feat: expose cleanup and reporting outcomes for gateway runs

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/harness-contract.md

@@ -144,3 +144,28 @@ The contract does not schedule work, source blueprints, allocate workers,
 resolve leadership, broker credentials, select an unapproved model by price, or
 standardize rein internals. Composable rein middleware remains deferred by
 ADR-004 until a second concrete need exists.
+
+## Cleanup and reporting outcomes (GLAS-WP-0013)
+
+`ExecutionEvidence.session_cleanup` and `sandbox_destroy` independently report
+`not_attempted`, `succeeded` or `failed`. If execution fails and cleanup also
+fails, the original failure stage/error remains primary and both teardown
+outcomes remain visible. Destroy is attempted even after cleanup failure.
+A teardown failure following successful execution makes the run unsuccessful.
+A successful method return is the owner's reported result, not an additional
+filesystem/process verification by the gateway.
+
+`GatewayResult.hub_report_status` reports `not_requested`, `accepted` or `failed`
+to the direct caller (including CLI JSON). `accepted` means the progress HTTP
+request returned successfully. It does not guarantee durable audit storage or
+exactly-once delivery. A timeout may occur after the server accepted a request;
+`failed` means acknowledgement was not obtained. Reporting failure does not
+rerun the agent or change its execution outcome. There is no automatic retry
+or durable outbox. The status is outside ExecutionEvidence because it is known
+only after the evidence report is attempted.
+
+These are additive defaulted fields in the current contract models. Old records
+without them load as `unknown`, rather than implying that cleanup or reporting
+occurred. Consumers using older strict schemas must update to accept these
+fields before consuming new serialized results. No profile pins or readiness
+states change with this addition.