Delegated work outcomes

The main conversation reads validated domain outcomes from the original work. An ending report is display text; it cannot prove a merge, permit another writer, or replace a typed result. See the delegation plan.

• Code: src/core/coordinator/shipOutcome.ts, src/core/coordinator/recoveryHistory.ts, src/core/coordinator/contract.ts, src/core/coordinator/instanceStore.ts, src/core/coordinator/driver.ts, src/channels/adminCoordinator.ts, src/core/coordinator/mainWorkerRelay.ts, src/tools/mainWorker.ts, deploy/cloudflare-memory/worker.ts, src/core/dispatch/ship.ts, src/core/runnerOwnership.ts
• Tests: src/core/coordinator/shipOutcome.test.ts, src/core/coordinator/recoveryHistory.test.ts, src/core/coordinator/instanceStore.test.ts, src/core/coordinator/driver.test.ts, src/channels/adminCoordinator.test.ts, src/core/coordinator/mainWorkerRelay.test.ts, src/tools/mainWorker.test.ts, deploy/cloudflare-memory/runLedger.test.ts, src/core/dispatch/ship.test.ts, src/core/runnerOwnership.test.ts

Criterion	Proof
Unreconciled original admission cannot authorize a new recovery. Confirming the exact saved create preserves unit history and action records; replaying that confirmation cannot erase a later settlement.	[unit] src/core/coordinator/recoveryHistory.test.ts::*::requires reconciled admission and preserves history through confirmation replay; src/channels/adminCoordinator.test.ts::*::refuses recovery while original admission remains unreconciled; [worker] deploy/cloudflare-memory/runLedger.test.ts::*::commits recovery history and settlement atomically while fencing older writers
Every recovery transition preserves the original thread and request provenance. Replaying an older settlement or refusal cannot release a newer action on the same unit, and a healthy refusal replay completes cleanup after repeated lost responses.	[unit] src/core/coordinator/recoveryHistory.test.ts::*::rejects identity and provenance changes in every recovery transition; src/channels/adminCoordinator.test.ts::*::reconciles repeated lost refusal replies without releasing a successor action; ::refuses an older private settlement while a successor recovery owns the same unit; src/core/runnerOwnership.test.ts::canonical runner pull owner::keeps the exact canonical action when routing a single recovery owner
An aborted findings round retains terminal PR state, exact heads, stop cause and missing-output count independently of its report; a merged PR does not imply the findings work landed. Private text is excluded.	[unit] src/core/coordinator/shipOutcome.test.ts::typed Ship outcome::preserves a terminal pull request without crediting missing findings as landed; ::retains incomplete results independently of equal merged and observed heads
Confirmed merge and closed PR remain distinct. Idle and continued segments are not settled outcomes. Merge readiness remains unprojected: the machine's approval boundary alone cannot certify final checks or commit readiness.	[unit] src/core/coordinator/shipOutcome.test.ts::typed Ship outcome::separates a confirmed merge from a closed pull request and a review boundary; ::does not turn an idle or continued segment into a settled outcome; src/core/coordinator/driver.test.ts::the plan runner's driver — a resume at review (agent-ship item 10)::the ending's facts read still reports an unsquashed fix-up commit when the approved head is otherwise mergeable
Unknown versions, malformed values, extra fields and contradictory states cannot become a stored outcome. Legacy reports supply no typed proof.	[unit] src/core/coordinator/shipOutcome.test.ts::typed Ship outcome::rejects malformed or contradictory persisted facts instead of reading report text
The driver sends the producer's typed terminal outcome alongside its rendered report.	[unit] src/core/coordinator/driver.test.ts::the plan runner's driver — the Workflow body over the step runner (item 9)::a merge door answering merged by other — the pull request was merged after the approval — completes the plan: the unit ends merged and the report reads the Already-merged sentence
Settlement and the Worker store reject malformed outcomes and kind/PR mismatches. Every settlement uses full-row CAS so a stale legacy write cannot erase typed facts. Typed retries reconcile a lost acknowledgment, refuse conflicts before delivery, and preserve a successor publication owner, including after recovery.	[unit] src/channels/adminCoordinator.test.ts::the plan runner's steps — plan, unit-start, branch, round, unit-end, finish (item 9)::persists typed settlement facts and refuses a mismatched ending before publication; ::reconciles a typed settlement after a lost store acknowledgment without replacing its result; ::refuses typed settlement when another writer changes the row between read and commit; ::does not let a legacy settlement erase a typed outcome committed while its row read was pending; ::keeps a successor publication owner when a normal typed settlement is replayed; src/channels/adminCoordinator.test.ts::*::replays a recovered private unit report after its settlement committed but the log failed; deploy/cloudflare-memory/runLedger.test.ts::run ledger — the coordinator's unit rows (item 50)::persists a typed outcome and rejects malformed or foreign pull request facts without changing the stored row
A fresh private progress reader returns the saved outcome only to the bound requester. Contradictory report text cannot change its meaning. A missing projection is explicitly unverified; the tool keeps report text untrusted.	[unit] src/core/coordinator/mainWorkerRelay.test.ts::main worker relay::returns the stored typed outcome after restart without interpreting a contradictory report; ::keeps a legacy ending unverified even when its report claims a confirmed merge; src/tools/mainWorker.test.ts::work_progress — the main agent reads its linked private worker::returns only the authorized projection, fencing worker prose as untrusted data
Ordinary unit writes, wake writes and instance replacement cannot erase a typed settlement. A conflicting batch writes nothing and consumes no events; only an exact checked replacement may advance the saved row.	[unit] src/core/coordinator/instanceStore.test.ts::*::refuses unfenced writes over a typed ending atomically while allowing an exact checked replacement; deploy/cloudflare-memory/runLedger.test.ts::run ledger — the coordinator's unit rows (item 50)::fences stale full-row and wake writes after typed settlement without committing part of a batch; src/channels/adminCoordinator.test.ts::*::%s cannot erase a typed ending committed between its row read and ordinary write
A private typed settlement saves its original delivery ID before append. Normal and recovered retries with a different ID or report are refused; retrying the original ID after a lost append acknowledgment produces one reply. A legacy recovery cannot adopt a concurrent typed result through receipt-only reconciliation.	[unit] src/channels/adminCoordinator.test.ts::*::binds a typed private report to its original delivery id across retries; src/channels/adminCoordinator.test.ts::*::replays a recovered private unit report after its settlement committed but the log failed; src/channels/adminCoordinator.test.ts::*::refuses a legacy recovery replay that races a typed settlement before a lost CAS response
A constrained provider action returns its verified result to the original private conversation after restart or compaction, with separate effect and delivery receipts.	[gap]
Recovery claim preserves the observed predecessor and reserves space for its successor. Settlement appends an immutable causal receipt in the same transaction as the unit update. A later recovery keeps both earlier outcomes.	[unit] src/core/coordinator/recoveryHistory.test.ts::recovery history store::retains both predecessors across two recovery settlements
The authenticated source message identifies a recovery action. Exact retries, including external-review recovery, reconcile the same Workflow before mutable review validation; unavailable or changed reviews cannot release a running or unconfirmed action. Only a proven absent Workflow may retry creation after fresh admission checks. A changed payload conflicts and another caller cannot adopt the action. A definitive refusal remains refused on replay; a later request has a different action but cannot consume an earlier review transition again.	[unit] src/core/coordinator/recoveryHistory.test.ts::recovery history store::binds action replay to its request and preserves a definitive refusal; src/channels/adminCoordinator.test.ts::*::reconciles an exact external-review retry after a lost create response (%s, %s); ::revalidates an absent external-review Workflow before retrying its original create (%s); ::keeps a pending external-review action bound to its requester, message and Workflow
Ownership routing rereads the canonical durable owner on every request; it never caches claims or reserves a writer. An unknown or incomplete read does not prove absence. Publication admission uses the original full-row CAS, which refuses a rival that arrives after an earlier read without displacing either owner.	[unit] src/core/runnerOwnership.test.ts::canonical runner pull owner::never caches a prior owner across a later complete owner read; ::retains canonical refusal*; ::retains transport uncertainty instead of treating it as no owner; src/channels/adminCoordinator.test.ts::pr-check recover — the answer says why nothing was recovered, and GitHub being down is never none::refuses a rival admitted while the original publication awaits its binding CAS
An absent Workflow read does not grant exclusive creation. A requester's failed review revalidation leaves the pending action and ownership intact if another exact retry starts that Workflow during the read; its matched internal callback retains fresh validation and rollback.	[unit] src/channels/adminCoordinator.test.ts::*::does not revoke a concurrent external-review retry after observing its Workflow absent; ::post-approval recovery revalidates %s before the Workflow resumes
History-enabled units reject ordinary, bare CAS, replacement and wake writes that bypass history. Conflicting batches and transitions write nothing. Count and UTF-8 request limits refuse before external admission, reserving successor capacity.	[unit] src/core/coordinator/recoveryHistory.test.ts::recovery history store::fences alternate writers without losing history or consuming wake events; ::refuses oversized transitions before changing the unit
Both storage implementations commit predecessor/action/claim and successor/settlement atomically. A lost claim, refusal or settlement acknowledgment reconciles the original durable transition without releasing a successor owner.	[unit] src/channels/adminCoordinator.test.ts::*::preserves the predecessor and final receipt at the recovery owner; ::reconciles a committed refusal after a lost acknowledgment and releases the original owner; ::reconciles a claim CAS whose committed response was lost and keeps ownership through Workflow admission; ::reconciles a committed terminal CAS with a lost response and releases only the original owner; [worker] deploy/cloudflare-memory/runLedger.test.ts::*::commits recovery history and settlement atomically while fencing older writers
Admission reserves terminal-row headroom and the last receipt slot; progress cannot consume that reserve. Pages have count and byte bounds, and malformed receipt endings remain unreadable.	[unit] src/core/coordinator/recoveryHistory.test.ts::recovery history store::reserves terminal row space before admitting a large but valid task; ::reserves the final receipt slot and pages history without trimming predecessors; ::rejects receipts without an ending or with contradictory nested outcomes
The original adapter message identifies the request, without a run-id fallback. Exact refused-action replay returns the saved refusal; a later request needs new admission. Private history remains bound to the original act and requester, with untrusted bounded reports and an explicit gap before the observed predecessor.	[unit] src/core/dispatch/ship.test.ts::*::runs explicit recovery before ordinary preflight and hands the resolved requester and thread to the deterministic coordinator operation; src/channels/adminCoordinator.test.ts::*::returns a saved admission refusal for the same request and admits only a later request; src/core/coordinator/mainWorkerRelay.test.ts::main worker relay::reads bounded recovery history after restart only through the original act; src/tools/mainWorker.test.ts::*::returns only the authorized projection, fencing worker prose as untrusted data