@dzhechkov/harness-core 0.5.0 → 0.5.2

package/src/loop-plan.ts

@@ -27,6 +27,10 @@
 
 import { createHash } from 'node:crypto';
 import { TRACE_KEY_RE } from './loop-trace.js';
+// The ONE ceiling formula (ADR-004 Confirmation-2) — imported so the run projection's
+// `budgetTotal` and the rendered script's `__budget` constant cannot drift into two ceilings.
+// loop-run-semantics has no runtime import of its own, so this edge introduces no cycle.
+import { computeBudgetTotal } from './loop-run-semantics.js';
 
 export const LOOP_PLAN_SCHEMA = 'loop-plan/1';
 
@@ -1437,3 +1441,184 @@ export function toTraceProjection(plan: LoopPlan): TraceProjection {
     expectedSteps: norm.steps.filter((s) => s.kind === 'agent' || s.kind === 'gate').map((s) => s.stepId),
   };
 }
+
+// ─────────────────────────────────────────────────────────────────────────────
+// The FOURTH projection (feature dz-workflow-run, ADR-001 O1 + AM-3 doctrine).
+//
+// `dz workflow run` is a SECOND enactor of the same plan, and the AM-3 rule that kept the first
+// one honest applies to it unchanged: a consumer reads a PROJECTION, never `plan.steps`. The three
+// existing projections cannot serve it — `TraceProjection` is the invariant-checking view and
+// carries no prompts, models or budgets by design. So the scheduler gets its own view, added next
+// to the other three, and joins the same layer-1 consumer grep.
+//
+// The addition is ANALYTICAL: the `loop-plan/1` SCHEMA SURFACE (the LoopPlan/LoopStep types,
+// FIELD_DOMAINS, KNOWN_KEYS, REQUIRED_FIELDS, STEP_FIELD_KINDS, CROSS_REFS, parsePlan,
+// validatePlan, normalizePlan, planDigest) is byte-unchanged — nothing below can make a plan that
+// used to parse stop parsing, or change a digest.
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** One dispatching step as the scheduler needs it — everything it must know to build a prompt,
+ * pick a model, spend budget, retry, and verify a deliverable landed. */
+export interface RunStepSpec {
+  stepId: string;
+  kind: 'agent' | 'gate';
+  phase: string;
+  /** USER prompt seed (`plan.steps[].prompt`); null means the plan declared none. */
+  prompt: string | null;
+  model: string | null;
+  deliverable: Deliverable;
+  reads: string[];
+  writes: string[];
+  tools: string[];
+  /** INCLUDES the initial attempt (AM-4 semantics; 1 = no retry). */
+  retryMaxAttempts: number;
+  retryOn: FailureClass[];
+  /** `budget.maxAgents ?? 1` — the per-step worst case a boundary reservation is built from. */
+  maxAgents: number;
+  /** `step['x-role'] === 'qe'` — the designed `x-` seam, not a schema field (fence: zero surgery). */
+  qeRole: boolean;
+  gate: { kind: string; failRoute: string | null; maxRedos: number } | null;
+}
+
+/** One SCHEDULING BOUNDARY: the unit the runner reserves budget for, checkpoints, and may pause
+ * BEFORE. A parallel region is ONE boundary (its worst case is reserved as a whole), which is what
+ * makes "pause before the region, never mid-region" expressible. */
+export interface RunBoundary {
+  /** The stepId of the stage / fanout / gate / pause this boundary enacts. */
+  boundaryId: string;
+  kind: 'stage' | 'region' | 'gate' | 'pause';
+  /** Happens-before inputs, as BOUNDARY ids: a declared dep on a join stage or a fanout member is
+   * carried as its REGION, because the member and the join are not boundaries of their own. */
+  deps: string[];
+  /** Present for kind 'stage' | 'gate'. */
+  stage?: RunStepSpec;
+  /** Present for kind 'region'. */
+  region?: {
+    fanout: string;
+    join: string;
+    joinPolicy: string;
+    onInvalid: string;
+    maxFanout: number;
+    registry: string[];
+    dedup: boolean;
+    shape: ConcurrencyShape;
+    chain: RunStepSpec[];
+  };
+  /** Present for kind 'pause'. */
+  pause?: { state: string; resumeArg: string; payloadSchema: Record<string, unknown> | null };
+}
+
+export interface RunProjection {
+  kind: 'run-projection/1';
+  /** Plan order — the render's enactment order, so both enactors walk the same sequence. */
+  boundaries: RunBoundary[];
+  /** `computeBudgetTotal(plan)` — the SAME number the rendered script spends against. */
+  budgetTotal: number;
+  /** Plan-declared `pauses[].resumeArg` keys — the enumerated argsHash exclusions (AM-13). */
+  resumeArgKeys: string[];
+  /** `plan.trace.emit === true` — the AM-6 gate input (a run with no trace plane is refused). */
+  traceEmit: boolean;
+}
+
+/** The ONLY plan view `workflow-run.ts` consumes (AM-3, fourth consumer). */
+export function toRunProjection(plan: LoopPlan): RunProjection {
+  const norm = normalizePlan(plan);
+  const byId = new Map(norm.steps.map((s) => [s.stepId, s]));
+  const gatesById = new Map((norm.gates ?? []).map((g) => [g.stepId, g]));
+  const pausesByState = new Map((norm.pauses ?? []).map((p) => [p.state, p]));
+  const fanouts = norm.fanouts ?? [];
+  const joinsByForStage = new Map((norm.joins ?? []).map((j) => [j.forStage, j]));
+
+  /** member stepId → its owning fanout stage; join stepId → its owning fanout stage. */
+  const ownedByRegion = new Map<string, string>();
+  for (const f of fanouts) {
+    for (const c of f.chain ?? []) ownedByRegion.set(c, f.stage);
+    const j = joinsByForStage.get(f.stage);
+    if (j !== undefined) ownedByRegion.set(j.stage, f.stage);
+  }
+
+  const specOf = (s: LoopStep): RunStepSpec => {
+    const g = s.kind === 'gate' ? gatesById.get(s.stepId) : undefined;
+    return {
+      stepId: s.stepId,
+      kind: s.kind === 'gate' ? 'gate' : 'agent',
+      phase: s.phase,
+      prompt: typeof s.prompt === 'string' ? s.prompt : null,
+      model: typeof s.model === 'string' && s.model !== '' ? s.model : null,
+      deliverable: s.deliverable ?? 'return-value',
+      reads: [...(s.artifacts?.reads ?? [])],
+      writes: [...(s.artifacts?.writes ?? [])],
+      tools: [...(s.tools ?? [])],
+      retryMaxAttempts: typeof s.retry?.maxAttempts === 'number' && s.retry.maxAttempts >= 1 ? Math.floor(s.retry.maxAttempts) : 1,
+      retryOn: [...(s.retry?.retryableFailureClasses ?? [])],
+      maxAgents: typeof s.budget?.maxAgents === 'number' ? s.budget.maxAgents : 1,
+      qeRole: s['x-role'] === 'qe',
+      gate:
+        g === undefined
+          ? null
+          : {
+              kind: typeof g.kind === 'string' ? g.kind : 'gate',
+              failRoute: typeof g.failRoute === 'string' ? g.failRoute : null,
+              maxRedos: typeof g.maxRedos === 'number' && Number.isFinite(g.maxRedos) && g.maxRedos > 0 ? Math.floor(g.maxRedos) : 0,
+            },
+    };
+  };
+
+  /** A declared dep resolved to the BOUNDARY that must have settled before this one dispatches. */
+  const depBoundary = (dep: string): string => ownedByRegion.get(dep) ?? dep;
+
+  const boundaries: RunBoundary[] = [];
+  for (const s of norm.steps) {
+    if (ownedByRegion.has(s.stepId)) continue; // members and joins are rendered inside their region
+    const deps = [...new Set((s.deps ?? []).map(depBoundary).filter((d) => d !== s.stepId))];
+    if (s.kind === 'fanout') {
+      const f = fanouts.find((x) => x.stage === s.stepId);
+      const j = f === undefined ? undefined : joinsByForStage.get(f.stage);
+      boundaries.push({
+        boundaryId: s.stepId,
+        kind: 'region',
+        deps,
+        region: {
+          fanout: s.stepId,
+          join: j?.stage ?? '',
+          joinPolicy: j?.joinPolicy ?? '',
+          onInvalid: j?.onInvalid ?? 'named-failure',
+          maxFanout: typeof f?.maxFanout === 'number' ? f.maxFanout : 0,
+          registry: [...(f?.registry ?? [])],
+          dedup: f?.dedup === true,
+          shape: s.concurrency ?? 'barrier',
+          chain: (f?.chain ?? []).map((c) => byId.get(c)).filter((c): c is LoopStep => c !== undefined).map(specOf),
+        },
+      });
+      continue;
+    }
+    if (s.kind === 'pause') {
+      const state = typeof s.pauseState === 'string' ? s.pauseState : '';
+      const declared = pausesByState.get(state);
+      boundaries.push({
+        boundaryId: s.stepId,
+        kind: 'pause',
+        deps,
+        pause: {
+          state,
+          resumeArg: declared?.resumeArg ?? '',
+          payloadSchema: declared?.payloadSchema ?? null,
+        },
+      });
+      continue;
+    }
+    if (s.kind === 'gate') {
+      boundaries.push({ boundaryId: s.stepId, kind: 'gate', deps, stage: specOf(s) });
+      continue;
+    }
+    boundaries.push({ boundaryId: s.stepId, kind: 'stage', deps, stage: specOf(s) });
+  }
+
+  return {
+    kind: 'run-projection/1',
+    boundaries,
+    budgetTotal: computeBudgetTotal(norm),
+    resumeArgKeys: (norm.pauses ?? []).map((p) => p.resumeArg).filter((k): k is string => typeof k === 'string' && k !== ''),
+    traceEmit: norm.trace?.emit === true,
+  };
+}

package/src/loop-render.ts

@@ -34,6 +34,7 @@ import {
   type LoopStep,
 } from './loop-plan.js';
 import { BLOBS, type LoopBlob } from './loop-blobs.generated.js';
+import { computeBudgetTotal, stepContractLines } from './loop-run-semantics.js';
 
 export const LOOP_RENDER_GENERATOR = 'loop-render/1';
 
@@ -76,6 +77,12 @@ function sha256(s: string): string {
 /** Which blobs a plan pulls in (opt-in subsystems + auto rules + requires closure). */
 export function selectBlobs(plan: LoopPlan): LoopBlob[] {
   const names = new Set<string>();
+  // The ENACTMENT-DECISION blob is UNCONDITIONAL (ADR-001 W4): the base runtime aliases
+  // errText/errSnap/classifyFailure in every script, so there is no plan that does not need it.
+  // gateVerdict/joinRegion are inert function declarations in a plan with no gate/fanout — the
+  // alternative (a conditional roster) would make the exec fingerprint's `tools` axis depend on
+  // plan shape twice, and would let a semantics-carrying script exist without the semantics.
+  names.add('loop-semantics');
   const sub = plan.subsystems ?? {};
   if (plan.checkpointing?.enabled === true || sub.checkpoints === true) names.add('checkpoints');
   // AM-9: training pairs are injected ONLY on an explicit opt-in — never by default (PHI lesson).
@@ -189,26 +196,22 @@ function stepUserLines(s: LoopStep): string[] {
 function stepPromptAssembly(s: LoopStep, plan: LoopPlan): string[] {
   const id = s.stepId;
   const lines: string[] = [];
-  const reads = s.artifacts?.reads ?? [];
-  const writes = s.artifacts?.writes ?? [];
   const gateCfg = s.kind === 'gate' ? (plan.gates ?? []).find((g) => g.stepId === id) : undefined;
   lines.push(`const P_${ident(id)} = [`);
   lines.push(`  USER_PROMPT_${ident(id)},`);
-  if (reads.length > 0) lines.push(`  ${jsString('declared inputs (plan artifacts.reads): ' + reads.join(', '))},`);
-  if (writes.length > 0) {
-    const fileNote = (s.deliverable ?? 'return-value') === 'file' ? '; your deliverable is the written file(s), not your reply' : '';
-    lines.push(`  ${jsString('declared outputs (plan artifacts.writes): ' + writes.join(', ') + ' — write them' + fileNote + '. The loop verifies they land.')},`);
-  }
-  // ENACTS LoopStep.tools (cfr-pipeline ADR-002): the declared perimeter is COMMUNICATED to the
-  // agent in FIXED wording, so its presence is greppable by a layer-1 test. The second sentence is
-  // not decoration — it is the honesty clause the whole feature rests on: a declaration is not
-  // enforcement, and every environment this ships into today serves the tools as labeled stubs.
-  const tools = s.tools ?? [];
-  if (tools.length > 0) {
-    lines.push(`  ${jsString('declared MCP tool allowlist (plan tools): ' + tools.join(', ') + ' — use NOTHING outside it. In this environment every one of these is a labeled STUB, not a live integration; enforcement lives at the MCP server, not here.')},`);
-  }
-  if (s.kind === 'gate') {
-    lines.push(`  ${jsString('GATE PROTOCOL (kind: ' + (gateCfg?.kind ?? 'gate') + '): end your reply with exactly one line "GATE: PASS" or "GATE: FAIL" — the loop PARSES this verdict and never synthesizes one.')},`);
+  // The contract lines themselves come from ONE function shared with the dz runner
+  // (loop-run-semantics.stepContractLines, ADR-001 Confirmation-5) — the render's only remaining
+  // job is JS-quoting them. ENACTS artifacts.reads/writes/deliverable, LoopStep.tools and the gate
+  // protocol: the plan's declarations are COMMUNICATED to the agent in FIXED wording, so their
+  // presence is greppable by a layer-1 test and IDENTICAL under both enactors.
+  for (const line of stepContractLines({
+    reads: s.artifacts?.reads ?? [],
+    writes: s.artifacts?.writes ?? [],
+    deliverable: s.deliverable ?? 'return-value',
+    tools: s.tools ?? [],
+    gate: s.kind === 'gate' ? { kind: gateCfg?.kind ?? 'gate' } : null,
+  })) {
+    lines.push(`  ${jsString(line)},`);
   }
   lines.push(`].join('\\n')`);
   return lines;
@@ -477,15 +480,10 @@ function renderRuntime(plan: LoopPlan, planDig: string, execFp: string, blobs: L
   const traceOn = plan.trace?.emit === true;
   const ckptOn = plan.checkpointing?.enabled === true || plan.subsystems?.checkpoints === true;
   // budget: declared per-step budgets PLUS the declared gate-redo allowance (QE round-3 B1 — a
-  // plan-declared redo must be affordable; an undeclared one still hits the guard loudly).
-  const stepBudget = plan.steps.reduce((n, s) => n + (s.budget?.maxAgents ?? 1), 0);
-  const byIdB = new Map(plan.steps.map((s) => [s.stepId, s]));
-  const gateRedoBudget = (plan.gates ?? []).reduce((n, g) => {
-    const redos = typeof g.maxRedos === 'number' && Number.isFinite(g.maxRedos) && g.maxRedos > 0 ? Math.floor(g.maxRedos) : 0;
-    if (redos === 0 || typeof g.failRoute !== 'string' || g.failRoute.startsWith('terminal:')) return n;
-    return n + redos * ((byIdB.get(g.failRoute)?.budget?.maxAgents ?? 1) + (byIdB.get(g.stepId)?.budget?.maxAgents ?? 1));
-  }, 0);
-  const budgetTotal = stepBudget + gateRedoBudget;
+  // plan-declared redo must be affordable; an undeclared one still hits the guard loudly). The
+  // FORMULA lives in loop-run-semantics (ADR-004 Confirmation-2) so the dz runner reserves against
+  // the same ceiling this script spends against — one formula, two enactors.
+  const budgetTotal = computeBudgetTotal(plan);
   const lines: string[] = [];
   lines.push(G('runtime'));
   lines.push(`const A = typeof args === 'string' ? JSON.parse(args) : (args || {})`);
@@ -518,82 +516,15 @@ function renderRuntime(plan: LoopPlan, planDig: string, execFp: string, blobs: L
   lines.push(`function __settleSeqOf(stepId, itemKey, occ) { const v = __settled[__settleKey(stepId, itemKey, occ)]; return typeof v === 'number' ? v : -1 }`);
   lines.push(`let __invocationN = 0`);
   lines.push(`let __seqFallback = 0 // used only when the trace blob is opted out (hooks are no-ops)`);
-  lines.push(`// __errText — TOTAL error-to-text (QE round-3 B3, the ha-consilium 5b totality lesson): the`);
-  lines.push(`// writer's own settle event must survive a hostile error object. String(err) throws on a`);
-  lines.push(`// null-prototype object and a throwing .message getter throws on access — both are caught here,`);
-  lines.push(`// so rendering a message can never replace the original failure or lose the settle. The`);
-  lines.push(`// .message property is read ONCE into a local (round-5 B3: a one-shot getter answered the`);
-  lines.push(`// typeof probe and vanished on the value read — snapshot-once defeats it).`);
-  lines.push(`function __errText(err) {`);
-  lines.push(`  try {`);
-  lines.push(`    if (err !== null && typeof err === 'object') { const m = err.message; if (typeof m === 'string') return m }`);
-  lines.push(`    return String(err)`);
-  lines.push(`  } catch (_e) {`);
-  lines.push(`    try { return Object.prototype.toString.call(err) } catch (_e2) { return '[unrenderable error]' }`);
-  lines.push(`  }`);
-  lines.push(`}`);
-  lines.push(`// failure classification (G4, hardened in QE round-3 B3, round-4: cause-chain + word bounds) —`);
-  lines.push(`// the CLOSED enum from loop-plan/1 (timeout | transport | malformed-output | policy-refusal).`);
-  lines.push(`// The err.cause CHAIN is traversed (bounded depth 5, cycle-safe, getter-safe): the standard`);
-  lines.push(`// Node fetch shape TypeError('fetch failed', {cause:{code:'ECONNRESET'}}) is TRANSPORT.`);
-  lines.push(`// THREE TIERS over the whole chain, strongest first:`);
-  lines.push(`//   1. error CODE (works on non-Error shapes like {code:'ECONNRESET'}; never message-dependent;`);
-  lines.push(`//      ETIMEDOUT is a TRANSPORT code — round-2's message regex captured it as 'timeout' first);`);
-  lines.push(`//   2. error NAME (SyntaxError = parsing model output failed → malformed-output);`);
-  lines.push(`//   3. message patterns, DISJOINT by precedence transport > policy-refusal > malformed-output >`);
-  lines.push(`//      timeout — every alternative WORD-BOUNDED (round-4 B3: 'rate.?limit' unbounded matched`);
-  lines.push(`//      'delibeRATE LIMITation'/'corpoRATE LIMITation' — a substring can never smuggle a class).`);
-  lines.push(`// An UNCLASSIFIABLE failure returns null and is NEVER retried (closed enum, fail-closed).`);
-  lines.push(`function __causeChain(err) {`);
-  lines.push(`  const chain = []`);
-  lines.push(`  let cur = err`);
-  lines.push(`  for (let d = 0; d < 5; d++) {`);
-  lines.push(`    if (cur === null || cur === undefined) break`);
-  lines.push(`    if (chain.indexOf(cur) !== -1) break // cycle-safe`);
-  lines.push(`    chain.push(cur)`);
-  lines.push(`    try { cur = typeof cur === 'object' ? cur.cause : undefined } catch (_e) { cur = undefined } // getter-safe`);
-  lines.push(`  }`);
-  lines.push(`  return chain.length > 0 ? chain : [err]`);
-  lines.push(`}`);
-  lines.push(`// __errSnap — ONE snapshot PER FAILURE (round-6 B3; Codex round-5: .message was snapshot once`);
-  lines.push(`// per __errText INVOCATION, not once per failure — logging read it, classification read it`);
-  lines.push(`// AGAIN, so a one-shot .message getter answered the log and defeated classification: 2 getter`);
-  lines.push(`// reads, 1 attempt MEASURED). The catch site builds this snapshot ONCE; the log line and the`);
-  lines.push(`// classifier both consume the SNAPSHOT — .code/.name/.message are each read exactly once per`);
-  lines.push(`// failure, getter-safe, over the whole cause chain.`);
-  lines.push(`function __errSnap(err) {`);
-  lines.push(`  const chain = __causeChain(err)`);
-  lines.push(`  const snap = []`);
-  lines.push(`  for (let ci = 0; ci < chain.length; ci++) {`);
-  lines.push(`    let code = null`);
-  lines.push(`    try { const c = chain[ci] !== null && typeof chain[ci] === 'object' ? chain[ci].code : null; code = typeof c === 'string' ? c.toUpperCase() : null } catch (_e) { code = null }`);
-  lines.push(`    let name = null`);
-  lines.push(`    try { const n = chain[ci] !== null && typeof chain[ci] === 'object' ? chain[ci].name : null; name = typeof n === 'string' ? n : null } catch (_e) { name = null }`);
-  lines.push(`    snap.push({ code: code, name: name, text: __errText(chain[ci]) })`);
-  lines.push(`  }`);
-  lines.push(`  return snap`);
-  lines.push(`}`);
-  lines.push(`function __classifyFailure(outcome, snap) {`);
-  lines.push(`  if (outcome === 'null') return 'transport' // a dead/empty agent is a delivery failure — the "agent died" case is retryable ONLY under retryOn: ['transport']`);
-  lines.push(`  const links = Array.isArray(snap) ? snap : []`);
-  lines.push(`  for (let ci = 0; ci < links.length; ci++) {`);
-  lines.push(`    const code = links[ci].code`);
-  lines.push(`    if (code === 'ETIMEDOUT' || code === 'ECONNRESET' || code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'EPIPE' || code === 'ECONNABORTED' || code === 'EAI_AGAIN') return 'transport'`);
-  lines.push(`  }`);
-  lines.push(`  for (let ci = 0; ci < links.length; ci++) {`);
-  lines.push(`    if (links[ci].name === 'SyntaxError') return 'malformed-output'`);
-  lines.push(`  }`);
-  lines.push(`  let msg = ''`);
-  lines.push(`  for (let ci = 0; ci < links.length; ci++) { msg += (ci > 0 ? '\\n' : '') + links[ci].text }`);
-  lines.push(`  msg = msg.toLowerCase()`);
-  lines.push(`  // rate[ -]?limit(ed|ing|s)? is RIGHT-BOUNDED (round-5 B3: the open 'rate.?limit' matched`);
-  lines.push(`  // 'rate limitation: invalid JSON' as transport — a malformed-output failure smuggled a class)`);
-  lines.push(`  if (/\\btransport\\b|\\beconnreset\\b|\\beconnrefused\\b|\\benotfound\\b|\\bepipe\\b|\\betimedout\\b|\\bsocket hang up\\b|\\bnetwork error\\b|\\brate[ -]?limit(ed|ing|s)?\\b|\\boverloaded\\b|\\bhttp 5[0-9][0-9]\\b/.test(msg)) return 'transport'`);
-  lines.push(`  if (/\\bpolicy\\b|\\brefus(e|ed|es|al|ing)\\b|\\bdeclin(e|ed|es|ing)\\b|\\bcontent filter\\b|\\bsafety block\\b/.test(msg)) return 'policy-refusal'`);
-  lines.push(`  if (/\\bmalformed\\b|\\bunparseable\\b|\\bparse error\\b|\\binvalid json\\b|\\bunexpected token\\b|\\bunexpected end of json\\b|\\bschema mismatch\\b/.test(msg)) return 'malformed-output'`);
-  lines.push(`  if (/\\btimeout\\b|\\btimed out\\b/.test(msg)) return 'timeout'`);
-  lines.push(`  return null`);
-  lines.push(`}`);
+  lines.push(`// The enactment DECISIONS below are ALIASES onto the always-on \`loop-semantics\` blob`);
+  lines.push(`// (ADR-001 W4): errText/causeChain/errSnap/classifyFailure/gateVerdict/joinRegion have ONE`);
+  lines.push(`// implementation, sliced into this script from harness-core/src/loop-run-semantics.ts and`);
+  lines.push(`// IMPORTED (not copied) by the dz runner. The __-prefixed names are kept so every call site`);
+  lines.push(`// in this runtime reads exactly as it did when the bodies lived here.`);
+  lines.push(`const __errText = errText`);
+  lines.push(`const __causeChain = causeChain`);
+  lines.push(`const __errSnap = errSnap`);
+  lines.push(`const __classifyFailure = classifyFailure`);
   lines.push(`// __settleStep — THE single terminal exit of every step path (QE round-5 B3 class-kill;`);
   lines.push(`// round-6: SUCCESS-PATH PARITY — Codex round-5 showed __settleStep({outcome:'ok'}) returned`);
   lines.push(`// BEFORE flushing, leaving success durability on a naked phase-boundary await whose rejection`);
@@ -684,17 +615,8 @@ function renderRuntime(plan: LoopPlan, planDig: string, execFp: string, blobs: L
   lines.push(`  if (lastErr !== null) throw lastErr`);
   lines.push(`  return null`);
   lines.push(`}`);
-  lines.push(`// join helper — explicit policy from the closed set; a dispatched branch is never skippable`);
-  lines.push(`function joinRegion(results, o) {`);
-  lines.push(`  const policy = o && o.policy ? o.policy : 'all-activated'`);
-  lines.push(`  const failures = []`);
-  lines.push(`  for (let i = 0; i < results.length; i++) { if (results[i] === null || results[i] === undefined) failures.push(i) }`);
-  lines.push(`  if (policy === 'any') { if (failures.length === results.length) { throw new Error('join ' + o.region + ': every branch failed (policy any)') } return { ok: true, values: results, failures: failures } }`);
-  lines.push(`  const quorum = /^quorum:([1-9][0-9]*)$/.exec(policy)`);
-  lines.push(`  if (quorum) { const okN = results.length - failures.length; if (okN < Number(quorum[1])) { throw new Error('join ' + o.region + ': quorum ' + quorum[1] + ' not met (' + okN + ' ok)') } return { ok: true, values: results, failures: failures } }`);
-  lines.push(`  if (failures.length > 0) { throw new Error('join ' + o.region + ': ' + failures.length + ' dispatched branch(es) failed under policy ' + policy + ' — a dispatched branch is never skippable') }`);
-  lines.push(`  return { ok: true, values: results, failures: [] }`);
-  lines.push(`}`);
+  lines.push(`// join helper — explicit policy from the closed set; a dispatched branch is never skippable.`);
+  lines.push(`// The DECISION lives in the loop-semantics blob above (\`joinRegion\`), called directly here.`);
   if (plan.steps.some((s) => s.kind === 'fanout')) {
     // ── QUIESCENCE (QE round-7 B3, the round-6 reviewer's FOURTH CLASS: structured-concurrency /
     // quiescence ownership). MEASURED by Codex on the previous shape: the region awaited a
@@ -731,7 +653,7 @@ function renderRuntime(plan: LoopPlan, planDig: string, execFp: string, blobs: L
   }
   if (traceOn) {
     lines.push(`// trace wiring (blob-provided emitter; hooks INSIDE runStep — ADR-003)`);
-    lines.push(`const __traceState = traceInit(RUN_ID, PLAN_DIGEST, EXEC_FP)`);
+    lines.push(`const __traceState = traceInit(RUN_ID, PLAN_DIGEST, EXEC_FP, 'rendered-script')`);
     lines.push(`__hooks.onDispatch = function (e) { return traceOnDispatch(__traceState, e) }`);
     lines.push(`__hooks.onSettle = function (e) { return traceOnSettle(__traceState, e) }`);
     lines.push(`async function __traceFlushNow(phaseName, stepLabel) {`);
@@ -871,20 +793,8 @@ function renderRuntime(plan: LoopPlan, planDig: string, execFp: string, blobs: L
     lines.push(`// must be the ONLY anchored verdict line. Embedded mid-reply "GATE: PASS" text never counts,`);
     lines.push(`// "GATE: PASS" followed by trailing prose is invalid, and "GATE: FAIL … GATE: PASS" is an`);
     lines.push(`// INVALID verdict (never a success) — routed like a failure (redo/fail route), never a pass.`);
-    lines.push(`function __gateVerdict(r) {`);
-    lines.push(`  if (typeof r !== 'string') return 'invalid'`);
-    lines.push(`  const vLines = r.split('\\n')`);
-    lines.push(`  const vRe = /^\\s*GATE:\\s*(PASS|FAIL)\\s*$/`);
-    lines.push(`  let vCount = 0`);
-    lines.push(`  let vLast = ''`);
-    lines.push(`  for (let i = 0; i < vLines.length; i++) {`);
-    lines.push(`    if (vRe.test(vLines[i])) { vCount++ }`);
-    lines.push(`    if (vLines[i].trim() !== '') { vLast = vLines[i] }`);
-    lines.push(`  }`);
-    lines.push(`  const vEnd = vRe.exec(vLast)`);
-    lines.push(`  if (vCount !== 1 || vEnd === null) return 'invalid'`);
-    lines.push(`  return vEnd[1] === 'PASS' ? 'pass' : 'fail'`);
-    lines.push(`}`);
+    lines.push(`// The grammar itself lives in the loop-semantics blob, shared with the dz runner.`);
+    lines.push(`const __gateVerdict = gateVerdict`);
   }
   lines.push(GE('runtime'));
   return lines.join('\n');