loopforge 3.9.2 → 4.0.7

package/dist/round-coordinator.js

@@ -17,27 +17,37 @@
  * Persistence is owned by round-transaction.ts so reject paths remain
  * side-effect free and accepted decisions can be replayed idempotently.
  */
-import { queryLoopEntries } from "./loop-store.js";
-import { CHECK_SUCCESS_WITHOUT_VERIFIED_EVIDENCE, collectOutOfScopeFiles, roundDriftFiles, verifySelfEvaluation, } from "./verification-gate.js";
-import { entryRound, isRecord } from "./token-utils.js";
+import { emptyCommittedHistory, historyWindow, loadCommittedHistory, } from "./history.js";
+import { CHECK_SUCCESS_WITHOUT_VERIFIED_EVIDENCE, verifySelfEvaluation, } from "./verification-gate.js";
+import { checkpointForRoundBoundary, deriveRecoveryDirective, validateCheckpointManifest, } from "./recovery.js";
 import { driftedEntrypoints } from "./evidence-provider.js";
-import { declaresBlocked, effectiveOutcome, effectiveSuccess } from "./self-eval.js";
-import { derivationRounds, decodeCommittedRound, inFlightGitMotion } from "./committed-round.js";
-import { makeRoundId } from "./round-transaction.js";
-import { enforceRound, buildRejectionPrompt, findSafeRestorePoint, buildBacktrackPrompt, findBacktrackTargetSnapshot, } from "./enforcement-gate.js";
+import { declaresBlocked, effectiveOutcome, effectiveSuccess, } from "./round-outcome.js";
+import { deriveRoundProgress, } from "./progress.js";
+import { enforceRound, buildRejectionPrompt, findSafeRestorePoint, } from "./enforcement-gate.js";
 import { logEvent } from "./observability.js";
 import { getPolicy } from "./policy.js";
-import { deriveRoundContractView } from "./round-contract.js";
-import { roundVerificationStatus, } from "./contract-items.js";
-/** v3.2/v3.6: Whether a round's success enters the success trajectory.
- *  Excluded when the gate contradicted the round, or when the success claim
- *  carries no machine-verified observation — the merged R8 check fires a
- *  warn under machine_backed_success "warn" (v3.6: success_unverified merged
- *  into R8; its warn-level trajectory exclusion moved with it) — an
- *  accepted-but-unverified round is not evidence of progress. */
-function shouldPushSuccess(gateContradicted, verificationFlags, contractStatuses) {
+import { deriveRoundFacts } from "./round-facts.js";
+import { deriveEvidencePosture, rollbackEvidencePosture, } from "./evidence-posture.js";
+import { deriveFilesReconciliation } from "./files-reconciliation.js";
+/** v3.2/v3.6/v4.0.3: Whether a round's success enters the success
+ *  trajectory.
+ *
+ *  The trajectory counts MACHINE-BACKED success only: the Agent must
+ *  effectively claim success AND the verification gate must have found a
+ *  passed, untampered after command (`machineBackedSuccess`). A partial or
+ *  blocked outcome, an unbacked success claim, a contradicted gate, a
+ *  redirect round and an unverified contract item all keep the round out.
+ *  This does not change `completed` — it only keeps progress metrics honest. */
+function shouldPushSuccess(selfEval, gateContradicted, verificationFlags, machineBackedSuccess, contractStatuses) {
+    if (!effectiveSuccess(selfEval))
+        return false;
+    if (!machineBackedSuccess)
+        return false;
     if (gateContradicted)
         return false;
+    // v3.9.9: a redirect round abandons a slice; it is never success evidence.
+    if (contractStatuses?.closure === "superseded")
+        return false;
     // v3.8: an unverified contract item (or a claimed-but-unbacked success)
     // keeps the round out of the success trajectory — an accepted-but-unverified
     // round is not evidence of progress.
@@ -69,120 +79,48 @@ function shouldPushSuccess(gateContradicted, verificationFlags, contractStatuses
 export function finalizeStopReason(
 /** `undefined` when the disposition named no terminal reason at all (the
  *  callers fall back to their own default) — there is nothing to guard. */
-reason, selfEval, contractStatuses) {
+reason, selfEval, contractStatuses,
+/** v3.9.9/v4.0.6: the current round's redirect. A committed redirect can
+ *  never produce `completed` even if the old items were all verified. */
+redirect) {
     if (reason !== "completed")
         return { reason, flags: [] };
     const declared = declaresBlocked(selfEval);
     const blockedContract = contractStatuses?.closure === "blocked";
-    if (!declared && !blockedContract)
-        return { reason, flags: [] };
-    return {
-        reason: "blocked",
-        flags: [{
-                severity: "warn",
-                field: declared ? "outcome" : "round_contract",
-                check: "completion_truth_downgraded",
-                detail: declared
-                    ? "The round declared a blocked outcome but the stop decision produced " +
-                        "`completed`; the declaration wins and the stop reason was downgraded " +
-                        "to `blocked`."
-                    : "The active contract closed on a blocked outcome but the stop decision " +
-                        "produced `completed`; the stop reason was downgraded to `blocked`.",
-            }],
-    };
-}
-// ── RoundCoordinator ───────────────────────────────────────────────────────
-/** v3.8.1: The rolled-back branch's facts — the ONE derivation of which rounds
- *  failed, which approaches must not be repeated, which assumptions were
- *  falsified, and which files (with their failed-round git fingerprints) the
- *  agent must restore.
- *
- *  Sources are COMMITTED rounds above the restore point; rejected attempts are
- *  not durable history and never become a source. The in-flight attempt that
- *  triggered the rollback is the one exception — its evaluation lives in this
- *  process, not in committed history.
- *
- *  Extracted from the coordinator's inline walk so it is unit-testable without
- *  driving a whole rollback, and so the prompt, the state file and the
- *  committed decision all describe one event. */
-export function deriveBacktrackRecoveryFacts(input) {
-    const { currentRound, restoreRound, vaultEntries, selfEval } = input;
-    // v2.13: files changed in skipped rounds, for the restore prompt.
-    const skippedFiles = [];
-    // M3 (v3.7.x): each skipped file's git fingerprint at its failed round.
-    // Recorded from the round's own after-evidence (machine data, not the
-    // agent's report); later rounds overwrite earlier ones so the map holds the
-    // LAST failed state of every file.
-    const skippedFingerprints = {};
-    const failedRounds = [];
-    const approaches = [];
-    const wrongAssumptions = [];
-    for (let r = restoreRound + 1; r < currentRound; r++) {
-        // v3.2.1: match the feedback entry (execution_report lives there) — the
-        // compile-time lineage entry for the same round precedes it in the flat
-        // view and carries no evidence.
-        const entry = vaultEntries.find((e) => entryRound(e) === r && e.task_type !== "loop_lineage");
-        const view = entry ? decodeCommittedRound(entry) : null;
-        const evaluation = view?.evaluation ?? null;
-        if (entry?.execution_report) {
-            const ev = entry.execution_report;
-            const reported = Array.isArray(ev.files_changed)
-                ? ev.files_changed.filter((f) => typeof f === "string")
-                : [];
-            // v3.9.1: the machine delta is the primary set of files the failed
-            // round changed; the agent report is unioned in so an ignored file the
-            // agent named is not lost from the recovery brief.
-            const machineFiles = (view?.observationDelta ?? [])
-                .filter((delta) => delta.kind === "git" && delta.changedFiles !== null)
-                .flatMap((delta) => delta.changedFiles);
-            const files = [...new Set([...machineFiles, ...reported])];
-            const git = view?.afterEvidence.find((snapshot) => snapshot.kind === "git" &&
-                snapshot.status === "observed" &&
-                isRecord(snapshot.data.fingerprints));
-            const gitFingerprints = git && git.kind === "git"
-                ? git.data.fingerprints
-                : null;
-            for (const f of files) {
-                if (!skippedFiles.includes(f))
-                    skippedFiles.push(f);
-                const fp = gitFingerprints?.[f];
-                if (typeof fp === "string")
-                    skippedFingerprints[f] = fp;
-            }
-        }
-        const summary = evaluation?.output_summary ?? "";
-        if (summary.trim().length > 0) {
-            failedRounds.push(r);
-            approaches.push(summary.trim().slice(0, 200));
-        }
-        const assumptions = (evaluation?.wrong_assumptions ?? [])
-            .filter((v) => typeof v === "string")
-            .map((s) => s.slice(0, 500));
-        for (const a of assumptions) {
-            if (!wrongAssumptions.includes(a))
-                wrongAssumptions.push(a);
-        }
+    if (declared || blockedContract) {
+        return {
+            reason: "blocked",
+            flags: [{
+                    severity: "warn",
+                    field: declared ? "outcome" : "round_contract",
+                    check: "completion_truth_downgraded",
+                    detail: declared
+                        ? "The round declared a blocked outcome but the stop decision produced " +
+                            "`completed`; the declaration wins and the stop reason was downgraded " +
+                            "to `blocked`."
+                        : "The active contract closed on a blocked outcome but the stop decision " +
+                            "produced `completed`; the stop reason was downgraded to `blocked`.",
+                }],
+        };
     }
-    // The in-flight attempt that triggered this rollback.
-    const triggerSummary = selfEval.output_summary?.trim() ?? "";
-    if (triggerSummary.length > 0) {
-        if (!failedRounds.includes(currentRound))
-            failedRounds.push(currentRound);
-        approaches.push(triggerSummary.slice(0, 200));
-        for (const a of (selfEval.wrong_assumptions ?? [])
-            .filter((v) => typeof v === "string")) {
-            if (!wrongAssumptions.includes(a))
-                wrongAssumptions.push(a.slice(0, 500));
-        }
+    const superseded = contractStatuses?.closure === "superseded" ||
+        Boolean(redirect);
+    if (superseded) {
+        return {
+            reason: "incomplete",
+            flags: [{
+                    severity: "warn",
+                    field: "round_contract.supersedes",
+                    check: "completion_truth_downgraded",
+                    detail: "The round superseded its active contract, so the old slice is not " +
+                        "verified and the round cannot be `completed`; the stop reason was " +
+                        "downgraded to `incomplete`.",
+                }],
+        };
     }
-    return {
-        skippedFiles,
-        skippedFingerprints,
-        failedRounds,
-        approaches,
-        wrongAssumptions,
-    };
+    return { reason, flags: [] };
 }
+// ── RoundCoordinator ───────────────────────────────────────────────────────
 export class RoundCoordinator {
     store;
     constructor(store) {
@@ -199,72 +137,97 @@ export class RoundCoordinator {
      *  - Transactional feedback commit (accepted rounds only)
      *  - State file I/O (both paths, after compiling) */
     processRound(input) {
-        const { loopId, task, currentRound, maxRounds, selfEval, lastSelfEval, consecutiveRejections, evidenceDeltas, } = input;
-        const roundSuccess = selfEval.success ?? false;
-        // ── 1. Query vault entries ──────────────────────────────────────────
-        // Lineage entries (constraint violations, output summaries) and feedback
-        // entries (including execution_report) are both needed by
-        // the enforcement gate. queryLoopEntries excludes feedback by default,
-        // so we issue a second query and merge both result sets.
-        const prefix = `loop:${loopId}:r`;
-        const vaultEntries = this.store
-            ? [
-                ...queryLoopEntries(this.store, loopId, { prefix }),
-                ...queryLoopEntries(this.store, loopId, { prefix, feedbackOnly: true }),
-            ]
-            : [];
+        const { loopId, task, currentRound, maxRounds, selfEval, consecutiveRejections, evidenceDeltas, } = input;
+        const agentSuccessClaim = effectiveSuccess(selfEval);
+        const agentOutcome = effectiveOutcome(selfEval);
+        // ── 1. Load committed history once ──────────────────────────────────
+        // The verification gate and the contract reducer read the same flat entry
+        // view and the same committed window; one store read serves both. The
+        // advance path passes the history it already loaded for its own
+        // pre-commit facts.
+        const history = input.history ?? (this.store
+            ? loadCommittedHistory(this.store, loopId)
+            : emptyCommittedHistory(loopId));
+        const vaultEntries = history.entries;
+        // v3.9.6: the previous evaluation is the last committed branch round,
+        // never a session copy.
+        const committedRounds = historyWindow(history, currentRound);
+        const previousCommitted = committedRounds.length > 0
+            ? committedRounds[committedRounds.length - 1].evaluation
+            : null;
         // ── 2. Verification gate ────────────────────────────────────────────
-        const verifyResult = verifySelfEvaluation(selfEval, currentRound, vaultEntries, lastSelfEval ?? null, evidenceDeltas ?? [], input.backtrackSkippedFiles ?? [], input.backtrackSkippedFingerprints ?? {}, input.backtrackTargetGitHead,
+        // v3.9.7: the old post-backtrack restore checks/R9 are gone. LoopForge
+        // verifies the restore before issuing the redo prompt; a redo submission
+        // is ordinary work, so its after boundary must never be compared to the
+        // restore target.
+        // v4.0.3: ONE RoundFacts derivation for this round. The verification
+        // gate, the stop decision, the success trajectory and the evidence
+        // posture all consume this bundle; none derives the contract again.
+        const commands = getPolicy().evidence.commands ?? [];
+        const roundFacts = deriveRoundFacts({
+            rounds: committedRounds,
+            currentRound,
+            inFlight: {
+                currentReport: selfEval.execution_report ?? null,
+                currentDeltas: evidenceDeltas ?? [],
+                currentBlocked: declaresBlocked(selfEval),
+                currentRedirect: selfEval.round_contract?.supersedes ?? null,
+            },
+            commands,
+        });
+        const verifyResult = verifySelfEvaluation(selfEval, currentRound, vaultEntries, previousCommitted, evidenceDeltas ?? [],
         // v3.7.1: gate records live under the gate: prefix — outside the round
         // entries above — and are passed separately to the gate check.
-        this.store
-            ? queryLoopEntries(this.store, loopId, { prefix: `loop:${loopId}:gate:` })
-            : [],
+        history.entries.filter((entry) => String(entry.task_id ?? "").startsWith(`loop:${loopId}:gate:`)),
         // v3.8.3: the absolute arm of the entrypoint check. Derived here, not in
         // the gate, because it needs the filesystem and the in-flight trust map
         // captured when this round was prepared — the gate stays a pure function
         // of its inputs.
-        driftedEntrypoints(input.entrypointTrust), input.beforeEvidence ?? [],
-        // v3.9: the restore point's own dirty files — the baseline the restored
-        // workspace is compared against.
-        input.backtrackTargetDirty);
+        driftedEntrypoints(input.entrypointTrust),
+        // v3.9.4: the SAME manifest basis the receipt uses. An omitted
+        // files_changed field is not silently treated as "a report exists".
+        input.submittedFields
+            ? input.submittedFields.includes("execution_report.files_changed")
+            : undefined,
+        // v4.0.3: the one derivation, computed above. Passing it removes the
+        // gate's private contract/item/claim derivation.
+        roundFacts, maxRounds);
         const verificationFlags = verifyResult.flags;
         const gateContradicted = verifyResult.verdict === "contradicted";
-        // v3.8: the ACTIVE contract's derived item statuses for this round — the
-        // same reducer the gate, compile path, audit and explain consume. Drives
-        // the stop mapping (completed vs incomplete) and the success trajectory.
-        const committedRounds = derivationRounds(vaultEntries, currentRound);
-        // v3.8: the shared executed-contract derivation — the same one explain and
-        // audit call, so the live posture and the read-only views cannot diverge.
-        const { contract: activeContract, statuses: activeContractStatuses } = deriveRoundContractView({
-            rounds: committedRounds,
+        const { activeContract, itemStatuses: activeContractStatuses } = roundFacts;
+        // v4.0.3: the evidence posture is derived ONCE here, from the same raw
+        // facts every other branch reads. It is persisted with an accepted round;
+        // a rejected/terminated attempt carries only the transient copy.
+        const verificationConfigured = commands.some((command) => command.enabled === true &&
+            (command.phase === "after" || command.phase === "both"));
+        const filesReconciliation = deriveFilesReconciliation(selfEval.execution_report ?? null, evidenceDeltas ?? [], input.submittedFields
+            ? {
+                attempted: input.submittedFields.includes("execution_report.files_changed"),
+            }
+            : {});
+        const evaluationPosture = deriveEvidencePosture({
             round: currentRound,
-            report: selfEval.execution_report ?? null,
-            deltas: evidenceDeltas ?? [],
-            outcome: effectiveOutcome(selfEval),
-            commands: getPolicy().evidence.commands ?? [],
+            kind: "evaluation",
+            selfEval,
+            afterEvidence: input.afterEvidence ?? [],
+            evidenceDeltas: evidenceDeltas ?? [],
+            verificationFlags,
+            machineBackedSuccess: verifyResult.machineBackedSuccess,
+            activeContract,
+            contractStatuses: activeContractStatuses,
+            verificationConfigured,
+            filesReconciliation,
+        });
+        const evaluationResult = (result) => ({
+            ...result,
+            evidencePosture: evaluationPosture,
+            agentOutcome,
+        });
+        const rollbackResult = (result) => ({
+            ...result,
+            evidencePosture: rollbackEvidencePosture(currentRound),
+            agentOutcome: null,
         });
-        // v3.8.3: the legal exit from scope drift — a round that declares itself
-        // blocked may switch contracts, but only by declaring a proposal whose
-        // scope covers EVERY file it changed out of scope. Computed here because
-        // this is the only place where the round's git delta, the active
-        // contract's scope and the submitted proposal are all in reach; the
-        // enforcement gate receives the verdict, not the inputs.
-        //
-        // `selfEval.round_contract` is already the parsed proposal (buildSelfEvaluation
-        // runs parseRoundContract), so the coverage test reads the same object the
-        // commit path will read back.
-        //
-        // The coverage requirement is what keeps this from being a universal
-        // escape: without it "declare blocked" would dissolve a machine fact
-        // without declaring anything. The drift FLAG is untouched — it still lands
-        // on the committed round, so audit/explain keep reporting it.
-        const driftedFiles = roundDriftFiles(activeContract, evidenceDeltas ?? []);
-        const proposal = selfEval.round_contract;
-        const scopeDriftWaiver = driftedFiles !== null && driftedFiles.length > 0 &&
-            declaresBlocked(selfEval) &&
-            proposal !== undefined &&
-            collectOutOfScopeFiles(driftedFiles, proposal.scope).length === 0;
         if (gateContradicted) {
             logEvent("gate_contradicted", {
                 loopId,
@@ -278,11 +241,11 @@ export class RoundCoordinator {
         // transaction reaches enforcement with a fully extracted self-evaluation.
         // The old v2.5 "heuristic partial enforcement" plumbing (extractionSucceeded
         // flag, enforcement skipEvidenceRules mode) was removed as unreachable.
-        const enforceResult = enforceRound(selfEval, verifyResult, currentRound, vaultEntries, consecutiveRejections, input.lastRejectionCheck ?? "", scopeDriftWaiver,
-        // v3.9: what THIS round moved, from the same Git motion rule the
-        // committed series uses. Unknown motion stays null — an unobservable
-        // round never gains the stall excuse.
-        inFlightGitMotion(evidenceDeltas ?? [], input.backtrackTargetGitHead));
+        const enforceResult = enforceRound(selfEval, verifyResult, currentRound, vaultEntries, consecutiveRejections, input.lastRejectionCheck ?? "",
+        // v3.9.9: what THIS round moved, under the SAME Git workspace selector
+        // the committed window uses. Unknown/not_applicable never gains the
+        // stall excuse, and no other provider's fact can change this verdict.
+        deriveRoundProgress(evidenceDeltas ?? []));
         if (enforceResult.action === "reject") {
             const newRejections = consecutiveRejections + 1;
             const rejectionPrompt = buildRejectionPrompt(currentRound, task, enforceResult, verificationFlags);
@@ -293,21 +256,18 @@ export class RoundCoordinator {
                 check: enforceResult.check ?? "",
                 consecutiveRejections: newRejections,
             });
-            return {
+            return evaluationResult({
                 action: "reject",
-                verificationStatus: roundVerificationStatus(activeContractStatuses, selfEval.execution_report ?? null),
                 rejectionPrompt,
                 verificationFlags,
                 enforcementAction: "reject",
                 enforcementReason: enforceResult.reason,
                 rejectionCheck: enforceResult.check,
-                roundSuccess,
+                agentSuccessClaim,
                 gateContradicted,
                 newConsecutiveRejections: newRejections,
-                // Don't update lastSelfEval on reject — the agent redoes the same round
-                newLastSelfEval: undefined,
                 shouldPushSuccessTrajectory: false,
-            };
+            });
         }
         if (enforceResult.action === "terminate") {
             // v3.8: a row may name the stop reason it terminates with (the
@@ -319,100 +279,129 @@ export class RoundCoordinator {
                 stopReason: terminateReason,
                 round: currentRound,
             });
-            return {
+            return evaluationResult({
                 action: "terminate",
-                verificationStatus: roundVerificationStatus(activeContractStatuses, selfEval.execution_report ?? null),
                 stopReason: terminateReason,
                 verificationFlags,
                 enforcementAction: "terminate",
                 enforcementReason: enforceResult.reason,
                 rejectionCheck: enforceResult.check,
-                roundSuccess,
+                agentSuccessClaim,
                 gateContradicted,
                 newConsecutiveRejections: 0,
-                newLastSelfEval: selfEval,
                 shouldPushSuccessTrajectory: false,
-            };
+            });
         }
-        // ── v2.10: Backtrack ──────────────────────────────────────────────────
+        // ── v2.10 / v3.9.7: Backtrack ─────────────────────────────────────────
         if (enforceResult.action === "backtrack") {
             const maxDepth = getPolicy().engine.backtrack_max_depth;
-            const restorePoint = findSafeRestorePoint(currentRound, vaultEntries, maxDepth);
+            // The state after round T is the before-image of round T+1. A candidate
+            // is eligible only when that image was materialized and its manifest is
+            // readable; there is no verification-only fallback.
+            const resolveRef = (restoreRound) => {
+                const redoRound = restoreRound + 1;
+                const ref = checkpointForRoundBoundary({
+                    entries: vaultEntries,
+                    heldRound: currentRound,
+                    heldBeforeCheckpoint: input.beforeCheckpoint,
+                    redoRound,
+                });
+                if (!ref)
+                    return null;
+                if (input.resolveCheckpointManifest) {
+                    const manifest = input.resolveCheckpointManifest(ref);
+                    // Machine target selection must prove the ref and manifest are
+                    // self-consistent BEFORE committing an immutable directive. Blob
+                    // and HEAD checks still run in the post-commit preflight.
+                    if (!manifest || !validateCheckpointManifest(ref, manifest).ok) {
+                        return null;
+                    }
+                }
+                return ref;
+            };
+            const restorePoint = findSafeRestorePoint(currentRound, vaultEntries, maxDepth, (restoreRound) => resolveRef(restoreRound) !== null);
             if (!restorePoint) {
-                // No clean round found within maxDepth — fall through to terminate
+                // No clean round with a materialized restore point within maxDepth.
+                logEvent("session_end", {
+                    loopId,
+                    stopReason: "enforcement_terminated",
+                    round: currentRound,
+                });
+                return evaluationResult({
+                    action: "terminate",
+                    stopReason: "enforcement_terminated",
+                    verificationFlags,
+                    enforcementAction: "terminate",
+                    enforcementReason: `${enforceResult.reason} (backtrack failed: no materialized restore point within ${maxDepth} rounds)`,
+                    rejectionCheck: enforceResult.check,
+                    agentSuccessClaim,
+                    gateContradicted,
+                    newConsecutiveRejections: 0,
+                    shouldPushSuccessTrajectory: false,
+                });
+            }
+            const targetRef = resolveRef(restorePoint.round);
+            const targetManifest = targetRef && input.resolveCheckpointManifest
+                ? input.resolveCheckpointManifest(targetRef)
+                : null;
+            if (!targetRef || !targetManifest) {
                 logEvent("session_end", {
                     loopId,
                     stopReason: "enforcement_terminated",
                     round: currentRound,
                 });
-                return {
+                return evaluationResult({
                     action: "terminate",
-                    verificationStatus: roundVerificationStatus(activeContractStatuses, selfEval.execution_report ?? null),
                     stopReason: "enforcement_terminated",
                     verificationFlags,
                     enforcementAction: "terminate",
-                    enforcementReason: `${enforceResult.reason} (backtrack failed: no clean restore point within ${maxDepth} rounds)`,
+                    enforcementReason: `${enforceResult.reason} (backtrack failed: restore point manifest unavailable)`,
                     rejectionCheck: enforceResult.check,
-                    roundSuccess,
+                    agentSuccessClaim,
                     gateContradicted,
                     newConsecutiveRejections: 0,
-                    newLastSelfEval: selfEval,
                     shouldPushSuccessTrajectory: false,
-                };
+                });
             }
-            // v2.13/v3.8.1: the rolled-back branch's facts — one named derivation,
-            // so the walk is testable without driving a whole rollback, and the
-            // prompt, the state file and the committed decision all describe one
-            // event.
-            const { skippedFiles, skippedFingerprints, failedRounds, approaches, wrongAssumptions, } = deriveBacktrackRecoveryFacts({
-                currentRound,
-                restoreRound: restorePoint.round,
-                vaultEntries,
-                selfEval,
+            const abandonedRounds = committedRounds
+                .filter((view) => view.round >= targetRef.redoRound);
+            const recovery = deriveRecoveryDirective({
+                origin: "machine",
+                reason: enforceResult.reason,
+                ...(enforceResult.check ? { triggerRule: enforceResult.check } : {}),
+                // The transaction layer fills the directive transaction id, which
+                // depends on the prompt hash/branch identity.
+                transactionId: "",
+                targetRef,
+                targetManifest,
+                abandonedRounds,
+                currentAfterEvidence: input.afterEvidence ?? [],
+                triggerEvaluation: selfEval,
+                triggerRound: currentRound,
+                triggerFindings: verificationFlags,
             });
-            // v2.12: Capture the restore point's machine snapshot — the commit the
-            // workspace must return to and what was already dirty there — so the
-            // next round's verification can confirm the workspace returned to this
-            // point without reading unrelated work in progress as a failed restore.
-            const targetSnapshot = findBacktrackTargetSnapshot(restorePoint.round, vaultEntries);
-            const targetGitHead = targetSnapshot?.head ?? null;
-            const backtrackPrompt = buildBacktrackPrompt(currentRound, restorePoint.round, enforceResult.check ?? "progress_stall", getPolicy().engine.backtrack_preserve_discoveries
-                ? restorePoint.skippedDiscoveries
-                : [], skippedFiles, targetGitHead ?? undefined, makeRoundId(loopId, restorePoint.round + 1), { failedRounds, approaches, wrongAssumptions });
             logEvent("enforcement_backtrack", {
                 loopId,
                 round: currentRound,
                 reason: enforceResult.reason.slice(0, 120),
                 check: enforceResult.check ?? "",
-                backtrackTarget: restorePoint.round,
-                skippedDiscoveries: restorePoint.skippedDiscoveries.length,
+                backtrackTarget: targetRef.redoRound,
+                skippedDiscoveries: recovery.skipped_discoveries.length,
             });
-            return {
+            return rollbackResult({
                 action: "backtrack",
-                verificationStatus: roundVerificationStatus(activeContractStatuses, selfEval.execution_report ?? null),
-                backtrackPrompt,
-                backtrackTarget: restorePoint.round,
-                backtrackSkippedDiscoveries: getPolicy().engine.backtrack_preserve_discoveries
-                    ? restorePoint.skippedDiscoveries
-                    : [],
-                backtrackSkippedFiles: skippedFiles,
-                backtrackSkippedFingerprints: skippedFingerprints,
-                backtrackTargetGitHead: targetGitHead ?? undefined,
-                backtrackTargetDirty: targetSnapshot?.dirtyFiles,
-                backtrackTriggerRule: enforceResult.check,
-                backtrackFailedRounds: failedRounds,
-                backtrackApproaches: approaches,
-                backtrackWrongAssumptions: wrongAssumptions,
+                origin: "machine",
+                reason: enforceResult.reason,
+                recovery,
                 verificationFlags,
                 enforcementAction: "backtrack",
                 enforcementReason: enforceResult.reason,
                 rejectionCheck: enforceResult.check,
-                roundSuccess,
+                agentSuccessClaim,
                 gateContradicted,
                 newConsecutiveRejections: 0, // reset — fresh start
-                newLastSelfEval: undefined,
                 shouldPushSuccessTrajectory: false,
-            };
+            });
         }
         // Accept: reset rejection counter
         // (consecutiveRejections reset to 0 — caller persists)
@@ -432,24 +421,24 @@ export class RoundCoordinator {
             // the declaration arm below already owns that posture.
             const contractClosed = activeContractStatuses.contractId === "" ||
                 activeContractStatuses.closure === "verified";
-            // The agent's explicit declaration of a blocked stop outranks the
-            // success claim. It is checked FIRST so `success: true` + a declared
-            // `outcome`/`stop_reason` of blocked can never be reported as
-            // `completed` — the two fields contradict, and the honest reading is the
-            // declared one. A contradicted item also never reaches `completed`
-            // (closure is `verified` only when EVERY item is), so the
-            // contradicted-and-stopping posture lands on `incomplete` at worst; the
-            // reject/terminate path for it is the enforcement gate's, evaluated
-            // before this point.
+            // v4.0.6: the stop mapping reads ONE outcome field.
+            //   blocked                      → blocked
+            //   success + contract closed    → completed
+            //   success + open contract      → incomplete
+            //   partial                      → incomplete
+            //   failed                       → failed
+            // A contradicted item also never reaches `completed` (closure is
+            // `verified` only when EVERY item is); the reject/terminate path for it
+            // is the enforcement gate's, evaluated before this point.
             const declaredBlocked = declaresBlocked(selfEval);
             let reason;
             if (declaredBlocked) {
                 reason = "blocked";
             }
-            else if (effectiveSuccess(selfEval) && contractClosed) {
+            else if (agentOutcome === "success" && contractClosed) {
                 reason = "completed";
             }
-            else if (effectiveSuccess(selfEval)) {
+            else if (agentOutcome === "success" || agentOutcome === "partial") {
                 reason = "incomplete";
             }
             else {
@@ -459,50 +448,44 @@ export class RoundCoordinator {
             // is written into the committed round document below, so it must be
             // truthful at the moment it becomes a fact, not only when it is
             // returned to the client.
-            const finalized = finalizeStopReason(reason, selfEval, activeContractStatuses);
-            return {
+            const finalized = finalizeStopReason(reason, selfEval, activeContractStatuses, selfEval.round_contract?.supersedes ?? null);
+            return evaluationResult({
                 action: "stop",
-                verificationStatus: roundVerificationStatus(activeContractStatuses, selfEval.execution_report ?? null),
                 stopReason: finalized.reason,
                 verificationFlags: finalized.flags.length > 0
                     ? [...verificationFlags, ...finalized.flags]
                     : verificationFlags,
-                roundSuccess,
+                agentSuccessClaim,
                 gateContradicted,
                 newConsecutiveRejections: 0,
-                newLastSelfEval: selfEval,
-                shouldPushSuccessTrajectory: shouldPushSuccess(gateContradicted, verificationFlags, activeContractStatuses),
-            };
+                shouldPushSuccessTrajectory: shouldPushSuccess(selfEval, gateContradicted, verificationFlags, verifyResult.machineBackedSuccess, activeContractStatuses),
+            });
         }
         // 5c. Max rounds reached
         //
         // Progress stalls are handled before this point by the R4 delta tier and
         // R5 flatline tier. Max rounds is an independent hard boundary.
         if (currentRound >= maxRounds) {
-            return {
+            return evaluationResult({
                 action: "stop",
-                verificationStatus: roundVerificationStatus(activeContractStatuses, selfEval.execution_report ?? null),
                 stopReason: "max_rounds",
                 verificationFlags,
-                roundSuccess,
+                agentSuccessClaim,
                 gateContradicted,
                 newConsecutiveRejections: 0,
-                newLastSelfEval: selfEval,
-                shouldPushSuccessTrajectory: shouldPushSuccess(gateContradicted, verificationFlags, activeContractStatuses),
-            };
+                shouldPushSuccessTrajectory: shouldPushSuccess(selfEval, gateContradicted, verificationFlags, verifyResult.machineBackedSuccess, activeContractStatuses),
+            });
         }
         // ── 6. Continue — caller compiles next round ────────────────────────
-        return {
+        return evaluationResult({
             action: "continue",
-            verificationStatus: roundVerificationStatus(activeContractStatuses, selfEval.execution_report ?? null),
             verificationFlags,
             enforcementAction: "accept",
-            roundSuccess,
+            agentSuccessClaim,
             gateContradicted,
             newConsecutiveRejections: 0,
-            newLastSelfEval: selfEval,
-            shouldPushSuccessTrajectory: shouldPushSuccess(gateContradicted, verificationFlags, activeContractStatuses),
-        };
+            shouldPushSuccessTrajectory: shouldPushSuccess(selfEval, gateContradicted, verificationFlags, verifyResult.machineBackedSuccess, activeContractStatuses),
+        });
     }
 }
 //# sourceMappingURL=round-coordinator.js.map