fix(transaction): require positive evidence of absence for HALTED_BEFORE_EFFECT

[abrichr]

The defect (P0 soundness)

classify_transaction_outcome() fell through to TransactionOutcome.HALTED_BEFORE_EFFECT whenever the coarse outcome was HALTED, no policy rejection applied, and _has_unresolved_uncertainty(report) was False. Its inline comment asserted "a governed halt with the verifier having established no effect" — but nothing on that path established any such thing.

_has_unresolved_uncertainty() iterates result.effect_evidence. When a run aborts before verification runs, that list is empty, the loop body never executes, and the function returns False. Absence of evidence was read as evidence of absence, in the one place where that is most dangerous.

HALTED_BEFORE_EFFECT is documented to mean the verifier established that NO effect occurred. A customer receiving it reconciles nothing. If a write landed, they hold an unreconciled mutation in a system of record with no signal it exists — the exact silent-wrong-effect failure this product is sold against, pointing the other way.

Measured consequence

The committed reproduction in openadapt-evals (merged PR #272, released 0.90.0) judges the taxonomy against MockMed's independent store at GET /api/db, never against the runtime's own report:

Invariant	Applicable runs	Violations
An outcome asserting no business effect must not be reported when the store shows the write landed	16	7
A consequential step that reached actuation but was never verified must be RECONCILIATION_REQUIRED	23	14

When the backend commits the row then hangs past the client timeout, the run reported HALTED_BEFORE_EFFECT while the store held the write. RECONCILIATION_REQUIRED was reached only when a configured verifier returned a conflicting reading.

The rule implemented

No outcome may assert absence while any consequential step's effect is UNKNOWN.

For each consequential step, one of these must hold:

1. a verifier read the system of record and settled every declared effect — observed absent, or confirmed and journaled; or
2. the runtime positively recorded that the step stopped before delivery was attempted (_attempt_state → not_actuated).

Otherwise the run is RECONCILIATION_REQUIRED. This guards HALTED_BEFORE_EFFECT, REJECTED_POLICY, CANCELED, and FAILED_PLATFORM alike — all four assert an absence and all four tell the operator to reconcile nothing.

Why "settled" rather than "absent": the failure mode being fixed is an unaccounted write. A verifier-confirmed effect is known, journaled, and needs no reconciliation, so it does not by itself flip a later governed halt. Whether a partially-completed run deserves its own label is a separate taxonomy question, flagged in-code and pinned by a test rather than silently decided here.

_attempt_state made fail-closed

not_actuated is itself an absence claim, so it now requires positive evidence of a pre-delivery stop: a skipped step, a pre-execution gate pseudo-step, or a typed safety_halt / governed_refusal / unverified pre-click identity check. A step whose delivery was never recorded either way is now delivery_uncertain, not not_actuated.

A failed postcondition now counts as proof of delivery — postconditions are checked after the click, so an over-halt on one shows the write already went out. This is what makes the premature-abort case classify correctly.

Other instances of the same pattern

• build_effect_journal read a workflow-step lookup miss as "not consequential" and dropped the step from the journal entirely. An absent lookup is unknown, not a negative; the report-side mirror now retains such a step whenever its own typed fields say it could write.
• _has_unresolved_uncertainty is unchanged in behavior, but its docstring now states that it reads conflicting evidence only and says nothing about a step with no evidence — so no future caller reads its False as "no effect occurred".
• _worst_observed_effect was already correct (no evidence → unknown) and is untouched.

Noted but not changed (out of scope, different failure direction — false presence, not false absence): execution_profiles.classify_execution_outcome does if step is None: continue, skipping a result whose step is missing from the workflow rather than failing toward COMPLETED_UNVERIFIED.

Benchmark expectations that pinned the defect

In ap_invoice (missing_po, duplicate_invoice) and o2c_recon (ambiguous_duplicate, stale_snapshot) the API gateway refuses the write and the direct state oracle confirms zero deltas — but the runtime cannot prove that. ActuationStatus.HALT is documented in-tree as "The request WAS sent but its outcome is unknown or a rejection -> the write may have landed", and no verifier read the system of record afterwards. These are unverified actuations and now report RECONCILIATION_REQUIRED.

That this is not an over-correction is shown by what did not move:

• missing_in_ledger — an explicit halt terminal, never actuated → still HALTED_BEFORE_EFFECT
• phantom_writeback (governed) — re-reads the file and establishes absence → still HALTED_BEFORE_EFFECT

Published results.json regenerated and both READMEs updated. The safety headlines are unchanged — governed silent-incorrect-success 0, healthy-path over-halts 0, model calls 0, healthy path VERIFIED. The only headline number that moves is ap_invoice's governed_reconciliation_required, 6 -> 12, which is exactly the 6 runs (2 scenarios x 3) that stopped making an unproven absence claim.

Tests

tests/test_transaction_outcome.py 25 → 42. 8 of the new tests fail on unmodified origin/main and pass here (verified in a detached baseline worktree), so none is vacuous.

Coverage:

• consequential step actuated then aborted before verification → RECONCILIATION_REQUIRED, explicitly not HALTED_BEFORE_EFFECT
• commit-then-timeout past the client deadline
• unclassified runtime_failure on a consequential step → fails closed
• API ActuationStatus.HALT → RECONCILIATION_REQUIRED
• approved-but-unverified GUI write cannot claim absence
• unproven absence also blocks REJECTED_POLICY, CANCELED, FAILED_PLATFORM
• halt genuinely before actuation, nothing delivered → REMAINS HALTED_BEFORE_EFFECT
• verifier-established absence after delivery → REMAINS HALTED_BEFORE_EFFECT
• confirmed earlier write is settled → REMAINS HALTED_BEFORE_EFFECT (scope boundary, pinned deliberately)
• skipped / reversible steps never block an absence claim
• the existing duplicate conflicting-reading case → still RECONCILIATION_REQUIRED

Two of these run end-to-end through the real Replayer, using the backend's recorded actions as independent proof of whether the click went out:

• click delivered → postcondition aborts the run → RECONCILIATION_REQUIRED (this one reproduces the defect on origin/main)
• resolution fails, backend.actions == [] → HALTED_BEFORE_EFFECT

Invariants preserved and re-asserted: COMPLETED_UNVERIFIED never a production success and never billable; only VERIFIED billable; no blind retry after uncertain delivery.

Verification

• uvx ruff==0.15.22 check openadapt_flow — pass
• uvx ruff==0.15.22 format --check openadapt_flow tests — pass (428 files)
• mypy openadapt_flow/transaction.py — pass
• pytest tests/test_transaction_outcome.py tests/test_uncertain_delivery.py tests/test_replayer.py tests/test_run_gate.py tests/test_ap_invoice_benchmark.py tests/test_o2c_recon_benchmark.py tests/test_execution_profiles.py — pass

Overlap note

PR #279 (feat: bind PHI-free qualified identity signals) merged as 3f34200 while this was in flight. This branch is rebased on top of it; #279 did not touch transaction.py, so there is no conflict. The diff here is deliberately surgical — transaction.py, its tests, the two benchmark suites whose expectations pinned the defect, and the HALTED_BEFORE_EFFECT docs. No paper/**, no benchmark/effectbench/**.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM

[abrichr]

Safety review: the central fix is necessary, but this head is not merge-ready yet because three absence assertions remain unsound.

1. _effect_accounted_for() conflates confirmed presence with confirmed absence. A run with a confirmed earlier write and a later halt is deliberately pinned as HALTED_BEFORE_EFFECT; the same path can return REJECTED_POLICY, CANCELED, or FAILED_PLATFORM. Those labels all assert that no effect occurred, so a known-present effect must block them. Until a precise partial-completion outcome exists, fail conservatively to RECONCILIATION_REQUIRED (non-billable), and replace the test that currently blesses the contradiction.

2. Evidence coverage is not checked against the declared contracts. If two effect_contract_hashes are declared but only one settled effect_evidence item exists, all(...) returns true and the code can claim absence. Require exact coverage of every declared contract hash (including duplicate handling) before treating the step as settled; add missing/duplicate/mismatched-hash regressions.

3. failure_category in ("governed_refusal", "safety_halt") is not itself proof of pre-delivery refusal. The real replayer sets a post-action heal-policy failure to safety_halt after a click; for remote/raw-coordinate delivery there may be no delivery_receipt, postcondition, input verdict, actuation tag, or effect evidence, so _reached_delivery() is false and this branch falsely calls it not_actuated. Reproduce this real path and make pre-delivery proof explicit rather than inferring it from the broad terminal category.

Please preserve the valuable empty-evidence/commit-timeout fix, but close these three cases before merge. I am holding this PR out of the current #278 -> #275 exact-SHA train until the revised head and full matrix are green.