@inflexa-ai/harness 0.45.0 → 0.46.0

package/dist/workflows/execute-analysis.js

@@ -39,69 +39,72 @@
  *       `partial`).
  *     - the halt cascade (cancel in-flight via
  *       `Promise.allSettled(handles.map(h => DBOS.cancelWorkflow(h.workflowID)))`,
- *       stop scheduling) survives only for a suspension of a child and the
- *       `neverFits` plan-validation guard.
- *  4. Suspension cascade (workflow-suspension spec)
- *     - a child that suspends sends a typed message on `CHILD_SUSPENDED_TOPIC`
- *       and cancels itself. The parent reads the kind of the message, never a
- *       reason string: it cancels the siblings, then self-cancels to
- *       `CANCELLED` (NOT `ERROR` — ERROR isn't resumable; NOTES #3)
- *     - a refusal of the `RunCharge.open` gate with the suspend flag suspends
- *       the run before any step starts
- *     - a `suspend` error of a synthesis model request suspends the run in
- *       place of the synthesis failure
- *     - the run row and the analysis flip to `suspended_insufficient_funds` in
- *       `collectAndComplete`. The run status is terminal and does not block a
- *       new run of the plan. The paused parent lands in `CANCELLED`, a
- *       durably reschedulable state; re-driving it is a future enhancement,
- *       not yet wired here. The reason of the host rides to the run row, the
- *       charge close, the metric, and the terminal part, unread.
+ *       stop scheduling) survives only for the `neverFits` plan-validation guard.
+ *  4. Pause (work-pause spec)
+ *     - a step pauses in its own workflow, and the parent waits for its result as
+ *       for a step that runs. The other steps go on, and the run row stays
+ *       `running`
+ *     - a refusal of the `RunCharge.open` gate with the suspend flag pauses the
+ *       run before any step starts, and the charge opens again after the resume
+ *     - a failed model request of the synthesis with a cause of a pause waits in
+ *       the loop of the synthesizer
  *  5. `synthesizeFindings` (single sequential block, no sandbox)
  *  6. `collectAndComplete` (terminal — runs on ALL paths)
  *     - determine final status from completed/cancelled/failed counts
- *     - update `cortex_runs.status` + `error`, and inside that same step record
- *       the run outcome metric plus the outcome of every settled step whose
- *       child never wrote its own terminal row (a cancelled child, or one that
- *       died before `failStep`)
- *     - close running charge with matching reason
- *     - revoke run authorization via the injected `runAuthorizer` seam
+ *     - update `cortex_runs.status` + `error`. When the write changes the row,
+ *       the same step emits `run_completed` before the commit, records the run
+ *       outcome metric plus the outcome of every settled step whose child never
+ *       wrote its own terminal row (a cancelled child, or one that died before
+ *       `failStep`), closes the running charge with the matching outcome, and
+ *       revokes the run authorization through the injected `runAuthorizer`
+ *     - the write retries with backoff on a failed transaction. When the write is
+ *       refused, or fails on each attempt, close and revoke in their own steps, then
+ *       emit `run_completed`. After a failed write the row stays `running`, so the
+ *       body records its run end as a workflow event for the run canceler
  *     - emit terminal stream part
  *     - WRITES NOTHING to the conversation thread (results are pull-only
  *       via `inspectRun`)
  */
-import { DBOS, Error as DBOSErrors } from "@dbos-inc/dbos-sdk";
+import { errorMessageOf } from "../lib/thrown.js";
+import { textOf } from "../lib/unknown-text.js";
+import { DBOS } from "@dbos-inc/dbos-sdk";
+import { isWorkflowCancellation } from "../runtime/dbos.js";
 import { err, ok } from "neverthrow";
 import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { forStep } from "../auth/types.js";
+import { RUN_END_EVENT_KEY } from "../execution/run-end-record.js";
 import { createNoopLogger } from "../lib/console-logger.js";
 import { deliverNotice, passGate } from "../lib/hooks.js";
 import { ATTR_INFLEXA_STEP_ID, stableSpan } from "../lib/otel-spans.js";
 import { recordRunCompleted, recordStepCompleted, stepOutcomeOf } from "../lib/metrics.js";
-import { describeDbError } from "../lib/db-result.js";
+import { describeDbError, withTransaction } from "../lib/db-result.js";
 import { unwrapOrThrow } from "../lib/result.js";
-import { countArtifactsByRuns, insertStepExecution, loadDataProfileStatus, queryActiveRun, queryStepArtifactPaths, queryStepsByRun, seedStepExecutions, setRunSynthesisOutcome, suspendAnalysis as suspendAnalysisQuery, sweepPendingStepExecutions, updateRunStatus, updateStepExecution, } from "../state/index.js";
+import { countArtifactsByRuns, insertStepExecution, loadDataProfileStatus, queryActiveRun, queryStepArtifactPaths, queryStepsByRun, seedStepExecutions, setRunSynthesisOutcome, sweepPendingStepExecutions, updateRunStatus, updateStepExecution, } from "../state/index.js";
+import { clearPausesOfWork } from "../state/paused-work.js";
 import { addChatUsage, hasReportedUsage } from "../loop/metrics.js";
 import { flattenDataPart } from "../contracts/chat-frame.js";
 import { SYNTHESIS_AGENT_ID, loadStepSummariesFromDisk } from "../execution/run-synthesis.js";
-import { MAX_UPSTREAM_ARTIFACTS, composeStepBriefing, emptyStepMemory } from "../prompts/briefing.js";
+import { MAX_UPSTREAM_ARTIFACTS, composeStepBriefing, emptyStepMemory, } from "../prompts/briefing.js";
 import { SYNTHESIS_STEP_ID, runDir, runStepDir, stepSubdir, stepWritePrefix, toSandboxPath } from "../workspace/paths.js";
 import { isChatDataPart, synthesisEmission } from "../sandbox/sandbox-step-translate.js";
 import { synthesizeRun } from "../app/synthesize-run.js";
 import { computeTopologicalLevels, scheduleReady, validatePlanDag } from "./execute-analysis-scheduler.js";
 import { recordCancelledChild } from "./metrics.js";
-import { CHILD_SUSPENDED_TOPIC } from "./sandbox-step.js";
-import { cancelSelf, suspensionOfFailure, suspensionOfRefusal } from "./suspension.js";
+import { pauseAtGate, workPause } from "./pause.js";
+import { presentGet } from "../lib/present.js";
 // ── In-body orchestration helpers ────────────────────────────────────
 /** Emit a chat data part on the parent's DBOS stream. */
 function emitStreamPart(part) {
     return DBOS.writeStream("events", part);
 }
 /**
- * A failed write rolls back no side effect that succeeded and never fails the
- * run. A DBOS exception passes through with no change.
+ * A failed write rolls back no side effect that succeeded. The step body logs
+ * its own failure and never throws. A DBOS exception passes through with no
+ * change.
  */
 async function ledgerStep(log, name, write) {
+    // typecheck-disable-next-line must-use-result -- a ledger miss must not fail the run
     await DBOS.runStep(async () => {
         const written = await write();
         if (written.isOk())
@@ -151,8 +154,8 @@ function buildRunObservation(args) {
                 agent: input.agentByStepId[s.id] ?? "unknown",
                 // A step absent from the map has not been reached yet; `pending` is its honest state.
                 status: rt?.status ?? "pending",
-                ...(rt?.durationMs !== undefined ? { durationMs: rt.durationMs } : {}),
-                ...(rt?.error !== undefined ? { error: rt.error } : {}),
+                durationMs: rt?.durationMs,
+                error: rt?.error,
             };
         }),
     };
@@ -183,7 +186,7 @@ function observeRunGuarded(deps, observation) {
  * projection/timeout-propagation tests.
  */
 export function buildChildInput(args) {
-    const { input, stepId, level, runId, workflowId, prompt } = args;
+    const { input, stepId, level, runId, prompt, templateBinding } = args;
     const resources = input.resourcesByStepId[stepId];
     if (!resources) {
         throw new Error(`executeAnalysis: step "${stepId}" missing from resourcesByStepId — every step must declare resources`);
@@ -205,9 +208,11 @@ export function buildChildInput(args) {
         // genuinely declared nothing, and it silently deletes every same-run edge
         // the step was entitled to.
         dependsOn: planStep.depends_on,
+        // Composed beside the seed, thus the same checkpoint carries both and a
+        // replay hands the child the binding its briefing describes.
+        templateBinding,
         level,
         prompt,
-        parentWorkflowId: workflowId,
         resources,
         timeoutSeconds: input.timeoutByStepId?.[stepId],
     };
@@ -222,13 +227,18 @@ export function buildChildInput(args) {
  * rendered any earlier (at plan submission, say) cannot mention them, and the
  * agent is left to rediscover its own upstream.
  *
- * REPLAY: the caller wraps this in a `DBOS.runStep`, so the composed string is
- * checkpointed and a replay returns it verbatim — the DB and disk are not read
- * again and cannot drift the seed under a recovered run. Never call it
- * unwrapped from the workflow body.
+ * The template contract of a grounded step is read with the package, and the
+ * plan settings are bound to it: the seed describes the binding, and the child
+ * input carries it, from one checkpoint. The child fetches nothing.
+ *
+ * REPLAY: the caller wraps this in a `DBOS.runStep`, so the composed seed is
+ * checkpointed and a replay returns it verbatim — the DB, the disk, and the
+ * knowledge service are not read again and cannot drift the seed under a
+ * recovered run. Never call it unwrapped from the workflow body.
  */
 export async function composeStepSeed(args) {
-    return composeStepBriefing(await gatherStepPackage(args));
+    const { briefing, templateBinding } = await gatherStepPackage(args);
+    return { prompt: composeStepBriefing(briefing), templateBinding };
 }
 /**
  * Do every read of one step's package and give the data its seed is rendered
@@ -242,6 +252,9 @@ export async function composeStepSeed(args) {
  * so an edit during a run reaches each later step, and two steps of one run
  * can carry different copies.
  *
+ * The contract of the template a grounded step renders is read here too, from
+ * the knowledge client, and the plan settings are bound to it.
+ *
  * A read failure throws (house rules): a swallowed error would be frozen into
  * the checkpointed seed and served to every replay of this step.
  */
@@ -282,12 +295,149 @@ export async function gatherStepPackage(args) {
         agentByStepId: input.agentByStepId,
         pool: deps.pool,
     });
+    const contract = await resolveTemplateContract(step, deps.knowledge);
+    return {
+        briefing: {
+            step,
+            workspace,
+            profile: profile?.result ?? null,
+            upstream,
+            memory: { goal: memory.goal, constraints: memory.constraints },
+            ...contract.briefing,
+        },
+        templateBinding: contract.binding,
+    };
+}
+/** A served contract carries no `match`; the two refusals do. */
+function isTemplateContract(answer) {
+    return !("match" in answer);
+}
+/**
+ * Fetch the contract of the template a step grounds on, and bind the plan
+ * settings to it. A step without a template has no template part. A step
+ * with one and no way to read it (no client, no answer, or an unknown
+ * template) gets the reason, thus the seed reports the absence rather than
+ * hiding it, and no binding.
+ */
+async function resolveTemplateContract(step, client) {
+    const ref = step.grounding?.template;
+    if (!ref)
+        return { briefing: {} };
+    if (!client)
+        return { briefing: { templateNotRetrieved: "no knowledge client is bound" } };
+    const answer = await client.contract(ref);
+    if (!isTemplateContract(answer)) {
+        const reason = answer.match === "unavailable"
+            ? `the knowledge service did not answer: ${answer.reason}`
+            : `the knowledge service refused the lookup: ${answer.message}`;
+        return { briefing: { templateNotRetrieved: reason } };
+    }
+    return bindTemplateContract(ref, answer, step.grounding?.settings ?? [], {
+        stepId: step.id,
+        claims: step.grounding?.claims ?? [],
+        snapshot: step.grounding?.snapshot && step.grounding.snapshot !== "none" ? step.grounding.snapshot : undefined,
+    });
+}
+/** The version of a template reference (`tpl-x@1.0.0` gives `1.0.0`), or `undefined` when the reference has none. */
+function versionOfRef(ref) {
+    const at = ref.indexOf("@");
+    return at < 0 ? undefined : ref.slice(at + 1);
+}
+/** Two setting values agree when their JSON agrees: the values are scalars or lists of strings. */
+function sameSettingValue(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/**
+ * Whether a plan value is a value of the slot, and not a policy word. A
+ * procedure parameter and a template slot share a name, but not always a
+ * value domain: `min_samples = smallest_group_size` names a rule the agent
+ * applies, and the slot takes the resulting integer. Only a member of the
+ * enum of the slot, a number for a number slot, or a boolean for a boolean
+ * slot binds. A free-text slot never binds, because the host cannot tell a
+ * policy word from a value there.
+ */
+function fitsSlot(slot, value) {
+    if (slot.enum)
+        return typeof value === "string" && slot.enum.includes(value);
+    if (slot.type === "integer" || slot.type === "number")
+        return typeof value === "number";
+    if (slot.type === "boolean")
+        return typeof value === "boolean";
+    return false;
+}
+function bindTemplateContract(ref, contract, settings, grounding) {
+    const refVersion = versionOfRef(ref);
+    const versionMatches = refVersion === undefined || refVersion === contract.version;
+    const adaptable = contract.parameters.filter((slot) => slot.adaptable);
+    const adaptableNames = new Set(adaptable.map((slot) => slot.name));
+    const pinnedByName = new Map(contract.parameters.filter((slot) => !slot.adaptable).map((slot) => [slot.name, slot]));
+    const bound = [];
+    const unbound = [];
+    const slots = {};
+    const sources = {};
+    for (const setting of settings) {
+        const shown = `\`${setting.name}\` = ${JSON.stringify(setting.value)} (${setting.step})`;
+        if (!versionMatches) {
+            unbound.push(`${shown}: not bound, because the served version differs from the plan`);
+            continue;
+        }
+        if (adaptableNames.has(setting.name)) {
+            const slot = adaptable.find((candidate) => candidate.name === setting.name);
+            if (slot && !fitsSlot(slot, setting.value)) {
+                unbound.push(`${shown}: a policy of the plan, not a value of the \`${setting.name}\` slot (${slot.type}); state the value it gives`);
+                continue;
+            }
+            const prior = slots[setting.name];
+            if (prior !== undefined) {
+                if (!sameSettingValue(prior, setting.value))
+                    unbound.push(`${shown}: differs from the bound value ${JSON.stringify(prior)} of the same slot`);
+                continue;
+            }
+            slots[setting.name] = setting.value;
+            if (setting.source)
+                sources[setting.name] = setting.source;
+            bound.push({ name: setting.name, value: setting.value, source: setting.source ?? "plan" });
+            continue;
+        }
+        const pinned = pinnedByName.get(setting.name);
+        if (pinned) {
+            const pinnedValue = pinned.default === undefined ? "a fixed value" : JSON.stringify(pinned.default);
+            unbound.push(sameSettingValue(pinned.default, setting.value)
+                ? `${shown}: pinned by the template at the same value`
+                : `${shown}: the template pins \`${setting.name}\` at ${pinnedValue}, and the plan value cannot be sent`);
+            continue;
+        }
+        unbound.push(`${shown}: no slot of the template carries it`);
+    }
     return {
-        step,
-        workspace,
-        profile: profile?.result ?? null,
-        upstream,
-        memory: { goal: memory.goal, constraints: memory.constraints },
+        briefing: {
+            template: {
+                ref,
+                version_served: contract.version,
+                slots: adaptable,
+                inputs: (contract.inputs ?? []).map((input) => ({
+                    name: input.name,
+                    path: input.path,
+                    description: input.description,
+                })),
+                bound,
+                unbound_settings: unbound,
+            },
+        },
+        binding: versionMatches
+            ? {
+                template: ref,
+                slots,
+                sources,
+                step: grounding.stepId,
+                claims: grounding.claims,
+                snapshot: grounding.snapshot,
+                // The local slots of the contract, thus the tool binds a path or a column name on the machine
+                // without a second read of the contract.
+                local: contract.parameters.filter((slot) => slot.local === true),
+                adaptable: adaptable.map((slot) => slot.name),
+            }
+            : undefined,
     };
 }
 /**
@@ -330,13 +480,10 @@ async function collectUpstreamHandoffs(args) {
  * its reason in `blockedReason` — an honest agent-declared blocker, not an
  * error — and a failure carries the same reason string
  * `persist-synthesis-outcome` writes to `cortex_runs.synthesis_reason`, so the
- * two ledgers cannot disagree about why synthesis died. A suspension is not an
- * outcome: the row is canceled, as the row of a suspended step. Exported for
- * the projection tests (the `buildChildInput` pattern).
+ * two ledgers cannot disagree about why synthesis died. Exported for the
+ * projection tests (the `buildChildInput` pattern).
  */
 export function synthesisRowUpdate(outcome, durationMs) {
-    if ("kind" in outcome)
-        return { status: "canceled", durationMs, error: outcome.reason };
     switch (outcome.status) {
         case "produced":
             return { status: "completed", durationMs };
@@ -355,9 +502,11 @@ export function synthesisRowUpdate(outcome, durationMs) {
 /**
  * Run-level literature-grounded synthesis (no sandbox). Returns the
  * quick-display findings for the run-completed card; empty when synthesis is
- * skipped or produced no synthesizable content. A genuine failure re-throws
- * inside the caller's `DBOS.runStep`, failing the run (D10). Exported so
- * integration tests can drive the wired synthesis without a full parent body.
+ * skipped or produced no synthesizable content. A genuine failure re-throws,
+ * failing the run (D10). It runs in the body of the run workflow: each read and
+ * write is a step, each model call is a step, and each reviewer call starts a
+ * child workflow. Exported so integration tests can drive the wired synthesis
+ * without a full parent body.
  */
 export function synthesizeFindings(args) {
     const { analysisId, runId, completedSteps, session, deps } = args;
@@ -388,10 +537,9 @@ export function synthesizeFindings(args) {
         embedding: deps.embedding,
         resolveWorkspaceRoot: deps.resolveWorkspaceRoot,
         synthesisModel: deps.synthesisModel,
-        bioKeys: deps.bioKeys,
-        citationResolver: deps.citationResolver,
+        literatureReviewer: deps.literatureReviewer,
         usageRecorder: deps.usageRecorder,
-        ...(deps.toolOutputStore ? { toolOutputStore: deps.toolOutputStore } : {}),
+        toolOutputStore: deps.toolOutputStore,
     }, {
         analysisId,
         runId,
@@ -408,9 +556,10 @@ export function synthesizeFindings(args) {
         // call path.
         session: forStep(session, SYNTHESIS_STEP_ID),
         emit,
+        pause: args.pause?.afterFailure,
+        durably: (name, run) => DBOS.runStep(run, { name }),
         onProgress: async (phase, activity, extra = {}) => {
-            // Synthesis runs inside one `DBOS.runStep`, thus `DBOS.now()` reads the wall clock here, and a rerun of
-            // the step after a crash writes its entries again under the same ids. A reader dedups an entry by id.
+            // The body checkpoints the clock and each write, thus a replay writes no entry again.
             const seq = progressSeq++;
             const at = new Date(await DBOS.now()).toISOString();
             const parts = synthesisEmission(runId, SYNTHESIS_STEP_ID, seq, phase, activity, at, extra);
@@ -448,7 +597,17 @@ export async function runExecuteAnalysisBody(input, deps) {
     // the run authorization is already minted and rides in `input.runSession`.
     const runId = input.runSession.runFrame.runId;
     const workflowId = runId;
-    const init = await validateAndInit(input, runId, deps);
+    const pause = workPause({
+        pool: deps.pool,
+        workId: runId,
+        workKind: "run",
+        analysisId: input.analysisId,
+        emit: emitStreamPart,
+        retryDelaysMs: deps.pauseRetryDelaysMs,
+        run: { session: input.runSession, authorizer: deps.runAuthorizer },
+        logger,
+    });
+    const init = await validateAndInit(input, runId, deps, pause);
     if (init.kind === "joined-existing") {
         return {
             runId: init.runId,
@@ -460,7 +619,6 @@ export async function runExecuteAnalysisBody(input, deps) {
         };
     }
     if (init.kind === "charge-refused") {
-        const suspension = suspensionOfRefusal(init.refusal) ?? null;
         const refusedAtMs = await DBOS.now();
         const refused = await collectAndComplete({
             input,
@@ -470,16 +628,13 @@ export async function runExecuteAnalysisBody(input, deps) {
             completed: new Set(),
             failed: new Set(),
             canceled: new Set(),
-            suspension,
             failureReason: init.refusal.reason,
-            forceFailed: suspension === null,
+            forceFailed: true,
             findings: [],
             synthesisOutcome: null,
             deps,
         });
         observeRunGuarded(deps, buildRunObservation({ input, runId, status: refused.status, stepStates: new Map() }));
-        if (suspension !== null)
-            return cancelSelf("self-cancel-suspended");
         return refused;
     }
     // Seed the full DAG as `pending` rows so ledger readers see every step from
@@ -550,12 +705,11 @@ export async function runExecuteAnalysisBody(input, deps) {
     // still run the terminal block (close charge + revoke run authorization), and re-throw
     // after so the workflow record goes to ERROR.
     let synthesisError = null;
-    let synthesisSuspension = null;
+    let synthesisMessage;
     let synthesisFindings = [];
     // Null when synthesis never ran (disabled or no completed steps): the ledger
     // columns stay NULL — "unknown", not a recorded skip — and the seeded
-    // `synthesis` row (if any) stays `pending` for the terminal sweep. Also null
-    // when synthesis suspended: a resume of the run gives the outcome.
+    // `synthesis` row (if any) stays `pending` for the terminal sweep.
     let synthesisOutcome = null;
     if (synthesisEnabled && final.completed.size > 0) {
         // Bracketing clock reads for the row's duration_ms — checkpointed, so a
@@ -575,13 +729,14 @@ export async function runExecuteAnalysisBody(input, deps) {
         }));
         let rowOutcome;
         try {
-            const synthOut = await DBOS.runStep(() => synthesizeFindings({
+            const synthOut = await synthesizeFindings({
                 analysisId: input.analysisId,
                 runId,
                 completedSteps: [...final.completed],
                 session: input.runSession,
                 deps,
-            }), { name: "synthesize-findings" });
+                pause,
+            });
             synthesisFindings = synthOut.findings;
             synthesisOutcome = { status: synthOut.synthesisStatus, reason: synthOut.synthesisReason };
             rowOutcome = synthesisOutcome;
@@ -594,20 +749,14 @@ export async function runExecuteAnalysisBody(input, deps) {
             // this path either, so the run row is equally non-terminal and the pair
             // stays consistent — the pre-existing cancelled-mid-flight wedge shape
             // `inflexa run` already detects via its DBOS-status cross-check.
-            if (err instanceof DBOSErrors.DBOSWorkflowCancelledError)
+            if (isWorkflowCancellation(err))
                 throw err;
-            const suspended = suspensionOfFailure(err);
-            if (suspended !== undefined) {
-                synthesisSuspension = suspended;
-                rowOutcome = suspended;
-                logger.warn("synthesizeFindings suspended — suspending the run", { runId, reason: suspended.reason });
-            }
-            else {
-                synthesisError = err;
-                synthesisOutcome = { status: "failed", reason: err instanceof Error ? err.message : String(err) };
-                rowOutcome = synthesisOutcome;
-                logger.error("synthesizeFindings failed — failing the run", { runId, ...logger.errorFields(err) });
-            }
+            // A failure with a cause of a pause waited in the loop of the synthesizer, thus this one fails the run.
+            synthesisError = err;
+            synthesisMessage = errorMessageOf(err);
+            synthesisOutcome = { status: "failed", reason: errorMessageOf(err) ?? textOf(err) };
+            rowOutcome = synthesisOutcome;
+            logger.error("synthesizeFindings failed — failing the run", { runId, ...logger.errorFields(err) });
         }
         // Terminal stamp for the `synthesis` row — deliberately BEFORE
         // `collectAndComplete` writes the run row's terminal status, so no reader
@@ -627,7 +776,6 @@ export async function runExecuteAnalysisBody(input, deps) {
     // (6) collectAndComplete — terminal block. Runs on EVERY path. When synthesis
     // failed, force a failed terminal status so the charge/run-authorization close correctly
     // and the run row + stream report the failure before we re-throw.
-    const suspension = final.suspension ?? synthesisSuspension;
     const result = await collectAndComplete({
         input,
         runId,
@@ -636,15 +784,8 @@ export async function runExecuteAnalysisBody(input, deps) {
         completed: final.completed,
         failed: final.failed,
         canceled: final.canceled,
-        suspension,
-        ...(final.usage ? { usage: final.usage } : {}),
-        failureReason: synthesisError
-            ? synthesisError instanceof Error
-                ? `synthesis-failed: ${synthesisError.message}`
-                : "synthesis-failed"
-            : final.suspension === null && synthesisSuspension !== null
-                ? synthesisSuspension.reason
-                : final.failureReason,
+        usage: final.usage,
+        failureReason: synthesisError === null ? final.failureReason : synthesisMessage === undefined ? "synthesis-failed" : `synthesis-failed: ${synthesisMessage}`,
         forceFailed: synthesisError !== null,
         findings: synthesisFindings,
         synthesisOutcome,
@@ -652,20 +793,15 @@ export async function runExecuteAnalysisBody(input, deps) {
     });
     // Terminal snapshot, fired here rather than inside `collectAndComplete` because this is the
     // first point where BOTH the derived final status and the scheduler's final step map are in
-    // hand. It precedes the suspension self-cancel below on purpose: that branch raises out of the
-    // body, so an observer placed after it would never see a suspended run's last state.
+    // hand.
     observeRunGuarded(deps, buildRunObservation({ input, runId, status: result.status, stepStates: final.stepStates }));
-    // Synthesis failure takes priority over the suspension cascade: a run whose
-    // synthesis threw is definitively failed (ERROR), not a resumable
-    // suspension. Only self-cancel when synthesis did not throw a failure.
-    if (suspension !== null && synthesisError === null)
-        return cancelSelf("self-cancel-suspended");
     // Re-throw after the terminal block so the workflow record goes to ERROR.
+    // oxlint-disable-next-line typescript/only-throw-error -- the caught synthesis failure rides as-is so the workflow record fails with the original cause; a wrapper would erase its identity.
     if (synthesisError !== null)
         throw synthesisError;
     return result;
 }
-async function validateAndInit(input, runId, deps) {
+async function validateAndInit(input, runId, deps, pause) {
     // The cortex_runs row already exists (inserted by `executePlan`). Sanity-
     // check that no other active run for the same plan won the race — the
     // partial-unique index would have rejected the insert if so, so this is
@@ -682,11 +818,17 @@ async function validateAndInit(input, runId, deps) {
             recursive: true,
         });
     }, { name: "init-run-filesystem" });
-    const opened = await DBOS.runStep(async () => await passGate("RunCharge.open", deps.runCharge.open({
+    const openCharge = () => DBOS.runStep(async () => await passGate("RunCharge.open", deps.runCharge.open({
         analysisId: input.analysisId,
         runId,
         session: input.runSession,
     })), { name: "open-running-charge" });
+    let opened = await openCharge();
+    // A refusal with the suspend flag waits in a pause, and the charge opens again after the resume.
+    while (opened.isErr() && opened.error.kind === "suspended") {
+        await pauseAtGate(pause, opened.error.reason);
+        opened = await openCharge();
+    }
     if (opened.isErr())
         return { kind: "charge-refused", refusal: opened.error };
     return { kind: "fresh" };
@@ -697,14 +839,13 @@ async function runSchedulerLoop(args) {
     const failed = new Set();
     const canceled = new Set();
     const inFlight = new Map();
-    const childSuspensions = new Map();
     // Run-level usage aggregate, folded from the children's own durable results.
     // `getResult` IS the replay-safe source: a recovered parent reads back the
     // identical value from each child's workflow record, so the sum reproduces
     // exactly without a second channel. A child that settled by throwing carries
     // no result and therefore contributes nothing — same rule as its duration.
     const runUsage = {};
-    // Child workflow ids the parent itself cancelled (suspension / neverFits halt cascade). Their `getResult`
+    // Child workflow ids the parent itself cancelled (the neverFits halt cascade). Their `getResult`
     // rejects with a DBOS cancellation error and lands in the settlement error branch — but the step was
     // CANCELED by us, not failed on its own merits. Keyed here (deterministic: `cancelInFlight` runs the
     // same way on a replay) so that branch records it as canceled everywhere, matching how a child that
@@ -738,26 +879,18 @@ async function runSchedulerLoop(args) {
         const stack = [...(dependentsByStepId.get(failedStepId) ?? [])];
         while (stack.length > 0) {
             const id = stack.pop();
-            if (stepRuntime.get(id).status === "pending") {
+            if (id === undefined)
+                break;
+            if (presentGet(stepRuntime, id, "the runtime of the step").status === "pending") {
                 stepRuntime.set(id, { status: "skipped" });
                 stack.push(...(dependentsByStepId.get(id) ?? []));
             }
         }
     };
-    // Halts scheduling entirely — reserved for a suspension of a child and the
-    // `neverFits` guard. An ordinary step failure does NOT set it: it dooms
-    // only that step's transitive dependents.
+    // Halts scheduling entirely — reserved for the `neverFits` guard. An ordinary
+    // step failure does NOT set it: it dooms only that step's transitive dependents.
     let halted = false;
-    let suspension = null;
     let failureReason = null;
-    const haltForSuspension = async (child) => {
-        if (suspension === null) {
-            suspension = { kind: "suspended", reason: child.reason };
-            halted = true;
-            failureReason = child.reason;
-        }
-        await cancelInFlight(inFlight, child.reason, canceledByParent);
-    };
     const stepIndexById = new Map(input.steps.map((s, i) => [s.id, i]));
     const emitDagSnapshot = async () => {
         await emitStreamPart({
@@ -765,7 +898,7 @@ async function runSchedulerLoop(args) {
             id: `dag-${runId}`,
             runId,
             steps: input.steps.map((s) => {
-                const rt = stepRuntime.get(s.id);
+                const rt = presentGet(stepRuntime, s.id, "the runtime of the step");
                 const entry = {
                     id: s.id,
                     // `input.steps` is the SCHEDULER's projection — `{id, depends_on}` and nothing
@@ -798,7 +931,6 @@ async function runSchedulerLoop(args) {
         // the body once `collectAndComplete` has derived the final status.
         observeRunGuarded(deps, buildRunObservation({ input, runId, status: "running", stepStates: stepRuntime }));
     };
-    const dbosParentId = DBOS.workflowID ?? workflowId;
     const dispatchReady = async () => {
         if (halted)
             return;
@@ -832,13 +964,13 @@ async function runSchedulerLoop(args) {
                     });
                 }
                 halted = true;
-                failureReason = `step "${scheduled.neverFits[0]}" exceeds the machine resource budget`;
+                failureReason = `step "${String(scheduled.neverFits[0])}" exceeds the machine resource budget`;
                 await cancelInFlight(inFlight, "fail_fast", canceledByParent);
                 await emitDagSnapshot();
                 return;
             }
             for (const stepId of scheduled.heldForCapacity) {
-                if (stepRuntime.get(stepId).status !== "queued") {
+                if (presentGet(stepRuntime, stepId, "the runtime of the step").status !== "queued") {
                     stepRuntime.set(stepId, { status: "queued" });
                     queuedChanged = true;
                 }
@@ -854,33 +986,35 @@ async function runSchedulerLoop(args) {
             return;
         }
         for (const stepId of admit) {
-            const idx = stepIndexById.get(stepId);
+            const idx = presentGet(stepIndexById, stepId, "the index of the step");
             const childWorkflowId = `${workflowId}-${idx}`;
             // Compose the seed HERE — the dependencies of `stepId` are all in
             // `completed`, so this is the first (and only) moment their results
             // can be named. Checkpointed so a replay re-dispatches the child
             // with a byte-identical prompt instead of re-reading the DB/disk.
             const seedStepName = `compose-step-seed:${stepId}`;
-            const prompt = await DBOS.runStep(() => {
+            const checkpointed = await DBOS.runStep(() => {
                 stableSpan(seedStepName, "compose-step-seed", { [ATTR_INFLEXA_STEP_ID]: stepId });
                 return composeStepSeed({ input, stepId, runId, deps });
             }, { name: seedStepName });
+            // A run recovered from a checkpoint written when this step returned the
+            // bare seed string replays that string: it carries no binding.
+            const seed = typeof checkpointed === "string" ? { prompt: checkpointed } : checkpointed;
             const baseChildInput = buildChildInput({
                 input,
                 stepId,
                 level: levels.get(stepId) ?? 0,
                 runId,
-                workflowId,
-                prompt,
+                prompt: seed.prompt,
+                templateBinding: seed.templateBinding,
             });
             const childInput = {
                 ...baseChildInput,
-                parentWorkflowId: dbosParentId,
                 runSession: forStep(input.runSession, stepId),
             };
-            const handle = (await DBOS.startWorkflow(deps.sandboxStepCallable, {
+            const handle = await DBOS.startWorkflow(deps.sandboxStepCallable, {
                 workflowID: childWorkflowId,
-            })(childInput));
+            })(childInput);
             inFlight.set(childWorkflowId, { stepId, handle });
             stepRuntime.set(stepId, { status: "running" });
         }
@@ -894,7 +1028,7 @@ async function runSchedulerLoop(args) {
         // function-ID-consuming ops and diverge the counter on replay.
         const winner = await DBOS.waitFirst([...inFlight.values()].map((e) => e.handle));
         const childId = winner.workflowID;
-        const entry = inFlight.get(childId);
+        const entry = presentGet(inFlight, childId, "the in-flight entry of the winning child");
         inFlight.delete(childId);
         let settled;
         try {
@@ -904,8 +1038,6 @@ async function runSchedulerLoop(args) {
         catch (err) {
             settled = { childId, stepId: entry.stepId, kind: "error", err };
         }
-        await drainChildSuspensions(childSuspensions);
-        const childSuspension = childSuspensions.get(settled.childId);
         // Terminal step status + duration for the provenance emission below. Every
         // settlement branch assigns both, so the emission fires exactly once per
         // settled child with the mapped status.
@@ -918,24 +1050,22 @@ async function runSchedulerLoop(args) {
                 completed.add(settled.stepId);
                 stepRuntime.set(settled.stepId, {
                     status: "completed",
-                    durationMs: r.durationMs ?? undefined,
+                    durationMs: r.durationMs,
                 });
                 stepStatus = "completed";
-                stepDurationMs = r.durationMs ?? undefined;
+                stepDurationMs = r.durationMs;
                 await emitDagSnapshot();
                 await dispatchReady();
             }
             else if (r.status === "canceled") {
                 canceled.add(settled.stepId);
-                if (childSuspension !== undefined)
-                    await haltForSuspension(childSuspension);
                 stepRuntime.set(settled.stepId, {
                     status: "failed",
-                    durationMs: r.durationMs ?? undefined,
+                    durationMs: r.durationMs,
                     error: r.error ?? "canceled",
                 });
                 stepStatus = "canceled";
-                stepDurationMs = r.durationMs ?? undefined;
+                stepDurationMs = r.durationMs;
                 await emitDagSnapshot();
             }
             else {
@@ -948,18 +1078,18 @@ async function runSchedulerLoop(args) {
                 failureReason ??= r.error ?? (r.status === "blocked" ? "step_blocked" : "step_failed");
                 stepRuntime.set(settled.stepId, {
                     status: "failed",
-                    durationMs: r.durationMs ?? undefined,
+                    durationMs: r.durationMs,
                     error: r.error ?? (r.status === "blocked" ? "step_blocked" : "step_failed"),
                 });
                 markDependentsSkipped(settled.stepId);
                 stepStatus = "failed";
-                stepDurationMs = r.durationMs ?? undefined;
+                stepDurationMs = r.durationMs;
                 await emitDagSnapshot();
                 await dispatchReady();
             }
         }
         else if (canceledByParent.has(settled.childId)) {
-            // The child threw because the PARENT cancelled it (suspension / neverFits halt cascade), not
+            // The child threw because the PARENT cancelled it (the neverFits halt cascade), not
             // because it failed on its own — its `getResult` rejects with a DBOS cancellation error.
             // Record it as canceled, mirroring the graceful `{status:"canceled"}` branch above so the
             // `canceled` set, the terminal result, and the `step_completed` provenance all agree. No
@@ -969,34 +1099,22 @@ async function runSchedulerLoop(args) {
                 // `stepRuntime` (the DAG snapshot) has no canceled tier; the graceful-cancel branch above
                 // likewise renders canceled steps as "failed", so this stays consistent with it.
                 status: "failed",
-                error: settled.err instanceof Error ? settled.err.message : String(settled.err),
+                error: errorMessageOf(settled.err) ?? textOf(settled.err),
             });
             stepStatus = "canceled";
             stepDurationMs = undefined;
             await emitDagSnapshot();
         }
-        else if (childSuspension !== undefined) {
-            // The child suspended: it sent its typed suspension, then cancelled
-            // itself, thus `getResult` rejects with a DBOS cancellation. The
-            // suspension halts the run — the cascade is a decision of the host,
-            // not a DAG one — and it dooms no dependent: the resumed run needs them.
-            canceled.add(settled.stepId);
-            await haltForSuspension(childSuspension);
-            stepRuntime.set(settled.stepId, { status: "failed", error: childSuspension.reason });
-            stepStatus = "canceled";
-            stepDurationMs = undefined;
-            await emitDagSnapshot();
-        }
         else {
-            // The child threw on its own (not a parent-driven cancel, not a
-            // suspension). A throw is treated exactly like a step failure:
+            // The child threw on its own (not a parent-driven cancel). A throw is
+            // treated exactly like a step failure:
             // dependents doomed, siblings continue.
             failed.add(settled.stepId);
-            failureReason ??= settled.err instanceof Error ? settled.err.message : String(settled.err);
+            failureReason ??= errorMessageOf(settled.err) ?? textOf(settled.err);
             markDependentsSkipped(settled.stepId);
             stepRuntime.set(settled.stepId, {
                 status: "failed",
-                error: settled.err instanceof Error ? settled.err.message : String(settled.err),
+                error: errorMessageOf(settled.err) ?? textOf(settled.err),
             });
             stepStatus = "failed";
             // A child that settled by throwing carries no durable duration.
@@ -1017,30 +1135,19 @@ async function runSchedulerLoop(args) {
             runId,
             stepId: settled.stepId,
             status: stepStatus,
-            ...(stepDurationMs !== undefined ? { durationMs: stepDurationMs } : {}),
+            durationMs: stepDurationMs,
             atMs: settledAtMs,
         }, input.runSession);
     }
-    await drainChildSuspensions(childSuspensions);
     return {
         completed,
         failed,
         canceled,
-        suspension,
         failureReason,
         stepStates: stepRuntime,
-        ...(hasReportedUsage(runUsage) ? { usage: { ...runUsage } } : {}),
+        usage: hasReportedUsage(runUsage) ? { ...runUsage } : undefined,
     };
 }
-async function drainChildSuspensions(suspensions) {
-    while (true) {
-        const msg = await DBOS.recv(CHILD_SUSPENDED_TOPIC, 0);
-        if (!msg)
-            return;
-        if (msg.kind === "suspended" && !suspensions.has(msg.childWorkflowId))
-            suspensions.set(msg.childWorkflowId, msg);
-    }
-}
 async function cancelInFlight(inFlight, cause, canceledByParent) {
     const ids = [...inFlight.keys()];
     // Record every id BEFORE the cancel so the settlement loop classifies the resulting
@@ -1052,10 +1159,11 @@ async function cancelInFlight(inFlight, cause, canceledByParent) {
         recordCancelledChild({ cause });
     }
 }
+// ── (6) collectAndComplete ────────────────────────────────────────────
+/** The waits between the attempts are 1, 2, 4, and 8 seconds. */
+const FINAL_STATUS_WRITE_RETRY = { retriesAllowed: true, maxAttempts: 5, intervalSeconds: 1, backoffRate: 2 };
 async function collectAndComplete(args) {
-    const { input, runId, workflowId, startedAtMs, completed, failed, canceled, suspension, failureReason, forceFailed, deps } = args;
-    // A forced failure is terminal and never a resumable suspension.
-    const suspended = suspension !== null && !forceFailed ? suspension : null;
+    const { input, runId, workflowId, startedAtMs, completed, failed, canceled, failureReason, forceFailed, deps } = args;
     const logger = (deps.logger ?? createNoopLogger()).named("executeAnalysis").with({ runId, analysisId: input.analysisId });
     const status = forceFailed
         ? "failed"
@@ -1064,34 +1172,12 @@ async function collectAndComplete(args) {
             completed,
             failed,
             canceled,
-            suspended: suspended !== null,
         });
-    const chargeOutcome = status === "completed" || status === "partial"
-        ? { kind: "ok" }
-        : status === "failed"
-            ? { kind: "error" }
-            : suspended !== null
-                ? { kind: "suspended", reason: suspended.reason }
-                : { kind: "canceled" };
-    const revokeReason = status === "completed" || status === "partial"
-        ? "workflow-completed"
-        : status === "failed"
-            ? "workflow-failed"
-            : suspended !== null
-                ? "workflow-suspended"
-                : "workflow-canceled";
-    // Terminal clock read + run-completion provenance, emitted BEFORE the `cortex_runs`
-    // status write below — and thus before any of the terminal cleanup steps. The CLI
-    // watches the run by POLLING that row (`run.ts` `waitForRunTerminal`) and shuts down
-    // the instant it leaves `running`, flushing provenance and then `process.exit()`ing;
-    // emitting the record only after the status write races that shutdown and can drop
-    // the run's terminal provenance entirely. Emitting first makes the record dirty
-    // (synchronously, via the bus) before the row can be observed terminal, so the CLI's
-    // flush always captures it. Not step-wrapped — a DBOS recovery replay must re-fire it;
-    // `DBOS.now()` is checkpointed, so the span stays replay-stable (see `RunProvenanceEvent`).
-    // The duration measures from the `run_started` read threaded in as `startedAtMs`.
+    const chargeOutcome = status === "completed" || status === "partial" ? { kind: "ok" } : status === "failed" ? { kind: "error" } : { kind: "canceled" };
+    const revokeReason = status === "completed" || status === "partial" ? "workflow-completed" : status === "failed" ? "workflow-failed" : "workflow-canceled";
+    const finalError = failureReason ?? (status === "canceled" ? "external_cancel" : null);
     const terminalAtMs = await DBOS.now();
-    emitProvenanceGuarded(deps, {
+    const emitRunEnd = () => emitProvenanceGuarded(deps, {
         type: "run_completed",
         analysisId: input.analysisId,
         runId,
@@ -1099,12 +1185,53 @@ async function collectAndComplete(args) {
         atMs: terminalAtMs,
         durationMs: terminalAtMs - startedAtMs,
     }, input.runSession);
-    await ledgerStep(logger.with({ status }), "persist-final-status", async () => {
-        const written = await updateRunStatus(deps.pool, runId, status, failureReason ?? (status === "canceled" ? "external_cancel" : null));
-        if (written.isErr())
-            return written;
-        // The outcome metrics ride inside the step that persists the terminal status: DBOS
-        // caches the step, so a recovered body records nothing again. A step's own terminal
+    const closeCharge = () => deliverNotice(logger.with({ chargeOutcome: chargeOutcome.kind }), "RunCharge.close", deps.runCharge.close({
+        analysisId: input.analysisId,
+        runId,
+        outcome: chargeOutcome,
+        session: input.runSession,
+    }));
+    const revokeAuthorization = () => deliverNotice(logger.with({ revokeReason }), "RunAuthorizer.revoke", deps.runAuthorizer.revoke(input.runSession, revokeReason));
+    // The writer that wins the row owns the run end: the `run_completed` emit, the charge close,
+    // and the revoke. The step does all three when its write changes the row. An engine cancel
+    // cannot stop a step that started, so a won write is never cut before these acts.
+    //
+    // The emit rides inside the transaction of the write. The update holds the row lock until the
+    // commit, so the run canceler waits and then loses, and no reader sees the terminal row before
+    // the emit. The cli polls the row and flushes the provenance when it leaves `running`; an emit
+    // after the commit can miss that flush. `emitRunEvent` returns `void`, so the emit completes before the commit.
+    //
+    // DBOS retries only a thrown error, so an attempt before the last throws on a failed transaction.
+    // The last attempt returns "failed" instead: the body takes the failed path with no `try`, and a
+    // failure of DBOS to record a won step cannot be mistaken for a failed write. A commit can fail
+    // after the emit, so `emittedInStep` keeps the later attempts from emitting again.
+    // The `undefined` in the annotation exists only because control-flow analysis cannot see the closure assignment; no code may depend on the initial state.
+    let emittedInStep;
+    const finalWrite = await DBOS.runStep(async () => {
+        const stepLog = logger.with({ status }).named("persist-final-status");
+        const written = await withTransaction(deps.pool, "runs.persistFinalStatus", (client) => updateRunStatus(client, runId, status, finalError).map((changed) => {
+            if (changed && !emittedInStep) {
+                emitRunEnd();
+                emittedInStep = true;
+            }
+            return changed;
+        }));
+        if (written.isErr()) {
+            const attempt = DBOS.stepStatus;
+            const isLastAttempt = attempt?.currentAttempt === undefined || attempt.maxAttempts === undefined || attempt.currentAttempt >= attempt.maxAttempts;
+            const failure = { error: describeDbError(written.error), ...stepLog.errorFields(written.error.cause) };
+            if (isLastAttempt) {
+                stepLog.error("ledger write failed", failure);
+                return "failed";
+            }
+            stepLog.warn("ledger write failed, the step retries", { ...failure, attempt: attempt.currentAttempt });
+            throw new Error(`ledger write failed: ${describeDbError(written.error)}`, { cause: written.error.cause });
+        }
+        // A refused write means an earlier write already set a terminal status: the run
+        // canceler's, or an earlier run of this step before a crash. That writer owns the run end.
+        if (!written.value)
+            return "refused";
+        // DBOS caches the step, so a recovered body records nothing again. A step's own terminal
         // row already carried its metric; the residue counted here is every settled step
         // without one — a child the cancel cut before `mark-canceled` (the cancel check runs
         // before a step body), or one that died before `failStep`. The ledger read is kept
@@ -1121,8 +1248,41 @@ async function collectAndComplete(args) {
                 recordStepCompleted({ agentId: row.agentId, status: "failed" });
         }
         recordRunCompleted({ workflow: "analysis", status, durationMs: terminalAtMs - startedAtMs });
-        return written;
-    });
+        await closeCharge();
+        await revokeAuthorization();
+        return "won";
+    }, { name: "persist-final-status", ...FINAL_STATUS_WRITE_RETRY });
+    // A refused write leaves two owners. When the canceler won, its engine cancel came before its
+    // write, so `close-running-charge` throws the cancel and the body does no act of the run end.
+    // When a recovery runs the status step again after its own write landed, no cancel occurred and
+    // the body completes the run end here. A failed write leaves the row `running` with no owner,
+    // and the body still closes and revokes.
+    let closed = false;
+    let revoked = false;
+    if (finalWrite !== "won") {
+        closed = await DBOS.runStep(closeCharge, { name: "close-running-charge" });
+        revoked = await DBOS.runStep(revokeAuthorization, { name: "revoke-run-auth" });
+    }
+    // The step emits only in the execution that ran it. A won step that DBOS gives from the cache
+    // did not run, and a refused or failed write did not emit; the body fires the run end here
+    // with the same checkpointed values. It is not step-wrapped, so a recovery replay fires it again.
+    if (!emittedInStep)
+        emitRunEnd();
+    // After a failed write the row is not terminal, so the body records its run end for the run
+    // canceler. The record comes after the acts: a cancel before it stops the body and the canceler
+    // then owns the run end. A cancel is the only error that goes back to DBOS; a failed record must
+    // not undo an otherwise-complete run, like the sibling terminal steps.
+    if (finalWrite === "failed") {
+        const recorded = { status, error: finalError, closed, revoked };
+        try {
+            await DBOS.setEvent(RUN_END_EVENT_KEY, recorded);
+        }
+        catch (error) {
+            if (isWorkflowCancellation(error))
+                throw error;
+            logger.error("run end record failed, the run canceler acts as for a run with no record", { status, ...logger.errorFields(error) });
+        }
+    }
     // Record the run's synthesis outcome AFTER the status write — a reader that
     // sees a terminal status then also sees whether (and why) synthesis ran. A
     // null outcome means synthesis never ran; leave the columns NULL ("unknown").
@@ -1132,40 +1292,17 @@ async function collectAndComplete(args) {
     if (outcome !== null) {
         await ledgerStep(logger.with({ synthesisStatus: outcome.status }), "persist-synthesis-outcome", () => setRunSynthesisOutcome(deps.pool, runId, outcome.status, outcome.reason));
     }
-    // Sweep never-started steps to `skipped` — but ONLY on genuinely-terminal
-    // paths. The gate is the BRANCH, not the written run status: the pending rows
-    // of a suspended run must survive for a later resume. Log-don't-rollback, like
-    // every other finalisation step here.
-    if (suspended === null) {
-        await ledgerStep(logger, "sweep-pending-steps", () => sweepPendingStepExecutions(deps.pool, runId));
-    }
-    if (suspended !== null) {
-        await ledgerStep(logger, "suspend-analysis", () => suspendAnalysisQuery(deps.pool, input.analysisId));
-    }
-    await DBOS.runStep(() => deliverNotice(logger.with({ chargeOutcome: chargeOutcome.kind }), "RunCharge.close", deps.runCharge.close({
-        analysisId: input.analysisId,
-        runId,
-        outcome: chargeOutcome,
-        session: input.runSession,
-    })), { name: "close-running-charge" });
-    // Revoke the run authorization for the terminal run state. Ownership
-    // defaults to true for inputs persisted before the field existed (a
-    // workflow recovered across this deploy) — those were always Cortex-owned.
-    const authorization = {
-        runSession: input.runSession,
-        ownsMandate: input.ownsMandate ?? true, // oss-core-managed-ok
-    };
-    await DBOS.runStep(() => deliverNotice(logger.with({ revokeReason }), "RunAuthorizer.revoke", deps.runAuthorizer.revoke(authorization, revokeReason)), {
-        name: "revoke-run-auth",
-    });
-    // The `run_completed` provenance was already emitted above (before the status write, to
-    // beat the CLI's poll-and-shutdown). These branches only fan out the UI stream part, whose
+    // Sweep never-started steps to `skipped`. Log-don't-rollback, like every other finalisation step here.
+    await ledgerStep(logger, "sweep-pending-steps", () => sweepPendingStepExecutions(deps.pool, runId));
+    // A step that the neverFits halt canceled in its pause leaves its row, thus the end of the run clears each row of the run.
+    await ledgerStep(logger, "clear-run-pauses", () => clearPausesOfWork(deps.pool, runId));
+    // The run end was emitted above. These branches only fan out the UI stream part, whose
     // completed/failed shapes genuinely differ — the provenance record does not.
     if (status === "completed" || status === "partial") {
         const artifactCount = await DBOS.runStep(async () => await countArtifactsByRuns(deps.pool, input.analysisId, [runId])
             .map((counts) => counts[0]?.count ?? 0)
             .unwrapOr(0), { name: "count-run-artifacts" });
-        await emitStreamPart({
+        const runCompleted = {
             type: "data-run-completed",
             runId,
             status,
@@ -1176,20 +1313,18 @@ async function collectAndComplete(args) {
                 title: f.title,
                 confidence: f.confidence,
             })),
-            ...(status === "partial"
-                ? {
-                    note: `${completed.size} of ${input.steps.length} steps completed; results are partial.`,
-                }
-                : {}),
-            ...(args.usage ? { usage: args.usage } : {}),
-        });
+        };
+        if (status === "partial")
+            runCompleted.note = `${completed.size} of ${input.steps.length} steps completed; results are partial.`;
+        if (args.usage)
+            runCompleted.usage = args.usage;
+        await emitStreamPart(runCompleted);
     }
     else {
         await emitStreamPart({
             type: "data-run-failed",
             runId,
-            error: failureReason ?? (suspended !== null ? suspended.reason : "Run canceled before completion"),
-            ...(suspended !== null ? { reason: suspended.reason } : {}),
+            error: failureReason ?? "Run canceled before completion",
         });
     }
     return {
@@ -1208,9 +1343,7 @@ async function collectAndComplete(args) {
  * status vocabulary without a cast.
  */
 function deriveFinalStatus(args) {
-    const { totalSteps, completed, failed, canceled, suspended } = args;
-    if (suspended)
-        return "suspended_insufficient_funds";
+    const { totalSteps, completed, failed, canceled } = args;
     if (failed.size > 0) {
         return completed.size > 0 ? "partial" : "failed";
     }