ruby_reactor 0.8.4 → 0.8.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 325464f0f2b9ee374b1267a4c7243121c9b564814d425bfa5ecce59891979468
-  data.tar.gz: 996363b210d54be36ac7065532aac6c0349334b18d8d14816896debd4e8993c4
+  metadata.gz: a4187fd51277447b11381c872a01b46d8e7663323b5b470316d8600ead76906e
+  data.tar.gz: 540b0c6b94d007a020f3bfbb3ff035eb47469691bf138cd41588e5a6a28ba468
 SHA512:
-  metadata.gz: 3fcbdbe30cce51beec8dd715c543c8db15140de630d94ec3ae01a7ba803d28cb88f44e0ce1ee97c232cbed34863d81b8c4d0ed979f44acf52a27cfbc07f31b04
-  data.tar.gz: 946f4082ec39691d47e35983b9466a128246159f0b191aca061d6c984e2340cabd09da8e111e92b4799ec97a8f4e9753826163e97df48424b3a1583abe40afbc
+  metadata.gz: 59c5faa4c755625a2172a5a7613941a82970aa3b52ac170f6c2f12015f41b289700d320d0195b51d4b13e1cf1f9b86e209bc8c59d5dcc84830a2e65c1c49a48d
+  data.tar.gz: 0be05ffe9539a5ae4c012a8f8e3f26394d27853a86219a7c02d82d9685f7f018bd760c26f749cf34c4899f0c9346c6a54a91ee64e0e274b2f2ad2d12048ee818

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.8.4"
+  ".": "0.8.5"
 }

data/.specify/feature.json

@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/006-step-retry-declarations"
+  "feature_directory": "specs/008-rollback-reliability"
 }

data/CHANGELOG.md

@@ -4,6 +4,54 @@
 
 ### ⚠ BREAKING CHANGES
 
+* **`retries` on a `compose` or an `async_reactor` raises `RubyReactor::Error::DeprecatedDslError`
+  at class definition.** A parent never retries a nested reactor as a whole: the child retries its
+  own steps. Before, a compose-level retry resumed a child whose earlier steps had already been
+  undone. Declare `retries` on the child's steps instead.
+  See *Migration notes: reliable rollback* below.
+* **`where` and `guard` are removed.** Declaring either on a `step`, `async_step` or `interrupt`
+  raises `RubyReactor::Error::DeprecatedDslError` at class definition. A step that should not run
+  returns `Skipped(value)` (or calls `skip!(value)`) from its body.
+  See *Migration notes: reliable rollback* below.
+* **`Skipped` no longer changes execution.** It is an instrumentation mark (the trace records it;
+  `skipped?` is true): a `background after:` step that returns `Skipped` now hands the rest of
+  the run off like any completed step (before, the rest ran in the calling process), and a
+  `with_period` step whose body returns `Skipped` marks its bucket. A skipped step is still never
+  undone.
+* **An exception that is not a `StandardError` fails the step and rolls back.** A
+  `NotImplementedError`, a `LoadError`, a `SystemStackError` or a custom `Exception` subclass
+  raised by reactor code (a step body, an argument transform, a `compensate`/`undo`, a key proc, a
+  `collect` block) is now that step's failure: the step is compensated if its body ran, completed
+  steps are undone, and `Reactor.run` returns the `Failure` instead of raising. Only interruptions
+  (`SignalException` including `Interrupt`, `SystemExit`, `NoMemoryError`, and an enclosing
+  `Timeout.timeout`'s interruption) still skip rollback and propagate.
+  See *Migration notes: reliable rollback* below.
+* **An `async_step`'s `compensate` runs, in the unit's own job, when its final attempt fails.**
+  Before, `compensate`/`undo` blocks on an `async_step` were accepted and never ran. Now the unit
+  compensates itself once, after its last retry, whether or not any step reads its result —
+  never for a retried attempt, a halt, or a body that never started. The outcome is recorded on
+  the unit's Step Result Record as `compensation: { status, rollback_failures, completed_at }`,
+  and the compensation middleware events fire in the unit's job. A reader that surfaces the
+  failure no longer leads to a second compensation of the unit.
+  See *Migration notes: reliable rollback* below.
+
+* **An inline `undo` inside `async_step` raises `RubyReactor::Error::ValidationError` at class
+  definition.** An independent async unit is never undone, so the block could never run. A step
+  class that defines `undo` and is used with `async_step` prints a definition-time warning
+  instead (the same class may be reused by ordinary steps, where its `undo` runs).
+  See *Migration notes: reliable rollback* below.
+* **A map rolls back the elements that completed.** When a map fails (an element fails under
+  `fail_fast`, or `collect` raises), and when a later step fails or the run is undone manually,
+  every completed element is rolled back by replaying its own step `undo`s, highest index first —
+  in inline and fan-out mode, whatever order the element jobs ran in. Before, completed elements
+  were never rolled back. A fail-fast fan-out map now waits for elements already in flight before
+  it reports its failure, and settles the elements it never started as skipped (which also stops
+  the map sweeper re-dispatching them). An element rollback that does not complete is listed in
+  `Failure#rollback_failures` with `map_step:` and `element_index:`; an element whose context
+  (or the map's element index) expired is reported with `reason: :context_unavailable`, and a
+  still-running duplicate with `reason: :element_in_flight`. A fan-out map whose rollback is
+  incomplete fails with the same `CompensationError` shape as an inline map.
+  See *Migration notes: reliable rollback* below.
 * **`RubyReactor::Step` is now a base class, not a mixin.** `include RubyReactor::Step` on a
   plain class with `def self.run(arguments, context)` is gone — no compatibility shim, no dual
   authoring style. A step subclasses `RubyReactor::Step` and writes `run` (and optionally
@@ -78,8 +126,130 @@
   `RubyReactor.Failure`, and a hash error needs braces, `Failure({ code: 1 })`, because a braceless
   `Failure(code: 1)` is now read as options.
 
+
+### Migration notes: reliable rollback
+
+Every breaking or shape-changing item of the rollback work, with what to change.
+
+1. **Map element `undo`s now run** (breaking, behavior). They run when the map fails, when a later
+   step fails, and on a manual `Reactor.undo(id)`. Make them idempotent.
+
+   ```ruby
+   # Before: this undo never ran for a map element; charges stayed on a failure.
+   # After: it refunds each charged element, highest index first. Guard against a double refund.
+   class ChargeStep < RubyReactor::Step
+     def undo
+       Payments.refund(result[:charge_id]) unless Payments.refunded?(result[:charge_id])
+       Success()
+     end
+   end
+   ```
+
+2. **An `async_step`'s `compensate` now runs in the unit's job** (breaking, behavior), once, after
+   its final attempt fails, whether or not a reader exists. Move reader-only cleanup into the
+   reader.
+
+   ```ruby
+   # Before: never ran.
+   async_step :notify, NotifyStep do
+     compensate { |error, inputs, _ctx| Audit.undelivered(inputs.user_id, error) }
+   end
+   # After: runs in the unit's job after the last retry; the outcome is on the unit's record
+   # as `compensation`. Cleanup that should run only when a reader fails the reactor:
+   step :confirm do
+     argument :delivery, result(:notify)
+     run { |inputs, _ctx| inputs.delivery.is_a?(RubyReactor::Failure) ? Failure("undelivered") : Success() }
+     compensate { |_error, _inputs, _ctx| Support.open_ticket }
+   end
+   ```
+
+3. **An inline `undo` inside `async_step` raises at class definition** (breaking, API).
+
+   ```ruby
+   # Before: accepted, never ran.
+   async_step(:notify) { run { ... }; undo { ... } }
+   # After: raises RubyReactor::Error::ValidationError. Use the unit's `compensate`, a reader's
+   # `compensate`, or an `async_reactor` child whose steps declare `undo`.
+   async_reactor :notify, NotifyReactor   # NotifyReactor's steps declare `undo`
+   ```
+
+4. **`retries` on `compose` / `async_reactor` raises at class definition** (breaking, API). Move
+   the retries onto the child step that can fail transiently. The child retries it itself; the
+   other child steps run once.
+
+   ```ruby
+   # Before: retried the whole child from the parent.
+   compose(:booking, BookingReactor) { retries max_attempts: 2 }
+   # After: raises RubyReactor::Error::DeprecatedDslError. Declare it on the child's step:
+   class ConfirmBookingStep < RubyReactor::Step
+     retries max_attempts: 2
+   end
+   compose :booking, BookingReactor
+   ```
+
+5. **`where` / `guard` are removed** (breaking, API). Skip from the step body. Unlike `where`,
+   the body decides after the step started: its arguments are resolved and validated (a step
+   that relied on `where` to avoid invalid arguments now fails on them), and its lock, semaphore
+   and rate-limit slot are taken first. A `background before:` hand-off at that step now always
+   fires; the body decides in the worker.
+
+   ```ruby
+   # Before
+   step :sync_user do
+     where { |ctx| ctx.get_input(:enabled) }
+     run { |inputs, _ctx| Success(sync!(inputs.user)) }
+   end
+   # After
+   step :sync_user do
+     run do |inputs, ctx|
+       next Skipped(nil) unless ctx.get_input(:enabled)
+       Success(sync!(inputs.user))
+     end
+   end
+   ```
+
+6. **Non-`StandardError` exceptions from reactor code roll back** (breaking, behavior). They no
+   longer propagate out of `Reactor.run`; check the returned `Failure` instead. A test assertion
+   error raised inside a step body (an RSpec expectation, a strict double) now surfaces as the
+   step's `Failure`, so assert on the result.
+
+   ```ruby
+   # Before: NotImplementedError propagated; nothing was undone; the run was stored `aborted`.
+   # After:
+   result = MyReactor.run(inputs)
+   result.failure?         # => true, completed steps undone
+   result.exception_class  # => "NotImplementedError"
+   ```
+
+7. **Argument and unknown errors roll back and carry `step_name`** (fix). The Failure's
+   shape changes on these paths.
+
+   ```ruby
+   # Before: "Execution failed: invalid value for Float(): 'abc'", step_name nil, nothing undone.
+   # After: "Step 'charge' failed: Step 'charge' could not resolve its arguments: …",
+   #        step_name :charge, exception_class "ArgumentError", completed steps undone.
+   result.step_name        # => :charge
+   result.exception_class  # => "ArgumentError"
+   ```
+
+8. **New `aborted` status** (additive), only for runs in the caller's process cut short by an
+   interruption. Dashboards and status filters gain a value; an `aborted` run needs
+   `MyReactor.undo(id)` to roll back.
+
+9. **`rollback_failures` entries may carry `map_step:` / `element_index:`** and the reasons
+   `:context_unavailable` / `:element_in_flight` (additive).
+
 ### Features
 
+* **`aborted` execution status.** A run in the caller's process that an interruption
+  (`SignalException` including `Interrupt`, `SystemExit`, `NoMemoryError`, or an enclosing
+  `Timeout.timeout`) cuts short runs no rollback code: the exception reaches the caller unchanged,
+  and the run is stored as `aborted` with only the steps not yet undone still outstanding (an
+  interruption during a rollback keeps exactly the rest, whichever failure started that rollback).
+  Workers and the sweeper never resume it; `Reactor.undo(id)` rolls it back, including the steps a
+  composed child or the elements of an inline `map` completed when the interruption hit inside
+  them. The dashboard and web API show and filter it, next to `failed`. A worker run is unchanged
+  (its job is redelivered).
 * **Step-scoped coordination.** Steps can declare `with_lock`, `with_semaphore`, `with_rate_limit`,
   `with_period`, and `with_ordered_lock` — the same macros as the reactor form, keyed on the step's
   own resolved arguments instead of the reactor's inputs — so one step of a workflow can be
@@ -140,6 +310,25 @@
 
 ### Bug Fixes
 
+* `Reactor.continue` accepts a resume only while the reactor is paused at an interrupt. A resume
+  that arrives while the reactor is executing or rolling back, or after it finished or was
+  aborted, raises `RubyReactor::Error::ValidationError` and changes nothing. Before, it resumed the
+  run from its stored state, which could run a rolled-back or aborted run forward again. An
+  accepted resume marks the run `running` before executing, so a concurrent second resume fails.
+  A resume that cannot take the reactor's lock or semaphore raises its `AcquisitionError` and
+  leaves the run paused, so the caller can retry it.
+* A `background after:` step that returns `Halt` no longer hands the rest of the run to a worker:
+  the run halts, as `Halt` promises. Before, the remaining steps ran in a worker.
+* A stored `Failure` keeps at most 100 backtrace frames, plus a `"... N more frames"` line. A stack
+  overflow's backtrace no longer inflates the stored context (about 2.4 MB to 23 KB).
+* Every error after a completed step now rolls back, and the failure names its step. An `argument`
+  source, `transform` or result path that raises fails the step with
+  `RubyReactor::Error::ArgumentResolutionError`: completed steps are undone, the step is neither
+  compensated (its body never started) nor retried, and the Failure carries `step_name`,
+  `reactor_name` and the original `exception_class`. Before, an argument error rolled nothing back
+  and carried no step. The same holds in a worker (an `async_step` unit, a `background` hand-off).
+  Any other exception raised outside a step body ("Execution failed: …") now rolls back completed
+  steps too, and a failure whose compensation raised ("Execution error: …") carries `step_name`.
 * A supplied `false` reactor input or step result no longer resolves to `nil`.
   `Context#get_input`, `Context#get_result` and `Template::Result#fetch` now check whether the key
   exists instead of whether the value is truthy. Code that relied on `false` arriving as `nil`
@@ -204,6 +393,13 @@
 * Docs: a park keeps each level's lock without a second `:lock_acquired` only while the gap stays
   within the lock's `ttl`; a lapsed lock is acquired again.
 
+## [0.8.5](https://github.com/arturictus/ruby_reactor/compare/v0.8.4...v0.8.5) (2026-09-30)
+
+
+### Miscellaneous Chores
+
+* Execution flows improvements and consolidation ([#65](https://github.com/arturictus/ruby_reactor/issues/65)) ([21a4c59](https://github.com/arturictus/ruby_reactor/commit/21a4c59fa13c0e7e66c8e08ccb5f20ea43875353))
+
 ## [0.8.4](https://github.com/arturictus/ruby_reactor/compare/v0.8.3...v0.8.4) (2026-09-26)
 
 

data/CLAUDE.md

@@ -1,5 +1,5 @@
 <!-- SPECKIT START -->
 For additional context about technologies to be used, project structure,
 shell commands, and other important information, read the current plan
-at specs/006-step-retry-declarations/plan.md
+at specs/008-rollback-reliability/plan.md
 <!-- SPECKIT END -->

data/README.md

@@ -13,7 +13,7 @@ A dynamic, dependency-resolving saga orchestrator for Ruby. Ruby Reactor impleme
 
 Building complex business transactions often results in spaghetti code or brittle "god classes." Ruby Reactor solves this by implementing the **Saga Pattern** in a lightweight, developer-friendly package. It lets you define workflows as clear, dependency-driven steps without the boilerplate of heavy enterprise frameworks.
 
-The key value is **Reliability**: if any part of your workflow fails, Ruby Reactor automatically triggers compensation logic to undo previous steps, ensuring your system never ends up in a corrupted half-state. Whether you're coordinating microservices or monolith modules, you get atomic-like consistency with background processing built-in.
+The key value is **Reliability**: if any part of your workflow fails with an error, Ruby Reactor automatically triggers compensation logic to undo previous steps, ensuring your system never ends up in a corrupted half-state. Only an interruption (a signal, an exit, out of memory) runs no rollback code; the run is recorded as `aborted` so a manual `undo` can roll it back. Whether you're coordinating microservices or monolith modules, you get atomic-like consistency with background processing built-in.
 
 ## Features
 
@@ -22,7 +22,7 @@ The key value is **Reliability**: if any part of your workflow fails, Ruby React
 - **Async Steps & Reactors**: `async_step` and `async_reactor` dispatch independent units of work while the reactor keeps running; steps that read their result wait for it.
 - **Map & Parallel Execution**: Iterate over collections in parallel with the `map` step, distributing work across multiple workers.
 - **Retries**: per-step retry policies (declared on the step class or step block) with exponential, linear, or fixed backoff.
-- **Compensation**: Automatic rollback of completed steps when a failure occurs.
+- **Compensation**: Automatic rollback of completed steps when any error occurs after them, including a raising argument transform or an exception that is not a `StandardError`.
 - **Interrupts**: Pause and resume workflows to wait for external events (webhooks, user approvals).
 - **Input Validation**: Integrated with `dry-validation` for robust input checking.
 - **Distributed Locks, Semaphores, Rate Limits, Periods & Ordered Locks**: Coordinate across processes with Redis-backed primitives — exclusive locks for at-most-one-runner, semaphores for capacity caps, fixed-window rate limits for external APIs (single or multi-window like "3/sec AND 100/min"), `with_period` to dedup reactors to once per calendar bucket, and `with_ordered_lock` for strict transaction ordering via a monotonically increasing nonce assigned at enqueue. Background jobs snooze on contention with smart `retry_after` instead of consuming retry budget.
@@ -32,7 +32,7 @@ The key value is **Reliability**: if any part of your workflow fails, Ruby React
 | Feature                  | Ruby Reactor | dry-transaction | Trailblazer | Custom Sidekiq Jobs |
 |--------------------------|--------------|-----------------|-------------|---------------------|
 | DAG/Parallel execution   | Yes          | No              | Limited     | Manual              |
-| Auto compensation/undo   | Yes          | No              | Manual      | Manual              |
+| Auto compensation/undo   | Yes (steps, compose, map; async units roll back on their own) | No | Manual | Manual |
 | Interrupts (pause/resume)| Yes          | No              | No          | Manual              |
 | Locks / sem / rate / per | Yes          | No              | No          | Manual              |
 | Built-in web dashboard   | Yes          | No              | No          | No                  |
@@ -237,7 +237,7 @@ Whichever style you use, a step's `run` returns one of four signals — all expo
 - **`Success(value)`** — step succeeded; `value` flows to dependent steps.
 - **`Failure(error)`** — step failed; the reactor rolls back completed steps (compensate/undo).
 - **`Halt(reason:)`** — clean halt: stop the reactor, keep partial progress, **no rollback**. See [Halting a reactor cleanly](documentation/core_concepts.md#halting-a-reactor-cleanly).
-- **`Skipped(value)`** — mark this one step skipped; the reactor continues and `value` flows to dependants exactly like `Success`. See [Skipping a single step](documentation/core_concepts.md#skipping-a-single-step).
+- **`Skipped(value)`** — mark this one step skipped. The run continues exactly as for `Success` — `value` flows to dependants — and the step is never undone; the execution trace marks it skipped. See [Skipping a single step](documentation/core_concepts.md#skipping-a-single-step).
 
 One-line helpers end a step immediately from any call depth: `success!(value)`, `fail!(error, retry: true)`, `halt!(reason:)`, `skip!(value)` — equivalent to `return`ing the matching signal, usable in `run`, `compensate`, and `undo` bodies.
 
@@ -544,10 +544,14 @@ time. On success the reader gets the raw value; on failure it gets the
 
 **Compensation is opt-in.** If a dispatched step fails and nothing reads its
 result, the reactor is not compensated — it was dispatched precisely so the
-reactor would not depend on it. A reader that returns `Failure` triggers
-compensation normally. The independence cuts both ways: async dispatches never
-enter the parent's undo stack, so a parent rolling back for its own reasons
-never "undoes" a unit that runs (and may still succeed) elsewhere.
+reactor would not depend on it. The unit's own `compensate` does run: once, in
+the unit's job, after its final attempt fails, recorded on the unit's record as
+`compensation`. A reader that returns `Failure` compensates itself and undoes the
+reactor's completed steps; the unit is not compensated again. The independence
+cuts both ways: async dispatches never enter the parent's undo stack, so a
+parent rolling back for its own reasons never "undoes" a unit that runs (and may
+still succeed) elsewhere. An inline `undo` on an `async_step` would never run, so
+it raises at class-definition time (a step class's `undo` is warned about).
 
 #### `async_reactor`: a whole nested reactor, running independently
 
@@ -850,7 +854,7 @@ step :ensure_active do
 end
 ```
 
-To skip a *single* step while the reactor continues — the step did nothing, but the rest of the workflow should still run — return `Skipped(value)` instead. The value flows to dependants exactly like a `Success` value, and the step is not enrolled for rollback:
+To mark a *single* step as having had nothing to do — the rest of the workflow runs as usual — return `Skipped(value)` instead. `Skipped` is only an instrumentation mark, so an engineer reviewing the execution can see the step did not need to run. It never changes how the run executes: the value flows to dependants, and a `background` hand-off and a `with_period` bucket treat it as a completed step. A skipped step had nothing to do, so it is never undone. (`where`/`guard` were removed; skipping from the body is the only way.)
 
 ```ruby
 step :maybe_sync do
@@ -893,6 +897,14 @@ A `fan_out` map is a **hand-off point**: the reactor stops at the map (the calle
 
 By using `fan_out` with `batch_size`, the system applies **Back Pressure** to efficiently manage resources. [Read more about Back Pressure & Resource Management](documentation/data_pipelines.md#back-pressure--resource-management).
 
+**Rollback.** A map rolls back like a composed reactor, with no map-level rollback DSL: the `undo`s
+already declared on the element reactor's steps are each element's rollback. When the map fails
+(an element fails under `fail_fast`, or `collect` raises), and when a later step fails or the run is
+undone manually, every element that completed is rolled back, highest index first, in inline and
+fan-out mode alike. A fail-fast fan-out map lets elements already in flight finish before it reports
+the failure. Make element `undo`s idempotent. See
+[Rollback](documentation/data_pipelines.md#rollback).
+
 `batch_size` is optional: with `fan_out` alone, RubyReactor fans out one worker per element (defaulting the batch size to the full source size) and aggregates the outcomes into a `ResultEnumerator` — convenient for small collections, but with no back pressure. See [`fan_out` Without `batch_size`](documentation/data_pipelines.md#fan_out-without-batch_size).
 
 > **Breaking change:** `async true` inside a `map` block has been **removed** — it read like `async_step`/`async_reactor`, which dispatch independent units the reactor does not stop for. It now raises at class-definition time. The exact replacement is `fan_out` (`fan_out batch_size: N`).
@@ -1306,7 +1318,7 @@ end
 
 ### Error Handling and Compensation
 
-When a step fails, RubyReactor automatically undoes completed steps in reverse order, compensate only runs in the failing step and backwalks the executed steps undo blocks:
+When a step fails, RubyReactor automatically undoes completed steps in reverse order, compensate only runs in the failing step and backwalks the executed steps undo blocks. Composed reactors and maps are completed steps too: undoing one replays its child's (or each completed element's) own step `undo`s:
 
 ```ruby
 class TransactionReactor < RubyReactor::Reactor
@@ -1408,9 +1420,33 @@ result.rollback_failures
 ```
 
 `reason` is `:coordination_unavailable`, `:returned_failure`, or `:raised`; `kind`
-is `:undo` or `:compensate`. See
+is `:undo` or `:compensate`. An entry from a map element's rollback also carries
+`map_step:` and `element_index:`, and a map reports an element it could not roll
+back with `reason: :context_unavailable` (its stored context, or the map's element index, expired) or
+`:element_in_flight` (a duplicate of it was still running). See
 [Step Rollback](documentation/locks_and_semaphores.md#step-rollback).
 
+Every error after a completed step rolls back, not only a step body's failure.
+An `argument` source, `transform` or result path that raises fails that step
+with `RubyReactor::Error::ArgumentResolutionError`. The step is not compensated
+(its body never started) nor retried; completed steps are undone. The Failure names the
+step, and `exception_class` reports the original error's class:
+
+```ruby
+result.step_name        # => :charge
+result.exception_class  # => "ArgumentError"
+```
+
+That holds for every exception, not only a `StandardError`: a step class that
+never implemented `run` (`NotImplementedError`) or a custom `Exception` subclass
+fails its step and rolls back the same way, and `exception_class` names it.
+
+Only an interruption (a signal such as `Interrupt`, `SystemExit`, `NoMemoryError`,
+or an enclosing `Timeout.timeout`) reaches the caller unchanged and runs no
+rollback code. A run in the caller's process is stored with status `aborted`,
+the steps not yet undone still outstanding; `MyReactor.undo(id)` rolls them
+back. A run in a worker is redelivered instead.
+
 ### Using Pre-defined Schemas
 
 You can use existing dry-validation schemas:

data/lib/ruby_reactor/dsl/async_macros.rb

@@ -137,9 +137,38 @@ module RubyReactor
         builder = RubyReactor::Dsl::StepBuilder.new(name, impl, self)
         builder.instance_eval(&block) if block_given?
 
-        steps[name] = builder.build(async_dispatch: :step)
+        config = builder.build(async_dispatch: :step)
+        check_async_step_undo!(builder, config, caller_locations(1, 1).first)
+        steps[name] = config
       end
 
+      # An async_step is never undone: its parent does not track it for undo
+      # (008 R-09/R-10), so an `undo` on it would be dead code. An inline one
+      # is rejected; a step class's is only warned about, because the same
+      # class is legitimately reused by ordinary steps, where it does run.
+      def check_async_step_undo!(builder, config, site)
+        if config.undo_block
+          raise RubyReactor::Error::ValidationError,
+                "`undo` on async_step :#{config.name} would never run: the parent never undoes an " \
+                "independent async unit. Put failure cleanup in the unit's `compensate` (it runs in the " \
+                "unit's job when its last attempt fails) or in the reading step's `compensate`; for cleanup " \
+                "that must run when the parent rolls back, use a `step`/`compose`/`map` (tracked for undo) " \
+                "or an `async_reactor` child whose steps declare `undo`."
+        end
+
+        return unless defines_undo?(config.impl)
+
+        builder.send(:warn_definition, site, nil,
+                     "async_step :#{config.name} uses #{config.impl}; its `undo` will not run for this async " \
+                     "use (async units are never undone).")
+      end
+      private :check_async_step_undo!
+
+      def defines_undo?(impl)
+        impl.is_a?(Class) && impl < RubyReactor::Step && impl.instance_method(:undo).owner != RubyReactor::Step
+      end
+      private :defines_undo?
+
       # Dispatch a whole nested reactor to run INDEPENDENTLY — linked
       # to this one by execution id for traceability, but excluded from its
       # compensation graph. Fire-and-forget unless a later step reads

data/lib/ruby_reactor/dsl/async_reactor_builder.rb

@@ -10,7 +10,6 @@ module RubyReactor
     # ordering nonce.
     class AsyncReactorBuilder
       include RubyReactor::Dsl::TemplateHelpers
-      include RubyReactor::Dsl::Retryable
 
       attr_accessor :name, :child_reactor_class, :argument_mappings
 
@@ -19,13 +18,23 @@ module RubyReactor
         @child_reactor_class = child_reactor_class
         @reactor = reactor
         @argument_mappings = {}
-        @retry_config = nil
       end
 
       def argument(child_input_name, source)
         @argument_mappings[child_input_name] = source
       end
 
+      # A parent never retries a nested reactor as a whole (008 R-14): the
+      # child owns its steps' retries. Kept as a stub to name the replacement.
+      def retries(*)
+        raise RubyReactor::Error::DeprecatedDslError.new(
+          "`retries` on an `async_reactor` has been removed: a parent never retries a nested " \
+          "reactor as a whole. Declare `retries` on :#{@name}'s child reactor's own steps " \
+          "(`retries max_attempts: 3` in the step block or the step class); the child retries them itself.",
+          step: @name
+        )
+      end
+
       def build
         RubyReactor::Dsl::StepConfig.new(
           async_dispatch: :reactor,
@@ -41,12 +50,9 @@ module RubyReactor
           # that reads `result(:name)` and decides to fail.
           compensate_block: nil,
           undo_block: nil,
-          conditions: [],
-          guards: [],
           dependencies: dependencies_from_mappings,
           args_validator: nil,
-          output_validator: nil,
-          retry_config: @retry_config
+          output_validator: nil
         )
       end
 

data/lib/ruby_reactor/dsl/compose_builder.rb

@@ -4,7 +4,6 @@ module RubyReactor
   module Dsl
     class ComposeBuilder
       include RubyReactor::Dsl::TemplateHelpers
-      include RubyReactor::Dsl::Retryable
 
       attr_accessor :name, :composed_reactor_class, :argument_mappings
 
@@ -21,7 +20,6 @@ module RubyReactor
         end
         @reactor = reactor
         @argument_mappings = {}
-        @retry_config = nil
       end
 
       def argument(composed_input_name, source)
@@ -45,6 +43,17 @@ module RubyReactor
         )
       end
 
+      # A parent never retries a nested reactor as a whole (008 R-14): the
+      # child owns its steps' retries. Kept as a stub to name the replacement.
+      def retries(*)
+        raise RubyReactor::Error::DeprecatedDslError.new(
+          "`retries` on a `compose` has been removed: a parent never retries a nested " \
+          "reactor as a whole. Declare `retries` on :#{@name}'s child reactor's own steps " \
+          "(`retries max_attempts: 3` in the step block or the step class); the child retries them itself.",
+          step: @name
+        )
+      end
+
       def build
         warn_if_child_has_ordered_lock!
         dependencies = extract_dependencies_from_mappings
@@ -59,12 +68,9 @@ module RubyReactor
           run_block: nil,
           compensate_block: nil,
           undo_block: nil,
-          conditions: [],
-          guards: [],
           dependencies: dependencies,
           args_validator: nil,
-          output_validator: nil,
-          retry_config: @retry_config
+          output_validator: nil
         }
 
         RubyReactor::Dsl::StepConfig.new(step_config)

data/lib/ruby_reactor/dsl/interrupt_builder.rb

@@ -73,9 +73,7 @@ module RubyReactor
           validation_schema: @validation_schema,
           max_attempts: @max_attempts,
           resume_mode: @resume_mode,
-          dependencies: @dependencies,
-          conditions: @conditions,
-          guards: @guards
+          dependencies: @dependencies
         }
 
         RubyReactor::Dsl::InterruptStepConfig.new(step_config)

data/lib/ruby_reactor/dsl/map_builder.rb

@@ -129,8 +129,6 @@ module RubyReactor
           run_block: nil,
           compensate_block: nil,
           undo_block: nil,
-          conditions: [],
-          guards: [],
           dependencies: dependencies.uniq,
           args_validator: nil,
           output_validator: nil