@inflexa-ai/harness 0.35.2 → 0.35.4

package/dist/tools/sandbox/list-available-packages.js

@@ -22,6 +22,7 @@
 import { ok } from "neverthrow";
 import { z } from "zod";
 import { defineTool } from "../define-tool.js";
+import { identityAddress, identityKey, identityOf, parseQuery, resolveQuery, } from "../../sandbox/package-identity.js";
 import { capCodePoints, DETAIL_NEEDLE_MAX_LENGTH } from "../../loop/tool-detail.js";
 import { LIBS_CONTAINER_PATH } from "../../sandbox/mount-plan.js";
 import { readFarmLockFile } from "../../sandbox/farm.js";
@@ -46,8 +47,9 @@ const DEFAULT_IMAGE_PACKAGES_FILE = `${LIBS_CONTAINER_PATH}/${IMAGE_PACKAGES_FIL
 /**
  * The two headings that a lock track and the image record can both carry.
  * Declared once, because {@link LANGUAGE_MATCHERS} keys the `language` filter
- * on the heading text, and {@link foldSections} merges two sources by it: a
- * second spelling of either would split one track into two headings.
+ * of these two on the heading text, and {@link foldSections} merges two
+ * sources by it: a second spelling of either would split one track into two
+ * headings.
  */
 const CLI_TITLE = "System tools (CLI)";
 const NODE_TITLE = "Node (npm)";
@@ -59,6 +61,20 @@ const TRACK_TITLES = {
     github: "R (GitHub)",
     node: NODE_TITLE,
 };
+/**
+ * The ecosystem of one lock subtree. `python` gives the Python track, and
+ * `cran`, `bioconductor`, and `github` give the R track — three subtrees of
+ * one ecosystem, because a repository is a source and not an identity rule.
+ *
+ * A subtree that names neither, such as `node`, carries no track: its packages
+ * are not in the pool of the two ecosystems, and a `names` lookup matches them
+ * by their rendered name.
+ */
+export function trackOfLockSubtree(subtree) {
+    if (subtree === "python")
+        return "python";
+    return subtree === "cran" || subtree === "bioconductor" || subtree === "github" ? "r" : undefined;
+}
 /**
  * Group the lock packages into sections, one per track, in a stable order:
  * the known tracks first, then an unknown track at its first occurrence.
@@ -77,7 +93,12 @@ export function lockSections(lock) {
         else
             byTrack.set(pkg.track, [entry]);
     }
-    return [...byTrack.entries()].filter(([, packages]) => packages.length > 0).map(([track, packages]) => ({ title: TRACK_TITLES[track] ?? track, packages }));
+    return [...byTrack.entries()]
+        .filter(([, packages]) => packages.length > 0)
+        .map(([subtree, packages]) => {
+        const track = trackOfLockSubtree(subtree);
+        return { title: TRACK_TITLES[subtree] ?? subtree, packages, ...(track === undefined ? {} : { track }) };
+    });
 }
 /**
  * Group the image record into its two sections, in the order of the record.
@@ -116,18 +137,22 @@ function foldSections(sections) {
     for (const section of sections) {
         let open = byTitle.get(section.title);
         if (!open) {
-            open = { title: section.title, packages: [], seen: new Set() };
+            open = { title: section.title, track: section.track, packages: [], seen: new Set() };
             byTitle.set(section.title, open);
         }
         for (const pkg of section.packages) {
-            const key = pkg.name.toLowerCase();
-            if (open.seen.has(key))
+            // An untracked section holds an executable or a node module, and
+            // the identity rule of a package track does not reach either one.
+            // Such a row folds by case alone, thus two sources that spell one
+            // executable differently still render one row.
+            const seen = section.track === undefined ? pkg.name.toLowerCase() : pkg.name;
+            if (open.seen.has(seen))
                 continue;
-            open.seen.add(key);
+            open.seen.add(seen);
             open.packages.push(pkg);
         }
     }
-    return [...byTitle.values()].map(({ title, packages }) => ({ title, packages }));
+    return [...byTitle.values()].map(({ title, track, packages }) => ({ title, packages, ...(track === undefined ? {} : { track }) }));
 }
 /**
  * Default cap on a listing — high enough that the real store is never truncated.
@@ -156,21 +181,59 @@ const UNAVAILABLE_NOTE = "Package list not available — the inventory of the fa
  */
 const POOL_UNAVAILABLE_NOTE = "Package list not available — the package pool could not be read, so what the store holds is UNKNOWN. " +
     "Do not assume a package is present, and do not report a package as absent.";
-/** The `language` filter values, mapped onto the concrete section headings. */
+/**
+ * The `language` filter of the two sections that carry no track, mapped onto
+ * their concrete headings. The `r` and `python` values read `section.track`
+ * instead, because a package track is data and a heading is display text.
+ */
 const LANGUAGE_MATCHERS = {
-    // The R triple: `R (CRAN)`, `R (Bioconductor)`, `R (GitHub)`.
-    r: (t) => /^r\b/i.test(t),
-    python: (t) => /^python\b/i.test(t),
     // `CLI_TITLE` — the conda-installed bioinformatics executables.
     cli: (t) => /system tools|\bcli\b/i.test(t),
     node: (t) => /^node\b/i.test(t),
 };
-/** One entry as the listing renders it: `name==version` where the source pins a version, the bare name otherwise. */
-function renderPackage(entry) {
-    return entry.version === undefined ? entry.name : `${entry.name}==${entry.version}`;
+/** Whether one section answers the `language` filter of a call. */
+function matchesLanguage(section, language) {
+    if (language === undefined)
+        return true;
+    if (language === "r" || language === "python")
+        return section.track === language;
+    return LANGUAGE_MATCHERS[language](section.title);
+}
+/**
+ * The identity names that the Python track and the R track both hold.
+ *
+ * A plan entry of such a name cannot say which package it means, thus the
+ * link pass refuses it as a collision. The listing marks each of these rows
+ * with the prefixed forms, and the planner writes one of them. A pair of two
+ * spellings, such as `decoupler` and `decoupleR`, needs no mark, because the
+ * two identities differ and the spelling settles the track.
+ */
+function bothTrackNames(sections) {
+    const python = new Set();
+    const r = new Set();
+    for (const section of sections) {
+        if (section.track === undefined)
+            continue;
+        const holder = section.track === "python" ? python : r;
+        for (const pkg of section.packages)
+            holder.add(identityOf(section.track, pkg.name).name);
+    }
+    return new Set([...python].filter((name) => r.has(name)));
+}
+/**
+ * One entry as the listing renders it: `name==version` where the source pins
+ * a version, the bare name otherwise. A name that both tracks hold carries
+ * the two forms a plan writes, because a bare entry of it refuses the launch.
+ */
+function renderPackage(entry, track, bothTracks) {
+    const rendered = entry.version === undefined ? entry.name : `${entry.name}==${entry.version}`;
+    if (track === undefined)
+        return rendered;
+    const identity = identityOf(track, entry.name).name;
+    return bothTracks.has(identity) ? `${rendered} [both tracks — write python:${identity} or r:${identity}]` : rendered;
 }
 /** Render sections to the agent-facing listing, bounded at `limit` packages. */
-function renderListing(sections, limit) {
+function renderListing(sections, limit, bothTracks) {
     const lines = [];
     let returned = 0;
     for (const section of sections) {
@@ -183,13 +246,52 @@ function renderListing(sections, limit) {
         }
         const shown = section.packages.slice(0, room);
         returned += shown.length;
-        lines.push(`\n## ${section.title}`, `  ${shown.map(renderPackage).join(", ")}`);
+        lines.push(`\n## ${section.title}`, `  ${shown.map((entry) => renderPackage(entry, section.track, bothTracks)).join(", ")}`);
         const hidden = section.packages.length - shown.length;
         if (hidden > 0)
             lines.push(`  … and ${hidden} more in this section (raise \`limit\` or narrow with \`query\`).`);
     }
     return { content: lines.join("\n").trim(), returned };
 }
+/**
+ * A {@link PoolIndex} over the rows of the tracked sections. The suggestion of
+ * the ladder reads `rIdentitiesFoldingTo`, and the fold of an identity is its
+ * store address — thus the census suggests exactly what the store holds.
+ */
+function poolIndexOf(held) {
+    const keys = new Set(held.map((row) => identityKey(row.identity)));
+    // Keyed by the identity KEY, not by the address: two R sections can list
+    // one package, and a suggestion must count that package once. Two R
+    // identities of one address stay two entries, and the ladder then gives no
+    // suggestion, because a guess between them is a coin flip.
+    const rByKey = new Map();
+    for (const row of held) {
+        if (row.identity.track !== "r")
+            continue;
+        rByKey.set(identityKey(row.identity), row.identity);
+    }
+    return {
+        has: (identity) => keys.has(identityKey(identity)),
+        rIdentitiesFoldingTo: (fold) => [...rByKey.values()].filter((identity) => identityAddress(identity) === fold),
+    };
+}
+/**
+ * One present answer of the `names` path. `name` echoes the spelling that the
+ * source records, because an R name is case-sensitive at `library()` and the
+ * caller imports that exact one. The store identity rides only where the
+ * source records it.
+ */
+function presentEntry(requested, row) {
+    return {
+        requested,
+        present: true,
+        name: row.entry.name,
+        section: row.section,
+        ...(row.entry.version === undefined ? {} : { version: row.entry.version }),
+        ...(row.entry.storeDir === undefined ? {} : { storeDir: row.entry.storeDir }),
+        ...(row.entry.hash === undefined ? {} : { hash: row.entry.hash }),
+    };
+}
 /**
  * Answer a packages query against a parsed catalog. Pure — the tool's `execute`
  * is only the file read plus this call.
@@ -199,41 +301,77 @@ export function queryPackages(rawSections, { names, query, language, limit }) {
     // Presence check — the cheap, targeted path. Answers "is X available, and in
     // which track" without returning the catalog.
     if (names && names.length > 0) {
-        const index = new Map();
+        // A tracked section holds packages of the pool, thus its rows answer
+        // through `resolveQuery` — the same ladder the link of the embedder
+        // runs, so the census and the link never disagree. An untracked section
+        // (system tools, node packages) holds no package of an ecosystem, thus
+        // its rows match their rendered name without case: an identity rule
+        // covers a distribution, and `BCFtools` must still reach `bcftools`.
+        const held = [];
+        const untracked = new Map();
         for (const section of sections) {
             for (const pkg of section.packages) {
-                // First writer wins: the sections arrive in a fixed order, so a
-                // name colliding across tracks resolves to the earliest one.
-                if (!index.has(pkg.name.toLowerCase()))
-                    index.set(pkg.name.toLowerCase(), { entry: pkg, section: section.title });
+                if (section.track === undefined) {
+                    const lowered = pkg.name.toLowerCase();
+                    const rows = untracked.get(lowered) ?? [];
+                    rows.push({ entry: pkg, section: section.title });
+                    untracked.set(lowered, rows);
+                    continue;
+                }
+                held.push({ entry: pkg, section: section.title, identity: identityOf(section.track, pkg.name) });
             }
         }
-        const checked = names.map((requested) => {
-            const hit = index.get(requested.trim().toLowerCase());
-            if (!hit)
-                return { requested, present: false };
-            // `name` echoes the catalog's canonical spelling — R package names are
-            // case-sensitive at `library()`, so the exact one is what the caller needs.
-            // The store identity rides only where the source records it.
-            return {
-                requested,
-                present: true,
-                name: hit.entry.name,
-                section: hit.section,
-                ...(hit.entry.version === undefined ? {} : { version: hit.entry.version }),
-                ...(hit.entry.storeDir === undefined ? {} : { storeDir: hit.entry.storeDir }),
-                ...(hit.entry.hash === undefined ? {} : { hash: hit.entry.hash }),
-            };
+        const pool = poolIndexOf(held);
+        const bySection = new Map();
+        for (const row of held)
+            if (!bySection.has(identityKey(row.identity)))
+                bySection.set(identityKey(row.identity), row);
+        const checked = names.flatMap((requested) => {
+            // The entry speaks the one grammar, thus `python:igraph` reads as
+            // the Python track and not as a package named `python:igraph`. The
+            // listing and the planner both write that form.
+            const parsed = parseQuery(requested);
+            // A census reports a state, it never refuses a call: an entry that
+            // is not a query names nothing that the pool holds, thus it answers
+            // absent and the caller reads its own entry back.
+            if (parsed.isErr())
+                return [{ requested, present: false }];
+            const query = parsed.value;
+            const hits = [];
+            const resolution = resolveQuery(query, pool);
+            // An ambiguous spelling answers once for each track, because the
+            // caller asked about exactly that pair.
+            const identities = resolution.kind === "resolved" ? [resolution.identity] : resolution.kind === "ambiguous" ? [resolution.python, resolution.r] : [];
+            for (const identity of identities) {
+                const row = bySection.get(identityKey(identity));
+                if (row !== undefined)
+                    hits.push(presentEntry(requested, row));
+            }
+            // A track-qualified entry names one ecosystem, thus it never
+            // reaches an executable or a node module.
+            if (query.track === undefined) {
+                for (const row of untracked.get(query.spelling.toLowerCase()) ?? []) {
+                    hits.push(presentEntry(requested, { entry: row.entry, section: row.section }));
+                }
+            }
+            if (hits.length > 0)
+                return hits;
+            const suggestion = resolution.kind === "unknown" ? resolution.suggestion : undefined;
+            return [{ requested, present: false, ...(suggestion === undefined ? {} : { suggestion: suggestion.name }) }];
         });
         return { available: true, checked };
     }
-    const matchesLanguage = language ? LANGUAGE_MATCHERS[language] : () => true;
+    // A browse filter, not an identity rule: the lower case here makes a
+    // substring search forgiving, and it never decides which package a name
+    // means. The `names` path above owns that decision, and `resolveQuery` is
+    // the one place that folds.
     const needle = query?.trim().toLowerCase();
     const filtered = sections
-        .filter((s) => matchesLanguage(s.title))
+        .filter((s) => matchesLanguage(s, language))
         .map((s) => ({
         title: s.title,
         packages: needle ? s.packages.filter((p) => p.name.toLowerCase().includes(needle)) : s.packages,
+        ...(s.track === undefined ? {} : { track: s.track }),
     }))
         .filter((s) => s.packages.length > 0);
     const total = filtered.reduce((n, s) => n + s.packages.length, 0);
@@ -247,7 +385,9 @@ export function queryPackages(rawSections, { names, query, language, limit }) {
             content: `No packages match this filter${scope ? ` (${scope})` : ""}. Nothing can be installed at runtime.`,
         };
     }
-    const { content, returned } = renderListing(filtered, limit ?? DEFAULT_LIMIT);
+    // The mark reads every section, not the filtered set: a `language` listing
+    // must still say that the other track holds the same name.
+    const { content, returned } = renderListing(filtered, limit ?? DEFAULT_LIMIT, bothTrackNames(sections));
     return { available: true, total, returned, hasMore: returned < total, content };
 }
 /**
@@ -275,7 +415,9 @@ export function createListAvailablePackagesTool(deps = {}) {
         id: "list_available_packages",
         description: scopeSentence +
             "A full listing is small (a few hundred packages) and is returned whole by default, so a listing you get back is the complete set unless `hasMore` says otherwise. " +
-            '`names`: check specific packages (e.g. ["Seurat", "scanpy"]) — returns present/absent plus the language track for each, case-insensitively; this is the cheapest call and the right one for \'is X available?\'. ' +
+            '`names`: check specific packages — each entry is a query in the one grammar, `[python:|r:]<name>` (e.g. ["Seurat", "python:igraph"]) — returns present/absent plus the language track for each; this is the cheapest call and the right one for \'is X available?\'. ' +
+            "A Python name matches under PEP 503, thus `scikit_learn` reaches `scikit-learn`. An R name matches its DESCRIPTION spelling exactly, thus `seurat` answers absent and carries `Seurat` as the suggestion. " +
+            "A name that the Python track and the R track both hold answers once for each track. " +
             "`query`: case-insensitive substring filter over package names. " +
             "`language`: restrict to one track (r | python | cli | node). " +
             "`limit`: cap the packages listed; the response always carries the true `total` and a `hasMore` flag, so truncation is never silent. " +
@@ -285,7 +427,7 @@ export function createListAvailablePackagesTool(deps = {}) {
                 .array(z.string())
                 .max(100)
                 .optional()
-                .describe("Check these exact package names for presence (case-insensitive). Returns one entry per name: present/absent + the language track it lives in."),
+                .describe("Check these packages for presence. Each entry is a query in the one grammar, `[python:|r:]<name>`. Returns one entry for each track that holds the name: present/absent + the language track it lives in. An absent name carries the spelling the pool holds, where there is one."),
             query: z.string().optional().describe("Case-insensitive substring filter over package names."),
             language: z.enum(["r", "python", "cli", "node"]).optional().describe("Restrict results to one language track."),
             limit: z

package/dist/workflows/execute-analysis.d.ts

@@ -51,7 +51,10 @@
  *  5. `synthesizeFindings` (single sequential block, no sandbox)
  *  6. `collectAndComplete` (terminal — runs on ALL paths)
  *     - determine final status from completed/cancelled/failed counts
- *     - update `cortex_runs.status` + `error`
+ *     - update `cortex_runs.status` + `error`, and inside that same step record
+ *       the run outcome metric plus the outcome of every settled step whose
+ *       child never wrote its own terminal row (a cancelled child, or one that
+ *       died before `failStep`)
  *     - close running charge with matching reason
  *     - revoke run authorization via the injected `runAuthorizer` seam
  *     - emit terminal stream part

package/dist/workflows/execute-analysis.js

@@ -51,7 +51,10 @@
  *  5. `synthesizeFindings` (single sequential block, no sandbox)
  *  6. `collectAndComplete` (terminal — runs on ALL paths)
  *     - determine final status from completed/cancelled/failed counts
- *     - update `cortex_runs.status` + `error`
+ *     - update `cortex_runs.status` + `error`, and inside that same step record
+ *       the run outcome metric plus the outcome of every settled step whose
+ *       child never wrote its own terminal row (a cancelled child, or one that
+ *       died before `failStep`)
  *     - close running charge with matching reason
  *     - revoke run authorization via the injected `runAuthorizer` seam
  *     - emit terminal stream part
@@ -63,8 +66,10 @@ import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { forStep } from "../auth/types.js";
 import { createNoopLogger } from "../lib/console-logger.js";
+import { ATTR_INFLEXA_STEP_ID, stableSpan } from "../lib/otel-spans.js";
+import { recordRunCompleted, recordStepCompleted, stepOutcomeOf } from "../lib/metrics.js";
 import { unwrapOrThrow } from "../lib/result.js";
-import { RunDedupCollisionError, countArtifactsForRun, insertStepExecution, loadDataProfileStatus, queryActiveRun, queryStepArtifactPaths, seedStepExecutions, setRunSynthesisOutcome, suspendAnalysis as suspendAnalysisQuery, sweepPendingStepExecutions, updateRunStatus, updateStepExecution, } from "../state/index.js";
+import { RunDedupCollisionError, countArtifactsForRun, insertStepExecution, loadDataProfileStatus, queryActiveRun, queryStepArtifactPaths, queryStepsByRun, seedStepExecutions, setRunSynthesisOutcome, suspendAnalysis as suspendAnalysisQuery, sweepPendingStepExecutions, updateRunStatus, updateStepExecution, } from "../state/index.js";
 import { isBudgetExceeded } from "../loop/budget-exceeded.js";
 import { addChatUsage, hasReportedUsage } from "../loop/metrics.js";
 import { SYNTHESIS_AGENT_ID, loadStepSummariesFromDisk } from "../execution/run-synthesis.js";
@@ -522,8 +527,13 @@ export async function runExecuteAnalysisBody(input, deps) {
         const rowOutcome = synthesisOutcome;
         try {
             const synthEndedAtMs = await DBOS.now();
+            const rowUpdate = synthesisRowUpdate(rowOutcome, synthEndedAtMs - synthStartedAtMs);
             await DBOS.runStep(async () => {
-                unwrapOrThrow(await updateStepExecution(deps.pool, runId, SYNTHESIS_STEP_ID, synthesisRowUpdate(rowOutcome, synthEndedAtMs - synthStartedAtMs)));
+                unwrapOrThrow(await updateStepExecution(deps.pool, runId, SYNTHESIS_STEP_ID, rowUpdate));
+                // Recorded inside the step that writes the row, so a replayed body records nothing again.
+                const outcome = stepOutcomeOf(rowUpdate.status);
+                if (outcome !== undefined)
+                    recordStepCompleted({ agentId: SYNTHESIS_AGENT_ID, status: outcome, durationMs: synthEndedAtMs - synthStartedAtMs });
             }, { name: "persist-synthesis-step" });
         }
         catch (err) {
@@ -770,7 +780,11 @@ async function runSchedulerLoop(args) {
             // `completed`, so this is the first (and only) moment their results
             // can be named. Checkpointed so a replay re-dispatches the child
             // with a byte-identical prompt instead of re-reading the DB/disk.
-            const prompt = await DBOS.runStep(() => composeStepSeed({ input, stepId, runId, deps }), { name: `compose-step-seed:${stepId}` });
+            const seedStepName = `compose-step-seed:${stepId}`;
+            const prompt = await DBOS.runStep(() => {
+                stableSpan(seedStepName, "compose-step-seed", { [ATTR_INFLEXA_STEP_ID]: stepId });
+                return composeStepSeed({ input, stepId, runId, deps });
+            }, { name: seedStepName });
             const baseChildInput = buildChildInput({
                 input,
                 stepId,
@@ -1005,6 +1019,28 @@ async function collectAndComplete(args) {
     try {
         await DBOS.runStep(async () => {
             unwrapOrThrow(await updateRunStatus(deps.pool, runId, status, failureReason ?? (status === "canceled" && !budgetExceeded ? "external_cancel" : null)));
+            // The outcome metrics ride inside the step that persists the terminal status: DBOS
+            // caches the step, so a recovered body records nothing again. A step's own terminal
+            // row already carried its metric; the residue counted here is every settled step
+            // without one — a child the cancel cut before `mark-canceled` (the cancel check runs
+            // before a step body), or one that died before `failStep`. The ledger read is kept
+            // apart from the status write: a failed read costs the metrics, never the write.
+            let stepRows = [];
+            try {
+                stepRows = unwrapOrThrow(await queryStepsByRun(deps.pool, runId));
+            }
+            catch (err) {
+                logger.warn("run metrics: step ledger read failed, residual step outcomes skipped", logger.errorFields(err));
+            }
+            for (const row of stepRows) {
+                if (row.completedAt !== null)
+                    continue;
+                if (canceled.has(row.stepId))
+                    recordStepCompleted({ agentId: row.agentId, status: "canceled" });
+                else if (failed.has(row.stepId))
+                    recordStepCompleted({ agentId: row.agentId, status: "failed" });
+            }
+            recordRunCompleted({ workflow: "analysis", status, durationMs: terminalAtMs - startedAtMs });
         }, { name: "persist-final-status" });
     }
     catch (err) {

package/dist/workflows/execute-target-assessment.js

@@ -37,6 +37,7 @@ import { DBOS } from "@dbos-inc/dbos-sdk";
 import { z } from "zod";
 import { forSubAgent } from "../auth/types.js";
 import { createNoopLogger } from "../lib/console-logger.js";
+import { ATTR_INFLEXA_FANOUT_KEY, stableSpan } from "../lib/otel-spans.js";
 import { unwrapOrThrow } from "../lib/result.js";
 import { durableStep } from "../loop/run-step.js";
 import { createPubMedTool } from "../tools/bio/pubmed.js";
@@ -52,6 +53,7 @@ import { readBudgetExceededMarker } from "./target-assessment/lib/llm-step.js";
 import { assembleSafetyCorroboration } from "./target-assessment/lib/safety-corroboration.js";
 import { investigateClaims, isClaimInvestigationBudgetExceeded } from "./target-assessment/investigation/index.js";
 import { recordTerminalReason } from "./target-assessment/metrics.js";
+import { elapsedSinceIso, recordRunCompleted } from "../lib/metrics.js";
 import { phase4Assemble } from "./target-assessment/phase4-assemble.js";
 import { DossierDerivedInvariantError, DossierSchemaViolationError, phase5Persist } from "./target-assessment/phase5-persist.js";
 import { emitProgress } from "./target-assessment/progress.js";
@@ -278,9 +280,14 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
             }))
             : [];
         async function runFanoutBlock(items, stepKindForName, keyOf, fn) {
-            return Promise.all(items.map((item) => DBOS.runStep(() => fn(item), {
-                name: `ta-fanout:${stepKindForName}:${keyOf(item)}`,
-            }).catch((err) => wrapCollectorThrow(err))));
+            return Promise.all(items.map((item) => {
+                const key = keyOf(item);
+                const stepName = `ta-fanout:${stepKindForName}:${key}`;
+                return DBOS.runStep(() => {
+                    stableSpan(stepName, `ta-fanout:${stepKindForName}`, { [ATTR_INFLEXA_FANOUT_KEY]: key });
+                    return fn(item);
+                }, { name: stepName }).catch((err) => wrapCollectorThrow(err));
+            }));
         }
         const [perModulatorFaersResults, perTrialAesResults, perModulatorPolypharmResults, perClassDrugAesResults] = await Promise.all([
             runFanoutBlock(triageShortlist, "modulator-faers", (item) => item.moleculeChemblId, faersForOneModulator),
@@ -438,9 +445,19 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
     }
     // (§6.1, §6.8) Terminal block. Read the row first; if soft-deleted,
     // no-op (the user's delete during the run wins).
-    const row = await DBOS.runStep(async () => unwrapOrThrow(await getAssessment(deps.pool, input.assessmentId, input.organizationId)), {
-        name: "ta-terminal-read-row",
-    });
+    //
+    // Each terminal path records its `cortex.run.completed` outcome INSIDE the
+    // DBOS step that persists it, so a recovery replay reads the cached step
+    // and records nothing again. The duration runs from the row's `created_at`.
+    // The deleted path writes no row, so its record rides the read step itself.
+    const row = await DBOS.runStep(async () => {
+        const read = unwrapOrThrow(await getAssessment(deps.pool, input.assessmentId, input.organizationId));
+        if (read?.status === "deleted") {
+            recordRunCompleted({ workflow: "target_assessment", status: "canceled", durationMs: elapsedSinceIso(read.createdAt) });
+        }
+        return read;
+    }, { name: "ta-terminal-read-row" });
+    const recordTerminal = (status) => recordRunCompleted({ workflow: "target_assessment", status, durationMs: elapsedSinceIso(row?.createdAt) });
     if (row?.status === "deleted") {
         recordTerminalReason("deleted");
         return {
@@ -452,9 +469,10 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
     // (§6.2) Normal completion — happy path wrote `dossierForPersist`.
     if (!phase0Error && !schemaViolation && !derivedViolation && !unexpectedError && !budgetExceeded && dossierForPersist) {
         try {
-            await DBOS.runStep(async () => unwrapOrThrow(await setDossier(deps.pool, input.assessmentId, dossierForPersist)), {
-                name: "ta-terminal-completed",
-            });
+            await DBOS.runStep(async () => {
+                unwrapOrThrow(await setDossier(deps.pool, input.assessmentId, dossierForPersist));
+                recordTerminal("completed");
+            }, { name: "ta-terminal-completed" });
             await emitProgress(deps.pool, logger, input.assessmentId, "completed");
         }
         catch (err) {
@@ -470,10 +488,13 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
     }
     // (§6.3) Phase 0 throw — target unresolved.
     if (phase0Error) {
-        await DBOS.runStep(async () => unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
-            kind: "target-unresolved",
-            message: phase0Error instanceof Error ? phase0Error.message : String(phase0Error),
-        })), { name: "ta-terminal-failed-resolve" });
+        await DBOS.runStep(async () => {
+            unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
+                kind: "target-unresolved",
+                message: phase0Error instanceof Error ? phase0Error.message : String(phase0Error),
+            }));
+            recordTerminal("failed");
+        }, { name: "ta-terminal-failed-resolve" });
         await emitProgress(deps.pool, logger, input.assessmentId, "failed");
         await revokeRunAuthorizationSafe(deps, authorization, "target-assessment-failed");
         recordTerminalReason("target-unresolved");
@@ -485,11 +506,14 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
     }
     // (§6.4) Schema violation.
     if (schemaViolation) {
-        await DBOS.runStep(async () => unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
-            kind: "schema-invariant-violation",
-            message: schemaViolation.message,
-            details: schemaViolation.issues,
-        })), { name: "ta-terminal-failed-schema" });
+        await DBOS.runStep(async () => {
+            unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
+                kind: "schema-invariant-violation",
+                message: schemaViolation.message,
+                details: schemaViolation.issues,
+            }));
+            recordTerminal("failed");
+        }, { name: "ta-terminal-failed-schema" });
         await emitProgress(deps.pool, logger, input.assessmentId, "failed");
         await revokeRunAuthorizationSafe(deps, authorization, "target-assessment-failed");
         recordTerminalReason("schema-violation");
@@ -501,10 +525,13 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
     }
     // (§6.4 — derived invariant variant — same terminal class, different kind.)
     if (derivedViolation) {
-        await DBOS.runStep(async () => unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
-            kind: "derived-invariant-violation",
-            message: derivedViolation.message,
-        })), { name: "ta-terminal-failed-derived" });
+        await DBOS.runStep(async () => {
+            unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
+                kind: "derived-invariant-violation",
+                message: derivedViolation.message,
+            }));
+            recordTerminal("failed");
+        }, { name: "ta-terminal-failed-derived" });
         await emitProgress(deps.pool, logger, input.assessmentId, "failed");
         await revokeRunAuthorizationSafe(deps, authorization, "target-assessment-failed");
         recordTerminalReason("derived-invariant-violation");
@@ -523,7 +550,11 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
         await DBOS.runStep(() => readBudgetExceededMarker(), {
             name: "ta-terminal-drain-marker",
         }).catch(() => null);
-        await DBOS.runStep(async () => unwrapOrThrow(await markAssessmentSuspended(deps.pool, input.assessmentId)), { name: "ta-terminal-suspended" });
+        await DBOS.runStep(async () => {
+            unwrapOrThrow(await markAssessmentSuspended(deps.pool, input.assessmentId));
+            // A budget pause records as `canceled`, the same status the analysis run ledger gives it.
+            recordTerminal("canceled");
+        }, { name: "ta-terminal-suspended" });
         await emitProgress(deps.pool, logger, input.assessmentId, "suspended");
         await revokeRunAuthorizationSafe(deps, authorization, "target-assessment-canceled");
         const workflowId = DBOS.workflowID;
@@ -546,10 +577,13 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
     }
     // (§6.5) Unexpected throw — bug somewhere, coverage envelope failed.
     if (unexpectedError) {
-        await DBOS.runStep(async () => unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
-            kind: "unexpected-throw",
-            message: unexpectedError instanceof Error ? unexpectedError.message : String(unexpectedError),
-        })), { name: "ta-terminal-failed-unexpected" });
+        await DBOS.runStep(async () => {
+            unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
+                kind: "unexpected-throw",
+                message: unexpectedError instanceof Error ? unexpectedError.message : String(unexpectedError),
+            }));
+            recordTerminal("failed");
+        }, { name: "ta-terminal-failed-unexpected" });
         await emitProgress(deps.pool, logger, input.assessmentId, "failed");
         await revokeRunAuthorizationSafe(deps, authorization, "target-assessment-failed");
         recordTerminalReason("unexpected-throw");
@@ -562,10 +596,13 @@ export async function runExecuteTargetAssessmentBody(input, deps) {
     // Defensive: this branch is unreachable in practice (one of the
     // categories above must have fired). Fall through to a generic failed
     // status so a buggy refactor surfaces visibly.
-    await DBOS.runStep(async () => unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
-        kind: "unexpected-throw",
-        message: "terminal block reached without classified outcome",
-    })), { name: "ta-terminal-failed-uncategorized" });
+    await DBOS.runStep(async () => {
+        unwrapOrThrow(await markFailed(deps.pool, input.assessmentId, {
+            kind: "unexpected-throw",
+            message: "terminal block reached without classified outcome",
+        }));
+        recordTerminal("failed");
+    }, { name: "ta-terminal-failed-uncategorized" });
     recordTerminalReason("unexpected-throw");
     return {
         assessmentId: input.assessmentId,