ADR 0299: Checkpoint read surfaces mirror the gate without effects

Status: accepted; builds the read surface of ADR 0293's contract on the governing policy of ADR 0294, the when boundary of ADR 0296, and the evidence bindings of ADR 0298

The interlock exists but could only be experienced by colliding with it: the first sighting of a question was the done refusal, and the only account of an effort's declaration state was inside a gate run. Agents needed the questions early in the inner loop, and owners needed one command answering what governs, what state the effort is in, what would fire, and which declared-unmet conclusions still await a variance. Every candidate surface is a read — and a read that executed project code, wrote an open question, or disagreed with what done would actually do would be worse than none.

Checkpoints get one strict-obligation inspection, projected everywhere, and one read verb that reports the state done and accept would act on — with no effect of any kind.

• One inspection, many projections. inspectCheckpointObligations joins the governing policy, current structural outcomes, readable persisted open questions, projected subject currency, and declarations into one decision state per governing checkpoint. Plan notes for done --dry-run, advisory hints for prepare and status, report rows for discern checkpoints, and the strict preflight all consume that inspection. Structural preview remains evidence beside the decision; it is not the decision itself.
• Persisted questions outrank idle triggers. A trigger opens an open question but does not own its lifetime. Once a governed stop question is readable in the effort store, a later structural veto or passing when cannot retract it. The inspection therefore projects that question as awaiting, reopened, declared met, or declared unmet even while its current structural preview is idle. A settled structural fire without a stored question projects will_open; an ungoverned historical question remains visible but does not interlock.
• discern checkpoints is the contract's detailed read surface — CLI, --json, --markdown, and MCP discern_checkpoints, one shared core. It reports the governing policy (question, trigger summary, mode, policy identity), each row's canonical obligation, the structural preview, open-question evidence, and any recorded open question the governing policy does not contain. The envelope is always ok: this is an account of state, and every uncertainty (unresolvable policy, unreadable diff or store, a pending when, a subject that cannot be computed) projects unknown with an advisory or “may require” account rather than a refusal.
• Declaration currency mirrors gate reconciliation. Every readable governed open question gets its current definition hash and subject fingerprint recomputed read-only, including one whose trigger is now dormant. A differing binding projects reopened with declaration.current: false; a matching binding carries its recorded conclusion. A pending when that could change a standing conclusion's subject stays unknown because a read surface never executes project code.
• Strict execution inspects, then reconciles once. Bare done begins from the same inspection, resolves any pending when, and performs the existing open-question and declaration writes once. The pure active-state classifier is shared by the read projection and mutating preflight, while invalid declaration requests remain all-or-nothing.
• The read surface routes, it never authorizes. An awaiting question is routed to the two valid done conclusions (--met, or --unmet --why); a current declared-unmet conclusion is routed to the owner's variance review at accept. No read surface presents --variance as work the agent performs.
• Observed economics stay outside the decision. observedCheckpointEconomics reads the Logbook through one named seam. Its counts may inform policy review, but never feed an obligation or refusal.

• An agent learns of a coming or already-open declaration at prepare time and can judge the question while the change is hot; the done refusal becomes confirmation, not news.
• A conclusion the next gate run would unbind is never reported as standing, even after the structural trigger becomes idle — at the cost of a few extra read-only Git operations per governed open question.
• prepare and status each gained a small fixed number of Git reads (merge-base, governing config, effort diff) even in checkpoint-free projects; a checkpoint-free effort still renders zero additional output.
• The preview cannot see through when: a when-gated checkpoint previews as "may require" rather than a certainty, which is the honest limit of a surface forbidden to execute project code.

• Let structural preview define the obligation. Rejected: a trigger opens a question but cannot close it, so an idle preview may coexist with a persisted question strict done must still interlock.
• Report the store's own currency untouched. Rejected: after a relevant edit, the store can still claim a conclusion that the next done will unbind — precisely the wrong answer to "what state is my effort in".
• Run when commands in the read verb for an exact preview. Rejected: read verbs run none of the project's commands — a guarantee documented to users — and the when boundary already makes execution a gate-time act.
• A per-surface preview computation. Rejected: three independently-evolved previews is how prepare, status, and --dry-run come to disagree about what fires.
• Ship a placeholder economics block in the wire schema now. Rejected: the observation workstream owns the event vocabulary; a guessed shape would either constrain it or ship dead wire fields. The named function seam defers the shape to the work that defines it.