@desplega.ai/agent-swarm 2.5.2 → 2.5.4

package/dist/{cli-j3dwd4kz.js → cli-gbfxp48k.js}

@@ -4,9 +4,26 @@ import {
   scrubJsonValue,
   init_scrub_json,
   getDbClient2,
+  getAgentById2,
+  updateAgentStatus2,
+  updateAgentMaxTasks2,
+  getActiveTaskCount2,
+  approvalCancellationNotificationKey,
+  init_approvals,
   getTaskById2,
+  getRunLineageBlock,
+  getWorkflowRunStatus,
+  getChildWorkflowRunId,
+  isParentStepAttemptCurrent,
   createForeachChildSteps,
   init_workflow_runs,
+  isApiOnlyConfigKey,
+  isInternalConfigKey,
+  internalConfigKeyError,
+  isReservedConfigKey,
+  reservedKeyError,
+  validateConfigEntry,
+  init_swarm_config_guard,
   getOAuthApp,
   getOAuthTokens,
   init_oauth,
@@ -14,6 +31,7 @@ import {
   init_workflow_replay,
   createTaskExtended2,
   getSwarmConfigs2,
+  upsertSwarmConfig2,
   getWorkflow2,
   createWorkflowRun2,
   getWorkflowRun2,
@@ -37,23 +55,30 @@ import {
   releaseApprovalCancellationNotificationClaim2,
   updateApprovalRequestNotifications2,
   init_db3
-} from "./cli-csh8fnbg.js";
+} from "./cli-jb30dzvk.js";
+import {
+  isMultiRuntimeEnabled
+} from "./cli-e8xyjvfc.js";
 import {
   getSlackApp2
-} from "./cli-15xd0j7w.js";
+} from "./cli-abs8ndtr.js";
 import {
   externalChannelToolError2,
   isBlockExternalEnabled2,
   getChannelBlockReason2
-} from "./cli-b63d08rs.js";
+} from "./cli-eftzyh9y.js";
 import {
   DEFAULT_MODEL,
   resolveCredential
 } from "./cli-qqzmjxkf.js";
+import {
+  revokeRuntimeTokensForRuntime,
+  init_users
+} from "./cli-6a1xg1p7.js";
 import {
   TERMINAL_TASK_STATUSES,
   init_types
-} from "./cli-mntxtkhn.js";
+} from "./cli-mz9afxxf.js";
 import {
   getSlackConfiguration,
   isSlackConfigured,
@@ -63,18 +88,18 @@ import {
   selectCredential,
   init_credentials
 } from "./cli-zw88zjba.js";
-import {
-  deepInterpolate,
-  init_template,
-  resolveTemplate,
-  init_resolver
-} from "./cli-tx00c0h6.js";
 import {
   DEFAULT_OPENROUTER_BASE_URL,
   getOpenRouterBaseUrl,
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
 } from "./cli-dfyv0jdy.js";
+import {
+  deepInterpolate,
+  init_template,
+  resolveTemplate,
+  init_resolver
+} from "./cli-dqygeeh5.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -124,7 +149,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-ft6r6v23.js");
+    const { getSlackApp } = await import("./app-ctn8gsgx.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -362,6 +387,15 @@ function utcDayBounds(now) {
   const start = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
   return { start: start.toISOString(), end: new Date(start.getTime() + 86400000).toISOString() };
 }
+async function isFirstWorkflowPreflightFailureToday(workflowId, runId, now = new Date) {
+  const bounds = utcDayBounds(now);
+  const row = await getDbClient2().get(`SELECT 1 AS found FROM workflow_runs
+     WHERE workflowId = ? AND id != ? AND status = 'failed'
+       AND error LIKE 'needs_setup:%'
+       AND startedAt >= ? AND startedAt < ?
+     LIMIT 1`, [workflowId, runId, bounds.start, bounds.end]);
+  return row == null;
+}
 async function recordSchedulePreflightFailure(scheduleId, failureReason, now = new Date) {
   const message = scrubSecrets(failureReason);
   return await getDbClient2().transaction(async (tx) => {
@@ -382,7 +416,7 @@ async function recordWorkflowPreflightFailure(input) {
   const bounds = utcDayBounds(now);
   return await getDbClient2().transaction(async (tx) => {
     const existing = await tx.get(`SELECT id FROM workflow_runs
-       WHERE workflowId = ? AND status = 'failed'
+       WHERE workflowId = ? AND status = 'failed' AND parentStepId IS NULL
          AND error LIKE 'needs_setup:%'
          AND startedAt >= ? AND startedAt < ?
        ORDER BY startedAt ASC LIMIT 1`, [input.workflowId, bounds.start, bounds.end]);
@@ -404,7 +438,10 @@ async function recordWorkflowPreflightFailure(input) {
       timestamp,
       timestamp
     ]);
-    return { runId, recorded: true };
+    return {
+      runId,
+      recorded: await isFirstWorkflowPreflightFailureToday(input.workflowId, runId, now)
+    };
   });
 }
 
@@ -457,10 +494,475 @@ class BaseExecutor {
 
 // src/workflows/executors/human-in-the-loop.ts
 init_zod();
+
+// src/be/approval-config-question.ts
+init_zod();
+init_db3();
+
+// src/be/multi-runtime.ts
+init_secret_scrubber();
+init_db3();
+init_users();
+var AGENT_MAX_TASKS_CONFIG_KEY = "AGENT_MAX_TASKS";
+function parseAgentMaxTasksValue(raw) {
+  const str = raw.trim();
+  if (!/^\d+$/.test(str))
+    return null;
+  const value = Number(str);
+  return value >= 1 && value <= 100 ? value : null;
+}
+function defaultMaxTasksForAgent(agent) {
+  return agent.isLead ? 2 : 1;
+}
+async function getAgentMaxTasksConfig(agentId) {
+  return (await getSwarmConfigs2({ scope: "agent", scopeId: agentId, key: AGENT_MAX_TASKS_CONFIG_KEY }))[0] ?? null;
+}
+async function reconcileAgentMaxTasksPolicy(agentId) {
+  const agent = await getAgentById2(agentId);
+  if (!agent)
+    return;
+  const existing = await getAgentMaxTasksConfig(agentId);
+  if (existing) {
+    const authoritative = parseAgentMaxTasksValue(existing.value);
+    if (authoritative !== null && authoritative !== (agent.maxTasks ?? 1)) {
+      await updateAgentMaxTasks2(agentId, authoritative);
+    }
+    return;
+  }
+  await upsertSwarmConfig2({
+    scope: "agent",
+    scopeId: agentId,
+    key: AGENT_MAX_TASKS_CONFIG_KEY,
+    value: String(agent.maxTasks ?? defaultMaxTasksForAgent(agent)),
+    description: "Logical agent max-tasks policy (seeded from agents.maxTasks)"
+  });
+}
+async function resetAgentMaxTasksMirror(agentId) {
+  const agent = await getAgentById2(agentId);
+  if (!agent)
+    return;
+  await updateAgentMaxTasks2(agentId, defaultMaxTasksForAgent(agent));
+}
+async function upsertSwarmConfigWithPolicyMirror(data) {
+  const scopeId = data.scope === "agent" ? data.scopeId : null;
+  if (!scopeId || data.key !== AGENT_MAX_TASKS_CONFIG_KEY) {
+    return upsertSwarmConfig2(data);
+  }
+  return await getDbClient2().transaction(async () => {
+    const row = await upsertSwarmConfig2(data);
+    const value = parseAgentMaxTasksValue(data.value);
+    if (value !== null)
+      await updateAgentMaxTasks2(scopeId, value);
+    return row;
+  });
+}
+function rowToRuntimeInstance(row) {
+  let metadata = null;
+  if (row.metadata) {
+    try {
+      metadata = JSON.parse(row.metadata);
+    } catch {
+      metadata = null;
+    }
+  }
+  return {
+    id: row.id,
+    agentId: row.agent_id,
+    poolId: row.pool_id ?? null,
+    controllerId: row.controller_id ?? null,
+    externalHandle: row.external_handle ? JSON.parse(row.external_handle) : null,
+    provisionAttempts: row.provision_attempts ?? 0,
+    provisionError: row.provision_error ?? null,
+    provisionRequestedAt: row.provision_requested_at ?? null,
+    draining: row.draining === 1,
+    idleSince: row.idle_since ?? null,
+    leaseExpiresAt: row.lease_expires_at ?? null,
+    taskId: row.task_id ?? null,
+    status: row.status,
+    reportedSlots: row.reported_slots,
+    credentialReady: row.credential_ready === null ? null : row.credential_ready === 1,
+    metadata,
+    lastSeenAt: row.last_seen_at,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function runtimeStaleThresholdMinutes() {
+  return Number(process.env.RUNTIME_STALE_THRESHOLD_MIN) || 5;
+}
+function runtimeLivenessCutoff() {
+  return new Date(Date.now() - runtimeStaleThresholdMinutes() * 60 * 1000).toISOString();
+}
+async function upsertRuntimeInstance(instance) {
+  const metadataJson = instance.metadata ? JSON.stringify(instance.metadata) : null;
+  const row = await getDbClient2().transaction(async (tx) => {
+    const provisioning = await tx.get("SELECT id FROM runtime_instances WHERE id = ? AND status = 'provisioning' AND agent_id = ?", [instance.id, instance.agentId]);
+    const row = await tx.get(`INSERT INTO runtime_instances (id, agent_id, status, reported_slots, metadata)
+     VALUES (?, ?, 'active', ?, ?)
+     ON CONFLICT(id) DO UPDATE SET
+       status = 'active',
+       reported_slots = excluded.reported_slots,
+       metadata = COALESCE(excluded.metadata, runtime_instances.metadata),
+       last_seen_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+       updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE runtime_instances.agent_id = excluded.agent_id
+     RETURNING *`, [instance.id, instance.agentId, instance.reportedSlots, metadataJson]);
+    if (row?.pool_id && provisioning) {
+      await tx.run("UPDATE agents SET runtime_provision_attempts = 0, runtime_provision_retry_at = NULL WHERE id = ?", [row.agent_id]);
+      await tx.run("UPDATE runtime_pools SET consecutive_failures = 0, circuit_open_until = NULL WHERE id = ?", [row.pool_id]);
+    }
+    return row;
+  });
+  return row ? rowToRuntimeInstance(row) : null;
+}
+async function getRuntimeInstanceById(id) {
+  const row = await getDbClient2().get("SELECT * FROM runtime_instances WHERE id = ?", [id]);
+  return row ? rowToRuntimeInstance(row) : null;
+}
+async function insertProvisioningRuntime(instance) {
+  const row = await getDbClient2().get(`INSERT INTO runtime_instances (id, agent_id, pool_id, controller_id, status,
+       reported_slots, provision_requested_at)
+     VALUES (?, ?, ?, ?, 'provisioning', ?, ?) RETURNING *`, [
+    instance.id,
+    instance.agentId,
+    instance.poolId,
+    instance.controllerId,
+    instance.reportedSlots ?? 1,
+    new Date().toISOString()
+  ]);
+  return rowToRuntimeInstance(row);
+}
+async function markRuntimeTerminated(id, reason) {
+  await getDbClient2().transaction(async () => {
+    const runtime = await getRuntimeInstanceById(id);
+    if (!runtime)
+      return;
+    await markRuntimeInstanceOffline(id, runtime.agentId);
+    if (runtime.status === "provisioning") {
+      await getDbClient2().run("UPDATE runtime_instances SET provision_error = ? WHERE id = ?", [
+        scrubSecrets(reason),
+        id
+      ]);
+    }
+    await reconcileAgentStatusFromRuntimes(runtime.agentId);
+    await revokeRuntimeTokensForRuntime(id);
+  });
+}
+async function touchRuntimeInstance(id, agentId) {
+  const result = await getDbClient2().run(`UPDATE runtime_instances
+     SET last_seen_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+         updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [id, agentId, runtimeLivenessCutoff()]);
+  return result.changes > 0;
+}
+async function markRuntimeInstanceOffline(id, agentId) {
+  const row = await getDbClient2().get(`UPDATE runtime_instances
+     SET status = 'offline', updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND agent_id = ? RETURNING *`, [id, agentId]);
+  return row ? rowToRuntimeInstance(row) : null;
+}
+async function countActiveRuntimeInstancesForAgent(agentId) {
+  const result = await getDbClient2().get(`SELECT COUNT(*) as count FROM runtime_instances
+     WHERE agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [agentId, runtimeLivenessCutoff()]);
+  return result?.count ?? 0;
+}
+async function listRuntimeInstancesForAgent(agentId) {
+  const rows = await getDbClient2().query(`SELECT *, (status = 'active' AND last_seen_at >= ?) AS is_live
+     FROM runtime_instances
+     WHERE agent_id = ?
+     ORDER BY created_at ASC, id ASC`, [runtimeLivenessCutoff(), agentId]);
+  return rows.map((row) => ({ ...rowToRuntimeInstance(row), isLive: row.is_live === 1 }));
+}
+async function setRuntimeCredentialReady(id, agentId, ready) {
+  const result = await getDbClient2().run(`UPDATE runtime_instances
+     SET credential_ready = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [ready ? 1 : 0, id, agentId, runtimeLivenessCutoff()]);
+  return result.changes > 0;
+}
+async function hasReadyLiveRuntime(agentId) {
+  const row = await getDbClient2().get(`SELECT COUNT(*) c FROM runtime_instances
+     WHERE agent_id = ? AND status = 'active' AND last_seen_at >= ?
+       AND (credential_ready IS NULL OR credential_ready = 1)`, [agentId, runtimeLivenessCutoff()]);
+  return (row?.c ?? 0) > 0;
+}
+async function reconcileAgentStatusFromRuntimes(agentId) {
+  await getDbClient2().transaction(async () => {
+    const agent = await getAgentById2(agentId);
+    if (!agent)
+      return;
+    if (await countActiveRuntimeInstancesForAgent(agentId) === 0) {
+      if (agent.status !== "offline")
+        await updateAgentStatus2(agentId, "offline");
+      return;
+    }
+    if (!await hasReadyLiveRuntime(agentId)) {
+      if (agent.status !== "waiting_for_credentials") {
+        await updateAgentStatus2(agentId, "waiting_for_credentials");
+      }
+      return;
+    }
+    const next = await getActiveTaskCount2(agentId) > 0 ? "busy" : "idle";
+    if (agent.status !== next)
+      await updateAgentStatus2(agentId, next);
+  });
+}
+async function agentsWithLiveRuntime() {
+  const rows = await getDbClient2().query(`SELECT DISTINCT agent_id FROM runtime_instances
+     WHERE status = 'active' AND last_seen_at >= ?`, [runtimeLivenessCutoff()]);
+  return new Set(rows.map((r) => r.agent_id));
+}
+async function expireStaleRuntimeInstances() {
+  if (!isMultiRuntimeEnabled()) {
+    return { expired: 0, agentsOffline: 0, pruned: 0 };
+  }
+  return await getDbClient2().transaction(async (tx) => {
+    const cutoff = runtimeLivenessCutoff();
+    const stale = await tx.query(`SELECT id, agent_id FROM runtime_instances
+       WHERE status = 'active' AND last_seen_at < ? AND pool_id IS NULL`, [cutoff]);
+    const pruned = (await tx.run("DELETE FROM runtime_instances WHERE last_seen_at < ? AND status != 'provisioning' AND (pool_id IS NULL OR status = 'offline')", [cutoff])).changes;
+    let agentsOffline = 0;
+    for (const agentId of new Set(stale.map((r) => r.agent_id))) {
+      await reconcileAgentStatusFromRuntimes(agentId);
+      if ((await getAgentById2(agentId))?.status === "offline")
+        agentsOffline++;
+    }
+    return { expired: stale.length, agentsOffline, pruned };
+  });
+}
+async function listRuntimeInstancesForPool(poolId) {
+  return (await getDbClient2().query("SELECT * FROM runtime_instances WHERE pool_id = ? ORDER BY created_at", [poolId])).map(rowToRuntimeInstance);
+}
+
+// src/be/approval-config-question.ts
+init_swarm_config_guard();
+var ConfigQuestionSettingsSchema = object2({
+  key: string2().min(1).max(255).regex(/^\S+$/, "must not contain whitespace").describe("The swarm config key to set, e.g. BITBUCKET_TOKEN"),
+  scope: _enum2(["global", "agent", "repo"]).describe("Config scope the value is written to"),
+  scopeId: string2().min(1).optional().describe("Agent or repo id for agent/repo scope. From request-human-input, agent scope defaults to the calling agent; pass it explicitly when asking on behalf of another agent."),
+  isSecret: boolean().optional().describe("Store encrypted and never show the value (default true). An existing secret row always stays secret."),
+  helpUrl: string2().url().refine((url) => /^https?:\/\//i.test(url), "must be an http(s) URL").optional().describe("Link shown next to the field, e.g. where to create the token"),
+  options: array2(object2({
+    value: string2(),
+    label: string2(),
+    description: string2().optional()
+  })).optional().describe("Allowed values for a non-secret key, rendered as a choice"),
+  defaultValue: string2().optional().describe("Prefilled value for a non-secret key")
+});
+var ConfigAnswerSchema = discriminatedUnion("action", [
+  object2({ action: literal2("set"), value: string2() }),
+  object2({ action: literal2("keep") }),
+  object2({ action: literal2("skip") })
+]);
+var ConfigResultSchema = object2({
+  key: string2(),
+  scope: _enum2(["global", "agent", "repo"]),
+  scopeId: string2().nullable(),
+  isSecret: boolean(),
+  status: _enum2(["set", "kept", "skipped"]),
+  updatedAt: string2().nullable(),
+  value: string2().optional()
+});
+var ConfigStateSchema = object2({
+  exists: boolean(),
+  isSecret: boolean(),
+  updatedAt: string2().nullable(),
+  value: string2().optional().describe("Current value; present only for non-secret rows")
+});
+async function readConfigRow(settings) {
+  const scopeId = settings.scope === "global" ? null : settings.scopeId ?? null;
+  const row = await getDbClient2().get(`SELECT isSecret, lastUpdatedAt, envPath, description,
+            CASE WHEN isSecret = 1 THEN NULL ELSE value END AS plainValue
+       FROM swarm_config
+      WHERE scope = ? AND ${scopeId === null ? "scopeId IS NULL" : "scopeId = ?"} AND key = ?`, scopeId === null ? [settings.scope, settings.key] : [settings.scope, scopeId, settings.key]);
+  if (!row)
+    return null;
+  const isSecret = row.isSecret === 1 || isApiOnlyConfigKey(settings.key);
+  return {
+    isSecret,
+    updatedAt: row.lastUpdatedAt,
+    envPath: row.envPath,
+    description: row.description,
+    ...isSecret || row.plainValue === null ? {} : { value: row.plainValue }
+  };
+}
+async function readConfigState(settings) {
+  const row = await readConfigRow(settings);
+  if (!row)
+    return { exists: false, isSecret: settings.isSecret !== false, updatedAt: null };
+  const isSecret = row.isSecret || settings.isSecret !== false;
+  return {
+    exists: true,
+    isSecret,
+    updatedAt: row.updatedAt,
+    ...!isSecret && row.value !== undefined ? { value: row.value } : {}
+  };
+}
+async function normalizeConfigQuestion(question, ctx) {
+  const fail = (reason) => ({
+    ok: false,
+    error: `config question "${question.id}": ${reason}`
+  });
+  const parsed = ConfigQuestionSettingsSchema.safeParse(question.config);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    const path = issue?.path.length ? `config.${issue.path.map(String).join(".")}` : "config";
+    return fail(`${path}: ${issue?.message ?? "invalid"}`);
+  }
+  if (ctx.approvers.policy !== "any") {
+    return fail('a config question needs approvers.policy "any" (a config value has one author)');
+  }
+  const settings = { ...parsed.data };
+  if (settings.scope === "agent" && !settings.scopeId && ctx.callerAgentId) {
+    settings.scopeId = ctx.callerAgentId;
+  }
+  if (settings.scope === "global" && settings.scopeId) {
+    return fail("global scope must not have scopeId");
+  }
+  if (settings.scope !== "global" && !settings.scopeId) {
+    return fail(`${settings.scope} scope requires scopeId`);
+  }
+  if (isReservedConfigKey(settings.key))
+    return fail(reservedKeyError(settings.key).message);
+  if (isInternalConfigKey(settings.key))
+    return fail(internalConfigKeyError(settings.key).message);
+  const row = await readConfigRow(settings);
+  const isSecret = settings.isSecret !== false || row?.isSecret === true || isApiOnlyConfigKey(settings.key);
+  if (isSecret && (settings.options || settings.defaultValue !== undefined)) {
+    return fail("options and defaultValue are only allowed when isSecret is false (and the key is not already stored as a secret)");
+  }
+  if (settings.options?.length === 0)
+    return fail("options must not be empty");
+  if (settings.options && settings.defaultValue !== undefined && !settings.options.some((option) => option.value === settings.defaultValue)) {
+    return fail("defaultValue must be one of options");
+  }
+  const label = question.label?.trim() ? question.label : settings.key;
+  return {
+    ok: true,
+    question: {
+      ...question,
+      label,
+      required: question.required ?? true,
+      config: { ...settings, isSecret }
+    }
+  };
+}
+async function normalizeApprovalQuestions(questions, ctx) {
+  const out = [];
+  for (const question of questions) {
+    if (question.type !== "config") {
+      if (question.config !== undefined) {
+        return {
+          ok: false,
+          error: `question "${question.id}": the config block is only valid on type "config"`
+        };
+      }
+      if (typeof question.label !== "string") {
+        return { ok: false, error: `question "${question.id}": label is required` };
+      }
+      out.push({ ...question, label: question.label });
+      continue;
+    }
+    const normalized = await normalizeConfigQuestion(question, ctx);
+    if (!normalized.ok)
+      return normalized;
+    out.push(normalized.question);
+  }
+  return { ok: true, questions: out };
+}
+function isConfigQuestion(question) {
+  return question.type === "config" && typeof question.config === "object" && !!question.config;
+}
+function parseConfigAnswer(question, raw, state) {
+  const fail = (reason) => ({
+    ok: false,
+    error: `config question "${question.id}": ${reason}`
+  });
+  const required = question.required !== false;
+  if (raw === undefined || raw === null) {
+    return required ? fail("an answer is required") : { ok: true, answer: { action: "skip" } };
+  }
+  const parsed = ConfigAnswerSchema.safeParse(raw);
+  if (!parsed.success) {
+    return fail('answer must be { action: "set", value } , { action: "keep" } or { action: "skip" }');
+  }
+  const answer = parsed.data;
+  if (answer.action === "keep") {
+    return state.exists ? { ok: true, answer } : fail("cannot keep a key that is not set");
+  }
+  if (answer.action === "skip") {
+    return required ? fail("a required question cannot be skipped") : { ok: true, answer };
+  }
+  if (answer.value.trim().length === 0)
+    return fail("value must not be empty");
+  const { config } = question;
+  const isSecret = config.isSecret || state.isSecret;
+  if (!isSecret && config.options && !config.options.some((o) => o.value === answer.value)) {
+    return fail("value must be one of options");
+  }
+  const error = validateConfigEntry({
+    scope: config.scope,
+    scopeId: config.scopeId ?? null,
+    key: config.key,
+    value: answer.value
+  });
+  if (error)
+    return fail(isSecret ? `value rejected by ${config.key} validation` : error);
+  return { ok: true, answer };
+}
+function result(question, status, isSecret, updatedAt, value) {
+  const { key, scope, scopeId } = question.config;
+  return {
+    key,
+    scope,
+    scopeId: scope === "global" ? null : scopeId ?? null,
+    isSecret,
+    status,
+    updatedAt,
+    ...!isSecret && value !== undefined ? { value } : {}
+  };
+}
+function skippedConfigResult(question) {
+  return result(question, "skipped", question.config.isSecret, null);
+}
+async function keptConfigResult(question) {
+  const row = await readConfigRow(question.config);
+  if (!row)
+    return null;
+  const isSecret = question.config.isSecret || row.isSecret;
+  return result(question, "kept", isSecret, row.updatedAt, row.value);
+}
+async function applyConfigAnswer(question, value) {
+  const { config } = question;
+  const existing = await readConfigRow(config);
+  const isSecret = config.isSecret || existing?.isSecret === true;
+  const written = await upsertSwarmConfigWithPolicyMirror({
+    scope: config.scope,
+    scopeId: config.scope === "global" ? null : config.scopeId ?? null,
+    key: config.key,
+    value,
+    isSecret,
+    envPath: existing?.envPath ?? null,
+    description: existing?.description ?? null
+  });
+  return result(question, "set", isSecret, written.lastUpdatedAt, value);
+}
+function formatConfigResult(value) {
+  const parsed = ConfigResultSchema.safeParse(value);
+  if (!parsed.success)
+    return null;
+  const r = parsed.data;
+  const where = `${r.scope}${r.scopeId ? `:${r.scopeId}` : ""}`;
+  const updated = r.updatedAt ? `, updated ${r.updatedAt}` : "";
+  const shown = !r.isSecret && r.value !== undefined ? ` = ${r.value}` : "";
+  return `${r.key} (${where}, ${r.isSecret ? "secret" : "plain"}): ${r.status}${updated}${shown}`;
+}
+
+// src/workflows/executors/human-in-the-loop.ts
 init_secret_scrubber();
 
 // src/workflows/approval-notifications.ts
 init_db3();
+init_approvals();
 init_resolver();
 
 // src/slack/dm.ts
@@ -489,7 +991,7 @@ function escapeSlackMrkdwn(text) {
 function buildSlackQuestionsSummary(questions, timeoutText = "") {
   const header = `*Questions:*
 `;
-  const lines = questions.map((q) => `• ${escapeSlackMrkdwn(q.label.replace(/\s+/g, " ").trim())}`);
+  const lines = questions.map((q) => `• ${escapeSlackMrkdwn((q.label ?? "").replace(/\s+/g, " ").trim())}${q.type === "config" ? " (set on dashboard)" : ""}`);
   const fits = (shown, omitted) => {
     const tail = omitted > 0 ? `
 _…and ${omitted} more. Answer all of them on the dashboard._` : "";
@@ -627,7 +1129,7 @@ async function postApprovalCancellationUpdates(approvals, reason, client = getSl
     for (const notification of slackThreads) {
       if (notification.channel !== "slack" || !notification.messageTs)
         continue;
-      const notificationKey = `${notification.target}:${notification.messageTs}`;
+      const notificationKey = approvalCancellationNotificationKey(notification.target, notification.messageTs);
       const claim = await claimApprovalCancellationNotification2(approval.id, notificationKey);
       if (!claim)
         continue;
@@ -687,6 +1189,8 @@ function formatResponses(questions, responses) {
     let answerText;
     if (answer == null) {
       answerText = "(no answer)";
+    } else if (q.type === "config") {
+      answerText = formatConfigResult(answer) ?? "(unreadable config result)";
     } else if (q.type === "approval") {
       const a = answer;
       answerText = a.approved ? "Approved" : "Rejected";
@@ -750,6 +1254,14 @@ var QuestionSchema = discriminatedUnion("type", [
     required: boolean().default(true),
     description: string2().optional(),
     defaultValue: boolean().optional()
+  }),
+  object2({
+    id: string2(),
+    type: literal2("config"),
+    label: string2().optional(),
+    required: boolean().default(true),
+    description: string2().optional(),
+    config: ConfigQuestionSettingsSchema
   })
 ]);
 var ApproverConfigSchema = object2({
@@ -841,7 +1353,17 @@ class HumanInTheLoopExecutor extends BaseExecutor {
     const resolved = resolveHitlQuestions(input.config?.questions);
     if (!resolved.ok)
       return { status: "failed", error: resolved.error };
-    return super.run({ ...input, config: { ...input.config, questions: resolved.questions } });
+    const approvers = input.config?.approvers;
+    const normalized = await normalizeApprovalQuestions(resolved.questions, {
+      approvers: { policy: approvers?.policy }
+    });
+    if (!normalized.ok) {
+      return {
+        status: "failed",
+        error: `human-in-the-loop questions are invalid: ${normalized.error}`
+      };
+    }
+    return super.run({ ...input, config: { ...input.config, questions: normalized.questions } });
   }
   async execute(config, _context, meta) {
     const { db } = this.deps;
@@ -2924,11 +3446,23 @@ class SystemOneDecisionExecutor extends BaseExecutor {
 
 // src/workflows/foreach-join.ts
 init_db3();
+init_workflow_runs();
 
 // src/workflows/checkpoint.ts
 init_db3();
-async function checkpointStep(runId, stepId, nodeId, result, ctx) {
-  await getDbClient2().transaction(async () => {
+init_workflow_runs();
+async function holdsFence(runId, stepId, fence) {
+  const row = await getDbClient2().get(`SELECT 1 AS found
+       FROM workflow_run_steps s
+       JOIN workflow_runs r ON r.id = s.runId
+      WHERE s.id = ? AND s.runId = ? AND s.status = 'running' AND s.retryCount = ?
+        AND r.status IN ('running', 'waiting')`, [stepId, runId, fence.retryCount]);
+  return row != null && await getRunLineageBlock(runId) == null;
+}
+async function checkpointStep(runId, stepId, nodeId, result, ctx, options = {}) {
+  return getDbClient2().transaction(async () => {
+    if (options.fence && !await holdsFence(runId, stepId, options.fence))
+      return false;
     await updateWorkflowRunStep2(stepId, {
       status: "completed",
       output: result.output,
@@ -2939,45 +3473,53 @@ async function checkpointStep(runId, stepId, nodeId, result, ctx) {
     await updateWorkflowRun2(runId, {
       context: ctx
     });
+    return true;
   });
 }
 async function checkpointStepFailure(runId, stepId, error, retryCount, retryPolicy, options) {
   const now = new Date().toISOString();
-  if (retryPolicy && retryCount < retryPolicy.maxRetries) {
-    const delay = calculateBackoff(retryPolicy, retryCount);
-    const nextRetryAt = new Date(Date.now() + delay).toISOString();
+  return getDbClient2().transaction(async () => {
+    if (options?.fence && !await holdsFence(runId, stepId, options.fence)) {
+      return { shouldRetry: false, stale: true };
+    }
+    if (retryPolicy && retryCount < retryPolicy.maxRetries) {
+      const delay = calculateBackoff(retryPolicy, retryCount);
+      const nextRetryAt = new Date(Date.now() + delay).toISOString();
+      await updateWorkflowRunStep2(stepId, {
+        status: "failed",
+        error,
+        output: options?.output,
+        retryCount: retryCount + 1,
+        maxRetries: retryPolicy.maxRetries,
+        nextRetryAt
+      });
+      return { shouldRetry: true };
+    }
     await updateWorkflowRunStep2(stepId, {
       status: "failed",
       error,
-      retryCount: retryCount + 1,
-      maxRetries: retryPolicy.maxRetries,
-      nextRetryAt
+      output: options?.output,
+      finishedAt: now,
+      nextRetryAt: null
     });
-    return { shouldRetry: true };
-  }
-  await updateWorkflowRunStep2(stepId, {
-    status: "failed",
-    error,
-    finishedAt: now,
-    nextRetryAt: null
-  });
-  const markRunFailed = options?.markRunFailed ?? true;
-  if (markRunFailed) {
-    await getDbClient2().transaction(async () => {
+    const markRunFailed = options?.markRunFailed ?? true;
+    if (markRunFailed) {
       const run = await getWorkflowRun2(runId);
-      if (run?.status !== "running" && run?.status !== "waiting")
-        return;
-      await updateWorkflowRun2(runId, {
-        status: "failed",
-        error: `Step failed: ${error}`,
-        finishedAt: now
-      });
-    });
-  }
-  return { shouldRetry: false };
+      if (run?.status === "running" || run?.status === "waiting") {
+        await updateWorkflowRun2(runId, {
+          status: "failed",
+          error: `Step failed: ${error}`,
+          finishedAt: now
+        });
+      }
+    }
+    return { shouldRetry: false };
+  });
 }
 async function checkpointStepWaiting(runId, stepId, ctx, options = {}) {
   return getDbClient2().transaction(async () => {
+    if (await getRunLineageBlock(runId))
+      return false;
     const step = await getDbClient2().get(`UPDATE workflow_run_steps
          SET status = 'waiting'
        WHERE id = ? AND runId = ? AND status = 'running'
@@ -3014,6 +3556,7 @@ function calculateBackoff(policy, attempt) {
 
 // src/workflows/foreach-driver.ts
 init_db3();
+init_workflow_runs();
 
 // src/workflows/constants.ts
 var FAILED_TASK_OUTPUT_PREFIX = "[FAILED:";
@@ -3021,6 +3564,7 @@ var FOREACH_ITEMS_WAIT_FOR = "foreach.items";
 
 // src/workflows/engine.ts
 init_db3();
+init_workflow_runs();
 init_workflow_replay();
 init_telemetry();
 
@@ -3408,64 +3952,90 @@ async function resolveRenderedWorkflowInputs(input) {
 }
 async function startWorkflowExecution2(workflow, triggerData, registry, options = {}) {
   const preflight = preflightAutomation(workflowPreflightInput(workflow), await getAutomationSetupStates());
-  if (preflight.state === "needs_setup") {
-    const { runId, recorded } = await recordWorkflowPreflightFailure({
-      workflowId: workflow.id,
-      triggerType: options.triggerType ?? "manual",
-      triggerData,
-      failureReason: preflight.failureReason,
-      createdBy: options.requestedByUserId
+  if (preflight.state === "needs_setup" && !options.parentStepId) {
+    const { runId, recorded } = await getDbClient2().transaction(async () => {
+      const failure = await recordWorkflowPreflightFailure({
+        workflowId: workflow.id,
+        triggerType: options.triggerType ?? "manual",
+        triggerData,
+        failureReason: preflight.failureReason,
+        createdBy: options.requestedByUserId
+      });
+      await options.accept?.({ runId: failure.runId, skipped: false });
+      return failure;
     });
     if (recorded)
       await notifyAutomationPreflightFailure(preflight);
     return runId;
   }
-  workflow = renderAutomationTokens(workflow, workflow.params ?? {});
-  if (workflow.triggerSchema) {
-    const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
-    if (validationErrors.length > 0) {
-      throw new TriggerSchemaError(validationErrors);
+  let initial;
+  if (preflight.state === "needs_setup") {
+    initial = {
+      status: "failed",
+      error: preflight.failureReason,
+      finishedAt: new Date().toISOString(),
+      preflight: true
+    };
+  } else {
+    workflow = renderAutomationTokens(workflow, workflow.params ?? {});
+    if (workflow.triggerSchema) {
+      const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
+      if (validationErrors.length > 0) {
+        throw new TriggerSchemaError(validationErrors);
+      }
+    }
+    if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
+      initial = { status: "skipped", error: "cooldown", finishedAt: new Date().toISOString() };
+    } else {
+      initial = await buildInitialRunState(workflow, triggerData, registry, options);
     }
   }
-  if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
-    const runId = crypto.randomUUID();
-    await createWorkflowRun2({
-      id: runId,
+  const newRunId = crypto.randomUUID();
+  const release = holdWorkflowRun(newRunId);
+  try {
+    const { runId, created, preflightAlert } = await createRunWithInitialState(workflow, triggerData, options, initial, newRunId);
+    if (!created)
+      return runId;
+    if (initial.status === "failed" && initial.preflight) {
+      if (preflightAlert)
+        await notifyAutomationPreflightFailure(preflight);
+      return runId;
+    }
+    if (initial.status === "skipped")
+      return runId;
+    telemetry.workflow("started", {
       workflowId: workflow.id,
-      triggerType: options.triggerType ?? "manual",
-      triggerData,
-      createdBy: options.requestedByUserId,
-      parentStepId: options.parentStepId
-    });
-    await updateWorkflowRun2(runId, {
-      status: "skipped",
-      error: "cooldown",
-      finishedAt: new Date().toISOString()
+      nodeCount: workflow.definition.nodes.length,
+      triggerType: options.triggerType ?? "manual"
     });
+    if (initial.status)
+      return runId;
+    const walk = walkGraph(workflow.definition, runId, initial.context, findEntryNodes(workflow.definition), registry, workflow.id, getSecretInputKeys(workflow.input), options);
+    if (options.parentStepId) {
+      walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
+      return runId;
+    }
+    await walk;
     return runId;
+  } finally {
+    release();
   }
-  const runId = crypto.randomUUID();
-  await createWorkflowRun2({
-    id: runId,
-    workflowId: workflow.id,
-    triggerType: options.triggerType ?? "manual",
-    triggerData,
-    createdBy: options.requestedByUserId,
-    parentStepId: options.parentStepId
-  });
-  telemetry.workflow("started", {
-    workflowId: workflow.id,
-    nodeCount: workflow.definition.nodes.length,
-    triggerType: options.triggerType ?? "manual"
-  });
+}
+
+class ParentStepNotCurrentError extends Error {
+  constructor(parentStepId, attempt) {
+    super(`Parent step ${parentStepId} (attempt ${attempt}) is no longer running; no child run started`);
+    this.name = "ParentStepNotCurrentError";
+  }
+}
+async function buildInitialRunState(workflow, triggerData, registry, options) {
   const notReady = await findWorkflowReadinessProblems(workflow.definition, registry);
   if (notReady.length > 0) {
-    await updateWorkflowRun2(runId, {
+    return {
       status: "failed",
       error: formatReadinessRunError(notReady),
       finishedAt: new Date().toISOString()
-    });
-    return runId;
+    };
   }
   const ctx = { trigger: triggerData };
   if (options.requestedByUserId) {
@@ -3479,23 +4049,41 @@ async function startWorkflowExecution2(workflow, triggerData, registry, options
       const resolved = await resolveRenderedWorkflowInputs(workflow.input);
       Object.assign(ctx, { input: resolved });
     } catch (err) {
-      await updateWorkflowRun2(runId, {
+      return {
         status: "failed",
         error: `Input resolution failed: ${err}`,
         finishedAt: new Date().toISOString()
-      });
-      return runId;
+      };
     }
   }
-  const entryNodes = findEntryNodes(workflow.definition);
-  const secretKeys = getSecretInputKeys(workflow.input);
-  const walk = walkGraph(workflow.definition, runId, ctx, entryNodes, registry, workflow.id, secretKeys, options);
-  if (options.parentStepId) {
-    walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
-    return runId;
-  }
-  await walk;
-  return runId;
+  return { context: ctx };
+}
+async function createRunWithInitialState(workflow, triggerData, options, initial, runId) {
+  return getDbClient2().transaction(async () => {
+    const { parentStepId } = options;
+    const attempt = options.parentStepAttempt ?? 0;
+    if (parentStepId) {
+      if (!await isParentStepAttemptCurrent(parentStepId, attempt)) {
+        throw new ParentStepNotCurrentError(parentStepId, attempt);
+      }
+      const existingId = await getChildWorkflowRunId(parentStepId, attempt);
+      if (existingId)
+        return { runId: existingId, created: false };
+    }
+    await createWorkflowRun2({
+      id: runId,
+      workflowId: workflow.id,
+      triggerType: options.triggerType ?? "manual",
+      triggerData,
+      createdBy: options.requestedByUserId,
+      parentStepId,
+      parentStepAttempt: parentStepId ? attempt : undefined
+    });
+    await updateWorkflowRun2(runId, initial.status ? { status: initial.status, error: initial.error, finishedAt: initial.finishedAt } : { context: initial.context });
+    const preflightAlert = initial.status === "failed" && initial.preflight ? await isFirstWorkflowPreflightFailureToday(workflow.id, runId) : undefined;
+    await options.accept?.({ runId, skipped: initial.status === "skipped" });
+    return { runId, created: true, preflightAlert };
+  });
 }
 var activeWalks = new Map;
 var executingSteps = new Set;
@@ -3518,6 +4106,9 @@ async function failRunOnUnreadableReplay(runId, err, stepId) {
 function isWorkflowRunActive(runId) {
   return activeWalks.has(runId);
 }
+function isStepExecuting(stepId) {
+  return executingSteps.has(stepId);
+}
 function holdWorkflowRun(runId) {
   activeWalks.set(runId, (activeWalks.get(runId) ?? 0) + 1);
   let released = false;
@@ -3652,6 +4243,8 @@ async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId,
     const run = await getWorkflowRun2(runId);
     if (!run || run.status !== "running")
       return;
+    if (await getRunLineageBlock(runId))
+      return;
     const finalSteps = await getWorkflowRunStepsByRunId2(runId);
     if (hasRunningStep(finalSteps))
       return;
@@ -3760,17 +4353,34 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
     if (!run || run.status !== "running" && run.status !== "waiting") {
       return { halted: true };
     }
+    if (await getRunLineageBlock(runId))
+      return { halted: true };
     if (node.type !== "foreach") {
       const current = await getCurrentStepForNode2(runId, node.id, getAllPredecessors(def, node.id));
       if (current && (current.status !== "running" || executingSteps.has(current.id))) {
         return { current };
       }
+      if (current && node.type === "sub-workflow") {
+        claimedStepId = current.id;
+        executingSteps.add(current.id);
+        return {
+          existingStep: current,
+          stepId: current.id,
+          fence: { retryCount: current.retryCount },
+          deduped: false
+        };
+      }
     }
     const iteration = await getStepCountForNode2(runId, node.id);
     const idempotencyKey = `${runId}:${node.id}:${iteration}`;
     const existingStep = await getStepByIdempotencyKey2(idempotencyKey);
     if (existingStep && (existingStep.status === "completed" || existingStep.status === "waiting")) {
-      return { existingStep, stepId: existingStep.id, deduped: true };
+      return {
+        existingStep,
+        stepId: existingStep.id,
+        fence: { retryCount: existingStep.retryCount },
+        deduped: true
+      };
     }
     const latestForeachStep = node.type === "foreach" ? await getLatestStepForNode2(runId, node.id) : undefined;
     const reusableForeachStep = latestForeachStep && !FOREACH_TERMINAL_STEP_STATUSES.has(latestForeachStep.status) ? latestForeachStep : undefined;
@@ -3787,7 +4397,8 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
     }
     claimedStepId = stepId;
     executingSteps.add(stepId);
-    return { existingStep, stepId, deduped: false };
+    const fence = { retryCount: reusableForeachStep?.retryCount ?? 0 };
+    return { existingStep, stepId, fence, deduped: false };
   };
   const dedup = await getDbClient2().transaction(claimStep).catch((err) => {
     if (claimedStepId)
@@ -3811,7 +4422,7 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
     return { outcome: "waiting", successors: [] };
   }
   try {
-    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, workflowId, options);
+    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, dedup.fence, workflowId, options);
   } catch (err) {
     if (await failRunOnUnreadableReplay(runId, err, dedup.stepId)) {
       return { outcome: "failed", successors: [] };
@@ -3821,11 +4432,14 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
     executingSteps.delete(dedup.stepId);
   }
 }
-async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, workflowId, options = {}) {
+async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, fence, workflowId, options = {}) {
+  const stale = { outcome: "failed", successors: [] };
   const executor = registry.get(node.type);
   const systemOneRetryProblems = systemOneRetryViolations(node);
   if (systemOneRetryProblems.length > 0) {
-    await checkpointStepFailure(runId, stepId, systemOneRetryProblems.join("; "), 0);
+    await checkpointStepFailure(runId, stepId, systemOneRetryProblems.join("; "), 0, undefined, {
+      fence
+    });
     return { outcome: "failed", successors: [] };
   }
   const interpolationCtx = buildNodeInterpolationCtx(node, ctx);
@@ -3833,7 +4447,11 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     const inputErrors = validateJsonSchema(node.inputSchema, interpolationCtx);
     if (inputErrors.length > 0) {
       const errorMsg = `Input schema validation failed: ${inputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      const { stale: lost } = await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, {
+        fence
+      });
+      if (lost)
+        return stale;
       throw new Error(errorMsg);
     }
   }
@@ -3847,11 +4465,11 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
   const executionCtx = { ...ctx, ...interpolationCtx };
   if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
     const errorMsg = scriptBodyInterpolationError(node.id, scriptBodyUnresolved);
-    await checkpointStepFailure(runId, stepId, errorMsg, 0);
+    await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { fence });
     return { outcome: "failed", successors: [] };
   }
   if (strictUnresolved && strictUnresolved.length > 0) {
-    await checkpointStepFailure(runId, stepId, systemOneUnresolvedError(node.id, strictUnresolved, node.type), 0);
+    await checkpointStepFailure(runId, stepId, systemOneUnresolvedError(node.id, strictUnresolved, node.type), 0, undefined, { fence });
     return { outcome: "failed", successors: [] };
   }
   if (unresolved.length > 0) {
@@ -3884,19 +4502,20 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     const errorMsg = err instanceof Error ? err.message : String(err);
     const retryPolicy = node.retry || executor.retryPolicy;
     const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy);
+    const { shouldRetry, stale: lost } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy, { fence });
+    if (lost)
+      return stale;
     if (!shouldRetry) {
       throw err;
     }
     return { outcome: "completed", successors: [] };
   }
   if (result.status === "failed") {
-    const retryPolicy = node.retry || executor.retryPolicy;
+    const retryPolicy = result.retryable === false ? undefined : node.retry || executor.retryPolicy;
     const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy);
-    if (result.output !== undefined) {
-      await updateWorkflowRunStep2(stepId, { output: result.output });
-    }
+    const { shouldRetry, stale: lost } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy, { fence, output: result.output });
+    if (lost)
+      return stale;
     if (!shouldRetry) {
       throw new Error(result.error || "Step execution failed");
     }
@@ -3917,7 +4536,7 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     }
     const waiting = await checkpointStepWaiting(runId, stepId, ctx);
     if (waiting && result.waitFor === "workflow.child.finished") {
-      const { resumeFromChildRun } = await import("./resume-a26kvr41.js");
+      const { resumeFromChildRun } = await import("./resume-frdtgfa0.js");
       await resumeFromChildRun(stepId, registry);
     }
     return { outcome: waiting ? "waiting" : "completed", successors: [] };
@@ -3926,7 +4545,11 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     const outputErrors = validateJsonSchema(node.outputSchema, result.output);
     if (outputErrors.length > 0) {
       const errorMsg = `Output schema validation failed: ${outputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      const { stale: lost } = await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, {
+        fence
+      });
+      if (lost)
+        return stale;
       throw new Error(errorMsg);
     }
   }
@@ -3935,7 +4558,10 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     validationResult = await runStepValidation(registry, node, result.output, executionCtx, meta);
     if (validationResult.outcome === "halt") {
       const errorMsg = "Validation failed (mustPass)";
-      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { markRunFailed: false });
+      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, {
+        markRunFailed: false,
+        fence
+      });
       return { outcome: "failed", successors: [] };
     }
     if (validationResult.outcome === "retry") {
@@ -3946,12 +4572,15 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
       }
       const retryPolicy = node.validation.retry || node.retry;
       const currentRetryCount = existingStep?.retryCount || 0;
-      await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy);
+      const { stale: lost } = await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy, { fence });
+      if (lost)
+        return stale;
       return { outcome: "completed", successors: [] };
     }
   }
   result.nextPort = resolveValidationPort(node.next, result.nextPort, validationResult?.passed);
-  await checkpointStep(runId, stepId, node.id, result, ctx);
+  if (!await checkpointStep(runId, stepId, node.id, result, ctx, { fence }))
+    return stale;
   const successors = result.nextPort ? getSuccessors(def, node.id, result.nextPort) : getSuccessors(def, node.id);
   return { outcome: "completed", successors };
 }
@@ -4199,7 +4828,7 @@ class ForeachExecutor extends BaseExecutor {
       };
     }));
     const childSteps = (await this.deps.db.getWorkflowRunStepsByRunId(meta.runId)).filter((step) => parseSyntheticNodeId(step.nodeId)?.parentNodeId === meta.nodeId);
-    if (childSteps.every((step) => FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
+    if (childSteps.every(isForeachChildSettled)) {
       return { status: "success", output: buildForeachAggregate(childSteps) };
     }
     return {
@@ -4369,7 +4998,7 @@ async function runForeachDrive(runId, parentNodeId, registry) {
     if (drive.successors.length > 0) {
       await walkGraph(workflow.definition, runId, ctx, drive.successors, registry, workflow.id, getSecretInputKeys(workflow.input));
     } else {
-      const { finalizeOrWait } = await import("./resume-a26kvr41.js");
+      const { finalizeOrWait } = await import("./resume-frdtgfa0.js");
       await finalizeOrWait(runId);
     }
     return drive;
@@ -4408,6 +5037,11 @@ async function claimChildren(def, runId, parentNode) {
   const claimed = [];
   try {
     await getDbClient2().transaction(async () => {
+      const status = await getWorkflowRunStatus(runId);
+      if (status !== "running" && status !== "waiting")
+        return;
+      if (await getRunLineageBlock(runId))
+        return;
       const children = latestForeachChildren(def, parentNode.id, await getWorkflowRunStepsByRunId2(runId));
       for (const child of children) {
         if (child.status === "running" && !ownedChildren.has(child.id)) {
@@ -4415,7 +5049,7 @@ async function claimChildren(def, runId, parentNode) {
           claimed.push(child);
         }
       }
-      const inFlight = children.filter((child) => child.status === "running" || child.status === "waiting").length;
+      const inFlight = children.filter((child) => child.status === "running" || child.status === "waiting" || isRetryPending(child)).length;
       let free = foreachConcurrencyCap(parentNode) - inFlight;
       for (const child of children) {
         if (free <= 0)
@@ -4511,7 +5145,7 @@ async function startChild(input) {
     const parked = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'waiting' WHERE id = ? AND status = 'running' RETURNING id", [child.id]);
     if (parked && result.waitFor === "workflow.child.finished") {
       ownedChildren.delete(child.id);
-      const { resumeFromChildRun } = await import("./resume-a26kvr41.js");
+      const { resumeFromChildRun } = await import("./resume-frdtgfa0.js");
       await resumeFromChildRun(child.id, registry);
     }
     return null;
@@ -4552,6 +5186,12 @@ var FOREACH_TERMINAL_STEP_STATUSES = new Set([
   "cancelled",
   "skipped"
 ]);
+function isRetryPending(step) {
+  return step.status === "failed" && step.nextRetryAt != null;
+}
+function isForeachChildSettled(step) {
+  return FOREACH_TERMINAL_STEP_STATUSES.has(step.status) && !isRetryPending(step);
+}
 function parseSyntheticNodeId(nodeId) {
   const separatorIndex = nodeId.indexOf("#");
   if (separatorIndex <= 0 || separatorIndex === nodeId.length - 1)
@@ -4574,7 +5214,7 @@ async function joinForeach(def, runId, childStep, ctx) {
     throw new Error(`Step "${childStep.nodeId}" is not a foreach child`);
   }
   const children = latestForeachChildren(def, parent.id, await getWorkflowRunStepsByRunId2(runId));
-  if (children.some((step) => !FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
+  if (children.some((step) => !isForeachChildSettled(step))) {
     return { joined: false, parentNodeId: parent.id, successors: [] };
   }
   const parentStep = await getLatestStepForNode2(runId, parent.id);
@@ -4664,6 +5304,8 @@ async function settleForeachChild(def, runId, childStepId, outcome, ctx, options
     });
     if (run.status !== "running" && run.status !== "waiting")
       return unclaimed;
+    if (await getRunLineageBlock(runId))
+      return unclaimed;
     if (outcome.status !== "completed" && effectiveFailurePolicy(parent, def) === "fail-fast") {
       const reason = options.runError ?? outcome.error ?? `foreach item ${current.nodeId} failed`;
       await cancelQueuedForeachChildren(def, runId, parent.id, current.nodeId);
@@ -4693,9 +5335,11 @@ async function cancelQueuedForeachChildren(def, runId, parentNodeId, failedChild
   await getDbClient2().transaction(async () => {
     const children = latestForeachChildren(def, parentNodeId, await getWorkflowRunStepsByRunId2(runId));
     for (const child of children) {
-      if (child.status !== "pending")
+      if (child.status !== "pending" && !isRetryPending(child))
         continue;
-      const row = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'cancelled', error = ?, finishedAt = ? WHERE id = ? AND status = 'pending' RETURNING id", [error, finishedAt, child.id]);
+      const row = await getDbClient2().get(`UPDATE workflow_run_steps SET status = 'cancelled', error = ?, finishedAt = ?, nextRetryAt = NULL
+          WHERE id = ? AND (status = 'pending' OR (status = 'failed' AND nextRetryAt IS NOT NULL))
+          RETURNING id`, [error, finishedAt, child.id]);
       if (row)
         cancelled++;
     }
@@ -5122,4 +5766,4 @@ function applyDefinitionPatch(def, patch) {
   return { definition: patchedDef, errors };
 }
 
-export { notifyAutomationPreflightFailure, automationIntegrationFixUrl, isNeedsSetupFailure, preflightAutomation, renderAutomationTokens, getAutomationSetupStates, schedulePreflightInput, listEnabledAutomationPreflightInputs, recordSchedulePreflightFailure, BaseExecutor, resolveSlackConversationId, dispatchApprovalNotifications, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_PROVIDER_IDS, SystemOneExtractionExecutor, SYSTEM_ONE_DECISION_NODE_TYPE, SystemOneDecisionConfigSchema, SystemOneDecisionExecutor, checkpointStep, checkpointStepFailure, checkpointStepWaiting, FAILED_TASK_OUTPUT_PREFIX, FOREACH_ITEMS_WAIT_FOR, loadCompletedStepRouting, resolveInputValue, getSecretInputKeys, validateJsonSchema, findJsonSchemaShapeErrors, getMaxWorkflowStepsPerRun, findWorkflowReadinessProblems, formatReadinessProblems, workflowSaveWarnings, withSaveWarnings, runStepValidation, TriggerSchemaError, startWorkflowExecution2, failRunOnUnreadableReplay, isWorkflowRunActive, holdWorkflowRun, walkGraph, hasRunningStep, findReadyNodes, scriptBodyInterpolationError, ForeachExecutor, rebuildNodeExecutionInput, isForeachChildOwned, parkAndDriveForeach, startForeachDrive, runForeachDrive, FOREACH_TERMINAL_STEP_STATUSES, parseSyntheticNodeId, resolveForeachParent, settleForeachChild, resolveStepNode, stepFailureMode, getNextTargets, generateEdges, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch };
+export { notifyAutomationPreflightFailure, automationIntegrationFixUrl, isNeedsSetupFailure, preflightAutomation, renderAutomationTokens, getAutomationSetupStates, schedulePreflightInput, listEnabledAutomationPreflightInputs, recordSchedulePreflightFailure, BaseExecutor, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, markRuntimeInstanceOffline, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, ConfigQuestionSettingsSchema, ConfigStateSchema, readConfigState, normalizeApprovalQuestions, isConfigQuestion, parseConfigAnswer, skippedConfigResult, keptConfigResult, applyConfigAnswer, resolveSlackConversationId, dispatchApprovalNotifications, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_PROVIDER_IDS, SystemOneExtractionExecutor, SYSTEM_ONE_DECISION_NODE_TYPE, SystemOneDecisionConfigSchema, SystemOneDecisionExecutor, checkpointStep, checkpointStepFailure, checkpointStepWaiting, FAILED_TASK_OUTPUT_PREFIX, FOREACH_ITEMS_WAIT_FOR, loadCompletedStepRouting, resolveInputValue, getSecretInputKeys, validateJsonSchema, findJsonSchemaShapeErrors, getMaxWorkflowStepsPerRun, findWorkflowReadinessProblems, formatReadinessProblems, workflowSaveWarnings, withSaveWarnings, runStepValidation, TriggerSchemaError, startWorkflowExecution2, ParentStepNotCurrentError, failRunOnUnreadableReplay, isWorkflowRunActive, isStepExecuting, holdWorkflowRun, walkGraph, hasRunningStep, findReadyNodes, scriptBodyInterpolationError, ForeachExecutor, rebuildNodeExecutionInput, isForeachChildOwned, parkAndDriveForeach, startForeachDrive, runForeachDrive, FOREACH_TERMINAL_STEP_STATUSES, isRetryPending, parseSyntheticNodeId, resolveForeachParent, settleForeachChild, resolveStepNode, stepFailureMode, getNextTargets, generateEdges, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch };