synartesis 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,181 @@
 
 What changed, and why it mattered. Dates are release dates.
 
+## 0.5.0 — 2026-09-10
+
+A safety release. Two more races of the same family as 0.4.2's, one structural
+change so that family cannot be written again, the first proof that a shipped
+policy actually restores anything, and durability by default.
+
+Minor rather than patch: two behaviours change in ways you will notice.
+
+### Changed
+
+- **The journal is durable by default.** It ran with `synchronous = NORMAL`, on
+  the reasoning that the tail of the write-ahead log holds the record of a call
+  and never the call itself. True, and the wrong way round: the call reached the
+  server or it did not regardless of this file, so losing the record means the
+  world changed and the journal does not know. Undo cannot reverse what it has
+  no record of, and `show --live` would report that nothing was recorded — the
+  reassuring answer, on no evidence.
+
+  Measured here on 2,000 inserts of a 2 kB payload: NORMAL 0.0246 ms per write,
+  FULL 0.0594. Durability costs **0.035 ms per action**, about eight per cent of
+  the proxy's own 0.43 ms overhead. `SYNARTESIS_SYNC=normal` restores the old
+  behaviour.
+
+- **An interrupted inverse no longer resumes itself.** An action in
+  `rolling_back` was let through without a claim, on the reasoning that it must
+  be a crash. It is also what a live undo looks like between claiming an action
+  and finishing its inverse, and nothing here can tell those apart, so a second
+  undo starting in that window sent the same inverse again. It now halts and
+  names the evidence to look at. Finishing such an inverse needs a lease that
+  distinguishes a live owner from an abandoned attempt, which needs a schema
+  and a migration path this build does not have; that limit is now stated
+  rather than silently crossed.
+
+### Added
+
+- **Adapter contract tests for the shipped filesystem policy**, run against the
+  real server. Policies were checked only for tool *existence* — that
+  `fs.read_text_file` is a real tool — and never for whether the declared
+  inverse puts the file back. That is the failure mode that looks fine: a real
+  tool, a clean resolution, a report saying `rolled_back`, and the file still
+  wrong. Drift detection cannot catch it, because nothing is wrong with the
+  drift.
+
+  The tests make the mutation, undo it and compare bytes: exact restoration
+  including trailing whitespace and non-ascii, repeated writes to one file, a
+  colleague's edit refused, absence told apart from a read that failed, and
+  inspection distinguishing a touched file from an untouched one. Changing the
+  inverse to restore `$.content` instead of `$snapshot.content` fails them.
+
+  The tested server version is named in the file. **memory, git and github ship
+  policies with no such proof**; those servers are not installed in this
+  repository and their guarantees remain assumed.
+
+### Fixed
+
+- **Every status change now goes through one door.** Three of thirteen
+  transitions were conditional; the other ten wrote whatever they were told and
+  were safe only by convention. The convention failed three times in two days.
+  There are now two ways to change a status and no third: one reports whether it
+  won the race, the other names the statuses the caller must be holding and
+  throws when the row is not in one of them. Turning it on found three states
+  nothing can produce, all of them in tests that had been setting end states
+  directly.
+
+- **A second place one approval could authorise two calls.** The
+  missing-prior-state branch ignored the result of spending the approval.
+
+## 0.4.3 — 2026-09-10
+
+A correctness release. Seven reproduced defects in how effects are accounted
+for and how recovery is planned. Each is pinned by a test that fails against
+0.4.2 on real state and inverse-call counts, not on messages.
+
+The theme is one mistake made in seven places: treating absence of evidence as
+evidence. An error was read as proof nothing happened, a missing post-state as
+permission to write anyway, a stripped rule as proof of absence, and an
+unreadable resource as one with nothing left applied.
+
+### Fixed
+
+- **A timeout after the write was recorded as never applied.** The uncertainty
+  check knew only "Connection closed" and a downstream abort, so an upstream
+  that mutates a record and then times out fell through to `failed` — and
+  rollback steps over a failed action without looking at it. The change was
+  invisible to recovery.
+
+- **`isError` was treated as proof of a refusal.** The protocol gives the flag
+  no transactional meaning: it covers business-logic failures that happen after
+  a write as readily as a refusal before one.
+
+  Both now ask instead of assuming. Where a pre-read was declared, that same
+  read says what is true now, and comparing it against what was there before
+  turns a guess into evidence: unchanged is recorded as never applied, changed
+  is recorded as applied so it can be undone, and a read that cannot answer
+  leaves the outcome unknown. Only evidence of no dispatch — no transport, or a
+  JSON-RPC rejection of the envelope — is now recorded as definitely not
+  applied. Where there is no pre-read to ask, an adapter can state the
+  guarantee itself with `refusal: clean` on a tool policy; the default is
+  `uncertain`.
+
+- **Undo overwrote human edits when the post-state was missing.** A reversible
+  action promises evidence. Where the post-read failed at capture, rollback
+  reverted anyway, labelled it unverified and reported success — writing the
+  old value over whatever was there, with no `--force` required. It now halts
+  and says which half of the evidence is missing. `--force` is how a person
+  decides to proceed; the step stays unverified in the report. Compensable
+  actions, whose policies declare no pre-read at all, are deliberately not
+  caught by this.
+
+- **`absentWhen` was stripped on the way back in.** Rollback and inspection
+  each parsed a stored verify read through a schema naming only server, tool
+  and args, so the absence rules were dropped and every read failure became
+  "the resource is gone". A "permission denied" was reported as a definite
+  change and could send an inverse. There is now one shared schema for a stored
+  read.
+
+- **`--replan` could not recover a resolved conflict.** Taking the halt's own
+  advice — put the resource back, then replan — passed every check and then
+  failed to claim the row, reporting that another undo held it, which was never
+  true. Unresolved drift still halts.
+
+- **Preview invented drift it would never meet.** Undo puts intervening states
+  back as it walks down; a preview sends nothing, so an older write to a
+  twice-written record was compared against the newest value and called drift.
+  The preview now carries the state each planned inverse would leave, and only
+  where that is knowable — a compensation stops the chain rather than guessing.
+
+- **Inspection claimed nothing was left applied about resources it could not
+  read.** The summary counted only changed and unchanged, so an unreadable
+  resource fell through to the most reassuring sentence available. Unknowns are
+  now said first and never absorbed into a clean answer; `tally()` exposes the
+  counts. A failed post-read is also no longer reported as "no pre-read was
+  declared".
+
+- **A second place where one approval could authorise two calls.** The
+  missing-prior-state branch ignored the boolean from `adoptApproval`, so a
+  caller that lost the claim proceeded anyway. It now asks, like the gate path.
+
+## 0.4.2 — 2026-09-09
+
+Three bugs, found by auditing the paths the last pass did not touch. Each is
+pinned by a test that fails against 0.4.1.
+
+### Fixed
+
+- **One approval could authorise two irreversible calls.** Spending a standing
+  approval was an announcement rather than a claim: `markInFlight` and
+  `adoptApproval` both wrote unconditionally, so two proxies — which share one
+  journal, the reason `close` is never automatic — could read the same approved
+  row before either had used it, and both proceed. One person's yes, two emails
+  sent, which is the single thing this is here to prevent.
+
+  Both are now conditional on the row still being `approved` and report whether
+  they won it. `adoptApproval` spends first and only carries the approval across
+  if it did. The proxy treats losing the race as never having had an approval:
+  it asks. The guard already existed for inverses, and its comment describes
+  this exact failure; the approval path never got one.
+
+- **`prune` deleted sessions still waiting on a person.** `--help` and the
+  README both promise that nothing waiting on a person is ever pruned. The query
+  enforced it for `pending`, `gated` and `rolling_back`, and not for the two
+  other statuses that mean the same thing: `approved`, somebody's yes the agent
+  has not spent, and `unrecoverable`, an undo that stopped because somebody had
+  changed the resource and is waiting for them to choose. Pruning the first threw
+  away a human decision; the second threw away both the conflict and the undo
+  they were deciding about.
+
+- **Forcing an undo walked around the double-apply guard.** `markRollingBack`
+  claims an action by moving it out of `applied`, so two rollbacks cannot both
+  send one inverse. `undo --force`, added in 0.4.1, acts on rows an earlier
+  refusal left `unrecoverable` — which the claim did not know about, so it never
+  claimed them and never reported that it had not. Two concurrent forced undos
+  both sent the inverse: harmless for an idempotent write, a second real change
+  to the world for a compensable one.
+
 ## 0.4.1 — 2026-09-09
 
 ### Added

package/dist/{chunk-FOA4UIDE.js → chunk-CACV6R74.js}

@@ -339,7 +339,9 @@ function openDatabase(path) {
     db.pragma("journal_mode = WAL");
     db.pragma("foreign_keys = ON");
     db.pragma("busy_timeout = 5000");
-    db.pragma("synchronous = NORMAL");
+    db.pragma(
+      process.env["SYNARTESIS_SYNC"]?.toLowerCase() === "normal" ? "synchronous = NORMAL" : "synchronous = FULL"
+    );
     if (path !== ":memory:") {
       restrictToOwner(path);
     }
@@ -454,11 +456,46 @@ var SqliteJournal = class {
       );
     });
   }
-  markFailed(actionId, error) {
-    this.#run("markFailed", () => {
-      this.#db.prepare("UPDATE actions SET status = 'failed', error = ? WHERE id = ?").run(error, actionId);
+  /**
+   * Every status change, in one place, and none of them silent.
+   *
+   * Three of thirteen transitions used to be conditional; the other ten wrote
+   * whatever they were told. That was safe only by convention -- each caller
+   * happened to hold a claim first -- and the convention failed three times:
+   * a forced undo, a spent approval, and an adopted one all wrote a status
+   * they did not own, and two irreversible calls went out on one person's yes.
+   *
+   * `from` is the set of statuses the caller must be holding. #settle throws
+   * when the row is not in one of them, because a caller that has lost its
+   * claim has lost the right to say what happened; #claim reports it instead,
+   * for the callers whose job is to race. Neither can be bypassed by writing
+   * status directly, because nothing else in this class does.
+   */
+  #settle(operation, actionId, to, from, error) {
+    this.#run(operation, () => {
+      const slots = from.map(() => "?").join(",");
+      const sql = error === void 0 ? `UPDATE actions SET status = ? WHERE id = ? AND status IN (${slots})` : `UPDATE actions SET status = ?, error = ? WHERE id = ? AND status IN (${slots})`;
+      const args = error === void 0 ? [to, actionId, ...from] : [to, error, actionId, ...from];
+      const result = this.#db.prepare(sql).run(...args);
+      if (result.changes !== 1) {
+        const now = this.getAction(actionId)?.status ?? "gone";
+        throw new Error(
+          `cannot move ${actionId} to ${to}: it is ${now}, not one of ${from.join(", ")}`
+        );
+      }
+    });
+  }
+  #claim(operation, actionId, to, from, error) {
+    return this.#run(operation, () => {
+      const slots = from.map(() => "?").join(",");
+      const sql = error === void 0 ? `UPDATE actions SET status = ? WHERE id = ? AND status IN (${slots})` : `UPDATE actions SET status = ?, error = ? WHERE id = ? AND status IN (${slots})`;
+      const args = error === void 0 ? [to, actionId, ...from] : [to, error, actionId, ...from];
+      return this.#db.prepare(sql).run(...args).changes === 1;
     });
   }
+  markFailed(actionId, error) {
+    this.#settle("markFailed", actionId, "failed", ["pending", "gated", "approved"], error);
+  }
   /**
    * The call was interrupted, so whether the upstream applied it is genuinely
    * unknown. The row deliberately stays `pending`: recording it as failed
@@ -466,20 +503,37 @@ var SqliteJournal = class {
    * case surfaced rather than resolved by guesswork.
    */
   markUnknown(actionId, error) {
-    this.#run("markUnknown", () => {
-      this.#db.prepare("UPDATE actions SET status = 'pending', error = ? WHERE id = ?").run(error, actionId);
-    });
+    this.#settle("markUnknown", actionId, "pending", ["pending", "gated", "approved"], error);
   }
-  markRollingBack(actionId) {
+  /**
+   * Claim an action to send its inverse, or report that somebody else has.
+   *
+   * Conditional, so the transition is a claim rather than an announcement. Two
+   * rollbacks of one run both read the action as applied and both sent its
+   * inverse; for a compensating call rather than a restore, that is a second
+   * real change to the world.
+   *
+   * `from` is which statuses may be claimed. It exists because `undo --force`
+   * acts on rows left `unrecoverable` by an earlier refusal, and a claim that
+   * only knew `applied` never claimed those at all -- so the guard above was
+   * simply absent on the one path where a person had already been told the
+   * resource is contested.
+   */
+  markRollingBack(actionId, from = ["applied"]) {
     return this.#run("markRollingBack", () => {
-      const result = this.#db.prepare("UPDATE actions SET status = 'rolling_back' WHERE id = ? AND status = 'applied'").run(actionId);
+      const slots = from.map(() => "?").join(",");
+      const result = this.#db.prepare(
+        `UPDATE actions SET status = 'rolling_back' WHERE id = ? AND status IN (${slots})`
+      ).run(actionId, ...from);
       return result.changes === 1;
     });
   }
   markRolledBack(actionId) {
-    this.#run("markRolledBack", () => {
-      this.#db.prepare("UPDATE actions SET status = 'rolled_back' WHERE id = ?").run(actionId);
-    });
+    this.#settle("markRolledBack", actionId, "rolled_back", [
+      "rolling_back",
+      "applied",
+      "unrecoverable"
+    ]);
   }
   /**
    * The upstream processed the inverse and refused it, so nothing was applied
@@ -488,9 +542,7 @@ var SqliteJournal = class {
    * was briefly unwell, and rollback is expected to be retried (D7).
    */
   markInverseRejected(actionId, error) {
-    this.#run("markInverseRejected", () => {
-      this.#db.prepare("UPDATE actions SET status = 'applied', error = ? WHERE id = ?").run(error, actionId);
-    });
+    this.#settle("markInverseRejected", actionId, "applied", ["rolling_back"], error);
   }
   /**
    * The inverse may or may not have reached the upstream. The row stays in
@@ -498,18 +550,24 @@ var SqliteJournal = class {
    * current state rather than assuming either way.
    */
   markUnknownInverse(actionId, error) {
-    this.#run("markUnknownInverse", () => {
-      this.#db.prepare("UPDATE actions SET status = 'rolling_back', error = ? WHERE id = ?").run(error, actionId);
-    });
+    this.#settle("markUnknownInverse", actionId, "rolling_back", ["rolling_back"], error);
   }
   markGated(actionId, why) {
-    this.#run("markGated", () => {
-      this.#db.prepare("UPDATE actions SET status = 'gated', error = ? WHERE id = ?").run(why ?? null, actionId);
-    });
+    this.#settle("markGated", actionId, "gated", ["pending", "gated"], why ?? null);
   }
+  /**
+   * Spend a standing approval, or report that somebody else already has.
+   *
+   * Conditional for the same reason markRollingBack is. Several proxies share
+   * one journal, so two can read the same approved row before either has used
+   * it, and an unconditional write let both proceed -- one person's yes
+   * authorising two irreversible calls, which is the single thing this is here
+   * to prevent.
+   */
   markInFlight(actionId) {
-    this.#run("markInFlight", () => {
-      this.#db.prepare("UPDATE actions SET status = 'pending' WHERE id = ?").run(actionId);
+    return this.#run("markInFlight", () => {
+      const result = this.#db.prepare("UPDATE actions SET status = 'pending' WHERE id = ? AND status = 'approved'").run(actionId);
+      return result.changes === 1;
     });
   }
   /**
@@ -542,12 +600,18 @@ var SqliteJournal = class {
     });
   }
   adoptApproval(actionId, granted) {
-    this.#run("adoptApproval", () => {
+    return this.#run("adoptApproval", () => {
       const move = this.#db.transaction(() => {
+        const spent = this.#db.prepare(
+          "UPDATE actions SET status = 'denied', error = ? WHERE id = ? AND status = 'approved'"
+        ).run(`${SPENT_APPROVAL} ${actionId}`, granted.id);
+        if (spent.changes !== 1) {
+          return false;
+        }
         this.#db.prepare("UPDATE actions SET approved_by = ?, approved_at = ? WHERE id = ?").run(granted.approvedBy ?? null, granted.approvedAt ?? null, actionId);
-        this.#db.prepare("UPDATE actions SET status = 'denied', error = ? WHERE id = ?").run(`${SPENT_APPROVAL} ${actionId}`, granted.id);
+        return true;
       });
-      move.immediate();
+      return move.immediate();
     });
   }
   listGated() {
@@ -587,9 +651,11 @@ var SqliteJournal = class {
     });
   }
   markUnrecoverable(actionId, error) {
-    this.#run("markUnrecoverable", () => {
-      this.#db.prepare("UPDATE actions SET status = 'unrecoverable', error = ? WHERE id = ?").run(error, actionId);
-    });
+    this.#settle("markUnrecoverable", actionId, "unrecoverable", [
+      "applied",
+      "rolling_back",
+      "unrecoverable"
+    ], error);
   }
   listRuns() {
     return this.#run(
@@ -639,10 +705,18 @@ var SqliteJournal = class {
              FROM runs r
             WHERE r.status != 'active'
               AND COALESCE(r.ended_at, r.started_at) < ?
+              -- Everything a person still has business with. approved is
+              -- somebody's yes that the agent has not spent yet, and
+              -- unrecoverable is an undo that stopped because somebody had
+              -- changed the resource, waiting for them to choose. Both were
+              -- missing, so the promise made in --help and the README -- that
+              -- nothing waiting on a person is ever pruned -- was not one this
+              -- query kept.
               AND NOT EXISTS (
                     SELECT 1 FROM actions a
                      WHERE a.run_id = r.id
-                       AND a.status IN ('pending','gated','rolling_back'))
+                       AND a.status IN
+                           ('pending','gated','approved','rolling_back','unrecoverable'))
             ORDER BY at, r.rowid`
       ).all(before).map(
         (row) => z.object({
@@ -880,6 +954,7 @@ var toolPolicy = z2.strictObject({
   match: z2.string().min(1),
   class: z2.enum(["readonly", "reversible", "compensable", "irreversible"]),
   gate: z2.enum(["always", "on_write", "never"]).optional(),
+  refusal: z2.enum(["uncertain", "clean"]).optional(),
   snapshot: callTemplate.optional(),
   inverse: callTemplate.optional()
 });
@@ -1036,6 +1111,7 @@ function withGate(policy) {
     match: policy.match,
     class: policy.class,
     gate,
+    refusal: policy.refusal ?? "uncertain",
     ...policy.snapshot === void 0 ? {} : { snapshot: toCall(policy.snapshot) },
     ...policy.inverse === void 0 ? {} : { inverse: toCall(policy.inverse) }
   };
@@ -1306,7 +1382,7 @@ function literalLength(pattern) {
   return pattern.length - pattern.split("*").length + 1;
 }
 function failClosed(qualifiedName) {
-  return { match: qualifiedName, class: "irreversible", gate: "always" };
+  return { match: qualifiedName, class: "irreversible", gate: "always", refusal: "uncertain" };
 }
 function createPolicyResolver(manifest) {
   const compiled = manifest.tools.map((policy) => ({
@@ -1383,6 +1459,20 @@ function planInverse(call, context) {
   }
   return { server: target.server, tool: target.tool, args: resolveArgs(call, context) };
 }
+var resolvedRead = z4.object({
+  server: z4.string(),
+  tool: z4.string(),
+  args: z4.record(z4.string(), z4.unknown()),
+  absentWhen: z4.array(z4.string()).optional()
+});
+function toResolvedRead(parsed) {
+  return {
+    server: parsed.server,
+    tool: parsed.tool,
+    args: parsed.args,
+    ...parsed.absentWhen === void 0 ? {} : { absentWhen: parsed.absentWhen }
+  };
+}
 function planRead(call, context) {
   const target = splitQualified(call.tool);
   if (target === void 0) {
@@ -1403,10 +1493,6 @@ function isDisconnected(error) {
   const message = error instanceof Error ? error.message : String(error);
   return message.includes("Not connected") || message.includes("Connection closed");
 }
-function mayHaveArrived(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  return message.includes("Connection closed");
-}
 async function runRead(router, read2, signal) {
   const label = `${read2.server}.${read2.tool}`;
   const upstream = router.byName(read2.server);
@@ -1486,11 +1572,12 @@ export {
   refusal,
   toPayload,
   planInverse,
+  resolvedRead,
+  toResolvedRead,
   planRead,
   isDisconnected,
-  mayHaveArrived,
   runRead,
   observeState,
   connectStdioUpstream
 };
-//# sourceMappingURL=chunk-FOA4UIDE.js.map
+//# sourceMappingURL=chunk-CACV6R74.js.map

package/dist/cli.js

@@ -20,12 +20,14 @@ import {
   planRead,
   proxyCommand,
   qualify,
+  resolvedRead,
   rule,
   style,
   toPayload,
+  toResolvedRead,
   verifyAgainstServers,
   wasRefused
-} from "./chunk-FOA4UIDE.js";
+} from "./chunk-CACV6R74.js";
 import {
   DriftConflict,
   ManifestError,
@@ -384,6 +386,7 @@ async function rollback(options) {
   );
   let halted;
   let leftInPlace = false;
+  const projected = /* @__PURE__ */ new Map();
   for (const action of inScope) {
     let forcedOver;
     const early = classify(action, policies !== void 0, force || dryRun);
@@ -414,13 +417,14 @@ ${seen}` : seen;
       continue;
     }
     const plan = parsedPlan.data;
-    const verifyRead = inversePlan.safeParse(rebuilt.verify ?? action.verify);
+    const verifyRead = resolvedRead.safeParse(rebuilt.verify ?? action.verify);
     const recordedPost = observation.safeParse(action.postSnapshot);
     let verified = false;
     if (recordedPost.success && verifyRead.success) {
+      const foreseen = dryRun ? projected.get(resourceKey(toResolvedRead(verifyRead.data))) : void 0;
       let current;
       try {
-        current = await observeState(router, verifyRead.data, signal);
+        current = foreseen !== void 0 && foreseen !== UNFORESEEABLE ? foreseen : await observeState(router, toResolvedRead(verifyRead.data), signal);
       } catch (error) {
         const reason = `could not read current state to check for drift: ${describe(error)}`;
         halted = { seq: action.seq, reason, detail: "" };
@@ -471,6 +475,17 @@ ${seen}` : seen;
         forcedOver = "the resource had changed since; that change was overwritten";
       }
     }
+    if (!verified && action.class === "reversible" && !force) {
+      const reason = unverifiedBecause(action);
+      halted = {
+        seq: action.seq,
+        reason,
+        detail: "Without it there is no way to tell this resource from one somebody has edited since, so the recorded value was not written.",
+        conflict: true
+      };
+      steps.push({ ...describeStep(action), kind: "halt", reason, verified: false, plan });
+      break;
+    }
     if (!verified && action.status === "rolling_back") {
       const reason = "an inverse was already sent before an interruption and no pre-read is declared, so whether it applied cannot be determined";
       halted = { seq: action.seq, reason, detail: action.error ?? "" };
@@ -480,6 +495,10 @@ ${seen}` : seen;
       }
       break;
     }
+    if (dryRun && verifyRead.success) {
+      const after = intendedAfterInverse(action);
+      projected.set(resourceKey(toResolvedRead(verifyRead.data)), after ?? UNFORESEEABLE);
+    }
     steps.push({
       ...describeStep(action),
       kind: "revert",
@@ -491,10 +510,15 @@ ${seen}` : seen;
     if (dryRun) {
       continue;
     }
-    const claimed = journal.markRollingBack(action.id);
-    if (!claimed && action.status === "applied") {
-      const reason = "another undo is already working on this action";
-      halted = { seq: action.seq, reason, detail: "" };
+    const claimable = force || policies !== void 0 ? ["applied", "unrecoverable"] : ["applied"];
+    const claimed = journal.markRollingBack(action.id, claimable);
+    if (!claimed) {
+      const reason = action.status === "rolling_back" ? "an inverse for this action was already sent and never finished; whether another undo still holds it cannot be told from here" : "another undo is already working on this action";
+      halted = {
+        seq: action.seq,
+        reason,
+        detail: action.status === "rolling_back" ? "Nothing here can tell a live owner from a dead one, and this build has no lease to consult. Read the action with `show --live`: if the resource still shows the agent's write, the inverse never landed." : ""
+      };
       steps[steps.length - 1] = {
         ...describeStep(action),
         kind: "halt",
@@ -552,6 +576,10 @@ function unverifiedBecause(action) {
 function describeStep(action) {
   return { seq: action.seq, server: action.server, tool: action.tool };
 }
+function resourceKey(read) {
+  return canonical({ server: read.server, tool: read.tool, args: read.args });
+}
+var UNFORESEEABLE = /* @__PURE__ */ Symbol("unforeseeable");
 function overwriteText(current, action) {
   const intended2 = intendedAfterInverse(action);
   if (intended2 === void 0) {
@@ -597,11 +625,6 @@ async function executeInverse(router, plan, idempotencyKey, signal) {
 
 // src/rollback/inspect.ts
 import { z as z3 } from "zod";
-var inversePlan2 = z3.object({
-  server: z3.string(),
-  tool: z3.string(),
-  args: z3.record(z3.string(), z3.unknown())
-});
 var observation2 = z3.union([
   z3.object({ present: z3.literal(true), value: z3.unknown() }),
   z3.object({ present: z3.literal(false) })
@@ -612,7 +635,7 @@ function sameState2(a, b) {
 function intended(action) {
   return action.snapshot === void 0 ? void 0 : { present: true, value: action.snapshot };
 }
-function resourceKey(plan) {
+function resourceKey2(plan) {
   return canonical({ server: plan.server, tool: plan.tool, args: plan.args });
 }
 var SETTLED = /* @__PURE__ */ new Set(["failed", "denied", "gated", "approved"]);
@@ -635,17 +658,18 @@ async function inspect(options) {
       resources.push({ ...at, condition: "restored" });
       continue;
     }
-    const verify = inversePlan2.safeParse(action.verify);
+    const verify = resolvedRead.safeParse(action.verify);
     const post = observation2.safeParse(action.postSnapshot);
     if (!verify.success || !post.success) {
+      const note = !verify.success ? action.verify === void 0 ? "no pre-read was declared, so there is nothing to compare against" : "the recorded pre-read could not be read back" : action.postSnapshot === void 0 ? "the post-state was never captured, so there is nothing to compare against" : "the recorded post-state could not be read back";
       resources.push({
         ...at,
         condition: "unknowable",
-        note: action.inverse === void 0 ? "nothing was captured to restore" : "no pre-read was declared"
+        note: action.inverse === void 0 ? `${note}; and nothing was captured to restore` : note
       });
       continue;
     }
-    const key = resourceKey(verify.data);
+    const key = resourceKey2(toResolvedRead(verify.data));
     if (seen.has(key)) {
       resources.push({ ...at, condition: "superseded" });
       continue;
@@ -653,7 +677,7 @@ async function inspect(options) {
     seen.add(key);
     let current;
     try {
-      current = await observeState(router, verify.data, signal);
+      current = await observeState(router, toResolvedRead(verify.data), signal);
     } catch (error) {
       resources.push({ ...at, condition: "unknowable", note: `could not read it: ${describe(error)}` });
       continue;
@@ -675,16 +699,49 @@ async function inspect(options) {
   }
   return { runId, resources: resources.reverse() };
 }
+function tally(inspection) {
+  const counts = {
+    unchanged: 0,
+    changed: 0,
+    restored: 0,
+    superseded: 0,
+    "not-applied": 0,
+    unknowable: 0
+  };
+  for (const resource of inspection.resources) {
+    counts[resource.condition] += 1;
+  }
+  return counts;
+}
 function verdict(inspection) {
-  const changed = inspection.resources.filter((r) => r.condition === "changed").length;
-  const undoable = inspection.resources.filter((r) => r.condition === "unchanged").length;
-  if (changed > 0) {
-    return `${String(changed)} changed since this ran; undoing would write over ${changed === 1 ? "it" : "them"}`;
+  const counts = tally(inspection);
+  const said = [];
+  if (counts.changed > 0) {
+    said.push(
+      `${String(counts.changed)} changed since this ran; undoing would write over ${counts.changed === 1 ? "it" : "them"}`
+    );
+  }
+  if (counts.unknowable > 0) {
+    said.push(
+      `${String(counts.unknowable)} could not be checked, so whether ${counts.unknowable === 1 ? "it is" : "they are"} still applied is unknown`
+    );
+  }
+  if (said.length > 0) {
+    if (counts.unchanged > 0) {
+      said.push(`${String(counts.unchanged)} unchanged`);
+    }
+    return said.join(" \xB7 ");
+  }
+  if (counts.unchanged > 0) {
+    return `nothing has been touched since; all ${String(counts.unchanged)} would undo cleanly`;
+  }
+  if (counts.restored > 0 || counts.superseded > 0) {
+    return "everything here has already been put back";
   }
-  if (undoable > 0) {
-    return `nothing has been touched since; all ${String(undoable)} would undo cleanly`;
+  if (counts["not-applied"] > 0) {
+    return "nothing here was ever applied";
   }
-  return "nothing here is still applied";
+  return "nothing was recorded in this session";
 }
 
 // src/watch.ts

package/dist/proxy.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  canonical,
   cliCommandFrom,
   connectStdioUpstream,
   createPolicyResolver,
@@ -9,7 +10,6 @@ import {
   isDisconnected,
   loadManifest,
   mark,
-  mayHaveArrived,
   observeState,
   openJournal,
   planInverse,
@@ -19,7 +19,7 @@ import {
   runRead,
   toPayload,
   verifyAgainstServers
-} from "./chunk-FOA4UIDE.js";
+} from "./chunk-CACV6R74.js";
 import {
   SnapshotError,
   UpstreamError,
@@ -322,6 +322,25 @@ function identityFor(router) {
   }
   return { name: "synartesis", version: "0.0.0" };
 }
+async function whatHappened(router, verify, before, signal) {
+  if (verify === void 0) {
+    return "unknown";
+  }
+  try {
+    const now = await observeState(router, verify, signal);
+    return canonical(now) === canonical(before) ? "none" : "applied";
+  } catch {
+    return "unknown";
+  }
+}
+function neverDispatched(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (message.includes("Not connected")) {
+    return true;
+  }
+  const code = isRecord(error) ? error["code"] : void 0;
+  return code === ErrorCode.MethodNotFound || code === ErrorCode.InvalidParams || code === ErrorCode.InvalidRequest || code === ErrorCode.ParseError;
+}
 var SYNARTESIS_INSTRUCTIONS = [
   "These tools are guarded by Synartesis, which records every change so it can be undone later.",
   "",
@@ -588,10 +607,11 @@ function createProxyServer(options) {
           seq: reusable.seq,
           idempotencyKey: reusable.idempotencyKey
         };
+        let spent = true;
         if (inherited !== void 0) {
-          journal.adoptApproval(pending.actionId, inherited);
+          spent = journal.adoptApproval(pending.actionId, inherited);
         } else if (granted !== void 0 && waiting === void 0) {
-          journal.markInFlight(granted.id);
+          spent = journal.markInFlight(granted.id);
         }
         if (granted !== void 0) {
           log?.info(
@@ -654,15 +674,17 @@ function createProxyServer(options) {
           }
         };
         const askedAlready = wantsGate;
-        if (wantsGate && granted === void 0) {
+        if (wantsGate && (granted === void 0 || !spent)) {
           await decide("this action cannot be undone");
         }
         let snapshot;
         let verify;
+        let probe;
         let missingPriorState;
         if (policy.snapshot !== void 0) {
           try {
             verify = planRead(policy.snapshot, { args });
+            probe = verify;
             snapshot = await runRead(router, verify, extra.signal);
             journal.attachSnapshot(pending.actionId, snapshot);
           } catch (error) {
@@ -683,6 +705,7 @@ function createProxyServer(options) {
             }
           }
         }
+        const priorState = probe === void 0 || missingPriorState !== void 0 ? { present: false } : { present: true, value: snapshot };
         if (missingPriorState !== void 0 && !askedAlready) {
           const standing = journal.findApproval({
             server: route.upstream.name,
@@ -694,12 +717,15 @@ function createProxyServer(options) {
             await decide(
               `nothing was captured to restore, so this cannot be undone \u2014 the read said: ${missingPriorState}`
             );
-          } else {
-            journal.adoptApproval(pending.actionId, standing);
+          } else if (journal.adoptApproval(pending.actionId, standing)) {
             log?.info(
               { action: pending.actionId, by: standing.approvedBy, from: standing.runId },
               "proceeding on a standing approval"
             );
+          } else {
+            await decide(
+              `nothing was captured to restore, so this cannot be undone \u2014 the read said: ${missingPriorState}`
+            );
           }
         }
         const forwarded = {
@@ -712,12 +738,27 @@ function createProxyServer(options) {
           });
           const refused = refusal(result);
           if (refused !== void 0) {
-            journal.markFailed(pending.actionId, `the upstream refused the call: ${refused}`);
-            log?.debug(
+            const settled = policy.refusal === "clean" ? "none" : await whatHappened(router, probe, priorState, extra.signal);
+            if (settled !== "applied") {
+              const why = `the upstream refused the call: ${refused}`;
+              if (settled === "none") {
+                journal.markFailed(pending.actionId, why);
+              } else {
+                journal.markUnknown(
+                  pending.actionId,
+                  `${why} -- and whether anything changed could not be established`
+                );
+              }
+              log?.debug(
+                { seq: pending.seq, tool: route.tool, reason: refused, settled },
+                "refused by the upstream"
+              );
+              return result;
+            }
+            log?.warn(
               { seq: pending.seq, tool: route.tool, reason: refused },
-              "refused by the upstream"
+              "the upstream reported an error after changing the resource"
             );
-            return result;
           }
           const context = { args, snapshot, result: toPayload(result) };
           const warnings = [];
@@ -759,10 +800,30 @@ function createProxyServer(options) {
           return result;
         } catch (error) {
           const disconnected = isDisconnected(error);
-          if (extra.signal.aborted || mayHaveArrived(error)) {
-            journal.markUnknown(pending.actionId, describe(error));
-          } else {
+          if (neverDispatched(error)) {
             journal.markFailed(pending.actionId, describe(error));
+          } else {
+            const settled = await whatHappened(router, probe, priorState, extra.signal);
+            if (settled === "none") {
+              journal.markFailed(pending.actionId, describe(error));
+            } else if (settled === "unknown") {
+              journal.markUnknown(pending.actionId, describe(error));
+            } else {
+              let recovered;
+              if (policy.inverse !== void 0 && missingPriorState === void 0) {
+                try {
+                  recovered = planInverse(policy.inverse, { args, snapshot, result: void 0 });
+                } catch {
+                  recovered = void 0;
+                }
+              }
+              journal.markApplied(pending.actionId, {
+                result: void 0,
+                ...recovered === void 0 ? {} : { inverse: recovered },
+                ...verify === void 0 ? {} : { verify },
+                warning: `the call applied but its answer never arrived: ${describe(error)}`
+              });
+            }
           }
           if (disconnected && route.upstream.reconnect !== void 0) {
             await route.upstream.reconnect().catch(() => void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,