;
+            if (op.kind === 'workspace') {
+                const call = linked[0], effect = JSON.parse(String(op.receipt));
+                if (op.resolution !== 'workspace-content-receipt-v1' ||
+                    // station_calls.operation_id is unique, so a write has at most one call.
+                    !call ||
+                    call.kind !== 'patch' ||
+                    call.state !== 'returned' ||
+                    call.helper_state !== 'stopped' ||
+                    call.attempt_id !== attempt.id ||
+                    !call.result_json ||
+                    effect.version !== 1 ||
+                    effect.scope !== 'station-workspace' ||
+                    effect.call_id !== call.id ||
+                    effect.root_digest !== root ||
+                    effect.root_digest !== call.root_digest ||
+                    effect.configuration_digest !== call.configuration_digest ||
+                    effect.input_digest !== call.input_digest ||
+                    canonical(effect.result) !== canonical(JSON.parse(String(call.result_json))) ||
+                    effect.result?.ok !== true)
+                    return null;
+                effects.push({
+                    operation_id: op.id,
+                    operation_digest: op.operation_digest,
+                    call_id: call.id,
+                    effect,
+                });
+            }
+            else if (op.kind === 'review') {
+                if (op.connector !== 'local-review-v1' ||
+                    op.replay !== 'read-only' ||
+                    op.resolution !== 'local-review-receipt' ||
+                    linked.length)
+                    return null;
+                effects.push({ operation_id: op.id, operation_digest: op.operation_digest, review: true });
+            }
+            else
+                return null;
+        }
+        // Other station calls: closed reads, or returned checks whose own unit stopped with proof.
+        const others = calls.filter((c) => c.operation_id === null);
+        if (others.some((c) => c.state !== 'returned' ||
+            !(c.kind === 'read' || (c.kind === 'check' && c.helper_state === 'stopped'))))
+            return null;
+        const checks = others.filter((c) => c.kind === 'check').map((c) => String(c.id));
+        const mcp = [];
+        const open = new Map();
+        for (const e of events) {
+            if (!['tool.started', 'tool.finished', 'operator_mcp.call'].includes(String(e.kind)))
+                continue;
+            const payload = of(e);
+            if (Number(e.seq) >= Number(unhealthy[0].seq) || payload.attempt_id !== attempt.id)
+                return null;
+            if (e.kind === 'tool.started') {
+                if (!['salaam_operator_mcp', 'salaam_station', 'salaam_board', 'salaam_review'].includes(String(payload.tool)) ||
+                    typeof payload.tool_call_id !== 'string' ||
+                    !payload.tool_call_id ||
+                    payload.parent_tool_call_id)
+                    return null;
+                open.set(payload.tool_call_id, { tool: String(payload.tool), calls: 0 });
+            }
+            else if (e.kind === 'tool.finished') {
+                const started = open.get(String(payload.tool_call_id));
+                if (!started || payload.tool !== started.tool)
+                    return null;
+                open.delete(String(payload.tool_call_id));
+            }
+            else {
+                const free = [...open.values()].find((t) => t.tool === 'salaam_operator_mcp' && t.calls === 0);
+                if (!free || !['returned', 'failed', 'tool_error'].includes(String(payload.outcome)))
+                    return null;
+                free.calls++;
+                mcp.push({ seq: e.seq, ...payload });
+            }
+        }
+        if (open.size)
+            return null;
+        const units = this.noLedgeredEffects(session, task, {
+            operations: true,
+            stationCalls: true,
+            checkUnits: checks,
+        });
+        if (!units)
+            return null;
+        return {
+            unhealthy: unhealthy[0],
+            interrupted: interrupted[0],
+            known_effects: effects,
+            station_calls: others.map((c) => ({ id: c.id, kind: c.kind, input_digest: c.input_digest })),
+            operator_mcp_calls: mcp,
+            unbound_stopped_units: units,
+        };
+    }
     /** A disjoint failure profile: the native child was denied before any effect
      * ledger was created. Stopped resources alone never establish zero effects. */
     zeroEffectConcurrencyFailure(session, task, runtime, attempts) {
@@ -369,6 +904,21 @@ export class AgentPodWork {
             links[0].plan_revision !== task.plan_revision ||
             links[0].step_id !== task.steps.find((s) => s.attempt_id === attempt.id)?.id)
             return null;
+        const units = this.noLedgeredEffects(session, task);
+        if (!units)
+            return null;
+        return {
+            block: blocks[0],
+            activity,
+            model: models[0],
+            policy: policies[0],
+            link: links[0],
+            unbound_stopped_units: units,
+        };
+    }
+    /** Every execution/effect ledger, including read calls, is empty for this session and task,
+     * and any station unit is unbound with a complete durable stop proof. Returns those units. */
+    noLedgeredEffects(session, task, checked = {}) {
         // These are all independent execution/effect ledgers, including read calls.
         for (const table of [
             'operations',
@@ -379,6 +929,17 @@ export class AgentPodWork {
             'local_calls',
             'command_runs',
         ]) {
+            // A caller that proves its own operations or closed reads checks those itself.
+            if (table === 'operations' && checked.operations)
+                continue;
+            if (table === 'station_calls' && checked.stationCalls)
+                continue;
+            if (table === 'station_calls' &&
+                checked.stationReads &&
+                !this.store.db
+                    .prepare("SELECT 1 FROM station_calls WHERE session_id=? AND NOT (kind='read' AND state='returned')")
+                    .get(session))
+                continue;
             if (this.store.db.prepare(`SELECT 1 FROM ${table} WHERE session_id=?`).get(session))
                 return null;
         }
@@ -420,8 +981,11 @@ export class AgentPodWork {
             .prepare('SELECT * FROM station_units WHERE session_id=? OR session_id IS NULL')
             .all(session);
         for (const unit of units) {
-            if (unit.session_id !== null ||
-                unit.call_id !== null ||
+            // A proven returned check's own unit belongs to this session; it still needs its stop proof.
+            const ownCheck = unit.session_id === session &&
+                typeof unit.call_id === 'string' &&
+                !!checked.checkUnits?.includes(unit.call_id);
+            if ((!ownCheck && (unit.session_id !== null || unit.call_id !== null)) ||
                 unit.state !== 'stopped' ||
                 !unit.stop_json)
                 return null;
@@ -434,11 +998,139 @@ export class AgentPodWork {
                 !/^[a-f0-9]{32}$/.test(stop.invocation))
                 return null;
         }
+        return units;
+    }
+    /** An attempt the owner's authority revocation cancelled (for example a hub restart) before
+     * any ledgered effect. The only tool activity allowed is closed operator MCP calls, each
+     * journaled with argument and result digests; they are preserved as the known effects. */
+    revokeCancelledFailure(session, task, runtime, attempts) {
+        const attempt = attempts[0];
+        if (task.state !== 'blocked' ||
+            !runtime ||
+            runtime.auto_enabled ||
+            runtime.reserved_requests ||
+            runtime.reserved_tokens ||
+            runtime.verification_runs ||
+            attempts.length !== 1 ||
+            !attempt ||
+            attempt.state !== 'cancelled' ||
+            attempt.resolved_by !== null ||
+            attempt.continues_attempt_id !== null ||
+            attempt.result !== null ||
+            !attempt.outcome)
+            return null;
+        const outcome = JSON.parse(String(attempt.outcome));
+        if (outcome.version !== 1 ||
+            outcome.stopReason !== 'cancelled' ||
+            outcome.failure?.kind !== 'cancelled' ||
+            outcome.failure.code !== 'attempt_cancelled' ||
+            outcome.failure.retryable !== false ||
+            outcome.failure.sessionId !== session ||
+            outcome.failure.attemptId !== attempt.id)
+            return null;
+        const steps = task.steps.filter((s) => s.attempt_id === attempt.id);
+        if (steps.length !== 1 ||
+            steps[0].state !== 'cancelled' ||
+            task.steps.some((s) => s !== steps[0] && (s.state !== 'pending' || s.attempt_id !== null)))
+            return null;
+        const links = this.store.db
+            .prepare('SELECT b.* FROM task_step_attempts b JOIN task_steps s ON s.id=b.step_id WHERE s.task_id=?')
+            .all(task.id);
+        if (links.length !== 1 ||
+            links[0].attempt_id !== attempt.id ||
+            links[0].plan_revision !== task.plan_revision ||
+            links[0].step_id !== steps[0].id)
+            return null;
+        // The cancellation came from the node's revocation of this session, not a local operator.
+        const cancellations = this.store.db
+            .prepare('SELECT * FROM cancellations WHERE attempt_id=?')
+            .all(String(attempt.id));
+        const revocations = this.store.db
+            .prepare('SELECT * FROM session_revocations WHERE session_id=?')
+            .all(session);
+        if (cancellations.length !== 1 ||
+            cancellations[0].requested_by !== 'agentpod-node' ||
+            revocations.length !== 1)
+            return null;
+        const revocation = JSON.parse(String(revocations[0].receipt));
+        if (revocation.revoked !== true ||
+            revocation.session_id !== session ||
+            canonical(revocation.session_ids) !== canonical([session]) ||
+            canonical(revocation.attempt_ids) !== canonical([attempt.id]) ||
+            canonical(revocation.unresolved_operations) !== canonical([]) ||
+            typeof revocation.request_id !== 'string' ||
+            !revocation.request_id)
+            return null;
+        const marks = this.store.db
+            .prepare("SELECT seq,kind,payload,causation_id FROM events WHERE session_id=? AND kind IN ('attempt.cancel_requested','execution.revoked','attempt.cancelled') ORDER BY seq")
+            .all(session);
+        const only = (kind) => {
+            const found = marks.filter((e) => e.kind === kind);
+            return found.length === 1 ? found[0] : null;
+        };
+        const requested = only('attempt.cancel_requested'), revoked = only('execution.revoked'), cancelled = only('attempt.cancelled');
+        if (marks.length !== 3 ||
+            !requested ||
+            !revoked ||
+            !cancelled ||
+            requested.causation_id !== 'agentpod-revocation' ||
+            JSON.parse(String(requested.payload)).attempt_id !== attempt.id ||
+            revoked.causation_id !== revocation.request_id ||
+            JSON.parse(String(revoked.payload)).owner_session !== session ||
+            JSON.parse(String(cancelled.payload)).attempt_id !== attempt.id ||
+            !(Number(requested.seq) < Number(revoked.seq) && Number(revoked.seq) < Number(cancelled.seq)))
+            return null;
+        // Tool activity: only operator MCP tools, each closed before the revocation, each holding
+        // at most one journaled call (none for a catalog read), and no call outside a tool.
+        const activity = this.store.db
+            .prepare("SELECT seq,kind,payload FROM events WHERE session_id=? AND kind IN ('tool.started','tool.finished','operator_mcp.call','policy.allowed','policy.denied') ORDER BY seq")
+            .all(session);
+        const calls = [];
+        let open = null;
+        for (const event of activity) {
+            const payload = JSON.parse(String(event.payload));
+            if (Number(event.seq) >= Number(requested.seq))
+                return null;
+            if (payload.attempt_id !== attempt.id)
+                return null;
+            if (event.kind === 'tool.started') {
+                if (open ||
+                    payload.tool !== 'salaam_operator_mcp' ||
+                    typeof payload.tool_call_id !== 'string' ||
+                    !payload.tool_call_id ||
+                    payload.parent_tool_call_id)
+                    return null;
+                open = { id: payload.tool_call_id, calls: 0 };
+            }
+            else if (event.kind === 'tool.finished') {
+                if (!open || payload.tool_call_id !== open.id || payload.tool !== 'salaam_operator_mcp')
+                    return null;
+                open = null;
+            }
+            else if (event.kind === 'operator_mcp.call') {
+                if (!open ||
+                    ++open.calls > 1 ||
+                    !['returned', 'tool_error', 'failed'].includes(String(payload.outcome)))
+                    return null;
+                calls.push({ seq: event.seq, ...payload });
+            }
+            else if (event.kind === 'policy.allowed') {
+                if (!open || payload.tool !== 'salaam_operator_mcp')
+                    return null;
+            }
+            else
+                return null;
+        }
+        if (open)
+            return null;
+        const units = this.noLedgeredEffects(session, task);
+        if (!units)
+            return null;
         return {
-            block: blocks[0],
-            activity,
-            model: models[0],
-            policy: policies[0],
+            revocation,
+            cancellation: cancellations[0],
+            events: marks,
+            operator_mcp_calls: calls,
             link: links[0],
             unbound_stopped_units: units,
         };
@@ -1093,6 +1785,7 @@ export class AgentPodWork {
                 objective: task.objective,
                 constraints: task.constraints,
                 acceptance: task.acceptance,
+                ...(task.completion_gate ? { completion_gate: task.completion_gate } : {}),
                 deliverables: task.deliverables,
                 limits: task.limits,
                 steps: task.steps.map(({ key, title, instruction, depends_on, checks }) => ({
@@ -1121,7 +1814,7 @@ export class AgentPodWork {
                     .get(String(check.id));
                 require(saved);
                 const bindingArtifact = JSON.parse(String(saved.response)), bound = artifact(bindingArtifact, session);
-                const call = calls.find((c) => c.id === bound.call_id), configured = task.acceptance.find((c) => c.key === check.check_key);
+                const call = calls.find((c) => c.id === bound.call_id), configured = requiredChecks(task).find((c) => c.key === check.check_key);
                 require(check.state === 'passed' &&
                     check.plan_revision === task.plan_revision &&
                     check.engine_id === 'linux-systemd-station-v1' &&
@@ -1431,15 +2124,7 @@ export class AgentPodWork {
         const { root, row, task } = this.owned(binding);
         if (workRequest !== row.request_id || !/^[a-f0-9]{64}$/.test(terminalDigest))
             throw new ServiceError('work_settlement_conflict', 'Exact original work and terminal digest required');
-        const stopped = () => {
-            const current = this.authority.inspect(binding);
-            if (!current.revoked ||
-                current.authorized ||
-                !current.owned_execution_stopped ||
-                current.unresolved_operations.length ||
-                current.active_attempts.length)
-                throw new ServiceError('work_settlement_unsafe', 'Revoked stopped root with known effects required');
-        };
+        const stopped = () => this.assertKnownEffectsStop(binding);
         stopped();
         return this.store.request('agentpod-work-failure', workRequest, {
             binding: root.binding,
@@ -1449,112 +2134,7 @@ export class AgentPodWork {
         }, () => {
             stopped();
             this.assertPlan(task, JSON.parse(String(row.admission_json)));
-            const runtime = this.store.db
-                .prepare('SELECT * FROM task_runtime WHERE task_id=?')
-                .get(task.id);
-            const attempts = this.store.db
-                .prepare('SELECT * FROM attempts WHERE session_id=?')
-                .all(root.session_id);
-            const ops = this.store.db
-                .prepare('SELECT * FROM operations WHERE session_id=?')
-                .all(root.session_id);
-            const calls = this.store.db
-                .prepare("SELECT * FROM station_calls WHERE session_id=? AND kind!='read'")
-                .all(root.session_id);
-            const op = ops[0], attempt = attempts[0], call = calls[0];
-            const approval = op
-                ? this.store.db.prepare('SELECT * FROM approvals WHERE operation_id=?').get(String(op.id))
-                : undefined;
-            const effect = op?.receipt ? JSON.parse(String(op.receipt)) : null;
-            const bound = 'Provider payload exceeds declared per-request token bounds';
-            const originalBlock = this.store.db
-                .prepare("SELECT seq,payload FROM events WHERE session_id=? AND kind='work_task.budget_blocked' AND json_extract(payload,'$.task_id')=? AND json_extract(payload,'$.reason')=? ORDER BY seq LIMIT 1")
-                .get(root.session_id, task.id, bound);
-            const runtimeExpired = runtime?.blocked_reason === 'Task runtime limit reached' &&
-                runtime.started_at !== null &&
-                Number.isFinite(Number(runtime.started_at)) &&
-                Date.now() - Number(runtime.started_at) >= task.limits.runtime_ms;
-            const savedInvalidatedOffer = approval?.state === 'invalidated'
-                ? this.store.db
-                    .prepare("SELECT response FROM requests WHERE actor='agentpod-work-decision-offer' AND id=?")
-                    .get(String(approval.id))
-                : undefined;
-            const knownReadOnly = this.historicalKnownReadOnlyFailure(root.binding, task, runtime) ??
-                (ops.length === 1 && op && approval && savedInvalidatedOffer
-                    ? this.historicalKnownReadOnlyFailure(root.binding, task, runtime, {
-                        operation: op,
-                        approval,
-                        offered: JSON.parse(String(savedInvalidatedOffer.response)),
-                        invalidated: true,
-                    })
-                    : null) ??
-                (ops.length === 1 && op && approval
-                    ? this.historicalKnownReadOnlyFailure(root.binding, task, runtime, undefined, {
-                        operation: op,
-                        approval,
-                    })
-                    : null);
-            const zeroEffect = this.zeroEffectConcurrencyFailure(root.session_id, task, runtime, attempts);
-            if (!zeroEffect &&
-                !knownReadOnly &&
-                (task.state !== 'blocked' ||
-                    !runtime ||
-                    !originalBlock ||
-                    (runtime.blocked_reason !== bound && !runtimeExpired) ||
-                    attempt?.error !== 'Required control failed: ' + bound ||
-                    runtime.auto_enabled ||
-                    runtime.reserved_requests ||
-                    runtime.reserved_tokens ||
-                    runtime.verification_runs ||
-                    attempts.length !== 1 ||
-                    attempt?.state !== 'interrupted' ||
-                    attempt.resolved_by !== null ||
-                    ops.length !== 1 ||
-                    op?.kind !== 'workspace' ||
-                    op.state !== 'succeeded' ||
-                    op.attempt_id !== attempt.id ||
-                    op.resolution !== 'workspace-content-receipt-v1' ||
-                    calls.length !== 1 ||
-                    call?.kind !== 'patch' ||
-                    call.state !== 'returned' ||
-                    call.helper_state !== 'stopped' ||
-                    call.operation_id !== op.id ||
-                    call.attempt_id !== attempt.id ||
-                    !call.result_json ||
-                    !approval ||
-                    approval.state !== 'decided' ||
-                    approval.decision !== 'approve' ||
-                    approval.operation_digest !== op.operation_digest ||
-                    !effect ||
-                    effect.version !== 1 ||
-                    effect.scope !== 'station-workspace' ||
-                    effect.call_id !== call.id ||
-                    effect.root_digest !== digest(root.binding) ||
-                    effect.root_digest !== call.root_digest ||
-                    effect.configuration_digest !== call.configuration_digest ||
-                    effect.input_digest !== call.input_digest ||
-                    canonical(effect.result) !== canonical(JSON.parse(String(call.result_json))) ||
-                    effect.result?.ok !== true ||
-                    task.steps.filter((s) => s.attempt_id === attempt.id && s.state === 'interrupted')
-                        .length !== 1 ||
-                    task.steps.some((s) => !['pending', 'interrupted'].includes(s.state)) ||
-                    this.store.db.prepare('SELECT 1 FROM task_checks WHERE task_id=?').get(task.id) ||
-                    this.store.db
-                        .prepare('SELECT 1 FROM child_tasks WHERE parent_session=?')
-                        .get(root.session_id)))
-                throw new ServiceError('work_settlement_unsafe', 'Only exact known approved-patch, zero-effect child denial, or closed historical read-only evidence can retire');
-            const evidence_digest = digest({
-                binding: root.binding,
-                task_id: task.id,
-                plan_revision: task.plan_revision,
-                blocked_reason: runtime.blocked_reason,
-                attempt,
-                operation: op ?? null,
-                approval: approval ?? null,
-                call: call ?? null,
-                ...(zeroEffect ? { zero_effect_concurrency: zeroEffect } : {}),
-                ...(knownReadOnly ? { historical_known_readonly: knownReadOnly } : {}),
-            });
+            const evidence_digest = this.failureEvidence(root, task);
             driver.cancelInTransaction(task.id, task.revision, stopped);
             const receipt = {
                 version: 1,
@@ -1573,6 +2153,368 @@ export class AgentPodWork {
             return receipt;
         });
     }
+    /** A revoked root whose execution stopped with nothing unresolved or still running. */
+    assertKnownEffectsStop(binding) {
+        const current = this.authority.inspect(binding);
+        if (!current.revoked ||
+            current.authorized ||
+            !current.owned_execution_stopped ||
+            current.unresolved_operations.length ||
+            current.active_attempts.length)
+            throw new ServiceError('work_settlement_unsafe', 'Revoked stopped root with known effects required');
+    }
+    /** The evidence a known-effects retirement records, or work_settlement_unsafe when the stopped
+     * run is not one of the exact shapes Salaam can prove. Reads only; fail() and status share it. */
+    /** A task the provider rate limit stopped after its retries (RATE_LIMIT_STOP). Everything is
+     * closed and definite: every attempt completed or failed, the one failed step's last attempt
+     * rate-limited and recorded by the driver, every operation succeeded or failed definitely with
+     * no approval pending, every station call settled with its helper stopped, no children. */
+    rateLimitStopFailure(session, task, runtime, attempts) {
+        if (!['blocked', 'partially_completed'].includes(task.state) ||
+            !runtime ||
+            runtime.blocked_reason !== RATE_LIMIT_STOP ||
+            runtime.auto_enabled ||
+            runtime.reserved_requests ||
+            runtime.reserved_tokens ||
+            attempts.some((a) => !['completed', 'failed'].includes(String(a.state))))
+            return null;
+        const failed = task.steps.filter((s) => s.state === 'failed');
+        if (failed.length !== 1 ||
+            task.steps.some((s) => !['completed', 'failed', 'pending'].includes(s.state)))
+            return null;
+        const last = String(failed[0].attempt_id ?? '');
+        const limits = new RateLimitRetries(this.store);
+        const recorded = this.store.db
+            .prepare('SELECT attempt_id,failures FROM task_rate_limits WHERE task_id=? AND step_id=? ORDER BY failures')
+            .all(task.id, failed[0].id);
+        if (!limits.rateLimited(last) || !recorded.some((r) => r.attempt_id === last))
+            return null;
+        const db = this.store.db;
+        const operations = db
+            .prepare('SELECT id,state FROM operations WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        const calls = db
+            .prepare('SELECT id,kind,state,helper_state FROM station_calls WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        if (operations.some((o) => !['succeeded', 'failed_definite'].includes(String(o.state))) ||
+            db.prepare("SELECT 1 FROM approvals WHERE session_id=? AND state='pending'").get(session) ||
+            calls.some((c) => ['prepared', 'dispatching', 'outcome_unknown'].includes(String(c.state)) ||
+                !['none', 'stopped'].includes(String(c.helper_state))) ||
+            db.prepare('SELECT 1 FROM child_tasks WHERE parent_session=?').get(session))
+            return null;
+        return {
+            step_id: failed[0].id,
+            attempts: attempts.map((a) => ({ id: a.id, state: a.state })),
+            rate_limited: recorded,
+            operations,
+            calls,
+        };
+    }
+    /** A task its verification budget stopped after every step finished (staging run_54648a07).
+     * Everything is closed and definite: every attempt completed or failed, every step completed or
+     * failed, every operation succeeded or failed definitely with no approval pending, every station
+     * call settled with its helper stopped, nothing reserved, no children. */
+    /** Which part of the verification-budget stop shape a run misses: a closed set of codes, so a
+     * refusal can say why without carrying any data. */
+    static VERIFICATION_LIMIT_MISSES = [
+        'vl:task_state',
+        'vl:reason',
+        'vl:auto',
+        'vl:reserved',
+        'vl:attempts',
+        'vl:steps',
+        'vl:operations',
+        'vl:approvals',
+        'vl:calls',
+        'vl:children',
+    ];
+    verificationLimitMiss = null;
+    verificationLimitStopFailure(session, task, runtime, attempts) {
+        const miss = (code) => {
+            this.verificationLimitMiss = code;
+            return null;
+        };
+        this.verificationLimitMiss = null;
+        // The stop is the verification budget's: the current reason, or the run's first budget block
+        // when its runtime limit overwrote the reason later while it sat parked (staging run_54648a07).
+        const firstBlock = this.store.db
+            .prepare("SELECT json_extract(payload,'$.reason') AS reason FROM events WHERE session_id=? AND kind='work_task.budget_blocked' AND json_extract(payload,'$.task_id')=? ORDER BY seq LIMIT 1")
+            .get(session, task.id);
+        if (!runtime ||
+            !(runtime.blocked_reason === 'Task verification run limit reached' ||
+                (runtime.blocked_reason === 'Task runtime limit reached' &&
+                    firstBlock?.reason === 'Task verification run limit reached')))
+            return miss('vl:reason');
+        if (!['blocked', 'partially_completed'].includes(task.state))
+            return miss('vl:task_state');
+        if (runtime.auto_enabled)
+            return miss('vl:auto');
+        if (runtime.reserved_requests || runtime.reserved_tokens)
+            return miss('vl:reserved');
+        if (!attempts.length ||
+            attempts.some((a) => !['completed', 'failed'].includes(String(a.state))))
+            return miss('vl:attempts');
+        if (task.steps.some((s) => !['completed', 'failed'].includes(s.state)))
+            return miss('vl:steps');
+        const db = this.store.db;
+        const operations = db
+            .prepare('SELECT id,state FROM operations WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        const calls = db
+            .prepare('SELECT id,kind,state,helper_state FROM station_calls WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        if (operations.some((o) => !['succeeded', 'failed_definite'].includes(String(o.state))))
+            return miss('vl:operations');
+        if (db.prepare("SELECT 1 FROM approvals WHERE session_id=? AND state='pending'").get(session))
+            return miss('vl:approvals');
+        if (calls.some((c) => ['prepared', 'dispatching', 'outcome_unknown'].includes(String(c.state)) ||
+            !['none', 'stopped'].includes(String(c.helper_state))))
+            return miss('vl:calls');
+        if (db.prepare('SELECT 1 FROM child_tasks WHERE parent_session=?').get(session))
+            return miss('vl:children');
+        return {
+            steps: task.steps.map((s) => ({ id: s.id, state: s.state })),
+            attempts: attempts.map((a) => ({ id: a.id, state: a.state })),
+            operations,
+            calls,
+        };
+    }
+    /** A task its own acceptance check stopped (staging card_d74eac4509f1453c): the latest receipt
+     * for the check the stop names failed definitely, and the run is as closed as a
+     * verification-budget stop. The board then gets a failed run with that reason, not a park. */
+    static CHECK_FAILED_MISSES = [
+        'cf:reason',
+        'cf:check',
+        'cf:task_state',
+        'cf:auto',
+        'cf:reserved',
+        'cf:attempts',
+        'cf:steps',
+        'cf:operations',
+        'cf:approvals',
+        'cf:calls',
+        'cf:children',
+    ];
+    checkFailedMiss = null;
+    checkFailedStopFailure(session, task, runtime, attempts) {
+        const miss = (code) => {
+            this.checkFailedMiss = code;
+            return null;
+        };
+        this.checkFailedMiss = null;
+        const prefix = 'Verification failed or became stale: ';
+        const reason = String(runtime?.auto_error ?? '');
+        if (!runtime || runtime.blocked_reason || !reason.startsWith(prefix))
+            return miss('cf:reason');
+        const db = this.store.db;
+        const check = db
+            .prepare('SELECT id,state FROM task_checks WHERE task_id=? AND check_key=? AND plan_revision=? ORDER BY rowid DESC LIMIT 1')
+            .get(task.id, reason.slice(prefix.length), task.plan_revision);
+        if (check?.state !== 'failed')
+            return miss('cf:check');
+        if (!['blocked', 'partially_completed'].includes(task.state))
+            return miss('cf:task_state');
+        if (runtime.auto_enabled)
+            return miss('cf:auto');
+        if (runtime.reserved_requests || runtime.reserved_tokens)
+            return miss('cf:reserved');
+        if (!attempts.length ||
+            attempts.some((a) => !['completed', 'failed'].includes(String(a.state))))
+            return miss('cf:attempts');
+        if (task.steps.some((s) => !['completed', 'failed'].includes(s.state)))
+            return miss('cf:steps');
+        const operations = db
+            .prepare('SELECT id,state FROM operations WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        const calls = db
+            .prepare('SELECT id,kind,state,helper_state FROM station_calls WHERE session_id=? ORDER BY rowid')
+            .all(session);
+        if (operations.some((o) => !['succeeded', 'failed_definite'].includes(String(o.state))))
+            return miss('cf:operations');
+        if (db.prepare("SELECT 1 FROM approvals WHERE session_id=? AND state='pending'").get(session))
+            return miss('cf:approvals');
+        if (calls.some((c) => ['prepared', 'dispatching', 'outcome_unknown'].includes(String(c.state)) ||
+            !['none', 'stopped'].includes(String(c.helper_state))))
+            return miss('cf:calls');
+        if (db.prepare('SELECT 1 FROM child_tasks WHERE parent_session=?').get(session))
+            return miss('cf:children');
+        return {
+            reason,
+            check: check.id,
+            steps: task.steps.map((s) => ({ id: s.id, state: s.state })),
+            attempts: attempts.map((a) => ({ id: a.id, state: a.state })),
+            operations,
+            calls,
+        };
+    }
+    failureEvidence(root, task) {
+        const runtime = this.store.db
+            .prepare('SELECT * FROM task_runtime WHERE task_id=?')
+            .get(task.id);
+        const attempts = this.store.db
+            .prepare('SELECT * FROM attempts WHERE session_id=?')
+            .all(root.session_id);
+        const ops = this.store.db
+            .prepare('SELECT * FROM operations WHERE session_id=?')
+            .all(root.session_id);
+        const calls = this.store.db
+            .prepare("SELECT * FROM station_calls WHERE session_id=? AND kind!='read'")
+            .all(root.session_id);
+        const op = ops[0], attempt = attempts[0], call = calls[0];
+        const approval = op
+            ? this.store.db.prepare('SELECT * FROM approvals WHERE operation_id=?').get(String(op.id))
+            : undefined;
+        const effect = op?.receipt ? JSON.parse(String(op.receipt)) : null;
+        const bound = 'Provider payload exceeds declared per-request token bounds';
+        const originalBlock = this.store.db
+            .prepare("SELECT seq,payload FROM events WHERE session_id=? AND kind='work_task.budget_blocked' AND json_extract(payload,'$.task_id')=? AND json_extract(payload,'$.reason')=? ORDER BY seq LIMIT 1")
+            .get(root.session_id, task.id, bound);
+        const runtimeExpired = runtime?.blocked_reason === 'Task runtime limit reached' &&
+            runtime.started_at !== null &&
+            Number.isFinite(Number(runtime.started_at)) &&
+            Date.now() - Number(runtime.started_at) >= task.limits.runtime_ms;
+        const savedInvalidatedOffer = approval?.state === 'invalidated'
+            ? this.store.db
+                .prepare("SELECT response FROM requests WHERE actor='agentpod-work-decision-offer' AND id=?")
+                .get(String(approval.id))
+            : undefined;
+        const knownReadOnly = this.historicalKnownReadOnlyFailure(root.binding, task, runtime) ??
+            (ops.length === 1 && op && approval && savedInvalidatedOffer
+                ? this.historicalKnownReadOnlyFailure(root.binding, task, runtime, {
+                    operation: op,
+                    approval,
+                    offered: JSON.parse(String(savedInvalidatedOffer.response)),
+                    invalidated: true,
+                })
+                : null) ??
+            (ops.length === 1 && op && approval
+                ? this.historicalKnownReadOnlyFailure(root.binding, task, runtime, undefined, {
+                    operation: op,
+                    approval,
+                })
+                : null);
+        const zeroEffect = this.zeroEffectConcurrencyFailure(root.session_id, task, runtime, attempts);
+        const revokeCancelled = zeroEffect
+            ? null
+            : this.revokeCancelledFailure(root.session_id, task, runtime, attempts);
+        const budgetStop = zeroEffect || revokeCancelled
+            ? null
+            : this.requestBudgetStopFailure(root.session_id, task, runtime, attempts);
+        const refusedWrites = zeroEffect || revokeCancelled || budgetStop
+            ? null
+            : this.runtimeStopRefusedWritesFailure(root.session_id, task, runtime, attempts);
+        const budgetKnown = zeroEffect || revokeCancelled || budgetStop || refusedWrites
+            ? null
+            : this.requestBudgetStopKnownEffectsFailure(root.session_id, root.binding, task, runtime, attempts);
+        const rateLimit = zeroEffect || revokeCancelled || budgetStop || refusedWrites || budgetKnown
+            ? null
+            : this.rateLimitStopFailure(root.session_id, task, runtime, attempts);
+        const verificationLimit = zeroEffect || revokeCancelled || budgetStop || refusedWrites || budgetKnown || rateLimit
+            ? null
+            : this.verificationLimitStopFailure(root.session_id, task, runtime, attempts);
+        const checkFailed = zeroEffect ||
+            revokeCancelled ||
+            budgetStop ||
+            refusedWrites ||
+            budgetKnown ||
+            rateLimit ||
+            verificationLimit
+            ? null
+            : this.checkFailedStopFailure(root.session_id, task, runtime, attempts);
+        if (!zeroEffect &&
+            !revokeCancelled &&
+            !budgetStop &&
+            !refusedWrites &&
+            !rateLimit &&
+            !verificationLimit &&
+            !checkFailed &&
+            !budgetKnown &&
+            !knownReadOnly &&
+            (task.state !== 'blocked' ||
+                !runtime ||
+                !originalBlock ||
+                (runtime.blocked_reason !== bound && !runtimeExpired) ||
+                attempt?.error !== 'Required control failed: ' + bound ||
+                runtime.auto_enabled ||
+                runtime.reserved_requests ||
+                runtime.reserved_tokens ||
+                runtime.verification_runs ||
+                attempts.length !== 1 ||
+                attempt?.state !== 'interrupted' ||
+                attempt.resolved_by !== null ||
+                ops.length !== 1 ||
+                op?.kind !== 'workspace' ||
+                op.state !== 'succeeded' ||
+                op.attempt_id !== attempt.id ||
+                op.resolution !== 'workspace-content-receipt-v1' ||
+                calls.length !== 1 ||
+                call?.kind !== 'patch' ||
+                call.state !== 'returned' ||
+                call.helper_state !== 'stopped' ||
+                call.operation_id !== op.id ||
+                call.attempt_id !== attempt.id ||
+                !call.result_json ||
+                !approval ||
+                approval.state !== 'decided' ||
+                approval.decision !== 'approve' ||
+                approval.operation_digest !== op.operation_digest ||
+                !effect ||
+                effect.version !== 1 ||
+                effect.scope !== 'station-workspace' ||
+                effect.call_id !== call.id ||
+                effect.root_digest !== digest(root.binding) ||
+                effect.root_digest !== call.root_digest ||
+                effect.configuration_digest !== call.configuration_digest ||
+                effect.input_digest !== call.input_digest ||
+                canonical(effect.result) !== canonical(JSON.parse(String(call.result_json))) ||
+                effect.result?.ok !== true ||
+                task.steps.filter((s) => s.attempt_id === attempt.id && s.state === 'interrupted')
+                    .length !== 1 ||
+                task.steps.some((s) => !['pending', 'interrupted'].includes(s.state)) ||
+                this.store.db.prepare('SELECT 1 FROM task_checks WHERE task_id=?').get(task.id) ||
+                this.store.db
+                    .prepare('SELECT 1 FROM child_tasks WHERE parent_session=?')
+                    .get(root.session_id)))
+            throw new ServiceError('work_settlement_unsafe', this.verificationLimitMiss && this.verificationLimitMiss !== 'vl:reason'
+                ? 'Verification-budget stop not provable: ' + this.verificationLimitMiss
+                : this.checkFailedMiss && this.checkFailedMiss !== 'cf:reason'
+                    ? 'Check-failed stop not provable: ' + this.checkFailedMiss
+                    : 'Only exact known approved-patch, zero-effect child denial, revoke-cancelled operator MCP reads, request budget stopped operator MCP reads, runtime-stopped refused workspace writes, request budget stopped known effects, a closed rate-limit, verification-budget or check-failed stop, or closed historical read-only evidence can retire');
+        const evidence_digest = digest({
+            binding: root.binding,
+            task_id: task.id,
+            plan_revision: task.plan_revision,
+            blocked_reason: runtime.blocked_reason,
+            attempt,
+            operation: op ?? null,
+            approval: approval ?? null,
+            call: call ?? null,
+            ...(zeroEffect ? { zero_effect_concurrency: zeroEffect } : {}),
+            ...(revokeCancelled ? { revoke_cancelled: revokeCancelled } : {}),
+            ...(budgetStop ? { request_budget_stop: budgetStop } : {}),
+            ...(refusedWrites ? { runtime_stop_refused_writes: refusedWrites } : {}),
+            ...(budgetKnown ? { request_budget_stop_known_effects: budgetKnown } : {}),
+            ...(rateLimit ? { rate_limit_stop: rateLimit } : {}),
+            ...(verificationLimit ? { verification_limit_stop: verificationLimit } : {}),
+            ...(checkFailed ? { check_failed_stop: checkFailed } : {}),
+            ...(knownReadOnly ? { historical_known_readonly: knownReadOnly } : {}),
+        });
+        return evidence_digest;
+    }
+    /** Status's read-only verdict: "known_effects_failure" when fail() would retire this run now. */
+    settlementReady(binding, root, row, task) {
+        try {
+            this.assertKnownEffectsStop(binding);
+            this.assertPlan(task, JSON.parse(String(row.admission_json)));
+            this.failureEvidence(root, task);
+            return 'known_effects_failure';
+        }
+        catch (error) {
+            return {
+                refused: error instanceof ServiceError ? error.code + ': ' + error.message : 'settlement_unproven',
+            };
+        }
+    }
     abandon(binding, request, workRequest, terminalDigest) {
         const { root, row, task } = this.owned(binding);
         if (workRequest !== row.request_id || !/^[a-f0-9]{64}$/.test(terminalDigest))
@@ -1715,7 +2657,7 @@ export class AgentPodWork {
                 return e;
             });
             if (evidence.checks.some((id) => !checks.some((c) => c.id === id)) ||
-                task.acceptance.some((a) => !checks.some((c) => c.step_id === null && c.check_key === a.key)) ||
+                requiredChecks(task).some((a) => !checks.some((c) => c.step_id === null && c.check_key === a.key)) ||
                 calls.some((c) => c.kind === 'check' && !checkEvidence.some((e) => e.call_id === c.id)))
                 fail();
             // Historical evidence only: do not observe a fresh tree, renew authority,
@@ -1746,6 +2688,64 @@ export class AgentPodWork {
             return receipt;
         });
     }
+    /** Item 11b: restore a checkpoint's files, operator-approved, only for a run that has ended (its
+     * execution revoked and stopped with nothing unresolved), never while another run is active on
+     * the station, and only exactly as reviewed: the restore digest is recomputed and must match. */
+    async restore(binding, request, checkpoint, restoreDigest, approvedBy) {
+        const { root, task } = this.owned(binding);
+        const current = this.authority.inspect(binding);
+        if (!current.revoked ||
+            current.authorized ||
+            !current.owned_execution_stopped ||
+            current.unresolved_operations.length ||
+            current.active_attempts.length)
+            throw new ServiceError('restore_unsafe', 'Restore is only for a run that has ended and stopped');
+        if (this.store.db
+            .prepare("SELECT 1 FROM agentpod_admissions WHERE state!='revoked' AND session_id<>?")
+            .get(root.session_id))
+            throw new ServiceError('restore_busy', 'Another run is active on this station');
+        const station = this.stationBoundary();
+        if (!station)
+            throw new ServiceError('restore_unavailable', 'Restore needs the station boundary');
+        // A replay of a restore already journaled returns its receipt: the live tree it moved is no
+        // reason to refuse the very approval that moved it.
+        const replay = station.replayed?.(root.session_id, request, restoreDigest) ?? null;
+        if (replay !== null)
+            return replay;
+        const plan = await new StationCheckpoints(this.store).restorePlan(task, checkpoint, await station.live());
+        if (plan.restore_digest !== restoreDigest)
+            throw new ServiceError('restore_changed', 'This restore no longer matches what was reviewed');
+        return station.restore(root.session_id, digest(root.binding), plan, request, approvedBy);
+    }
+    /** Item 11: the run's checkpoints, from its own recorded station writes. Read-only. */
+    checkpoints(binding) {
+        const { task } = this.owned(binding);
+        this.authority.inspect(binding);
+        return {
+            version: 1,
+            task_id: task.id,
+            checkpoints: new StationCheckpoints(this.store).list(task),
+        };
+    }
+    /** Item 11: what restoring a checkpoint would do to each file written after it. Read-only. */
+    async checkpointDiff(binding, checkpoint) {
+        const { task } = this.owned(binding);
+        this.authority.inspect(binding);
+        const checkpoints = new StationCheckpoints(this.store);
+        checkpoints.get(task, checkpoint);
+        const station = this.stationBoundary();
+        if (!station)
+            throw new ServiceError('restore_unavailable', 'A checkpoint diff needs the station boundary');
+        return {
+            version: 1,
+            task_id: task.id,
+            ...(await checkpoints.diff(task, checkpoint, await station.live())),
+        };
+    }
+    /** The station boundary, which reads the live workspace and writes restores. */
+    stationBoundary() {
+        return this.verification.station?.station;
+    }
     async status(binding, driver) {
         const { root, row, task } = this.owned(binding);
         const view = await driver.viewAsync(task.id);
@@ -1758,8 +2758,91 @@ export class AgentPodWork {
             plan_revision: this.tasks.get(task.id).plan_revision,
             binding_digest: digest(root.binding),
             auto_enabled: !!view.runtime.auto_enabled,
+            activity: this.activity(root.session_id),
+            plan: planUpdate(view),
+            // Board reads the agent is waiting on; the owner serves them (operator ruling 2026-10-28).
+            ...(() => {
+                const reads = new BoardReads(this.store).pending(root.session_id);
+                return reads.length ? { board_reads: reads } : {};
+            })(),
+            // The owner may settle a stopped run automatically only on this verdict.
+            ...(() => {
+                const ready = this.settlementReady(binding, root, row, task);
+                if (ready === 'known_effects_failure')
+                    return { settlement_ready: ready };
+                // Which guard refused, for a stopped run only: the owner logs it, so an unsettled run
+                // says why instead of "cannot prove". Codes and fixed messages only; no data.
+                return ready && this.authority.inspect(binding).revoked
+                    ? { settlement_refused: ready.refused }
+                    : {};
+            })(),
         };
     }
+    /** The owner's answer to one of this run's board reads. */
+    answerBoardRead(binding, answer) {
+        const { root } = this.owned(binding);
+        return new BoardReads(this.store).answer(root.session_id, answer);
+    }
+    /** The latest tool steps, oldest first, for the owner to show as card activity while the work
+     * runs. Observation only: it carries no authority and changes nothing. Input is clipped. */
+    activity(session) {
+        const startedOf = this.store.db.prepare("SELECT json_extract(payload,'$.input') AS input FROM events WHERE session_id=? AND kind='tool.started' AND json_extract(payload,'$.tool_call_id')=? ORDER BY seq DESC LIMIT 1");
+        const startedInput = (id) => typeof id === 'string'
+            ? startedOf.get(session, id)?.input
+            : undefined;
+        return this.store.db
+            .prepare("SELECT seq,kind,payload FROM events WHERE session_id=? AND kind IN ('tool.started','tool.finished','permission.auto-approved','fetch.host_paused') ORDER BY seq DESC LIMIT 64")
+            .all(session)
+            .reverse()
+            .map((row) => {
+            const p = JSON.parse(String(row.payload));
+            // Approval scopes: a write the run grant answered says so on the card, with the grant.
+            // A fetch host paused by the breaker: one line, and the run carries on.
+            if (row.kind === 'fetch.host_paused')
+                return {
+                    seq: Number(row.seq),
+                    phase: 'finished',
+                    tool_call_id: 'fetch-pause:' + String(row.seq),
+                    title: `Paused requests to ${String(p.host)} for ${Math.round(Number(p.pause_ms) / 1000)}s after ${Number(p.failures)} failures`,
+                    kind: null,
+                    input: null,
+                    failed: false,
+                };
+            if (row.kind === 'permission.auto-approved')
+                return {
+                    seq: Number(row.seq),
+                    phase: 'finished',
+                    tool_call_id: 'approval:' + String(p.operation_id ?? ''),
+                    title: p.rule === 'run-grant'
+                        ? 'Approved by the run grant' +
+                            (typeof p.granted_by === 'string' ? ` (granted by ${p.granted_by})` : '')
+                        : p.rule === 'agent-rule'
+                            ? "Allowed by the agent's standing rule" +
+                                (typeof p.set_by === 'string' ? ` (set by ${p.set_by})` : '')
+                            : 'Approved by a standing policy',
+                    kind: null,
+                    input: null,
+                    failed: false,
+                };
+            const started = row.kind === 'tool.started', tool = typeof p.tool === 'string' ? p.tool : '';
+            const input = typeof p.input === 'string' ? p.input.slice(0, 2048) : null;
+            // A finished step carries no input, so it is titled from the call it finishes: the card
+            // read a bare "salaam_station" under every station step (staging card_3a97983751784bf9).
+            const callInput = started ? p.input : startedInput(p.tool_call_id);
+            return {
+                seq: Number(row.seq),
+                phase: started ? 'started' : 'finished',
+                tool_call_id: typeof p.tool_call_id === 'string' ? p.tool_call_id : '',
+                title: tool ? toolTitle(tool, callInput) : 'Tool',
+                kind: started ? String(p.kind ?? toolMetadata(tool, p.input).kind) : null,
+                input: started ? input : null,
+                failed: !started && p.failed === true,
+                // The tool's text output, already redacted and clipped by the worker, so the card shows
+                // what the step returned as Hermes does.
+                ...(!started && typeof p.output === 'string' ? { output: p.output.slice(0, 2048) } : {}),
+            };
+        });
+    }
     progress(binding, request, workRequest, steps, driver) {
         const { root, row, task } = this.owned(binding);
         if (workRequest !== row.request_id)
@@ -1773,7 +2856,11 @@ export class AgentPodWork {
         }, () => {
             this.store.execution.assert(root.session_id);
             this.assertPlan(task, JSON.parse(String(row.admission_json)));
-            if (steps !== task.steps.length || steps < 1 || steps > 32)
+            // Exactly the plan's steps, or those plus the capped re-run allowance that funds a
+            // rate-limited retry or a reopened step; steps complete once, so it never adds work.
+            if ((steps !== task.steps.length && steps !== task.steps.length + RERUN_ALLOWANCE) ||
+                steps < 1 ||
+                steps > 32 + RERUN_ALLOWANCE)
                 throw new ServiceError('invalid_limit', 'Progression must bind every admitted step within32');
             if (this.store.controlView(root.session_id).expires_at > Date.now())
                 throw new ServiceError('control_busy', 'Local controller currently owns this session');