@tacuchi/agent-workflow-cli 21.11.0 → 21.12.0

package/dist/application/flow/run-state-service.js

@@ -12,15 +12,45 @@
  *   before the single write happens, so a failure halfway through leaves the
  *   previous state exactly as it was rather than a half-applied one.
  */
-import { join } from "node:path";
-import { FLOW_RUN_STATE_FILE, parseRunState, serializeRunState, } from "../../domain/flow/run-state.js";
+import { dirname, join } from "node:path";
+import { FLOW_RUN_STATE_FILE, atCurrentVersion, parseRunState, serializeRunState, withAttemptCounters, } from "../../domain/flow/run-state.js";
 import { LockBusyError, acquireLock } from "../lock-service.js";
+import { semanticDigest } from "../semantic-operation/protocol.js";
+/**
+ * The attempt counter: outside the run state's seal, and outside its FOLDER.
+ *
+ * Two evasions, and the file's location answers the second one. The seal proved
+ * it detects an edit and does not detect a restore: copying an earlier
+ * `.flow-run.json` back over the current one is accepted — the file is
+ * internally consistent, because it really was written by this CLI — and it
+ * takes the attempt ledger back with it. So the count lives in a second file
+ * that only ever grows. But while that file sat NEXT to the state, inside the
+ * session folder, a `cp -r` of the folder carried both away and back, and
+ * deleting it reset the cap: the counter defended against restoring a file and
+ * fell to restoring the directory that contained it, which is the same move one
+ * level up.
+ *
+ * Now it is workspace runtime — `.<ns>/sessions/.flow-attempts/<folder>.json`,
+ * keyed by the session it counts, dot-prefixed so the session listing skips it
+ * and already inside the gitignore the CLI manages. Restoring a session folder
+ * cannot lower it, deleting the folder cannot delete it, and a recovery does not
+ * delete it either: it records how many attempts were given back. See
+ * `attemptsAt`.
+ *
+ * One file per run rather than one registry for the workspace, because two runs
+ * advance concurrently under two DIFFERENT locks: a shared registry would need a
+ * lock of its own, and losing that race would silently drop a run's floor —
+ * rebuilding the very hole the file exists to close.
+ */
+const COUNTER_VERSION = 2;
+const NO_COUNTERS = { attempts: {}, granted: {} };
 export function locateRun(paths, session) {
     const dir = join(paths.cwdSessionsDir(), session);
     return {
         session,
         dir,
         statePath: join(dir, FLOW_RUN_STATE_FILE),
+        countersPath: paths.cwdFlowAttemptsFile(session),
         lockPath: join(dir, `${FLOW_RUN_STATE_FILE}.lock`),
     };
 }
@@ -43,7 +73,187 @@ export async function readRun(fs, location) {
             },
         };
     }
-    return parseRunState(await fs.readText(location.statePath));
+    const parsed = parseRunState(await fs.readText(location.statePath));
+    if (!parsed.ok)
+        return parsed;
+    // Reconciled on the way OUT, never on the way in: whoever restored an older
+    // state has already handed it to us, and raising the floor here is what makes
+    // the restore worthless. Every reader goes through this function, so no surface
+    // of the CLI can see a run with attempts the counter says were already spent.
+    const counters = await readCounters(fs, location);
+    if (!counters.ok)
+        return counters;
+    const rolledBack = checkAgainstSealedFloor(parsed.state, counters.value);
+    if (rolledBack !== null)
+        return { ok: false, failure: rolledBack };
+    return {
+        ok: true,
+        state: withAttemptCounters(atCurrentVersion(parsed.state), {
+            floor: counters.value.attempts,
+            grants: counters.value.granted,
+        }),
+    };
+}
+/**
+ * Whether the counter came back BEHIND the floor the state itself carries sealed.
+ *
+ * The write order is the counter first and the state second, so the counter is
+ * never behind: a process that dies between the two leaves it AHEAD, which costs
+ * an attempt nobody spent, and that is the only one of the two errors that is
+ * safe to make. The reverse cannot happen by running this CLI. It happens when
+ * the counter file is deleted, truncated or replaced by an older copy while the
+ * state stays — surgery on the accounting, and the only evidence of it that
+ * survives inside the seal.
+ *
+ * Refused rather than rebuilt. Rebuilding from the state is precisely what the
+ * counter exists to not do: the state is the file a restore rolls back, and
+ * seeding the floor from it would hand the evader the reset they came for while
+ * calling it a repair.
+ */
+function checkAgainstSealedFloor(state, counters) {
+    const behind = (sealed, live) => Object.entries(sealed ?? {}).find(([transition, count]) => count > (live[transition] ?? 0));
+    const lost = behind(state.attempt_floor, counters.attempts) ??
+        behind(state.attempt_grants, counters.granted);
+    if (lost === undefined)
+        return null;
+    return {
+        code: "FLOW_RUN_COUNTER_ROLLED_BACK",
+        message: `el contador de intentos quedó detrás del estado sellado: '${lost[0]}' declara ${lost[1]} y el contador no los tiene`,
+        action: "el contador se borró o se restauró una copia anterior: restaurá el archivo de intentos de la corrida, o descartá la corrida entera y re-adoptá la sesión con 'aw flow advance --flow <flow> --adopt' — no se reconstruye desde el estado, que es justo lo que una restauración rebobina",
+    };
+}
+/**
+ * The counter as it stands, or the conservative reading when there is none.
+ *
+ * An ABSENT file is the normal state of every run that started before the counter
+ * existed, and of every run that has not spent an attempt yet: it reads as "no
+ * floor beyond the ledger", the run keeps walking, and the next write seeds the
+ * file from the ledger it already has. Absence is not a hole — a state that DID
+ * spend attempts carries their floor inside its own seal, so an absent counter
+ * under such a state is caught by {@link checkAgainstSealedFloor} rather than
+ * read as zero.
+ *
+ * Everything else is refused with a cause, and the checks are the state file's
+ * own, in the same order: shape, then version, then the SEAL, then coherence.
+ * This file is read fail-closed for exactly the reason the state is — it was the
+ * surface added to resist manipulation, and while it was the only unsealed file
+ * of the run it was also the easiest one to manipulate: writing `granted: 99`
+ * into it turned the cap off for good.
+ */
+async function readCounters(fs, location) {
+    if (!(await fs.exists(location.countersPath)))
+        return { ok: true, value: NO_COUNTERS };
+    const refuse = (why) => ({
+        ok: false,
+        failure: {
+            code: "FLOW_RUN_COUNTER_INVALID",
+            message: `el contador de intentos de la corrida ${why}`,
+            action: "no se avanza con una contabilidad de intentos ilegible ni con una que fue editada fuera del CLI: restaurá el archivo, o descartá la corrida entera y re-adoptá la sesión con 'aw flow advance --flow <flow> --adopt'",
+        },
+    });
+    let parsed;
+    try {
+        parsed = JSON.parse(await fs.readText(location.countersPath));
+    }
+    catch {
+        return refuse("no es JSON válido");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return refuse("no es un objeto JSON");
+    }
+    const record = parsed;
+    if (record.version !== COUNTER_VERSION) {
+        return refuse(`declara una versión que este CLI no lee: ${String(record.version)}`);
+    }
+    const attempts = readCounterMap(record.attempts);
+    const granted = readCounterMap(record.granted);
+    if (attempts === null || granted === null)
+        return refuse("no es un contador por transición");
+    const value = { attempts, granted };
+    if (record.digest !== counterDigest(location.session, value)) {
+        return refuse("no coincide con su propio sello");
+    }
+    // A grant is what a recovery forgave, and forgiving more than was ever spent
+    // is not a state this CLI can produce: `raiseCounters` only ever copies the
+    // grants the state recorded, and a recovery grants exactly what it found
+    // spent. A file that says otherwise is asking for a cap that never fires.
+    const forgiven = Object.entries(granted).find(([id, count]) => count > (attempts[id] ?? 0));
+    if (forgiven !== undefined) {
+        return refuse(`perdona ${forgiven[1]} intentos de '${forgiven[0]}' y solo registra ${attempts[forgiven[0]] ?? 0}`);
+    }
+    return { ok: true, value };
+}
+/**
+ * The counter's seal — the same canonicalization the rest of the protocol uses.
+ *
+ * The SESSION is inside it, and not as decoration: the file lives in a shared
+ * runtime folder keyed by folder name, so sealing the key is what makes one run's
+ * counter unusable as another's.
+ */
+function counterDigest(session, counters) {
+    return semanticDigest({ version: COUNTER_VERSION, session, ...counters });
+}
+/**
+ * Raise the counter to what this state knows, and hand the state back reconciled.
+ *
+ * Monotone by construction on both halves: the attempts seen can only go up —
+ * `Math.max` against what the file already said — and the grants a recovery
+ * recorded come from the state, which only ever adds to them. A state written
+ * from a restored ledger therefore raises nothing and gets the live floor back.
+ */
+async function raiseCounters(fs, location, state) {
+    const current = await readCounters(fs, location);
+    if (!current.ok)
+        return current;
+    const spent = new Map();
+    for (const attempt of state.attempts) {
+        spent.set(attempt.transition, (spent.get(attempt.transition) ?? 0) + 1);
+    }
+    const attempts = { ...current.value.attempts };
+    for (const [transition, count] of spent) {
+        attempts[transition] = Math.max(attempts[transition] ?? 0, count);
+    }
+    const granted = { ...current.value.granted };
+    for (const [transition, forgiven] of Object.entries(state.attempt_grants ?? {})) {
+        granted[transition] = Math.max(granted[transition] ?? 0, forgiven);
+    }
+    const next = { attempts, granted };
+    if (changed(current.value, next))
+        await writeCounters(fs, location, next);
+    return { ok: true, state: withAttemptCounters(state, { floor: attempts, grants: granted }) };
+}
+async function writeCounters(fs, location, counters) {
+    await fs.mkdirp(dirname(location.countersPath));
+    await fs.writeText(location.countersPath, `${JSON.stringify({
+        version: COUNTER_VERSION,
+        session: location.session,
+        ...counters,
+        digest: counterDigest(location.session, counters),
+    }, null, 2)}\n`);
+}
+/**
+ * Start the counter over for a run that is being created.
+ *
+ * The file goes rather than being zeroed, so an adopted run is byte-identical to
+ * one that never had a counter: the next attempt seeds it again from the ledger.
+ */
+async function resetCounters(fs, location, state) {
+    await fs.remove(location.countersPath);
+    return { ok: true, state: withAttemptCounters(state, { floor: {}, grants: {} }) };
+}
+function changed(before, after) {
+    return (JSON.stringify(before.attempts) !== JSON.stringify(after.attempts) ||
+        JSON.stringify(before.granted) !== JSON.stringify(after.granted));
+}
+function readCounterMap(value) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const entries = Object.entries(value);
+    if (!entries.every(([, count]) => Number.isInteger(count) && count >= 0))
+        return null;
+    return Object.fromEntries(entries);
 }
 /**
  * Run one mutation under the run's lock and persist its result.
@@ -95,10 +305,31 @@ export async function applyUnderLock(fs, location, mutate, options = {}) {
             return result;
         if (result.persist === false)
             return result;
+        // The counter first, the state second, and the order is the contract. If the
+        // process dies between them the counter is AHEAD of the ledger, which costs
+        // an attempt nobody spent; the other order would leave it BEHIND, which is an
+        // attempt somebody spent and can spend again. Only one of those two errors is
+        // safe to make.
+        //
+        // An ADOPTION is the one case that starts the counter over, and it is not a
+        // loophole in the monotonicity: a state that was absent means this run is
+        // being created now, and the only way to get there deliberately is to throw
+        // the previous run away whole — every applied transition with it. What the
+        // counter defends against is keeping the position and losing the attempts;
+        // paying for a reset with the entire run is not that trade. Keeping the old
+        // count would be worse than useless: re-adopting after a corrupt state — the
+        // repair this CLI prints — would come back pre-exhausted at its first gate.
+        const raised = state === null
+            ? await resetCounters(fs, location, result.state)
+            : await raiseCounters(fs, location, result.state);
+        if (!raised.ok)
+            return raised;
         // One write, after the next state is complete and sealed: nothing partial
         // can be observed because nothing partial is ever written.
-        await fs.writeText(location.statePath, serializeRunState(result.state));
-        return result;
+        await fs.writeText(location.statePath, serializeRunState(raised.state));
+        // The reconciled state is what the caller gets back, because the digest it
+        // holds is the one the next compare-and-swap will be judged against.
+        return { ...result, state: raised.state };
     }
     finally {
         await lock.release();

package/dist/application/flow/run-state-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-state-service.js","sourceRoot":"","sources":["../../../src/application/flow/run-state-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,mBAAmB,EAGnB,aAAa,EACb,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,aAAa,EAAoB,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAUlF,MAAM,UAAU,SAAS,CAAC,KAAmB,EAAE,OAAe;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO;QACL,OAAO;QACP,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACzC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAkB,EAAE,QAAyB;IACzE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,cAAc,QAAQ,CAAC,OAAO,8BAA8B;gBACrE,MAAM,EACJ,+FAA+F;aAClG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9D,CAAC;AAyBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAkB,EAClB,QAAyB,EACzB,MAA0F,EAC1F,UAAwB,EAAE;IAE1B,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAC9D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE9B,IAAI,IAA6C,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,gDAAgD,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;oBACjG,MAAM,EACJ,6FAA6F;iBAChG;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB,CAAC;YAC1D,IAAI,CAAC,MAAM,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,IAAI,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;YACjE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,iEAAiE;oBAC1E,MAAM,EAAE,2EAA2E;iBACpF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAC5C,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"run-state-service.js","sourceRoot":"","sources":["../../../src/application/flow/run-state-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,mBAAmB,EAGnB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,aAAa,EAAoB,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAa1B,MAAM,WAAW,GAAoB,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAWnE,MAAM,UAAU,SAAS,CAAC,KAAmB,EAAE,OAAe;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO;QACL,OAAO;QACP,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACzC,YAAY,EAAE,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAChD,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAkB,EAAE,QAAyB;IACzE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,cAAc,QAAQ,CAAC,OAAO,8BAA8B;gBACrE,MAAM,EACJ,+FAA+F;aAClG;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,mBAAmB,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACzD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;YAC9B,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;SAC/B,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAC9B,KAAmB,EACnB,QAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,MAA0C,EAAE,IAA4B,EAAE,EAAE,CAC1F,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,IAAI,GACR,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,6DAA6D,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,6BAA6B;QAC9H,MAAM,EACJ,yRAAyR;KAC5R,CAAC;AACJ,CAAC;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,YAAY,CAAC,EAAkB,EAAE,QAAyB;IACvE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,CAAC,GAAW,EAAe,EAAE,CAAC,CAAC;QAC5C,EAAE,EAAE,KAAK;QACT,OAAO,EAAE;YACP,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,yCAAyC,GAAG,EAAE;YACvD,MAAM,EACJ,sNAAsN;SACzN;KACF,CAAC,CAAC;IACH,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,4CAA4C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CACX,WAAW,QAAQ,CAAC,CAAC,CAAC,iBAAiB,QAAQ,CAAC,CAAC,CAAC,qBAAqB,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,QAAyB;IAC/D,OAAO,cAAc,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,EAAkB,EAClB,QAAyB,EACzB,KAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;QAChF,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,MAAM,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAkB,EAClB,QAAyB,EACzB,QAAyB;IAEzB,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,SAAS,CAChB,QAAQ,CAAC,YAAY,EACrB,GAAG,IAAI,CAAC,SAAS,CACf;QACE,OAAO,EAAE,eAAe;QACxB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,QAAQ;QACX,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;KAClD,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,EAAkB,EAClB,QAAyB,EACzB,KAAmB;IAEnB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,OAAO,CAAC,MAAuB,EAAE,KAAsB;IAC9D,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAA2B,CAAC;AAC/D,CAAC;AAyBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAkB,EAClB,QAAyB,EACzB,MAA0F,EAC1F,UAAwB,EAAE;IAE1B,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAC9D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE9B,IAAI,IAA6C,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,gDAAgD,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;oBACjG,MAAM,EACJ,6FAA6F;iBAChG;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB,CAAC;YAC1D,IAAI,CAAC,MAAM,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,IAAI,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;YACjE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,iEAAiE;oBAC1E,MAAM,EAAE,2EAA2E;iBACpF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAC5C,6EAA6E;QAC7E,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,gBAAgB;QAChB,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,MAAM,GACV,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;YACjD,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/application/flow/submit.js

@@ -21,14 +21,14 @@
  * `renderHuman`, and a boundary nobody can see is a boundary that did not happen.
  */
 import { join } from "node:path";
-import { authorizeEffects } from "../../domain/capability/effects.js";
+import { authorizeEffects, touchesTheWorld, } from "../../domain/capability/effects.js";
 import { AttemptLedger } from "../../domain/capability/protocol.js";
-import { claimedSeal, parseFlowAnswer } from "../../domain/flow/answer.js";
+import { claimedSeal, parseFlowAnswer, spendsAttempt, } from "../../domain/flow/answer.js";
 import { actionOf, approvalGrantOf, effectsOf, internalActionOf, journeyOfFlow, proposalContractOf, publishApprovalOf, scopesSources, } from "../../domain/flow/authority.js";
 import { effectApprovalDigest } from "../../domain/flow/authorization.js";
 import { PAUSE_LABEL, STOP_LABEL, stepOf, } from "../../domain/flow/directive.js";
 import { executionVerdict } from "../../domain/flow/execution-result.js";
-import { applyTransition, checkAgainstJourney, withApproval, withAttempt, withBoundary, withObservation, withProposal, withScope, } from "../../domain/flow/run-state.js";
+import { applyTransition, checkAgainstJourney, restatesLastEvent, withApproval, withAttempt, withBoundary, withEvent, withObservation, withProposal, withScope, } from "../../domain/flow/run-state.js";
 import { destinationsOf, sealProposal } from "../../domain/proposal.js";
 import { baseDigest } from "../../domain/proposal.js";
 import { reservationMarker } from "../../domain/reservation.js";
@@ -211,8 +211,9 @@ function decide(state, input, snapshot) {
     // nothing — matching a recorded attempt requires resending exactly what already
     // ran, and a retry applies nothing.
     const identity = attemptIdentity(state, input, claimedSeal(input.raw) ?? resolved.seal, resolved.stopped.id);
+    const cost = { journey, identity };
     // 1 · Resend, before anything else.
-    const resend = resendCheck(state, resolved, identity);
+    const resend = resendCheck(state, resolved, cost);
     if (resend !== null)
         return resend;
     // The action the run is waiting on is the one that was EMITTED, and the seal
@@ -220,11 +221,11 @@ function decide(state, input, snapshot) {
     // is the diagnosis: when the two differ, the invocation changed underneath a run
     // in flight (a CLI upgraded mid-run), which is a different problem from a state
     // that moved — and it has a different answer.
-    const drifted = actionDrift(state, resolved);
+    const drifted = actionDrift(state, resolved, cost);
     if (drifted !== null)
         return drifted;
     // 2 · The boundary in force decides what is admissible.
-    const admissible = admit(state, resolved, resolved.stopped, input, { journey, identity });
+    const admissible = admit(state, resolved, resolved.stopped, input, cost);
     if ("decision" in admissible)
         return admissible.decision;
     const parsed = admissible;
@@ -237,17 +238,11 @@ function decide(state, input, snapshot) {
     // preview showed. Neither ever applies the step by itself.
     const scoped = scopeFrom(state, resolved.stopped, parsed.answer, snapshot.scope);
     if ("failure" in scoped) {
-        return reject(state, resolved, scoped.failure.message, {
-            code: scoped.failure.code,
-            action: scoped.failure.action,
-        });
+        return reject(state, resolved, scoped.failure.message, { code: scoped.failure.code, action: scoped.failure.action }, cost);
     }
     const sealed = sealFrom(scoped.state, resolved.stopped, parsed.answer, snapshot.destinations);
     if ("failure" in sealed) {
-        return reject(state, resolved, sealed.failure.message, {
-            code: sealed.failure.code,
-            action: sealed.failure.action,
-        });
+        return reject(state, resolved, sealed.failure.message, { code: sealed.failure.code, action: sealed.failure.action }, cost);
     }
     const granted = resolved.kind === "authorization" ? (resolved.authorization?.planned ?? []) : [];
     const approved = grantOf(sealed.state, resolved, parsed.answer, granted, journey);
@@ -336,8 +331,16 @@ function scopeFrom(state, stopped, answer, snapshot) {
     }
     return { state: withScope(state, { plan, sources }) };
 }
+/**
+ * A scope answer the boundary read and refused — under its OWN code.
+ *
+ * It reported `FLOW_ANSWER_INVALID` for a while, and that code means "the
+ * envelope could not be read as an answer", so the same string stood for two
+ * opposite facts: one that must not cost an attempt and one that must. A reader
+ * cannot tell them apart, and neither could the table that decides the charge.
+ */
 function invalidScope(message, action) {
-    return { code: "FLOW_ANSWER_INVALID", message, action };
+    return { code: "FLOW_SCOPE_INVALID", message, action };
 }
 /**
  * Seat the proposal an authoring answer just handed over — sealed, not believed.
@@ -498,7 +501,7 @@ function grantOf(state, resolved, answer, granted, journey) {
  * a payload the boundary's own contract rejects, a decline (a real answer that
  * applies nothing), and an execution result that did not earn its transition.
  */
-function admit(state, resolved, stopped, input, spent) {
+function admit(state, resolved, stopped, input, cost) {
     const expectedApproval = resolved.kind === "authorization"
         ? effectApprovalDigest(stopped.id, resolved.authorization?.planned ?? [])
         : null;
@@ -514,11 +517,13 @@ function admit(state, resolved, stopped, input, spent) {
         request: resolved.request,
     });
     if (!parsed.ok) {
-        // An answer the boundary refused IS an attempt spent: it is the exact event
-        // the chassis' cap counts. Recorded here and nowhere else — a resend, a
-        // decline and a pause are not failed tries at resolving the gap.
+        // An answer the boundary EVALUATED and refused is an attempt spent: it is the
+        // exact event the chassis' cap counts. A payload it could not read as an
+        // answer at all is not — see {@link FLOW_ANSWER_REJECTIONS}, which `reject`
+        // consults. A resend, a decline and a pause are not failed tries either, and
+        // they are classified there rather than being exempted here.
         return {
-            decision: reject(state, resolved, parsed.failure.message, { code: parsed.failure.code, action: parsed.failure.action }, spent),
+            decision: reject(state, resolved, parsed.failure.message, { code: parsed.failure.code, action: parsed.failure.action }, cost),
         };
     }
     // The flow control is a real answer, and neither half applies anything. They
@@ -532,7 +537,7 @@ function admit(state, resolved, stopped, input, spent) {
                 code: "FLOW_BOUNDARY_PAUSED",
                 action: "escribí el CHECKPOINT con 'aw checkpoint-write', compactá, y volvé con 'aw flow advance' a esta misma frontera",
                 outcome: "needs_input",
-            }),
+            }, cost),
         };
     }
     if (parsed.answer.choice === STOP_LABEL) {
@@ -541,7 +546,7 @@ function admit(state, resolved, stopped, input, spent) {
                 code: "FLOW_BOUNDARY_DECLINED",
                 action: "reanudá con 'aw flow advance' cuando quieras retomar esta frontera",
                 outcome: "cancelled",
-            }),
+            }, cost),
         };
     }
     // An execution result has to EARN the transition. Anything short of a completed
@@ -553,11 +558,49 @@ function admit(state, resolved, stopped, input, spent) {
         // would leave the transition pending for an effect nobody could produce.
         const verdict = executionVerdict(parsed.answer.result, resolved.action, effectsOfTransition(state, stopped));
         if (verdict !== null) {
-            return { decision: reject(state, resolved, verdict.message, verdict.detail, spent) };
+            const trace = declaredTrace(stopped, resolved, parsed.answer, verdict);
+            return {
+                decision: reject(state, resolved, verdict.message, verdict.detail, {
+                    ...cost,
+                    ...(trace === null ? {} : { trace }),
+                }),
+            };
         }
     }
     return parsed;
 }
+/**
+ * The material fact a REFUSED external result still leaves behind — or `null`.
+ *
+ * A rejected result is not the same as a result about nothing. The executor may
+ * have run the command, written the file and come back with evidence the
+ * boundary did not accept: the effect reached the world regardless of what the
+ * verdict decided about it. Nothing else in the run records that — the trace is
+ * only written by the internal driver — so an external execution could declare
+ * `applied` classes, be refused, exhaust the boundary, and then be handed back as
+ * answerable by a recovery whose whole job is to refuse exactly that.
+ *
+ * Recorded when the result declares an effect past `read_only`, and when the
+ * verdict is a PARTIAL one: "it finished and did not apply everything" is the
+ * case where what did reach the world is precisely the unknown.
+ */
+function declaredTrace(stopped, resolved, answer, verdict) {
+    const applied = answer.result?.effects.applied ?? [];
+    if (!touchesTheWorld(applied) && verdict.detail.code !== "FLOW_EFFECT_PARTIAL")
+        return null;
+    const invocation = resolved.action?.invocation;
+    return {
+        kind: "failed",
+        transition: stopped.id,
+        // What was really run, named the way whoever ran it would recognize it: an
+        // external execution has no internal operation id to quote.
+        operation: invocation === undefined ? stopped.id : [invocation.program, ...invocation.args].join(" "),
+        code: verdict.detail.code,
+        message: verdict.message,
+        recovery: verdict.detail.action,
+        effects: [...applied],
+    };
+}
 /**
  * Whether the sealed action changed underneath a run that is standing on it.
  *
@@ -566,7 +609,7 @@ function admit(state, resolved, stopped, input, spent) {
  * staleness the seal would otherwise report, because the fix is different: nothing
  * is wrong with the state, the invocation is simply no longer the one that ran.
  */
-function actionDrift(state, resolved) {
+function actionDrift(state, resolved, cost) {
     const pending = state.pending_action;
     if (pending === null || resolved.action === null)
         return null;
@@ -575,7 +618,7 @@ function actionDrift(state, resolved) {
     return reject(state, resolved, "la acción de esta frontera cambió después de emitirse: el resultado corresponde a otra invocación", {
         code: "FLOW_ACTION_CHANGED",
         action: "volvé a correr 'aw flow advance' para recibir la acción vigente y ejecutá esa antes de responder",
-    });
+    }, cost);
 }
 /**
  * Approving an effect is NOT deciding the step, and never executing it.
@@ -651,7 +694,8 @@ function applyAndAdvance(approved, journey, stopped, identity, answer) {
  * for the reason the registry gives everywhere it derives: two sources for one
  * fact disagree eventually, and then the state is unusable.
  */
-function resendCheck(state, resolved, identity) {
+function resendCheck(state, resolved, cost) {
+    const identity = cost.identity;
     const ledger = new AttemptLedger();
     for (const past of state.attempts) {
         const replay = ledger.record(past);
@@ -677,24 +721,32 @@ function resendCheck(state, resolved, identity) {
         code: "FLOW_ANSWER_RESENT",
         action: "la frontera vigente es la que devuelve esta directiva; contestá esa",
         outcome: "completed",
-    });
+    }, cost);
 }
 /**
  * A rejection, expressed as the recalculated directive.
  *
- * The state handed back is the one that was read: nothing is written on this
- * path, and the caller can see that because the mutation returns `ok: false`
- * only for invocation failures — a business rejection returns the state unchanged
- * with its own outcome.
+ * Whether it spends an attempt is decided HERE, from the code, and never by the
+ * call site. It used to be the call site's business, and six refusals of this
+ * file simply forgot to pass the parameter: a scope answered with an alias the
+ * plan does not name never exhausted, never degraded and never became
+ * recoverable — an unbounded loop inside the very mechanism that exists to bound
+ * one. One place decides, one table says which codes count.
+ *
+ * `cost` is absent only where there is no boundary to charge: a run that already
+ * finished, or one that never stopped at anything.
  */
-function reject(state, resolved, message, detail, spent) {
+function reject(state, resolved, message, detail, cost) {
     // A refused answer is the one rejection that CHANGES the run: the attempt is
     // recorded, so the boundary that has been tried to its cap degrades instead of
     // being emitted again. The boundary is recalculated over that state, which is
     // what turns the last refusal into the degradation rather than into an
     // identical question with a different error string.
-    const after = spent === undefined ? state : withAttempt(state, spent.identity);
-    const now = spent === undefined ? resolved : resolveBoundary(after, spent.journey);
+    const traced = cost?.trace === undefined || restatesLastEvent(state, cost.trace)
+        ? state
+        : withEvent(state, cost.trace);
+    const after = cost !== undefined && spendsAttempt(detail.code) ? withAttempt(traced, cost.identity) : traced;
+    const now = cost === undefined || after === state ? resolved : resolveBoundary(after, cost.journey);
     const built = directiveFor(after, now, [], {
         // No outcome named ⇒ the boundary decides it: a finished journey reports
         // `completed`, an open one `needs_input`. Hardcoding one here would let a
@@ -716,7 +768,10 @@ function reject(state, resolved, message, detail, spent) {
         ok: true,
         state: after,
         value: { directive, advanced: false },
-        persist: spent !== undefined,
+        // Persisted exactly when something really changed, whichever half changed it.
+        // Tying this to the attempt alone would drop a material trace that a refusal
+        // produced without charging for it.
+        persist: after !== state,
     };
 }
 /**