Retain safe ACP diagnostics in saved Prompt failures - #1098

Why

ACP Prompt failures can share a readable summary while carrying different supported classifications and details. XMD dropped that information before saving the Prompt, making later diagnosis depend on separate runtime logs. Closes #1039.

What changes

Safe available failure details survive in the saved Prompt error. Read them through the same Journal query used for shell-command debugging:

<REPL.Entry.Journal entry={1}
  yq={'[.records[] | select(.prompt != null and .status == "failed")]'} />

Each record includes promptError: the selected saved error, or null. Message-only failures retain their message with the diagnostic absent. Existing numeric Prompt identity, marker, status and shell fields keep their meanings.

The complete selected entry is queried before pagination. Component, Sidekick attachment and CLI return the same {value,next,prev,last} shape, with navigation expressed as reusable queries. A matching failed Prompt can be found beyond the first record page. Large selected objects retain the existing refusal; a narrower string selection uses the existing Unicode pages.

Existing Prompt reply/request/error text reads keep their prior shape. The earlier branch-only diagnostic member on Prompt text pages is removed.

How it works

The pinned in-process ACPX result retains selected normalization/protocol facts. The terminal Error carries them into Core's existing Prompt failure serializer. Core screens the new optional diagnostic before constructing the saved error, preserving useful safe fields and omitting unsafe or unverifiable optional detail. Original failure fields and the whole-event secret gate keep their behavior.

Core's parser and reconstructed Prompt error preserve the selected diagnostic. The REPL model copies/freezes the complete selected error and nested containers. Journal correlates it by the entry-local record marker. No arbitrary protocol data, provider files, raw prompt payloads, environment or headers are included in the diagnostic projection, and no diagnostic changes failure, refusal, cancellation, cleanup, checkpoint or uncertainty authority. Retryable is descriptive and grants no resend.

Review guide

Review the complete feature at 9831766bbefe10a356f228f423493783b53bbb16 against Main 32b53ab9, including original feature 648c44a3/cbe8b2bf, mechanical Main integration 3da4abde, CI correction 58060b03, the Journal amendment 0a19aeef, and the one-line typing fixture correction 9831766b. Reviewing only the latest tests does not cover the original feature.

Trace ACPX normalization through packages/acp/src/events.ts, Core's saved error ownership, the frozen REPL model and Journal query projection. Inspect the existing query/pagination and shared attachment/CLI consumers rather than treating the component result alone as qualification.

The prior Claude Fable 5.1 full-feature findings at 58060b03 reported no blockers and three nonblocking observations. Its overlong summary and original result remain preserved and disclosed there. The same original native reviewer completed the affected closeout at 9831766b: pass, no blocking findings, all five acceptance clauses examined, and the response passed the delivery schema. The closeout reviews the Journal amendment and final typing fixture while reusing the earlier full-feature judgment.

How to verify it

• Original production paths fail the retained witnesses for lost runtime, terminal, saved and inspection details. First failures and exact candidates are preserved.
• Original feedback at signed cbe8b2bf passed ACP13 tests/103 steps, Core12/74, controls10/65 and offline vendor verification1/12. The original Architect and Planner passed their frozen full-feature responsibilities there. Main integration preserved the feature patch byte-for-byte; those judgments retain their original provenance.
• CI2409 exposed strict Node event-array typing and an explicit JSR schema annotation. The same JSR issue failed the staged consumer. 58060b03 fixes types without changing the runtime schema, and uses noncredential dummy values in two excluded-data fixtures without changing the scanner or positive credential contrasts. Exact-head CI2410 passed all 56 jobs, and the automated PR review passed on 580.
• The requested Journal amendment has three passing candidates whose complete binary patches match signed 0a19aeef: controls10 groups/66 steps, selected attachment outer suite1/17 steps, vendor1/12 steps. The attachment suite executed the amended shell-and-Prompt component/attachment/CLI parity witness.
• The production save/cold-read journey distinguishes two actual equal-summary failures, preserves their classifications/correlation, locates failures after record 20, traverses narrower Unicode detail pages and leaves provider count exactly two, history bytes unchanged and entry count unchanged. It covers oversized object/item refusal, null/message-only/frozen error distinctions, raw-payload exclusions and unchanged Prompt summary pages.
• The original Architect passed affected S4-J/S5-J on exact 0a; the original Planner passed the frozen affected acceptance matrix on exact 0a. Neither repeated passing suites or waited for CI. Shipped Phase.Accept/Ticket.Advance computed exact-head feedback readiness from these actual saved outcomes with zero provider calls. Prior feedback and failures remain preserved.
• The complete current feature diff has zero findings under the unchanged secret scanner.
• CI2411 found one existing typing fixture missing the required error member. Signed child 9831766b adds exactly error: undefined to that completed-turn fixture. Both failed typechecks (deno task check and strict Node tsc) and its four-test regression pass on a candidate matched exactly to the commit. Production code, documentation and all Journal behavior are byte-identical to reviewed 0a19aee. The shipped mechanical review policy selects no additional ordinary reviewers; original feedback provenance remains at 0a19aee.
• Exact-head CI2412 completed successfully at 9831766: all 56 jobs complete and all 57 check runs accounted for, including the successful separate automated PR review1895. Current Main32b53ab9 is independently proven by its authoritative push CI2408.
• The same original Claude Fable 5.1 reviewer completed the affected closeout at exact 9831766. Its joined response passed the actual delivery schema, all five clauses were examined, and no blocking finding was reported. The reviewer reran the 12 vendor checks and reported a clean checkout. Root verified the original native identity, canonical response/receipt correspondence and unchanged signed source.

Scope

The change covers the pinned in-process result projection/provenance, saved Prompt diagnostics, the existing passive Journal projection, focused regressions and affected documentation. Pristine upstream bytes, dependencies, secret-policy implementation, query/navigation algorithms, test-file discovery, exclusions, runner commands and weights are unchanged.

Risks and limitations

Only supported selected fields are retained, including an actual string at protocol data.details. Arbitrary adapter data stays excluded. This does not establish the cause of the historical Internal error or whether its backend accepted the request. RUNTIME is the normalizer's fallback, not a backend diagnosis.

The Architect and independent Fable closeout retain the request-local repeated marker lookup as a nonblocking cleanup observation. A bounded comparison-count probe establishes extra work; it supplies no timing or responsiveness claim. Fable also notes that retained diagnostic details have no size cap: a large selected error object can hit the existing query-result bound, requiring a narrower projection or the paginated details string. This matches existing retention/refusal behavior; a new retention cap remains a product choice rather than a repair in this PR. The query refusal hint currently names exec channels while the specification also describes Prompt details. Earlier nonblocking observations remain linked in the full-feature review. No additional correction round is implied.

Scope confirmation

• Every changed file supports preserved ACP failure evidence or the requested Journal inspection path.
• Generated changes and provenance are identified.
• No unrelated cleanup, dependency change or live-provider qualification is included.
• The description distinguishes exact-head feedback, historical reviews, completed independent closeout and exact-head delivery checks.