@try-works/dsh-recursive-mode 0.4.7 → 0.4.9

package/README.md

@@ -386,10 +386,17 @@ from `session/event`, with a cheap shape test first, because that event fires fo
 observer **waits** — bounded, polling, with a timeout — and reports "no settlement yet" only after actually
 waiting. The park remains as the fallback, so an unobserved round is never an approval.
 
-**Action records are written for every delegation**, and they carry `Execution Mode` and `Status`. After a
-failed delegation, they now also carry **`Failure:`** — because `Status: failed` on its own cannot distinguish a
-child that ran and failed from a child that never started. That distinction cost three rounds of investigation
-before the field existed.
+**Action records are written for every delegation**, and they carry `Execution Mode` and a `Status` with
+**three** values, not two: `accepted`, `failed`, and `parked (still running; no settlement yet)`. The third
+state exists because a round whose child had not settled is **not** a failure — the delegation interface says
+so, and `recursive_review` already reports it as `parked` — and a binary status forced it to read as one: a live
+run's record said `Status: failed` with *"the child never reported, or never ran"*, the main agent concluded its
+reviewer was dead and obtained the review another way, and the child replied eighteen minutes later. A `failed`
+record carries **`Failure:`** with its cause; a parked record carries **`Parked:`** instead — stating only what
+is known ("no settlement had landed when the wait ended … the child may still be working"), naming the
+`childId`, and saying that resuming with that id is the next step. `operations/operations.jsonl` records the
+same distinction (`parked` rather than `unaccepted`), because the operation log had the identical conflation.
+That distinction cost three rounds of investigation before the third state existed.
 
 ---
 

package/lib/delegation.d.ts

@@ -336,9 +336,40 @@ export interface ActionRecordInput {
      * nothing else: a delegation that FAILED and a delegation that NEVER HAPPENED read identically, which is what
      * let me conclude for three rounds that the host was not scheduling children. The caller ALREADY passed
      * `stopReason`, and the live record said `n/a` — because there was no result to take a stop reason from.
+     *
+     * ⚠ AND IT IS EMITTED ONLY FOR A GENUINE FAILURE. A PARKED round is neither accepted nor failed, so it
+     * carries {@link ActionRecordInput.parked} instead: calling a live child a failure is the defect this
+     * field's own history is made of.
      */
     failure?: string;
+    /**
+     * ⚠ THE THIRD STATE, AND WHY `success` COULD NOT CARRY IT.
+     *
+     * A continuable round that has not settled is NOT a failure — `ContinuableDelegationLike.parked` says so in
+     * its own doc comment, and the tool result already surfaces it. The RECORD did not: a live run's child was
+     * parked, the record said `Status: failed` with "the child never reported, or never ran", the main agent
+     * read that as a dead child and obtained the review elsewhere — while the child was still working and
+     * replied eighteen minutes later. `success: false` cannot express "still in flight", because a genuinely
+     * dead child also produces `success: false`, so a second field is required rather than a cleverer boolean.
+     *
+     * When true, the record says `parked` and carries a `Parked:` line (never a `Failure:` line) whose text
+     * states only what is KNOWN, names the `childId`, and names the resume step. It takes precedence over
+     * `success`: an unobserved round is never an acceptance, whatever a caller passes alongside it.
+     */
+    parked?: boolean;
 }
+/**
+ * The status a record states, in ONE place, because the three states are the fix and a second writer would
+ * drift from this one.
+ *
+ * The wording is chosen for two readers at once. The MODEL reads it to decide whether to resume or to give up
+ * and obtain the result another way — the exact decision the live defect got wrong — so the token must not
+ * read as a failure and must not need the rest of the document to be understood. A HUMAN reading the run tree
+ * months later needs to tell "died" from "still working" at a glance. Hence `parked (still running; no
+ * settlement yet)`: a third token rather than a renamed second, qualified with the two facts that separate it
+ * from `failed`, and short enough to sit in a status line.
+ */
+export declare function actionRecordStatus(input: Pick<ActionRecordInput, 'success' | 'parked'>): string;
 /**
  * Write a durable action record under subagents/ in the shape this repo's own
  * linter accepts (ts-lint.ts lintSubagentActionRecordFile — every top-level .md
@@ -351,7 +382,10 @@ export interface ActionRecordInput {
  *     `Code Refs` strictly inside ## Inputs Provided. The linter resolves each of
  *     those through the heading body, so a field under another heading is not
  *     found at all.
- * A success:false attempt is written with a failed status and is NOT accepted.
+ * A success:false attempt is written with a failed status and is NOT accepted. A round that PARKED is written
+ * with a status of its own (`parked (still running; no settlement yet)`, see {@link actionRecordStatus}) and a
+ * `Parked:` line instead of a `Failure:` one, because no settlement is not a death: it is the caller's signal to
+ * resume the same child. Only a genuine failure carries `Failure:`.
  */
 export declare function writeActionRecord(input: ActionRecordInput): string;
 /**

package/lib/enforcement.d.ts

@@ -55,8 +55,14 @@ export declare const DEFAULT_ENFORCEMENT: EnforcementConfig;
  * every allow/deny/ask the guard hands back). `'none'` means no guard predicate
  * fired; `'transition'` marks a decision whose only dissenting gate was the
  * advisory transition gate (see consultTransitionGate).
+ *
+ * `'phase-order'` is the WRITE half of the ordering rule the owner states as *only
+ * one phase may be active at a time, and the phases should be sequential and the
+ * active phase must be locked before proceeding to next phase*: `'lock-order'` refuses
+ * locking ahead, `'phase-order'` refuses WRITING ahead. Two labels rather than one,
+ * because the guard log has to tell the owner which of the two the agent attempted.
  */
-export type GuardRule = 'lock-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none';
+export type GuardRule = 'lock-order' | 'phase-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none';
 /** T15: the transition gate's verdict as attached to a decision (advisory only). */
 export interface GuardTransition {
     passed: boolean;
@@ -108,7 +114,7 @@ export interface ToolExecLike {
  * `recursive:policy` later — can read the effective rules instead of inferring
  * them from a code path.
  */
-export declare function resolveToolPolicyForGuard(worktreeRoot: string, runId: string): ToolPolicy;
+export declare function resolveToolPolicyForGuard(worktreeRoot: string, runId: string, activePhaseArtifact?: string): ToolPolicy;
 /**
  * The artifact whose phase baseline applies: the HIGHEST-numbered phase artifact
  * present in the run (a run at phase 3 has `00`-`03` on disk). Read from the

package/lib/index.js

@@ -1512,11 +1512,91 @@ function lockedWriteRule(target, worktreeRoot) {
 	};
 }
 /**
+* The file name when `abs` is a DIRECT CHILD of `runDir`, and `null` otherwise.
+*
+* ⚠ THE DIRECT-CHILD TEST IS NOT TIDINESS — IT IS WHAT KEEPS THE RULE OFF THE SUPPORT
+* FILES. `phaseNumberForArtifact` reads the leading digits of a NAME, so
+* `<run>/evidence/01-as-is.md` or `<run>/subagents/child/03-brief.md` would look like
+* phase 1 and phase 3 artifacts if the name were all that was examined. A phase artifact
+* is a file the run tree holds DIRECTLY beside the others (`recursive_init` writes all
+* twelve into `<run>/` itself), so the parent directory is part of the definition.
+*
+* The comparison normalizes separators and case: the same run directory reached through
+* a Windows spelling that differs in case is the same directory, and the rule must not
+* abstain on one spelling and fire on the other.
+*/
+function directChildName(abs, runDir) {
+	const normalize = (path) => resolve(path).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+	if (normalize(dirname(abs)) !== normalize(runDir)) return null;
+	return basename(abs);
+}
+/**
+* PHASE-ORDER rule: a denial when the target is a LATER phase's artifact than the phase
+* currently active, `null` when it is not.
+*
+* ⚠ THE HOLE THIS CLOSES. The monotonic rule was enforced on `recursive_lock` ONLY. An
+* agent could therefore write `08-memory-impact.md` while the run sat at phase 0 — and a
+* live run did exactly that: twelve artifacts, not one of them locked, written out of
+* order, with a single line in `operations/operations.jsonl`. Ordering that only binds
+* the lock tool is not ordering; the model's ordinary `write` is the path that mattered.
+*
+* The owner's rule, verbatim: *only one phase may be active at a time, and the phases
+* should be sequential and the active phase must be locked before proceeding to next
+* phase*. The ACTIVE phase is the one the selector names (`ctx.activePhaseArtifact`), so:
+*
+*   - the target is the ACTIVE artifact, or shares its phase number (`00-requirements.md`
+*     and `00-worktree.md` are both phase 0; `01-as-is.md` and `01.5-root-cause.md` are
+*     both phase 1) -> ABSTAIN, the write is allowed;
+*   - the target is an EARLIER phase -> ABSTAIN. Such an artifact is LOCKED by
+*     construction (the active phase is the lowest UNLOCKED one), so the locked-artifact
+*     rule above decides it, and its rule label is preserved;
+*   - the target is a LATER phase -> DENY: working ahead.
+*
+* ⚠ THE ALLOW HALF IS LOAD-BEARING. An enforcement rule in this exact area was once the
+* bug: strict enforcement denied the run's OWN artifacts in every phase and made the
+* workflow unusable (see `resolveFrom` and `currentPhaseArtifact`). "The active artifact
+* stays writable at every phase" is therefore asserted by walking every phase, not by
+* one case — `tests/strict-run-tree.spec.ts` (d).
+*
+* WHAT IT ABSTAINS ON, deliberately:
+*   - no `activePhaseArtifact` (a caller with no run context, or a run with no phase
+*     artifacts yet) -> abstain, never guess a phase;
+*   - a target outside the active run's own directory -> abstain. The rule is about THIS
+*     run's sequence; another run's tree is a different question and denying it here
+*     would be a false positive;
+*   - a support file (anything not a direct child) -> abstain: `evidence/`, `scratch/`,
+*     `addenda/`, `subagents/`, `operations/` and a plain `<run>/notes.md` are not phases.
+*
+* The predicate adds only the per-call particular — which artifact, which phase, which is
+* active; the rule keeps the static, auditable sentence.
+*/
+function phaseOrderRule(target, ctx) {
+	const active = ctx.activePhaseArtifact;
+	if (!target || !ctx.runDir || !ctx.worktreeRoot) return null;
+	if (typeof active !== "string" || active === "") return null;
+	const activePhaseText = phaseNumberForArtifact(active);
+	if (!activePhaseText) return null;
+	const normalized = target.replace(/\\/g, "/");
+	if (!normalized.endsWith(".md")) return null;
+	const abs = resolveFrom(ctx.worktreeRoot, normalized);
+	if (!abs) return null;
+	const name = directChildName(abs, ctx.runDir);
+	if (name === null) return null;
+	const phaseText = phaseNumberForArtifact(name);
+	if (!phaseText) return null;
+	if (Number(phaseText) <= Number(activePhaseText)) return null;
+	return {
+		verdict: "deny",
+		detail: name + " is phase " + phaseText + " but the ACTIVE phase is " + active + " (phase " + activePhaseText + ") - the active phase must be locked before writing a later phase"
+	};
+}
+/**
 * The BUILT-IN default rule list — the pre-T16 guard behaviour expressed as
 * data:
 *
 *   `recursive_lock*`  -> the monotonic lock-order denial;
 *   the write-tool ids -> the locked-artifact write denial;
+*   the write-tool ids -> the phase-order (write-ahead) denial;
 *   `*`                -> allow, so an ordinary tool is not turned into an `ask`.
 *
 * Every `deny` precedes the `allow`, which is what makes "deny wins over allow" a
@@ -1543,6 +1623,13 @@ function builtInToolPolicyRules() {
 		label: "locked-write",
 		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null
 	});
+	for (const name of WRITE_TOOL_NAMES) rules.push({
+		pattern: name,
+		verdict: "deny",
+		reason: "phase order: only one phase may be active at a time - the active phase must be locked before a later phase artifact is written",
+		label: "phase-order",
+		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null
+	});
 	rules.push({
 		pattern: "*",
 		verdict: "allow",
@@ -1581,6 +1668,10 @@ function attachPolicyPredicate(rule) {
 		...rule,
 		predicate: (id, args, ctx) => LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir) : null
 	};
+	if (rule.label === "phase-order") return {
+		...rule,
+		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null
+	};
 	if (WRITE_TOOL_NAMES.has(rule.pattern)) return {
 		...rule,
 		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null
@@ -7784,8 +7875,8 @@ const DEFAULT_ENFORCEMENT = {
 * `recursive:policy` later — can read the effective rules instead of inferring
 * them from a code path.
 */
-function resolveToolPolicyForGuard(worktreeRoot, runId) {
-	return withPhaseBaseline(loadToolPolicyFile(worktreeRoot).policy, currentPhaseArtifact(worktreeRoot, runId));
+function resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact) {
+	return withPhaseBaseline(loadToolPolicyFile(worktreeRoot).policy, activePhaseArtifact ?? currentPhaseArtifact(worktreeRoot, runId));
 }
 /**
 * The artifact whose phase baseline applies: the HIGHEST-numbered phase artifact
@@ -7835,11 +7926,13 @@ function evaluateToolGuard(exec, worktreeRoot, activeRunId, mode = "advisory") {
 	const runId = typeof activeRunId === "string" ? activeRunId.trim() : "";
 	const runDir = join(worktreeRoot, ".recursive", "run", runId);
 	const transition = consultTransitionGate(name, args, worktreeRoot, runId);
-	return advisory(verdictFor(mode, evaluateToolPolicy(resolveToolPolicyForGuard(worktreeRoot, runId), name, args, {
+	const activePhaseArtifact = currentPhaseArtifact(worktreeRoot, runId);
+	return advisory(verdictFor(mode, evaluateToolPolicy(resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact), name, args, {
 		args,
 		runDir,
 		runId,
-		worktreeRoot
+		worktreeRoot,
+		activePhaseArtifact
 	})), transition);
 }
 /**
@@ -8086,6 +8179,7 @@ function renderStableContract(config = DEFAULT_ENFORCEMENT) {
 		"- Gates in force: pre-step " + config.preStep + ", tool guards " + config.toolGuards + ", tamper detection " + config.tamper + ".",
 		"- A transition that fails its gates is BLOCKED (strict) or warns (advisory); no rejected transition proceeds silently.",
 		"- Writes to a Status: LOCKED phase doc are denied/asked; reopen explicitly to edit.",
+		"- Phase order binds WRITES as well as locks: only the ACTIVE phase (the lowest-numbered artifact not yet LOCKED) may be written; a write to a LATER phase artifact is denied/asked. Run support files (evidence/, scratch/, addenda/, subagents/, operations/) are not phases.",
 		"- Phase 3 lock requires TDD evidence (strict) or rationale (pragmatic); Phase 5 requires QA evidence.",
 		"- The control-plane root is resolved STRICTLY from this session workspace (never scanned from another)."
 	].join("\n");
@@ -8779,7 +8873,7 @@ async function delegateContinuable(input) {
 			const observed = await input.awaitRoundResult(childId, lastMessageId);
 			if (observed === null) return {
 				ok: false,
-				reason: "no settlement has landed for round " + (round + 1) + " yet (the child is still working)",
+				reason: "no settlement has landed for round " + (round + 1) + " yet, so the round is PARKED, not failed: the child may still be working. Resume it on a later turn with childId " + String(childId) + " (the `resumeChild` argument) — do not start a second child.",
 				childId,
 				messageIds,
 				rounds,
@@ -8993,6 +9087,21 @@ function validateReferences(root, references) {
 		checked
 	};
 }
+/**
+* The status a record states, in ONE place, because the three states are the fix and a second writer would
+* drift from this one.
+*
+* The wording is chosen for two readers at once. The MODEL reads it to decide whether to resume or to give up
+* and obtain the result another way — the exact decision the live defect got wrong — so the token must not
+* read as a failure and must not need the rest of the document to be understood. A HUMAN reading the run tree
+* months later needs to tell "died" from "still working" at a glance. Hence `parked (still running; no
+* settlement yet)`: a third token rather than a renamed second, qualified with the two facts that separate it
+* from `failed`, and short enough to sit in a status line.
+*/
+function actionRecordStatus(input) {
+	if (input.parked === true) return "parked (still running; no settlement yet)";
+	return input.success ? "accepted" : "failed";
+}
 function slugify(value) {
 	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "action";
 }
@@ -9008,7 +9117,10 @@ function slugify(value) {
 *     `Code Refs` strictly inside ## Inputs Provided. The linter resolves each of
 *     those through the heading body, so a field under another heading is not
 *     found at all.
-* A success:false attempt is written with a failed status and is NOT accepted.
+* A success:false attempt is written with a failed status and is NOT accepted. A round that PARKED is written
+* with a status of its own (`parked (still running; no settlement yet)`, see {@link actionRecordStatus}) and a
+* `Parked:` line instead of a `Failure:` one, because no settlement is not a death: it is the caller's signal to
+* resume the same child. Only a genuine failure carries `Failure:`.
 */
 function writeActionRecord(input) {
 	const { root, runId } = input;
@@ -9046,8 +9158,8 @@ function writeActionRecord(input) {
 		"- Phase: " + input.phase,
 		"- Purpose: " + input.purpose,
 		"- Execution Mode: " + input.executionMode,
-		"- Status: " + (input.success ? "accepted" : "failed"),
-		...input.success === false && input.failure !== void 0 ? ["- Failure: " + input.failure] : [],
+		"- Status: " + actionRecordStatus(input),
+		...input.success === false && input.failure !== void 0 ? [input.parked === true ? "- Parked: " + input.failure : "- Failure: " + input.failure] : [],
 		"- Stop Reason: " + (input.stopReason ?? "n/a"),
 		"- Timestamp: " + (/* @__PURE__ */ new Date()).toISOString(),
 		"",
@@ -10827,7 +10939,10 @@ var RecursiveRuntime = class extends Service {
 				} else if (continuable.ok && continuable.rounds.length > 0) {
 					result = continuable.rounds[continuable.rounds.length - 1].result ?? null;
 					if (!result) error = "continuable child produced no final result";
-				} else error = continuable.reason ?? "continuable delegation failed";
+				} else {
+					result = continuable.rounds[continuable.rounds.length - 1]?.result ?? null;
+					if (result === null) error = continuable.reason ?? "continuable delegation failed";
+				}
 			} else try {
 				result = await delegate({
 					subagents,
@@ -10852,7 +10967,7 @@ var RecursiveRuntime = class extends Service {
 			id: operation,
 			act: "delegate-review",
 			at: (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z"),
-			outcome: evaluation.accepted ? "accepted" : "unaccepted",
+			outcome: parked ? "parked" : evaluation.accepted ? "accepted" : "unaccepted",
 			phase: input.phase
 		});
 		const actionRecordPath = writeActionRecord({
@@ -10871,7 +10986,8 @@ var RecursiveRuntime = class extends Service {
 			findings: evaluation.accepted && result?.structured ? [result.structured?.verdict ?? "accepted"] : void 0,
 			success: evaluation.accepted,
 			stopReason: result?.stopReason,
-			failure: evaluation.accepted ? void 0 : result == null ? input.mode !== "one-shot" ? "the continuable start was made and NO SETTLEMENT arrived within the wait (the child never reported, or never ran); tier " + decision.tier + ", provider " + (decision.provider ?? "none chosen") + ", names on offer [" + (this.lastProviderNames.join(", ") || "none") + "]; parent id " + (input.parent?.id ?? "none") + ", parent session keys [" + (input.parent === void 0 ? "no parent" : Object.keys(input.parent).join(", ")) + "]" : "no delegate result was produced by the one-shot path; tier " + decision.tier + ", provider " + (decision.provider ?? "none chosen") : "the delegation returned without acceptance; stop reason " + (result.stopReason ?? "none reported")
+			...parked ? { parked: true } : {},
+			failure: evaluation.accepted ? void 0 : parked ? "no settlement had landed when the wait ended, so this round is PARKED, not failed: nothing was accepted and nothing was refused, and the child may still be working. The next step is to RESUME this round, not to re-dispatch it or replace the child: call `recursive_review` again on a later turn with childId " + String(continuable?.childId ?? input.childId) + " (the child the round was started for, which stays resumable). Diagnostics: tier " + decision.tier + ", provider " + (decision.provider ?? "none chosen") + ", names on offer [" + (this.lastProviderNames.join(", ") || "none") + "]; parent id " + (input.parent?.id ?? "none") + ", parent session keys [" + (input.parent === void 0 ? "no parent" : Object.keys(input.parent).join(", ")) + "]" : result == null ? input.mode !== "one-shot" ? "the continuable start was made and NO SETTLEMENT arrived within the wait (the child never reported, or never ran); tier " + decision.tier + ", provider " + (decision.provider ?? "none chosen") + ", names on offer [" + (this.lastProviderNames.join(", ") || "none") + "]; parent id " + (input.parent?.id ?? "none") + ", parent session keys [" + (input.parent === void 0 ? "no parent" : Object.keys(input.parent).join(", ")) + "]" : "no delegate result was produced by the one-shot path; tier " + decision.tier + ", provider " + (decision.provider ?? "none chosen") : "the delegation returned without acceptance; stop reason " + (result.stopReason ?? "none reported") + (result.success === false ? " (the child itself reported success:false)" : "")
 		});
 		const delegationMode = continuable !== null ? continuable.fellBackToOneShot ? "continuable-unavailable" : "continuable" : result !== null ? "one-shot" : "none";
 		return {
@@ -14793,4 +14909,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, DEFAULT_BUDGETS, DEFAULT_ENFORCEMENT, OPTIONAL_PHASES, PHASES, PHASE_POSITIONS, PHASE_SEQUENCE, RECURSIVE_API_PREFIX, RUN_ARTIFACT_SEQUENCE, RUN_STATES, RecursiveRuntime, apply, auditToPass, buildDelegationPrompt, buildReviewBundle, buildWorkSlice, builtInToolPolicy, capabilityProbe, childScratchPath, coerceAskToDecision, contentSha256, contractDigest, coupleGateBlockToGoal, createChildBrief, createHandoff, createRecursiveCloseoutTool, createRecursiveInitTool, createRecursiveLintTool, createRecursiveLockTool, createRecursivePhaseTool, createRecursiveScratchTool, createRecursiveStatusTool, createRecursiveWorktreeTool, currentPhaseArtifact, defaultReviewToolFilter, delegate, delegateContinuable, delegationDecisionBasis, delegationError, detectTamper, discoverRuns, drainContinuableChildren, drainContinuableDescendants, escapeRegExp, evaluateDelegationResult, evaluateToolGuard, foldDiagnostics, foldRun, foldRunCard, getAllStaleReceipts, getArtifactState, getGateStatus, getLatestRunDirectory, getLockStatus, getMdFieldValue, getNextLegalPhase, getPrerequisiteBlockers, getPrerequisites, getStaleDownstreamPhases, getTodoStats, getWorkflowProfile, inject, interruptContinuable, invalidateReceipt, isCoreArtifact, isTaskClaimedBy, loadRouterPolicy, lockHashFromContent, makeRecursiveRoutes, mountRecursiveRoutesOnce, name, normalizeForLockHash, parseReplyVerdict, pendingWork, phaseIndex, phasePosition, probeCapabilities, readReceipt, readRepairFromReply, readRepairFromStructured, readVerdictFromReply, readVerdictFromStructured, receiptPath, referencesFromResult, registerRecursiveSkill, remainingDepthFor, renderPhaseTail, renderRecursivePolicy, renderStableContract, renderTaskHistory, replyPath, resetFoldCache, resolveEnforcementConfig, resolveRole, resolveRunDir, resolveToolPolicyForGuard, reviewBundleDir, reviewOutputSchema, routerPolicyPath, snapshotWorkspace, tamperCandidatePath, trimMdValue, validateChain, validateReferences, validateTransition, writeActionRecord, writeReceipt };
+export { Config, DEFAULT_BUDGETS, DEFAULT_ENFORCEMENT, OPTIONAL_PHASES, PHASES, PHASE_POSITIONS, PHASE_SEQUENCE, RECURSIVE_API_PREFIX, RUN_ARTIFACT_SEQUENCE, RUN_STATES, RecursiveRuntime, actionRecordStatus, apply, auditToPass, buildDelegationPrompt, buildReviewBundle, buildWorkSlice, builtInToolPolicy, capabilityProbe, childScratchPath, coerceAskToDecision, contentSha256, contractDigest, coupleGateBlockToGoal, createChildBrief, createHandoff, createRecursiveCloseoutTool, createRecursiveInitTool, createRecursiveLintTool, createRecursiveLockTool, createRecursivePhaseTool, createRecursiveScratchTool, createRecursiveStatusTool, createRecursiveWorktreeTool, currentPhaseArtifact, defaultReviewToolFilter, delegate, delegateContinuable, delegationDecisionBasis, delegationError, detectTamper, discoverRuns, drainContinuableChildren, drainContinuableDescendants, escapeRegExp, evaluateDelegationResult, evaluateToolGuard, foldDiagnostics, foldRun, foldRunCard, getAllStaleReceipts, getArtifactState, getGateStatus, getLatestRunDirectory, getLockStatus, getMdFieldValue, getNextLegalPhase, getPrerequisiteBlockers, getPrerequisites, getStaleDownstreamPhases, getTodoStats, getWorkflowProfile, inject, interruptContinuable, invalidateReceipt, isCoreArtifact, isTaskClaimedBy, loadRouterPolicy, lockHashFromContent, makeRecursiveRoutes, mountRecursiveRoutesOnce, name, normalizeForLockHash, parseReplyVerdict, pendingWork, phaseIndex, phasePosition, probeCapabilities, readReceipt, readRepairFromReply, readRepairFromStructured, readVerdictFromReply, readVerdictFromStructured, receiptPath, referencesFromResult, registerRecursiveSkill, remainingDepthFor, renderPhaseTail, renderRecursivePolicy, renderStableContract, renderTaskHistory, replyPath, resetFoldCache, resolveEnforcementConfig, resolveRole, resolveRunDir, resolveToolPolicyForGuard, reviewBundleDir, reviewOutputSchema, routerPolicyPath, snapshotWorkspace, tamperCandidatePath, trimMdValue, validateChain, validateReferences, validateTransition, writeActionRecord, writeReceipt };

package/lib/policy-globs.d.ts

@@ -21,6 +21,18 @@ export interface ToolPolicyContext {
     runDir?: string;
     runId?: string;
     worktreeRoot?: string;
+    /**
+     * The ACTIVE phase artifact of the run — the LOWEST-numbered phase artifact that is not
+     * LOCKED, falling back to the highest when every one of them is locked.
+     *
+     * ⚠ THIS IS NOT A SECOND SELECTOR. It is the answer `currentPhaseArtifact` in
+     * `enforcement.ts` produced for this call, carried here so a rule in THIS module can
+     * compare against it. `policy-globs.ts` cannot import that function (enforcement.ts
+     * imports this module, and the repo has already paid once for a value-level import
+     * cycle), so the value is passed in rather than recomputed. A caller that omits it
+     * gets NO phase-order verdict — the rule abstains rather than guessing a phase.
+     */
+    activePhaseArtifact?: string;
 }
 /**
  * What a rule predicate returns when the condition it guards DOES apply:
@@ -152,6 +164,7 @@ export declare const LOCK_TOOL_NAMES: Set<string>;
  *
  *   `recursive_lock*`  -> the monotonic lock-order denial;
  *   the write-tool ids -> the locked-artifact write denial;
+ *   the write-tool ids -> the phase-order (write-ahead) denial;
  *   `*`                -> allow, so an ordinary tool is not turned into an `ask`.
  *
  * Every `deny` precedes the `allow`, which is what makes "deny wins over allow" a

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-recursive-mode",
   "description": "recursive-mode workflow as a DeepSeek Harness bundle: RecursiveRuntime service + 13 recursive_* tools (recursive_status, recursive_init, recursive_lock, recursive_lint, recursive_closeout, recursive_scratch, recursive_worktree, recursive_phase, recursive_audit_team, recursive_review, recursive_delegate, recursive_ask, recursive_preview)",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/delegation.ts

@@ -559,9 +559,18 @@ export async function delegateContinuable(input: {
         // turn-shaped caller resumes on a later turn instead of treating the round
         // as lost, and so `accepted` stays false — an unobserved round is never an
         // approval.
+        //
+        // ⚠ THE SENTENCE NAMES THE CHILD, and that is not decoration. The advice this
+        // reason carries ("resume with the SAME child") is UNACTIONABLE without the id,
+        // so a caller that reads it and does not also read `childId` can only report the
+        // park, not act on it — and the record built from this reason is exactly where a
+        // live run read "no settlement" as "the child is dead" and went around its own
+        // reviewer. `resumeChild` is the field that consumes this id.
         return {
           ok: false,
-          reason: 'no settlement has landed for round ' + (round + 1) + ' yet (the child is still working)',
+          reason: 'no settlement has landed for round ' + (round + 1) + ' yet, so the round is PARKED, not failed: '
+            + 'the child may still be working. Resume it on a later turn with childId ' + String(childId)
+            + ' (the `resumeChild` argument) — do not start a second child.',
           childId,
           messageIds,
           rounds,
@@ -774,8 +783,43 @@ export interface ActionRecordInput {
    * nothing else: a delegation that FAILED and a delegation that NEVER HAPPENED read identically, which is what
    * let me conclude for three rounds that the host was not scheduling children. The caller ALREADY passed
    * `stopReason`, and the live record said `n/a` — because there was no result to take a stop reason from.
+   *
+   * ⚠ AND IT IS EMITTED ONLY FOR A GENUINE FAILURE. A PARKED round is neither accepted nor failed, so it
+   * carries {@link ActionRecordInput.parked} instead: calling a live child a failure is the defect this
+   * field's own history is made of.
    */
   failure?: string
+  /**
+   * ⚠ THE THIRD STATE, AND WHY `success` COULD NOT CARRY IT.
+   *
+   * A continuable round that has not settled is NOT a failure — `ContinuableDelegationLike.parked` says so in
+   * its own doc comment, and the tool result already surfaces it. The RECORD did not: a live run's child was
+   * parked, the record said `Status: failed` with "the child never reported, or never ran", the main agent
+   * read that as a dead child and obtained the review elsewhere — while the child was still working and
+   * replied eighteen minutes later. `success: false` cannot express "still in flight", because a genuinely
+   * dead child also produces `success: false`, so a second field is required rather than a cleverer boolean.
+   *
+   * When true, the record says `parked` and carries a `Parked:` line (never a `Failure:` line) whose text
+   * states only what is KNOWN, names the `childId`, and names the resume step. It takes precedence over
+   * `success`: an unobserved round is never an acceptance, whatever a caller passes alongside it.
+   */
+  parked?: boolean
+}
+
+/**
+ * The status a record states, in ONE place, because the three states are the fix and a second writer would
+ * drift from this one.
+ *
+ * The wording is chosen for two readers at once. The MODEL reads it to decide whether to resume or to give up
+ * and obtain the result another way — the exact decision the live defect got wrong — so the token must not
+ * read as a failure and must not need the rest of the document to be understood. A HUMAN reading the run tree
+ * months later needs to tell "died" from "still working" at a glance. Hence `parked (still running; no
+ * settlement yet)`: a third token rather than a renamed second, qualified with the two facts that separate it
+ * from `failed`, and short enough to sit in a status line.
+ */
+export function actionRecordStatus(input: Pick<ActionRecordInput, 'success' | 'parked'>): string {
+  if (input.parked === true) return 'parked (still running; no settlement yet)'
+  return input.success ? 'accepted' : 'failed'
 }
 
 function slugify(value: string): string {
@@ -794,7 +838,10 @@ function slugify(value: string): string {
  *     `Code Refs` strictly inside ## Inputs Provided. The linter resolves each of
  *     those through the heading body, so a field under another heading is not
  *     found at all.
- * A success:false attempt is written with a failed status and is NOT accepted.
+ * A success:false attempt is written with a failed status and is NOT accepted. A round that PARKED is written
+ * with a status of its own (`parked (still running; no settlement yet)`, see {@link actionRecordStatus}) and a
+ * `Parked:` line instead of a `Failure:` one, because no settlement is not a death: it is the caller's signal to
+ * resume the same child. Only a genuine failure carries `Failure:`.
  */
 export function writeActionRecord(input: ActionRecordInput): string {
   const { root, runId } = input
@@ -844,11 +891,18 @@ export function writeActionRecord(input: ActionRecordInput): string {
     '- Phase: ' + input.phase,
     '- Purpose: ' + input.purpose,
     '- Execution Mode: ' + input.executionMode,
-    '- Status: ' + (input.success ? 'accepted' : 'failed'),
+    '- Status: ' + actionRecordStatus(input),
     // ⚠ EMITTED ONLY WHEN A REASON IS GIVEN, so a caller that says nothing produces the record it always did.
     // Not politeness: this record's shape is asserted by specs, and a first attempt that always emitted the line
     // failed 13 tests across 5 files. A change to a shared surface should be additive where it can be.
-    ...(input.success === false && input.failure !== undefined ? ['- Failure: ' + input.failure] : []),
+    //
+    // ⚠ AND `parked` IS THE ONE STATE THAT MUST NOT WEAR THE `Failure:` LABEL. This line used to be
+    // `input.success === false && input.failure !== undefined`, which is true of a PARKED round as well — so a
+    // live child that was still working was recorded, on the same line, as a failure. A parked round is not a
+    // failure, so it gets its own field and states only what is established.
+    ...(input.success === false && input.failure !== undefined
+      ? [input.parked === true ? '- Parked: ' + input.failure : '- Failure: ' + input.failure]
+      : []),
     '- Stop Reason: ' + (input.stopReason ?? 'n/a'),
     // Timestamp LAST in Metadata. This USED to be load-bearing: `getHeadingBody` ended
     // its capture with a `\Z` that JavaScript reads as a literal `Z`, so a body was

package/src/enforcement.ts

@@ -129,8 +129,14 @@ export const DEFAULT_ENFORCEMENT: EnforcementConfig = {
  * every allow/deny/ask the guard hands back). `'none'` means no guard predicate
  * fired; `'transition'` marks a decision whose only dissenting gate was the
  * advisory transition gate (see consultTransitionGate).
+ *
+ * `'phase-order'` is the WRITE half of the ordering rule the owner states as *only
+ * one phase may be active at a time, and the phases should be sequential and the
+ * active phase must be locked before proceeding to next phase*: `'lock-order'` refuses
+ * locking ahead, `'phase-order'` refuses WRITING ahead. Two labels rather than one,
+ * because the guard log has to tell the owner which of the two the agent attempted.
  */
-export type GuardRule = 'lock-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none'
+export type GuardRule = 'lock-order' | 'phase-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none'
 
 /** T15: the transition gate's verdict as attached to a decision (advisory only). */
 export interface GuardTransition {
@@ -179,9 +185,12 @@ export interface ToolExecLike {
  * `recursive:policy` later — can read the effective rules instead of inferring
  * them from a code path.
  */
-export function resolveToolPolicyForGuard(worktreeRoot: string, runId: string): ToolPolicy {
+export function resolveToolPolicyForGuard(worktreeRoot: string, runId: string, activePhaseArtifact?: string): ToolPolicy {
   const loaded = loadToolPolicyFile(worktreeRoot)
-  return withPhaseBaseline(loaded.policy, currentPhaseArtifact(worktreeRoot, runId))
+  // A caller that already asked `currentPhaseArtifact` for this call passes the answer in,
+  // so one guard call reads the run tree's lock statuses ONCE rather than twice. The
+  // no-cache discipline is unchanged: an omitted argument still reads the filesystem here.
+  return withPhaseBaseline(loaded.policy, activePhaseArtifact ?? currentPhaseArtifact(worktreeRoot, runId))
 }
 
 /**
@@ -258,8 +267,14 @@ export function evaluateToolGuard(
   // T16: the verdict comes from the ordered policy, not from branches here. The
   // policy file is re-read per call on purpose: a policy a human just edited
   // must take effect on the next tool call, not after a restart.
-  const policy = resolveToolPolicyForGuard(worktreeRoot, runId)
-  const context: ToolPolicyContext = { args, runDir, runId, worktreeRoot }
+  //
+  // The ACTIVE phase is resolved ONCE, by the ONE selector, and is used twice: it
+  // selects the phase baseline (narrowing rules) and it is carried into the context so
+  // the phase-order rule can refuse a WRITE that is ahead of the active phase. Both
+  // halves of the ordering rule therefore read the same answer for the same call.
+  const activePhaseArtifact = currentPhaseArtifact(worktreeRoot, runId)
+  const policy = resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact)
+  const context: ToolPolicyContext = { args, runDir, runId, worktreeRoot, activePhaseArtifact }
   const decision = evaluateToolPolicy(policy, name, args, context)
   return advisory(verdictFor(mode, decision), transition)
 }

package/src/policy-globs.ts

@@ -40,10 +40,10 @@
  * just wrote and believes is in force.
  */
 import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { basename, dirname, join, resolve } from 'node:path'
 import { getLockStatus, getPrerequisiteBlockers } from './lock.ts'
 import { getMdFieldValue } from './status.ts'
-import { policyTargetPath, resolveFrom } from './phase-rules.ts'
+import { phaseNumberForArtifact, policyTargetPath, resolveFrom } from './phase-rules.ts'
 
 /** The three verdicts a rule may carry. */
 export type Verdict = 'allow' | 'deny' | 'ask'
@@ -70,6 +70,18 @@ export interface ToolPolicyContext {
   runDir?: string
   runId?: string
   worktreeRoot?: string
+  /**
+   * The ACTIVE phase artifact of the run — the LOWEST-numbered phase artifact that is not
+   * LOCKED, falling back to the highest when every one of them is locked.
+   *
+   * ⚠ THIS IS NOT A SECOND SELECTOR. It is the answer `currentPhaseArtifact` in
+   * `enforcement.ts` produced for this call, carried here so a rule in THIS module can
+   * compare against it. `policy-globs.ts` cannot import that function (enforcement.ts
+   * imports this module, and the repo has already paid once for a value-level import
+   * cycle), so the value is passed in rather than recomputed. A caller that omits it
+   * gets NO phase-order verdict — the rule abstains rather than guessing a phase.
+   */
+  activePhaseArtifact?: string
 }
 
 /**
@@ -452,12 +464,95 @@ function lockedWriteRule(target: string | null, worktreeRoot: string | undefined
   return { verdict: 'deny', detail: normalized + ' carries Status: LOCKED (reopen explicitly to edit)' }
 }
 
+/**
+ * The file name when `abs` is a DIRECT CHILD of `runDir`, and `null` otherwise.
+ *
+ * ⚠ THE DIRECT-CHILD TEST IS NOT TIDINESS — IT IS WHAT KEEPS THE RULE OFF THE SUPPORT
+ * FILES. `phaseNumberForArtifact` reads the leading digits of a NAME, so
+ * `<run>/evidence/01-as-is.md` or `<run>/subagents/child/03-brief.md` would look like
+ * phase 1 and phase 3 artifacts if the name were all that was examined. A phase artifact
+ * is a file the run tree holds DIRECTLY beside the others (`recursive_init` writes all
+ * twelve into `<run>/` itself), so the parent directory is part of the definition.
+ *
+ * The comparison normalizes separators and case: the same run directory reached through
+ * a Windows spelling that differs in case is the same directory, and the rule must not
+ * abstain on one spelling and fire on the other.
+ */
+function directChildName(abs: string, runDir: string): string | null {
+  const normalize = (path: string) => resolve(path).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase()
+  if (normalize(dirname(abs)) !== normalize(runDir)) return null
+  return basename(abs)
+}
+
+/**
+ * PHASE-ORDER rule: a denial when the target is a LATER phase's artifact than the phase
+ * currently active, `null` when it is not.
+ *
+ * ⚠ THE HOLE THIS CLOSES. The monotonic rule was enforced on `recursive_lock` ONLY. An
+ * agent could therefore write `08-memory-impact.md` while the run sat at phase 0 — and a
+ * live run did exactly that: twelve artifacts, not one of them locked, written out of
+ * order, with a single line in `operations/operations.jsonl`. Ordering that only binds
+ * the lock tool is not ordering; the model's ordinary `write` is the path that mattered.
+ *
+ * The owner's rule, verbatim: *only one phase may be active at a time, and the phases
+ * should be sequential and the active phase must be locked before proceeding to next
+ * phase*. The ACTIVE phase is the one the selector names (`ctx.activePhaseArtifact`), so:
+ *
+ *   - the target is the ACTIVE artifact, or shares its phase number (`00-requirements.md`
+ *     and `00-worktree.md` are both phase 0; `01-as-is.md` and `01.5-root-cause.md` are
+ *     both phase 1) -> ABSTAIN, the write is allowed;
+ *   - the target is an EARLIER phase -> ABSTAIN. Such an artifact is LOCKED by
+ *     construction (the active phase is the lowest UNLOCKED one), so the locked-artifact
+ *     rule above decides it, and its rule label is preserved;
+ *   - the target is a LATER phase -> DENY: working ahead.
+ *
+ * ⚠ THE ALLOW HALF IS LOAD-BEARING. An enforcement rule in this exact area was once the
+ * bug: strict enforcement denied the run's OWN artifacts in every phase and made the
+ * workflow unusable (see `resolveFrom` and `currentPhaseArtifact`). "The active artifact
+ * stays writable at every phase" is therefore asserted by walking every phase, not by
+ * one case — `tests/strict-run-tree.spec.ts` (d).
+ *
+ * WHAT IT ABSTAINS ON, deliberately:
+ *   - no `activePhaseArtifact` (a caller with no run context, or a run with no phase
+ *     artifacts yet) -> abstain, never guess a phase;
+ *   - a target outside the active run's own directory -> abstain. The rule is about THIS
+ *     run's sequence; another run's tree is a different question and denying it here
+ *     would be a false positive;
+ *   - a support file (anything not a direct child) -> abstain: `evidence/`, `scratch/`,
+ *     `addenda/`, `subagents/`, `operations/` and a plain `<run>/notes.md` are not phases.
+ *
+ * The predicate adds only the per-call particular — which artifact, which phase, which is
+ * active; the rule keeps the static, auditable sentence.
+ */
+function phaseOrderRule(target: string | null, ctx: ToolPolicyContext): ToolPolicyPredicateMatch | null {
+  const active = ctx.activePhaseArtifact
+  if (!target || !ctx.runDir || !ctx.worktreeRoot) return null
+  if (typeof active !== 'string' || active === '') return null
+  const activePhaseText = phaseNumberForArtifact(active)
+  if (!activePhaseText) return null
+  const normalized = target.replace(/\\/g, '/')
+  if (!normalized.endsWith('.md')) return null
+  const abs = resolveFrom(ctx.worktreeRoot, normalized)
+  if (!abs) return null
+  const name = directChildName(abs, ctx.runDir)
+  if (name === null) return null
+  const phaseText = phaseNumberForArtifact(name)
+  if (!phaseText) return null
+  if (Number(phaseText) <= Number(activePhaseText)) return null
+  return {
+    verdict: 'deny',
+    detail: name + ' is phase ' + phaseText + ' but the ACTIVE phase is ' + active
+      + ' (phase ' + activePhaseText + ') - the active phase must be locked before writing a later phase',
+  }
+}
+
 /**
  * The BUILT-IN default rule list — the pre-T16 guard behaviour expressed as
  * data:
  *
  *   `recursive_lock*`  -> the monotonic lock-order denial;
  *   the write-tool ids -> the locked-artifact write denial;
+ *   the write-tool ids -> the phase-order (write-ahead) denial;
  *   `*`                -> allow, so an ordinary tool is not turned into an `ask`.
  *
  * Every `deny` precedes the `allow`, which is what makes "deny wins over allow" a
@@ -488,6 +583,20 @@ export function builtInToolPolicyRules(): ToolPolicyRule[] {
       predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null),
     })
   }
+  // The SAME write-tool ids get a SECOND conditional deny, the phase-order rule. Two rules
+  // share one pattern on purpose: the engine's predicates ABSTAIN (`null`) when their
+  // condition does not apply, so a clean write falls through both to the catch-all allow,
+  // and a target that is BOTH locked and a later phase is reported by the locked rule
+  // first (file order within a specificity tier), which is the pre-existing wording.
+  for (const name of WRITE_TOOL_NAMES) {
+    rules.push({
+      pattern: name,
+      verdict: 'deny',
+      reason: 'phase order: only one phase may be active at a time - the active phase must be locked before a later phase artifact is written',
+      label: 'phase-order',
+      predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null),
+    })
+  }
   rules.push({
     pattern: '*',
     verdict: 'allow',
@@ -523,6 +632,18 @@ export function attachPolicyPredicate(rule: ToolPolicyRule): ToolPolicyRule {
   if (rule.pattern === 'recursive_lock*') {
     return { ...rule, predicate: (id, args, ctx) => (LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir) : null) }
   }
+  // ⚠ THE LABEL IS CONSULTED BEFORE THE PATTERN, because the phase-order rule and the
+  // locked-artifact rule share EVERY write-tool pattern (see `builtInToolPolicyRules`).
+  // Selecting by pattern alone would give BOTH rules the locked-artifact condition — the
+  // second would then deny a locked target with the wrong reason and the phase-order
+  // condition would never be attached at all, so the hole would stay open in every repo
+  // that ships a policy file. The `label` is already the rule's machine-readable identity
+  // (`firstPolicyDefect` admits it, `decide` surfaces it as the decision's `rule`), so the
+  // label is what names the condition. A rule with NO label keeps the pattern's condition,
+  // exactly as before.
+  if (rule.label === 'phase-order') {
+    return { ...rule, predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null) }
+  }
   if (WRITE_TOOL_NAMES.has(rule.pattern)) {
     return { ...rule, predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null) }
   }

package/src/policy.ts

@@ -111,6 +111,7 @@ export function renderStableContract(config: EnforcementConfig = DEFAULT_ENFORCE
       + ', tamper detection ' + config.tamper + '.',
     '- A transition that fails its gates is BLOCKED (strict) or warns (advisory); no rejected transition proceeds silently.',
     '- Writes to a Status: LOCKED phase doc are denied/asked; reopen explicitly to edit.',
+    '- Phase order binds WRITES as well as locks: only the ACTIVE phase (the lowest-numbered artifact not yet LOCKED) may be written; a write to a LATER phase artifact is denied/asked. Run support files (evidence/, scratch/, addenda/, subagents/, operations/) are not phases.',
     '- Phase 3 lock requires TDD evidence (strict) or rationale (pragmatic); Phase 5 requires QA evidence.',
     '- The control-plane root is resolved STRICTLY from this session workspace (never scanned from another).',
   ].join('\n')

package/src/runtime.ts

@@ -1099,7 +1099,16 @@ export class RecursiveRuntime extends Service {
           result = continuable.rounds[continuable.rounds.length - 1].result ?? null
           if (!result) error = 'continuable child produced no final result'
         } else {
-          error = continuable.reason ?? 'continuable delegation failed'
+          // ⚠ A ROUND THAT SETTLED IS A RESULT, EVEN WHEN IT WAS NOT ACCEPTED — and this branch used to
+          // discard it. The condition above requires `continuable.ok`, so a child that REPORTED and was
+          // refused (`success: false`, or a non-completed stop reason) fell through to here: `result` stayed
+          // null, the action record said "NO SETTLEMENT arrived within the wait", and the child's own stop
+          // reason — the one fact that explains the refusal — was dropped on the floor. It is the same defect
+          // as the parked one, one branch over: an absence asserted where the code had evidence. Keeping the
+          // result is what lets the record say "the delegation returned without acceptance; stop reason error"
+          // instead of blaming a wait that ended perfectly well.
+          result = continuable.rounds[continuable.rounds.length - 1]?.result ?? null
+          if (result === null) error = continuable.reason ?? 'continuable delegation failed'
         }
       } else {
         try {
@@ -1147,7 +1156,14 @@ export class RecursiveRuntime extends Service {
         id: operation,
         act: 'delegate-review',
         at: new Date().toISOString().replace(/\.\d{3}Z$/, 'Z'),
-        outcome: evaluation.accepted ? 'accepted' : 'unaccepted',
+        // ⚠ A PARK IS NOT A REFUSAL, and `unaccepted` said it was. This line used to be
+        // `accepted ? 'accepted' : 'unaccepted'`, so a round that had merely not settled yet was indexed
+        // exactly like a delegation that was evaluated and refused — while the round it really was (still in
+        // flight, resume the same child) was nowhere in the run's own operation log. The defect the action
+        // record had, the log had too. The new value is honest on both readings that matter: it is not
+        // `accepted`, so every retry gate still treats the operation as unfinished and retryable — which is
+        // what a parked round is — and it no longer claims the delegation was judged and rejected.
+        outcome: parked ? 'parked' : (evaluation.accepted ? 'accepted' : 'unaccepted'),
         phase: input.phase,
       })
     }
@@ -1158,8 +1174,8 @@ export class RecursiveRuntime extends Service {
       runId: input.runId,
       subagentId: input.childId,
       phase: input.phase,
-      // ⚠ FU-17 — the kind is stated in the record. `Status` says accepted or failed; nothing said whether the
-      // child PRODUCED the phase's work or JUDGED it, and a reader of a run could not tell the two apart.
+      // ⚠ FU-17 — the kind is stated in the record. `Status` says accepted, failed or parked; nothing said whether
+      // the child PRODUCED the phase's work or JUDGED it, and a reader of a run could not tell the two apart.
       purpose: input.role + (input.kind === 'work' ? ' (work)' : '') + ' for run ' + input.runId,
       executionMode: decision.tier + (input.mode !== 'one-shot' ? ' (continuable)' : ''),
       artifactPath: input.artifactPath,
@@ -1171,32 +1187,70 @@ export class RecursiveRuntime extends Service {
       findings: evaluation.accepted && result?.structured ? [(result.structured as { verdict?: string })?.verdict ?? 'accepted'] : undefined,
       success: evaluation.accepted,
       stopReason: result?.stopReason,
+      // ⚠ A PARKED ROUND IS RECORDED AS PARKED — the whole defect in one field. `success: evaluation.accepted`
+      // is false for a park (correct: nothing was accepted), and `writeActionRecord` reads this flag to state
+      // the third state instead of collapsing it into `failed`.
+      ...(parked ? { parked: true } : {}),
       // ⚠ FU-9 — AND SAY WHICH KIND OF FAILURE, because the record previously could not. `result == null` means
       // the provider never produced anything at all (never started, or returned nothing) — which is what the
       // live record's `Stop Reason: n/a` was quietly telling me — while a present result that failed to be
       // accepted means a child DID run and its work was refused. Different problems, identical artifacts.
+      //
+      // ⚠ AND `parked` IS BRANCHED FIRST. A parked round produced NO result at all — that IS what parking
+      // means — so without this branch first it fell into the `result == null` text below: "the continuable
+      // start was made and NO SETTLEMENT arrived within the wait (the child never reported, or never ran)".
+      // That is the exact false conclusion this fix exists for, and it was reached whatever the record's
+      // Status said. Order is therefore load-bearing here.
       failure: evaluation.accepted
         ? undefined
-        : result == null
-          // ⚠ THE TWO STATES ARE NOT THE SAME AND THE MESSAGE USED TO CONFLATE THEM. The one-shot path cannot
-          // resolve to nothing — the host's `start` returns a run or throws (assertCapabilities, expectProvider)
-          // — so a null result on the CONTINUABLE path means the opposite of what I first wrote: the start WAS
-          // made and NO SETTLEMENT ARRIVED within the wait. That distinction cost me two rounds of looking at
-          // provider names, so the record now states which path a run took and what it was waiting for.
-          ? (input.mode !== 'one-shot'
-            ? 'the continuable start was made and NO SETTLEMENT arrived within the wait (the child never reported,'
-              + ' or never ran); tier ' + decision.tier + ', provider ' + (decision.provider ?? 'none chosen')
-              + ', names on offer [' + (this.lastProviderNames.join(', ') || 'none') + ']'
-              // ⚠ FU-9 — THE PARENT IDENTITY, because the host refuses a prompt when it cannot resolve the
-              // parent session as a live Agent (`subagent/parent-unavailable`, index.ts L429-436), and the tool
-              // builds this handle with a CAST (`exec.agent as unknown as SubagentParentHandle`). A cast is not
-              // a contract: if the id here is not the one the host looks up, the refusal is real and the
-              // classifier's crash has been hiding it. Printing it here costs nothing and settles the question.
-              + '; parent id ' + ((input.parent as { id?: string } | undefined)?.id ?? 'none')
-              + ', parent session keys [' + (input.parent === undefined ? 'no parent' : Object.keys(input.parent as object).join(', ')) + ']'
-            : 'no delegate result was produced by the one-shot path; tier ' + decision.tier
-              + ', provider ' + (decision.provider ?? 'none chosen'))
-          : 'the delegation returned without acceptance; stop reason ' + (result.stopReason ?? 'none reported'),
+        : parked
+          // ⚠ WHAT IS KNOWN, AND ONLY WHAT IS KNOWN, WITH THE ID THE READER NEEDS TO ACT.
+          //
+          // The text this replaces said "the child never reported, or never ran" — a CONCLUSION drawn from an
+          // ABSENCE, and it was false: a live child went on to complete three review rounds and reply eighteen
+          // minutes later, while the main agent read `Status: failed`, concluded the child was dead, and
+          // obtained its review by other means. So the parked message asserts nothing about the child's state
+          // beyond "no settlement had landed when the wait ended", keeps "may still be working" as the
+          // possibility it is, and NAMES the childId plus the exact next step, because advice to resume is
+          // unactionable without the id. The identity diagnostics stay, because they are what makes a
+          // misconfigured provider readable — but they are diagnostics, not the reason.
+          ? 'no settlement had landed when the wait ended, so this round is PARKED, not failed: nothing was'
+            + ' accepted and nothing was refused, and the child may still be working. The next step is to RESUME'
+            + ' this round, not to re-dispatch it or replace the child: call `recursive_review` again on a later'
+            + ' turn with childId ' + String(continuable?.childId ?? input.childId) + ' (the child the round was'
+            + ' started for, which stays resumable). Diagnostics: tier ' + decision.tier
+            + ', provider ' + (decision.provider ?? 'none chosen')
+            + ', names on offer [' + (this.lastProviderNames.join(', ') || 'none') + ']'
+            // ⚠ FU-9 — THE PARENT IDENTITY, because the host refuses a prompt when it cannot resolve the
+            // parent session as a live Agent (`subagent/parent-unavailable`, index.ts L429-436), and the tool
+            // builds this handle with a CAST (`exec.agent as unknown as SubagentParentHandle`). A cast is not
+            // a contract: if the id here is not the one the host looks up, the refusal is real and the
+            // classifier's crash has been hiding it. Printing it here costs nothing and settles the question.
+            + '; parent id ' + ((input.parent as { id?: string } | undefined)?.id ?? 'none')
+            + ', parent session keys [' + (input.parent === undefined ? 'no parent' : Object.keys(input.parent as object).join(', ')) + ']'
+          : result == null
+            // ⚠ THE TWO STATES ARE NOT THE SAME AND THE MESSAGE USED TO CONFLATE THEM. The one-shot path cannot
+            // resolve to nothing — the host's `start` returns a run or throws (assertCapabilities, expectProvider)
+            // — so a null result on the CONTINUABLE path means the opposite of what I first wrote: the start WAS
+            // made and NO SETTLEMENT ARRIVED within the wait. That distinction cost me two rounds of looking at
+            // provider names, so the record now states which path a run took and what it was waiting for.
+            // (A park is handled above and never reaches this branch; this one is a continuable round that
+            // produced neither a result nor the park signal, which IS a failure to report.)
+            ? (input.mode !== 'one-shot'
+              ? 'the continuable start was made and NO SETTLEMENT arrived within the wait (the child never reported,'
+                + ' or never ran); tier ' + decision.tier + ', provider ' + (decision.provider ?? 'none chosen')
+                + ', names on offer [' + (this.lastProviderNames.join(', ') || 'none') + ']'
+                // ⚠ FU-9 — THE PARENT IDENTITY, because the host refuses a prompt when it cannot resolve the
+                // parent session as a live Agent (`subagent/parent-unavailable`, index.ts L429-436), and the tool
+                // builds this handle with a CAST (`exec.agent as unknown as SubagentParentHandle`). A cast is not
+                // a contract: if the id here is not the one the host looks up, the refusal is real and the
+                // classifier's crash has been hiding it. Printing it here costs nothing and settles the question.
+                + '; parent id ' + ((input.parent as { id?: string } | undefined)?.id ?? 'none')
+                + ', parent session keys [' + (input.parent === undefined ? 'no parent' : Object.keys(input.parent as object).join(', ')) + ']'
+              : 'no delegate result was produced by the one-shot path; tier ' + decision.tier
+                + ', provider ' + (decision.provider ?? 'none chosen'))
+            : 'the delegation returned without acceptance; stop reason ' + (result.stopReason ?? 'none reported')
+              + (result.success === false ? ' (the child itself reported success:false)' : ''),
     })
 
     // T35: report the mode that ACTUALLY ran, not the one that was asked for. A