synartesis 0.8.1 → 0.8.5

package/CHANGELOG.md

@@ -2,6 +2,270 @@
 
 What changed, and why it mattered. Dates are release dates.
 
+## 0.8.5 — 2026-09-22
+
+Three states you could get into and not get out of, two screens that read the
+whole journal to draw one frame, and a gate that let two statements through.
+Found by auditing rather than by using it, which is the difference between
+this release and the last one.
+
+### Fixed
+
+- **An undo killed halfway can now be resumed.** An action whose inverse was
+  being sent is marked `rolling_back`, and until now nothing could ever
+  reclaim one: no flag, no command, no amount of waiting. The claim was right
+  to refuse -- sending a second inverse is harmless for a restore and a second
+  real change to the world for a compensation -- but it was refusing because
+  it could not tell a process still working from one that had died, and there
+  was nothing to ask. One Ctrl-C during an undo put an action permanently
+  beyond the command whose whole job is getting back.
+
+  There is a lease now, in a `leases` table, holding the host and process id
+  that took each claim. A claim is reclaimed only on evidence, and only when
+  both questions have answers: the drift check has already proved the inverse
+  never landed (a `rolling_back` row that gets that far has a verified
+  pre-read, or it halts earlier), and the operating system says the process
+  that held it is gone. Anything less certain -- a lease from another machine,
+  a lease taken by a build from before the table existed, no lease at all --
+  still halts, and now says who held it and since when. There is no timeout to
+  tune, so there is no window in which an undo that is merely slow is mistaken
+  for one that died.
+
+  No schema version bump. `CREATE TABLE IF NOT EXISTS` changes no row and no
+  meaning, runs on every open, and an older build opening the same journal
+  neither notices nor cares -- the same argument the indexes have carried
+  since 0.6. A bump would refuse to open every journal already out there,
+  because there is still no migration path.
+
+- **A call whose outcome was never established no longer blocks a whole run
+  for ever.** `pending` means the call went out and nobody can say whether it
+  landed, and undo stops at one rather than produce a state that is neither
+  the before nor the after. That was right and permanent: nothing in the CLI
+  could settle such a row, so one interrupted call blocked the undo of
+  everything older than it, and the only way past was `--to` above it, which
+  abandons the rest.
+
+  `synartesis resolve <action> --applied|--failed` records what a person
+  found, and who they were. It claims nothing else: an action resolved as
+  applied has no inverse, because none was ever resolved, so undo reports it
+  as something it cannot put back and carries on with the rest of the run.
+  Unblocking a run and undoing an action are different things and only the
+  first is on offer. A proxy that comes back and records what it actually saw
+  wins over a person's judgement, because it was there.
+
+- **Ctrl-C during an undo stops between actions instead of wherever it lands.**
+  There was no signal handling in the CLI at all, so an interrupt was node's
+  default: die immediately, including with an inverse in flight, which is the
+  single best way to produce the state the first item above describes. The
+  first Ctrl-C now asks the rollback to stop before it claims the next action
+  and says so; the second is the operating system's. Deliberately not wired to
+  the abort signal that cancels a request in flight -- what is already in the
+  air is allowed to finish and be recorded.
+
+- **A client disconnecting no longer erases that a session was undone.** The
+  proxy ends its run when its client goes away, which says nothing about
+  whether anything was put back -- and it was an unguarded write, so it
+  stamped `complete` straight over the `rolled_back` an undo had just
+  recorded. A session somebody had reversed came back looking untouched.
+
+- **`undo` no longer defaults to a session an agent is still writing to.** The
+  newest run is, by definition, the one a running proxy is using, and `undo`
+  with no id pointed straight at it. A preview is always allowed, because it
+  writes nothing; doing it for real now needs `--yes`, and the refusal names
+  all three ways on. A session whose proxy exited normally is `complete`, so
+  this fires only where something really is unfinished.
+
+- **Two writes the `on_write` gate read as reads.**
+  `WITH x AS (DELETE FROM users RETURNING *) SELECT * FROM x` is an ordinary
+  PostgreSQL data-modifying CTE, and `EXPLAIN ANALYZE DELETE FROM users` runs
+  the statement it claims to be explaining. Both begin with a word on the
+  read list, neither contains a semicolon, and both were passed through
+  ungated while emptying a table. The heuristic's promise is that anything it
+  cannot confidently read as a read is gated; these were read confidently and
+  wrongly. The leading word still decides whether a statement could be a read,
+  and a second pass over it -- with comments and string literals removed, so a
+  keyword cannot hide in either -- decides whether anything in it writes.
+
+  No shipped policy uses `on_write`, so nothing in the box was exposed. The
+  documentation invites you to use it for your own SQL server, which is
+  exactly who this was a hole for.
+
+### Changed
+
+- **The console drew each frame by reading the entire journal.** `runsView`
+  called `getActions` for every session on screen -- every snapshot, result
+  and inverse in each of them, each through a schema parse -- to arrive at two
+  integers per row, eight times a second. `tallyRuns` was added for precisely
+  this and `list` was moved onto it; the console was missed. On a
+  hundred-megabyte journal that was 62ms a frame against a 120ms tick, so half
+  the event loop went on deciding what to draw and keypresses queued behind
+  renders. It is about 2ms now, and what each session still has waiting comes
+  from two partial indexes rather than from its rows.
+
+- **`watch` scanned the whole table to show twelve lines.** `recentActions`
+  orders by time and there was no index on time alone, so every 120ms it read
+  every row in the table -- the ones carrying the snapshots -- and sorted them
+  in a temporary b-tree to return twelve. 7.4ms to 0.03ms on the same journal.
+
+- **A large write no longer pays to canonicalise its own arguments for
+  nothing.** The three lookups that run on the way in to a call each built a
+  canonical form of the arguments before checking whether there was any
+  candidate row to compare it against -- and their indexes are partial
+  precisely so that there almost never is. 23.5ms of pure waste on a
+  ten-megabyte write, gone with an early return.
+
+- **A budget test for both screens.** Every performance test here measured one
+  call against a journal a few hundred rows deep, which is the one shape in
+  which none of the above exists. `tests/screen-budget.test.ts` seeds four
+  thousand actions and holds a console frame and a watch frame to a fraction
+  of their tick, so the next regression is caught by CI rather than by
+  somebody's fan.
+
+## 0.8.4 — 2026-09-21
+
+Bugs, all of them found by using the thing rather than by a test going red:
+the suite was green before this and is green after it.
+
+### Fixed
+
+- **A server that was briefly unreachable no longer turns an ordinary undo
+  into one that needs `--force`.** The drift check reads the resource as it is
+  now, and when that read failed the action was written back as
+  `unrecoverable`. Nothing had been learned about the resource -- the read
+  never happened -- but the row now said otherwise, and the next plain
+  `undo` refused with "halted here on an earlier attempt" and offered
+  `--replan` or `--force`. So a server that was down for ten seconds escalated
+  an undo that would have worked into one that writes over whatever anybody
+  else had changed since.
+
+  The same write cost a second thing. A row that had already halted on real
+  drift carried the diff of what somebody had changed, which is the evidence
+  the person deciding is shown; retrying while the server was unreachable
+  replaced it with `server fs is not connected`. The halt then offered its
+  three-way choice with a transport error where the conflict used to be. The
+  read failure is now reported and not recorded, for the reason an unknown
+  outcome has never been recorded either: a rollback may not write down as
+  fact a thing it did not observe.
+
+- **The way past a drift halt no longer sends you round in a circle.** It
+  printed `put it back as the run left it: synartesis undo <id> --replan`,
+  which reads as though the flag does the putting back. It does not: it
+  rebuilds each inverse from the current manifest, and the drift check then
+  runs again on a resource nobody has touched. Somebody who typed what that
+  line told them to got the identical halt, offering the identical three
+  options, including the one they had just chosen, for as long as they cared
+  to keep typing it. The restoring is the reader's half, as `--help` has
+  always said, and the line now says so: `put the resource back, then:`.
+
+  While there: the three options were spaced by hand and the middle one sat a
+  character left of the other two, which is enough to stop a menu reading as
+  a menu. They are padded to a column now, and a test fails if they drift
+  apart again.
+
+- **`--to` past the end of a run answers in one line.** The message was
+  already exact -- `--to 99 is past the end of this run, which goes up to 1`
+  -- and was followed by five lines of unrelated commands. The bound in that
+  sentence was read off the journal, which is precisely the case the
+  command list was already meant to stay out of.
+
+- **Counts agree with their nouns.** `1 runs and 1 actions removed`,
+  `1 actions: 1 gated`. Three places counted the same way and each had its own
+  copy of the arithmetic; there is one now, in `style.ts`, beside the other
+  decisions about how text is set.
+
+- **The repository's social preview card is the whole card.** Every other
+  source in `brand/` states its size at 1x and gets its sharpness from the
+  shoot's scale factor; this one was written at 2560x1280 and shot at
+  1280x640, so what GitHub served when the repository was pasted into Slack
+  or a message was the top-left quarter of itself: three quarters empty
+  maroon with the tagline cropped off the bottom edge. It was also the only
+  asset here that nothing said how to rebuild, which is how it drifted.
+  `brand/README.md` now carries its command with the rest.
+
+- **`og:image` states its dimensions.** LinkedIn and Slack lay a link card out
+  before the image arrives and held a grey box of the wrong shape until it
+  did.
+
+## 0.8.3 — 2026-09-20
+
+Documentation, brand and repository furniture. No code changed, and the
+published package behaves exactly as 0.8.2 did.
+
+0.8.2 was tagged and never published to npm; this goes out in its place rather
+than publishing a tarball whose README differs from what its own tag points
+at.
+
+### Added
+
+- **Two drawings that move.** The README could say the value is kept before
+  the write and could show the result afterwards, and had no way to show the
+  sequence in between — which is the whole design. `synartesis-path-loop.svg`
+  draws where the proxy sits, which the README had described in prose and
+  never drawn at all; `synartesis-undo-loop.svg` is the three phases of an
+  undo. Hand-written SVG rather than GIF: two hundred times less weight and no
+  fuzziness on a retina screen, at the cost of the brand faces, since a
+  browser gives an SVG inside an `<img>` no network and blocks the webfont
+  import. Both carry their own ground so they read in either of GitHub's
+  themes, and both answer `prefers-reduced-motion` by settling on the end
+  state rather than disappearing.
+
+- **A wiki, and a sponsor button.** Four pages that deliberately do not repeat
+  the documentation — a policy cookbook whose every example was run through
+  the real manifest loader first, troubleshooting organised by the symptom in
+  front of you, an FAQ, and a home page saying what lives where. Discussions
+  opened with a thread saying what is actually proven. Ko-fi produces the
+  button today; `github:` is in `FUNDING.yml` and starts working the moment
+  that account is enrolled.
+
+### Changed
+
+- **The README's navigation is buttons rather than blue text.** The top was a
+  hand-written contents bar of eleven in-page anchors, most of which
+  duplicated GitHub's own table-of-contents button. One row of six now points
+  at the places somebody actually leaves for, with the status badges at half
+  the size underneath. Two details that had made the row look accidental: the
+  Actions badge is a different height from a flat-square row, and shields
+  picks text colour by background brightness, which had put white on the one
+  button meant to stand out.
+
+## 0.8.2 — 2026-09-20
+
+### Added
+
+- **The git policy's undo is proven, not just plausible.** `check` starts the
+  server and confirms every tool the policy names exists, which proves the
+  policy loads and proves nothing about recovery: a compensation can resolve to
+  a real tool, take the arguments that tool really wants, put nothing back, and
+  report `rolled_back`. So `tests/adapter-git.test.ts` stages real changes in a
+  real repository, undoes them, and reads the index back with git itself rather
+  than through the server being tested.
+
+  It is a narrower claim than the filesystem and memory files make, and that is
+  the policy's shape rather than the test's. This server exposes nothing that
+  restores content — nearly every read it offers answers in prose written for a
+  person, so almost nothing can be inverted from a captured state — which
+  leaves exactly one compensation to prove. Proven: staging comes back off the
+  index and the working tree is untouched; a commit is held rather than
+  approximated; a branch switch goes through and undo reports it as permanent
+  instead of claiming to have reversed it.
+
+  **The overreach is pinned too.** This server's `git_reset` unstages
+  everything, not only what the call staged, so undoing the agent's `git_add`
+  also unstages work a person staged by hand. Nothing is lost — both edits are
+  still in the working tree — but it is a compensation and not an undo, and the
+  test now fails if the policy is ever changed to imply otherwise. Every guard
+  in the file was broken in turn to confirm it bites.
+
+  CI installs `uv`, because mcp-server-git is a Python package. Without it that
+  file fails rather than skipping, deliberately: a proof that quietly does not
+  run leaves the suite green and the claim unsupported.
+
+### Changed
+
+- The README, the user guide and the site said git was "checked only for tool
+  existence". That was true when written and is not now, so all three say what
+  is actually proven and what still is not. **github** remains untested.
+
 ## 0.8.1 — 2026-09-19
 
 Documentation only. No code changed, and the published package behaves exactly

package/README.md

@@ -9,23 +9,9 @@ Synartesis sits between your MCP client and the servers it talks to, records
 every tool call with the state that call replaced, and can put that state back.
 What cannot be put back, it refuses to let an agent do unsupervised.
 
-### [Install it, then read the five minutes ahead of you →](docs/synartesis-user-guide.md#the-five-minutes-ahead-of-you)
-
-[![check](https://github.com/ArhaanDev24/Synartesis/actions/workflows/check.yml/badge.svg)](https://github.com/ArhaanDev24/Synartesis/actions/workflows/check.yml)
-[![npm](https://img.shields.io/npm/v/synartesis?color=5e1420&label=npm)](https://www.npmjs.com/package/synartesis)
-[![downloads](https://img.shields.io/npm/dm/synartesis?color=5e1420&label=downloads)](https://www.npmjs.com/package/synartesis)
-[![node](https://img.shields.io/node/v/synartesis?color=5e1420)](https://nodejs.org)
-[![MIT](https://img.shields.io/badge/licence-MIT-5e1420.svg)](LICENSE)
-[![site](https://img.shields.io/badge/synartesis.online-5e1420)](https://synartesis.online)
-[![star this repo](https://img.shields.io/badge/★_star_this_repo-2c080f)](https://github.com/ArhaanDev24/Synartesis)
-
-[Choose your path](#choose-your-path) · [See it in action](#see-it-in-action) ·
-[Install](#install) · [The screen](#the-screen) ·
-[The desktop window](#the-desktop-window) ·
-[The four classes](#what-it-can-and-cannot-do) ·
-[Your own server](#writing-a-policy-for-your-own-server) ·
-[Commands](#commands) · [What it does not do](#what-it-does-not-do) ·
-[Trust](#trust) · [Contributing](#contributing)
+[![Get started](https://img.shields.io/badge/Get%20started-5e1420?style=for-the-badge&labelColor=5e1420&color=5e1420&logoColor=f6e9e5)](#install) [![Desktop app](https://img.shields.io/badge/Desktop%20app-5e1420?style=for-the-badge&labelColor=5e1420&color=5e1420&logoColor=f6e9e5)](#the-desktop-window) [![User guide](https://img.shields.io/badge/User%20guide-5e1420?style=for-the-badge&labelColor=5e1420&color=5e1420&logoColor=f6e9e5)](docs/synartesis-user-guide.md) [![Wiki](https://img.shields.io/badge/Wiki-5e1420?style=for-the-badge&labelColor=5e1420&color=5e1420&logoColor=f6e9e5)](https://github.com/ArhaanDev24/Synartesis/wiki) [![Discussions](https://img.shields.io/badge/Discussions-5e1420?style=for-the-badge&labelColor=5e1420&color=5e1420&logoColor=f6e9e5)](https://github.com/ArhaanDev24/Synartesis/discussions) [![★ Star](https://img.shields.io/badge/%E2%98%85%20Star-f1b696?style=for-the-badge&labelColor=f1b696&color=f1b696)](https://github.com/ArhaanDev24/Synartesis)
+
+[![check](https://img.shields.io/github/actions/workflow/status/ArhaanDev24/Synartesis/check.yml?branch=main&label=check&style=flat-square)](https://github.com/ArhaanDev24/Synartesis/actions/workflows/check.yml) [![npm](https://img.shields.io/npm/v/synartesis?color=5e1420&label=npm&style=flat-square)](https://www.npmjs.com/package/synartesis) [![downloads](https://img.shields.io/npm/dm/synartesis?color=5e1420&label=downloads&style=flat-square)](https://www.npmjs.com/package/synartesis) [![node](https://img.shields.io/node/v/synartesis?color=5e1420&style=flat-square)](https://nodejs.org) [![licence MIT](https://img.shields.io/badge/licence-MIT-5e1420?style=flat-square)](LICENSE) [![synartesis.online](https://img.shields.io/badge/synartesis.online-5e1420?style=flat-square)](https://synartesis.online)
 
 </div>
 
@@ -38,6 +24,8 @@ It is not a sandbox: the container your agent runs in is disposable, but the
 CRM row it updated over the network is not. It is not a tracing tool: a trace
 tells you `update_customer` ran forty times, not what the values were before.
 
+![Where Synartesis sits: a tool call goes from your agent through the proxy, which writes the state it is about to replace into a local journal, and on to your tools](https://raw.githubusercontent.com/ArhaanDev24/Synartesis/main/brand/synartesis-path-loop.svg)
+
 **If this is a problem you have, [a star](https://github.com/ArhaanDev24/Synartesis) helps other people find it.**
 It is a young project, and that is most of how anybody learns it exists.
 
@@ -75,7 +63,13 @@ machine, and the proxy talks only to the servers your policy names.
 
 ## See it in action
 
-Both shots are real output from [`./demo/filesystem-demo.sh`](demo/filesystem-demo.sh),
+**The order is the whole design.** The value is kept *before* the write, which
+is what makes putting it back possible at all — and it is the one thing a
+screenshot cannot show:
+
+![Capture, change, put back: the value 412,800 is copied into the journal before the agent writes North to 0, and the captured copy is what comes back](https://raw.githubusercontent.com/ArhaanDev24/Synartesis/main/brand/synartesis-undo-loop.svg)
+
+Both shots below are real output from [`./demo/filesystem-demo.sh`](demo/filesystem-demo.sh),
 pasted rather than typeset. An agent overwrote a file and tried to move another.
 One command puts the first back and reports that the second never happened:
 
@@ -93,7 +87,7 @@ It stops at the record that moved and exits non-zero. Anything already put back
 stays put back, and it prints the three ways on: leave it, restore the resource
 and `--replan`, or `--force` to overwrite deliberately.
 
-[The desktop window](#the-desktop-window) · [What it can and cannot do](#what-it-can-and-cannot-do) · [What it does not do](#what-it-does-not-do) · [User guide](docs/synartesis-user-guide.md)
+**Next:** [the desktop window](#the-desktop-window) · [what it can and cannot do](#what-it-can-and-cannot-do) · [what it does not do](#what-it-does-not-do) · [the full guide](docs/synartesis-user-guide.md)
 
 ---
 ## Install
@@ -122,7 +116,7 @@ installed.**
 Needs Node 22 or newer. npm ships a prebuilt SQLite binding, so no toolchain is
 required unless you build from a clone.
 
-[User guide](docs/synartesis-user-guide.md#install-it) · [Claude Desktop](docs/synartesis-user-guide.md#claude-desktop) · [Claude Code](docs/synartesis-user-guide.md#claude-code) · [Any other client](docs/synartesis-user-guide.md#any-other-mcp-client)
+**Setting it up by hand:** [the walkthrough](docs/synartesis-user-guide.md#install-it) · [Claude Desktop](docs/synartesis-user-guide.md#claude-desktop) · [Claude Code](docs/synartesis-user-guide.md#claude-code) · [any other client](docs/synartesis-user-guide.md#any-other-mcp-client)
 
 ---
 
@@ -273,7 +267,7 @@ It loads the manifest, connects to every server it names, and says which tools
 your policy covers, which it does not, and where the two disagree. A policy
 that names a tool the server no longer has is an error, not a warning.
 
-[Writing a manifest](docs/synartesis-user-guide.md#open-the-file) · [The four classes](docs/synartesis-user-guide.md#the-four-classes) · [Checking it](docs/synartesis-user-guide.md#check-that-it-worked) · [Pinning a tool's shape](#when-the-server-changes-underneath-you)
+**Going further:** [writing a manifest](docs/synartesis-user-guide.md#open-the-file) · [the four classes](docs/synartesis-user-guide.md#the-four-classes) · [checking it](docs/synartesis-user-guide.md#check-that-it-worked) · [pinning a tool's shape](#when-the-server-changes-underneath-you) · [the cookbook](https://github.com/ArhaanDev24/Synartesis/wiki/Policy-cookbook)
 
 
 ---
@@ -421,6 +415,7 @@ get it if it is not installed.
 | `show <id> --live` | The same, plus what has changed in the world since |
 | `show <id> --full` | Every argument, snapshot and inverse, nothing elided |
 | `gates` / `approve <id>` / `deny <id>` | What is waiting, and answering it |
+| `resolve <id> --applied\|--failed` | Settle a call whose outcome nothing established |
 | `undo <id>` | Reverse a session, newest action first |
 | `undo <id> --dry-run` | Plan it and change nothing |
 | `undo <id> --replan` | Rebuild each undo from the current manifest |
@@ -458,17 +453,32 @@ cannot start a process:** see the [user guide](docs/synartesis-user-guide.md).
 - **An error is not proof that nothing happened.** A timeout or a tool-level
   error after a write leaves the outcome *unknown*, not failed, and undo will
   not step past it. Where a pre-read exists it is consulted to settle the
-  question instead of guessing.
+  question instead of guessing, and where none can settle it, `resolve` is how
+  a person who looked says which way it went -- an action resolved as applied
+  still has no inverse, so undo reports it as something it cannot put back
+  rather than pretending otherwise.
 - **An undo is only as good as the policy that recorded it.** Inverses are
   resolved when the call happens, so a mistake in a manifest is baked into every
   run made under it. `undo --replan` rebuilds them from a corrected one.
 
-Two bundled policies are tested against the real server, by making the change
+Three bundled policies are tested against the real server, by making the change
 and undoing it. **filesystem**: exact byte-for-byte restoration, drift refusal,
 and absence told apart from a read that failed. **memory**: the graph is put
 back as it was, entities the agent only tried to create are left alone, and a
-delete of an entity is held rather than approximated. **git and github** are
-checked only for tool existence — their recovery guarantees are not yet proven.
+delete of an entity is held rather than approximated.
+
+**git** is the narrowest of the three, because the policy is: this server
+exposes nothing that can restore content, so there is no restoration to prove.
+What is proven is what it does claim — staging is taken back off the index and
+the working tree is left alone; a commit is held rather than approximated; a
+branch switch goes through and is reported as something undo cannot take back.
+And the overreach is pinned too: this server's reset unstages *everything*, so
+undoing the agent's `git_add` also unstages work a person staged by hand. That
+is why it is recorded as a compensation and not an undo, and there is now a
+test that fails if it ever gets described as one.
+
+**github** is checked only for tool existence — its recovery guarantees are not
+proven.
 
 All three of filesystem, memory and git declare `provenance: live`, and that
 word is narrower than it looks: it says the policy has met its server and the
@@ -561,11 +571,19 @@ same gate a pull request has to pass:
 pnpm check
 ```
 
-Bugs and questions go in [issues](https://github.com/ArhaanDev24/Synartesis/issues).
-Security reports do not — [`SECURITY.md`](SECURITY.md) says where those go
-instead. And if it saved you an afternoon, **[star the
-repo](https://github.com/ArhaanDev24/Synartesis)**; it costs you a click and is
-most of how a project this size gets found.
+**Where each thing goes.** A bug is an [issue](https://github.com/ArhaanDev24/Synartesis/issues). A question, an
+idea, or something you built with it is a
+[discussion](https://github.com/ArhaanDev24/Synartesis/discussions). A policy you wrote for a server that does not
+ship with one, a symptom you worked out, or an answer worth keeping goes in the
+[wiki](https://github.com/ArhaanDev24/Synartesis/wiki), which anybody can edit — it holds the things that are
+better off community-maintained, and deliberately does not repeat the
+documentation. A vulnerability goes in none of those:
+[`SECURITY.md`](SECURITY.md) says where.
+
+And if it saved you an afternoon, **[star the repo](https://github.com/ArhaanDev24/Synartesis)**; it costs you a
+click and is most of how a project this size gets found. If it saved you more
+than that, there is [a tip jar](https://ko-fi.com/synartesis) — entirely
+optional, and nothing here is behind it.
 
 ---
 

package/dist/{chunk-O3QDPYEL.js → chunk-JE7MOCZO.js}

@@ -150,6 +150,9 @@ function usable(stream) {
 function spaced(text) {
   return Array.from(text).join(" ");
 }
+function counted(n, noun) {
+  return `${String(n)} ${noun}${n === 1 ? "" : "s"}`;
+}
 function palette(on) {
   const paint = (codes, text) => on ? `${codes}${text}${RESET}` : text;
   return {
@@ -200,6 +203,7 @@ var NOTHING_RECORDED_YET = [
 
 // src/journal/journal.ts
 import { chmodSync, existsSync as existsSync2, mkdirSync } from "fs";
+import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 import Database from "better-sqlite3";
 import { z } from "zod";
@@ -254,6 +258,37 @@ CREATE TABLE IF NOT EXISTS actions (
   UNIQUE(run_id, seq)
 );
 
+-- Who is currently sending an inverse for an action, so that a dead owner can
+-- be told from a live one.
+--
+-- Without this, a row left in rolling_back by an undo that was killed could
+-- never be reclaimed by anything. The claim exists to stop two undos each
+-- sending the same inverse -- harmless for a restore, a second real change to
+-- the world for a compensation -- and refusing was the only safe answer to
+-- "is somebody still working on this?" when there was no way to ask. So an
+-- action could be stranded permanently by one Ctrl-C, on the command whose
+-- entire job is getting back. rollback.ts said as much in a comment: there is
+-- no lease to consult, and inventing a schema for one is a separate piece of
+-- work. This is that table.
+--
+-- Not a schema version bump, on the same argument the indexes above make: a
+-- table nothing older reads changes no row and no meaning, IF NOT EXISTS makes
+-- it idempotent, and an older build opening the same file afterwards neither
+-- notices nor cares -- it simply goes on refusing to reclaim, which is what it
+-- did before. A bump would refuse to open every journal already out there.
+--
+-- host and pid together, because a pid is only meaningful on the machine that
+-- issued it, and journals are shared. claimed_at is for the message rather
+-- than the decision: liveness is asked of the operating system, not inferred
+-- from a clock, so there is no timeout to tune and no window in which a slow
+-- undo is mistaken for a dead one.
+CREATE TABLE IF NOT EXISTS leases (
+  action_id  TEXT PRIMARY KEY REFERENCES actions(id),
+  host       TEXT NOT NULL,
+  pid        INTEGER NOT NULL,
+  claimed_at TEXT NOT NULL
+);
+
 CREATE INDEX IF NOT EXISTS actions_by_run ON actions(run_id, seq);
 
 -- Deliberately not a schema version bump. Adding an index changes no row and
@@ -339,6 +374,43 @@ CREATE INDEX IF NOT EXISTS actions_writes ON actions(run_id, seq)
 -- changes, no meaning changes, IF NOT EXISTS makes it idempotent, and an older
 -- build opening the same file afterwards neither notices nor cares.
 CREATE INDEX IF NOT EXISTS actions_seen ON actions(server, ts);
+
+-- The twin of actions_undoable, and partial for the same reason. The console
+-- asks, of every session, two questions: is there anything here an undo would
+-- reverse, and is there anything here a person still has to decide. The first
+-- is actions_undoable above; this is the second. It was being answered by
+-- materialising every action in every run -- snapshots, results and inverses,
+-- each through a zod parse -- eight times a second, to arrive at two integers
+-- per row. Measured on forty runs of five hundred actions with two-kilobyte
+-- snapshots, a hundred-megabyte journal: 62ms a frame, which on a 120ms tick
+-- is half the event loop spent deciding what to draw, so keypresses queued
+-- behind renders and the screen felt stuck.
+--
+-- The inverse_json test is in the predicate rather than in the query, so the
+-- count never reaches into a row: an unrecoverable action with no inverse is
+-- not a decision anybody can act on, and telling the two apart is exactly
+-- what cost the frame.
+--
+-- Added the same way as the ones above and for the same reason: no row
+-- changes, no meaning changes, IF NOT EXISTS makes it idempotent, and an older
+-- build opening the same file afterwards neither notices nor cares.
+CREATE INDEX IF NOT EXISTS actions_conflicted ON actions(run_id)
+  WHERE status = 'unrecoverable' AND inverse_json IS NOT NULL;
+
+-- The one query the seven above left behind, and the one running most often.
+-- recentActions asks for the newest twelve rows by time, and the watch screen
+-- asks it every 120ms. There was no index on ts alone -- actions_gated leads
+-- with status and actions_seen leads with server, so neither can serve a bare
+-- ORDER BY ts -- which left a full scan plus a temporary b-tree over a table
+-- whose rows carry the snapshots, to return twelve of them. The columns are
+-- in the same order the query sorts by, so sqlite walks this backwards and
+-- stops at the limit. Measured on forty runs of five hundred actions with
+-- two-kilobyte snapshots, a hundred-megabyte journal: 7.4ms to 0.03ms.
+--
+-- Added the same way as the ones above and for the same reason: no row
+-- changes, no meaning changes, IF NOT EXISTS makes it idempotent, and an older
+-- build opening the same file afterwards neither notices nor cares.
+CREATE INDEX IF NOT EXISTS actions_recent ON actions(ts, seq);
 `;
 
 // src/journal/journal.ts
@@ -351,6 +423,22 @@ var runSchema = z.object({
   status: z.enum(["active", "complete", "rolled_back", "partial"])
 });
 var seenSchema = z.object({ server: z.string(), ts: z.string() });
+var countedSchema = z.object({ run_id: z.string(), n: z.number() });
+var leaseSchema = z.object({
+  action_id: z.string(),
+  host: z.string(),
+  pid: z.number(),
+  claimed_at: z.string()
+});
+function running(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+    return code !== "ESRCH";
+  }
+}
 var tallySchema = z.object({
   run_id: z.string(),
   actions: z.number(),
@@ -394,6 +482,13 @@ function decode(value) {
 function orUndefined(value) {
   return value === null ? void 0 : value;
 }
+function sameCall(rows, args) {
+  if (rows.length === 0) {
+    return void 0;
+  }
+  const wanted = canonical(args ?? {});
+  return rows.find((row) => canonical(row.args) === wanted);
+}
 function toRun(raw) {
   const row = runSchema.parse(raw);
   return {
@@ -491,9 +586,14 @@ var SqliteJournal = class {
     });
     return id;
   }
-  endRun(runId, status) {
+  endRun(runId, status, from) {
     this.#run("endRun", () => {
-      this.#db.prepare("UPDATE runs SET ended_at = ?, status = ? WHERE id = ?").run((/* @__PURE__ */ new Date()).toISOString(), status, runId);
+      if (from === void 0) {
+        this.#db.prepare("UPDATE runs SET ended_at = ?, status = ? WHERE id = ?").run((/* @__PURE__ */ new Date()).toISOString(), status, runId);
+        return;
+      }
+      const allowed = from.map(() => "?").join(", ");
+      this.#db.prepare(`UPDATE runs SET ended_at = ?, status = ? WHERE id = ? AND status IN (${allowed})`).run((/* @__PURE__ */ new Date()).toISOString(), status, runId, ...from);
     });
   }
   closeAbandonedRun(runId) {
@@ -603,6 +703,9 @@ var SqliteJournal = class {
   markFailed(actionId, error) {
     this.#settle("markFailed", actionId, "failed", ["pending", "gated", "approved"], error);
   }
+  settleByHand(actionId, outcome, note) {
+    return this.#claim("settleByHand", actionId, outcome, ["pending"], note);
+  }
   /**
    * The call was interrupted, so whether the upstream applied it is genuinely
    * unknown. The row deliberately stays `pending`: recording it as failed
@@ -632,10 +735,38 @@ var SqliteJournal = class {
       const result = this.#db.prepare(
         `UPDATE actions SET status = 'rolling_back' WHERE id = ? AND status IN (${slots})`
       ).run(actionId, ...from);
-      return result.changes === 1;
+      if (result.changes !== 1) {
+        return false;
+      }
+      this.#db.prepare(
+        `INSERT INTO leases (action_id, host, pid, claimed_at) VALUES (?, ?, ?, ?)
+             ON CONFLICT(action_id) DO UPDATE SET host = excluded.host,
+               pid = excluded.pid, claimed_at = excluded.claimed_at`
+      ).run(actionId, hostname(), process.pid, (/* @__PURE__ */ new Date()).toISOString());
+      return true;
+    });
+  }
+  leaseFor(actionId) {
+    return this.#run("leaseFor", () => {
+      const raw = this.#db.prepare("SELECT * FROM leases WHERE action_id = ?").get(actionId);
+      if (raw === void 0) {
+        return void 0;
+      }
+      const row = leaseSchema.parse(raw);
+      return {
+        host: row.host,
+        pid: row.pid,
+        claimedAt: row.claimed_at,
+        alive: row.host === hostname() ? running(row.pid) : void 0
+      };
     });
   }
+  /** Releases a claim. Safe to call when there is none. */
+  #release(actionId) {
+    this.#db.prepare("DELETE FROM leases WHERE action_id = ?").run(actionId);
+  }
   markRolledBack(actionId) {
+    this.#release(actionId);
     this.#settle("markRolledBack", actionId, "rolled_back", [
       "rolling_back",
       "applied",
@@ -649,6 +780,7 @@ var SqliteJournal = class {
    * was briefly unwell, and rollback is expected to be retried (D7).
    */
   markInverseRejected(actionId, error) {
+    this.#release(actionId);
     this.#settle("markInverseRejected", actionId, "applied", ["rolling_back"], error);
   }
   /**
@@ -721,6 +853,12 @@ var SqliteJournal = class {
       return move.immediate();
     });
   }
+  listPending() {
+    return this.#run(
+      "listPending",
+      () => this.#db.prepare("SELECT * FROM actions WHERE status = 'pending' ORDER BY ts").all().map(toAction)
+    );
+  }
   listGated() {
     return this.#run(
       "listGated",
@@ -736,8 +874,7 @@ var SqliteJournal = class {
               AND approved_at >= ?
             ORDER BY approved_at DESC`
       ).all(query.server, query.tool, query.notBefore).map(toAction);
-      const wanted = canonical(query.args ?? {});
-      return rows.find((row) => canonical(row.args) === wanted);
+      return sameCall(rows, query.args);
     });
   }
   findGated(query) {
@@ -747,8 +884,7 @@ var SqliteJournal = class {
             WHERE run_id = ? AND server = ? AND tool = ? AND status = 'gated'
             ORDER BY seq`
       ).all(query.runId, query.server, query.tool).map(toAction);
-      const wanted = canonical(query.args ?? {});
-      return rows.find((row) => canonical(row.args) === wanted);
+      return sameCall(rows, query.args);
     });
   }
   findPending(query) {
@@ -758,8 +894,7 @@ var SqliteJournal = class {
             WHERE run_id = ? AND server = ? AND tool = ? AND status = 'pending'
             ORDER BY seq`
       ).all(query.runId, query.server, query.tool).map(toAction);
-      const wanted = canonical(query.args ?? {});
-      return rows.find((row) => canonical(row.args) === wanted);
+      return sameCall(rows, query.args);
     });
   }
   getAction(actionId) {
@@ -824,6 +959,30 @@ var SqliteJournal = class {
       return tally;
     });
   }
+  standingPerRun() {
+    return this.#run("standingPerRun", () => {
+      const standing2 = /* @__PURE__ */ new Map();
+      const count = (sql, field) => {
+        for (const raw of this.#db.prepare(sql).all()) {
+          const row = countedSchema.parse(raw);
+          const at = standing2.get(row.run_id) ?? { undoable: 0, conflicted: 0 };
+          at[field] = row.n;
+          standing2.set(row.run_id, at);
+        }
+      };
+      count(
+        `SELECT run_id, COUNT(*) AS n FROM actions INDEXED BY actions_undoable
+          WHERE status = 'applied' AND inverse_json IS NOT NULL GROUP BY run_id`,
+        "undoable"
+      );
+      count(
+        `SELECT run_id, COUNT(*) AS n FROM actions INDEXED BY actions_conflicted
+          WHERE status = 'unrecoverable' AND inverse_json IS NOT NULL GROUP BY run_id`,
+        "conflicted"
+      );
+      return standing2;
+    });
+  }
   /**
    * The newest run that still holds something an undo would put back.
    *
@@ -1973,6 +2132,7 @@ export {
   pathBinaryMatches,
   findManifest,
   findJournal,
+  counted,
   style,
   errorStyle,
   WORDMARK,
@@ -2011,4 +2171,4 @@ export {
   observeState,
   connectStdioUpstream
 };
-//# sourceMappingURL=chunk-O3QDPYEL.js.map
+//# sourceMappingURL=chunk-JE7MOCZO.js.map

package/dist/cli.js

@@ -9,6 +9,7 @@ import {
   canonical,
   cliCommand,
   connectStdioUpstream,
+  counted,
   createPolicyResolver,
   createRouter,
   describeStanding,
@@ -38,7 +39,7 @@ import {
   verifyAgainstServers,
   warnUntested,
   wasRefused
-} from "./chunk-O3QDPYEL.js";
+} from "./chunk-JE7MOCZO.js";
 import {
   DriftConflict,
   ManifestError,
@@ -365,6 +366,15 @@ var toolResult = z2.looseObject({ isError: z2.boolean().default(false) });
 function sameState(a, b) {
   return canonical(a) === canonical(b);
 }
+function held(lease) {
+  if (lease === void 0) {
+    return "No lease is recorded against it, so it was claimed by a build from before leases existed and there is no way from here to tell a live owner from a dead one. ";
+  }
+  if (lease.alive === void 0) {
+    return `It was claimed by process ${String(lease.pid)} on ${lease.host} at ${lease.claimedAt}, and this is not that machine, so whether it is still running cannot be asked from here. `;
+  }
+  return `It is held by process ${String(lease.pid)} on ${lease.host}, claimed at ${lease.claimedAt}, and that process is still running. `;
+}
 function classify(action, replanning, goAhead) {
   switch (action.status) {
     case "rolled_back":
@@ -435,6 +445,14 @@ async function rollback(options) {
   let leftInPlace = false;
   const projected = /* @__PURE__ */ new Map();
   for (const action of inScope) {
+    if (options.interrupt?.aborted === true) {
+      halted = {
+        seq: action.seq,
+        reason: "interrupted, so this and everything before it were left as they are",
+        detail: "Nothing was half applied: the stop was taken between actions. Run undo again to carry on."
+      };
+      break;
+    }
     let forcedOver;
     if (action.class === "readonly") {
       steps.push({ ...describeStep(action), kind: "skip", reason: "readonly", verified: true });
@@ -483,9 +501,6 @@ ${seen}` : seen;
         const reason = `could not read current state to check for drift: ${describe(error)}`;
         halted = { seq: action.seq, reason, detail: "" };
         steps.push({ ...describeStep(action), kind: "halt", reason, verified: false });
-        if (!dryRun) {
-          journal.markUnrecoverable(action.id, reason);
-        }
         break;
       }
       if (sameState(current, recordedPost.data)) {
@@ -576,14 +591,20 @@ ${seen}` : seen;
     if (dryRun) {
       continue;
     }
-    const claimable = force || policies !== void 0 ? ["applied", "unrecoverable"] : ["applied"];
+    const lease = action.status === "rolling_back" ? journal.leaseFor(action.id) : void 0;
+    const abandoned = verified && lease?.alive === false;
+    const claimable = [
+      "applied",
+      ...force || policies !== void 0 ? ["unrecoverable"] : [],
+      ...abandoned ? ["rolling_back"] : []
+    ];
     const claimed = journal.markRollingBack(action.id, claimable);
     if (!claimed) {
-      const reason = action.status === "rolling_back" ? "an inverse for this action was already sent and never finished; whether another undo still holds it cannot be told from here" : "another undo is already working on this action";
+      const reason = action.status === "rolling_back" ? "an inverse for this action was already sent and never finished, and the undo that sent it is still running" : "another undo is already working on this action";
       halted = {
         seq: action.seq,
         reason,
-        detail: action.status === "rolling_back" ? "Nothing here can tell a live owner from a dead one, and this build has no lease to consult. Read the action with `show --live`: if the resource still shows the agent's write, the inverse never landed." : ""
+        detail: action.status === "rolling_back" ? held(lease) + "Read the action with `show --live`: if the resource still shows the agent's write, the inverse never landed." : ""
       };
       steps[steps.length - 1] = {
         ...describeStep(action),
@@ -2101,36 +2122,28 @@ function runsView(journal, screen, options) {
     ];
   }
   const at = Math.min(screen.cursor, runs.length - 1);
+  const tally2 = journal.tallyRuns();
   return runs.map((run, index) => {
-    const actions = journal.getActions(run.id);
-    const held = actions.filter((action) => action.status === "gated").length;
+    const counts = tally2.get(run.id);
+    const total = counts?.actions ?? 0;
+    const held2 = counts?.waiting ?? 0;
     const here = index === at && canPress(options);
     const name = (run.label ?? "an agent").padEnd(24);
-    const note = held === 0 ? "" : `  ${style.accent(`${String(held)} awaiting approval`)}`;
-    return `  ${here ? style.accent(CURSOR) : " "} ${here ? style.accent(name) : style.strong(name)} ${style.quiet(shortTime(run.startedAt).trimEnd().padEnd(13))}  ${style.quiet(run.status.padEnd(11))} ${style.quiet(`${String(actions.length)} actions`)}${note}`;
+    const note = held2 === 0 ? "" : `  ${style.accent(`${String(held2)} awaiting approval`)}`;
+    return `  ${here ? style.accent(CURSOR) : " "} ${here ? style.accent(name) : style.strong(name)} ${style.quiet(shortTime(run.startedAt).trimEnd().padEnd(13))}  ${style.quiet(run.status.padEnd(11))} ${style.quiet(counted(total, "action"))}${note}`;
   });
 }
-function standing2(actions) {
-  let undoable = 0;
-  let conflicted = 0;
-  for (const action of actions) {
-    if (action.inverse === void 0) {
-      continue;
-    }
-    if (action.status === "applied") {
-      undoable += 1;
-    } else if (action.status === "unrecoverable") {
-      conflicted += 1;
-    }
-  }
-  return { undoable, conflicted };
+var NOTHING = { undoable: 0, conflicted: 0 };
+function standing2(journal, runId) {
+  return journal.standingPerRun().get(runId) ?? NOTHING;
 }
 function elsewhere(journal, exceptId) {
+  const perRun = journal.standingPerRun();
   for (const run of [...journal.listRuns()].reverse()) {
     if (run.id === exceptId) {
       continue;
     }
-    const found = standing2(journal.getActions(run.id));
+    const found = perRun.get(run.id) ?? NOTHING;
     if (found.undoable > 0 || found.conflicted > 0) {
       return run;
     }
@@ -2371,7 +2384,7 @@ async function openConsole(options) {
     if (run === void 0) {
       return [];
     }
-    const here = standing2(ready.getActions(run.id));
+    const here = standing2(ready, run.id);
     const id = run.id.slice(0, 8);
     if (here.undoable > 0) {
       return [
@@ -2592,7 +2605,7 @@ async function openConsole(options) {
         if (ready === void 0 || run === void 0) {
           return;
         }
-        const here = standing2(ready.getActions(run.id));
+        const here = standing2(ready, run.id);
         if (here.undoable === 0 && here.conflicted === 0) {
           say(nothingToUndo(ready, run));
           return;
@@ -2614,7 +2627,7 @@ async function openConsole(options) {
         if (ready === void 0 || run === void 0) {
           return;
         }
-        const here = standing2(ready.getActions(run.id));
+        const here = standing2(ready, run.id);
         if (here.undoable === 0 && here.conflicted === 0) {
           say(nothingToUndo(ready, run));
           return;
@@ -2788,6 +2801,7 @@ var COMMANDS = `
   synartesis watch [--by <name>] [--journal <path>]
   synartesis approve [actionId|--all] [--by <name>] [--journal <path>]
   synartesis deny [actionId|--all] [--by <name>] [--reason <text>] [--journal <path>]
+  synartesis resolve [actionId] --applied|--failed [--by <name>] [--reason <text>]
   synartesis undo [runId] [--to <seq>] [--dry-run] [--replan] [--force [--yes]]
                           [--manifest <path>] [--journal <path>]
 
@@ -2803,6 +2817,14 @@ this command. Both share one journal, so either can undo what the other did.
 close ends a run left active by a proxy that was killed; nothing guesses at
 that, since several proxies can share one journal.
 
+resolve settles a call whose outcome was never established -- a proxy killed
+mid-write, or a server that answered too late. undo stops at one of those
+rather than guess, and stopping there used to be permanent: it blocked
+everything older in the same run. Only a person can say which way it went, so
+this records that they said it, and who. An action resolved as applied still
+has no inverse, so undo will report it as something it cannot put back and
+carry on with the rest.
+
 prune reclaims space. Putting a file back means keeping what was in it, so a
 journal grows at several times what an agent writes and never shrinks by
 itself. Nothing still active or still waiting on a person is ever pruned.
@@ -2831,6 +2853,8 @@ resource back as the run left it and --replan, or --force to overwrite.
   --once      watch prints the current state and exits
   --json      machine-readable output for list, show and gates
   --dry-run   read current state and print the plan without changing anything
+  --applied   resolve: the call did land, though nothing recorded it
+  --failed    resolve: the call never landed
   --replan    rebuild each undo from the current manifest, for a run recorded
               under a policy that turned out to be wrong
   --force     undo even where the resource changed after the run. On its own it
@@ -3012,7 +3036,7 @@ async function runCheck(argv) {
   out(`  ${style.quiet("guarded ")} ${style.accent(String(gated))}`);
   const pinned = Object.entries(manifest.pins ?? {});
   const servers = Object.keys(manifest.servers);
-  const unpinned = servers.filter((name) => !pinned.some(([held]) => held === name));
+  const unpinned = servers.filter((name) => !pinned.some(([held2]) => held2 === name));
   out(
     `  ${style.quiet("pinned  ")} ${pinned.length === 0 ? style.quiet("nothing -- run `synartesis pin`") : pinned.map(([name, tools]) => `${name} (${String(Object.keys(tools).length)})`).join(", ") + (unpinned.length === 0 ? "" : style.quiet(`; not ${unpinned.join(", ")}`))}`
   );
@@ -3332,6 +3356,7 @@ ${listed(matches)}`,
 }
 var RUN = { one: "run", many: "runs" };
 var WAITING = { one: "action awaiting approval", many: "actions awaiting approval" };
+var UNSETTLED = { one: "action whose outcome is unknown", many: "actions whose outcome is unknown" };
 process.stdout.on("error", (error) => {
   if (error.code === "EPIPE") {
     process.exit(0);
@@ -3408,12 +3433,12 @@ function laid(text, width) {
 function runList(journal, asJson, journalPath) {
   const runs = [...journal.listRuns()].reverse();
   const tally2 = journal.tallyRuns();
-  const counted = (id) => tally2.get(id) ?? { actions: 0, unknown: 0, waiting: 0, applied: 0 };
+  const counted2 = (id) => tally2.get(id) ?? { actions: 0, unknown: 0, waiting: 0, applied: 0 };
   if (asJson) {
     out(
       JSON.stringify(
         runs.map((run) => {
-          const actions = counted(run.id).actions;
+          const actions = counted2(run.id).actions;
           return { ...run, actions, actionCount: actions };
         })
       )
@@ -3435,7 +3460,7 @@ function runList(journal, asJson, journalPath) {
     )
   );
   for (const run of runs) {
-    const actions = counted(run.id);
+    const actions = counted2(run.id);
     const { unknown, waiting } = actions;
     const notes = [
       unknown === 0 ? "" : `${String(unknown)} of unknown outcome`,
@@ -3658,7 +3683,7 @@ function summarise2(actions) {
   }
   const parts = [...counts].sort(([a], [b]) => a < b ? -1 : 1).map(([k, v]) => `${String(v)} ${k}`);
   const undoable = actions.filter((a) => a.inverse !== void 0).length;
-  return `${String(actions.length)} actions: ${parts.join(", ")} | ${String(undoable)} with a recorded undo`;
+  return `${counted(actions.length, "action")}: ${parts.join(", ")} | ${String(undoable)} with a recorded undo`;
 }
 var journalArg = "";
 var manifestArg = "";
@@ -3718,13 +3743,13 @@ function runPrune(argv, journal, journalPath) {
   for (const run of stale) {
     actions += run.actions;
     out(
-      `  ${style.strong((run.label ?? "an agent").padEnd(24))} ${style.quiet(run.at.slice(0, 19).replace("T", " "))}  ${style.quiet(run.status.padEnd(11))} ${style.quiet(`${String(run.actions)} actions`)}`
+      `  ${style.strong((run.label ?? "an agent").padEnd(24))} ${style.quiet(run.at.slice(0, 19).replace("T", " "))}  ${style.quiet(run.status.padEnd(11))} ${style.quiet(counted(run.actions, "action"))}`
     );
   }
   out("");
   if (planned) {
     out(
-      `  ${style.accent(`${String(stale.length)} runs`)} ${style.quiet(`and ${String(actions)} actions would go. Nothing was changed.`)}`
+      `  ${style.accent(counted(stale.length, "run"))} ${style.quiet(`and ${counted(actions, "action")} would go. Nothing was changed.`)}`
     );
     out("");
     return 0;
@@ -3732,12 +3757,58 @@ function runPrune(argv, journal, journalPath) {
   const removed = journal.deleteRuns(stale.map((run) => run.id));
   journal.vacuum();
   out(
-    `  ${style.accent(`${String(removed.runs)} runs`)} ${style.quiet(`and ${String(removed.actions)} actions removed.`)}`
+    `  ${style.accent(counted(removed.runs, "run"))} ${style.quiet(`and ${counted(removed.actions, "action")} removed.`)}`
   );
   out(`  ${style.quiet(`Journal ${sizeBefore} \u2192 ${sizeOf(journalPath)}.`)}`);
   out("");
   return 0;
 }
+function runResolve(argv, journal) {
+  const applied = argv.includes("--applied");
+  const failed = argv.includes("--failed");
+  if (applied === failed) {
+    throw new UsageError(
+      "resolve needs exactly one of --applied (the call landed) or --failed (it never did)"
+    );
+  }
+  const by = flag(argv, "--by") ?? process.env["USER"] ?? process.env["LOGNAME"] ?? "unknown";
+  const why = flag(argv, "--reason");
+  const given = positional(argv)[1];
+  if (given !== void 0) {
+    const already = journal.getAction(given);
+    if (already !== void 0 && already.status !== "pending") {
+      process.stderr.write(
+        `synartesis: ${given} is not waiting to be resolved (it is ${labelFor(already)})
+`
+      );
+      return 1;
+    }
+  }
+  const action = pick(journal.listPending(), given, UNSETTLED);
+  const outcome = applied ? "applied" : "failed";
+  const note = `resolved as ${outcome} by ${by}` + (why === void 0 ? "" : `: ${why}`);
+  if (!journal.settleByHand(action.id, outcome, note)) {
+    const now = journal.getAction(action.id);
+    process.stderr.write(
+      `synartesis: ${action.id} was settled by the proxy first (it is ${now?.status ?? "gone"})
+`
+    );
+    return 1;
+  }
+  out("");
+  out(
+    `  ${style.accent(outcome)} ${style.strong(`${action.server}.${action.tool}`)} ${style.quiet(action.id.slice(0, 8))}`
+  );
+  out("");
+  out(
+    `  ${style.quiet(
+      applied ? "Undo will now pass it, and report it as something it cannot put back:" : "Undo will now pass it, as a call that never applied:"
+    )}`
+  );
+  out(`  ${style.strong(`${cliCommand()} undo ${action.runId.slice(0, 8)}`)}`);
+  out("");
+  return 0;
+}
 function runClose(argv, journal) {
   const all = journal.listRuns();
   const given = positional(argv)[1];
@@ -3903,13 +3974,15 @@ function report(result, alreadyForcing = false, as = "") {
       const self = cliCommand();
       const id = result.runId.slice(0, 8);
       out("");
-      out(`  ${style.quiet("keep the change, drop the undo:")}   ${style.quiet("nothing to do")}`);
-      out(
-        `  ${style.quiet("put it back as the run left it:")}  ${style.strong(`${self} undo ${id} --replan`)}`
-      );
-      out(
-        `  ${style.quiet("undo anyway, losing the change:")}   ${style.strong(`${self} undo ${id} --force`)}`
-      );
+      const ways = [
+        ["keep the change, drop the undo:", style.quiet("nothing to do")],
+        ["put the resource back, then:", style.strong(`${self} undo ${id} --replan`)],
+        ["undo anyway, losing the change:", style.strong(`${self} undo ${id} --force`)]
+      ];
+      const column = Math.max(...ways.map(([label]) => label.length));
+      for (const [label, command] of ways) {
+        out(`  ${style.quiet(label.padEnd(column))}   ${command}`);
+      }
     }
   }
   const permanent = result.steps.filter((step) => step.kind === "permanent");
@@ -3970,6 +4043,22 @@ async function withUpstreams(manifestPath, use, only) {
     }
   }
 }
+function stopOnInterrupt() {
+  const stopping = new AbortController();
+  let asked = false;
+  for (const sign of ["SIGINT", "SIGTERM"]) {
+    process.once(sign, () => {
+      if (asked) {
+        process.exit(130);
+      }
+      asked = true;
+      stopping.abort();
+      out("");
+      out(`  ${style.quiet("stopping after this action; press again to stop now")}`);
+    });
+  }
+  return stopping.signal;
+}
 function serversUsedBy(journal, runId) {
   return new Set(journal.getActions(runId).map((action) => action.server));
 }
@@ -3983,7 +4072,8 @@ async function performUndo(manifestPath, journal, runId, options) {
       ...options.toSeq === void 0 ? {} : { toSeq: options.toSeq },
       ...options.replan === true ? { replanWith: manifest } : {},
       dryRun: options.dryRun,
-      ...options.force === true ? { force: true } : {}
+      ...options.force === true ? { force: true } : {},
+      interrupt: stopOnInterrupt()
     }),
     // A replan re-resolves inverses from the current policy, which may name a
     // server this run never used; everything else needs only what it touched.
@@ -3994,11 +4084,20 @@ async function runUndo(argv, journal) {
   const rawTo = flag(argv, "--to");
   const toSeq = rawTo === void 0 ? void 0 : Number(rawTo);
   if (toSeq !== void 0 && (!Number.isInteger(toSeq) || toSeq < 1)) {
-    throw new UsageError("--to needs a positive whole number");
+    throw new UsageError("--to needs a positive whole number", false);
   }
   const given = positional(argv)[1];
   const chosen = pick([...journal.listRuns()].reverse(), given, RUN, true);
   const runId = chosen.id;
+  if (journal.getRun(runId)?.status === "active" && !argv.includes("--yes") && !argv.includes("--dry-run")) {
+    throw new UsageError(
+      `${runId.slice(0, 8)} has not ended, so an agent may still be writing to it.
+  See what an undo would do:  ${cliCommand()} undo ${runId.slice(0, 8)} --dry-run
+  If its proxy is gone:       ${cliCommand()} close ${runId.slice(0, 8)}
+  Undo it anyway:             ${cliCommand()} undo ${runId.slice(0, 8)} --yes`,
+      false
+    );
+  }
   if (given === void 0) {
     const actions = journal.getActions(runId);
     const left = actions.filter(
@@ -4039,7 +4138,8 @@ async function runUndo(argv, journal) {
     const highest = journal.getActions(runId).reduce((top, action) => Math.max(top, action.seq), 0);
     if (toSeq > highest) {
       throw new UsageError(
-        `--to ${String(toSeq)} is past the end of this run, which goes up to ${String(highest)}`
+        `--to ${String(toSeq)} is past the end of this run, which goes up to ${String(highest)}`,
+        false
       );
     }
   }
@@ -4117,6 +4217,7 @@ var KNOWN_COMMANDS = [
   "watch",
   "approve",
   "deny",
+  "resolve",
   "undo",
   "help",
   "version"
@@ -4140,6 +4241,9 @@ var FLAGS = /* @__PURE__ */ new Set([
   "--dry-run",
   "--replan",
   "--reason",
+  // resolve: which way the unknown outcome actually went.
+  "--applied",
+  "--failed",
   "--force",
   "--yes",
   "--older-than",
@@ -4313,6 +4417,8 @@ ${COMMANDS}`);
         return runPrune(argv, journal, journalPath);
       case "gates":
         return runGates(journal, asJson);
+      case "resolve":
+        return runResolve(argv, journal);
       case "approve":
         return runDecision(argv, journal, true);
       case "deny":

package/dist/proxy.js

@@ -25,7 +25,7 @@ import {
   verifyAgainstServers,
   warnUntested,
   withIdempotencyKey
-} from "./chunk-O3QDPYEL.js";
+} from "./chunk-JE7MOCZO.js";
 import {
   SnapshotError,
   UpstreamError,
@@ -256,12 +256,19 @@ import { z } from "zod";
 
 // src/gate/heuristic.ts
 var READ_ONLY = /^(select|with|show|explain|describe|desc|values|table)\b/;
+var WRITES = /\b(insert|update|delete|merge|upsert|replace|truncate|drop|alter|create|grant|revoke|vacuum|attach|detach|reindex|call|do|copy|lock|pragma|into)\b/;
+function code(text) {
+  return text.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/'(?:[^']|'')*'/g, " ").replace(/"(?:[^"]|"")*"/g, " ").trim();
+}
 function isReadOnlyStatement(text) {
-  const stripped = text.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ").trim();
+  const stripped = code(text);
   if (!READ_ONLY.test(stripped.toLowerCase())) {
     return false;
   }
-  return stripped.replace(/;\s*$/, "").indexOf(";") === -1;
+  if (stripped.replace(/;\s*$/, "").indexOf(";") !== -1) {
+    return false;
+  }
+  return !WRITES.test(stripped.toLowerCase());
 }
 function shouldGateOnWrite(args) {
   if (typeof args !== "object" || args === null) {
@@ -344,8 +351,8 @@ function neverDispatched(error) {
   if (message.includes("Not connected")) {
     return true;
   }
-  const code = isRecord(error) ? error["code"] : void 0;
-  return code === ErrorCode.MethodNotFound || code === ErrorCode.InvalidParams || code === ErrorCode.InvalidRequest || code === ErrorCode.ParseError;
+  const code2 = isRecord(error) ? error["code"] : void 0;
+  return code2 === ErrorCode.MethodNotFound || code2 === ErrorCode.InvalidParams || code2 === ErrorCode.InvalidRequest || code2 === ErrorCode.ParseError;
 }
 var SYNARTESIS_INSTRUCTIONS = [
   "These tools are guarded by Synartesis, which records every change so it can be undone later.",
@@ -1078,7 +1085,7 @@ function createProxyServer(options) {
   server.onclose = () => {
     connected = false;
     if (runId !== void 0) {
-      journal.endRun(runId, "complete");
+      journal.endRun(runId, "complete", ["active"]);
       runId = void 0;
     }
     previousOnClose?.();
@@ -1259,7 +1266,7 @@ async function main() {
   }
   const proxy = build();
   let shuttingDown = false;
-  const shutdown = (code) => {
+  const shutdown = (code2) => {
     if (shuttingDown) {
       return;
     }
@@ -1274,7 +1281,7 @@ async function main() {
         await upstream.close();
       }
       journal.close();
-      process.exit(code);
+      process.exit(code2);
     })();
   };
   process.on("SIGINT", () => {

package/manifests/git.yaml

@@ -1,6 +1,9 @@
 # Policy for mcp-server-git, the official git server, run through uvx.
 #
-# Verified against the real server on a real repository.
+# Verified against the real server on a real repository, and round-tripped by
+# tests/adapter-git.test.ts: the one compensation below is run and its effect
+# read back with git itself, and both gates are checked from both ends. Change
+# a class or a gate here and that file fails.
 #
 # The finding worth carrying away from writing this one: nearly every read this
 # server offers answers in prose meant for a person -- git_status says "On

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.8.1",
+  "version": "0.8.5",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,