Step journals: replay recorded decisions without rerunning the outside world

A proposed journal can append intent, dispatch, result-observed, effect-confirmed, approval, budget, and terminal events with stable identities. Define which transitions share a storage transaction and which merely follow one another. Append corrections or reconciliation findings instead of silently rewriting an old success into a failure. Include logical step, attempt, incarnation, expected revision, contract version, and references to the relevant inputs and outputs. An application log line is not automatically a durable accepted event.

Store large artifacts through immutable versioned references with integrity metadata and an availability policy. A digest can detect a changed payload when compared against a trusted record, but it cannot recover a missing payload. Retention and access controls must cover the artifacts required for recovery. A redacted diagnostic trace and a complete execution record can serve different purposes. State what information is replay-critical and how its deletion or expiration changes the supported recovery window.

A model response is a nondeterministic external result for replay purposes. Preserve the actual response and its artifact identity, along with model, prompt, tool-schema, and decoding configuration. A fixed seed or zero temperature does not guarantee a future provider invocation returns identical bytes under changed infrastructure or model revisions. Likewise, wall-clock reads, random values, network lookups, and scheduler order need recorded inputs or workflow-safe APIs when they affect control decisions. Do not turn a replay into a new planning run silently.

Temporal's documented replay compares generated commands with its Event History under deterministic constraints. That is a concrete platform mechanism, not a promise that arbitrary application code can replay safely. Code changes need the platform's supported compatibility or versioning strategy. In the proposed journal design, define equivalent rules for reducer and schema evolution. A hash chain can assist integrity checking, but an untrusted actor able to replace the whole chain and its root is not defeated by hashes alone; use a trusted anchor and access policy.

If the journal contains a tool intent but no confirmed outcome, determine whether dispatch occurred and whether the provider can resolve the logical operation. Use a stable idempotency key, provider receipt lookup, conditional resource state, or another implemented reconciliation path. Replaying a recorded completion should not repeat its external write. Retrying an unresolved intent with a new identity can create a duplicate. Test crashes before dispatch, after provider commit, and before journal append rather than assuming the same handler exception covers every window.

The cache lab models only the performance of retaining a small working set. Reset, set C=3 and s=4, predict zero initial hits in sixteen requests, then Play or Step. Separately Reset, set C=4 and s=4, predict twelve, then Play or Step. A workflow state cache can reduce reconstruction work, but this toy LRU stream has no journal or durable storage. Evicting a cache entry is different from losing its authoritative history; validate replay from the durable record even after every in-memory entry is gone.