Make a run say what it did without

[shanev]

Why

Several boundaries deliberately refuse to let a host-supplied callback end a run — a broken logging sink must not destroy a user's work. That resilience is correct. It was paid for with a warnings.warn that reaches no consumer of the result.

Demonstrated before this change — a sink that raises once, mid-stream:

sink invocations: 4
events actually delivered: 3
journal length (events that happened): 4
ledger believes emitted: 4
warnings: ['budget event sink failed: RuntimeError: transient …']
LOST EVENTS: 1

The event is gone, the ledger believes it was delivered, and every consumer sees a stream that is simply one event short. A run that lost an event, ran its terminal extract without host context, or discarded salvageable work returned something byte-identical to a clean run.

What

RunDegradation — site, error_type, detail, and consequence, the last recording not that a callback raised but what the run then did without:

site	consequence
budget_event_sink	a budget event was produced but never delivered
extract_context_provider	terminal extract ran without host-held observations
extractable_work_probe	run treated as having no salvageable work; extract skipped

Exposed on RLMResult.degradations and — via Trace ABI v9 → v10 — on the result event, so a host across the wire sees it too. BudgetLedger.dropped_events() exposes the same facts for a directly-held ledger.

Empty on a clean run and always present: absence must never be how a consumer learns nothing was lost. droste_runner emits degradations: [] on every response shape for the same reason.

Nothing new can end a run. The fallbacks are unchanged; only their silence is.

On the ABI bump

The nested result payload is a closed schema despite a comment claiming it "keeps its own schema authority" — adding the field is necessarily an ABI change. TS treats the nested result as opaque, so the relay needed only the envelope bump.

Verification

1268 passed, 3 skipped; 65 Deno tests. Includes an end-to-end test asserting a recorded degradation actually arrives on the emitted result event — recording something the host never receives would be the same defect one layer up.

🤖 Generated with Claude Code