@eir-labs/coltrane 0.10.0 → 0.11.0

package/dist/src/runtime.js

@@ -3,6 +3,7 @@
 // writes each typed output to the store (validated), links provenance (derived_from),
 // and records one ledger entry with a deterministic genome_hash + a run_fingerprint
 // that carries model_version + (empty, v0) eval_scores — honestly un-tempered.
+import { lineageAdoption } from "./lineage_adoption.js";
 import { randomUUID } from "node:crypto";
 import { PRIMITIVE_OUTPUT_TYPE, CORE_TYPES } from "./core_types.js";
 import { executeSkillAsync } from "./skill_subprocess.js";
@@ -21,6 +22,7 @@ import { resolveAndRealize } from "./venue_realize.js";
 export const CORE_TO_PRIMITIVE = Object.fromEntries(Object.entries(PRIMITIVE_OUTPUT_TYPE).map(([prim, core]) => [String(core), prim]));
 import { sha256Hex, canonJson, canonStructuralJson, runFingerprint, outputContentHash, CANONICAL_FORM_VERSION } from "./canonical_form.js";
 import { producersSha, reuseCacheKey, checkReuseEntry, runIdentityMismatch, checkpointRoleKey, CHECKPOINT_SCHEMA_VERSION, REUSE_SCHEMA_VERSION, } from "./reuse.js";
+import { checkGigConformance } from "./gig_conformance.js";
 import { drainGigHeader } from "./output_mirror.js";
 import { LEDGER_SCHEMA_VERSION } from "./ledger.js";
 import { COLTRANE_VERSION } from "./version.js";
@@ -289,11 +291,24 @@ export async function runGig(standard, gigInput, deps) {
     // construction, and torn down at each chair's lifecycle end.
     let gigRealization;
     let gigVenue;
+    // The SUBSTRATE half of the wire. The policy realization above CONFINES a venue-named gig — it
+    // intersects the tool ceiling and refuses a breach — but stands up no room. Without this the
+    // container substrate (src/venue_realizer.ts) was unreachable from dispatch: a venue-named gig got
+    // NO ROOM, only paper confinement. When the resolved venue declares mcp_servers AND a realizer is
+    // wired, the substrate is realized here, ONCE, before any chair — and torn down beside the policy
+    // layer in the finally block below.
+    let gigSubstrate;
     if (deps.venue !== undefined) {
         const realization = resolveAndRealize(deps.venue, {
             venues: new Map(deps.venues ?? []),
             seats: standard.agents.map((agent) => ({ agent })),
-            ambientEnv: {},
+            // The ambient container environment realize() filters to each seat's allowlisted env
+            // (SEAT_ENV_ALLOWLIST — PATH/HOME). Passing `{}` here was the other half of the ENOENT
+            // measured on gig 87cffa2c: even a correct allowlist has nothing to admit when the caller
+            // feeds it an empty env, so every venue-confined seat spawned with no PATH and died. The
+            // allowlist is what makes handing realize() the whole process.env safe — it carries PATH/HOME
+            // through and drops every credential (COLTRANE_DRAIN_KEY et al.), never inheriting wholesale.
+            ambientEnv: process.env,
             ...(deps.credentialsPresent ? { credentialsPresent: deps.credentialsPresent } : {}),
             gigId: gig_id,
         });
@@ -303,6 +318,33 @@ export async function runGig(standard, gigInput, deps) {
         gigRealization = realization;
         // realize() only returns ok once the slug resolved, so the venue is present in the map.
         gigVenue = deps.venues?.get(deps.venue);
+        // Realize the SUBSTRATE when the venue declares servers to stand up OR the RUN names a repository
+        // to populate the room's tree with — either is a reason to build a real room. A venue with NEITHER
+        // has nothing to stand up (the empty room stays free), and an absent realizer is the opt-out that
+        // keeps every pre-wire caller byte-identical. realize() tolerates an empty mcp_servers list (its
+        // credential/compose steps iterate the servers as no-ops — the existing repo_url-declines law
+        // exercises exactly this, mcp_servers: [], and gets a handle back), so a repository-only run
+        // reaches it without an empty services list becoming fatal. credentialResolver defaults to an
+        // empty async resolver — realize() takes it as a required positional, so undefined would throw at
+        // credential-resolution time; the empty default satisfies the interface without a new mandatory
+        // field. A bring-up failure propagates like a policy refusal: no chair spawns.
+        //
+        // The repository is `deps.repoUrl` — named by the RUN, explicit at dispatch. The per-gig git
+        // credential plumbing (drainKey/instance/endpoint) is READ FROM THE AMBIENT ENVIRONMENT here, the
+        // same discipline src/workspace.ts documents: the SUBJECT of work must be explicit, but the
+        // credential that clones it is ambient plumbing, never a per-repository fact. Absent env → the
+        // populate declines on its own terms (prepareWorkspace names what it could not obtain).
+        if (deps.venueRealizer && gigVenue && (gigVenue.mcp_servers.length > 0 || deps.repoUrl)) {
+            gigSubstrate = await deps.venueRealizer.realize(gigVenue, deps.credentialResolver ?? (async () => ({})), {
+                gigId: gig_id,
+                ...(deps.repoUrl ? { repoUrl: deps.repoUrl } : {}),
+                ...(process.env["COLTRANE_DRAIN_KEY"] ? { drainKey: process.env["COLTRANE_DRAIN_KEY"] } : {}),
+                ...(process.env["COLTRANE_INSTANCE"] ? { instance: process.env["COLTRANE_INSTANCE"] } : {}),
+                ...(process.env["COLTRANE_GIT_CREDENTIALS_URL"]
+                    ? { gitCredentialsEndpoint: process.env["COLTRANE_GIT_CREDENTIALS_URL"] }
+                    : {}),
+            });
+        }
     }
     // Hash the gig input LAZILY. Three callers want it now (#196's provenance backfill, the
     // resume identity, and the reuse key) but a hostile or circular payload must not be
@@ -702,23 +744,94 @@ export async function runGig(standard, gigInput, deps) {
         // THE GATE. A resume into a moved genome would have chairs from genome B consuming sealed
         // outputs from genome A, and nothing in input_shas / genome_hash / run_fingerprint would
         // record that it happened — the manifest would describe a system that never existed.
-        const drift = runIdentityMismatch(cp.identity, identity());
+        //
+        // SCOPED RELAXATION (gig ce902971): producers_sha — the fold of every producing agent's
+        // definition — is NOT a resume gate when every chair still to run is human. Those producers
+        // already produced; their sealed, hashed outputs cannot change under a definition edit, and a
+        // producing agent's definition cannot change what a PERSON is being asked to decide. Without
+        // this, a parked gig becomes permanently unapprovable the moment any agent definition moves
+        // after it parks. This is the ONLY relaxation and its ONLY justification is 'this input cannot
+        // affect what remains to run': every other identity field still gates, and producers_sha
+        // itself still gates the moment ANY remaining chair is a model chair. The remaining-chair set
+        // is derived synchronously from data already in scope (cp.roles, standard.phases), so the gate
+        // still fires before the first await.
+        //
+        // The predicate is two-valued — a chair is human or it is a model chair. If a future
+        // non-human, agent-less chair type is introduced it MUST be re-examined here: it must not
+        // silently inherit this waiver.
+        const sealedRoles = new Set(cp.roles.map((r) => r.role));
+        const remainingChairs = standard.phases.flatMap((p) => p.chairs).filter((c) => !sealedRoles.has(c.role));
+        const allRemainingHuman = remainingChairs.length > 0 &&
+            remainingChairs.every((c) => c.human === true && (c.agent_slug ?? "") === "");
+        // #19 — an OMITTED --depth is not a DISAGREEMENT. When the operator states no depth,
+        // `deps.depth` is undefined and identity() resolves it to "" — collapsing "I did not say"
+        // and "I said something different" into one value that then reads as a mismatch against a
+        // checkpoint written with a stated depth. The checkpoint already records its depth (a
+        // first-class run-identity field), so an unstated depth INHERITS it: substitute the
+        // checkpoint's depth as the effective comparison value ONLY when deps.depth is undefined.
+        // An EXPLICIT depth still compares as-is, so a skim resume of a deep checkpoint still
+        // refuses (#237: depth shapes what the model is asked for; a skim half stitched to a deep
+        // half is a real defect). This never MANUFACTURES a false mismatch and it is NOT a waiver
+        // of a stated one — see the note beside the 'never waived' rule in src/reuse.ts. identity()
+        // stays a pure function of deps, so `cur = identity()` below and every non-comparison use
+        // still see the operator's actual (undefined→"") depth.
+        // #20 — an OMITTED --input is no more a DISAGREEMENT than an omitted --depth, and the same
+        // omission-vs-conflict distinction applies. A checkpoint stores ONLY identity.gig_input_sha —
+        // a hash of the canonical dispatch payload — and NEVER the payload itself (see src/reuse.ts,
+        // RunIdentity.gig_input_sha), so the omitted payload cannot be "recovered from the checkpoint";
+        // it is INHERITED. The producers already consumed the input and sealed their hashed outputs, so
+        // when every remaining chair is human — approving already-sealed work it does not read — an
+        // unstated --input inherits the checkpoint's recorded gig_input_sha. A SUPPLIED value is never
+        // substituted (deps.gig_input_omitted is false), so a disagreeing --input still drives a
+        // refusal; and while any remaining chair is a MODEL chair (allRemainingHuman false) the payload
+        // is exactly what that chair will consume, so gig_input_sha keeps gating unchanged. identity()
+        // itself stays untouched, so `cur = identity()` below and every checkpoint write still see the
+        // operator's actual (omitted→{}) payload hash — the substitution is only the comparison value.
+        const current = identity();
+        const inheritDepth = deps.depth === undefined;
+        const inheritGigInput = allRemainingHuman && deps.gig_input_omitted === true;
+        const currentForGate = {
+            ...current,
+            ...(inheritDepth ? { depth: cp.identity.depth } : {}),
+            ...(inheritGigInput ? { gig_input_sha: cp.identity.gig_input_sha } : {}),
+        };
+        const drift = runIdentityMismatch(cp.identity, currentForGate, { waiveProducers: allRemainingHuman });
         if (drift.length > 0) {
             // DIAGNOSTIC HONESTY, not a widened resume. The genome genuinely moved, so the refusal
-            // stands — but the operator's real fix is "resume from the build that wrote this", and
-            // nothing told them which build that was. `engine_version` (stamped by every build since
-            // this landed) names it; a checkpoint from before this field says so plainly rather than
-            // crash. Lead with the version + the action; the raw before/after hashes still ride in
+            // stands — but the refusal must send the operator to the thing that ACTUALLY changed, not
+            // to a guess. When the producing and current engine versions DIFFER, "resume from the build
+            // that wrote this" is that thing, and `engine_version` names it. When they are IDENTICAL the
+            // old prose ("resume from a <version> build") named a version that already matched — sending
+            // the reader to verify a correct build before they reached the drift bracket. So when the
+            // versions agree, name the fields that drifted instead, drawn from the SAME `drift` list that
+            // refused (never a second, re-derived one). The raw before/after hashes always ride in
             // `drift` for a builder who wants them.
             const cur = identity();
-            const wroteBy = cp.engine_version
-                ? `coltrane ${cp.engine_version}`
-                : "an earlier build (engine version unrecorded)";
-            const resumeAction = cp.engine_version
-                ? `Resume from a ${cp.engine_version} build, or re-dispatch cold`
-                : "Resume from the matching build, or re-dispatch cold";
-            throw new ResumeRefused(gig_id, `this checkpoint was written by ${wroteBy} (genome_hash ${cp.identity.genome_hash}); ` +
-                `the current build is coltrane ${COLTRANE_VERSION} (genome_hash ${cur.genome_hash}). ${resumeAction}`, drift);
+            // Each drift entry reads `<field>: checkpoint="..." current="..."` — the field is the token
+            // before the first ':'. This is the authoritative list `runIdentityMismatch` already returned;
+            // it is formatted here, never recomputed, so prose and refusal answer to one computation.
+            const driftedFields = drift.map((d) => d.slice(0, d.indexOf(":")));
+            let why;
+            if (cp.engine_version === COLTRANE_VERSION) {
+                why =
+                    `this checkpoint and the current build are both coltrane ${COLTRANE_VERSION}, but the run ` +
+                        `identity moved under that same version: ${driftedFields.join(", ")} changed since the ` +
+                        `checkpoint was written (raw before/after values below). Re-dispatch cold, or restore the ` +
+                        `prior ${driftedFields.join("/")} to resume`;
+            }
+            else if (cp.engine_version) {
+                why =
+                    `this checkpoint was written by coltrane ${cp.engine_version} (genome_hash ${cp.identity.genome_hash}); ` +
+                        `the current build is coltrane ${COLTRANE_VERSION} (genome_hash ${cur.genome_hash}). ` +
+                        `Resume from a ${cp.engine_version} build, or re-dispatch cold`;
+            }
+            else {
+                why =
+                    `this checkpoint was written by an earlier build (engine version unrecorded) ` +
+                        `(genome_hash ${cp.identity.genome_hash}); the current build is coltrane ${COLTRANE_VERSION} ` +
+                        `(genome_hash ${cur.genome_hash}). Resume from the matching build, or re-dispatch cold`;
+            }
+            throw new ResumeRefused(gig_id, why, drift);
         }
         const rolesInStandard = new Set(standard.phases.flatMap((p) => p.chairs.map((c) => c.role)));
         for (const r of cp.roles) {
@@ -945,6 +1058,48 @@ export async function runGig(standard, gigInput, deps) {
                         type: "chair_complete", phase: phase.name, role: hc.role, producer: deps.approved_by ?? "human",
                         output_types: [domain_type], duration_ms: Date.now() - t0,
                     });
+                    // A sealed lineage-verdict either grounds an institution or does not. Decide it here,
+                    // where the verdict and the record it approved are both in hand, and report the answer
+                    // either way. The record the verdict targets IS the input it approved — the same set
+                    // already sealed into this output's input_shas — so no lookup is invented.
+                    if (domain_type === "lineage-verdict") {
+                        const target = approvalInputs.find((i) => i.domain_type === "lineage-record") ?? approvalInputs[0];
+                        // An ENTRY human chair (depends_on []) has no upstream outputs — the record it approves
+                        // arrived in the dispatch payload. lineage-adopt-v0 is exactly that shape, and exists to
+                        // be: a record composed by any standard can be brought to a seat without re-running the
+                        // work that made it. Reading only from approvalInputs made the adoption blind to every
+                        // record seeded that way, which is every record that standard will ever see.
+                        //
+                        // Found by running it, not by testing it: five integration tests passed because all of
+                        // them seated the human chair downstream of a compose phase. They encoded the assumption
+                        // instead of testing it.
+                        //
+                        // The payload record carries no content_sha — it has not been sealed by THIS gig — so the
+                        // reference falls back to its id. LineageRecordRefSchema admits exactly this: record_ref
+                        // is "content_sha (OR SLUG) of the sealed lineage-record". Prefer the sha when a real
+                        // upstream output exists; use the slug when the record came in from outside.
+                        const seeded = gigInput["lineage-record"];
+                        const seededId = typeof seeded?.["id"] === "string" ? seeded["id"] : "";
+                        // WHICH institution this grounds. Carried by lineage-adoption-target in the payload,
+                        // because the attachment is a property of the adoption ACT — one record, approved once,
+                        // may be adopted into two institutions by two separate acts. Neither the record nor the
+                        // verdict holds it, and both promise the attachment in prose.
+                        const tgt = gigInput["lineage-adoption-target"];
+                        const institution_slug = typeof tgt?.["institution_slug"] === "string" ? tgt["institution_slug"] : "";
+                        const decision = lineageAdoption({
+                            verdict: (approval ?? null),
+                            record_ref: target?.content_sha ?? seededId,
+                            sealed_at: rec.created_at,
+                            institution_slug,
+                        });
+                        emit({
+                            type: "lineage_adoption", phase: phase.name, role: hc.role,
+                            adopt: decision.adopt,
+                            ...(decision.ref ? { record_ref: decision.ref.record_ref, approved_by: decision.ref.approved_by ?? "" } : {}),
+                            ...(decision.institution_slug ? { institution_slug: decision.institution_slug } : {}),
+                            ...(decision.refusals.length ? { refusals: decision.refusals.map((r) => r.reason) } : {}),
+                        });
+                    }
                 }
                 ready = ready.filter((c) => !(c.human === true && (c.agent_slug ?? "") === ""));
                 if (ready.length === 0)
@@ -1175,7 +1330,13 @@ export async function runGig(standard, gigInput, deps) {
                 const sha = outputContentHash({
                     core_type: spec.core_type,
                     domain_type: o.domain_type,
-                    domain_type_version: 1,
+                    // The version the loaded genome's type carries now, re-derived through the ONE owner
+                    // (typeVersionOf) rather than a constant — so the re-hash reproduces the pre-image the
+                    // original seal folded. NOTE (accepted point-in-time exposure, bill-change-plan step 5):
+                    // this is the CURRENT version; a cached output whose type was extended since it sealed
+                    // would re-hash under the newer version and be refused as stale. Point-in-time version
+                    // tracking is out of scope for this change.
+                    domain_type_version: deps.outputs.typeVersionOf(o.domain_type),
                     domain: a.domain,
                     primitive: spec.primitive,
                     phase: a.phaseName,
@@ -1460,11 +1621,18 @@ export async function runGig(standard, gigInput, deps) {
                 settleChairCost(p, false);
                 throw e;
             }
-            finally {
-                // Venue → dispatch wire: tear the room down at the chair lifecycle end. `teardown()` is
-                // idempotent and a no-op when no venue was named, so a venue-less gig is unaffected.
-                gigRealization?.teardown();
-            }
+            // THE ROOM IS NOT TORN DOWN HERE. It used to be, in this chair-level `finally`, described as
+            // "idempotent and a no-op when no venue was named". Idempotent yes; a no-op no —
+            // `src/venue_realize.ts` sets `torn = true`, and `canReach()` is `!torn && egress.includes(...)`.
+            // So the FIRST chair to finish closed the room's egress probe for every chair after it, and a
+            // multi-chair phase ran the rest of its seats against a room already reported torn down.
+            //
+            // It was invisible because nothing in the run path consults `canReach` today, and because the
+            // policy realization's teardown costs nothing. Neither excuse survives a realizer that does real
+            // work: a container torn down after chair one is gone for chair two.
+            //
+            // A room's lifetime is the GIG's, not a chair's. Teardown now runs once, at the gig boundary,
+            // on both the success and failure paths — see the `finally` on runGig's outer try.
         }
         async function executeChair(p) {
             const { chair, phaseName, inputs, skills, output_specs, producer_slug, domain } = p;
@@ -1593,6 +1761,15 @@ export async function runGig(standard, gigInput, deps) {
                         // venue resolved, so the invoker narrows the spawn by construction; both fields stay
                         // absent otherwise (the venue-less path is unchanged).
                         ...(gigRealization && gigVenue ? { realization: gigRealization, venue: gigVenue } : {}),
+                        // The substrate → spawn wire: when the room was actually stood up, hand the chair the
+                        // realized transports (docker-exec stdio configs) so the invoker points the spawn at the
+                        // servers INSIDE the room. Absent otherwise — the substrate-less path is unchanged.
+                        ...(gigSubstrate ? { substrateMcpConfigs: gigSubstrate.mcpServerConfigs } : {}),
+                        // The seat → spawn wire: when the substrate stood up a SEAT-BEARING room (a floor image
+                        // carrying the toolchain), hand the chair the room's workspace + container so the invoker
+                        // runs the seat INSIDE the room with the workspace as cwd. Absent when the room is the
+                        // production-only room image (no seat runs there) — the host-spawn path is unchanged.
+                        ...(gigSubstrate?.seat ? { seatExec: gigSubstrate.seat } : {}),
                         onEvent: (ev) => {
                             sink.fold(ev);
                             emit({ type: "agent_event", phase: phaseName, role: chair.role, event: ev });
@@ -1765,13 +1942,21 @@ export async function runGig(standard, gigInput, deps) {
             const resolved = [];
             for (const spec of output_specs) {
                 const keyed = data[spec.domain_type];
-                const slice = keyed !== undefined && keyed !== null ? keyed : single ? data : undefined;
-                if (slice === undefined || slice === null)
+                const raw = keyed !== undefined && keyed !== null ? keyed : single ? data : undefined;
+                if (raw === undefined || raw === null)
                     continue;
-                if (typeof slice !== "object" || slice === null) {
-                    throw new RuntimeError(`chair "${chair.role}" output "${spec.domain_type}" must be a JSON object, got ${typeof slice}`);
+                // MULTI-RECORD SEAL. captureOutputWrites hands the runtime a LIST of records per declared type
+                // — a chair may seal MANY records of one type (gig 8baced9d's lineage scout made 15 accepted
+                // output_write calls; the old last-wins collapse sealed 1). An ARRAY here is that list, and the
+                // loop seals one record per element. A bare object is one record — the skill-backed path and
+                // the single-output fallback still hand a plain object, so single-seal chairs are untouched.
+                const slices = Array.isArray(raw) ? raw : [raw];
+                for (const slice of slices) {
+                    if (typeof slice !== "object" || slice === null || Array.isArray(slice)) {
+                        throw new RuntimeError(`chair "${chair.role}" output "${spec.domain_type}" must be a JSON object, got ${Array.isArray(slice) ? "array" : slice === null ? "null" : typeof slice}`);
+                    }
+                    resolved.push({ spec, slice: slice });
                 }
-                resolved.push({ spec, slice: slice });
             }
             // backfillShas refuses an ambiguous provenance field. Run it over EVERY slice up front so
             // that throw also lands before the first write, rather than midway through them.
@@ -1838,6 +2023,10 @@ export async function runGig(standard, gigInput, deps) {
                 const rec = deps.outputs.write({
                     core_type: spec.core_type,
                     domain_type: spec.domain_type,
+                    // Stamp the REAL version the type carries at seal time, read through the ONE owner. Omitting
+                    // it let outputs.write default to 1, so a record sealed against a v3 type claimed v1 — inside
+                    // its content_sha pre-image, which is the record's identity.
+                    domain_type_version: deps.outputs.typeVersionOf(spec.domain_type),
                     domain,
                     gig_id,
                     agent_slug: producer_slug,
@@ -2024,6 +2213,10 @@ export async function runGig(standard, gigInput, deps) {
             result.unresolved_evals = unresolved_evals;
         if (unfulfilledOutputs.length > 0)
             result.unfulfilled_outputs = unfulfilledOutputs;
+        // The gig-close conformance classification — computed over the SETTLED produced[] (every amend
+        // round resolved, every reuse/resume row folded in) so it grades the run as it finally stands.
+        // Attached beside run_fingerprint, never folded into it and never sealed back into the gig.
+        result.conformance = checkGigConformance(standard, produced, skipped, "complete", gig_id);
         // Say what was skipped and why. The ABSENCE of these fields is itself a claim — that every
         // chair in this manifest ran — so they are present only when there is something to report,
         // and `reuse` is present whenever the cache was wired even if nothing hit (a zero-hit run is
@@ -2075,6 +2268,42 @@ export async function runGig(standard, gigInput, deps) {
         });
         throw e;
     }
+    finally {
+        // ONE ROOM, ONE GIG, ONE TEARDOWN — on both paths. A room outlives every chair that sits in it
+        // and dies with the run, which is what `lifecycle: ephemeral` means and what the chair-level
+        // teardown this replaces could not express.
+        //
+        // AWAITED, because a realizer that stands up real resources returns a promise: the interface
+        // already declares `Promise<void> | void`, and an unawaited teardown on the failure path means a
+        // process can exit with a container still running. A leak on the path that is ALREADY going
+        // badly is the worst place to have one.
+        //
+        // Best-effort by construction: a teardown that throws must not replace the gig's own outcome —
+        // a failed teardown after a successful run would turn a good gig into a bad one, and after a
+        // failed run would hide the real error behind a cleanup error. What it must never do is pass
+        // silently, so it is reported on the drain-debug channel like every other best-effort seam here.
+        try {
+            await gigRealization?.teardown();
+        }
+        catch (te) {
+            if (process.env["COLTRANE_DRAIN_DEBUG"]) {
+                console.error(`[venue] teardown failed for gig ${gig_id}: ${te instanceof Error ? te.message : String(te)}`);
+            }
+        }
+        // BOTH LAYERS ARE TORN DOWN, INDEPENDENTLY. The substrate handle (a real compose project, for the
+        // container realizer) gets its OWN try/catch, NOT the policy teardown's: a shared one would let a
+        // throwing substrate teardown skip the policy teardown (or vice versa), and a room that outlives
+        // its gig is the leak this wire exists to close. Best-effort like the policy teardown — a throw
+        // here must not replace the gig's outcome, only surface on the drain-debug channel.
+        try {
+            await gigSubstrate?.teardown();
+        }
+        catch (te) {
+            if (process.env["COLTRANE_DRAIN_DEBUG"]) {
+                console.error(`[venue] substrate teardown failed for gig ${gig_id}: ${te instanceof Error ? te.message : String(te)}`);
+            }
+        }
+    }
 }
 // v0 eval-scorer: a minimal scan over the produced outputs. The named eval is
 // looked up by slug (no shared genome handle in the runtime today), so we use