@inflexa-ai/harness 0.12.0 → 0.14.0

package/dist/app/run-activity.js

@@ -0,0 +1,51 @@
+/**
+ * Ephemeral conversation-tail projection of non-terminal analysis runs.
+ *
+ * This is derived operational state, not memory: callers render it afresh for
+ * each turn and never persist it to the thread.
+ */
+/** Maximum detailed run rows paid into every conversation turn. */
+export const RUN_ACTIVITY_DETAIL_LIMIT = 20;
+function compactAge(startedAt, nowMs) {
+    const startedMs = Date.parse(startedAt);
+    if (!Number.isFinite(startedMs))
+        return "unknown age";
+    const elapsedSeconds = Math.max(0, Math.floor((nowMs - startedMs) / 1_000));
+    if (elapsedSeconds < 60)
+        return `${elapsedSeconds}s ago`;
+    const elapsedMinutes = Math.floor(elapsedSeconds / 60);
+    if (elapsedMinutes < 60)
+        return `${elapsedMinutes}m ago`;
+    const elapsedHours = Math.floor(elapsedMinutes / 60);
+    if (elapsedHours < 24)
+        return `${elapsedHours}h ago`;
+    return `${Math.floor(elapsedHours / 24)}d ago`;
+}
+function renderRows(label, rows, nowMs) {
+    if (rows.length === 0)
+        return [];
+    return [
+        `${label}:`,
+        ...rows.map((run) => `- runId: ${run.runId} | planId: ${run.planId ?? "none"} | startedAt: ${run.startedAt} | started: ${compactAge(run.startedAt, nowMs)}`),
+    ];
+}
+/** Render the bounded run-activity snapshot injected into a conversation tail. */
+export function renderRunActivity(activity, nowMs = Date.now()) {
+    const lines = ["[Run Activity]"];
+    if (activity.total === 0) {
+        lines.push("No runs are currently running or suspended.");
+        return lines.join("\n");
+    }
+    const running = activity.runs.filter((run) => run.status === "running");
+    const suspended = activity.runs.filter((run) => run.status === "suspended_insufficient_funds");
+    lines.push(...renderRows("Running", running, nowMs), ...renderRows("Suspended", suspended, nowMs));
+    const omitted = activity.total - activity.runs.length;
+    if (omitted > 0) {
+        lines.push(`Showing ${activity.runs.length} of ${activity.total} non-terminal runs; ${omitted} omitted. Use inspect_run to page the full list.`);
+    }
+    return lines.join("\n");
+}
+/** Render an honest degraded state when the activity projection cannot be read. */
+export function renderRunActivityUnavailable() {
+    return "[Run Activity]\nRun status is temporarily unavailable. Do not infer that no active runs exist.";
+}

package/dist/config/resource-limits.d.ts

@@ -34,13 +34,6 @@ export declare const ResourcePolicySchema: z.ZodObject<{
         cpu: z.ZodNumber;
         memoryGb: z.ZodNumber;
     }, z.core.$strip>;
-    ephemeral: z.ZodOptional<z.ZodObject<{
-        cpu: z.ZodNumber;
-        memoryGb: z.ZodNumber;
-        gpu: z.ZodOptional<z.ZodObject<{
-            count: z.ZodNumber;
-        }, z.core.$strip>>;
-    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type GpuSpec = z.infer<typeof GpuSpecSchema>;
 export type ResourceSpec = z.infer<typeof ResourceSpecSchema>;

package/dist/config/resource-limits.js

@@ -26,7 +26,6 @@ export const MachineBudgetSchema = z.object({
 export const ResourcePolicySchema = z.object({
     perStep: ResourceLimitsSchema,
     budget: MachineBudgetSchema,
-    ephemeral: ResourceSpecSchema.optional(),
 });
 /** Default LLM-turn budget for a sandbox agent step. Covers simple,
  *  standard, and complex analyses — extra headroom on simple steps is

package/dist/contracts/target-dossier.d.ts

@@ -1789,8 +1789,8 @@ export declare const ExpressionHeatmapCellSchema: z.ZodObject<{
         medium: "medium";
         low: "low";
         absent: "absent";
-        not_loaded: "not_loaded";
         no_data: "no_data";
+        not_loaded: "not_loaded";
     }>;
 }, z.core.$strip>;
 export declare const ExpressionHeatmapSchema: z.ZodObject<{
@@ -1808,8 +1808,8 @@ export declare const ExpressionHeatmapSchema: z.ZodObject<{
             medium: "medium";
             low: "low";
             absent: "absent";
-            not_loaded: "not_loaded";
             no_data: "no_data";
+            not_loaded: "not_loaded";
         }>;
     }, z.core.$strip>>;
     per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -1915,8 +1915,8 @@ export declare const PreclinicalProfileSchema: z.ZodObject<{
                     medium: "medium";
                     low: "low";
                     absent: "absent";
-                    not_loaded: "not_loaded";
                     no_data: "no_data";
+                    not_loaded: "not_loaded";
                 }>;
             }, z.core.$strip>>;
             per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -4233,8 +4233,8 @@ export declare const DossierSchema: z.ZodObject<{
                             medium: "medium";
                             low: "low";
                             absent: "absent";
-                            not_loaded: "not_loaded";
                             no_data: "no_data";
+                            not_loaded: "not_loaded";
                         }>;
                     }, z.core.$strip>>;
                     per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -5486,8 +5486,8 @@ export declare const ReferenceBiologyV4Shape: z.ZodObject<{
                         medium: "medium";
                         low: "low";
                         absent: "absent";
-                        not_loaded: "not_loaded";
                         no_data: "no_data";
+                        not_loaded: "not_loaded";
                     }>;
                 }, z.core.$strip>>;
                 per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -6918,8 +6918,8 @@ export declare const DossierV4Schema: z.ZodObject<{
                             medium: "medium";
                             low: "low";
                             absent: "absent";
-                            not_loaded: "not_loaded";
                             no_data: "no_data";
+                            not_loaded: "not_loaded";
                         }>;
                     }, z.core.$strip>>;
                     per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -9135,8 +9135,8 @@ export declare const DossierV4BodySchema: z.ZodObject<{
                             medium: "medium";
                             low: "low";
                             absent: "absent";
-                            not_loaded: "not_loaded";
                             no_data: "no_data";
+                            not_loaded: "not_loaded";
                         }>;
                     }, z.core.$strip>>;
                     per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -12210,8 +12210,8 @@ export declare const DossierV5Schema: z.ZodObject<{
                             medium: "medium";
                             low: "low";
                             absent: "absent";
-                            not_loaded: "not_loaded";
                             no_data: "no_data";
+                            not_loaded: "not_loaded";
                         }>;
                     }, z.core.$strip>>;
                     per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -14932,8 +14932,8 @@ export declare const DossierV5BodySchema: z.ZodObject<{
                             medium: "medium";
                             low: "low";
                             absent: "absent";
-                            not_loaded: "not_loaded";
                             no_data: "no_data";
+                            not_loaded: "not_loaded";
                         }>;
                     }, z.core.$strip>>;
                     per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -16561,8 +16561,8 @@ export declare const DossierSchemaV3Legacy: z.ZodObject<{
                             medium: "medium";
                             low: "low";
                             absent: "absent";
-                            not_loaded: "not_loaded";
                             no_data: "no_data";
+                            not_loaded: "not_loaded";
                         }>;
                     }, z.core.$strip>>;
                     per_species_coverage: z.ZodRecord<z.ZodString, z.ZodEnum<{

package/dist/execution/dbos-run-launcher.js

@@ -3,36 +3,11 @@
  * shared by every embedder. Host-neutral: it references only DBOS, which the harness
  * already depends on, so it ships in the harness.
  */
-import { DBOS, Error as DBOSErrors } from "@dbos-inc/dbos-sdk";
+import { DBOS } from "@dbos-inc/dbos-sdk";
 export function createDbosRunLauncher() {
     return {
         async launch(workflow, opts, input) {
             await DBOS.startWorkflow(workflow, { workflowID: opts.workflowId })(input);
         },
-        async launchAndAwait(workflow, opts, input, runOpts) {
-            const handle = await DBOS.startWorkflow(workflow, {
-                workflowID: opts.workflowId,
-            })(input);
-            // Registered only after the workflow row is persisted — an abort racing a
-            // not-yet-started workflow would `cancelWorkflow` a missing row (no-op)
-            // and, being `{ once: true }`, never fire again, blocking `getResult`.
-            const cancel = () => {
-                void DBOS.cancelWorkflow(opts.workflowId);
-            };
-            if (runOpts.signal.aborted)
-                cancel();
-            else
-                runOpts.signal.addEventListener("abort", cancel, { once: true });
-            try {
-                const result = await handle.getResult();
-                return { status: "completed", result };
-            }
-            catch (e) {
-                if (e instanceof DBOSErrors.DBOSWorkflowCancelledError) {
-                    return { status: "cancelled" };
-                }
-                throw e;
-            }
-        },
     };
 }

package/dist/execution/report-runner.js

@@ -147,8 +147,8 @@ export async function runReportIteration(deps, opts) {
                 signal: opts.signal,
                 emit: opts.emit,
                 runStep: passthroughStep,
-            }, {
                 resolved: () => outcome !== undefined,
+            }, {
                 tools: [buildReportTool, submitReportTool],
                 nudge: "You stopped without calling submit_report, so this report version " +
                     "was not recorded. Build the report if needed, then call " +

package/dist/execution/run-authorizer.d.ts

@@ -1,7 +1,7 @@
 /**
  * RunAuthorizer — the async-edge run-authorization seam.
  *
- * Every async edge that starts durable work (`execute_plan`, `run_ephemeral`,
+ * Every async edge that starts durable work (`execute_analysis`,
  * data-profile) must turn the caller's opaque auth into a durable `RunSession`
  * before dispatching a workflow. That turning is the ONE place the credential
  * kind matters (a live caller credential → mint a fresh run credential Cortex

package/dist/execution/run-authorizer.js

@@ -1,7 +1,7 @@
 /**
  * RunAuthorizer — the async-edge run-authorization seam.
  *
- * Every async edge that starts durable work (`execute_plan`, `run_ephemeral`,
+ * Every async edge that starts durable work (`execute_analysis`,
  * data-profile) must turn the caller's opaque auth into a durable `RunSession`
  * before dispatching a workflow. That turning is the ONE place the credential
  * kind matters (a live caller credential → mint a fresh run credential Cortex

package/dist/execution/run-event-parts.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The two input-only rules of the run-event read seam: narrowing a raw durable
+ * stream value to the chat data-part contract, and the latest-wins reconciling
+ * fold applied before delivery.
+ *
+ * They live apart from the reader because they are the only part of the seam
+ * whose correctness is a function of its argument alone — no database, no
+ * durability engine, no clock — and keeping them here is what lets that be
+ * proven directly instead of inferred from a driven subscription.
+ */
+import type { CortexChatPart } from "../contracts/chat-parts.js";
+/**
+ * Narrow one raw stream value to a chat data part, or `null` when it is not one.
+ *
+ * A run's streams carry more than the contract: a sandbox step also writes its
+ * loop orchestration under envelopes (`data-loop-event`, `data-sandbox-event`)
+ * that belong to the workflow layer and have no registry entry. The seam's
+ * contract is the `CortexChatPart` union, so anything the registry does not
+ * classify is not deliverable — which also covers a part written by a producer
+ * newer than the reader.
+ *
+ * The registry is keyed by the discriminant alone, so this validates `type` and
+ * trusts the producer for the payload. There is no per-part schema to validate
+ * against: `contracts/chat-parts.ts` declares interfaces, not Zod objects. Both
+ * ends of this stream are typed against that same union inside this package, so
+ * the discriminant is the boundary that can actually drift (a producer emitting
+ * something else entirely) and the one worth checking.
+ */
+export declare function parseRunEventPart(value: unknown): CortexChatPart | null;
+/**
+ * Collapse a batch of parts so each reconciling id appears once, carrying its
+ * latest value, and every other part survives untouched in write order.
+ *
+ * `reconciling` in `PART_REGISTRY` already means "a later emission under this id
+ * supersedes the earlier one" — `data-step-activity` mints a stable id per
+ * `(runId, stepId)` precisely so a fold collapses every phase transition. Reading
+ * the flag rather than holding a list of part types here keeps one source of
+ * truth: a part type added to the registry later folds correctly without this
+ * module changing.
+ *
+ * A survivor keeps the position of its LAST occurrence, so relative order among
+ * the parts that are delivered is the order they were written.
+ */
+export declare function foldRunEventParts(parts: readonly CortexChatPart[]): CortexChatPart[];

package/dist/execution/run-event-stream.d.ts

@@ -0,0 +1,91 @@
+/**
+ * RunEventStream — the read side of the durable per-run event stream.
+ *
+ * Every analysis run already writes a rich, typed event stream: the parent
+ * `executeAnalysis` workflow writes the run-level parts, and each `sandbox-step`
+ * child writes its own step-level parts to its OWN stream, because a workflow can
+ * only write the stream it owns. This seam reads all of them back as one channel,
+ * so an embedder can show a user what a run is actually doing without
+ * reconstructing progress from the durability engine's internal step-cache tables
+ * — which record a step only when it *completes*, and so describe the thing that
+ * just finished rather than the thing in flight.
+ *
+ * The seam quarantines the engine the same way `RunLauncher` does for starting
+ * workflows: the delivered values are the harness's own `contracts/` part types,
+ * and no engine type appears in the exported signature.
+ *
+ * It is a push subscription rather than a snapshot reader because the engine's
+ * read primitive is an async generator with no offset parameter — "give me what
+ * is new since X" is not expressible on the public API, and expressing it would
+ * mean reaching into the SDK internals this seam exists to remove. A merged async
+ * iterator was the other candidate and was rejected because the set of sources
+ * grows during iteration (children join mid-run), which costs materially more
+ * code than invoking a handler; a callback also matches the `EmitFn` idiom the
+ * producers already speak.
+ *
+ * `subscribe` resolves rather than returning a `Result` because it has no failure
+ * to report. Observation is a diagnostic channel: a throwing handler and a
+ * failing stream are both logged and contained, mirroring the `safeEmit` stance
+ * on the write side, where a dropped UI frame must never fail a step. A read side
+ * that tore itself down on one bad part would be strictly less robust than the
+ * writer it observes.
+ */
+import type { Pool } from "pg";
+import type { CortexChatPart } from "../contracts/chat-parts.js";
+import type { Logger } from "../lib/logger.js";
+/**
+ * Construction-time dependencies. The pool is the application pool the run
+ * ledger lives in; the logger is where every contained failure is reported, and
+ * defaults to silence so an embedder that wired none sees nothing rather than
+ * having console forced on it.
+ */
+export interface RunEventStreamDeps {
+    readonly pool: Pool;
+    readonly logger?: Logger;
+}
+/**
+ * Receives one part. May be async — the subscription awaits it, so a handler is
+ * never invoked concurrently with itself and back-pressure is the caller's to
+ * exert by taking its time. A throw is logged and swallowed.
+ */
+export type RunEventPartHandler = (part: CortexChatPart) => void | Promise<void>;
+/** Call-time parameters of one subscription. */
+export interface RunEventSubscribeOptions {
+    /** The run to observe. Also the parent workflow's id. */
+    readonly runId: string;
+    /** Where each delivered part goes. */
+    readonly onPart: RunEventPartHandler;
+    /** Aborting stops delivery and settles the returned promise. */
+    readonly signal: AbortSignal;
+}
+/**
+ * The run-event read seam. One method, because a run-scoped subscription is the
+ * whole capability: a general-purpose stream reader would leak the engine's model
+ * back into the surface this exists to quarantine.
+ */
+export interface RunEventStream {
+    /**
+     * Deliver every part the run produces — parent and children alike — to
+     * `onPart`, resolving when the run is terminal and every stream opened has
+     * drained, or promptly when the signal aborts.
+     *
+     * Parts from one workflow arrive in the order that workflow wrote them. No
+     * order is promised ACROSS the parent and its children: those workflows
+     * execute concurrently and the producers establish no cross-stream clock, so
+     * a total order could only be synthesised from timestamps that were never
+     * meant to be one. Consumers do not need it — every part is addressed by
+     * `runId`/`stepId` and the reconciling fold is per id.
+     */
+    subscribe(options: RunEventSubscribeOptions): Promise<void>;
+}
+/**
+ * Build the DBOS-backed realization of {@link RunEventStream}.
+ *
+ * Every stream is read from its beginning, and each workflow is opened at most
+ * once per subscription. Replay is not a cost worked around here, it is what
+ * makes attaching mid-run correct: a subscriber joining at minute ten receives
+ * the run's whole history and folding it yields the true current state.
+ * Re-opening a workflow would redeliver that history and duplicate every part
+ * the fold does not reconcile.
+ */
+export declare function createRunEventStream(deps: RunEventStreamDeps): RunEventStream;

package/dist/execution/run-event-stream.js

@@ -0,0 +1,212 @@
+/**
+ * RunEventStream — the read side of the durable per-run event stream.
+ *
+ * Every analysis run already writes a rich, typed event stream: the parent
+ * `executeAnalysis` workflow writes the run-level parts, and each `sandbox-step`
+ * child writes its own step-level parts to its OWN stream, because a workflow can
+ * only write the stream it owns. This seam reads all of them back as one channel,
+ * so an embedder can show a user what a run is actually doing without
+ * reconstructing progress from the durability engine's internal step-cache tables
+ * — which record a step only when it *completes*, and so describe the thing that
+ * just finished rather than the thing in flight.
+ *
+ * The seam quarantines the engine the same way `RunLauncher` does for starting
+ * workflows: the delivered values are the harness's own `contracts/` part types,
+ * and no engine type appears in the exported signature.
+ *
+ * It is a push subscription rather than a snapshot reader because the engine's
+ * read primitive is an async generator with no offset parameter — "give me what
+ * is new since X" is not expressible on the public API, and expressing it would
+ * mean reaching into the SDK internals this seam exists to remove. A merged async
+ * iterator was the other candidate and was rejected because the set of sources
+ * grows during iteration (children join mid-run), which costs materially more
+ * code than invoking a handler; a callback also matches the `EmitFn` idiom the
+ * producers already speak.
+ *
+ * `subscribe` resolves rather than returning a `Result` because it has no failure
+ * to report. Observation is a diagnostic channel: a throwing handler and a
+ * failing stream are both logged and contained, mirroring the `safeEmit` stance
+ * on the write side, where a dropped UI frame must never fail a step. A read side
+ * that tore itself down on one bad part would be strictly less robust than the
+ * writer it observes.
+ */
+import { DBOS } from "@dbos-inc/dbos-sdk";
+import { sleep } from "../lib/async-utils.js";
+import { createNoopLogger } from "../lib/console-logger.js";
+import { describeDbError } from "../lib/db-result.js";
+import { queryStepsByRun } from "../state/step-executions.js";
+import { foldRunEventParts, parseRunEventPart } from "./run-event-parts.js";
+/** Durable stream key every run producer writes its parts under. */
+const RUN_EVENT_STREAM_KEY = "events";
+/**
+ * How often the run's step ledger is re-read for children that have started
+ * since the last look.
+ *
+ * A child records its own workflow id as it begins, so discovery can only be as
+ * timely as that write and there is nothing to subscribe to before it lands.
+ * Polling is the honest mechanism: the parent's dag snapshot marks a step running
+ * before the child's body has written its row, so an event-driven re-check would
+ * race the ledger. One second matches the engine's own stream-polling fallback,
+ * and lagging a child's first writes costs nothing — a stream subscribed late is
+ * still read from its beginning.
+ */
+const CHILD_DISCOVERY_INTERVAL_MS = 1_000;
+/**
+ * Build the DBOS-backed realization of {@link RunEventStream}.
+ *
+ * Every stream is read from its beginning, and each workflow is opened at most
+ * once per subscription. Replay is not a cost worked around here, it is what
+ * makes attaching mid-run correct: a subscriber joining at minute ten receives
+ * the run's whole history and folding it yields the true current state.
+ * Re-opening a workflow would redeliver that history and duplicate every part
+ * the fold does not reconcile.
+ */
+export function createRunEventStream(deps) {
+    const baseLogger = (deps.logger ?? createNoopLogger()).named("run-event-stream");
+    return {
+        async subscribe({ runId, onPart, signal }) {
+            const logger = baseLogger.with({ runId });
+            // Open generators, so an abort can ask each to wind down. The engine's
+            // reader exposes no cancellation: while it waits on a quiet-but-active
+            // workflow it is suspended inside an await, where a queued `return()` is
+            // only honoured once it next reaches a yield. Teardown is therefore
+            // best-effort by construction, and the subscription's own promise is
+            // raced against the signal rather than waiting on it.
+            const open = new Set();
+            let resolveAbort;
+            const aborted = new Promise((resolve) => {
+                resolveAbort = resolve;
+            });
+            const onAbort = () => {
+                resolveAbort();
+                for (const generator of open) {
+                    void generator.return(undefined).catch(() => {
+                        /* the read is already being abandoned */
+                    });
+                }
+            };
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener("abort", onAbort, { once: true });
+            // Delivery is serialized through one queue across every stream. That
+            // gives the fold a batch to collapse — whatever accumulated while the
+            // previous handler call was in flight is reconciled before it is handed
+            // over, which is what spares a mid-run subscriber the superseded
+            // intermediates it replayed. The queue is FIFO and the fold keeps
+            // survivors in place, so a single stream's write order survives it.
+            const pending = [];
+            let delivering = false;
+            const deliver = async () => {
+                if (delivering)
+                    return;
+                delivering = true;
+                try {
+                    while (pending.length > 0 && !signal.aborted) {
+                        const batch = pending.splice(0, pending.length);
+                        for (const part of foldRunEventParts(batch)) {
+                            if (signal.aborted)
+                                return;
+                            try {
+                                await onPart(part);
+                            }
+                            catch (err) {
+                                logger.warn("run-event handler threw", { partType: part.type, ...logger.errorFields(err) });
+                            }
+                        }
+                    }
+                }
+                finally {
+                    delivering = false;
+                }
+            };
+            const readWorkflowStream = async (workflowId) => {
+                const streamLogger = logger.with({ workflowId });
+                const generator = DBOS.readStream(workflowId, RUN_EVENT_STREAM_KEY);
+                open.add(generator);
+                try {
+                    for (;;) {
+                        const next = await generator.next();
+                        // Checked after the read, not before: `next()` is what notices
+                        // the workflow going inactive, and an aborted subscription
+                        // must not enqueue anything the drain will never take.
+                        if (next.done === true || signal.aborted)
+                            return;
+                        const part = parseRunEventPart(next.value);
+                        if (part === null) {
+                            streamLogger.debug("dropped a stream value outside the chat-part contract");
+                            continue;
+                        }
+                        pending.push(part);
+                        void deliver();
+                    }
+                }
+                catch (err) {
+                    // One stream's failure is contained here so the parent and every
+                    // other child keep arriving.
+                    streamLogger.error("run-event stream read failed", streamLogger.errorFields(err));
+                }
+                finally {
+                    open.delete(generator);
+                    void generator.return(undefined).catch(() => {
+                        /* already finished, or abandoned under abort */
+                    });
+                }
+            };
+            const subscribed = new Set([runId]);
+            const childReads = [];
+            // Children are addressed by the id the workflow bodies already persist.
+            // Deriving them from the scheduler's `${runId}-${idx}` naming would
+            // hard-code a scheme that belongs to the scheduler, and the engine's own
+            // child bookkeeping is internals of the kind this seam removes.
+            const discoverChildren = async () => {
+                (await queryStepsByRun(deps.pool, runId)).match((rows) => {
+                    for (const row of rows) {
+                        const childWorkflowId = row.childWorkflowId;
+                        if (childWorkflowId === null || subscribed.has(childWorkflowId))
+                            continue;
+                        subscribed.add(childWorkflowId);
+                        childReads.push(readWorkflowStream(childWorkflowId));
+                    }
+                }, (error) => {
+                    logger.warn("child discovery failed", { err: describeDbError(error) });
+                });
+            };
+            let parentDrained = false;
+            const parentRead = readWorkflowStream(runId).finally(() => {
+                parentDrained = true;
+            });
+            // The parent's stream draining IS the run reaching terminal: the engine
+            // ends a read exactly when the workflow is no longer active. One further
+            // pass runs after that — a child whose id landed in the ledger late is
+            // still replayed from zero — and then discovery stops.
+            const discovery = (async () => {
+                for (;;) {
+                    if (signal.aborted)
+                        return;
+                    await discoverChildren();
+                    if (signal.aborted || parentDrained)
+                        return;
+                    await Promise.race([sleep(CHILD_DISCOVERY_INTERVAL_MS), aborted, parentRead]);
+                }
+            })();
+            const settled = (async () => {
+                await discovery;
+                await parentRead;
+                await Promise.all(childReads);
+            })().catch((err) => {
+                // Defensive: every stream read and every discovery pass contains its
+                // own failure, so arriving here is a defect in this seam rather than
+                // a runtime condition. Logged rather than left to surface as an
+                // unhandled rejection after an abort already settled the caller.
+                logger.error("run-event subscription failed", logger.errorFields(err));
+            });
+            try {
+                await Promise.race([settled, aborted]);
+            }
+            finally {
+                signal.removeEventListener("abort", onAbort);
+            }
+        },
+    };
+}

package/dist/execution/run-launcher.d.ts

@@ -1,12 +1,10 @@
 /**
  * RunLauncher — the durability-engine launch seam.
  *
- * The async-edge tools (`execute_plan`, `run_ephemeral`) start durable runs but
+ * Async-edge tools such as `execute_analysis` start durable runs but
  * must not reach the durability engine directly — that engine is quarantined
  * out of tools and the loop. This seam is the one capability they need: start a
- * registered workflow under a caller-chosen id, either fire-and-forget or
- * awaiting its result inline. `launchAndAwait` hides the engine's cancellation
- * behind a discriminated outcome, so no engine error type leaks to callers.
+ * registered workflow under a caller-chosen id.
  *
  * The workflow itself stays injected — it is the registered-workflow function
  * reference, typed `(input) => Promise<result>`; the launcher only owns the
@@ -16,21 +14,7 @@ export interface LaunchOptions {
     /** Caller-chosen durable workflow id (e.g. the runId). */
     readonly workflowId: string;
 }
-export interface LaunchRunOptions {
-    /** Aborting cancels the in-flight run; wired internally by the launcher. */
-    readonly signal: AbortSignal;
-}
-/** Result of an awaited launch: the value on completion, or a cancelled
- * sentinel that replaces the engine's cancellation error. */
-export type LaunchOutcome<R> = {
-    readonly status: "completed";
-    readonly result: R;
-} | {
-    readonly status: "cancelled";
-};
 export interface RunLauncher {
     /** Fire-and-forget: resolves once the run is durably started. */
     launch<I>(workflow: (input: I) => Promise<unknown>, opts: LaunchOptions, input: I): Promise<void>;
-    /** Start the run and await its result inline, wiring cancel-on-abort. */
-    launchAndAwait<I, R>(workflow: (input: I) => Promise<R>, opts: LaunchOptions, input: I, runOpts: LaunchRunOptions): Promise<LaunchOutcome<R>>;
 }

package/dist/execution/run-launcher.js

@@ -1,12 +1,10 @@
 /**
  * RunLauncher — the durability-engine launch seam.
  *
- * The async-edge tools (`execute_plan`, `run_ephemeral`) start durable runs but
+ * Async-edge tools such as `execute_analysis` start durable runs but
  * must not reach the durability engine directly — that engine is quarantined
  * out of tools and the loop. This seam is the one capability they need: start a
- * registered workflow under a caller-chosen id, either fire-and-forget or
- * awaiting its result inline. `launchAndAwait` hides the engine's cancellation
- * behind a discriminated outcome, so no engine error type leaks to callers.
+ * registered workflow under a caller-chosen id.
  *
  * The workflow itself stays injected — it is the registered-workflow function
  * reference, typed `(input) => Promise<result>`; the launcher only owns the

package/dist/execution/run-synthesis.js

@@ -369,9 +369,9 @@ export async function generateRunSynthesis(input) {
         signal,
         emit,
         runStep: passthroughStep,
+        resolved: () => holder.outcome !== null,
     };
     await runToTerminal(agent, [{ role: "user", content: prompt }], input.session, loopDeps, {
-        resolved: () => holder.outcome !== null,
         tools: [submitTool, blockerTool],
         nudge: "You ended without calling a terminal tool. You MUST call " +
             "submit_synthesis with the final synthesis now, or report_blocker " +