@inflexa-ai/harness 0.44.0 → 0.45.0

package/dist/state/data-profile.js

@@ -144,7 +144,9 @@ export function recordDataProfileWorkflowId(pool, analysisId, workflowId) {
 }
 function terminalWriteOf(rows) {
     const row = rows[0];
-    return row === undefined ? { stamped: false } : { stamped: true, startedAt: row.data_profile_started_at ?? null };
+    return row === undefined
+        ? { stamped: false }
+        : { stamped: true, startedAt: row.data_profile_started_at ?? null, completedAt: row.data_profile_completed_at };
 }
 /**
  * Stamp a claimed-`running` row `completed` and record its result — a terminal
@@ -162,7 +164,7 @@ function terminalWriteOf(rows) {
  * guard only ever refuses a row another writer already moved on from.
  *
  * `stamped: true` when this call stamped the row, with the `data_profile_started_at`
- * of the claim it closed; `stamped: false` when the guard refused it (the row was
+ * of the claim it closed and the `data_profile_completed_at` it stamped; `stamped: false` when the guard refused it (the row was
  * cleared/expired/replayed away) — a no-op the caller logs, not an error.
  */
 export function completeDataProfile(pool, analysisId, result) {
@@ -173,7 +175,7 @@ export function completeDataProfile(pool, analysisId, result) {
             SET data_profile_status = 'completed', data_profile_completed_at = $1,
                 data_profile_result = $2::jsonb
             WHERE analysis_id = $3 AND data_profile_status = 'running'
-            RETURNING data_profile_started_at`,
+            RETURNING data_profile_started_at, data_profile_completed_at`,
             values: [now, result ? JSON.stringify(result) : null, analysisId],
         });
         return terminalWriteOf(res.rows);
@@ -188,7 +190,7 @@ export function completeDataProfile(pool, analysisId, result) {
  * prior profile survives the failure (the re-profile/retry route can keep serving it).
  *
  * `stamped: true` when this call stamped the row, with the `data_profile_started_at`
- * of the claim it closed; `stamped: false` when the guard refused it — a logged
+ * of the claim it closed and the `data_profile_completed_at` it stamped; `stamped: false` when the guard refused it — a logged
  * no-op, not an error.
  */
 export function failDataProfile(pool, analysisId, error) {
@@ -199,7 +201,7 @@ export function failDataProfile(pool, analysisId, error) {
             SET data_profile_status = 'failed', data_profile_error = $1,
                 data_profile_completed_at = $2
             WHERE analysis_id = $3 AND data_profile_status = 'running'
-            RETURNING data_profile_started_at`,
+            RETURNING data_profile_started_at, data_profile_completed_at`,
             values: [error, now, analysisId],
         });
         return terminalWriteOf(res.rows);

package/dist/state/index.d.ts

@@ -9,20 +9,21 @@
 export { initCortexState } from "./init.js";
 export type { Querier } from "./db.js";
 export { upsertAnalysis, suspendAnalysis, resumeAnalysis, loadAnalysisStatus } from "./analyses.js";
-export { upsertArtifact, upsertArtifacts, queryInputArtifacts, queryStepArtifactPaths, queryUnsyncedStepArtifacts, updateArtifactId, updateFileIds, countArtifactsForRun, } from "./artifacts.js";
-export type { RegisterArtifactInput, InputArtifactMeta, StepArtifactRef } from "./artifacts.js";
-export { insertRun, reserveRunById, RunDedupCollisionError, RunIdentityCollisionError, updateRunStatus, markRunCanceledIfActive, promoteFailedToPartial, setRunMandate, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
-setRunSynthesisOutcome, queryRun, queryActiveRun, queryNonTerminalRunsByAnalysis, queryRunsForInspection, queryRunsByAnalysis, queryRunsByThread, } from "./runs.js";
+export { upsertArtifact, upsertArtifacts, queryInputArtifacts, queryStepArtifactPaths, queryUnsyncedStepArtifacts, updateArtifactId, updateFileIds, queryArtifactPage, countArtifactsByRuns, } from "./artifacts.js";
+export type { RegisterArtifactInput, InputArtifactMeta, StepArtifactRef, ArtifactPage, ArtifactPageEntry, ArtifactPageQuery, ArtifactPageSort, RunArtifactCount, } from "./artifacts.js";
+export { insertRun, reserveRunById, RunDedupCollisionError, RunIdentityCollisionError, updateRunStatus, reconcileOrphanedRuns, ORPHANED_RUN_GRACE_MS, markRunCanceledIfActive, promoteFailedToPartial, setRunMandate, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+setRunSynthesisOutcome, queryRun, queryActiveRun, queryNonTerminalRunsByAnalysis, queryRunsForInspection, queryRunsByAnalysis, queryRunsByThread, queryRunIdsByPlan, } from "./runs.js";
 export type { InsertRunInput, RunPage, RunReservation } from "./runs.js";
 export { insertStepExecution, seedStepExecutions, sweepPendingStepExecutions, updateStepExecution, queryStepsByRun } from "./step-executions.js";
 export type { InsertStepExecutionInput, SeedStepExecutionRow, UpdateStepExecutionInput } from "./step-executions.js";
 export { setSandboxRef, clearSandboxRef, reconcileReapedSandbox } from "./active-sandboxes.js";
-export { insertPlan, upsertPlan, loadPlan } from "./plans.js";
-export type { InsertPlanInput, UpsertPlanInput } from "./plans.js";
+export { insertPlan, upsertPlan, loadPlan, loadPlanRecord } from "./plans.js";
+export type { InsertPlanInput, UpsertPlanInput, PlanRecord } from "./plans.js";
 export { tryStartDataProfile, tryRetryDataProfile, tryRerunDataProfile, completeDataProfile, failDataProfile, expireStaleDataProfile, reconcileOrphanedDataProfile, clearDataProfile, completeEmptyDataProfile, loadDataProfileStatus, loadSeedInputFileIds, recordDataProfileWorkflowId, } from "./data-profile.js";
 export type { DataProfileStatus, DataProfileTerminalWrite, DataProfileResult, DataProfileChecked, DataProfileCompanionCompleteness, DataProfileDimension, DataProfileGroup, DataProfileGroupSlot, DataProfileFile, DataProfileMemberAnnotation, DataProfileObservation, DataProfilePartition, DataProfileProbeReport, DataProfileQualityAssessment, DataProfileQuarantine, DataProfileRecipeStep, DataProfileKind, DataProfileAxis, DataProfileInputSignature, DataProfileCoverage, } from "./data-profile.js";
-export { queryRunCountsByAnalyses, queryThreadCountsByAnalyses, queryDataProfileStatusByAnalyses } from "./analyses-metrics.js";
+export { queryRunCountsByAnalyses, queryThreadCountsByAnalyses, queryDataProfileStatusByAnalyses, queryLatestRunsByAnalyses, queryRunProgressByRuns, queryRunsEndedSince, } from "./analyses-metrics.js";
+export type { DataProfileSummary, EndedRunSummary, LatestRunSummary, RunProgressSummary } from "./analyses-metrics.js";
 export { createAnalysisPurge } from "./purge-analysis.js";
 export type { AnalysisPurge, AnalysisPurgeDeps, AnalysisPurgeOutcome } from "./purge-analysis.js";
 export { AnalysisStateRowSchema, ArtifactRole, ArtifactRowSchema, RunStatus, StepExecutionStatus, SynthesisStatus, CortexRunRowSchema, StepExecutionRowSchema, CortexPlanRowSchema, } from "./schema.js";
-export type { AnalysisStateRow, ArtifactRow, CortexRunRow, StepExecutionRow, CortexPlanRow } from "./schema.js";
+export type { AnalysisStateRow, ArtifactRow, CortexRunRow, StepExecutionRow, CortexPlanRow, TerminalRunStatus } from "./schema.js";

package/dist/state/index.js

@@ -8,14 +8,14 @@
  */
 export { initCortexState } from "./init.js";
 export { upsertAnalysis, suspendAnalysis, resumeAnalysis, loadAnalysisStatus } from "./analyses.js";
-export { upsertArtifact, upsertArtifacts, queryInputArtifacts, queryStepArtifactPaths, queryUnsyncedStepArtifacts, updateArtifactId, updateFileIds, countArtifactsForRun, } from "./artifacts.js";
-export { insertRun, reserveRunById, RunDedupCollisionError, RunIdentityCollisionError, updateRunStatus, markRunCanceledIfActive, promoteFailedToPartial, setRunMandate, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
-setRunSynthesisOutcome, queryRun, queryActiveRun, queryNonTerminalRunsByAnalysis, queryRunsForInspection, queryRunsByAnalysis, queryRunsByThread, } from "./runs.js";
+export { upsertArtifact, upsertArtifacts, queryInputArtifacts, queryStepArtifactPaths, queryUnsyncedStepArtifacts, updateArtifactId, updateFileIds, queryArtifactPage, countArtifactsByRuns, } from "./artifacts.js";
+export { insertRun, reserveRunById, RunDedupCollisionError, RunIdentityCollisionError, updateRunStatus, reconcileOrphanedRuns, ORPHANED_RUN_GRACE_MS, markRunCanceledIfActive, promoteFailedToPartial, setRunMandate, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+setRunSynthesisOutcome, queryRun, queryActiveRun, queryNonTerminalRunsByAnalysis, queryRunsForInspection, queryRunsByAnalysis, queryRunsByThread, queryRunIdsByPlan, } from "./runs.js";
 export { insertStepExecution, seedStepExecutions, sweepPendingStepExecutions, updateStepExecution, queryStepsByRun } from "./step-executions.js";
 export { setSandboxRef, clearSandboxRef, reconcileReapedSandbox } from "./active-sandboxes.js";
-export { insertPlan, upsertPlan, loadPlan } from "./plans.js";
+export { insertPlan, upsertPlan, loadPlan, loadPlanRecord } from "./plans.js";
 export { tryStartDataProfile, tryRetryDataProfile, tryRerunDataProfile, completeDataProfile, failDataProfile, expireStaleDataProfile, reconcileOrphanedDataProfile, clearDataProfile, completeEmptyDataProfile, loadDataProfileStatus, loadSeedInputFileIds, recordDataProfileWorkflowId, } from "./data-profile.js";
-export { queryRunCountsByAnalyses, queryThreadCountsByAnalyses, queryDataProfileStatusByAnalyses } from "./analyses-metrics.js";
+export { queryRunCountsByAnalyses, queryThreadCountsByAnalyses, queryDataProfileStatusByAnalyses, queryLatestRunsByAnalyses, queryRunProgressByRuns, queryRunsEndedSince, } from "./analyses-metrics.js";
 // Not per-entity: one analysis's whole Postgres footprint, reached from its id
 // alone, with the workflow ledger behind an injected seam.
 export { createAnalysisPurge } from "./purge-analysis.js";

package/dist/state/migrations/20261012120000_index_the_runs_by_start.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Index the runs of an analysis by their start time, thus the read of the
+ * newest run of each analysis of a list reads one index entry for each
+ * analysis, and its cost does not grow with the run history. The index on
+ * `analysis_id` alone stays: a drop is a separate decision.
+ */
+import type { Migration } from "kysely/migration";
+export declare const indexTheRunsByStart: Migration;

package/dist/state/migrations/20261012120000_index_the_runs_by_start.js

@@ -0,0 +1,12 @@
+/**
+ * Index the runs of an analysis by their start time, thus the read of the
+ * newest run of each analysis of a list reads one index entry for each
+ * analysis, and its cost does not grow with the run history. The index on
+ * `analysis_id` alone stays: a drop is a separate decision.
+ */
+import { sql } from "kysely";
+export const indexTheRunsByStart = {
+    async up(db) {
+        await sql `CREATE INDEX IF NOT EXISTS idx_cortex_runs_analysis_started ON cortex_runs(analysis_id, started_at DESC, run_id DESC)`.execute(db);
+    },
+};

package/dist/state/migrations/20261013120000_index_the_ended_runs_and_the_recent_threads.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Index the runs by their completion time and the live threads by their update
+ * time, thus the reads over each analysis walk an index and do not sort the
+ * whole history. The thread index is partial on the live rows, the predicate of
+ * the read.
+ */
+import type { Migration } from "kysely/migration";
+export declare const indexTheEndedRunsAndTheRecentThreads: Migration;

package/dist/state/migrations/20261013120000_index_the_ended_runs_and_the_recent_threads.js

@@ -0,0 +1,13 @@
+/**
+ * Index the runs by their completion time and the live threads by their update
+ * time, thus the reads over each analysis walk an index and do not sort the
+ * whole history. The thread index is partial on the live rows, the predicate of
+ * the read.
+ */
+import { sql } from "kysely";
+export const indexTheEndedRunsAndTheRecentThreads = {
+    async up(db) {
+        await sql `CREATE INDEX IF NOT EXISTS idx_cortex_runs_completed ON cortex_runs(completed_at DESC, run_id DESC)`.execute(db);
+        await sql `CREATE INDEX IF NOT EXISTS idx_cortex_analysis_threads_recent ON cortex_analysis_threads(updated_at DESC, thread_id) WHERE deleted_at IS NULL`.execute(db);
+    },
+};

package/dist/state/migrations/20261013180000_narrow_the_active_run_index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Narrow the one-active-run index to the `running` status. A run that a host
+ * suspended is terminal, thus it no longer blocks a new run of its plan. A drop
+ * and a new index replace the index, because Postgres cannot change the
+ * predicate of an index.
+ */
+import type { Migration } from "kysely/migration";
+export declare const narrowTheActiveRunIndex: Migration;

package/dist/state/migrations/20261013180000_narrow_the_active_run_index.js

@@ -0,0 +1,13 @@
+/**
+ * Narrow the one-active-run index to the `running` status. A run that a host
+ * suspended is terminal, thus it no longer blocks a new run of its plan. A drop
+ * and a new index replace the index, because Postgres cannot change the
+ * predicate of an index.
+ */
+import { sql } from "kysely";
+export const narrowTheActiveRunIndex = {
+    async up(db) {
+        await sql `DROP INDEX IF EXISTS idx_cortex_runs_active_plan`.execute(db);
+        await sql `CREATE UNIQUE INDEX idx_cortex_runs_active_plan ON cortex_runs(analysis_id, plan_id) WHERE status = 'running'`.execute(db);
+    },
+};

package/dist/state/migrations/20261014120000_index_the_plans_by_parent_and_the_runs_by_plan.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Index the plans by their parent, thus the read of the plan that replaced a
+ * plan, and the key check when a plan row goes away, read one index entry.
+ * Index the runs by their plan, thus the read of the run ids of a plan reads
+ * only the runs of that plan.
+ */
+import type { Migration } from "kysely/migration";
+export declare const indexThePlansByParentAndTheRunsByPlan: Migration;

package/dist/state/migrations/20261014120000_index_the_plans_by_parent_and_the_runs_by_plan.js

@@ -0,0 +1,13 @@
+/**
+ * Index the plans by their parent, thus the read of the plan that replaced a
+ * plan, and the key check when a plan row goes away, read one index entry.
+ * Index the runs by their plan, thus the read of the run ids of a plan reads
+ * only the runs of that plan.
+ */
+import { sql } from "kysely";
+export const indexThePlansByParentAndTheRunsByPlan = {
+    async up(db) {
+        await sql `CREATE INDEX IF NOT EXISTS idx_cortex_plans_parent ON cortex_plans(parent_plan_id)`.execute(db);
+        await sql `CREATE INDEX IF NOT EXISTS idx_cortex_runs_plan ON cortex_runs(analysis_id, plan_id, started_at DESC, run_id DESC)`.execute(db);
+    },
+};

package/dist/state/migrations/index.js

@@ -8,10 +8,18 @@
 import { baseline } from "./20260927120000_baseline.js";
 import { threadTitleSetByUser } from "./20260927180000_thread_title_set_by_user.js";
 import { dropActiveExecTracking } from "./20261005120000_drop_the_active_exec_tracking.js";
+import { indexTheRunsByStart } from "./20261012120000_index_the_runs_by_start.js";
+import { indexTheEndedRunsAndTheRecentThreads } from "./20261013120000_index_the_ended_runs_and_the_recent_threads.js";
+import { narrowTheActiveRunIndex } from "./20261013180000_narrow_the_active_run_index.js";
+import { indexThePlansByParentAndTheRunsByPlan } from "./20261014120000_index_the_plans_by_parent_and_the_runs_by_plan.js";
 export function cortexMigrations(logger) {
     return {
         "20260927120000_baseline": baseline(logger),
         "20260927180000_thread_title_set_by_user": threadTitleSetByUser,
         "20261005120000_drop_the_active_exec_tracking": dropActiveExecTracking,
+        "20261012120000_index_the_runs_by_start": indexTheRunsByStart,
+        "20261013120000_index_the_ended_runs_and_the_recent_threads": indexTheEndedRunsAndTheRecentThreads,
+        "20261013180000_narrow_the_active_run_index": narrowTheActiveRunIndex,
+        "20261014120000_index_the_plans_by_parent_and_the_runs_by_plan": indexThePlansByParentAndTheRunsByPlan,
     };
 }

package/dist/state/plans.d.ts

@@ -54,3 +54,24 @@ export declare function upsertPlan(pool: Querier, input: UpsertPlanInput): Resul
 export declare function loadPlan(pool: Querier, planId: string, opts: {
     analysisId: string;
 }): ResultAsync<unknown | null, DbError>;
+/** A stored plan with its lineage, as {@link loadPlanRecord} reads it. */
+export interface PlanRecord {
+    planId: string;
+    /** The stored document, as the store holds it. A reader parses it. */
+    plan: unknown;
+    parentPlanId: string | null;
+    /** The newest plan of the same analysis that names this plan as its parent. */
+    supersededBy: string | null;
+    createdAt: string;
+}
+/**
+ * Analysis-scoped read of one plan with its parent and the newest plan that
+ * replaced it, in one statement. Returns `ok(null)` for an unknown planId OR a
+ * planId of a different analysis, as {@link loadPlan} does.
+ *
+ * `created_at` is ISO 8601 text, thus the text order is the time order; the plan
+ * id breaks a tie so that the answer is stable.
+ */
+export declare function loadPlanRecord(pool: Querier, planId: string, opts: {
+    analysisId: string;
+}): ResultAsync<PlanRecord | null, DbError>;

package/dist/state/plans.js

@@ -115,3 +115,28 @@ export function loadPlan(pool, planId, opts) {
         return result.rows[0]?.plan ?? null;
     });
 }
+/**
+ * Analysis-scoped read of one plan with its parent and the newest plan that
+ * replaced it, in one statement. Returns `ok(null)` for an unknown planId OR a
+ * planId of a different analysis, as {@link loadPlan} does.
+ *
+ * `created_at` is ISO 8601 text, thus the text order is the time order; the plan
+ * id breaks a tie so that the answer is stable.
+ */
+export function loadPlanRecord(pool, planId, opts) {
+    return tryQuery("plans.loadPlanRecord", async () => {
+        const result = await pool.query({
+            text: `SELECT p.plan, p.parent_plan_id, p.created_at,
+                     (SELECT c.plan_id FROM cortex_plans c
+                       WHERE c.parent_plan_id = p.plan_id AND c.analysis_id = p.analysis_id
+                       ORDER BY c.created_at DESC, c.plan_id DESC LIMIT 1) AS superseded_by
+                FROM cortex_plans p
+               WHERE p.plan_id = $1 AND p.analysis_id = $2`,
+            values: [planId, opts.analysisId],
+        });
+        const row = result.rows[0];
+        if (!row)
+            return null;
+        return { planId, plan: row.plan, parentPlanId: row.parent_plan_id, supersededBy: row.superseded_by, createdAt: row.created_at };
+    });
+}

package/dist/state/runs.d.ts

@@ -77,11 +77,33 @@ export declare function queryActiveRun(pool: Querier, analysisId: string, planId
  * analysis's live concurrency, not by its history, and a run leaves the set permanently when it
  * finishes.
  *
- * The status set is the one {@link queryActiveRun} uses — non-terminal means still running, or
- * suspended awaiting funds. Keep the two in step: a new non-terminal status added to one and not the
- * other makes a live run invisible to exactly one of its readers.
+ * The status set is the one {@link queryActiveRun} uses — non-terminal means `running`. Keep the two
+ * in step: a new non-terminal status added to one and not the other makes a live run invisible to
+ * exactly one of its readers.
  */
 export declare function queryActiveRunsByAnalysis(pool: Querier, analysisId: string): ResultAsync<CortexRunRow[], DbError>;
+/**
+ * How long a reserved run may wait for its workflow before {@link reconcileOrphanedRuns} fails it. A launch writes
+ * the workflow row seconds after the reservation, and the margin covers a slow authorization gate of a managed host.
+ */
+export declare const ORPHANED_RUN_GRACE_MS: number;
+/**
+ * Fail each `running` run that started before the grace and that has no DBOS workflow row, and give the ids of
+ * the runs that it failed.
+ *
+ * A launch reserves the run row, then starts the workflow. A host that dies between the two, or a start that throws
+ * while the following status write also fails, leaves a `running` row that no workflow will ever settle. That row
+ * holds the active-plan slot, thus each later launch of the plan answers `started: false` for a run that never
+ * started. Recovery cannot help, because no workflow row exists to recover.
+ *
+ * Only a run with no workflow row at all is failed. A run whose workflow exists, also a terminal one, is the
+ * workflow's to settle: a failed mark could misname a run that completed. Call it after `DBOS.launch()`, thus a
+ * recovered workflow is visible to the predicate.
+ */
+export declare function reconcileOrphanedRuns(pool: Querier, opts?: {
+    now?: number;
+    graceMs?: number;
+}): ResultAsync<string[], DbError>;
 export declare function updateRunStatus(pool: Querier, runId: string, status: "running" | "completed" | "partial" | "failed" | "canceled" | "suspended_insufficient_funds", error?: string | null): ResultAsync<void, DbError>;
 /**
  * Conditionally transition an ACTIVE run to `canceled`, stamping `completed_at`
@@ -99,6 +121,16 @@ export declare function queryRunsByAnalysis(pool: Querier, analysisId: string, {
     limit?: number;
     offset?: number;
 }): ResultAsync<CortexRunRow[], DbError>;
+/**
+ * The run ids of one plan of one analysis, newest start first, at most `limit`.
+ * The run id breaks a tie of start times, highest first. A plan with no run gives
+ * an empty list.
+ */
+export declare function queryRunIdsByPlan(pool: Querier, opts: {
+    analysisId: string;
+    planId: string;
+    limit: number;
+}): ResultAsync<string[], DbError>;
 /**
  * Read the analysis's non-terminal run activity without coupling it to a
  * conversation thread. The total is counted before the detail limit so a
@@ -106,8 +138,7 @@ export declare function queryRunsByAnalysis(pool: Querier, analysisId: string, {
  */
 export declare function queryNonTerminalRunsByAnalysis(pool: Querier, analysisId: string, limit?: number): ResultAsync<RunPage, DbError>;
 /**
- * Read one stable inspection page: running first, then suspended, then
- * terminal history. This is deliberately separate from
+ * Read one stable inspection page: running first, then each other run. This is deliberately separate from
  * {@link queryRunsByAnalysis}, whose chronological order is an embedder/UI
  * contract.
  */

package/dist/state/runs.js

@@ -132,7 +132,7 @@ export function queryActiveRun(pool, analysisId, planId) {
             FROM cortex_runs
             WHERE analysis_id = $1
               AND plan_id IS NOT DISTINCT FROM $2
-              AND status IN ('running','suspended_insufficient_funds')`,
+              AND status = 'running'`,
             values: [analysisId, planId],
         });
         const row = result.rows[0];
@@ -152,9 +152,9 @@ export function queryActiveRun(pool, analysisId, planId) {
  * analysis's live concurrency, not by its history, and a run leaves the set permanently when it
  * finishes.
  *
- * The status set is the one {@link queryActiveRun} uses — non-terminal means still running, or
- * suspended awaiting funds. Keep the two in step: a new non-terminal status added to one and not the
- * other makes a live run invisible to exactly one of its readers.
+ * The status set is the one {@link queryActiveRun} uses — non-terminal means `running`. Keep the two
+ * in step: a new non-terminal status added to one and not the other makes a live run invisible to
+ * exactly one of its readers.
  */
 export function queryActiveRunsByAnalysis(pool, analysisId) {
     return tryQuery("runs.queryActiveRunsByAnalysis", async () => {
@@ -164,16 +164,52 @@ export function queryActiveRunsByAnalysis(pool, analysisId) {
                    mandate_jti, mandate_expires_at, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
             FROM cortex_runs
             WHERE analysis_id = $1
-              AND status IN ('running','suspended_insufficient_funds')
+              AND status = 'running'
             ORDER BY started_at DESC`,
             values: [analysisId],
         });
         return result.rows.map(mapRunRow);
     });
 }
+/**
+ * How long a reserved run may wait for its workflow before {@link reconcileOrphanedRuns} fails it. A launch writes
+ * the workflow row seconds after the reservation, and the margin covers a slow authorization gate of a managed host.
+ */
+export const ORPHANED_RUN_GRACE_MS = 5 * 60 * 1000;
+/**
+ * Fail each `running` run that started before the grace and that has no DBOS workflow row, and give the ids of
+ * the runs that it failed.
+ *
+ * A launch reserves the run row, then starts the workflow. A host that dies between the two, or a start that throws
+ * while the following status write also fails, leaves a `running` row that no workflow will ever settle. That row
+ * holds the active-plan slot, thus each later launch of the plan answers `started: false` for a run that never
+ * started. Recovery cannot help, because no workflow row exists to recover.
+ *
+ * Only a run with no workflow row at all is failed. A run whose workflow exists, also a terminal one, is the
+ * workflow's to settle: a failed mark could misname a run that completed. Call it after `DBOS.launch()`, thus a
+ * recovered workflow is visible to the predicate.
+ */
+export function reconcileOrphanedRuns(pool, opts = {}) {
+    const now = opts.now ?? Date.now();
+    const before = new Date(now - (opts.graceMs ?? ORPHANED_RUN_GRACE_MS)).toISOString();
+    return tryMutation("runs.reconcileOrphanedRuns", async () => {
+        const result = await pool.query({
+            text: `UPDATE cortex_runs r
+            SET status = 'failed',
+                error = 'The workflow of the run never started.',
+                completed_at = $1
+            WHERE r.status = 'running'
+              AND r.started_at < $2
+              AND NOT EXISTS (SELECT 1 FROM dbos.workflow_status ws WHERE ws.workflow_uuid = r.run_id)
+            RETURNING r.run_id`,
+            values: [new Date(now).toISOString(), before],
+        });
+        return result.rows.map((row) => row.run_id);
+    });
+}
 export function updateRunStatus(pool, runId, status, error) {
     const now = new Date().toISOString();
-    const isTerminal = status === "completed" || status === "partial" || status === "failed" || status === "canceled";
+    const isTerminal = status === "completed" || status === "partial" || status === "failed" || status === "canceled" || status === "suspended_insufficient_funds";
     return tryMutation("runs.updateRunStatus", async () => {
         await pool.query({
             text: `UPDATE cortex_runs
@@ -198,7 +234,7 @@ export function markRunCanceledIfActive(pool, runId, reason) {
         const result = await pool.query({
             text: `UPDATE cortex_runs
             SET status = 'canceled', completed_at = $2, error = $3
-            WHERE run_id = $1 AND status IN ('running','suspended_insufficient_funds')`,
+            WHERE run_id = $1 AND status = 'running'`,
             values: [runId, now, reason],
         });
         return (result.rowCount ?? 0) > 0;
@@ -242,6 +278,23 @@ export function queryRunsByAnalysis(pool, analysisId, { limit = 50, offset = 0 }
         return result.rows.map(mapRunRow);
     });
 }
+/**
+ * The run ids of one plan of one analysis, newest start first, at most `limit`.
+ * The run id breaks a tie of start times, highest first. A plan with no run gives
+ * an empty list.
+ */
+export function queryRunIdsByPlan(pool, opts) {
+    return tryQuery("runs.queryRunIdsByPlan", async () => {
+        const result = await pool.query({
+            text: `SELECT run_id FROM cortex_runs
+            WHERE analysis_id = $1 AND plan_id = $2
+            ORDER BY started_at DESC, run_id DESC
+            LIMIT $3`,
+            values: [opts.analysisId, opts.planId, opts.limit],
+        });
+        return result.rows.map((row) => row.run_id);
+    });
+}
 /**
  * Read the analysis's non-terminal run activity without coupling it to a
  * conversation thread. The total is counted before the detail limit so a
@@ -253,7 +306,7 @@ export function queryNonTerminalRunsByAnalysis(pool, analysisId, limit = 20) {
             text: `SELECT COUNT(*)::int AS total
             FROM cortex_runs
             WHERE analysis_id = $1
-              AND status IN ('running','suspended_insufficient_funds')`,
+              AND status = 'running'`,
             values: [analysisId],
         });
         const rowsResult = await pool.query({
@@ -262,13 +315,8 @@ export function queryNonTerminalRunsByAnalysis(pool, analysisId, limit = 20) {
                    mandate_jti, mandate_expires_at, plan_id
             FROM cortex_runs
             WHERE analysis_id = $1
-              AND status IN ('running','suspended_insufficient_funds')
-            ORDER BY CASE status
-                         WHEN 'running' THEN 0
-                         WHEN 'suspended_insufficient_funds' THEN 1
-                         ELSE 2
-                     END,
-                     started_at DESC,
+              AND status = 'running'
+            ORDER BY started_at DESC,
                      run_id DESC
             LIMIT $2`,
             values: [analysisId, limit],
@@ -280,8 +328,7 @@ export function queryNonTerminalRunsByAnalysis(pool, analysisId, limit = 20) {
     });
 }
 /**
- * Read one stable inspection page: running first, then suspended, then
- * terminal history. This is deliberately separate from
+ * Read one stable inspection page: running first, then each other run. This is deliberately separate from
  * {@link queryRunsByAnalysis}, whose chronological order is an embedder/UI
  * contract.
  */
@@ -299,8 +346,7 @@ export function queryRunsForInspection(pool, analysisId, { limit = 50, offset =
             WHERE analysis_id = $1
             ORDER BY CASE status
                          WHEN 'running' THEN 0
-                         WHEN 'suspended_insufficient_funds' THEN 1
-                         ELSE 2
+                         ELSE 1
                      END,
                      started_at DESC,
                      run_id DESC

package/dist/state/schema.d.ts

@@ -54,6 +54,8 @@ export declare const RunStatus: z.ZodEnum<{
     suspended_insufficient_funds: "suspended_insufficient_funds";
 }>;
 export type RunStatus = z.infer<typeof RunStatus>;
+/** A status that a run keeps once it ended: every status but `running`. */
+export type TerminalRunStatus = Exclude<RunStatus, "running">;
 export declare const StepExecutionStatus: z.ZodEnum<{
     failed: "failed";
     pending: "pending";

package/dist/tasks/data-profile-activity.d.ts

@@ -103,5 +103,11 @@ export interface ProfileActivityFrame {
  * A failing write is swallowed and logged, never propagated: observation is a
  * diagnostic channel, and a dropped frame must not fail a profile that is otherwise
  * succeeding. This mirrors the sandbox-step producer's stance on the same write.
+ *
+ * Each emission writes the reconciling activity part, so a late subscriber folds to the
+ * current activity, and then one `data-activity-entry`, so it also gets each earlier line.
+ * The two parts carry one time from `now`, which the body binds to the checkpointed clock of
+ * its workflow. The two writes fail alone. The sequence number of the entry advances before
+ * the clock read and the writes, thus a failure cannot shift a later id.
  */
-export declare function createProfileActivityEmitter(write: ActivityWrite, frame: ProfileActivityFrame, logger: Logger): ProfileActivityEmitter;
+export declare function createProfileActivityEmitter(write: ActivityWrite, frame: ProfileActivityFrame, logger: Logger, now: () => Promise<number>): ProfileActivityEmitter;

package/dist/tasks/data-profile-activity.js

@@ -19,7 +19,7 @@
  * anything that throws on the way there reaches the failure path having emitted
  * no terminal at all.
  */
-import { activityForTool, stepPartId } from "../sandbox/sandbox-step-translate.js";
+import { activityEmission, activityForTool } from "../sandbox/sandbox-step-translate.js";
 /**
  * Build the profile's activity channel over `write`.
  *
@@ -30,21 +30,30 @@ import { activityForTool, stepPartId } from "../sandbox/sandbox-step-translate.j
  * A failing write is swallowed and logged, never propagated: observation is a
  * diagnostic channel, and a dropped frame must not fail a profile that is otherwise
  * succeeding. This mirrors the sandbox-step producer's stance on the same write.
+ *
+ * Each emission writes the reconciling activity part, so a late subscriber folds to the
+ * current activity, and then one `data-activity-entry`, so it also gets each earlier line.
+ * The two parts carry one time from `now`, which the body binds to the checkpointed clock of
+ * its workflow. The two writes fail alone. The sequence number of the entry advances before
+ * the clock read and the writes, thus a failure cannot shift a later id.
  */
-export function createProfileActivityEmitter(write, frame, logger) {
-    // One reconciling id for the profile's single step, so the run-stream fold
-    // collapses every phase transition latest-wins onto one frame rather than
-    // accumulating them. Minted through the shared construction because that
-    // sameness across producers is what makes the fold correct.
-    const id = stepPartId("step-activity", frame.runId, frame.stepId);
-    const emit = async (phase, activity) => {
+export function createProfileActivityEmitter(write, frame, logger, now) {
+    let seq = 0;
+    const writeAlone = async (part, phase) => {
         try {
-            await write({ type: "data-step-activity", id, runId: frame.runId, stepId: frame.stepId, phase, activity });
+            await write(part);
         }
         catch (err) {
             logger.warn("run-event write failed (non-fatal)", { phase, ...logger.errorFields(err) });
         }
     };
+    const emit = async (phase, activity) => {
+        const position = seq++;
+        const at = new Date(await now()).toISOString();
+        const parts = activityEmission(frame, position, phase, activity, at);
+        await writeAlone(parts.activity, phase);
+        await writeAlone(parts.entry, phase);
+    };
     return {
         sandboxInit: () => emit("sandbox-init", "Starting sandbox"),
         scanning: () => emit("executing", "Scanning input files"),

package/dist/tasks/data-profile.d.ts

@@ -28,7 +28,7 @@ import type { SandboxAgentDeps } from "../agents/sandbox/shared.js";
 import type { BioToolKeys } from "../tools/bio/keys.js";
 import type { ToolOutputStore } from "../loop/tool-output.js";
 import type { DbError } from "../lib/db-result.js";
-import { type GateRefusal } from "../lib/hooks.js";
+import { type GateRefusal, type NoticeFailure } from "../lib/hooks.js";
 import type { Logger } from "../lib/logger.js";
 import type { UsageRecorder } from "../billing/usage-recorder.js";
 import type { ChatProvider, EmbeddingProvider } from "../providers/types.js";
@@ -38,6 +38,15 @@ import { type ResolveWorkspaceRoot } from "../workspace/paths.js";
 import { type ProfileSubmission } from "../schemas/data-profile-schemas.js";
 import { type ProfileResolution } from "./data-profile-resolve.js";
 import { type DataProfileResult } from "../state/index.js";
+/** The settle of one profile claim: the ledger row left `running`, and the terminal write stamped it. */
+export interface DataProfileSettlement {
+    readonly analysisId: string;
+    readonly status: "completed" | "failed";
+    /** The `data_profile_completed_at` that the terminal write stamped, as an ISO 8601 string. */
+    readonly completedAt: string;
+}
+/** The notice of a profile settle. The workflow body calls it one time for each settled claim. */
+export type NotifyDataProfileSettled = (settlement: DataProfileSettlement) => ResultAsync<void, NoticeFailure>;
 /** The body's construction-time deps — closed over at registration. */
 export interface DataProfileDeps extends EnvironmentStorePaths {
     /** Operational logging seam; omitted falls back to no-op. */
@@ -73,6 +82,11 @@ export interface DataProfileDeps extends EnvironmentStorePaths {
      * Unbound keeps the current shape: no link tool, and no error.
      */
     readonly extendAnalysisFarm?: ExtendAnalysisFarm;
+    /**
+     * Notice of each profile settle, for the records of the embedder. Unbound, the
+     * body calls nothing. It is not a provenance hook.
+     */
+    readonly notifyDataProfileSettled?: NotifyDataProfileSettled;
 }
 /**
  * Workflow input. JSON-serialisable — DBOS persists it as the workflow's