@xema/omni-protocol 0.1.57 → 0.1.58

package/dist/testing.js

@@ -784,6 +784,17 @@ export class TaskStream {
         const known = id === undefined ? undefined : this.tasks.get(id);
         switch (event.type) {
             case "snapshot":
+                // A snapshot replaces what is known, and still may not say a task lost terms it had read.
+                if (isRecord(event.snapshot) && Array.isArray(event.snapshot.tasks)) {
+                    event.snapshot.tasks.forEach((task, index) => {
+                        if (!isRecord(task) || typeof task.id !== "string")
+                            return;
+                        const was = this.tasks.get(task.id);
+                        if (was !== undefined && (was.source === "queue" || was.source === "ungoverned") && task.capabilitySource === "undetermined") {
+                            refuse("stream.snapshot.capabilitySource", `${at}.snapshot.tasks[${index}].capabilitySource`, `${task.id} was published under ${was.source} terms and the snapshot says undetermined: terms once read stay read`);
+                        }
+                    });
+                }
                 this.seed(event.snapshot);
                 break;
             case "task-offered":

package/guide.md

@@ -2728,7 +2728,8 @@ the terms arrive, the task is republished under `queue` with the set as it now s
 republish as any other permission that changed while the task was open. The move goes one way.
 Terms once read stay read: a re-read that fails mid-task is not a new fact about the task, so the
 last statement stands and the failure is a `diagnostic`, and a task that was published under
-`queue` or `ungoverned` never returns to `undetermined` (`stream.taskUpdated.capabilitySource`).
+`queue` or `ungoverned` never returns to `undetermined`, on an update (`stream.taskUpdated.capabilitySource`)
+or on a resync snapshot (`stream.snapshot.capabilitySource`).
 
 What the agent is told differs by source, and only one source tells them anything. Under `queue`
 and `ungoverned` the agent sees controls and nothing about where they came from: both are facts,
@@ -2736,8 +2737,16 @@ and an agent working a call has no use for the name of the rule behind its butto
 `undetermined` the agent is told, beside the controls, that these are what the provider will honour
 until the queue's terms arrive, and that the controls may change when they do -- a statement about
 the buttons in front of them now, not about the provider, because that is what changes when the
-republish lands. The two words are close in English and far apart on the desk: `ungoverned` is
-silence, `undetermined` is a notice. `exerciseAdapter` treats a
+republish lands. It stays for as long as the set is provisional, beside the controls it qualifies;
+a message that shows and clears has said nothing about the buttons still on the screen. The two
+words are close in English and far apart on the desk: `ungoverned` is silence, `undetermined` is a
+standing notice.
+
+One consequence for whoever builds the host: because a conformance run fails on `undetermined`, a
+conformant adapter never shows a host `undetermined` under test, and a clean `exerciseAdapter`
+result says nothing about how the host renders it. That rendering is tested against a fixture --
+a task published under `undetermined` shows the notice, the same task under `queue` shows none --
+and never against an adapter, even in principle. `exerciseAdapter` treats a
 task published under `undetermined` as a violation (`capabilitySource.undetermined`), as it treats
 a diagnostic: a conformance run against a platform that cannot say what it permits fails loudly
 rather than passing with a note.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xema/omni-protocol",
-  "version": "0.1.57",
+  "version": "0.1.58",
   "description": "The Omni protocol: the contract every provider adapter implements",
   "type": "module",
   "license": "MIT",