@cat-factory/worker 0.176.0 → 0.177.0

package/dist/infrastructure/containers/CloudflareContainerTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CloudflareContainerTransport.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/CloudflareContainerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAqE5E,qBAAa,4BAA6B,YAAW,eAAe;IAUhE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IArBhC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,0BAAyB;IAEzC,YAMmB,SAAS,EACtB,sBAAsB,CAAC,kBAAkB,CAAC,GAC1C,sBAAsB,CAAC,eAAe,CAAC;IAC3C,kFAAkF;IACjE,QAAQ,CAAC,EAAE,yBAAyB,YAAA;IACrD;;;;;;OAMG;IACc,YAAY,CAAC,EAAE,MAAM,YAAA,EACpC;IAEJ,oFAAoF;IACpF,OAAO,CAAC,YAAY;IAUd,QAAQ,CACZ,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,GAAE,kBAA4B,GACjC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CA+BxC;IAED;;;;;;;;;;;;OAYG;YACW,UAAU;IASlB,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAyCpD;IAED;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9C;IAED;;;;;;;;;;OAUG;IACG,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqB9D;CACF"}
+{"version":3,"file":"CloudflareContainerTransport.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/CloudflareContainerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAO9D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAqF5E,qBAAa,4BAA6B,YAAW,eAAe;IAUhE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IArBhC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,0BAAyB;IAEzC,YAMmB,SAAS,EACtB,sBAAsB,CAAC,kBAAkB,CAAC,GAC1C,sBAAsB,CAAC,eAAe,CAAC;IAC3C,kFAAkF;IACjE,QAAQ,CAAC,EAAE,yBAAyB,YAAA;IACrD;;;;;;OAMG;IACc,YAAY,CAAC,EAAE,MAAM,YAAA,EACpC;IAEJ,oFAAoF;IACpF,OAAO,CAAC,YAAY;IAUd,QAAQ,CACZ,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,GAAE,kBAA4B,GACjC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CA+BxC;IAED;;;;;;;;;;;;OAYG;YACW,UAAU;IAWlB,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAyCpD;IAED;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9C;IAED;;;;;;;;;;OAUG;IACG,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqB9D;CACF"}

package/dist/infrastructure/containers/CloudflareContainerTransport.js

@@ -1,5 +1,5 @@
-import { CONTAINER_EVICTION_ERROR, harnessDispatchError, readRunnerDispatchAck, } from '@cat-factory/kernel';
-import { isRolloutSignal } from './stopCause';
+import { composePostMortem, CONTAINER_EVICTION_ERROR, harnessDispatchError, readRunnerDispatchAck, } from '@cat-factory/kernel';
+import { describeContainerExit, isRolloutSignal, } from './stopCause';
 // The human-readable message for a failed poll the transport maps to a container eviction. The
 // eviction verdict the engine acts on rides the STRUCTURED `RunnerJobView.evicted` field
 // (`crash` / `transient`) minted alongside it. The "(container evicted or crashed)" wording and
@@ -24,14 +24,29 @@ const TRANSIENT_EVICTION_ERROR = {
     idle: IDLE_EVICTION_ERROR,
 };
 /**
- * The failed view for a 404 poll, given what the container itself observed about its reclaim.
- * No observed cause ⇒ the container is simply gone with nothing to explain it, which is a
- * `crash` (an OOM, a genuine fault) and recovers on the small budget.
+ * The failed view for a 404 poll, given what the container itself observed about its stop.
+ *
+ * The two halves of that observation answer different questions and are read independently. The
+ * `cause` decides the VERDICT: no observed cause ⇒ the container is simply gone with nothing to
+ * explain it, which is a `crash` (an OOM, a genuine fault) and recovers on the small budget. The
+ * `exit` state decides the DETAIL, and is attached whether or not a cause was recognised: on a
+ * runtime that cannot hand a log tail back to the Worker it is the only post-mortem there is,
+ * and a crash is exactly the case with no cause to name (finding D1).
+ *
+ * Independent does not mean unaware of each other. The cause is handed to the detail's wording
+ * so the two cannot contradict: the same reclaim that mints the `transient` verdict here is
+ * performed with a SIGKILL, and an exit code read as if nothing else explained it would tell the
+ * operator "out-of-memory kill" directly underneath "idle container reclaimed between polls".
  */
-function evictionView(cause) {
-    if (!cause)
-        return { state: 'failed', error: EVICTION_ERROR, evicted: 'crash' };
-    return { state: 'failed', error: TRANSIENT_EVICTION_ERROR[cause], evicted: 'transient' };
+function evictionView(observed) {
+    const detail = composePostMortem([describeContainerExit(observed.exit, observed.cause)]);
+    const { cause } = observed;
+    return {
+        state: 'failed',
+        error: cause ? TRANSIENT_EVICTION_ERROR[cause] : EVICTION_ERROR,
+        evicted: cause ? 'transient' : 'crash',
+        ...(detail ? { detail } : {}),
+    };
 }
 // The default runner transport: a per-RUN Cloudflare Container. One Durable Object
 // instance per run id (`ref.runId`) hosts that run's whole sequence of step jobs; the
@@ -71,7 +86,7 @@ export class CloudflareContainerTransport {
     constructor(
     // Either per-run container class: `ExecutionContainer` (the agent harness, bound as
     // `EXEC_CONTAINER`) or `DeployContainer` (the deploy harness, bound as `DEPLOY_CONTAINER`).
-    // Both expose the same `/jobs` HTTP contract on 8080 plus `recentEvictionCause`/`shutdown`,
+    // Both expose the same `/jobs` HTTP contract on 8080 plus `recentStopObservation`/`shutdown`,
     // so this transport drives either unchanged — a deploy-dedicated instance simply gets the
     // deploy namespace.
     namespace, 
@@ -145,8 +160,10 @@ export class CloudflareContainerTransport {
      * transport OBSERVED itself wins over a read that could not happen.
      */
     async evictionOf(stub, ref, observed) {
-        const claimed = await stub.recentEvictionCause(ref.jobId).catch(() => undefined);
-        return evictionView(observed ?? claimed);
+        const claimed = await stub.recentStopObservation(ref.jobId).catch(() => ({}));
+        // The transport's own observation wins for the CAUSE (see above); the exit state can only
+        // ever come from the container, so it rides through whichever way the cause was decided.
+        return evictionView({ ...claimed, ...(observed ? { cause: observed } : {}) });
     }
     async poll(ref) {
         // The per-run container is the Durable Object addressed by the run id; its DO id is

package/dist/infrastructure/containers/CloudflareContainerTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"CloudflareContainerTransport.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/CloudflareContainerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,GAOtB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAA2B,eAAe,EAAE,MAAM,aAAa,CAAA;AAGtE,+FAA+F;AAC/F,yFAAyF;AACzF,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,iEAAiE;AACjE,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAC/C,MAAM,sBAAsB,GAAG,GAAG,cAAc,sCAAsC,CAAA;AACtF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,2FAA2F;AAC3F,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,GAAG,cAAc,2CAA2C,CAAA;AAExF;;;;GAIG;AACH,MAAM,wBAAwB,GAAuC;IACnE,OAAO,EAAE,sBAAsB;IAC/B,IAAI,EAAE,mBAAmB;CAC1B,CAAA;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAqC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IAC/E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,wBAAwB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AAC1F,CAAC;AAED,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,oFAAoF;AACpF,2EAA2E;AAC3E,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,UAAU;AAEV,oFAAoF;AACpF,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,iGAAiG;AACjG,6FAA6F;AAC7F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,MAAM,CAAA;AAE9B,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEhD,MAAM,OAAO,4BAA4B;IAUpB,SAAS;IAIT,QAAQ;IAQR,YAAY;IArB/B,6EAA6E;IACpE,OAAO,GAAG,sBAAsB,CAAA;IAEzC;IACE,oFAAoF;IACpF,4FAA4F;IAC5F,4FAA4F;IAC5F,0FAA0F;IAC1F,oBAAoB;IACH,SAE0B;IAC3C,kFAAkF;IACjE,QAAoC;IACrD;;;;;;OAMG;IACc,YAAqB;yBAZrB,SAAS;wBAIT,QAAQ;4BAQR,YAAY;IAC5B,CAAC;IAEJ,oFAAoF;IAC5E,YAAY;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,CAAC;IAED,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,mFAAmF;IACnF,mFAAmF;IACnF,yDAAyD;IACzD,KAAK,CAAC,QAAQ,CACZ,GAAiB,EACjB,IAA6B,EAC7B,IAAI,GAAuB,OAAO;QAElC,mFAAmF;QACnF,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,iFAAiF;QACjF,mFAAmF;QACnF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,MAAM,oBAAoB,CAAC;gBACzB,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,kFAAkF;QAClF,kFAAkF;QAClF,+EAA+E;QAC/E,oDAAoD;QACpD,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC9C,wFAAwF;QACxF,6FAA6F;QAC7F,OAAO,qBAAqB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,UAAU,CACtB,IAAyF,EACzF,GAAiB,EACjB,QAA6B;QAE7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAChF,OAAO,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,oFAAoF;QACpF,kFAAkF;QAClF,uFAAuF;QACvF,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/E,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,iFAAiF;YACjF,0EAA0E;YAC1E,6CAA6C;YAC7C,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;YACtE,MAAM,GAAG,CAAA;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,2EAA2E;YAC3E,gFAAgF;YAChF,8EAA8E;YAC9E,oFAAoF;YACpF,wFAAwF;YACxF,sFAAsF;YACtF,wFAAwF;YACxF,mBAAmB;YACnB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,oFAAoF;QACpF,sFAAsF;QACtF,8DAA8D;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,+EAA+E;QAC/E,wEAAwE;QACxE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,yEAAyE;YACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtC,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBACrF,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;YACF,4FAA4F;YAC5F,2FAA2F;YAC3F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAoC,CAAA;gBACrE,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;YACjD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2FAA2F;YAC3F,sEAAsE;YACtE,IAAI,eAAe,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;QAC9C,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"CloudflareContainerTransport.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/CloudflareContainerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,GAOtB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAEL,qBAAqB,EACrB,eAAe,GAEhB,MAAM,aAAa,CAAA;AAGpB,+FAA+F;AAC/F,yFAAyF;AACzF,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,iEAAiE;AACjE,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAC/C,MAAM,sBAAsB,GAAG,GAAG,cAAc,sCAAsC,CAAA;AACtF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,2FAA2F;AAC3F,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,GAAG,cAAc,2CAA2C,CAAA;AAExF;;;;GAIG;AACH,MAAM,wBAAwB,GAAuC;IACnE,OAAO,EAAE,sBAAsB;IAC/B,IAAI,EAAE,mBAAmB;CAC1B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,QAAyB;IAC7C,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACxF,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;IAC1B,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc;QAC/D,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;QACtC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,oFAAoF;AACpF,2EAA2E;AAC3E,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,UAAU;AAEV,oFAAoF;AACpF,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,iGAAiG;AACjG,6FAA6F;AAC7F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,MAAM,CAAA;AAE9B,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEhD,MAAM,OAAO,4BAA4B;IAUpB,SAAS;IAIT,QAAQ;IAQR,YAAY;IArB/B,6EAA6E;IACpE,OAAO,GAAG,sBAAsB,CAAA;IAEzC;IACE,oFAAoF;IACpF,4FAA4F;IAC5F,8FAA8F;IAC9F,0FAA0F;IAC1F,oBAAoB;IACH,SAE0B;IAC3C,kFAAkF;IACjE,QAAoC;IACrD;;;;;;OAMG;IACc,YAAqB;yBAZrB,SAAS;wBAIT,QAAQ;4BAQR,YAAY;IAC5B,CAAC;IAEJ,oFAAoF;IAC5E,YAAY;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,CAAC;IAED,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,mFAAmF;IACnF,mFAAmF;IACnF,yDAAyD;IACzD,KAAK,CAAC,QAAQ,CACZ,GAAiB,EACjB,IAA6B,EAC7B,IAAI,GAAuB,OAAO;QAElC,mFAAmF;QACnF,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,iFAAiF;QACjF,mFAAmF;QACnF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,MAAM,oBAAoB,CAAC;gBACzB,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,kFAAkF;QAClF,kFAAkF;QAClF,+EAA+E;QAC/E,oDAAoD;QACpD,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC9C,wFAAwF;QACxF,6FAA6F;QAC7F,OAAO,qBAAqB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,UAAU,CACtB,IAA4E,EAC5E,GAAiB,EACjB,QAA6B;QAE7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAoB,CAAC,CAAA;QAChG,0FAA0F;QAC1F,yFAAyF;QACzF,OAAO,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,oFAAoF;QACpF,kFAAkF;QAClF,uFAAuF;QACvF,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/E,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,iFAAiF;YACjF,0EAA0E;YAC1E,6CAA6C;YAC7C,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;YACtE,MAAM,GAAG,CAAA;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,2EAA2E;YAC3E,gFAAgF;YAChF,8EAA8E;YAC9E,oFAAoF;YACpF,wFAAwF;YACxF,sFAAsF;YACtF,wFAAwF;YACxF,mBAAmB;YACnB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,oFAAoF;QACpF,sFAAsF;QACtF,8DAA8D;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,+EAA+E;QAC/E,wEAAwE;QACxE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,yEAAyE;YACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtC,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBACrF,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;YACF,4FAA4F;YAC5F,2FAA2F;YAC3F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAoC,CAAA;gBACrE,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;YACjD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2FAA2F;YAC3F,sEAAsE;YACtE,IAAI,eAAe,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;QAC9C,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/infrastructure/containers/RunContainer.d.ts

@@ -1,7 +1,7 @@
 import { Container } from '@cloudflare/containers';
 import type { StopParams } from '@cloudflare/containers';
 import type { Env } from '../env';
-import { type ContainerStopCause } from './stopCause';
+import { type StopObservation } from './stopCause';
 /**
  * The behaviour every per-run Cloudflare Container shares: one Durable Object instance per run
  * id hosts that run's sequence of jobs, the harness listens on 8080, and the base
@@ -23,21 +23,62 @@ export declare abstract class RunContainer extends Container<Env> {
     defaultPort: number;
     envVars: Record<string, string>;
     sleepAfter: string;
+    /**
+     * Whether the stop this container is about to observe is one WE asked for: the idle reclaim in
+     * {@link onActivityExpired} and the deliberate teardown in {@link shutdown}, both of which stop
+     * the container by signalling it.
+     *
+     * It exists because the resulting exit state is evidence about nothing. We sent the signal, so
+     * the code that comes back describes our own request (and escalates to a SIGKILL 137 whenever
+     * the harness does not exit inside the platform's grace period), while the account the run
+     * actually needs is the cause already recorded beside it. Left recorded, that exit is read back
+     * as the container's cause of death and reported as "most often an out-of-memory kill" under a
+     * verdict that says the platform reclaimed an idle container.
+     *
+     * In-memory rather than persisted, and reset by {@link onStart}: it describes ONE stop of ONE
+     * container life, and the isolate cannot outlive the stop it is set for. A container that comes
+     * back up has a real death ahead of it again.
+     */
+    private selfInitiatedStop;
+    /**
+     * A container life is starting, so nothing from here on is a stop we asked for.
+     *
+     * The base class flushes any deferred `onStop` from the PREVIOUS life before it calls this, so
+     * the reset can never land between a self-initiated stop and the hook that observes it.
+     */
+    onStart(): Promise<void>;
     /**
      * Record that THIS run's container was drained by a new-version rollout (a deploy, exit 143)
      * rather than crashing. The transport's next job poll (which 404s once the container restarts
-     * empty) reads this back through {@link recentEvictionCause}, so the engine
+     * empty) reads this back through {@link recentStopObservation}, so the engine
      * recovers it on the larger transient budget instead of failing the run as a crash.
      * Persisted to DO storage (not in-memory) so it survives the isolate reset a combined
      * worker+container deploy causes.
      */
     onError(error: unknown): Promise<unknown>;
     /**
-     * Belt-and-braces: depending on the runtime version, a rollout drain can surface as a
-     * `runtime_signal` stop with SIGTERM (143) through `onStop` instead of (or as well as)
-     * `onError`. Record it the same way.
+     * Record EVERY stop, with whatever this hook can say about it.
+     *
+     * Two things ride the same write. A `runtime_signal` SIGTERM (143) is a rollout drain, which
+     * depending on the runtime version surfaces here instead of (or as well as) through `onError`,
+     * so it is recorded as that cause the same way. And the `{ exitCode, reason }` pair itself is
+     * recorded for every stop, cause or not, because it is the ONLY account of a death this
+     * runtime can keep: a Cloudflare Container's stdout goes to the deployment's Workers logs and
+     * nothing here can read it back, so without this an OOM-killed agent reaches the operator as
+     * "container evicted or crashed" and nothing else (finding D1).
+     *
+     * Recording an exit changes no verdict: the transient/crash classification still comes from
+     * the cause alone, so a plain crash keeps spending the crash budget and merely says why.
+     *
+     * A stop WE asked for is the exception, and records nothing. Its exit state is the echo of our
+     * own signal rather than an observation, and the cause that explains it has already been
+     * recorded by whoever asked (see {@link selfInitiatedStop}).
+     *
+     * Both rules live in {@link observationForStop}, beside the other half of "what does this stop
+     * mean" (`isRolloutSignal`) and where a plain unit test can reach them: nothing in this class
+     * can be exercised without a real Durable Object.
      */
-    onStop(params: StopParams): void;
+    onStop(params: StopParams): Promise<void>;
     /**
      * The idle window elapsed. Record it as the reclaim cause it is, then reclaim as the base
      * class would.
@@ -75,20 +116,31 @@ export declare abstract class RunContainer extends Container<Env> {
      */
     fetch(request: Request): Promise<Response>;
     /**
-     * Why this run's container went away, for the transport to read over RPC after `jobId`'s poll
-     * 404s: the one thing that tells a reclaim apart from a crash. `undefined` means no reclaim
-     * this container observed explains that 404, so the caller reports a crash.
+     * What this run's container observed about its own stop, for the transport to read over RPC
+     * after `jobId`'s poll 404s: the `cause` that tells a reclaim apart from a crash, and the
+     * `exit` state that is the only surviving account of the death itself. An EMPTY observation
+     * means nothing this container saw explains that 404, so the caller reports a bare crash.
      *
      * Claimed by the polling job rather than deleted, so a retried durable poll step re-reads the
      * same answer while a different job still finds it spent. See {@link takeStopCause}.
      */
-    recentEvictionCause(jobId: string): Promise<ContainerStopCause | undefined>;
+    recentStopObservation(jobId: string): Promise<StopObservation>;
     /**
      * Reclaim this container now (SIGKILL via the base class), rather than waiting for the
      * `sleepAfter` idle timer. Called over RPC when a run settles or faults, so a leaked instance
      * isn't billed while idle. Best-effort and idempotent: destroying an already-stopped
      * container is a no-op, and we swallow any error so the caller's failure handling is never
      * derailed by cleanup.
+     *
+     * It is also where the stop record's life ENDS. A record is written on every stop and deleted
+     * only when a NEW job is accepted, so without this the last one a run ever observed sits in
+     * that run's Durable Object for good: the run is over, no dispatch is coming to clear it, and
+     * the value is a diagnostic nobody will read again. Deleting it here is what keeps the whole
+     * mechanism transient rather than a per-run key that accumulates for the lifetime of the
+     * deployment.
+     *
+     * Ordered after the teardown so the destroy's own `onStop` cannot land behind the delete,
+     * belt-and-braces with {@link selfInitiatedStop}, which stops that hook writing at all.
      */
     shutdown(): Promise<void>;
     private record;

package/dist/infrastructure/containers/RunContainer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RunContainer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/RunContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,OAAO,EAEL,KAAK,kBAAkB,EAKxB,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,YAAa,SAAQ,SAAS,CAAC,GAAG,CAAC;IACvD,wFAAwF;IAC/E,WAAW,SAAO;IAKlB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAElC;IAMG,UAAU,SAAQ;IAE3B;;;;;;;OAOG;IACY,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAIvD;IAED;;;;OAIG;IACM,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACY,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGhD;IAED;;;;;;;;;;;;;;OAcG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWxD;IAED;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAEhF;IAED;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAO9B;IAED,OAAO,CAAC,MAAM;IAId,wEAAwE;IACxE,OAAO,KAAK,OAAO,GAElB;CACF"}
+{"version":3,"file":"RunContainer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/RunContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,YAAa,SAAQ,SAAS,CAAC,GAAG,CAAC;IACvD,wFAAwF;IAC/E,WAAW,SAAO;IAKlB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAElC;IAMG,UAAU,SAAQ;IAE3B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,iBAAiB,CAAQ;IAEjC;;;;;OAKG;IACY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAGtC;IAED;;;;;;;OAOG;IACY,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAIvD;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACY,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACY,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAShD;IAED;;;;;;;;;;;;;;OAcG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWxD;IAED;;;;;;;;OAQG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEnE;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAc9B;IAED,OAAO,CAAC,MAAM;IAId,wEAAwE;IACxE,OAAO,KAAK,OAAO,GAElB;CACF"}

package/dist/infrastructure/containers/RunContainer.js

@@ -1,7 +1,7 @@
 import { Container } from '@cloudflare/containers';
 import { runBestEffort } from '@cat-factory/kernel';
 import { logger } from '../observability/logger';
-import { clearStopCause, isRolloutSignal, recordStopCause, takeStopCause, } from './stopCause';
+import { clearStopCause, isRolloutSignal, observationForStop, recordStopCause, takeStopCause, } from './stopCause';
 /**
  * The behaviour every per-run Cloudflare Container shares: one Durable Object instance per run
  * id hosts that run's sequence of jobs, the harness listens on 8080, and the base
@@ -32,29 +32,73 @@ export class RunContainer extends Container {
     // keeps it warm, which is why an elapsed window is recorded as a reclaim cause rather than
     // left to read as a crash. See `onActivityExpired`.
     sleepAfter = '10m';
+    /**
+     * Whether the stop this container is about to observe is one WE asked for: the idle reclaim in
+     * {@link onActivityExpired} and the deliberate teardown in {@link shutdown}, both of which stop
+     * the container by signalling it.
+     *
+     * It exists because the resulting exit state is evidence about nothing. We sent the signal, so
+     * the code that comes back describes our own request (and escalates to a SIGKILL 137 whenever
+     * the harness does not exit inside the platform's grace period), while the account the run
+     * actually needs is the cause already recorded beside it. Left recorded, that exit is read back
+     * as the container's cause of death and reported as "most often an out-of-memory kill" under a
+     * verdict that says the platform reclaimed an idle container.
+     *
+     * In-memory rather than persisted, and reset by {@link onStart}: it describes ONE stop of ONE
+     * container life, and the isolate cannot outlive the stop it is set for. A container that comes
+     * back up has a real death ahead of it again.
+     */
+    selfInitiatedStop = false;
+    /**
+     * A container life is starting, so nothing from here on is a stop we asked for.
+     *
+     * The base class flushes any deferred `onStop` from the PREVIOUS life before it calls this, so
+     * the reset can never land between a self-initiated stop and the hook that observes it.
+     */
+    async onStart() {
+        this.selfInitiatedStop = false;
+        await super.onStart();
+    }
     /**
      * Record that THIS run's container was drained by a new-version rollout (a deploy, exit 143)
      * rather than crashing. The transport's next job poll (which 404s once the container restarts
-     * empty) reads this back through {@link recentEvictionCause}, so the engine
+     * empty) reads this back through {@link recentStopObservation}, so the engine
      * recovers it on the larger transient budget instead of failing the run as a crash.
      * Persisted to DO storage (not in-memory) so it survives the isolate reset a combined
      * worker+container deploy causes.
      */
     async onError(error) {
         if (isRolloutSignal(error))
-            await this.record('rollout');
+            await this.record({ cause: 'rollout' });
         // Preserve the base behaviour (log + rethrow) so nothing else changes.
         return super.onError(error);
     }
     /**
-     * Belt-and-braces: depending on the runtime version, a rollout drain can surface as a
-     * `runtime_signal` stop with SIGTERM (143) through `onStop` instead of (or as well as)
-     * `onError`. Record it the same way.
+     * Record EVERY stop, with whatever this hook can say about it.
+     *
+     * Two things ride the same write. A `runtime_signal` SIGTERM (143) is a rollout drain, which
+     * depending on the runtime version surfaces here instead of (or as well as) through `onError`,
+     * so it is recorded as that cause the same way. And the `{ exitCode, reason }` pair itself is
+     * recorded for every stop, cause or not, because it is the ONLY account of a death this
+     * runtime can keep: a Cloudflare Container's stdout goes to the deployment's Workers logs and
+     * nothing here can read it back, so without this an OOM-killed agent reaches the operator as
+     * "container evicted or crashed" and nothing else (finding D1).
+     *
+     * Recording an exit changes no verdict: the transient/crash classification still comes from
+     * the cause alone, so a plain crash keeps spending the crash budget and merely says why.
+     *
+     * A stop WE asked for is the exception, and records nothing. Its exit state is the echo of our
+     * own signal rather than an observation, and the cause that explains it has already been
+     * recorded by whoever asked (see {@link selfInitiatedStop}).
+     *
+     * Both rules live in {@link observationForStop}, beside the other half of "what does this stop
+     * mean" (`isRolloutSignal`) and where a plain unit test can reach them: nothing in this class
+     * can be exercised without a real Durable Object.
      */
-    onStop(params) {
-        if (params.reason === 'runtime_signal' && params.exitCode === 143) {
-            void this.record('rollout');
-        }
+    async onStop(params) {
+        const observed = observationForStop(params, this.selfInitiatedStop);
+        if (observed)
+            await this.record(observed);
     }
     /**
      * The idle window elapsed. Record it as the reclaim cause it is, then reclaim as the base
@@ -76,8 +120,13 @@ export class RunContainer extends Container {
      * that case, so a marker would be attributing a reclaim that never happened.
      */
     async onActivityExpired() {
-        if (this.ctx.container?.running)
-            await this.record('idle');
+        if (this.ctx.container?.running) {
+            await this.record({ cause: 'idle' });
+            // The reclaim below is us signalling the container, so the exit it reports is our own
+            // request coming back (a SIGKILL 137 whenever the harness does not exit inside the grace
+            // period) and not a death to attribute. The cause just recorded is the whole account.
+            this.selfInitiatedStop = true;
+        }
         await super.onActivityExpired();
     }
     /**
@@ -106,14 +155,15 @@ export class RunContainer extends Container {
         return res;
     }
     /**
-     * Why this run's container went away, for the transport to read over RPC after `jobId`'s poll
-     * 404s: the one thing that tells a reclaim apart from a crash. `undefined` means no reclaim
-     * this container observed explains that 404, so the caller reports a crash.
+     * What this run's container observed about its own stop, for the transport to read over RPC
+     * after `jobId`'s poll 404s: the `cause` that tells a reclaim apart from a crash, and the
+     * `exit` state that is the only surviving account of the death itself. An EMPTY observation
+     * means nothing this container saw explains that 404, so the caller reports a bare crash.
      *
      * Claimed by the polling job rather than deleted, so a retried durable poll step re-reads the
      * same answer while a different job still finds it spent. See {@link takeStopCause}.
      */
-    async recentEvictionCause(jobId) {
+    async recentStopObservation(jobId) {
         return takeStopCause(this.storage, Date.now(), jobId);
     }
     /**
@@ -122,8 +172,19 @@ export class RunContainer extends Container {
      * isn't billed while idle. Best-effort and idempotent: destroying an already-stopped
      * container is a no-op, and we swallow any error so the caller's failure handling is never
      * derailed by cleanup.
+     *
+     * It is also where the stop record's life ENDS. A record is written on every stop and deleted
+     * only when a NEW job is accepted, so without this the last one a run ever observed sits in
+     * that run's Durable Object for good: the run is over, no dispatch is coming to clear it, and
+     * the value is a diagnostic nobody will read again. Deleting it here is what keeps the whole
+     * mechanism transient rather than a per-run key that accumulates for the lifetime of the
+     * deployment.
+     *
+     * Ordered after the teardown so the destroy's own `onStop` cannot land behind the delete,
+     * belt-and-braces with {@link selfInitiatedStop}, which stops that hook writing at all.
      */
     async shutdown() {
+        this.selfInitiatedStop = true;
         try {
             await this.destroy();
         }
@@ -131,9 +192,13 @@ export class RunContainer extends Container {
             // silent-catch-ok: already gone / not running, so there is nothing to reclaim and nothing
             // for an operator to do about it.
         }
+        // Best-effort: the container is reclaimed either way, and a retained key is a tidiness
+        // problem, never a correctness one. Reported rather than swallowed so a storage backend
+        // failing every delete does not stay invisible.
+        await runBestEffort(logger, 'clear container stop cause on shutdown', () => clearStopCause(this.storage));
     }
-    record(cause) {
-        return recordStopCause(this.storage, cause, Date.now());
+    record(observed) {
+        return recordStopCause(this.storage, observed, Date.now());
     }
     /** The DO storage, narrowed to what the stop-cause bookkeeping uses. */
     get storage() {

package/dist/infrastructure/containers/RunContainer.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunContainer.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/RunContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAChD,OAAO,EACL,cAAc,EAEd,eAAe,EACf,eAAe,EAEf,aAAa,GACd,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAgB,YAAa,SAAQ,SAAc;IACvD,wFAAwF;IAC/E,WAAW,GAAG,IAAI,CAAA;IAE3B,8FAA8F;IAC9F,wFAAwF;IACxF,kEAAkE;IACzD,OAAO,GAA2B,IAAI,CAAC,GAAG,CAAC,qBAAqB;QACvE,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAA;IAEN,4FAA4F;IAC5F,2FAA2F;IAC3F,2FAA2F;IAC3F,oDAAoD;IAC3C,UAAU,GAAG,KAAK,CAAA;IAE3B;;;;;;;OAOG;IACM,KAAK,CAAC,OAAO,CAAC,KAAc;QACnC,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACxD,uEAAuE;QACvE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED;;;;OAIG;IACM,MAAM,CAAC,MAAkB;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAClE,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACM,KAAK,CAAC,iBAAiB;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC1D,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAA;IACjC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACrC,wFAAwF;YACxF,2FAA2F;YAC3F,4EAA4E;YAC5E,MAAM,aAAa,CAAC,MAAM,EAAE,wCAAwC,EAAE,GAAG,EAAE,CACzE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAC7B,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,kCAAkC;QACpC,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAyB;QACtC,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,wEAAwE;IACxE,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAsC,CAAA;IACxD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"RunContainer.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/RunContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAChD,OAAO,EACL,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,eAAe,EAGf,aAAa,GACd,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAgB,YAAa,SAAQ,SAAc;IACvD,wFAAwF;IAC/E,WAAW,GAAG,IAAI,CAAA;IAE3B,8FAA8F;IAC9F,wFAAwF;IACxF,kEAAkE;IACzD,OAAO,GAA2B,IAAI,CAAC,GAAG,CAAC,qBAAqB;QACvE,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAA;IAEN,4FAA4F;IAC5F,2FAA2F;IAC3F,2FAA2F;IAC3F,oDAAoD;IAC3C,UAAU,GAAG,KAAK,CAAA;IAE3B;;;;;;;;;;;;;;;OAeG;IACK,iBAAiB,GAAG,KAAK,CAAA;IAEjC;;;;;OAKG;IACM,KAAK,CAAC,OAAO;QACpB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAA;QAC9B,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACM,KAAK,CAAC,OAAO,CAAC,KAAc;QACnC,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACnE,uEAAuE;QACvE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACM,KAAK,CAAC,MAAM,CAAC,MAAkB;QACtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,QAAQ;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACM,KAAK,CAAC,iBAAiB;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACpC,sFAAsF;YACtF,yFAAyF;YACzF,sFAAsF;YACtF,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAC/B,CAAC;QACD,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAA;IACjC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACrC,wFAAwF;YACxF,2FAA2F;YAC3F,4EAA4E;YAC5E,MAAM,aAAa,CAAC,MAAM,EAAE,wCAAwC,EAAE,GAAG,EAAE,CACzE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAC7B,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAAa;QACvC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,kCAAkC;QACpC,CAAC;QACD,uFAAuF;QACvF,wFAAwF;QACxF,gDAAgD;QAChD,MAAM,aAAa,CAAC,MAAM,EAAE,wCAAwC,EAAE,GAAG,EAAE,CACzE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAC7B,CAAA;IACH,CAAC;IAEO,MAAM,CAAC,QAAyB;QACtC,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,wEAAwE;IACxE,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAsC,CAAA;IACxD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/infrastructure/containers/stopCause.d.ts

@@ -12,9 +12,30 @@
 export type ContainerStopCause = 'rollout' | 'idle';
 /** DO-storage key holding the {@link StopCauseRecord} of the most recent self-observed stop. */
 export declare const STOP_CAUSE_KEY = "containerStopCause";
-/** What the container persists when it observes its own reclaim. */
+/**
+ * What the runtime reported when the workload stopped, mirroring the container base class's
+ * `StopParams`. Recorded for EVERY stop, including the ones no {@link ContainerStopCause}
+ * explains, because it answers a different question: the cause decides the recovery BUDGET, the
+ * exit state is the only account of the death anyone gets afterwards.
+ *
+ * A Cloudflare Container's stdout is delivered to the deployment's Workers logs and is not
+ * readable back from inside the Durable Object, so this is the whole of the post-mortem this
+ * runtime can mint. It is still the difference between "container evicted or crashed" and "exit
+ * code 137", i.e. between a run nobody can diagnose and an out-of-memory kill.
+ */
+export interface ContainerExitState {
+    code: number;
+    reason: 'exit' | 'runtime_signal';
+}
+/** What the container persists when it observes its own stop. */
 export interface StopCauseRecord {
-    cause: ContainerStopCause;
+    /**
+     * The infrastructure-churn cause, when the container recognised one. Absent for a stop it
+     * cannot explain (a crash, an OOM kill), which is exactly the case {@link exit} exists for.
+     */
+    cause?: ContainerStopCause;
+    /** What the runtime reported about the stop, when a hook that carries it fired. */
+    exit?: ContainerExitState;
     /** Epoch ms the stop was observed. */
     at: number;
     /**
@@ -49,6 +70,42 @@ export declare const ATTRIBUTION_WINDOW_MS: {
     rollout: number;
     idle: number;
 };
+/**
+ * How long a stop this container could NOT attribute (a crash, an OOM kill) may still explain a
+ * 404 poll, i.e. the window governing a record that carries only an {@link ContainerExitState}.
+ *
+ * The same reasoning as the `idle` window, and deliberately the same number: what separates the
+ * death from the poll that discovers it is the POLL GAP, and a crash is discovered by the same
+ * ~15s tick an idle reclaim is, stretched by whatever delayed the driver. Sizing this to the
+ * rollout case instead would read every crash discovered after a re-drive as unexplained, which
+ * is the class this record exists to explain.
+ *
+ * Wide is affordable here for a reason the cause windows do not share: an exit state changes no
+ * verdict. It is attached to the failure `detail`, so the cost of over-attributing is a
+ * misleading sentence, never a wrongly-extended recovery budget.
+ */
+export declare const EXIT_ATTRIBUTION_WINDOW_MS: number;
+/**
+ * How far apart two hook calls may be and still be treated as observations of ONE stop, i.e. the
+ * bound on {@link recordStopCause}'s merge.
+ *
+ * The merge exists for a single reason: `onError` and `onStop` are two views of the same death,
+ * fired by the runtime within moments of each other. Anything older is a DIFFERENT, earlier
+ * stop, and merging onto it is not conservative, it is destructive twice over: the new
+ * observation inherits the old record's `at`, so it is born already aged, and both halves then
+ * fall out of their own attribution windows and explain nothing. A record that is 40 minutes old
+ * would silently swallow the crash that just happened.
+ *
+ * Sized generously against what it models (two hooks, milliseconds apart) and far below the
+ * narrowest attribution window, so it cannot be the thing that decides an attribution: what a
+ * merge may do is complete an account of one stop, never date it.
+ */
+export declare const STOP_MERGE_WINDOW_MS = 60000;
+/** What a container observed about its own stop, once attributed to the job that reads it. */
+export interface StopObservation {
+    cause?: ContainerStopCause;
+    exit?: ContainerExitState;
+}
 /**
  * The message the base container class surfaces when the RUNTIME (not the workload) stopped a
  * container: a deploy draining the old version. Its own exit-code parser is keyed on the plain
@@ -57,18 +114,43 @@ export declare const ATTRIBUTION_WINDOW_MS: {
  */
 export declare function isRolloutSignal(error: unknown): boolean;
 /**
- * The cause a stored record still justifies at `now`, or `undefined` when there is nothing to
- * attribute.
+ * What a container should record about a stop the runtime just reported, or undefined when it
+ * should record nothing.
+ *
+ * Two rules, both about what the stop MEANS rather than what it says:
+ *
+ * - A `runtime_signal` 143 is the rollout drain surfacing through this hook instead of (or as
+ *   well as) `onError`, depending on the runtime version, so it names the same cause.
+ * - A stop the container ASKED for records nothing at all. Its idle reclaim and its shutdown RPC
+ *   both work by signalling the container, so the exit that comes back is this container's own
+ *   request echoed at it (escalating to a SIGKILL 137 when the workload does not exit inside the
+ *   grace period), not an observation of how anything died. Recorded anyway, it is read back as
+ *   the container's cause of death and reported to the operator as "most often an out-of-memory
+ *   kill" underneath a verdict that says the platform reclaimed an idle container. The cause the
+ *   caller recorded when it decided to stop is the whole account, and it is already stored.
+ */
+export declare function observationForStop(params: {
+    exitCode: number;
+    reason: 'exit' | 'runtime_signal';
+}, selfInitiated: boolean): StopObservation | undefined;
+/**
+ * What a stored record still explains at `now`, or an EMPTY observation when it explains
+ * nothing.
  *
- * `undefined` covers three things that all mean the same to the caller: nothing was recorded,
- * the record outlived its cause's window (the container recovered and ran on, so a later death
+ * An empty observation covers three things that all mean the same to the caller: nothing was
+ * recorded, the record outlived its window (the container recovered and ran on, so a later death
  * is its own), or the record names a cause this build no longer has. The last is possible
  * because the record is PERSISTED and the vocabulary is closed: a deploy that retires a member
  * leaves rows behind. All three land on the caller's existing default, reporting the eviction
  * as a `crash`, which is the honest reading of "no attribution" and the conservative one:
  * it costs a run one restart of its recovery budget, never a wrongly-extended one.
+ *
+ * The two halves are attributed INDEPENDENTLY, on their own windows: a record can be too old to
+ * excuse the eviction as churn while still being the only account of how the container died, and
+ * dropping the exit state with the cause would throw away the diagnostic to protect a budget the
+ * diagnostic never touches.
  */
-export declare function attributeStopCause(record: unknown, now: number, claimant: string): ContainerStopCause | undefined;
+export declare function attributeStopCause(record: unknown, now: number, claimant: string): StopObservation;
 /**
  * The slice of DO storage the bookkeeping below needs. Narrowed to three methods so the rules
  * can be exercised against a plain fake. The alternative is asserting them through a real
@@ -79,8 +161,57 @@ export interface StopCauseStorage {
     put: (key: string, value: StopCauseRecord) => Promise<void>;
     delete: (key: string) => Promise<unknown>;
 }
-/** Persist what this container just observed about its own reclaim. */
-export declare function recordStopCause(storage: StopCauseStorage, cause: ContainerStopCause, now: number): Promise<void>;
+/**
+ * Persist what this container just observed about its own stop, MERGING onto an unclaimed record
+ * of the SAME stop rather than replacing it.
+ *
+ * Merging is the point. One stop reaches this container through up to two hooks carrying
+ * different halves of the answer: `onError` recognises a rollout drain and knows no exit state,
+ * `onStop` carries `{ exitCode, reason }` and cannot name the churn. They fire in either order
+ * (and, on some runtime versions, both), so a plain overwrite means whichever landed second
+ * silently discarded the other's half: either the recovery budget or the only account of the
+ * death, depending on the ordering that day.
+ *
+ * Two records are never merged:
+ *
+ * - a CLAIMED one, which has already explained somebody's eviction, so anything observed after
+ *   it belongs to the next one;
+ * - one older than {@link STOP_MERGE_WINDOW_MS}, which is a different stop entirely. This
+ *   container's records are not reliably cleared between stops (`takeStopCause` deliberately
+ *   leaves an expired record in place, and only an accepted dispatch deletes one), so a stale
+ *   record is the ORDINARY state of a container that idled out and was re-driven, not an edge
+ *   case. Merging onto it would back-date the new observation to the old stop's `at` and age it
+ *   out of its own attribution window on arrival: the crash that just happened would be
+ *   recorded, read back, and dropped as too old to explain the eviction it caused.
+ *
+ * The kept `at` is the EARLIEST of the two observations, which within the merge window is a
+ * choice between timestamps moments apart: both describe one stop, and the window measures how
+ * long ago that stop happened.
+ */
+export declare function recordStopCause(storage: StopCauseStorage, observed: StopObservation, now: number): Promise<void>;
+/**
+ * The one-line account of a container's stop for the eviction `detail`, or undefined when
+ * nothing was recorded.
+ *
+ * `cause` is the account the run has ALREADY been given, and passing it is what keeps the detail
+ * from arguing with the verdict beside it. The two halves are recorded independently and the
+ * exit state is attached whether or not a cause was recognised, so they routinely describe one
+ * event twice: an idle reclaim is performed BY the platform with a SIGKILL, so a run correctly
+ * reported as "idle container reclaimed between polls" carries exit 137, and read as an
+ * unexplained death that code says "most often an out-of-memory kill". The operator is then
+ * holding a verdict and a detail that cannot both be true, which is worse than either alone,
+ * because there is no way to tell which one to act on.
+ *
+ * So the interpretation is offered only where it is the only account there is. Where a cause was
+ * named, the exit code is reported as the MECHANICS of that stop: still the difference between
+ * "reclaimed" and "reclaimed with a SIGKILL", and never a second, competing cause of death.
+ *
+ * Either way it states the platform's own limit rather than leaving it to be inferred: a
+ * Cloudflare Container writes its stdout to the deployment's Workers logs, and nothing inside
+ * the Durable Object can read it back, so an operator who reads this and goes looking for a log
+ * tail here should be told where the tail actually is.
+ */
+export declare function describeContainerExit(exit: ContainerExitState | undefined, cause?: ContainerStopCause): string | undefined;
 /**
  * Forget whatever this container observed before now.
  *
@@ -93,13 +224,17 @@ export declare function recordStopCause(storage: StopCauseStorage, cause: Contai
  */
 export declare function clearStopCause(storage: StopCauseStorage): Promise<void>;
 /**
- * Read the cause explaining `claimant`'s 404 poll, CLAIMING it for that job.
+ * Read what explains `claimant`'s 404 poll, CLAIMING it for that job.
  *
- * One reclaim explains exactly one job's eviction: the engine answers one by re-dispatching onto
+ * One stop explains exactly one job's eviction: the engine answers one by re-dispatching onto
  * a fresh container under the same DO id, so an unclaimed record would still be sitting there to
  * excuse the next death, whenever and for whatever reason it came. The claim is written rather
  * than the record deleted so a REPLAYED poll for the same job reads back the same answer (see
  * {@link StopCauseRecord.claimedBy}).
+ *
+ * The claim covers the record, not one half of it: an exit state read here is spent as surely as
+ * a cause is, because attaching one container's death to two runs' failures is the same lie
+ * either way.
  */
-export declare function takeStopCause(storage: StopCauseStorage, now: number, claimant: string): Promise<ContainerStopCause | undefined>;
+export declare function takeStopCause(storage: StopCauseStorage, now: number, claimant: string): Promise<StopObservation>;
 //# sourceMappingURL=stopCause.d.ts.map

package/dist/infrastructure/containers/stopCause.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stopCause.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAA;AAEnD,gGAAgG;AAChG,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAElD,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,kBAAkB,CAAA;IACzB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGY,CAAA;AAE9C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAWD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAQhC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1C;AAED,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CASzC"}
+{"version":3,"file":"stopCause.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAA;AAEnD,gGAAgG;AAChG,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAElD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAClC;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,mFAAmF;IACnF,IAAI,CAAC,EAAE,kBAAkB,CAAA;IACzB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGY,CAAA;AAE9C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAE1C,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,IAAI,CAAC,EAAE,kBAAkB,CAAA;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,EAC/D,aAAa,EAAE,OAAO,GACrB,eAAe,GAAG,SAAS,CAO7B;AAwBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,eAAe,CAYjB;AAOD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAUf;AAmDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,GAAG,SAAS,EACpC,KAAK,CAAC,EAAE,kBAAkB,GACzB,MAAM,GAAG,SAAS,CAgBpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAS1B"}

package/dist/infrastructure/containers/stopCause.js

@@ -26,6 +26,37 @@ export const ATTRIBUTION_WINDOW_MS = {
     rollout: 120_000,
     idle: 30 * 60_000,
 };
+/**
+ * How long a stop this container could NOT attribute (a crash, an OOM kill) may still explain a
+ * 404 poll, i.e. the window governing a record that carries only an {@link ContainerExitState}.
+ *
+ * The same reasoning as the `idle` window, and deliberately the same number: what separates the
+ * death from the poll that discovers it is the POLL GAP, and a crash is discovered by the same
+ * ~15s tick an idle reclaim is, stretched by whatever delayed the driver. Sizing this to the
+ * rollout case instead would read every crash discovered after a re-drive as unexplained, which
+ * is the class this record exists to explain.
+ *
+ * Wide is affordable here for a reason the cause windows do not share: an exit state changes no
+ * verdict. It is attached to the failure `detail`, so the cost of over-attributing is a
+ * misleading sentence, never a wrongly-extended recovery budget.
+ */
+export const EXIT_ATTRIBUTION_WINDOW_MS = 30 * 60_000;
+/**
+ * How far apart two hook calls may be and still be treated as observations of ONE stop, i.e. the
+ * bound on {@link recordStopCause}'s merge.
+ *
+ * The merge exists for a single reason: `onError` and `onStop` are two views of the same death,
+ * fired by the runtime within moments of each other. Anything older is a DIFFERENT, earlier
+ * stop, and merging onto it is not conservative, it is destructive twice over: the new
+ * observation inherits the old record's `at`, so it is born already aged, and both halves then
+ * fall out of their own attribution windows and explain nothing. A record that is 40 minutes old
+ * would silently swallow the crash that just happened.
+ *
+ * Sized generously against what it models (two hooks, milliseconds apart) and far below the
+ * narrowest attribution window, so it cannot be the thing that decides an attribution: what a
+ * merge may do is complete an account of one stop, never date it.
+ */
+export const STOP_MERGE_WINDOW_MS = 60_000;
 /**
  * The message the base container class surfaces when the RUNTIME (not the workload) stopped a
  * container: a deploy draining the old version. Its own exit-code parser is keyed on the plain
@@ -36,6 +67,31 @@ export function isRolloutSignal(error) {
     const message = error instanceof Error ? error.message : typeof error === 'string' ? error : String(error);
     return /new version rollout|runtime signalled the container to exit/i.test(message);
 }
+/**
+ * What a container should record about a stop the runtime just reported, or undefined when it
+ * should record nothing.
+ *
+ * Two rules, both about what the stop MEANS rather than what it says:
+ *
+ * - A `runtime_signal` 143 is the rollout drain surfacing through this hook instead of (or as
+ *   well as) `onError`, depending on the runtime version, so it names the same cause.
+ * - A stop the container ASKED for records nothing at all. Its idle reclaim and its shutdown RPC
+ *   both work by signalling the container, so the exit that comes back is this container's own
+ *   request echoed at it (escalating to a SIGKILL 137 when the workload does not exit inside the
+ *   grace period), not an observation of how anything died. Recorded anyway, it is read back as
+ *   the container's cause of death and reported to the operator as "most often an out-of-memory
+ *   kill" underneath a verdict that says the platform reclaimed an idle container. The cause the
+ *   caller recorded when it decided to stop is the whole account, and it is already stored.
+ */
+export function observationForStop(params, selfInitiated) {
+    if (selfInitiated)
+        return undefined;
+    const rollout = params.reason === 'runtime_signal' && params.exitCode === 143;
+    return {
+        ...(rollout ? { cause: 'rollout' } : {}),
+        exit: { code: params.exitCode, reason: params.reason },
+    };
+}
 /**
  * Whether a value read back out of DO storage is still a cause this build knows. Derived from
  * the window table's own keys rather than restated, so retiring a cause fails the build here
@@ -45,32 +101,177 @@ function isContainerStopCause(value) {
     return typeof value === 'string' && Object.hasOwn(ATTRIBUTION_WINDOW_MS, value);
 }
 /**
- * The cause a stored record still justifies at `now`, or `undefined` when there is nothing to
- * attribute.
+ * Whether a value read back out of DO storage is an exit state this build can render.
  *
- * `undefined` covers three things that all mean the same to the caller: nothing was recorded,
- * the record outlived its cause's window (the container recovered and ran on, so a later death
+ * The `reason` union is closed and PERSISTED, so an unknown member is possible after a runtime
+ * bump; it degrades to "no exit state recorded" rather than being rendered as a bare string,
+ * because a reason nobody has worded says less than the exit code alone already does.
+ */
+function isContainerExitState(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const { code, reason } = value;
+    return typeof code === 'number' && (reason === 'exit' || reason === 'runtime_signal');
+}
+/**
+ * What a stored record still explains at `now`, or an EMPTY observation when it explains
+ * nothing.
+ *
+ * An empty observation covers three things that all mean the same to the caller: nothing was
+ * recorded, the record outlived its window (the container recovered and ran on, so a later death
  * is its own), or the record names a cause this build no longer has. The last is possible
  * because the record is PERSISTED and the vocabulary is closed: a deploy that retires a member
  * leaves rows behind. All three land on the caller's existing default, reporting the eviction
  * as a `crash`, which is the honest reading of "no attribution" and the conservative one:
  * it costs a run one restart of its recovery budget, never a wrongly-extended one.
+ *
+ * The two halves are attributed INDEPENDENTLY, on their own windows: a record can be too old to
+ * excuse the eviction as churn while still being the only account of how the container died, and
+ * dropping the exit state with the cause would throw away the diagnostic to protect a budget the
+ * diagnostic never touches.
  */
 export function attributeStopCause(record, now, claimant) {
     if (!record || typeof record !== 'object')
-        return undefined;
-    const { cause, at, claimedBy } = record;
-    if (!isContainerStopCause(cause) || typeof at !== 'number')
-        return undefined;
+        return {};
+    const { cause, exit, at, claimedBy } = record;
+    if (typeof at !== 'number')
+        return {};
     // Spent on somebody else's eviction. Only the job that claimed it may read it back, which is
     // what lets a replay be idempotent without letting one reclaim excuse two deaths.
     if (claimedBy !== undefined && claimedBy !== claimant)
+        return {};
+    const age = now - at;
+    return {
+        ...(isContainerStopCause(cause) && age <= ATTRIBUTION_WINDOW_MS[cause] ? { cause } : {}),
+        ...(isContainerExitState(exit) && age <= EXIT_ATTRIBUTION_WINDOW_MS ? { exit } : {}),
+    };
+}
+/** Whether an observation carries anything at all (i.e. whether claiming it is worth a write). */
+function isEmptyObservation(observation) {
+    return !observation.cause && !observation.exit;
+}
+/**
+ * Persist what this container just observed about its own stop, MERGING onto an unclaimed record
+ * of the SAME stop rather than replacing it.
+ *
+ * Merging is the point. One stop reaches this container through up to two hooks carrying
+ * different halves of the answer: `onError` recognises a rollout drain and knows no exit state,
+ * `onStop` carries `{ exitCode, reason }` and cannot name the churn. They fire in either order
+ * (and, on some runtime versions, both), so a plain overwrite means whichever landed second
+ * silently discarded the other's half: either the recovery budget or the only account of the
+ * death, depending on the ordering that day.
+ *
+ * Two records are never merged:
+ *
+ * - a CLAIMED one, which has already explained somebody's eviction, so anything observed after
+ *   it belongs to the next one;
+ * - one older than {@link STOP_MERGE_WINDOW_MS}, which is a different stop entirely. This
+ *   container's records are not reliably cleared between stops (`takeStopCause` deliberately
+ *   leaves an expired record in place, and only an accepted dispatch deletes one), so a stale
+ *   record is the ORDINARY state of a container that idled out and was re-driven, not an edge
+ *   case. Merging onto it would back-date the new observation to the old stop's `at` and age it
+ *   out of its own attribution window on arrival: the crash that just happened would be
+ *   recorded, read back, and dropped as too old to explain the eviction it caused.
+ *
+ * The kept `at` is the EARLIEST of the two observations, which within the merge window is a
+ * choice between timestamps moments apart: both describe one stop, and the window measures how
+ * long ago that stop happened.
+ */
+export async function recordStopCause(storage, observed, now) {
+    const mergeable = mergeableRecord(await storage.get(STOP_CAUSE_KEY), now);
+    const at = mergeable ? Math.min(mergeable.at, now) : now;
+    const cause = observed.cause ?? mergeable?.cause;
+    const exit = observed.exit ?? mergeable?.exit;
+    await storage.put(STOP_CAUSE_KEY, {
+        ...(cause ? { cause } : {}),
+        ...(exit ? { exit } : {}),
+        at,
+    });
+}
+/**
+ * The stored record a new observation may complete, i.e. an unclaimed one describing the same
+ * stop. Anything else (absent, malformed, claimed, or from an earlier stop) is undefined, and
+ * the new observation stands alone.
+ */
+function mergeableRecord(stored, now) {
+    if (!stored || typeof stored !== 'object')
+        return undefined;
+    const record = stored;
+    if (record.claimedBy !== undefined)
         return undefined;
-    return now - at <= ATTRIBUTION_WINDOW_MS[cause] ? cause : undefined;
+    if (typeof record.at !== 'number')
+        return undefined;
+    // `now - at` rather than an absolute difference: a record stamped in the FUTURE (a clock
+    // adjustment between two hook calls) is one of ours moments ago, not a stale one.
+    if (now - record.at > STOP_MERGE_WINDOW_MS)
+        return undefined;
+    return record;
 }
-/** Persist what this container just observed about its own reclaim. */
-export async function recordStopCause(storage, cause, now) {
-    await storage.put(STOP_CAUSE_KEY, { cause, at: now });
+/**
+ * What an exit code IS, independent of why the container stopped.
+ *
+ * A bounded map rather than a `128 + n` derivation on purpose: the platform reports one number
+ * and only a couple of them are worth translating, while decoding an arbitrary code into a
+ * signal name would confidently mislabel an application exit code that merely happens to exceed
+ * 128. An unmapped code is reported as itself.
+ */
+const EXIT_SIGNAL_NAMES = {
+    137: 'SIGKILL',
+    143: 'SIGTERM',
+};
+/**
+ * What an exit code SUGGESTS about a death nothing else explains. Read only when no
+ * {@link ContainerStopCause} was recognised, which is what makes the guess worth offering: the
+ * alternative there is silence.
+ *
+ * Kept apart from {@link EXIT_SIGNAL_NAMES} because the two are different kinds of claim. The
+ * signal name is a fact about the number; this is an inference from the absence of any other
+ * account, and it is false exactly when that absence is false.
+ */
+const UNEXPLAINED_EXIT_NOTES = {
+    // Killed outright rather than exiting. With nothing else to explain it, on this runtime that
+    // is overwhelmingly the instance running out of memory, which is why it is worth saying.
+    137: 'most often an out-of-memory kill or a forced stop',
+    // Something asked it to stop, and whatever it was left no cause behind for us to name.
+    143: 'something asked the container to stop',
+};
+/**
+ * The one-line account of a container's stop for the eviction `detail`, or undefined when
+ * nothing was recorded.
+ *
+ * `cause` is the account the run has ALREADY been given, and passing it is what keeps the detail
+ * from arguing with the verdict beside it. The two halves are recorded independently and the
+ * exit state is attached whether or not a cause was recognised, so they routinely describe one
+ * event twice: an idle reclaim is performed BY the platform with a SIGKILL, so a run correctly
+ * reported as "idle container reclaimed between polls" carries exit 137, and read as an
+ * unexplained death that code says "most often an out-of-memory kill". The operator is then
+ * holding a verdict and a detail that cannot both be true, which is worse than either alone,
+ * because there is no way to tell which one to act on.
+ *
+ * So the interpretation is offered only where it is the only account there is. Where a cause was
+ * named, the exit code is reported as the MECHANICS of that stop: still the difference between
+ * "reclaimed" and "reclaimed with a SIGKILL", and never a second, competing cause of death.
+ *
+ * Either way it states the platform's own limit rather than leaving it to be inferred: a
+ * Cloudflare Container writes its stdout to the deployment's Workers logs, and nothing inside
+ * the Durable Object can read it back, so an operator who reads this and goes looking for a log
+ * tail here should be told where the tail actually is.
+ */
+export function describeContainerExit(exit, cause) {
+    if (!exit)
+        return undefined;
+    const signal = EXIT_SIGNAL_NAMES[exit.code];
+    const note = cause
+        ? signal
+        : [signal, UNEXPLAINED_EXIT_NOTES[exit.code]].filter(Boolean).join(', ');
+    const how = cause
+        ? 'the runtime reported it as'
+        : exit.reason === 'runtime_signal'
+            ? 'the runtime signalled it to exit, with'
+            : 'the workload inside it exited, with';
+    return (`The run's container stopped while the job was running: ${how} exit code ${exit.code}` +
+        `${note ? ` (${note})` : ''}. The container's own output is not readable from the Worker; ` +
+        `it is in this deployment's Workers logs.`);
 }
 /**
  * Forget whatever this container observed before now.
@@ -86,23 +287,27 @@ export async function clearStopCause(storage) {
     await storage.delete(STOP_CAUSE_KEY);
 }
 /**
- * Read the cause explaining `claimant`'s 404 poll, CLAIMING it for that job.
+ * Read what explains `claimant`'s 404 poll, CLAIMING it for that job.
  *
- * One reclaim explains exactly one job's eviction: the engine answers one by re-dispatching onto
+ * One stop explains exactly one job's eviction: the engine answers one by re-dispatching onto
  * a fresh container under the same DO id, so an unclaimed record would still be sitting there to
  * excuse the next death, whenever and for whatever reason it came. The claim is written rather
  * than the record deleted so a REPLAYED poll for the same job reads back the same answer (see
  * {@link StopCauseRecord.claimedBy}).
+ *
+ * The claim covers the record, not one half of it: an exit state read here is spent as surely as
+ * a cause is, because attaching one container's death to two runs' failures is the same lie
+ * either way.
  */
 export async function takeStopCause(storage, now, claimant) {
     const record = await storage.get(STOP_CAUSE_KEY);
-    const cause = attributeStopCause(record, now, claimant);
+    const observation = attributeStopCause(record, now, claimant);
     // Nothing to claim: either there was no record, it was spent, or it is too old to explain
     // anything. Leaving an expired record in place costs one key until the next reclaim
     // overwrites it, and rewriting it here would only re-date somebody else's observation.
-    if (!cause)
-        return undefined;
+    if (isEmptyObservation(observation))
+        return observation;
     await storage.put(STOP_CAUSE_KEY, { ...record, claimedBy: claimant });
-    return cause;
+    return observation;
 }
 //# sourceMappingURL=stopCause.js.map

package/dist/infrastructure/containers/stopCause.js.map

@@ -1 +1 @@
-{"version":3,"file":"stopCause.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,4FAA4F;AAC5F,8CAA8C;AAe9C,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAoBlD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,EAAE,GAAG,MAAM;CAC2B,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5F,OAAO,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACrF,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;AACjF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,GAAW,EACX,QAAgB;IAEhB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC3D,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAkC,CAAA;IACnE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC5E,6FAA6F;IAC7F,kFAAkF;IAClF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACvE,OAAO,GAAG,GAAG,EAAE,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACrE,CAAC;AAaD,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAyB,EACzB,KAAyB,EACzB,GAAW;IAEX,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAyB,EACzB,GAAW,EACX,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IACvD,0FAA0F;IAC1F,oFAAoF;IACpF,uFAAuF;IACvF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAI,MAA0B,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1F,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"stopCause.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,4FAA4F;AAC5F,8CAA8C;AAe9C,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AA0ClD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,EAAE,GAAG,MAAM;CAC2B,CAAA;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,MAAM,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAQ1C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5F,OAAO,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA+D,EAC/D,aAAsB;IAEtB,IAAI,aAAa;QAAE,OAAO,SAAS,CAAA;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAA;IAC7E,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACvD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;AACjF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAoC,CAAA;IAC7D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,gBAAgB,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,GAAW,EACX,QAAgB;IAEhB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACpD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAkC,CAAA;IACzE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACrC,6FAA6F;IAC7F,kFAAkF;IAClF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAChE,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,CAAA;IACpB,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,0BAA0B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAA;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,kBAAkB,CAAC,WAA4B;IACtD,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;AAChD,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAyB,EACzB,QAAyB,EACzB,GAAW;IAEX,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAA;IACzE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,CAAA;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,EAAE,IAAI,CAAA;IAC7C,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;QAChC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,EAAE;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,MAAe,EACf,GAAW;IAEX,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAkC,CAAA;IACjD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACpD,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACnD,yFAAyF;IACzF,kFAAkF;IAClF,IAAI,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG,oBAAoB;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO,MAAmD,CAAA;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAA2B;IAChD,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,SAAS;CACf,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAA2B;IACrD,6FAA6F;IAC7F,yFAAyF;IACzF,GAAG,EAAE,mDAAmD;IACxD,uFAAuF;IACvF,GAAG,EAAE,uCAAuC;CAC7C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoC,EACpC,KAA0B;IAE1B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,gBAAgB;YAChC,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,qCAAqC,CAAA;IAC3C,OAAO,CACL,0DAA0D,GAAG,cAAc,IAAI,CAAC,IAAI,EAAE;QACtF,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,gEAAgE;QAC3F,0CAA0C,CAC3C,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAyB,EACzB,GAAW,EACX,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC7D,0FAA0F;IAC1F,oFAAoF;IACpF,uFAAuF;IACvF,IAAI,kBAAkB,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAA;IACvD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAI,MAA0B,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1F,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/infrastructure/repositories/D1BinaryArtifactMetadataStore.d.ts

@@ -12,6 +12,7 @@ export declare class D1BinaryArtifactMetadataStore implements BinaryArtifactMeta
     countByExecution(workspaceId: string, executionId: string): Promise<number>;
     listByBlock(workspaceId: string, blockId: string): Promise<BinaryArtifactRecord[]>;
     listByDocument(workspaceId: string, document: DocumentArtifactRef): Promise<BinaryArtifactRecord[]>;
+    listByDocuments(workspaceId: string, documents: readonly DocumentArtifactRef[]): Promise<BinaryArtifactRecord[]>;
     deleteByIds(workspaceId: string, ids: readonly string[]): Promise<number>;
     delete(workspaceId: string, id: string): Promise<void>;
     listOlderThan(workspaceId: string, olderThan: number): Promise<BinaryArtifactRecord[]>;

package/dist/infrastructure/repositories/D1BinaryArtifactMetadataStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1BinaryArtifactMetadataStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1BinaryArtifactMetadataStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EAEpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AA2C3D,+FAA+F;AAC/F,qBAAa,6BAA8B,YAAW,2BAA2B;IAC/E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxD;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAM/E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAU/F;IAEK,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhF;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUvF;IAEK,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUjC;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9E;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D;IAIK,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAS3F;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS7E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAM1E;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5D;CACF"}
+{"version":3,"file":"D1BinaryArtifactMetadataStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1BinaryArtifactMetadataStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EAEpB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAqD3D,+FAA+F;AAC/F,qBAAa,6BAA8B,YAAW,2BAA2B;IAC/E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxD;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAM/E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAU/F;IAEK,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhF;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUvF;IAEK,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUjC;IAEK,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,mBAAmB,EAAE,GACxC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAoBjC;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9E;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D;IAIK,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAS3F;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS7E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAM1E;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5D;CACF"}

package/dist/infrastructure/repositories/D1BinaryArtifactMetadataStore.js

@@ -1,3 +1,4 @@
+import { dedupeDocumentRefs } from '@cat-factory/kernel';
 import { chunkForIn } from './chunk';
 function rowToRecord(row) {
     return {
@@ -20,6 +21,13 @@ function rowToRecord(row) {
         createdAt: row.created_at,
     };
 }
+/**
+ * Order rows the way every list read on this table returns them (`created_at`, then `id`), for a
+ * batch read whose result is the concatenation of several statements.
+ */
+function sortArtifactRows(rows) {
+    return rows.sort((a, b) => a.created_at - b.created_at || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}
 /** D1-backed metadata store for binary artifacts (see migration 0017). Bytes live in R2/S3. */
 export class D1BinaryArtifactMetadataStore {
     db;
@@ -77,6 +85,28 @@ export class D1BinaryArtifactMetadataStore {
             .all();
         return (results ?? []).map(rowToRecord);
     }
+    async listByDocuments(workspaceId, documents) {
+        const refs = dedupeDocumentRefs(documents);
+        if (!refs.length)
+            return [];
+        const rows = [];
+        // Two bound params per ref (source + external id), so the chunk size is derived from that
+        // rather than from the scalar-`IN` default.
+        for (const chunk of chunkForIn(refs, 2)) {
+            const clauses = chunk
+                .map(() => '(document_source = ? AND document_external_id = ?)')
+                .join(' OR ');
+            const { results } = await this.db
+                .prepare(`SELECT * FROM binary_artifacts WHERE workspace_id = ? AND (${clauses})`)
+                .bind(workspaceId, ...chunk.flatMap((ref) => [ref.source, ref.externalId]))
+                .all();
+            rows.push(...(results ?? []));
+        }
+        // Sorted here rather than per statement: with more than one chunk the concatenation is
+        // ordered by chunk, and the caller's "newest render for a view wins" rule reads the WHOLE
+        // list in order.
+        return sortArtifactRows(rows).map(rowToRecord);
+    }
     async deleteByIds(workspaceId, ids) {
         let removed = 0;
         for (const chunk of chunkForIn(ids)) {

package/dist/infrastructure/repositories/D1BinaryArtifactMetadataStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"D1BinaryArtifactMetadataStore.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1BinaryArtifactMetadataStore.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAmBpC,SAAS,WAAW,CAAC,GAAgB;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,IAAI,EAAE,GAAG,CAAC,IAAoC;QAC9C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAA0C;QACvD,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,8FAA8F;QAC9F,+EAA+E;QAC/E,QAAQ,EACN,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,oBAAoB;YAC7C,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,eAAiC,EAAE,UAAU,EAAE,GAAG,CAAC,oBAAoB,EAAE;YACzF,CAAC,CAAC,IAAI;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,OAAO,6BAA6B;IACvB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA4B;QACvC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;;;2DAImD,CACpD;aACA,IAAI,CACH,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,EAC/B,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,EACnC,MAAM,CAAC,SAAS,CACjB;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,kEAAkE,CAAC;aAC3E,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,KAAK,EAAe,CAAA;QACvB,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,WAAmB;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;yCAEiC,CAClC;aACA,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;aAC9B,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAmB;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CACN,wFAAwF,CACzF;aACA,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;aAC9B,KAAK,EAAiB,CAAA;QACzB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,OAAe;QACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;yCAEiC,CAClC;aACA,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;aAC1B,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,QAA6B;QAE7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;yCAEiC,CAClC;aACA,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC;aACvD,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,GAAsB;QAC3D,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC3B,OAAO,CACN;+CACqC,YAAY,GAAG,CACrD;iBACA,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC;iBAC3B,GAAG,EAAE,CAAA;YACR,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QAC9B,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,gEAAgE,CAAC;aACzE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,8FAA8F;IAC9F,uEAAuE;IACvE,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,SAAiB;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;+EACuE,CACxE;aACA,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;aAC5B,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,SAAiB;QAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,OAAO,CACN;+EACuE,CACxE;aACA,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;aAC5B,GAAG,EAAE,CAAA;QACR,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,uDAAuD,CAAC;aAChE,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,OAAO,CAAC,qDAAqD,CAAC;aAC9D,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAE,CAAA;QACR,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IAC1B,CAAC;CACF"}
+{"version":3,"file":"D1BinaryArtifactMetadataStore.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1BinaryArtifactMetadataStore.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAmBpC,SAAS,WAAW,CAAC,GAAgB;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,IAAI,EAAE,GAAG,CAAC,IAAoC;QAC9C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAA0C;QACvD,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,8FAA8F;QAC9F,+EAA+E;QAC/E,QAAQ,EACN,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,oBAAoB;YAC7C,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,eAAiC,EAAE,UAAU,EAAE,GAAG,CAAC,oBAAoB,EAAE;YACzF,CAAC,CAAC,IAAI;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAClF,CAAA;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,OAAO,6BAA6B;IACvB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA4B;QACvC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;;;2DAImD,CACpD;aACA,IAAI,CACH,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,EAC/B,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,EACnC,MAAM,CAAC,SAAS,CACjB;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,kEAAkE,CAAC;aAC3E,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,KAAK,EAAe,CAAA;QACvB,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,WAAmB;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;yCAEiC,CAClC;aACA,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;aAC9B,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAmB;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CACN,wFAAwF,CACzF;aACA,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;aAC9B,KAAK,EAAiB,CAAA;QACzB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,OAAe;QACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;yCAEiC,CAClC;aACA,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;aAC1B,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,QAA6B;QAE7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;yCAEiC,CAClC;aACA,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC;aACvD,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,SAAyC;QAEzC,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QAC3B,MAAM,IAAI,GAAkB,EAAE,CAAA;QAC9B,0FAA0F;QAC1F,4CAA4C;QAC5C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK;iBAClB,GAAG,CAAC,GAAG,EAAE,CAAC,oDAAoD,CAAC;iBAC/D,IAAI,CAAC,MAAM,CAAC,CAAA;YACf,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CAAC,8DAA8D,OAAO,GAAG,CAAC;iBACjF,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;iBAC1E,GAAG,EAAe,CAAA;YACrB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;QAC/B,CAAC;QACD,uFAAuF;QACvF,0FAA0F;QAC1F,iBAAiB;QACjB,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,GAAsB;QAC3D,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC3B,OAAO,CACN;+CACqC,YAAY,GAAG,CACrD;iBACA,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC;iBAC3B,GAAG,EAAE,CAAA;YACR,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QAC9B,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,gEAAgE,CAAC;aACzE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,8FAA8F;IAC9F,uEAAuE;IACvE,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,SAAiB;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;+EACuE,CACxE;aACA,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;aAC5B,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,SAAiB;QAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,OAAO,CACN;+EACuE,CACxE;aACA,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;aAC5B,GAAG,EAAE,CAAA;QACR,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,uDAAuD,CAAC;aAChE,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAe,CAAA;QACrB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,OAAO,CAAC,qDAAqD,CAAC;aAC9D,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAE,CAAA;QACR,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IAC1B,CAAC;CACF"}

package/dist/infrastructure/repositories/chunk.d.ts

@@ -1,3 +1,11 @@
-/** Split `items` into consecutive chunks no larger than {@link D1_MAX_IN_PARAMS}. */
-export declare function chunkForIn<T>(items: readonly T[]): T[][];
+/**
+ * Split `items` into consecutive chunks that stay under {@link D1_MAX_IN_PARAMS} bound
+ * parameters.
+ *
+ * `paramsPerItem` is how many parameters ONE item contributes: 1 for a plain `id IN (…)` list,
+ * 2 for a composite key matched as `(a = ? AND b = ?) OR …`. It is a divisor rather than a
+ * caller-picked chunk size so the ceiling stays stated in the unit D1 actually enforces, and a
+ * composite-key list cannot silently inherit a chunk size that was only safe for scalars.
+ */
+export declare function chunkForIn<T>(items: readonly T[], paramsPerItem?: number): T[][];
 //# sourceMappingURL=chunk.d.ts.map

package/dist/infrastructure/repositories/chunk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chunk.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/chunk.ts"],"names":[],"mappings":"AASA,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAMxD"}
+{"version":3,"file":"chunk.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/chunk.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa,SAAI,GAAG,CAAC,EAAE,EAAE,CAO3E"}

package/dist/infrastructure/repositories/chunk.js

@@ -6,11 +6,20 @@
  * list (e.g. a leading `github_id = ?`).
  */
 const D1_MAX_IN_PARAMS = 90;
-/** Split `items` into consecutive chunks no larger than {@link D1_MAX_IN_PARAMS}. */
-export function chunkForIn(items) {
+/**
+ * Split `items` into consecutive chunks that stay under {@link D1_MAX_IN_PARAMS} bound
+ * parameters.
+ *
+ * `paramsPerItem` is how many parameters ONE item contributes: 1 for a plain `id IN (…)` list,
+ * 2 for a composite key matched as `(a = ? AND b = ?) OR …`. It is a divisor rather than a
+ * caller-picked chunk size so the ceiling stays stated in the unit D1 actually enforces, and a
+ * composite-key list cannot silently inherit a chunk size that was only safe for scalars.
+ */
+export function chunkForIn(items, paramsPerItem = 1) {
+    const perChunk = Math.max(1, Math.floor(D1_MAX_IN_PARAMS / Math.max(1, paramsPerItem)));
     const chunks = [];
-    for (let i = 0; i < items.length; i += D1_MAX_IN_PARAMS) {
-        chunks.push(items.slice(i, i + D1_MAX_IN_PARAMS));
+    for (let i = 0; i < items.length; i += perChunk) {
+        chunks.push(items.slice(i, i + perChunk));
     }
     return chunks;
 }

package/dist/infrastructure/repositories/chunk.js.map

@@ -1 +1 @@
-{"version":3,"file":"chunk.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/chunk.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAI,KAAmB;IAC/C,MAAM,MAAM,GAAU,EAAE,CAAA;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"chunk.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/chunk.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAI,KAAmB,EAAE,aAAa,GAAG,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;IACvF,MAAM,MAAM,GAAU,EAAE,CAAA;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/worker",
-  "version": "0.176.0",
+  "version": "0.177.0",
   "description": "Reusable Cloudflare Worker library (Hono + D1) exposing the Agent Architecture Board core: the `createApp()` Hono factory, the default fetch/scheduled/queue handler, and the Durable Object + Workflow classes. Deployments (see deploy/backend) supply the wrangler.toml + config and re-export these.",
   "repository": {
     "type": "git",
@@ -43,22 +43,22 @@
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
     "workers-ai-provider": "^4.0.0",
-    "@cat-factory/agents": "0.117.11",
-    "@cat-factory/consensus": "0.14.57",
-    "@cat-factory/contracts": "0.273.0",
-    "@cat-factory/eks": "0.1.269",
-    "@cat-factory/caching": "0.18.12",
-    "@cat-factory/gates": "0.9.37",
-    "@cat-factory/gitlab": "0.18.4",
-    "@cat-factory/integrations": "0.149.0",
-    "@cat-factory/kernel": "0.271.0",
-    "@cat-factory/observability-langfuse": "0.10.41",
-    "@cat-factory/orchestration": "0.239.0",
-    "@cat-factory/prompt-fragments": "1.0.21",
-    "@cat-factory/provider-cloudflare": "0.7.419",
-    "@cat-factory/spend": "0.15.39",
-    "@cat-factory/server": "0.251.0",
-    "@cat-factory/observability-otel": "0.18.4"
+    "@cat-factory/agents": "0.117.12",
+    "@cat-factory/caching": "0.18.13",
+    "@cat-factory/consensus": "0.14.58",
+    "@cat-factory/contracts": "0.274.0",
+    "@cat-factory/eks": "0.1.270",
+    "@cat-factory/gates": "0.9.38",
+    "@cat-factory/gitlab": "0.18.5",
+    "@cat-factory/integrations": "0.150.0",
+    "@cat-factory/kernel": "0.272.0",
+    "@cat-factory/observability-langfuse": "0.10.42",
+    "@cat-factory/observability-otel": "0.18.5",
+    "@cat-factory/orchestration": "0.240.0",
+    "@cat-factory/prompt-fragments": "1.0.22",
+    "@cat-factory/provider-cloudflare": "0.7.420",
+    "@cat-factory/server": "0.252.0",
+    "@cat-factory/spend": "0.15.40"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.20.1",
@@ -66,7 +66,7 @@
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
     "wrangler": "^4.118.0",
-    "@cat-factory/conformance": "0.34.0"
+    "@cat-factory/conformance": "0.35.0"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",