@humwick/server 0.130.1 → 0.130.3

package/node_modules/@humwick/kernel/workflow-script.ts

@@ -1,11 +0,0 @@
-import { z } from "zod";
-
-// Optional fields preserve the shape of runs created before script steps (#3271).
-export const workflowScriptPollSchema = z.object({ step: z.string(), attempt: z.number().int(), deadline: z.number().int(), nextAt: z.number().int() });
-export const workflowScriptResultSchema = z.object({
-  step: z.string(), round: z.number().int(), attempt: z.number().int(), timerId: z.string(),
-  exitCode: z.number().int().nullable(), timedOut: z.boolean(), logArtifactId: z.string().optional(),
-  error: z.record(z.string(), z.unknown()).optional(),
-  output: z.record(z.string(), z.unknown()).optional(), at: z.number().int(),
-});
-export const workflowScriptAttemptSchema = workflowScriptResultSchema.extend({ id: z.string(), runId: z.string() });

package/node_modules/@humwick/kernel/workflow-state.ts

@@ -1,299 +0,0 @@
-import { z } from "zod";
-import { workflowActivationSchema, workflowSnapshotSchema, workflowBudgetSchema, workflowReservationSchema } from "./workflow-activation";
-import { laneStores } from "./workflow-lane";
-
-import { workflowScriptAttemptSchema, workflowScriptPollSchema } from "./workflow-script";
-import { type EntityStore, type ModuleCtx, OpError } from "./contract";
-import { WORKFLOW_REAP_POLICIES, workflowAppliedPinSchema, workflowCallPinSchema, workflowDefinitionSchema, workflowRoutingDefaultsSchema } from "./workflow-definition";
-
-/**
- * #3045 — declarative multi-agent workflows on the K7 workflow runtime. One durable `run` per
- * started workflow walks the declared steps: entering a step writes an EFFECT intent and parks on a
- * wait; the src supervisor performs the effect (dispatch a role, message the builder, clear the
- * hold, reap step agents) and SIGNALS the wait from durable src facts (a Task delivery, a land). Routing happens in
- * the `route` step, so each decision commits exactly once with the run record and the next effect.
- * The kernel never imports src: effects and signals are the whole seam (the outbox shape).
- */
-
-export const SIGNAL_TOPIC = "workflow.signaled" as const;
-/** #3120 — the SDK's PROJECT_FILE_SOURCES (the kernel does not import the SDK; the src start call type-checks against it). */
-export const WORKFLOW_SOURCES = ["bundled", "project", "project-overrides-bundled"] as const;
-export const ADMIN_GRANT = "workflow:admin" as const;
-export const RUN_STATUSES = ["running", "escalated", "done", "cancelled", "failed"] as const;
-export const EFFECT_KINDS = ["started", "dispatch", "script", "decision", "withdraw-decision", "child", "cancel-children", "cancel-agent-tree", "findings", "clear-hold", "hold", "escalate", "result", "reap", "close", "landed"] as const;
-export const allocationSchema = z.object({ id: z.string(), value: z.number().int() });
-export const admissionSchema = z.object({ id: z.string(), cursor: z.string().optional() });
-export const json = z.record(z.string(), z.unknown());
-
-export const awaitingSchema = z.object({
-  /** The wait's correlation id: one signal satisfies exactly one wait. */
-  key: z.string(),
-  kind: z.enum(["delivery", "landed", "ci", "script", "closed", "child", "cleanup", "for-each", "decision"]),
-  /** The Task whose delivery (or land) ends the wait; absent until the effect that creates it settles. */
-  taskId: z.number().int().optional(),
-  effectId: z.string().optional(),
-  /** A `ci` wait: the landed commit whose CI on main ends it. */
-  sha: z.string().optional(),
-  /** Only a delivery event after this id, recorded at or after `since`, counts. */
-  afterEventId: z.number().int(),
-  since: z.number().int(),
-  /** When the wait escalates once for making no progress; absent on a wait entered before #3045 H1. */
-  deadline: z.number().int().optional(),
-  timedOutAt: z.number().int().optional(),
-});
-
-export const stepEntrySchema = z.object({
-  step: z.string(),
-  taskId: z.number().int(),
-  outcome: z.string(),
-  head: z.string().optional(),
-  summary: z.string().optional(),
-  findings: z.string().optional(),
-  /** When the step's wait began and when its delivery was routed (#3076 step durations); absent on older entries. */
-  startedAt: z.number().int().optional(),
-  at: z.number().int().optional(),
-});
-
-/** A coordinator's answer to one escalation (#3045 H2): where the run went on, and the note for that step's agent. */
-export const resumeSchema = z.object({
-  escalation: z.string(), from: z.string(), step: z.string(), round: z.number().int(), note: z.string().optional(), by: z.string(), at: z.number().int(),
-});
-
-/** CI on main after the land (#3045 H5): `pass`, `fail` (red at the deadline, after one escalation), or `none`
- *  (no CI watch, or no verdict before the deadline). `sha` is the commit the verdict was read at. */
-export const ciVerdictSchema = z.object({
-  status: z.enum(["pass", "fail", "none"]), sha: z.string().optional(), workflows: z.array(z.string()).optional(), url: z.string().optional(), note: z.string().optional(),
-});
-
-export const runSchema = z.object({
-  id: z.string(),
-  workflow: z.string(),
-  ref: z.string(),
-  sha: z.string(),
-  /** #3120 — the workflow file's origin; absent on runs started before it was recorded. */
-  source: z.enum(WORKFLOW_SOURCES).optional(),
-  taskId: z.number().int(),
-  /** The agent that started the run; it receives the escalation or the result. */
-  coordinator: z.string(),
-  callerAgentId: z.string().optional(),
-  maxLiveAgents: z.number().int().min(1).optional(),
-  tokenBudget: z.object({ tokenCap: z.number().int().positive().max(Number.MAX_SAFE_INTEGER) }).optional(),
-  cwd: z.string(),
-  orchestratorId: z.string(),
-  definition: workflowDefinitionSchema,
-  inputs: json.optional(), outputs: json.optional(), results: z.record(z.string(), json).optional(),
-  parentRunId: z.string().optional(), parentActivationId: z.string().optional(), rootRunId: z.string().optional(), depth: z.number().int().optional(),
-  activationId: z.string().optional(), generation: z.number().int().optional(), requestKey: z.string().optional(),
-  itemContext: z.object({ item: z.unknown(), index: z.number().int() }).optional(),
-  snapshot: workflowSnapshotSchema.optional(), snapshotDigest: z.string().optional(), budget: workflowBudgetSchema.optional(),
-  limits: z.record(z.string(), z.number().int()).optional(),
-  finalizing: json.optional(),
-  cleanup: z.object({ status: z.enum(["pending", "complete", "incomplete"]), deadline: z.number().int(), error: z.string().optional() }).optional(),
-  childCount: z.number().int().optional(), decisionChildRunId: z.string().optional(),
-
-  scriptPoll: workflowScriptPollSchema.optional(),
-  scriptOutputs: z.record(z.string(), z.record(z.string(), z.unknown())).optional(),
-  /** #3121 — the coordinator's per-step pins (start call, replaced per step by a resume); they win over the YAML step's. */
-  pins: z.record(z.string(), workflowCallPinSchema).optional(),
-  routingDefaults: workflowRoutingDefaultsSchema.optional(),
-  status: z.enum(RUN_STATUSES),
-  /** A declared step, or `land`. */
-  step: z.string(),
-  round: z.number().int(),
-  entered: z.array(z.string()),
-  counters: z.record(z.string(), z.number().int()),
-  waitSeq: z.number().int(),
-  awaiting: awaitingSchema.nullable(),
-  overdueAt: z.number().int().optional(),
-  overdueSince: z.number().int().optional(),
-  overdueNotifiedAt: z.number().int().optional(),
-  /** The last input-Task delivery event the run consumed. */
-  cursor: z.number().int(),
-  /** The input Task's latest delivered head. */
-  head: z.string().optional(),
-  deliveryWorkspaceId: z.string().optional(),
-  landOperationId: z.string().optional(),
-  /** What a loop back hands the input step's builder. */
-  feedback: z.object({ head: z.string().optional(), findings: z.string(), taskId: z.number().int(), step: z.string() }).nullable(),
-  rounds: z.array(z.object({ round: z.number().int(), steps: z.array(stepEntrySchema) })),
-  reason: z.string().optional(),
-  /** The newest escalation the coordinator was sent; a resume answers each one once. An alert names its
-   *  wait, and goes stale once the run moves past it. */
-  escalation: z.object({ id: z.string(), at: z.number().int(), waitKey: z.string().optional() }).optional(),
-  resumes: z.array(resumeSchema).optional(),
-  /** Set by a resume and consumed by the next step entry, whose effect carries the note to the step's agent.
-   *  `to`: the step a run leaves its land wait for, once the Task is held again. */
-  resuming: z.object({ note: z.string().optional(), to: z.string().optional() }).optional(),
-  /** #3166 — who asked the run to end cancelled; the next routing or step entry ends it. */
-  cancel: z.object({ reason: z.string(), by: z.string(), at: z.number().int() }).optional(),
-  /** The land, once it happened; a `ci-main` step reads CI on this commit. */
-  landed: z.object({ sha: z.string(), at: z.number().int(), nothingToLand: z.boolean().optional(), ci: ciVerdictSchema.optional() }).optional(),
-  /** `nothingToLand`: the reviewed head was already on its base (#3103), so no land ran and `landedSha` is where main carries it. */
-  output: z.object({ landedSha: z.string().optional(), rounds: z.number().int().optional(), nothingToLand: z.boolean().optional(), ci: ciVerdictSchema.optional() }).catchall(z.unknown()).optional(),
-  createdAt: z.number().int(),
-  updatedAt: z.number().int(),
-});
-
-export const effectSchema = z.object({
-  /** `<runId>:<seq>:<kind>` — also the idempotency root of the src side effect. */
-  id: z.string(),
-  runId: z.string(),
-  kind: z.enum(EFFECT_KINDS),
-  /** The wait a failed effect satisfies, so the run escalates instead of waiting forever. */
-  waitKey: z.string().optional(),
-  payload: json,
-  status: z.enum(["pending", "deferred", "done", "failed"]),
-  attempts: z.number().int(),
-  error: z.string().optional(),
-  result: json.optional(),
-  createdAt: z.number().int(),
-  settledAt: z.number().int().optional(),
-});
-
-export const signalSchema = z.object({
-  id: z.string(),
-  runId: z.string(),
-  /** `land-cancelled`: the armed land's workspace was abandoned. `land-withdrawn`: the armed land was withdrawn, by the coordinator (#3603) or on an unresolved conflict handed back to its owner (#2704).
-   *  `resume`: the coordinator moved the run on.
-   *  `start-refused`: the spawn call that started the run failed with its first dispatch's error (#3160).
-   *  `cancel`: wakes a wait for the run's cancel (#3166). `agent-exited`: the step's agent exited without a delivery. */
-  kind: z.enum(["delivery", "script", "landed", "land-cancelled", "land-withdrawn", "effect-failed", "resume", "ci", "start-refused", "cancel", "agent-exited", "closed", "child", "cleanup", "for-each", "decision"]),
-  payload: json,
-  createdAt: z.number().int(),
-});
-
-/** One agent a step spawned, keyed by its first spawnRequestId. Its lifecycle is the run's record, not a
- *  coordinator wake (#3045); `reap` is the step's policy, copied when the spawn settles. A restart's
- *  successor rebinds the row (same agentId, new `spawnRequestId`), so facts and reap follow the live generation. */
-export const crossProviderSchema = z.object({ step: z.string(), avoided: z.string(), fallback: z.boolean(), reason: z.string().optional() });
-
-export const agentSchema = z.object({
-  id: z.string(),
-  /** The current generation's spawnRequestId. */
-  spawnRequestId: z.string(),
-  reservationId: z.string().optional(),
-  runId: z.string(),
-  step: z.string(),
-  round: z.number().int(),
-  taskId: z.number().int(),
-  reap: z.enum(WORKFLOW_REAP_POLICIES),
-  agentId: z.string().optional(),
-  readyAt: z.number().int().optional(),
-  spawnFailedAt: z.number().int().optional(),
-  spawnError: z.string().optional(),
-  exitedAt: z.number().int().optional(),
-  exitReason: z.string().optional(),
-  reapedAt: z.number().int().optional(),
-  /** The reap refused to shut it down (unlanded work, or not a stoppable target): it stays alive, and why. */
-  keptAt: z.number().int().optional(),
-  keptReason: z.string().optional(),
-  /** The provider the spawn resolved (#3105). */
-  provider: z.string().optional(),
-  /** #3105 — the step's `crossProvider` preference: the provider it avoided and, when no other one was available, why it ran on that one anyway. */
-  crossProvider: crossProviderSchema.optional(),
-  /** #3121 — the pin its dispatch applied, with each field's source. */
-  pin: workflowAppliedPinSchema.optional(),
-  routingSources: z.record(z.string(), z.string()).optional(),
-  warnings: z.array(z.string()).optional(),
-  createdAt: z.number().int(),
-});
-
-export const FACT_FIELD = { "spawn-failed": "spawnFailedAt", ready: "readyAt", exited: "exitedAt", reaped: "reapedAt", kept: "keptAt" } as const;
-
-/** Which run routes a Task's deliveries (the input Task and every Task a step created), and the
- *  step's verdict gate: on that Task the gate is the answer, not a land check. */
-export const linkSchema = z.object({ id: z.string(), taskId: z.number().int(), runId: z.string(), gate: z.string().optional(), activationId: z.string().optional() });
-
-export type WorkflowRunRecord = z.output<typeof runSchema>;
-export type WorkflowEffect = z.output<typeof effectSchema>;
-export type WorkflowSignal = z.output<typeof signalSchema>;
-export type WorkflowAgent = z.output<typeof agentSchema>;
-export type WorkflowCiVerdict = z.output<typeof ciVerdictSchema>;
-export type Awaiting = z.output<typeof awaitingSchema>;
-
-function runEndsAgentWork(run: WorkflowRunRecord): boolean {
-  return Boolean(run.landed || run.finalizing || run.cancel || run.status === "done" || run.status === "cancelled");
-}
-
-/** Completion and cancellation own shutdown regardless of definition version or step keep policy. */
-export function workflowOwnsAgentCleanup(run: WorkflowRunRecord): boolean {
-  return Boolean(run.rootRunId || run.callerAgentId || runEndsAgentWork(run));
-}
-
-export function workflowReapIncludesAgent(run: WorkflowRunRecord, payload: WorkflowEffect["payload"], agent: WorkflowAgent): boolean {
-  return payload.scope === "step" ? agent.step === payload.step : runEndsAgentWork(run) || agent.reap !== "never";
-}
-
-export interface Stores {
-  run: EntityStore<{ schema: typeof runSchema }>;
-  effect: EntityStore<{ schema: typeof effectSchema }>;
-  signal: EntityStore<{ schema: typeof signalSchema }>;
-  link: EntityStore<{ schema: typeof linkSchema }>;
-  agent: EntityStore<{ schema: typeof agentSchema }>;
-  allocation: EntityStore<{ schema: typeof allocationSchema }>;
-  admission: EntityStore<{ schema: typeof admissionSchema }>;
-  activation: EntityStore<{ schema: typeof workflowActivationSchema }>;
-  reservation: EntityStore<{ schema: typeof workflowReservationSchema }>;
-  scriptAttempt: EntityStore<{ schema: typeof workflowScriptAttemptSchema }>;
-}
-
-export function stores(ctx: ModuleCtx): Stores {
-  return laneStores(ctx, ctx.entities as unknown as Stores);
-}
-
-export async function requireRun(ctx: ModuleCtx, runId: string): Promise<WorkflowRunRecord> {
-  const run = await stores(ctx).run.get(runId);
-  if (!run) throw new OpError("not_found", 404, `workflow run '${runId}' was not found`);
-  return run;
-}
-
-export async function linkTask(ctx: ModuleCtx, taskId: number, runId: string, gate?: string, activationId?: string): Promise<void> {
-  const id = String(taskId);
-  const existing = await stores(ctx).link.get(id);
-  if (existing && existing.runId !== runId) {
-    const owner = await stores(ctx).run.get(existing.runId);
-    const composed = owner?.rootRunId || (owner?.status === "escalated" && (await requireRun(ctx, runId)).rootRunId);
-    if (owner && (owner.status === "running" || (owner.status === "escalated" && composed))) throw new OpError("conflict", 409, `TASK_EXECUTION_CONFLICT: T${taskId} is owned by ${owner.id}`);
-  }
-  if (!existing) await stores(ctx).link.create({ id, taskId, runId, ...(activationId ? { activationId } : {}), ...(gate ? { gate } : {}) });
-  else if (existing.runId !== runId || existing.gate !== gate) await stores(ctx).link.update(id, { runId, activationId, gate });
-}
-
-/** An effect's id: a retried write of the same effect is the same row. */
-export function workflowEffectId(runId: string, seq: number, kind: WorkflowEffect["kind"]): string {
-  return `${runId}:${String(seq).padStart(4, "0")}:${kind}`;
-}
-
-export async function writeEffect(ctx: ModuleCtx, run: WorkflowRunRecord, seq: number, kind: WorkflowEffect["kind"], payload: Record<string, unknown>, waitKey?: string): Promise<string> {
-  const id = workflowEffectId(run.id, seq, kind);
-  if (kind === "reap") {
-    const agentIds: string[] = [];
-    let cursor: string | undefined;
-    do {
-      const page = await stores(ctx).agent.list({ where: { runId: run.id }, limit: 200, ...(cursor ? { cursor } : {}) });
-      for (const agent of page.items) {
-        if (workflowReapIncludesAgent(run, payload, agent)) agentIds.push(agent.id);
-      }
-      cursor = page.cursor;
-    } while (cursor);
-    payload = { ...payload, agentIds };
-  }
-  await stores(ctx).effect.create({ id, runId: run.id, kind, payload, status: "pending", attempts: 0, ...(waitKey ? { waitKey } : {}), createdAt: ctx.clock.now() });
-  return id;
-}
-
-/** The highest seq the run's effects used (an end before #3045 H2 wrote one past `waitSeq`), and its pending end-of-run reaps. */
-export async function usedEffects(ctx: ModuleCtx, run: WorkflowRunRecord): Promise<{ seq: number; runReaps: string[] }> {
-  let seq = run.waitSeq;
-  const runReaps: string[] = [];
-  let cursor: string | undefined;
-  do {
-    const page = await stores(ctx).effect.list({ where: { runId: run.id }, limit: 200, ...(cursor ? { cursor } : {}) });
-    for (const effect of page.items) {
-      seq = Math.max(seq, Number(effect.id.slice(run.id.length + 1).split(":")[0]) || 0);
-      if (effect.kind === "reap" && effect.status === "pending" && effect.payload.scope === "run") runReaps.push(effect.id);
-    }
-    cursor = page.cursor;
-  } while (cursor);
-  return { seq, runReaps };
-}

package/node_modules/@humwick/kernel/workflow-step-commit.ts

@@ -1,195 +0,0 @@
-import type { Database } from "bun:sqlite";
-import type { EntitySession } from "./persistence";
-import type { EventSession } from "./event-log";
-import type { MessageAuthoritySession } from "./message-authority";
-import {
-  WorkflowContendedError,
-  isSqliteBusy,
-  type WorkflowJournalPersistence,
-  type WorkflowStepCommitRecord,
-} from "./workflow-journal";
-
-/** The executor lease this attempt claims to still hold, re-verified inside the commit. */
-export interface WorkflowStepLease {
-  /** Instance whose lease/fence predicate is re-checked. */
-  readonly instanceId: string;
-  /** The `executor_lease_token` this executor believes it holds. */
-  readonly token: string;
-  /** The fence-check time, compared against `executor_lease_expires_at` (`expires_at > now`). */
-  readonly now: number;
-}
-
-/**
- * Fault-injection boundaries threaded through the step's durable commit, each named to line up with
- * a labeled M4 chaos-harness kill point. M0 armed the first two with in-process throws to prove
- * all-or-nothing rollback; M4 arms any of them with a `process.kill(pid, "SIGKILL")` to prove the
- * SAME atomicity under a real cross-process kill-9 (an uncommitted WAL transaction leaves NO row).
- * The ordering, top to bottom, is the exact order the commit executes:
- *
- *   beforeCommit → [tx: fence → participant.flush → entity.flush → betweenEntitiesAndEvents
- *                   → event.flush → insideTxBeforeJournal → journal write → afterJournalBeforeCommit]
- *                   → afterCommit
- *
- * The two hooks INSIDE the tx after real writes (`insideTxBeforeJournal`, `afterJournalBeforeCommit`)
- * are the load-bearing ones: a kill there has already run entity/event (and, for the latter, the
- * journal INSERT + status UPDATE) statements, yet because the tx has not COMMITted, the crash must
- * leave zero rows. `afterCommit` fires once the tx is durably committed — a kill there proves the
- * committed step is memoized and NEVER re-executed on resume.
- */
-export interface WorkflowStepCommitFaults {
-  /** Fires after the sessions are sealed but before the transaction opens (models a pre-commit crash). */
-  beforeCommit?: () => void;
-  /** Fires after the workflow lease fence, before participant SQL. */
-  afterFenceBeforeParticipant?: () => void;
-  /** Fires immediately after participant SQL, before entity flush. */
-  afterParticipantBeforeEntities?: () => void;
-  /** Legacy fault seam: fires after the participant (if any), before the entity flush. */
-  afterFenceBeforeEntities?: () => void;
-  /** Fires inside the tx, between the entity flush and the event flush. */
-  betweenEntitiesAndEvents?: () => void;
-  /** Fires inside the transaction, after entity+event flush, before the journal write (models a mid-commit failure). */
-  insideTxBeforeJournal?: () => void;
-  /** Fires inside the tx, after the journal INSERT + instance UPDATE, before the tx COMMITs (proves
-   *  a kill with every write statement executed still rolls back to zero rows). */
-  afterJournalBeforeCommit?: () => void;
-  /** Fires AFTER the transaction has durably committed (proves a committed step is never re-run). */
-  afterCommit?: () => void;
-}
-
-export interface CommitStepAttemptInput {
-  readonly db: Database;
-  readonly journal: WorkflowJournalPersistence;
-  readonly lease: WorkflowStepLease;
-  readonly entitySession: EntitySession<unknown>;
-  readonly eventSession: EventSession<unknown>;
-  readonly messageAuthoritySession?: MessageAuthoritySession;
-  readonly record: WorkflowStepCommitRecord;
-  readonly faults?: WorkflowStepCommitFaults;
-}
-
-/**
- * Atomically commit one workflow step attempt. Opens ONE synchronous `db.transaction(() => …)`
- * and, in this exact order, does five things — any throw rolls back ALL five together:
- *
- *   (a) re-check the executor lease/fence by SQL predicate (never trust a pre-tx read);
- *   (b) flush the typed MESSAGE-authority participant (when one was staged);
- *   (c) `entitySession.flush()` — commit-time OCC comes free from K4;
- *   (d) `eventSession.flush()` — the scoped event log (K5);
- *   (e) write the `workflow_step_journal` memoization row and advance the instance
- *       status / journal cursor / transition columns.
- *
- * A lease-predicate failure (a) aborts before any entity, event, or journal row is written.
- * A participant refusal (b) aborts before entity, event, or journal SQL. A K4 optimistic-version
- * conflict (c) aborts before any event or journal row is written. The journal write (e), authority
- * mutation (b), and domain writes (c, d) commit as one unit or not at all — there
- * is no dual-write window. Returns the assigned journal `seq`.
- *
- * This is intentionally NOT `commitAtomically`: that helper owns the whole transaction and
- * flushes only an op attempt's enlisted sessions; it can express neither the lease predicate (a)
- * nor the journal write (e). The underlying `flush()`es already compose into a caller-owned tx.
- */
-export function commitStepAttempt(input: CommitStepAttemptInput): number {
-  const { db, journal, lease, entitySession, eventSession, messageAuthoritySession, record, faults } = input;
-
-  // Close all attempt sessions before entering the synchronous commit, so detached work can
-  // never add late intents (mirrors `commitAtomically`). Sealing precedes the fault boundary:
-  // a `beforeCommit` crash leaves them sealed-but-unflushed, so nothing is persisted.
-  entitySession.seal();
-  eventSession.seal();
-  messageAuthoritySession?.seal();
-  faults?.beforeCommit?.();
-
-  let seq = 0;
-  try {
-    db.transaction(() => {
-      journal.fenceLeaseInTransaction(lease.instanceId, lease.token, lease.now); // (a)
-      faults?.afterFenceBeforeParticipant?.();
-      messageAuthoritySession?.flush(); // (b)
-      faults?.afterParticipantBeforeEntities?.();
-      faults?.afterFenceBeforeEntities?.();
-      entitySession.flush(); // (c)
-      faults?.betweenEntitiesAndEvents?.();
-      eventSession.flush(); // (d)
-      faults?.insideTxBeforeJournal?.();
-      seq = journal.recordStepInTransaction(record); // (e)
-      faults?.afterJournalBeforeCommit?.();
-    })();
-  } catch (error) {
-    // A write-lock contention anywhere in the tx (fence, either flush, or the journal write) rolls
-    // the WHOLE tx back — no partial row — and must surface as the typed relinquish, never a raw
-    // SqliteError that would abort the driver's wakeup/recover loop or read as a lease loss.
-    if (isSqliteBusy(error)) throw new WorkflowContendedError(lease.instanceId, "commitStepAttempt", { cause: error });
-    throw error;
-  }
-  faults?.afterCommit?.();
-  return seq;
-}
-
-/** A FAILED attempt's commit (M3 retry path). */
-export interface CommitFailedStepAttemptInput {
-  readonly db: Database;
-  readonly journal: WorkflowJournalPersistence;
-  readonly lease: WorkflowStepLease;
-  /** Must have `outcome: "failed"`. A retry backoff parks the INSTANCE `sleeping` via
-   *  `nextStatus`/`sleepUntil`; exhaustion sets `nextStatus: "failed"` + `failure`. */
-  readonly record: WorkflowStepCommitRecord;
-  /** M4 chaos kill points around scheduling the backoff/failed row: `beforeCommit` (before the tx),
-   *  `insideTxBeforeJournal` (after the fence, before the failed-attempt row is written). */
-  readonly faults?: WorkflowStepCommitFaults;
-}
-
-/**
- * Atomically journal ONE failed step attempt (M3 retries). Unlike {@link commitStepAttempt} there
- * are NO domain effects to flush — the step body threw and its buffered K4/K5 sessions were already
- * discarded — so this opens one transaction that (a) re-checks the executor lease/fence, then (d)
- * writes the immutable `failed` journal row + advances the instance (to `sleeping` for a backoff,
- * `running` for an immediate retry, or terminal `failed` on exhaustion). Fencing a failed attempt
- * matters just as much as a completed one: a zombie driver whose lease was reclaimed must not be
- * able to append a phantom failed attempt and corrupt the retry sequence. Returns the journal `seq`.
- */
-export function commitFailedStepAttempt(input: CommitFailedStepAttemptInput): number {
-  const { db, journal, lease, record, faults } = input;
-  faults?.beforeCommit?.();
-  let seq = 0;
-  try {
-    db.transaction(() => {
-      journal.fenceLeaseInTransaction(lease.instanceId, lease.token, lease.now); // (a)
-      faults?.insideTxBeforeJournal?.();
-      seq = journal.recordStepInTransaction(record); // (d)
-    })();
-  } catch (error) {
-    if (isSqliteBusy(error)) throw new WorkflowContendedError(lease.instanceId, "commitFailedStepAttempt", { cause: error });
-    throw error;
-  }
-  return seq;
-}
-
-/**
- * Atomically journal a domain-effect-free completed transition under the executor lease. This is
- * used when a host participant proves that the workflow's exact authority generation was
- * superseded: the participant/domain transaction has rolled back, but the obsolete workflow must
- * still become terminal instead of being selected as a due sleeper forever.
- */
-export function commitSupersededStepAttempt(input: Omit<CommitFailedStepAttemptInput, "record"> & {
-  readonly record: WorkflowStepCommitRecord;
-}): number {
-  const { db, journal, lease, record, faults } = input;
-  if (record.outcome !== "completed" || record.nextStatus !== "done") {
-    throw new TypeError("a superseded workflow attempt must be a completed terminal transition");
-  }
-  faults?.beforeCommit?.();
-  let seq = 0;
-  try {
-    db.transaction(() => {
-      journal.fenceLeaseInTransaction(lease.instanceId, lease.token, lease.now);
-      faults?.insideTxBeforeJournal?.();
-      seq = journal.recordStepInTransaction(record);
-    })();
-  } catch (error) {
-    if (isSqliteBusy(error)) {
-      throw new WorkflowContendedError(lease.instanceId, "commitSupersededStepAttempt", { cause: error });
-    }
-    throw error;
-  }
-  return seq;
-}