MCP Flight Recorder

The recording distinguishes submitted input, selected tool arguments, host dispatch arguments, actual MCP invocation, observed outcome, and material submitted back to model context. A dispatch can refuse, defer or handle work locally. An MCP operation can lack model attribution. These facts remain separate rather than being collapsed into a presumed tool-call chain.

Core-issued receipts carry event, model-call, decision and operation identities. Decision occurrence IDs and decision event IDs have different uses. Only explicit recorder references or a positively observed host hook establish attribution. Matching names, payloads, timestamps or provider IDs never establish it.

Scope is captured when a wrapper is invoked and retained through deferred execution. Payloads are frozen when execution exposes them. Constructing a coroutine that is never awaited creates no observation or completion reservation. Awaiting a model call can record its request before the host consumes any returned stream. Host work and stream cleanup remain the host's responsibility.

Each capture owns a fresh Preparation and _IdentityReadScope. Identity lookups first check pending/committed memory, then lazily reuse at most one calling-thread read-only connection. Autocommit statements see later commits; no miss or pending value is promoted into committed memory. The committed cache is bounded by limits["committed_cache_items"], with 512 entries by default. Cursors and the scope close before admission/logging, including failures and nested captures.

Capture preparation produces immutable bundles outside the short admission critical section. The admission lock atomically checks capacity, queues a bundle and publishes its pending identities. Rejection publishes no identity. Accepted means frozen, charged and FIFO-admitted; it does not mean committed or durable.

Ordinary bundles and operation completions have separate byte and slot pools. An accepted operation start reserves minimal terminal capacity, so its terminal envelope can still be admitted when ordinary capacity is full. Queued and writer-held work remains charged. A reservation is released once, on commit, explicit discard or close-time handling.

The queue is bounded; health and loss diagnostics are bounded; optional body retention may be omitted explicitly. There are no per-event futures or unbounded background retries. Ordinary capture and model/MCP policy failures preserve native outcomes; policy process-control interruptions propagate as described in §6.

During capture, one writer thread owns the write connection. It writes a FIFO batch in an explicit outer transaction with one savepoint per bundle. Releasing a savepoint does not publish committed identity or release capacity. The successful outer commit establishes durable order and first binding witnesses.

The writer takes the first FIFO bundle intact, then drains already-ready work up to the existing item and byte caps. The first bundle remains indivisible even when it exceeds the batch byte cap. The oldest bundle's coalescing deadline limits only waiting for an empty queue: expiry does not stop selection of ready candidates. Once the queue is empty, the writer waits only while accepting and only for the remaining deadline; stopping drains ready work without waiting. Selection does not release ordinary charges or completion reservations; ownership continues through outer COMMIT or explicit discard.

An expected logical rejection can be isolated only when it loses no prerequisite identity. Rejection of an identity-bearing bundle or a turn start stops admission and discards its accepted dependent suffix; a valid earlier prefix can still commit while storage remains healthy. Unexpected storage, rollback or commit failure stops capture. No suffix is silently reattached to another scope.

An operation start event and its running row commit atomically. Its terminal event and exactly one running-row update also commit atomically. Closure marks unfinished operations incomplete without inventing an observed outcome or end time. Unfinished model requests use a run-scoped, NULL-safe response-ID set query, preserving duplicate requests and NULL turn IDs. An unmatched unscoped request still makes all affected turns partial; closure transactions, receipts and the five-second default budget are unchanged.

The writer uses WAL and synchronous=FULL during capture. Portable closure requires a joined writer, closed owned connections, a successful checkpoint with busy=0, nonnegative log count and all log frames checkpointed, verified DELETE journal mode, and a fresh read-only open. Already-DELETE is valid. Busy finalization retains the files and reports its reason; no code manually deletes SQLite sidecars to force portability.

close() stops admission and waits within its finite budget. aclose() starts the same shutdown when its coroutine executes; executor queue delay consumes that caller deadline. Cancelling the asynchronous waiter does not retract shutdown or cancel host work. After the capture writer stops, Recorder.finalize can start retry_finalization on a fresh thread that opens and closes its own connection; it never borrows the writer connection. Portability and complete capture are separate facts.

Schema 6 has seven tables: runs, turns, artifacts, events, operations, links and findings. The three views are observed_events, request_members and answer_occurrences. The current recorder and reader do not implement a scoring system or write findings.

Only an explicit message_path=None selects a direct request artifact, with message_array_unavailable. Otherwise the default is /messages, and missing/malformed pointers, a non-array message value or overlapping extraction paths reject as invalid_input; they do not fall back to a direct body.

Requests use a flat request_refs/2 manifest: template, message path, ordered message handles and extracted field handles. Duplicate message occurrences keep their positions. The manifest does not repeat a cumulative answer list. Answer bindings use explicit links and a first committed witness; later requests expose their current occurrences through membership.

For a structured request, the first public freeze detaches payload and facts, including a distinct retained request. After extraction paths and retained structure are validated, _template_copy shallow-copies the root and copies the ancestor containers along each path in the evolving template, replacing only the message array and extracted fields with null. Earlier masks survive when paths share ancestors; dict keys, list indices, escaped pointer tokens and unrelated values keep their meaning and order. Unchanged descendants are borrowed from the detached snapshots only during synchronous preparation. Existing serialization completes the template, message and field artifact bodies before admission; no borrowed template container reaches the writer. The original snapshots remain unchanged for later insertion validation.

Template observed_bytes describes the masked original template; retained body bytes, lengths and hashes describe the masked retained template. Fields retain their specified order and catalog reference, and message occurrences retain every position. Complete equal originals with equal bindings and compatible retention can share a message handle. Distinct originals remain distinct handles even when their retained message bodies are equal. The first snapshot, defensive digest freeze, policy metadata, admission and writer ownership are unchanged.

Reusable message identity requires compatible complete original, binding, projection and retention facts. Incomplete or unresolved observations receive fresh handles. Known bindings survive partial uncertainty elsewhere in a message; unknown context is never converted to an empty known binding list. bindings: [] describes only a message actually known to be unbound. Unavailable annotations can force fresh handles and repeated retained bodies as cumulative history grows; storage cost cannot be reduced by inventing bindings or hiding loss.

Original values versus retained bodies

The public JSON boundary accepts exact built-in dictionaries, lists, strings, integers, finite floats, booleans and null. It detaches containers and rejects cycles, custom objects, non-string keys and nonfinite values. MISSING is distinct from JSON null and is allowed only at an exposed top-level absence boundary.

Original equality uses a random in-memory per-run HMAC key and the named args_json_python/1, text_blocks_json/1 and message_json/1 projections. Canonical typing distinguishes booleans, integers and floats; the encoded projection cap is 1 MiB. Disabled, incomplete, unsupported, oversized or unavailable originals yield unavailable tokens with reasons. Raw JSON arguments reject duplicate keys/nonfinite values; disagreement with supplied parsed arguments is conflicting_arguments. Ordered text paths define text comparison. Equality establishes neither provenance nor authentication.

Original observed size and comparison input remain original. Body text, stored SHA256/length and retention flags describe the retained value. Metadata capture takes precedence over policy-provided content. Retained JSON null differs from omission. Normal policy omission alone need not make an otherwise complete source observation partial. Capacity loss, unresolved binding and partial source observations remain explicit.

Named projections are args_json_python/1, text_blocks_json/1 and message_json/1. Typed canonical JSON distinguishes booleans, integers and floats. A per-run random 32-byte HMAC key exists only in memory; original comparison tokens are scoped to that run. The encoded comparison projection cap is 1 MiB. Tokens indicate equality of the specified complete observed originals, not provenance or authentication.

For each request message, annotation and binding validation runs first. _fields then prepares the existing artifact fields once, including the original compact UTF-8 observed_bytes and the retained body, hash and flags. _message passes that original byte count through the private digest calls and reuses the prepared fields in _artifact_row. Availability checks and the defensive comparison freeze remain. A replacement or omission changes retained fields, never the original comparison input or eligibility size.

An original message with known UTF-8 size n uses one-shot compact, sorted ASCII JSON encoding only when 6 * n <= 1_048_576; the actual encoded length must also stay within that cap. The sixfold bound includes DEL, whose one UTF-8 byte becomes six ASCII escape bytes. Larger or absent size hints retain streaming encoding and its early limit/error order. Argument and text comparisons remain unhinted. This reorders existing field preparation and reuses its measured size; it does not remove original or retained field serialization.

Public boundaries detach and validate ordinary JSON before preparation. The internal canonical encoder and original-digest helper retain recursive validation, including for JSON parsed from raw argument strings. This preserves unavailable comparison tokens and their reasons when deeply nested input exceeds that validation boundary. Diagnostic copies remain where subsequent operations mutate them.

Valid inputs that pass the first public freeze may now succeed where the redundant whole-request template freeze previously exhausted the recursion stack. Removing that incidental later failure does not establish a fixed nesting-depth guarantee. Unsupported types, cycles, nonfinite values, invalid, overlapping or missing extraction paths and retained-message reordering still follow the existing validation.

MCP and model selective retention provide opt-in synchronous callbacks for model requests, separate decisions, normal responses and consumed-stream aggregates. The initial snapshot, message processing, digest validation, policy execution and serialization run synchronously. Bounded message encoding reduces iterator and per-chunk HMAC work; it does not establish total capture-time or memory bounds. Throughput and process-memory capacity depend on the host workload, SDK behavior and retention callbacks and require separate measurement.

Content capture retains bodies by default. Metadata capture omits bodies while retaining envelopes, structural membership and omission facts. Original comparisons use detached original values independently of retained bodies; preparation order does not change that authority. Redacted, truncated, omitted and unavailable facts remain distinct; payload bytes are never copied into receipt or diagnostic fields to bypass retention.

The three MCP factories accept optional synchronous retention_policy(kind, payload, context). Request payloads contain the complete {"arguments": ...} envelope; terminal payloads contain the existing translated result or error body. Callback payload and context are detached copies, with exactly client_id, server_key, method and name in context. Returned mappings are detached and validated before capture. Native values and original comparison inputs remain unchanged; no policy-owned body reference reaches admission.

The default retention_policy=None adds no policy call or copy. Scope remains fixed at invocation; projection and policy run only when lazy work executes. Never-awaited work creates no policy/native call or reservation, and MISSING skips the callback without becoming JSON null. Ordinary policy faults and callback-raised cancellation select fixed adapter_policy_error / retention_policy_failed omission before one capture attempt. The bounded loss is logged once per invocation, without payloads or exception messages; no raw fallback or second native call is added.

For MCP policies, SystemExit, KeyboardInterrupt and other unhandled BaseException values propagate. A request-side interruption can prevent native work; a response-side interruption can replace its pending outcome and leave an unfinished operation and incomplete close. Ordinary policy faults preserve native return, exception and cancellation identity. Each call keeps its own method/name context; the host owns any shared callback state.

Core start_operation(retention=...) applies the existing mapping to the complete request envelope. Original argument/result-text tokens and observed_bytes describe originals; stored bytes, hashes and flags describe retained bodies. Explicit retained null differs from omission. Invalid direct-core retention rejects without a request or reservation. Global metadata capture always omits bodies with capture_metadata precedence, including when a policy returns retained content.

The two model factories accept retention_policy=None. Their shared ModelCall owner selects retention separately for model.request, model.tool_call and model.response, including consumed-stream aggregates. Context has exactly instance_id, choice_index, tool_index, name and provider_ref; all but instance_id are null for requests/responses. Decisions expose their original positions and bounded name/reference. Callback payload/context and returned mappings are detached; original event metadata and native values remain unchanged. Host attachment helper signatures are unchanged.

Model requests reuse the pure _retained_request rule from core before the one observation attempt. Retained /messages and any submitted /tools path must remain present; the message array keeps its count and cannot move a recognizable unchanged original message to another position. Per-position replacement is allowed, and retained tools have no added count/order rule. This is structural validation, not arbitrary semantic reorder detection. Ordinary mapping, encoding or topology faults select fixed omission before admission; direct-core invalid-retention rejection remains unchanged.

Original request membership, bindings, insertions and per-part observed_bytes remain original. The structural request_refs/2 manifest remains retained when content is omitted. Supported decision args_digest values compare equal originals within one run; retention-distinct message artifact IDs may differ. Stored lengths, SHA256 and flags describe retained bodies. No model-response text digest, catalog token or public message digest is added. Retained JSON null is valid for decision/response bodies but invalid for a structured request. Metadata mode still executes configured policies and preserves capture_metadata precedence, including after failure.

Model policy failures add retention_policy_failed once per invocation without changing source completeness solely for omission. Default None adds no policy call/copy; invocation fixes scope, execution projects bodies, and MISSING skips policy. Streams apply policy to emitted decisions and the final consumed aggregate, never each chunk. Original chunk identity/order and existing bounded accumulation, partial/error/cancelled state and cleanup remain; there is no prefetch or drain.

Model policy process-control exceptions propagate at request, decision and terminal boundaries. Request interruption can prevent native work; decision/terminal interruption can replace a pending result, withhold a just-consumed chunk, or leave a missing terminal and incomplete close. Catching an interruption and resuming the same stream has no new guarantee of automatic cleanup or at-most-once policy invocation. Ordinary faults remain contained. Model observations retain their model/event lifecycle, not MCP operation reservations.

Bounded output and uncertainty

mfr.inspect/1 returns ok, scope, data, unknowns, cutoffs, omitted-diagnostic counts, error and untrusted_content=true. Default output is at most 65,536 bytes, configurable from 1,024 to 1,048,576; twenty diagnostics per kind are retained with overflow counts. Display strings may be clipped, but identities, pointers and cursors remain intact. If required intact output cannot fit, return limit_exceeded instead of malformed JSON or shortened identity.

Metadata projections exclude raw bodies, arbitrary event/link details and run policy/environment blobs. Small declared conditions appear only outside no_content; names and labels remain untrusted data. no_content is an output policy, not a confidentiality guarantee. Explicit content routes are payload and SQL.

Continuation resumes after the last emitted record, including byte-based trimming; oversized cursors are refused at 8,192 characters. Pages are independent live snapshots. Supported comparisons require complete observed originals in the same run and projection; incompatible/missing tokens yield null plus a reason. A validated binding and an available equality comparison are distinct facts.

Read operations and envelope construction share a cooperative deadline. Expected refusal/storage/deadline errors use safe JSON envelopes; unexpected implementation or process-control exceptions are not silently reclassified. Cleanup removes reader hooks, clears cache/prefix state, rolls back and closes owned connections before outcome logging.

Python and CLI use the same mfr.inspect/1 envelope, metadata projections, validation order and error codes. Each run_read invocation owns a read-only connection, one short transaction and one cooperative deadline. Required complete counts finish inside that transaction; deadlines or storage failures produce errors instead of partial success claims.

For a valid run-scoped CLI command without --run, _infer_run first performs a separate run-selection read, then _scoped invokes the selected reader. These reads have separate transactions and deadlines; for check/find_turns/explain/payload/slice, the selected timeout (default 10 seconds, finite positive value up to 30) is forwarded to both. CLI validation precedes run selection. This is a per-read budget, not an end-to-end deadline. With an explicit --run, only the selected reader is needed. fr schema and Python schema() return static metadata without opening a recording. Snapshot has its own connection and deadline management rather than using run_read.

One Context-owned _ReadCache retains immutable facts within that read snapshot: at most 8 MiB accounted bytes, 4,096 entries and 1 MiB per entry. Run-scoped typed keys distinguish raw and observed event rows, artifacts, relations, answer descriptors and membership minima. Request manifests and oversized entries bypass admission. Output arrays, SQLite buffers and process RSS are separate. Every lookup checks the deadline, including cached misses; each later public call starts fresh.

Stable answer descriptors exclude current-request completeness. One previous-request scalar slot per generator supplies that occurrence-specific fact; comparison precedence, row order, repeated diagnostics and overflow counts remain unchanged. A streamed, guarded membership prefix is only a negative prefilter: earlier minima still use original manifest authority. Any minimum eviction/refusal permanently disables it for that invocation; interrupted fills cannot advance coverage. Cache state is cleared before the owned read returns.

The private MEMBERS_SQL relation projects message_path and the message-pointer prefix with direct json_extract(a.body_text, '$.message_path'), while its predicate requires json_valid(a.body_text). The json_each iterator and format check retain their guarded input expressions, so malformed or omitted manifest bodies produce no members. Valid paths keep their SQLite scalar types; ordering, duplicate occurrences and per-occurrence diagnostics remain intact. This shared relation serves aggregate and detailed readers; input-answer and produced-answer populations remain separate and complete.

For turn membership totals, the private _member_count traversal reads request sequence and omission reason from the same guarded member selection. It preserves row selection and order, per-row deadline checks, and display diagnostics without projecting member records that the caller would discard. check validates links before operation lifecycle checks so later operation lookups do not evict membership-prefix facts before relation validation. Public item order, witness order, repeated diagnostics and overflow counts remain unchanged.

Turn answer totals use the private _answer_summary consumer of _answer_states, the shared occurrence traversal also used by answer_rows. The traversal preserves the original SELECT *, filters and ordering, descriptor checks, current-request completeness, per-occurrence deadlines and diagnostics. answer_rows still builds the full public records; turn totals consume all states without creating unused dictionaries. The input-answer and produced-answer passes remain separate and complete.

When decision_ids is not None, _answer_states consumes that iterable once and adds a redundant semijoin to the modern occurrence arm: member artifact IDs must appear in the same run's answers links with message_binding/2 and a selected source decision. The original modern join still chooses the links and preserves their multiplicity; the outer source filter still distinguishes decisions sharing a message handle. The complete legacy UNION ALL arm, outer request/source selectors, ordered output and LIMIT remain intact. Membership still spans the whole run, so produced answers include later requests in other turns. Numbered placeholders reuse the existing run and decision parameter slots: the binding count remains one run ID, the selected request and decision IDs, and an optional limit. This statement-local SQL filter adds no retained cache and preserves every occurrence's comparison, deadline and diagnostic evaluation.

Within _turn_facts, the already-owned request_info result is passed as private witness_info through witness and relation validation for the current request. Reuse requires both run and witness-event identity to match; other witnesses use the normal request lookup. The value is not admitted to the Context cache or retained across requests.

Check aggregates and navigation/explanation totals consume their complete relevant retained populations, including occurrence comparisons and diagnostics, before presentation limits. Those completed totals remain exact for retained facts. Slice and SQL have explicitly bounded traversals/results. A deadline or storage error never promotes a partial aggregate to a successful complete total. Attribution follows explicit identities. Missing observations, invalid bindings, unsupported representations and traversal cutoffs remain visible.

fr snapshot independently probes the source read-only and creates its SQLite backup in a private same-parent staging directory. It finalizes, reopens and verifies the staged DELETE database, prepares the result and closes the source before creating any public output. A single exclusive hard link publishes the verified main without overwriting a competing file. A sidecar visibly present immediately after link success causes recording_unreadable/destination_finalize rather than a false verified-success status, and the published main may already exist; this best-effort observation is not an atomic multi-path lock. Failures/interruption remove only private staging files: public main and sidecar paths are never cleanup targets. Snapshot does not use the capture writer or write its source. It preserves source state and does not repair, resume or modify a recording. A portable copy of an incomplete run remains incomplete.

Module loggers under mcp_flightrecorder report recorder lifecycle, capture loss, writer failure, adapter evidence loss, inspection failure and snapshot outcomes. The package installs only a NullHandler; applications own levels, handlers and destinations. No recording payload, path, tool/client name, SQL, raw exception or traceback is passed to logging.

Capture has one receipt/logging boundary after preparation and admission. The recorder claims each fixed loss category once under its condition, then emits outside that lock. Repeated public close/finalize results are suppressed until the result changes. Adapters reuse the existing per-invocation loss deduplication. Readers release their transaction before logging; snapshot cleanup completes before its final outcome is reported. A shared small emitter contains ordinary handler/filter exceptions. It does not add a queue or background worker.

Internal storage verification is a DEBUG event; only the public joined-owner result reports portability. A portable but incomplete recording still produces a warning. Reader and snapshot SQLite failures use one shared translation function, preserving deadline precedence. The capture contract describes synchronous handler ownership and application configuration.

The source tree contains current library modules, short end-user examples, test-owned recording producers under tests/producers/, tests, small declarative JSON inputs, requirements and documentation. Tests exercise the installed capture, inspection and snapshot implementations. Independent fixture expectations and canonical SQL assertions live in the normal pytest suite, with six plain shared functions in tests/fixture_checks.py. Tests generate their SQLite fixtures under temporary directories. Generated recordings, logs, reports, experiment outputs, dependency wheels, caches and historical handoffs are excluded. Testing describes the separate dependency profiles.

A committed tree is exported into a pristine directory and checked against tools/public_files.txt. A separate build copy produces the wheel and sdist; tools/check_package.py validates their actual members, metadata, license files and schema against that source. Temporary negative controls exercise refusals without entering the repository. Fresh virtual environments install the wheel normally, and smoke checks verify the import origin before using the CLI and public API outside the source tree. A fresh sdist extraction is rebuilt and installed to check source completeness.

The read-only GitHub Actions workflow runs the 19-module SDK-free selection on Linux CPython 3.11 and 3.14, plus the separate ten-module main integration selection on CPython 3.14. Each suite has its own environment and four workers. The core 3.11 job also rebuilds and installs the sdist. These are configured checks, not a claim of observed hosted success; the workflow does not publish artifacts or packages. Testing documents the commands and limits.

Staged publication

The manual publish.yml workflow admits main-only validate-only or explicit staged-release dispatch with a full reviewed commit, version 0.5.16 and planned tag 0.5.16. Staged release additionally requires that bare tag to exist as an annotated tag at the approved commit. A clean source export builds one original wheel/sdist pair, with package guards, strict Twine, installed smoke and an sdist-rebuilt wheel comparison. Both modes store a flat candidate containing the pair, manifest.json and SHA256SUMS; source/workflow identity, exact main-push CI and artifact hashes remain bound to the run.

Validate-only ends after candidate storage. Staged publication promotes the same bytes through the testpypi, pypi and github-release environments. A release reviewer inspects this run's candidate before TestPyPI approval; PyPI follows TestPyPI download/install verification and a second environment approval. GitHub draft/published-state verification follows PyPI download/install verification. Identity is rechecked after waits. Only proven identical existing files permit partial resume; conflicts stop without deleting, replacing or retagging public state. These are configured release paths, not an observed publication claim. Releasing contains exact setup and operator steps.

Configured release flow; all staged jobs use the same four-file candidate.

Model facades bind the selected native signature at invocation; MCP facades expose fixed method signatures. Each invocation claims a fresh ModelEvidence or OperationEvidence and fixes scope before returning deferred work. Native MCP argument validation still occurs when the native method executes. Wrong/reused evidence is a caller error before native execution. These objects hold receipts and bounded losses rather than duplicate payloads. Projection and policy happen at execution; never-awaited work creates no observation, native call or reservation. M04 and M05 display the two lifecycles.

MCP attribution is an accepted observed dispatch scope (host_hook), otherwise an explicit valid decision receipt (propagated), otherwise none. Invalid attribution records loss rather than guessing. Default model role=tool annotations remain unresolved (binding_not_supplied) even when a provider tool-call ID is present. Explicit host annotations/insertions supply ancestry.

MCP native results/errors distinguish ok, tool error, protocol error, timeout, transport error, cancellation and local error. Only an admitted start with a ticket permits a terminal attempt. Facades retain resolution="unknown" and input_rounds=None; cache options do not prove hits. They do not observe wire request IDs or split SDK-internal retries, sampling, elicitation or progress into independent events. Host-observed cache use enters the explicit core API.

The stream accumulator has two independent 1,048,576-byte pools for encoded raw chunk projections and pending tool ID/name/argument fragments across all keys, with at most 64 choices and 64 lifetime tool keys. Emission or unsupported-tool discard releases only fragment bytes; emitted keys still occupy their lifetime positions. Raw overflow closes body retention and makes the aggregate partial while selection inspection continues on the overflow chunk and later host-consumed chunks. Later full raw projections are not serialized again, but trusted projection, validation and fragment admission continue. A fully observed tool can remain complete and emit before its finishing native chunk is returned. Fragment/cardinality overflow keeps the conservative selection stop. Actual projection gaps mark pending and subsequent tool fragments partial; already-emitted decisions are not revoked, and later retained raw observations need not be a contiguous native prefix. At ordinary finalization, remaining supported or provisional tool occurrences emit incomplete decisions; explicitly unsupported tool types are discarded. Finalization clears both pools and their counters. The combined bound is 2,097,152 retained encoded buffer bytes, plus bounded container/object overhead. It does not bound native chunk size, transient projections, assembled payloads, all capture memory, callback time or process RSS.

The host drives every read and cleanup. EOF is complete only with finished choices and no partial-source condition; native error/cancellation and early close retain their own states. Early close forwards native cleanup and records the consumed aggregate as partial, error or cancelled according to the cleanup outcome, without draining. Abandoned streams receive no automatic cleanup. Ordinary terminal observation is guarded once; policy process-control interruption has the limits documented in §6.

Retention is selected separately for each request, decision and response/consumed aggregate. Redacting a decision does not redact its other representation in the response or stream aggregate. Default None or unavailable MISSING performs no callback. A configured callback gets detached values; its returned mapping is detached and validated. Ordinary callback/validation failures, including callback-raised cancellation, select fixed omission plus one bounded loss. Other process-control exceptions propagate. Metadata capture overrides body retention. Full supported signatures remain in Integrations.