start-command 0.42.0 → 0.44.0

package/src/lib/formal-ai.js

@@ -9,6 +9,11 @@
  * protocol error or cancellation stops it, and the exit status says which.
  * A final answer that is a known capability gap (issue #258) is reported as
  * incomplete with its obligations, never as an answer.
+ *
+ * A failed change stays unresolved until the same typed tool changes the same
+ * target and its readback is verified (issue #261): a later read, a copy over
+ * the file or Formal AI's final answer does not resolve it, and the run then
+ * ends `incomplete` with the original failure and its exit status.
  */
 
 const policy = require('./formal-ai-policy');
@@ -74,12 +79,21 @@ async function runFormalAiTask(options) {
     observedDirs: new Set(),
     contents: new Map(),
   };
+  // Failed calls whose obligation no later verified call met (#261).
+  const unresolved = [];
   const finish = (status, exitCode, message, remaining = [], extra = {}) => {
+    const open = unresolved.map(failureObligation);
     evidence.outcome = {
       status,
       exitCode,
       message,
-      remainingObligations: remaining,
+      remainingObligations: [
+        ...remaining,
+        ...open.filter((item) => !remaining.includes(item)),
+      ],
+      ...(unresolved.length
+        ? { failures: unresolved.map((f) => ({ ...f })) }
+        : {}),
       ...extra,
     };
     return evidence;
@@ -152,11 +166,29 @@ async function runFormalAiTask(options) {
         return finish(
           'capability-gap',
           EXIT.UNSUPPORTED,
-          describeGap(gap),
+          describeGap(gap, evidence.effects),
           gapObligations(gap, bounds.effects),
           { gap }
         );
       }
+      if (unresolved.length) {
+        const [first] = unresolved;
+        return finish(
+          'incomplete',
+          first.exitCode || 1,
+          `\`${first.command}\` failed (${first.error}) and no later call resolved it; ${describeEffects(evidence.effects)}`
+        );
+      }
+      const record = unrecognizedGapRecord(response.content, messages);
+      if (record) {
+        return finish(
+          'incomplete',
+          EXIT.UNSUPPORTED,
+          `Formal AI reported ${record.schema}${record.reason ? ` (${record.reason})` : ''}${record.target ? ` for ${record.target}` : ''}${record.clause ? ` for the clause ${JSON.stringify(record.clause)}` : ''}; nothing was verified as done by Formal AI; ${describeEffects(evidence.effects)}`,
+          ['Formal AI did not confirm the requested change'],
+          { gapRecord: record }
+        );
+      }
       if (response.handler === 'unknown' && toolCalls === 0) {
         return finish(
           'unsupported',
@@ -218,6 +250,7 @@ async function runFormalAiTask(options) {
         note,
         evidence,
       });
+      trackFailures(unresolved, evidence.steps[evidence.steps.length - 1]);
       if (signal && signal.aborted) {
         return cancelled();
       }
@@ -240,12 +273,138 @@ async function runFormalAiTask(options) {
   );
 }
 
-/** Capability gap, in words. */
-function describeGap(gap) {
+/**
+ * Keep the failed calls of a run until a later call meets their obligation
+ * (issue #261). A failed edit or write is resolved only by a verified edit or
+ * write of the same target (a write also resolves a failed read of the file
+ * it created); a failed read by a read of the same target; a failed write
+ * command only by the same command succeeding. A copy or move over the target
+ * never counts as the edit.
+ */
+function trackFailures(unresolved, step) {
+  if (!step || step.kind !== 'tool' || step.decision !== 'allowed') {
+    return;
+  }
+  const typed = step.tool !== undefined;
+  const changed = typed && step.tool !== 'read';
+  if (step.exitCode !== 0 && (typed || step.effect === 'write')) {
+    unresolved.push({
+      command: step.command,
+      ...(typed ? { tool: step.tool, target: step.target } : {}),
+      exitCode: step.exitCode ?? 1,
+      error:
+        step.error ||
+        (step.signal
+          ? `stopped by ${step.signal}`
+          : `exited with ${step.exitCode}`),
+    });
+    return;
+  }
+  if (step.exitCode !== 0) {
+    return;
+  }
+  const verified = changed && step.verification && step.verification.verified;
+  for (let index = unresolved.length - 1; index >= 0; index--) {
+    const failure = unresolved[index];
+    const resolved = typed
+      ? failure.target === step.target &&
+        (failure.tool === 'read'
+          ? step.tool === 'read' || verified
+          : verified && (failure.tool === step.tool || step.tool === 'edit'))
+      : failure.tool === undefined && failure.command === step.command;
+    if (resolved) {
+      unresolved.splice(index, 1);
+    }
+  }
+}
+
+function failureObligation(failure) {
+  return `\`${failure.command}\` failed: ${failure.error}`;
+}
+
+/**
+ * A final answer that is exactly one Links Notation record whose record_type
+ * names a gap, as Formal AI's task obligations answer (`obligation_gap`, e.g.
+ * reason `no_artifact_in_clause`): an id line, then `  key "value"` lines.
+ * Returned in the JSON gap shape (schema = record_type, never complete), so
+ * a gap Formal AI states in its own notation is never taken as success, even
+ * when start verified every change it made (#261).
+ * @param {string} text - Trimmed final answer
+ * @returns {object|null} {schema, reason?, clause?, complete: false}
+ */
+function linoGapRecord(text) {
+  const [id, ...lines] = text.split('\n');
+  if (!/^[A-Za-z0-9_]+$/.test(id) || !lines.length) {
+    return null;
+  }
+  const fields = {};
+  for (const line of lines) {
+    const match = /^ {2}([a-z_]+) (?:"([^"]*)"|'([^']*)'|(\S+))$/.exec(line);
+    if (!match || Object.hasOwn(fields, match[1])) {
+      return null;
+    }
+    fields[match[1]] = match[2] ?? match[3] ?? match[4];
+  }
+  if (typeof fields.record_type !== 'string') {
+    return null;
+  }
+  return {
+    schema: fields.record_type,
+    ...(fields.reason ? { reason: fields.reason } : {}),
+    ...(fields.clause ? { clause: fields.clause } : {}),
+    complete: false,
+  };
+}
+
+/**
+ * A final answer that is a JSON record of a gap start does not know: it is
+ * never taken as success, though its schema grants no recognized gap.
+ */
+function unrecognizedGapRecord(content, messages) {
+  let value;
+  try {
+    value = JSON.parse(String(content || '').trim());
+  } catch {
+    value = linoGapRecord(String(content || '').trim());
+  }
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    Array.isArray(value) ||
+    typeof value.schema !== 'string' ||
+    !/gap/i.test(value.schema) ||
+    !(
+      value.verified === false ||
+      value.complete === false ||
+      value.completed === false
+    )
+  ) {
+    return null;
+  }
+  if (files.echoedByTool(String(content).trim(), messages)) {
+    return null;
+  }
+  return {
+    schema: value.schema,
+    ...(typeof value.target === 'string' ? { target: value.target } : {}),
+    ...(typeof value.reason === 'string' ? { reason: value.reason } : {}),
+    ...(typeof value.clause === 'string' ? { clause: value.clause } : {}),
+  };
+}
+
+/**
+ * Capability gap, in words. When tools changed the working directory, the
+ * message keeps what start observed: Formal AI's gap still means the task is
+ * not confirmed, whatever start verified on its own (#261).
+ */
+function describeGap(gap, effects) {
   const missing = gap.missingCapabilities.length
     ? `; missing ${gap.missingCapabilities.join(', ')}`
     : '';
-  return `Formal AI reported a capability gap for ${gap.target} (${gap.reason}${missing}); nothing was verified as done`;
+  const head = `Formal AI reported a capability gap for ${gap.target} (${gap.reason}${missing})`;
+  return effects && policy.hasEffects(effects)
+    ? `${head}; Formal AI did not confirm the task as done; start observed: ${describeEffects(effects)}`
+    : `${head}; nothing was verified as done`;
 }
 
 function gapObligations(gap, effects) {
@@ -331,6 +490,7 @@ function runFileToolCall({ call, context, cwd, bounds, io, note, evidence }) {
       ? { previousSha256: receipt.previousSha256 }
       : {}),
     ...(receipt.replacements ? { replacements: receipt.replacements } : {}),
+    ...(receipt.mutation ? { mutation: receipt.mutation } : {}),
   });
   recordEffects(step, diff, evidence);
   if (receipt.error) {
@@ -347,14 +507,17 @@ function runFileToolCall({ call, context, cwd, bounds, io, note, evidence }) {
         stop: [
           'unverified',
           EXIT.PROTOCOL,
-          `\`${call.command}\` wrote the file but ${receipt.verification.detail}`,
+          `\`${call.command}\` ran but ${receipt.verification.detail}`,
           ['the change could not be confirmed by readback'],
         ],
       };
     }
     note(receipt.verification.detail);
   }
-  return { exitCode: receipt.exitCode, result: receipt.result };
+  return {
+    exitCode: receipt.exitCode,
+    result: receipt.result,
+  };
 }
 
 /** Show what a read returned, like the stdout of `cat`, within the output cap. */

package/src/lib/log-sanitizer.js

@@ -12,6 +12,11 @@
  * `Authorization: <scheme> <value>` header, so a logged one-line JSON prompt
  * keeps the rest of its line (issue #249, sensitive-data-sanitizer#45); the
  * pre-pass that did this here is gone (issue #253).
+ *
+ * The package stays on ^0.14.0: 0.20.0 and later drop the bytes after a
+ * credential that is followed by a NUL byte (sensitive-data-sanitizer#180,
+ * the blocker in .github/dependency-blockers.json). The Rust installer and its
+ * version check require the same release (rust/src/lib/log_sanitizer.rs).
  */
 
 const fs = require('fs');

package/src/lib/query-commands.js

@@ -3,7 +3,8 @@
  *
  * Every option in this module addresses an execution that already exists in
  * the tracking store instead of launching a new one: --status, --list,
- * --upload-log, --stop, --terminate, --attach, --resume, --resume-all and
+ * --upload-log, --stop, --terminate, --pause, --unpause, --attach, --resume,
+ * --resume-all and
  * --cleanup, plus --alias and --rename. `dispatchQueryCommand` is the single
  * entry point the CLI calls before it starts interpreting the command line as
  * a command to run.
@@ -54,6 +55,28 @@ function handleControlQuery(store, identifier, action) {
   return reportResult(controlExecution(store, identifier, action));
 }
 
+/**
+ * Handle --pause / --unpause (issue #263).
+ * @param {?object} store - Execution store
+ * @param {string} identifier - UUID or session name
+ * @param {string} action - pause or unpause
+ * @param {object} [options] - {outputFormat, pauseReason, pausedBy}
+ * @returns {number} Exit code
+ */
+function handlePauseQuery(store, identifier, action, options = {}) {
+  const pause = require('./execution-pause');
+  const deps = {
+    outputFormat: options.outputFormat,
+    reason: options.pauseReason || null,
+    by: options.pausedBy || null,
+  };
+  return reportResult(
+    action === pause.PauseAction.PAUSE
+      ? pause.pauseExecution(store, identifier, deps)
+      : pause.unpauseExecution(store, identifier, deps)
+  );
+}
+
 function handleAttachQuery(store, identifier, readOnly) {
   return reportResult(attachExecution(store, identifier, { readOnly }));
 }
@@ -155,6 +178,8 @@ function hasQueryMode(options) {
     hasValue(options.uploadLog) ||
     hasValue(options.stop) ||
     hasValue(options.terminate) ||
+    hasValue(options.pause) ||
+    hasValue(options.unpause) ||
     hasValue(options.attach) ||
     hasValue(options.resume) ||
     options.resumeAll === true ||
@@ -193,6 +218,12 @@ async function dispatchQueryCommand(options, context = {}) {
       ControlAction.TERMINATE
     );
   }
+  if (hasValue(options.pause)) {
+    return handlePauseQuery(store, options.pause, 'pause', options);
+  }
+  if (hasValue(options.unpause)) {
+    return handlePauseQuery(store, options.unpause, 'unpause', options);
+  }
   if (hasValue(options.attach)) {
     return handleAttachQuery(store, options.attach, options.readOnly === true);
   }
@@ -234,6 +265,7 @@ module.exports = {
   handleCleanup,
   handleControlQuery,
   handleListQuery,
+  handlePauseQuery,
   handleResumeAllQuery,
   handleResumeQuery,
   handleStatusQuery,

package/src/lib/session-probe.js

@@ -13,12 +13,16 @@ const { getDockerCommand } = require('./docker-cleanup');
 /**
  * States a tracked isolation session can be observed in.
  * - RUNNING: the session/container is alive and can be attached to
+ * - PAUSED: the container is frozen by `docker pause` (issue #263); it is
+ *   alive (its process and memory are kept) but can be neither attached to nor
+ *   resumed until `$ --unpause` thaws it
  * - STOPPED: the container still exists but is not running (resumable)
  * - MISSING: no trace of the session/container remains
  * - UNKNOWN: the backend cannot be probed locally (e.g. ssh)
  */
 const SessionState = {
   RUNNING: 'running',
+  PAUSED: 'paused',
   STOPPED: 'stopped',
   MISSING: 'missing',
   UNKNOWN: 'unknown',
@@ -39,6 +43,11 @@ function mapDockerStatusToState(status) {
   if (normalized === 'running' || normalized === 'restarting') {
     return SessionState.RUNNING;
   }
+  if (normalized === 'paused') {
+    // Paused is alive, not stopped: reading it as stopped made `--resume`
+    // plan a `docker start`/snapshot of a frozen container (issue #263).
+    return SessionState.PAUSED;
+  }
   return SessionState.STOPPED;
 }
 
@@ -109,13 +118,30 @@ function probeSession(record, runner = runCommand) {
     probe.state = result.success ? SessionState.RUNNING : SessionState.MISSING;
   }
 
-  probe.alive = probe.state === SessionState.RUNNING;
+  probe.alive =
+    probe.state === SessionState.RUNNING || probe.state === SessionState.PAUSED;
   return probe;
 }
 
+/**
+ * Refusal for a control that cannot act on a paused container (issue #263).
+ * @param {string} action - What was refused, e.g. "attach to" or "resume"
+ * @param {string} uuid - Execution UUID, for the suggested command
+ * @param {string} sessionName - Container name
+ * @returns {{error: string}} Error result
+ */
+function pausedSessionError(action, uuid, sessionName) {
+  return {
+    error:
+      `Session "${sessionName}" is paused (frozen by docker pause), so start cannot ${action} it. ` +
+      `Use \`$ --unpause ${uuid}\` first to continue the same process, or \`$ --stop ${uuid}\` to end it.`,
+  };
+}
+
 module.exports = {
   SessionState,
   mapDockerStatusToState,
   parseScreenSessionState,
+  pausedSessionError,
   probeSession,
 };

package/src/lib/status-formatter.js

@@ -33,6 +33,7 @@ const {
   persistContainerRemoval,
 } = require('./container-removal');
 const { withDockerInspectBatch } = require('./docker-inspect-batch');
+const pause = require('./execution-pause');
 const {
   backendExitCode,
   dockerProbeSpawnOptions,
@@ -460,8 +461,11 @@ function enrichDetachedStatus(record) {
     ? readAttemptLogTail(record, FATAL_MARKER_TAIL_BYTES)
     : null;
   const probe = dockerProbe();
-  const resolved = attachContainerRemoval(
-    resolveDetachedStatus(record, logTail, probe),
+  const resolved = pause.attachPauseState(
+    attachContainerRemoval(
+      resolveDetachedStatus(record, logTail, probe),
+      probe
+    ),
     probe
   );
   const enriched = attachMemoryExhaustion(
@@ -664,6 +668,7 @@ function formatRecordAsText(record) {
   if (obj.staleDetectedAt) {
     lines.push(`Stale Detected At: ${obj.staleDetectedAt}`);
   }
+  lines.push(...pause.pauseTextLines(obj));
   if (obj.containerState) {
     // The container no longer exists; `containerId` is history (issue #225).
     lines.push(`Container State:   ${obj.containerState}`);
@@ -821,6 +826,7 @@ function queryStatus(store, identifier, outputFormat) {
       () => {
         const enrichedRecord = enrichDetachedStatus(record);
         persistContainerRemoval(store, record, enrichedRecord);
+        pause.persistPauseReconciliation(store, enrichedRecord);
         return attachProcessIds(enrichedRecord);
       }
     );
@@ -856,7 +862,11 @@ function listExecutions(store, outputFormat, options = {}) {
     // One docker inspect for every listed container (issue #243).
     const enriched = sortRecordsByStartTimeDesc(
       withDockerInspectBatch(all, dockerProbe(), () =>
-        all.map(prepareRecordForList)
+        all.map((record) => {
+          const prepared = prepareRecordForList(record);
+          pause.persistPauseReconciliation(store, prepared);
+          return prepared;
+        })
       )
     );
     // --running reports the reconciled status, not the stored one: a record

package/src/lib/status-probe.js

@@ -29,7 +29,8 @@ const {
  *
  * @param {string} sessionName - Container name
  * @param {Object|null} [probe] - Receives `sessionNotFound` (issue #225)
- * @returns {{running: boolean, exitCode: number|null, oomKilled: boolean|null}|null} State,
+ * @returns {{running: boolean, exitCode: number|null, oomKilled: boolean|null,
+ *   status: ?string, paused: boolean}|null} State,
  *   or null when the container cannot be inspected (not found yet, removed, or docker error)
  */
 function inspectDockerState(sessionName, probe = null) {
@@ -37,7 +38,8 @@ function inspectDockerState(sessionName, probe = null) {
     getDockerCommand(),
     dockerProbeSpawnOptions(),
     '{{.State.Running}} {{.State.ExitCode}} {{.State.OOMKilled}} ' +
-      '{{.State.StartedAt}} {{.State.FinishedAt}}',
+      '{{.State.StartedAt}} {{.State.FinishedAt}} ' +
+      '{{.State.Status}} {{.State.Paused}}',
     sessionName
   );
   if (probe) {
@@ -50,9 +52,15 @@ function inspectDockerState(sessionName, probe = null) {
   }
   // Parsed positionally and defensively: an older docker (or a stubbed one)
   // may answer with fewer fields than the template asks for.
-  const [runningRaw, exitRaw, oomKilledRaw, startedRaw, finishedRaw] = stdout
-    .trim()
-    .split(/\s+/);
+  const [
+    runningRaw,
+    exitRaw,
+    oomKilledRaw,
+    startedRaw,
+    finishedRaw,
+    statusRaw,
+    pausedRaw,
+  ] = stdout.trim().split(/\s+/);
   const exitCode = Number.parseInt(exitRaw, 10);
   return {
     running: runningRaw === 'true',
@@ -61,6 +69,9 @@ function inspectDockerState(sessionName, probe = null) {
       oomKilledRaw === 'true' ? true : oomKilledRaw === 'false' ? false : null,
     startedAt: normalizeDockerTimestamp(startedRaw),
     finishedAt: normalizeDockerTimestamp(finishedRaw),
+    // A paused container is still `.State.Running` (issue #263).
+    status: statusRaw || null,
+    paused: pausedRaw === 'true' || statusRaw === 'paused',
   };
 }
 
@@ -99,6 +110,9 @@ function readDockerState(record, probe = null) {
   ) {
     return null;
   }
+  if (probe) {
+    probe.dockerState = state;
+  }
   return state;
 }
 

package/src/lib/usage.js

@@ -1,6 +1,6 @@
 /** Print usage information */
 function printUsage() {
-  console.log(`Usage: $ [options] [--] <command> | $ --status <uuid> [--output-format <fmt>] | $ --list [--running] [--output-format <fmt>] | $ --upload-log <id> | $ --stop <id> | $ --terminate <id> | $ --attach <id> [--read-only] | $ --resume <id> [-- <command>] | $ --resume-all | $ --alias <id> <name> | $ --rename <id> <name>
+  console.log(`Usage: $ [options] [--] <command> | $ --status <uuid> [--output-format <fmt>] | $ --list [--running] [--output-format <fmt>] | $ --upload-log <id> | $ --stop <id> | $ --terminate <id> | $ --pause <id> | $ --unpause <id> | $ --attach <id> [--read-only] | $ --resume <id> [-- <command>] | $ --resume-all | $ --alias <id> <name> | $ --rename <id> <name>
 
 Options:
   --help, -h           Show this usage and exit successfully
@@ -54,6 +54,11 @@ Options:
   --no-sanitize        With --upload-log, explicitly upload without secret redaction
   --stop <id>           Ask a detached isolated execution to stop gracefully
   --terminate <id>      Terminate a detached isolated execution immediately
+  --pause <id>          Freeze a detached Docker execution (docker pause): CPU is
+                        released, memory stays allocated (--stop frees it)
+  --pause-reason <text> With --pause, record why the execution was frozen
+  --paused-by <name>    With --pause, record who froze the execution
+  --unpause <id>        Thaw a paused Docker execution; the same process continues
   --attach <id>         Attach to a running detached isolated execution
   --read-only           With --attach, follow output without sending input
   --resume <id>         Restart a stopped detached execution in the same environment
@@ -93,6 +98,8 @@ Examples:
   $ --upload-log my-screen-session         # Upload stored execution log
   $ --stop my-screen-session               # Ask detached execution to stop gracefully
   $ --terminate my-screen-session          # Terminate detached execution immediately
+  $ --pause my-docker-session --pause-reason 'rate limit'  # Freeze, keep RAM
+  $ --unpause my-docker-session            # Continue the same frozen process
   $ --list --running                       # Only executions that are still running
   $ --attach my-docker-session             # Re-enter a running detached session
   $ --attach my-docker-session --read-only # Follow its output without stdin

package/test/args-parser-attach-resume.js

@@ -142,7 +142,7 @@ describe('query mode exclusivity', () => {
     test(`rejects ${args.join(' ')}`, () => {
       assert.throws(() => {
         parse(args);
-      }, /Cannot combine --status, --list, --upload-log, --stop, --terminate, --attach, --resume, --resume-all, --cleanup, --alias, or --rename/);
+      }, /Cannot combine --status, --list, --upload-log, --stop, --terminate, --pause, --unpause, --attach, --resume, --resume-all, --cleanup, --alias, or --rename/);
     });
   }
 });

package/test/args-parser-control.js

@@ -54,19 +54,19 @@ describe('control options', () => {
   it('should reject combining query and control modes', () => {
     assert.throws(() => {
       parseArgs(['--status', 'uuid-here', '--stop', 'my-session']);
-    }, /Cannot combine --status, --list, --upload-log, --stop, --terminate, --attach, --resume, --resume-all, --cleanup, --alias, or --rename/);
+    }, /Cannot combine --status, --list, --upload-log, --stop, --terminate, --pause, --unpause, --attach, --resume, --resume-all, --cleanup, --alias, or --rename/);
   });
 
   it('should reject combining upload-log with control modes', () => {
     assert.throws(() => {
       parseArgs(['--upload-log', 'uuid-here', '--terminate', 'my-session']);
-    }, /Cannot combine --status, --list, --upload-log, --stop, --terminate, --attach, --resume, --resume-all, --cleanup, --alias, or --rename/);
+    }, /Cannot combine --status, --list, --upload-log, --stop, --terminate, --pause, --unpause, --attach, --resume, --resume-all, --cleanup, --alias, or --rename/);
   });
 
   it('should reject output-format with control modes', () => {
     assert.throws(() => {
       parseArgs(['--stop', 'my-session', '--output-format', 'json']);
-    }, /--output-format option is only valid with --status, --list, --resume, or --resume-all/);
+    }, /--output-format option is only valid with --status, --list, --resume, --resume-all, --pause, or --unpause/);
   });
 
   it('should default control options to null', () => {

package/test/args-parser.js

@@ -859,7 +859,7 @@ describe('output-format option', () => {
   it('should throw error for output-format without status', () => {
     assert.throws(() => {
       parseArgs(['--output-format', 'json', '--', 'npm', 'test']);
-    }, /--output-format option is only valid with --status, --list, --resume, or --resume-all/);
+    }, /--output-format option is only valid with --status, --list, --resume, --resume-all, --pause, or --unpause/);
   });
 
   it('should accept all valid output formats', () => {

package/test/fixtures/formal-ai/receipts-258.json

@@ -1,6 +1,6 @@
 {
-  "source": "captured from Formal AI 0.355.29 (982a7ffcb05d039292712ec9fe33bdbd645ed569) js agent mode by experiments/issue-258/capture-receipts.cjs",
-  "capturedAt": "2026-11-02",
+  "source": "captured from Formal AI 0.355.32 (08ca27d1ee0560fb56450ad798f3a79c684404ed) js agent mode by experiments/issue-258/capture-receipts.cjs",
+  "capturedAt": "2026-11-04",
   "fixture": {
     "snippet.mjs": "// Synthetic snippet for issue #258: keep this comment.\nconst label = \"before\";\n\n\texport function show(name) {  \n  return `${label}: ${name}`; // trailing comment\n}\n/* label = \"before\" in a comment stays */\n"
   },
@@ -136,10 +136,21 @@
         }
       ],
       "outcome": {
-        "status": "completed",
+        "status": "incomplete",
         "exitCode": 1,
-        "message": "finished; the last tool call exited with 1; no file changed",
-        "remainingObligations": ["the last tool call failed"]
+        "message": "`edit snippet.mjs` failed (snippet.mjs: old_string was not found; nothing changed) and no later call resolved it; no file changed",
+        "remainingObligations": [
+          "`edit snippet.mjs` failed: snippet.mjs: old_string was not found; nothing changed"
+        ],
+        "failures": [
+          {
+            "command": "edit snippet.mjs",
+            "tool": "edit",
+            "target": "snippet.mjs",
+            "exitCode": 1,
+            "error": "snippet.mjs: old_string was not found; nothing changed"
+          }
+        ]
       },
       "after": {
         "snippet.mjs": "// Synthetic snippet for issue #258: keep this comment.\nconst label = \"before\";\n\n\texport function show(name) {  \n  return `${label}: ${name}`; // trailing comment\n}\n/* label = \"before\" in a comment stays */\n"
@@ -322,10 +333,17 @@
         }
       ],
       "outcome": {
-        "status": "completed",
-        "exitCode": 0,
-        "message": "finished after 3 tool call(s); changed snippet.mjs",
-        "remainingObligations": []
+        "status": "incomplete",
+        "exitCode": 65,
+        "message": "Formal AI reported obligation_gap (no_artifact_in_clause) for the clause \"Preserve all other content.\"; nothing was verified as done by Formal AI; changed snippet.mjs",
+        "remainingObligations": [
+          "Formal AI did not confirm the requested change"
+        ],
+        "gapRecord": {
+          "schema": "obligation_gap",
+          "reason": "no_artifact_in_clause",
+          "clause": "Preserve all other content."
+        }
       },
       "after": {
         "snippet.mjs": "// Synthetic snippet for issue #258: keep this comment.\nconst label = \"after\";\n\n\texport function show(name) {  \n  return `${label}: ${name}`; // trailing comment\n}\n/* label = \"before\" in a comment stays */\n"