# NEXT temporary contract 3.23 — Responsive operations, errors and reconnection {#root}

@status:impl/plan

[p01] @fact:NEXT-A23-SCOPE Temporary normative staging unit. Its body is the accepted architecture from refined plan revision 4, section 3.23. Before production code cites this law, promote the relevant clauses into permanent specifications. This file is consumed only after semantic coverage, implemented behavior and retained evidence are accepted. The task/retirement checker cannot perform semantic acceptance. @status:spec/done

[p02] @fact:NEXT-A23-U001 Request correlation, idempotency key, durable operation ID, existing domain run/intent ID and snapshot ID are separate. Register the admitted operation and its identity before the first effect. Persist bindings to existing lifecycle/deploy/build/publication journals and retained results rather than copying those systems into a new scheduler. The current one-writer/one-parked-continuation limits remain real; concurrent client requests receive conflict where the domain cannot execute both, while read queries/control remain responsive. @status:spec/done

[p03] @fact:NEXT-A23-U002 Operation states include prepared, awaiting-input/authorization, accepted/running, parked, cancellation-requested, completed, failed, cancelled and recovery-required/unknown-effect. Optional domain-specific phases reference the same operation. All outcomes include typed reason, phase, subject/preconditions, completed/pending/uncertain effects, retained evidence and recovery applicability. Structured failures exist even if no final domain report was produced. A Rust/tool Err is never assumed to mean that nothing was written; current materialise_subskill is a concrete counterexample (E49). @status:spec/done

[p04] @fact:NEXT-A23-U003 Inputs/approvals arrive as typed responses bound to question/action plan, schema, scope and policy generation. No TTY prompts in machine mode, no parsing free prose as a confirmation. Discoverable startup defaults cannot silently remove per-operation functionality or broaden grants. The IDE client's connection, an installed descriptor, an AI suggestion and assume-yes are not authority to apply an arbitrary plan. Use D-008/M-07/M-14 target/effect authority; current publication A and future B switch remain unchanged. @status:spec/done

[p05] @fact:NEXT-A23-U004 Events bind operation/context/target IDs, domain phase, monotonic per-stream sequence and snapshot/evidence references; request IDs only correlate individual calls. Separate structured state/progress/diagnostics from bounded raw stdout/stderr. Interleaving multiple streams has explicit ordering domains, not a fictitious global clock. Use flow control, streaming and backpressure; event gaps are explicit. Slow consumers cannot silently corrupt operation results or make unlimited memory queues. Cancellation and query dispatch must not wait behind a long synchronous tools/call. @status:spec/done

[p06] @fact:NEXT-A23-U005 Response loss/reconnect/restart: repeated submit with the same key and same request/plan attaches to the existing durable outcome, never reruns effects; same key with different payload refuses. Reserve the context/target/principal-scoped key and exact request/plan binding atomically under the shared operation admission boundary before effects, so simultaneous CLI/MCP/API submissions cannot both win. Use a host-issued submission namespace with an admission epoch/expiry; the namespace is recorded by the host and cannot be invented or renewed by a caller. Keep compact key→request/operation/outcome tombstones while the namespace is live. Retired/expired namespaces are rejected even after their individual keys/results were collected; a fresh namespace requires a new explicit action, never automatic resubmission of an uncertain old one. Active, parked and recovery-required operation identities remain pinned through namespace expiry: they are inspectable/recoverable under current authority but cannot be resubmitted as new work. Large result/event payloads may expire independently of deduplication/recovery identity; inspection then reports retained status plus payload-expired. This is admission bookkeeping over existing domain journals, not a second effect/evidence authority. Reconnection reauthorizes context and can obtain operation status, retained events/cursor and terminal/partial evidence. A replay gap means resnapshot plus current status. Durable outcome survives API process exit. @status:spec/done

[p07] @fact:NEXT-A23-U006 Define connection-loss policy before execution and advertise actual support. Transport EOF is neither evidence of successful cancellation nor permission to orphan children/restart the action. An on-demand operation owner may continue to completion or stop at an explicit safe boundary, durably recording the result before exit; attach/control for a still-running owner uses a protected local operation channel. If the owner crashed, recovery uses the domain journal and does not invent successful completion. This short-lived ownership mechanism does not require a permanent service or add autonomous task scheduling. @status:spec/done

[p08] @fact:NEXT-A23-U007 Cancellation is cooperative: acknowledgement of the request is distinct from reached safe stop. Before effects it can be cancelled cleanly; after committed/native/backend effects, return exact partial outcome and recovery obligations. Provider capability advertises supported boundaries; unsupported immediate cancellation or pause is visible. No false rollback, and no unsafe forced kill as the default package-management cancellation. Diagnostic capture/view cancellation can stop observation without claiming the underlying build was cancelled. @status:spec/done