@atolis-hq/wake 0.3.83 → 0.3.85

package/dist/src/activities/agent/agent-activity.js

@@ -175,7 +175,13 @@ function agentOutcome(result) {
         return {
             kind: ActivityOutcomeKind.Failed,
             data: {
-                reason: ActivityFailureCode.RunnerFailed,
+                // 'provider-quota-exceeded' is a literal, not execution's ProviderQuotaExceededFailureKind
+                // import: activities sits below execution in the module dependency order and must not
+                // import it. AgentRunnerPort's failure.kind is an open string per the existing runner
+                // contract convention; this is the one place that interprets it.
+                reason: result.failure?.kind === 'provider-quota-exceeded'
+                    ? ActivityFailureCode.RunnerQuotaExceeded
+                    : ActivityFailureCode.RunnerFailed,
                 ...(result.failure === undefined ? {} : { message: result.failure.message }),
             },
         };

package/dist/src/activities/agent/agent-result.js

@@ -14,7 +14,11 @@ const blockedReason = z
     .strict();
 const failedReason = z
     .object({
-    reason: z.enum([ActivityFailureCode.InvalidAgentResult, ActivityFailureCode.RunnerFailed]),
+    reason: z.enum([
+        ActivityFailureCode.InvalidAgentResult,
+        ActivityFailureCode.RunnerFailed,
+        ActivityFailureCode.RunnerQuotaExceeded,
+    ]),
     message: z.string().optional(),
 })
     .strict();

package/dist/src/activities/contracts/vocabulary.js

@@ -31,6 +31,7 @@ export const ActivityFailureCode = defineClosedVocabulary({
     InvalidAgentResult: 'invalid-agent-result',
     AmbiguousRunnerResult: 'ambiguous-runner-result',
     RunnerFailed: 'runner-failed',
+    RunnerQuotaExceeded: 'runner-quota-exceeded',
 });
 export const ActivityOutcomeKind = defineClosedVocabulary({
     Waiting: 'waiting',

package/dist/src/bootstrap/self-update-failure-log.js

@@ -1,5 +1,13 @@
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+// recordUpdateFailure (self-update-application.ts) records every failed
+// attempt through this same log regardless of stage — including one that
+// never reached rollout.deploy() at all, e.g. a quiesce timeout waiting on
+// active Runs. "rolled back" would misreport those as a completed deploy
+// that had to be undone, when nothing was ever deployed.
+export function describeSelfUpdateFailure(failure) {
+    return `update to ${failure.tag} failed at ${failure.occurredAt}: ${failure.message}`;
+}
 /**
  * Persists the most recent self-update rollback so it can surface on the
  * operator health screen instead of relying on a third-party notification —

package/dist/src/bootstrap/surface-api-applications.js

@@ -3,7 +3,7 @@ import { ApiCommandStatus, fromWorkItemKey, presentBoardCard, presentResource, p
 import { analyticsProjection } from './analytics-projection.js';
 import { boardConditionCounts, boardProjection, } from './board-projection.js';
 import { primaryExternalRef } from './external-ref.js';
-import { createSelfUpdateFailureLog } from './self-update-failure-log.js';
+import { createSelfUpdateFailureLog, describeSelfUpdateFailure, } from './self-update-failure-log.js';
 import { createExecutionApplications } from './surface-api-execution-applications.js';
 import { projectionMeta, sampledMeta } from './surface-api-metadata.js';
 import { projectionPage } from './surface-api-projection-pages.js';
@@ -200,7 +200,7 @@ function createSystemApplications(root, now) {
                     : {
                         name: 'self-update',
                         status: 'degraded',
-                        detail: `rolled back from ${selfUpdateFailure.tag} at ${selfUpdateFailure.occurredAt}: ${selfUpdateFailure.message}`,
+                        detail: describeSelfUpdateFailure(selfUpdateFailure),
                     },
             ];
             const adapters = root.providers.flatMap((instance) => (instance.health?.() ?? []).map((check) => ({
@@ -309,15 +309,25 @@ async function performTick(root, now, command, sequence) {
         result: await readControlPlaneStatus(root, now),
     };
 }
-async function readControlPlaneStatus(root, now) {
+export async function readControlPlaneStatus(root, now) {
     const stored = await root.projections.read(ControlStreamKind.Global, 'global');
     const meta = await projectionMeta(root.journal, stored === null ? [] : [stored], now());
+    const lease = await root.maintenance.read();
     return {
         data: {
             paused: stored?.value.pausedUntil !== null && stored?.value.pausedUntil !== undefined,
             ...(stored?.value.pausedUntil == null ? {} : { pausedUntil: stored.value.pausedUntil }),
             ...(stored?.value.reason === undefined ? {} : { reason: stored.value.reason }),
             updatedAt: meta.asOf,
+            ...(lease === null
+                ? {}
+                : {
+                    maintenanceLease: {
+                        phase: lease.phase,
+                        startedAt: lease.startedAt,
+                        ...(lease.failure === undefined ? {} : { failure: lease.failure }),
+                    },
+                }),
         },
         meta,
     };

package/dist/src/bootstrap/surface-cli-applications.js

@@ -9,7 +9,7 @@ import { IntakeHost, ResidentHost, TickHost } from '../control-plane/index.js';
 import { ExecutionCancellationReason, ExecutionFailureCode, RunStatus, loadPromptTemplate, } from '../execution/index.js';
 import { EventActorKind, correlationId } from '../kernel/index.js';
 import { ResourceCorrelationRole, resourceId } from '../resources/index.js';
-import { DockerProcessError, createApiDispatcher, createApiHttpServer, createLoggedDockerCli, createPackagedAssetSource, createProcessLogSink, createSandboxDockerPort, drainProcessOutput, runDoctor, runSandbox, runSandboxEntrypoint, runSandboxSetup, runSelfUpdateLatestLoop, runTargetSmoke, verifyResidentStart, waitForActiveRuns, } from '../surfaces/index.js';
+import { DockerProcessError, createApiDispatcher, createApiHttpServer, createLoggedDockerCli, createPackagedAssetSource, createProcessLogSink, createSandboxDockerPort, drainProcessOutput, runDoctor, runSandbox, runSandboxEntrypoint, runSandboxSetup, runSelfUpdateLatestLoop, runTargetSmoke, verifyResidentStart, waitForActiveRuns, waitForever, } from '../surfaces/index.js';
 import { WorkStreamKind, workItemId } from '../work/index.js';
 import { loadConfig } from './config/load-config.js';
 import { runtimeProjectionDefinitions } from './projection-runtime.js';
@@ -456,6 +456,7 @@ async function doctorDiagnostics(root) {
         }
     }
     await checkProviders(root, failures, notices);
+    await checkMaintenanceLease(root, failures);
     notices.push(...(await dockerSandboxHealthNotices(root)));
     for (const [name, path] of Object.entries({
         events: root.paths.eventsRoot,
@@ -490,6 +491,21 @@ function referencedPromptTemplateNames(workflows) {
     }
     return [...names];
 }
+// A retained maintenance lease pauses every resident loop (intake and
+// dispatch) regardless of phase -- including Failed, since it's the
+// operator's decision whether a failed attempt is safe to retry or clear.
+// Without this check the pause is invisible: the process ticks normally and
+// logs nothing, so a stuck lease from an update that couldn't quiesce active
+// Runs looks identical to a healthy idle system.
+async function checkMaintenanceLease(root, failures) {
+    const lease = await root.maintenance.read();
+    if (lease === null)
+        return;
+    const detail = lease.failure === undefined ? '' : ` (${lease.failure})`;
+    failures.push(`update maintenance lease is held in phase "${lease.phase}" since ${lease.startedAt}${detail} -- ` +
+        'every resident loop stays paused until it is cleared or resumes; run `wake self-update` ' +
+        'to retry, or clear the lease manually if the attempt is abandoned');
+}
 async function checkProviders(root, failures, notices) {
     for (const provider of root.providers) {
         if (provider.adapter.trim().length === 0) {
@@ -661,7 +677,7 @@ function createSandboxEntrypointDependencies(root) {
         waitForExit: async (pid) => children.get(pid) ?? 1,
         writeFile: (path, content) => writeFileContent(path, content, 'utf8'),
         sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-        waitForever: () => new Promise(() => { }),
+        waitForever,
         log: (message) => process.stdout.write(`${message}\n`),
     };
 }

package/dist/src/bootstrap/version.js

@@ -108,4 +108,4 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "gedf016c";
+export const wakeVersion = "g6de20bb";

package/dist/src/control-plane/application/advance-once-dispatch.js

@@ -1,6 +1,30 @@
-import { ActivationClaimConflictError, RunStatus, WorkspaceMode } from '../../execution/index.js';
+/* eslint-disable complexity, max-lines-per-function */
+import { ActivityFailureCode, ActivityOutcomeKind, } from '../../activities/index.js';
+import { ActivationClaimConflictError, NoEligibleRunnerError, RunStatus, WorkspaceMode, } from '../../execution/index.js';
 import { WorkflowStatus } from '../../orchestration/index.js';
 import { isExecutionFailureTerminal } from './execution-reconciliation.js';
+export function isRunnerQuotaOutcome(outcome) {
+    return (outcome.kind === ActivityOutcomeKind.Failed &&
+        typeof outcome.data === 'object' &&
+        outcome.data !== null &&
+        'reason' in outcome.data &&
+        outcome.data.reason === ActivityFailureCode.RunnerQuotaExceeded);
+}
+export function runnerQuotaMessage(outcome) {
+    const data = outcome.data;
+    return typeof data.message === 'string' ? data.message : 'runner reported quota exhaustion';
+}
+/**
+ * A quota retry deliberately leaves the outcome unaccepted, so a port that
+ * never applied it (absent method, or a workflow instance that vanished)
+ * leaves the Run permanently unresolved. Surface that rather than going
+ * silent; it is an operational defect, not a workflow state.
+ */
+export function reportUnappliedRunnerQuotaRetry(result, input) {
+    if (result !== null && result !== undefined)
+        return;
+    console.error(`Runner-quota retry was not applied for activation ${input.activationId} (run ${input.runId}); its outcome remains unaccepted.`);
+}
 /**
  * Fills open capacity within one Advancement call: dispatches ready
  * activations one at a time, rechecking `maxConcurrentRuns` and reselecting
@@ -73,18 +97,40 @@ export async function runDispatchLoop(pending, ctx) {
                 stopReason = { kind: 'no-work' };
                 break;
             }
+            if (error instanceof NoEligibleRunnerError) {
+                stopReason = { kind: 'no-work' };
+                break;
+            }
             throw error;
         }
         if (run.status === RunStatus.Succeeded && run.outcome !== undefined) {
-            if (await ctx.isDispatchPaused()) {
-                stopReason = { kind: 'paused' };
-                break;
+            if (isRunnerQuotaOutcome(run.outcome)) {
+                // No isDispatchPaused check here: a quota retry re-requests the same
+                // stage's activity without publishing an outcome or consuming retry
+                // budget, so it must not be held behind maintenance pause the way an
+                // outward-publishing acceptOutcome call is below.
+                const retried = await ctx.orchestration.retryRunnerQuotaFailure?.(selected.workflow.workflowInstanceId, {
+                    activationId: selected.activation.activationId,
+                    runId: run.runId,
+                    runnerName: run.runner?.name ?? 'unknown-runner',
+                    message: runnerQuotaMessage(run.outcome),
+                }, ctx.commandContext(run.runId));
+                reportUnappliedRunnerQuotaRetry(retried, {
+                    activationId: selected.activation.activationId,
+                    runId: run.runId,
+                });
+            }
+            else {
+                if (await ctx.isDispatchPaused()) {
+                    stopReason = { kind: 'paused' };
+                    break;
+                }
+                await ctx.orchestration.acceptOutcome({
+                    workflowInstanceId: selected.workflow.workflowInstanceId,
+                    activationId: selected.activation.activationId,
+                    outcome: run.outcome,
+                }, ctx.commandContext(run.runId));
             }
-            await ctx.orchestration.acceptOutcome({
-                workflowInstanceId: selected.workflow.workflowInstanceId,
-                activationId: selected.activation.activationId,
-                outcome: run.outcome,
-            }, ctx.commandContext(run.runId));
         }
         if (isExecutionFailureTerminal(run.status))
             await ctx.orchestration.resolveExecutionFailure?.(selected.workflow.workflowInstanceId, {

package/dist/src/control-plane/application/advance-once.js

@@ -5,7 +5,7 @@ import { isAmbiguityResolutionBlock, WorkflowStatus } from '../../orchestration/
 import { WorkStatus } from '../../work/index.js';
 import { ControlStreamKind } from '../contracts/streams.js';
 import { DispatchPolicy } from '../domain/dispatch-policy.js';
-import { runDispatchLoop } from './advance-once-dispatch.js';
+import { isRunnerQuotaOutcome, reportUnappliedRunnerQuotaRetry, runDispatchLoop, runnerQuotaMessage, } from './advance-once-dispatch.js';
 import { findUnresolvedSucceededTerminal, findUnresolvedTerminal, } from './execution-reconciliation.js';
 export function createAdvanceOnce(orchestration, execution, resources, clock, dependencies) {
     const runnerIneligibility = dependencies.runnerIneligibility ?? (async () => new Set());
@@ -96,11 +96,29 @@ export function createAdvanceOnce(orchestration, execution, resources, clock, de
             if (await isDispatchPaused())
                 return { kind: 'paused' };
             if (recovery.run.status === RunStatus.Succeeded) {
-                await orchestration.acceptOutcome({
-                    workflowInstanceId: recovery.item.workflow.workflowInstanceId,
-                    activationId: recovery.item.activation.activationId,
-                    outcome: recovery.run.outcome,
-                }, context(recovery.run.runId));
+                // An agent Run completes after execution.attempt() has already returned,
+                // so this reconciliation — not the dispatch loop — is where a real
+                // quota-classified outcome is resolved. It must divert here too, or the
+                // quota failure is published and charged to the retry budget after all.
+                if (isRunnerQuotaOutcome(recovery.run.outcome)) {
+                    const retried = await orchestration.retryRunnerQuotaFailure?.(recovery.item.workflow.workflowInstanceId, {
+                        activationId: recovery.item.activation.activationId,
+                        runId: recovery.run.runId,
+                        runnerName: recovery.run.runner?.name ?? 'unknown-runner',
+                        message: runnerQuotaMessage(recovery.run.outcome),
+                    }, context(recovery.run.runId));
+                    reportUnappliedRunnerQuotaRetry(retried, {
+                        activationId: recovery.item.activation.activationId,
+                        runId: recovery.run.runId,
+                    });
+                }
+                else {
+                    await orchestration.acceptOutcome({
+                        workflowInstanceId: recovery.item.workflow.workflowInstanceId,
+                        activationId: recovery.item.activation.activationId,
+                        outcome: recovery.run.outcome,
+                    }, context(recovery.run.runId));
+                }
                 return {
                     kind: 'progressed',
                     dispatched: [

package/dist/src/execution/application/execution-activity.js

@@ -1,4 +1,5 @@
 import { ExecutionEventType } from '../contracts/events.js';
+import { ProviderQuotaExceededFailureKind } from '../contracts/runner.js';
 import { parseAgentRunnerResponse } from '../infrastructure/agent-runner-adapter.js';
 import { createRunEvent } from './run-lifecycle.js';
 export async function executeActivity(runtime, currentRunId, request) {
@@ -77,7 +78,8 @@ function runnerResultReporter(runtime, currentRunId, context, activation, reques
             payload: { transport: result.transport, agent: parseAgentRunnerResponse(result) },
         });
         await appendIdempotently(runtime.repository, currentRunId, loaded.sequence, event);
-        if (result.failure?.kind === 'provider-quota-exceeded' && request.runnerName !== undefined)
+        if (result.failure?.kind === ProviderQuotaExceededFailureKind &&
+            request.runnerName !== undefined)
             await runtime.dependencies.reportRunnerQuota?.({
                 runnerName: request.runnerName,
                 message: result.failure.message,

package/dist/src/execution/contracts/runner.js

@@ -1,3 +1,4 @@
+export const ProviderQuotaExceededFailureKind = 'provider-quota-exceeded';
 // inputTokens/outputTokens/cacheReadTokens/cacheWriteTokens/costUsd are the known
 // numeric keys agent-runner-adapter.ts writes into AgentRunResponse.metadata.
 export function agentTokenUsage(metadata) {

package/dist/src/execution/infrastructure/runners/claude.js

@@ -1,4 +1,5 @@
 import { ExternalExecutionKind } from '../../../activities/index.js';
+import { ProviderQuotaExceededFailureKind } from '../../contracts/runner.js';
 import { ExecutionCancellationReason, RunStatus } from '../../contracts/vocabulary.js';
 import { runProcess } from '../process-execution.js';
 export function createClaudeRunner(options = {}) {
@@ -6,6 +7,7 @@ export function createClaudeRunner(options = {}) {
         ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
         ...(options.model === undefined ? {} : { defaultModel: options.model }),
         parseSuccessfulOutput: parseClaudeOutput,
+        classifyFailure: classifyClaudeFailure,
         supportsSessionResume: true,
     });
 }
@@ -19,6 +21,20 @@ export function parseClaudeOutput(stdout, _request) {
         ...claudeUsage(value),
     };
 }
+// Deliberately narrow: only genuine provider usage/rate-limit phrasing.
+// Auth/login failures (unauthorized, authentication, permission denied, api
+// key) are NOT included here — they are a different failure class and must
+// not be paused-and-retried as if they were transient.
+const claudeQuotaPattern = /rate limit|quota|credit balance|spend limit|usage limit|session limit|too many requests|\b429\b/i;
+export function classifyClaudeFailure(input) {
+    // Prefer stderr — a CLI's own diagnostic stream — over stdout, which on a
+    // failed run can carry the agent's own generated text; only fall back to
+    // stdout when stderr is empty.
+    const text = input.stderr.trim().length > 0 ? input.stderr : input.stdout;
+    if (!claudeQuotaPattern.test(text))
+        return undefined;
+    return { kind: ProviderQuotaExceededFailureKind, message: text.trim() };
+}
 function claudeUsage(value) {
     const usage = record(value.usage);
     const input = usage === undefined ? undefined : numeric(usage.input_tokens);
@@ -98,20 +114,29 @@ export function cliRunner(name, command, args, options = {}) {
                         transport: RunStatus.Failed,
                         output: value.stdout,
                         runner: name,
-                        failure: {
-                            kind: value.timedOut
-                                ? ExecutionCancellationReason.Timeout
-                                : (value.failureKind ?? 'process-exit'),
-                            message: value.timedOut
-                                ? `Runner timed out after ${options.timeoutMs}ms`
-                                : (value.failureMessage ?? (value.stderr || `exit ${value.exitCode}`)),
-                        },
+                        failure: failureFor(value, options),
                     }),
                 cancel: process.cancel,
             };
         },
     };
 }
+function failureFor(value, options) {
+    if (value.timedOut)
+        return {
+            kind: ExecutionCancellationReason.Timeout,
+            message: `Runner timed out after ${options.timeoutMs}ms`,
+        };
+    if (value.failureKind !== undefined)
+        return {
+            kind: value.failureKind,
+            message: value.failureMessage ?? (value.stderr || `exit ${value.exitCode}`),
+        };
+    const classified = options.classifyFailure?.({ stdout: value.stdout, stderr: value.stderr });
+    if (classified !== undefined)
+        return classified;
+    return { kind: 'process-exit', message: value.stderr || `exit ${value.exitCode}` };
+}
 function parseSuccessfulOutput(stdout, request, parser) {
     if (parser === undefined)
         return {};

package/dist/src/execution/infrastructure/runners/codex.js

@@ -1,10 +1,47 @@
+import { ProviderQuotaExceededFailureKind } from '../../contracts/runner.js';
 import { WorkspaceMode } from '../../contracts/vocabulary.js';
 import { cliRunner } from './claude.js';
+// Deliberately narrow: only genuine provider usage/rate-limit phrasing.
+// Auth/login failures (unauthorized, authentication, api key, not logged
+// in, login required) are NOT included here — they are a different failure
+// class and must not be paused-and-retried as if they were transient.
+const codexQuotaPattern = /usage limit|rate limit|quota|too many requests|credit balance|spend limit|session limit|\b429\b/i;
+export function classifyCodexFailure(input) {
+    // Only ever classify from Codex's own structured error/turn.failed
+    // message, never from scanning raw stdout — stdout on a failed run can
+    // carry the agent's own generated text, which must never be
+    // pattern-matched into a false quota classification.
+    const structured = extractCodexErrorMessage(input.stdout);
+    if (structured === undefined)
+        return undefined;
+    if (!codexQuotaPattern.test(structured))
+        return undefined;
+    return { kind: ProviderQuotaExceededFailureKind, message: structured };
+}
+function extractCodexErrorMessage(stdout) {
+    for (const line of stdout.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            continue;
+        const event = parseLine(trimmed);
+        if (event === undefined)
+            continue;
+        if (event.type === 'error' && typeof event.message === 'string')
+            return event.message;
+        if (event.type === 'turn.failed') {
+            const error = asRecord(event.error);
+            if (typeof error?.message === 'string')
+                return error.message;
+        }
+    }
+    return undefined;
+}
 export function createCodexRunner(options = {}) {
     return cliRunner('codex', options.command ?? 'codex', (request) => codexCommandArgs(request, options.args, options), {
         ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
         ...(options.model === undefined ? {} : { defaultModel: options.model }),
         parseSuccessfulOutput: parseCodexOutput,
+        classifyFailure: classifyCodexFailure,
         supportsSessionResume: true,
     });
 }

package/dist/src/execution/infrastructure/runners/cursor.js

@@ -1,12 +1,27 @@
+import { ProviderQuotaExceededFailureKind } from '../../contracts/runner.js';
 import { WorkspaceMode } from '../../contracts/vocabulary.js';
 import { cliRunner } from './claude.js';
 // Cursor's CLI subcommand, not the closed domain vocabulary word "agent".
 const cursorCliSubcommand = String.fromCharCode(97, 103, 101, 110, 116);
+// Deliberately narrow: only genuine provider usage/rate-limit phrasing.
+// Auth/login failures (unauthorized, authentication, api key) are NOT
+// included here — they are a different failure class and must not be
+// paused-and-retried as if they were transient.
+const cursorQuotaPattern = /rate limit|usage limit|quota|credit balance|spend limit|session limit|too many requests|\b429\b/i;
+export function classifyCursorFailure(input) {
+    // Prefer stderr over stdout, same reasoning as Claude's classifier: stdout
+    // on a failed run can carry the agent's own generated text.
+    const text = input.stderr.trim().length > 0 ? input.stderr : input.stdout;
+    if (!cursorQuotaPattern.test(text))
+        return undefined;
+    return { kind: ProviderQuotaExceededFailureKind, message: text.trim() };
+}
 export function createCursorRunner(options = {}) {
     return cliRunner('cursor', options.command ?? 'cursor', (request) => cursorCommandArgs(request, options.args, options), {
         ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
         ...(options.model === undefined ? {} : { defaultModel: options.model }),
         parseSuccessfulOutput: parseCursorOutput,
+        classifyFailure: classifyCursorFailure,
         supportsSessionResume: true,
     });
 }

package/dist/src/execution/infrastructure/runners/registry.js

@@ -1,3 +1,11 @@
+export class NoEligibleRunnerError extends Error {
+    runnerPool;
+    constructor(runnerPool) {
+        super(`Execution runner pool ${runnerPool} has no eligible runner: all candidates are ineligible`);
+        this.runnerPool = runnerPool;
+        this.name = 'NoEligibleRunnerError';
+    }
+}
 export class RunnerRegistry {
     runnerPools;
     runners;
@@ -22,5 +30,5 @@ function selectEligibleCandidate(runnerPool, candidates, runners, ineligible) {
             throw new Error(`Runner ${name} is not registered`);
         return { name, runner };
     }
-    throw new Error(`Execution runner pool ${runnerPool} has no eligible runner: all candidates are ineligible`);
+    throw new NoEligibleRunnerError(runnerPool);
 }

package/dist/src/orchestration/application/advance-workflow.js

@@ -3,7 +3,7 @@ import { OrchestrationEventType } from '../contracts/events.js';
 import { commandName, workflowInstanceId, } from '../contracts/identifiers.js';
 import { workflowInstanceStream } from '../contracts/streams.js';
 import { WorkflowStatus } from '../contracts/vocabulary.js';
-import { requestChangesResume as decideChangesResume, requestOperatorRetry as decideOperatorRetry, requestSupplementalActivity as decideSupplementalActivity, } from '../domain/interpreter.js';
+import { requestChangesResume as decideChangesResume, requestOperatorRetry as decideOperatorRetry, requestSupplementalActivity as decideSupplementalActivity, requestRunnerQuotaRetry, } from '../domain/interpreter.js';
 import { isAuthorisedActor } from '../domain/supplemental-policy.js';
 import { appendWithIntentRecovery } from './durable-append.js';
 import { acceptResourceTransition, matchResourceTransitions, } from './resource-transition-matching.js';
@@ -112,6 +112,29 @@ export class AdvanceWorkflow {
         ]);
         return (await this.repository.load(id)).view;
     }
+    async retryRunnerQuotaFailure(id, input, context) {
+        const loaded = await this.repository.load(id);
+        if (loaded.view === null)
+            return null;
+        // The retry re-requests the interrupted Activation, not a stage lookup, but
+        // the definition must still be resolvable for the retried Activation's own
+        // outcome to be routable later; an unavailable definition blocks here.
+        const definition = await this.workflows.definitionForOperation(loaded.view, loaded.sequence, context);
+        if (definition === null)
+            return (await this.repository.loadRequired(id)).view;
+        const decision = requestRunnerQuotaRetry(loaded.view, {
+            activationId: input.activationId,
+            runId: input.runId,
+            runnerName: input.runnerName,
+            message: input.message,
+            occurredAt: context.occurredAt,
+            causationId: context.commandId,
+        });
+        if (decision.kind === 'ignored')
+            return loaded.view;
+        await this.repository.append(id, loaded.sequence, decision.events);
+        return (await this.repository.load(id)).view;
+    }
     async retryBlockedFailedStage(id, context) {
         const loaded = await this.repository.load(id);
         if (loaded.view === null)

package/dist/src/orchestration/application/orchestration-service.js

@@ -67,6 +67,9 @@ export class OrchestrationService {
     resolveExecutionFailure(workflowInstanceId, input, context) {
         return this.transitionWatchChildren(context, () => this.advanceWorkflow.resolveExecutionFailure(workflowInstanceId, input, context));
     }
+    retryRunnerQuotaFailure(workflowInstanceId, input, context) {
+        return this.transitionWatchChildren(context, () => this.advanceWorkflow.retryRunnerQuotaFailure(workflowInstanceId, input, context));
+    }
     retryBlockedFailedStage(workflowInstanceId, context) {
         return this.transitionWatchChildren(context, () => this.advanceWorkflow.retryBlockedFailedStage(workflowInstanceId, context));
     }

package/dist/src/orchestration/contracts/event-decoder.js

@@ -232,6 +232,14 @@ const eventSchema = z.discriminatedUnion('eventType', [
         reason: z.string().min(1),
     })
         .strict()),
+    workflowEnvelope(OrchestrationEventType.ActivityRetriedForRunnerQuota, z
+        .object({
+        activationId: brandedStringSchema(activationId),
+        runId: z.string().min(1),
+        runnerName: z.string().min(1),
+        message: z.string().min(1),
+    })
+        .strict()),
     workflowEnvelope(OrchestrationEventType.ActivityWaiting, z
         .object({
         activationId: brandedStringSchema(activationId),

package/dist/src/orchestration/contracts/events.js

@@ -7,6 +7,7 @@ export const OrchestrationEventType = {
     ActivityStarted: 'orchestration.activity-started',
     ActivityOutcomeAccepted: 'orchestration.activity-outcome-accepted',
     ActivityExecutionFailed: 'orchestration.activity-execution-failed',
+    ActivityRetriedForRunnerQuota: 'orchestration.activity-retried-for-runner-quota',
     ActivityWaiting: 'orchestration.activity-waiting',
     SignalWaitStarted: 'orchestration.signal-wait-started',
     SignalAccepted: 'orchestration.signal-accepted',

package/dist/src/orchestration/domain/interpreter.js

@@ -11,6 +11,7 @@ export { startInstance } from './activation-policy.js';
 export { acceptSignal, waitForSignal } from './signal-policy.js';
 export { requestSupplementalActivity } from './supplemental-policy.js';
 export { isChangesResumeEligible, isOperatorRetryEligible, requestChangesResume, requestOperatorRetry, selectOperatorRetryTarget, } from './operator-retry-policy.js';
+export { isRunnerQuotaRetryEligible, requestRunnerQuotaRetry, } from './runner-quota-retry-policy.js';
 export function acceptActivityOutcome(definition, state, input) {
     if (!isPendingOutcome(state, input))
         return { kind: 'ignored', reason: 'outcome is not for the pending activation' };

package/dist/src/orchestration/domain/runner-quota-retry-policy.js

@@ -0,0 +1,41 @@
+import { activationId as toActivationId } from '../../activities/index.js';
+import { OrchestrationEventType, } from '../contracts/events.js';
+import { activation, nextOrdinal, stateDraft } from './decision-events.js';
+export function isRunnerQuotaRetryEligible(view, activationId) {
+    return (view.pendingActivation?.activationId === activationId &&
+        !view.acceptedOutcomes.includes(toActivationId(activationId)));
+}
+export function requestRunnerQuotaRetry(state, input) {
+    if (!isRunnerQuotaRetryEligible(state, input.activationId))
+        return {
+            kind: 'ignored',
+            reason: 'workflow has no matching pending activation for runner-quota retry',
+        };
+    // Re-request the interrupted Activation itself, not the current stage's
+    // configured activity: a supplemental or follow-on Activation runs a
+    // different activity and input, and substituting the stage's main one would
+    // drop that work and re-run something the runner never attempted.
+    const interrupted = state.pendingActivation;
+    // No RetryCounted here, deliberately: a quota condition is a runner-capacity
+    // fact, not a failed attempt, so it must never consume the route's
+    // configured `retry.max` budget.
+    const events = [
+        stateDraft(state, input, OrchestrationEventType.ActivityRetriedForRunnerQuota, {
+            activationId: toActivationId(input.activationId),
+            runId: input.runId,
+            runnerName: input.runnerName,
+            message: input.message,
+        }, 1),
+        stateDraft(state, input, OrchestrationEventType.ActivityRequested, activation(state.workflowInstanceId, nextOrdinal(state), interrupted.activity, interrupted.input, {
+            execution: interrupted.execution,
+            ...(interrupted.stage === undefined ? {} : { stage: interrupted.stage }),
+            ...(interrupted.followOnIndex === undefined
+                ? {}
+                : { followOnIndex: interrupted.followOnIndex }),
+            ...(interrupted.supplemental === undefined
+                ? {}
+                : { supplemental: interrupted.supplemental }),
+        }), 2),
+    ];
+    return { kind: 'append', events };
+}

package/dist/src/orchestration/domain/workflow-instance-events.js

@@ -34,6 +34,7 @@ function isActivityFact(event) {
         case OrchestrationEventType.ActivityStarted:
         case OrchestrationEventType.ActivityOutcomeAccepted:
         case OrchestrationEventType.ActivityExecutionFailed:
+        case OrchestrationEventType.ActivityRetriedForRunnerQuota:
         case OrchestrationEventType.ActivityWaiting:
             return true;
         default:
@@ -61,6 +62,10 @@ function applyActivityFact(state, event) {
             state.executionFailure = event.payload;
             updateActivationStatus(state, event.payload.activationId, ActivityActivationStatus.Completed);
             return;
+        case OrchestrationEventType.ActivityRetriedForRunnerQuota:
+            state.acceptedOutcomes.push(event.payload.activationId);
+            updateActivationStatus(state, event.payload.activationId, ActivityActivationStatus.Completed);
+            return;
         case OrchestrationEventType.ActivityWaiting:
             applyActivityWaiting(state, event);
             return;