@inflexa-ai/harness 0.45.1 → 0.46.2

package/dist/workflows/execute-analysis.js

@@ -39,23 +39,15 @@
  *       `partial`).
  *     - the halt cascade (cancel in-flight via
  *       `Promise.allSettled(handles.map(h => DBOS.cancelWorkflow(h.workflowID)))`,
- *       stop scheduling) survives only for a suspension of a child and the
- *       `neverFits` plan-validation guard.
- *  4. Suspension cascade (workflow-suspension spec)
- *     - a child that suspends sends a typed message on `CHILD_SUSPENDED_TOPIC`
- *       and cancels itself. The parent reads the kind of the message, never a
- *       reason string: it cancels the siblings, then self-cancels to
- *       `CANCELLED` (NOT `ERROR` — ERROR isn't resumable; NOTES #3)
- *     - a refusal of the `RunCharge.open` gate with the suspend flag suspends
- *       the run before any step starts
- *     - a `suspend` error of a synthesis model request suspends the run in
- *       place of the synthesis failure
- *     - the run row and the analysis flip to `suspended_insufficient_funds` in
- *       `collectAndComplete`. The run status is terminal and does not block a
- *       new run of the plan. The paused parent lands in `CANCELLED`, a
- *       durably reschedulable state; re-driving it is a future enhancement,
- *       not yet wired here. The reason of the host rides to the run row, the
- *       charge close, the metric, and the terminal part, unread.
+ *       stop scheduling) survives only for the `neverFits` plan-validation guard.
+ *  4. Pause (work-pause spec)
+ *     - a step pauses in its own workflow, and the parent waits for its result as
+ *       for a step that runs. The other steps go on, and the run row stays
+ *       `running`
+ *     - a refusal of the `RunCharge.open` gate with the suspend flag pauses the
+ *       run before any step starts, and the charge opens again after the resume
+ *     - a failed model request of the synthesis with a cause of a pause waits in
+ *       the loop of the synthesizer
  *  5. `synthesizeFindings` (single sequential block, no sandbox)
  *  6. `collectAndComplete` (terminal — runs on ALL paths)
  *     - determine final status from completed/cancelled/failed counts
@@ -73,7 +65,10 @@
  *     - WRITES NOTHING to the conversation thread (results are pull-only
  *       via `inspectRun`)
  */
-import { DBOS, Error as DBOSErrors } from "@dbos-inc/dbos-sdk";
+import { errorMessageOf } from "../lib/thrown.js";
+import { textOf } from "../lib/unknown-text.js";
+import { DBOS } from "@dbos-inc/dbos-sdk";
+import { isWorkflowCancellation } from "../runtime/dbos.js";
 import { err, ok } from "neverthrow";
 import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
@@ -85,7 +80,8 @@ import { ATTR_INFLEXA_STEP_ID, stableSpan } from "../lib/otel-spans.js";
 import { recordRunCompleted, recordStepCompleted, stepOutcomeOf } from "../lib/metrics.js";
 import { describeDbError, withTransaction } from "../lib/db-result.js";
 import { unwrapOrThrow } from "../lib/result.js";
-import { countArtifactsByRuns, insertStepExecution, loadDataProfileStatus, queryActiveRun, queryStepArtifactPaths, queryStepsByRun, seedStepExecutions, setRunSynthesisOutcome, suspendAnalysis as suspendAnalysisQuery, sweepPendingStepExecutions, updateRunStatus, updateStepExecution, } from "../state/index.js";
+import { countArtifactsByRuns, insertStepExecution, loadDataProfileStatus, queryActiveRun, queryStepArtifactPaths, queryStepsByRun, seedStepExecutions, setRunSynthesisOutcome, sweepPendingStepExecutions, updateRunStatus, updateStepExecution, } from "../state/index.js";
+import { clearPausesOfWork } from "../state/paused-work.js";
 import { addChatUsage, hasReportedUsage } from "../loop/metrics.js";
 import { flattenDataPart } from "../contracts/chat-frame.js";
 import { SYNTHESIS_AGENT_ID, loadStepSummariesFromDisk } from "../execution/run-synthesis.js";
@@ -95,18 +91,20 @@ import { isChatDataPart, synthesisEmission } from "../sandbox/sandbox-step-trans
 import { synthesizeRun } from "../app/synthesize-run.js";
 import { computeTopologicalLevels, scheduleReady, validatePlanDag } from "./execute-analysis-scheduler.js";
 import { recordCancelledChild } from "./metrics.js";
-import { CHILD_SUSPENDED_TOPIC } from "./sandbox-step.js";
-import { cancelSelf, suspensionOfFailure, suspensionOfRefusal } from "./suspension.js";
+import { pauseAtGate, workPause } from "./pause.js";
+import { presentGet } from "../lib/present.js";
 // ── In-body orchestration helpers ────────────────────────────────────
 /** Emit a chat data part on the parent's DBOS stream. */
 function emitStreamPart(part) {
     return DBOS.writeStream("events", part);
 }
 /**
- * A failed write rolls back no side effect that succeeded and never fails the
- * run. A DBOS exception passes through with no change.
+ * A failed write rolls back no side effect that succeeded. The step body logs
+ * its own failure and never throws. A DBOS exception passes through with no
+ * change.
  */
 async function ledgerStep(log, name, write) {
+    // typecheck-disable-next-line must-use-result -- a ledger miss must not fail the run
     await DBOS.runStep(async () => {
         const written = await write();
         if (written.isOk())
@@ -156,8 +154,8 @@ function buildRunObservation(args) {
                 agent: input.agentByStepId[s.id] ?? "unknown",
                 // A step absent from the map has not been reached yet; `pending` is its honest state.
                 status: rt?.status ?? "pending",
-                ...(rt?.durationMs !== undefined ? { durationMs: rt.durationMs } : {}),
-                ...(rt?.error !== undefined ? { error: rt.error } : {}),
+                durationMs: rt?.durationMs,
+                error: rt?.error,
             };
         }),
     };
@@ -188,7 +186,7 @@ function observeRunGuarded(deps, observation) {
  * projection/timeout-propagation tests.
  */
 export function buildChildInput(args) {
-    const { input, stepId, level, runId, workflowId, prompt, templateBinding } = args;
+    const { input, stepId, level, runId, prompt, templateBinding } = args;
     const resources = input.resourcesByStepId[stepId];
     if (!resources) {
         throw new Error(`executeAnalysis: step "${stepId}" missing from resourcesByStepId — every step must declare resources`);
@@ -212,10 +210,9 @@ export function buildChildInput(args) {
         dependsOn: planStep.depends_on,
         // Composed beside the seed, thus the same checkpoint carries both and a
         // replay hands the child the binding its briefing describes.
-        ...(templateBinding ? { templateBinding } : {}),
+        templateBinding,
         level,
         prompt,
-        parentWorkflowId: workflowId,
         resources,
         timeoutSeconds: input.timeoutByStepId?.[stepId],
     };
@@ -241,7 +238,7 @@ export function buildChildInput(args) {
  */
 export async function composeStepSeed(args) {
     const { briefing, templateBinding } = await gatherStepPackage(args);
-    return { prompt: composeStepBriefing(briefing), ...(templateBinding ? { templateBinding } : {}) };
+    return { prompt: composeStepBriefing(briefing), templateBinding };
 }
 /**
  * Do every read of one step's package and give the data its seed is rendered
@@ -308,7 +305,7 @@ export async function gatherStepPackage(args) {
             memory: { goal: memory.goal, constraints: memory.constraints },
             ...contract.briefing,
         },
-        ...(contract.binding ? { templateBinding: contract.binding } : {}),
+        templateBinding: contract.binding,
     };
 }
 /** A served contract carries no `match`; the two refusals do. */
@@ -338,7 +335,7 @@ async function resolveTemplateContract(step, client) {
     return bindTemplateContract(ref, answer, step.grounding?.settings ?? [], {
         stepId: step.id,
         claims: step.grounding?.claims ?? [],
-        ...(step.grounding?.snapshot && step.grounding.snapshot !== "none" ? { snapshot: step.grounding.snapshot } : {}),
+        snapshot: step.grounding?.snapshot && step.grounding.snapshot !== "none" ? step.grounding.snapshot : undefined,
     });
 }
 /** The version of a template reference (`tpl-x@1.0.0` gives `1.0.0`), or `undefined` when the reference has none. */
@@ -421,28 +418,26 @@ function bindTemplateContract(ref, contract, settings, grounding) {
                 inputs: (contract.inputs ?? []).map((input) => ({
                     name: input.name,
                     path: input.path,
-                    ...(input.description ? { description: input.description } : {}),
+                    description: input.description,
                 })),
                 bound,
                 unbound_settings: unbound,
             },
         },
-        ...(versionMatches
+        binding: versionMatches
             ? {
-                binding: {
-                    template: ref,
-                    slots,
-                    sources,
-                    step: grounding.stepId,
-                    claims: grounding.claims,
-                    ...(grounding.snapshot ? { snapshot: grounding.snapshot } : {}),
-                    // The local slots of the contract, thus the tool binds a path or a column name on the machine
-                    // without a second read of the contract.
-                    local: contract.parameters.filter((slot) => slot.local === true),
-                    adaptable: adaptable.map((slot) => slot.name),
-                },
+                template: ref,
+                slots,
+                sources,
+                step: grounding.stepId,
+                claims: grounding.claims,
+                snapshot: grounding.snapshot,
+                // The local slots of the contract, thus the tool binds a path or a column name on the machine
+                // without a second read of the contract.
+                local: contract.parameters.filter((slot) => slot.local === true),
+                adaptable: adaptable.map((slot) => slot.name),
             }
-            : {}),
+            : undefined,
     };
 }
 /**
@@ -485,13 +480,10 @@ async function collectUpstreamHandoffs(args) {
  * its reason in `blockedReason` — an honest agent-declared blocker, not an
  * error — and a failure carries the same reason string
  * `persist-synthesis-outcome` writes to `cortex_runs.synthesis_reason`, so the
- * two ledgers cannot disagree about why synthesis died. A suspension is not an
- * outcome: the row is canceled, as the row of a suspended step. Exported for
- * the projection tests (the `buildChildInput` pattern).
+ * two ledgers cannot disagree about why synthesis died. Exported for the
+ * projection tests (the `buildChildInput` pattern).
  */
 export function synthesisRowUpdate(outcome, durationMs) {
-    if ("kind" in outcome)
-        return { status: "canceled", durationMs, error: outcome.reason };
     switch (outcome.status) {
         case "produced":
             return { status: "completed", durationMs };
@@ -510,9 +502,11 @@ export function synthesisRowUpdate(outcome, durationMs) {
 /**
  * Run-level literature-grounded synthesis (no sandbox). Returns the
  * quick-display findings for the run-completed card; empty when synthesis is
- * skipped or produced no synthesizable content. A genuine failure re-throws
- * inside the caller's `DBOS.runStep`, failing the run (D10). Exported so
- * integration tests can drive the wired synthesis without a full parent body.
+ * skipped or produced no synthesizable content. A genuine failure re-throws,
+ * failing the run (D10). It runs in the body of the run workflow: each read and
+ * write is a step, each model call is a step, and each reviewer call starts a
+ * child workflow. Exported so integration tests can drive the wired synthesis
+ * without a full parent body.
  */
 export function synthesizeFindings(args) {
     const { analysisId, runId, completedSteps, session, deps } = args;
@@ -543,10 +537,9 @@ export function synthesizeFindings(args) {
         embedding: deps.embedding,
         resolveWorkspaceRoot: deps.resolveWorkspaceRoot,
         synthesisModel: deps.synthesisModel,
-        bioKeys: deps.bioKeys,
-        citationResolver: deps.citationResolver,
+        literatureReviewer: deps.literatureReviewer,
         usageRecorder: deps.usageRecorder,
-        ...(deps.toolOutputStore ? { toolOutputStore: deps.toolOutputStore } : {}),
+        toolOutputStore: deps.toolOutputStore,
     }, {
         analysisId,
         runId,
@@ -563,9 +556,10 @@ export function synthesizeFindings(args) {
         // call path.
         session: forStep(session, SYNTHESIS_STEP_ID),
         emit,
+        pause: args.pause?.afterFailure,
+        durably: (name, run) => DBOS.runStep(run, { name }),
         onProgress: async (phase, activity, extra = {}) => {
-            // Synthesis runs inside one `DBOS.runStep`, thus `DBOS.now()` reads the wall clock here, and a rerun of
-            // the step after a crash writes its entries again under the same ids. A reader dedups an entry by id.
+            // The body checkpoints the clock and each write, thus a replay writes no entry again.
             const seq = progressSeq++;
             const at = new Date(await DBOS.now()).toISOString();
             const parts = synthesisEmission(runId, SYNTHESIS_STEP_ID, seq, phase, activity, at, extra);
@@ -603,7 +597,17 @@ export async function runExecuteAnalysisBody(input, deps) {
     // the run authorization is already minted and rides in `input.runSession`.
     const runId = input.runSession.runFrame.runId;
     const workflowId = runId;
-    const init = await validateAndInit(input, runId, deps);
+    const pause = workPause({
+        pool: deps.pool,
+        workId: runId,
+        workKind: "run",
+        analysisId: input.analysisId,
+        emit: emitStreamPart,
+        retryDelaysMs: deps.pauseRetryDelaysMs,
+        run: { session: input.runSession, authorizer: deps.runAuthorizer },
+        logger,
+    });
+    const init = await validateAndInit(input, runId, deps, pause);
     if (init.kind === "joined-existing") {
         return {
             runId: init.runId,
@@ -615,7 +619,6 @@ export async function runExecuteAnalysisBody(input, deps) {
         };
     }
     if (init.kind === "charge-refused") {
-        const suspension = suspensionOfRefusal(init.refusal) ?? null;
         const refusedAtMs = await DBOS.now();
         const refused = await collectAndComplete({
             input,
@@ -625,16 +628,13 @@ export async function runExecuteAnalysisBody(input, deps) {
             completed: new Set(),
             failed: new Set(),
             canceled: new Set(),
-            suspension,
             failureReason: init.refusal.reason,
-            forceFailed: suspension === null,
+            forceFailed: true,
             findings: [],
             synthesisOutcome: null,
             deps,
         });
         observeRunGuarded(deps, buildRunObservation({ input, runId, status: refused.status, stepStates: new Map() }));
-        if (suspension !== null)
-            return cancelSelf("self-cancel-suspended");
         return refused;
     }
     // Seed the full DAG as `pending` rows so ledger readers see every step from
@@ -705,12 +705,11 @@ export async function runExecuteAnalysisBody(input, deps) {
     // still run the terminal block (close charge + revoke run authorization), and re-throw
     // after so the workflow record goes to ERROR.
     let synthesisError = null;
-    let synthesisSuspension = null;
+    let synthesisMessage;
     let synthesisFindings = [];
     // Null when synthesis never ran (disabled or no completed steps): the ledger
     // columns stay NULL — "unknown", not a recorded skip — and the seeded
-    // `synthesis` row (if any) stays `pending` for the terminal sweep. Also null
-    // when synthesis suspended: a resume of the run gives the outcome.
+    // `synthesis` row (if any) stays `pending` for the terminal sweep.
     let synthesisOutcome = null;
     if (synthesisEnabled && final.completed.size > 0) {
         // Bracketing clock reads for the row's duration_ms — checkpointed, so a
@@ -730,13 +729,14 @@ export async function runExecuteAnalysisBody(input, deps) {
         }));
         let rowOutcome;
         try {
-            const synthOut = await DBOS.runStep(() => synthesizeFindings({
+            const synthOut = await synthesizeFindings({
                 analysisId: input.analysisId,
                 runId,
                 completedSteps: [...final.completed],
                 session: input.runSession,
                 deps,
-            }), { name: "synthesize-findings" });
+                pause,
+            });
             synthesisFindings = synthOut.findings;
             synthesisOutcome = { status: synthOut.synthesisStatus, reason: synthOut.synthesisReason };
             rowOutcome = synthesisOutcome;
@@ -749,20 +749,14 @@ export async function runExecuteAnalysisBody(input, deps) {
             // this path either, so the run row is equally non-terminal and the pair
             // stays consistent — the pre-existing cancelled-mid-flight wedge shape
             // `inflexa run` already detects via its DBOS-status cross-check.
-            if (err instanceof DBOSErrors.DBOSWorkflowCancelledError)
+            if (isWorkflowCancellation(err))
                 throw err;
-            const suspended = suspensionOfFailure(err);
-            if (suspended !== undefined) {
-                synthesisSuspension = suspended;
-                rowOutcome = suspended;
-                logger.warn("synthesizeFindings suspended — suspending the run", { runId, reason: suspended.reason });
-            }
-            else {
-                synthesisError = err;
-                synthesisOutcome = { status: "failed", reason: err instanceof Error ? err.message : String(err) };
-                rowOutcome = synthesisOutcome;
-                logger.error("synthesizeFindings failed — failing the run", { runId, ...logger.errorFields(err) });
-            }
+            // A failure with a cause of a pause waited in the loop of the synthesizer, thus this one fails the run.
+            synthesisError = err;
+            synthesisMessage = errorMessageOf(err);
+            synthesisOutcome = { status: "failed", reason: errorMessageOf(err) ?? textOf(err) };
+            rowOutcome = synthesisOutcome;
+            logger.error("synthesizeFindings failed — failing the run", { runId, ...logger.errorFields(err) });
         }
         // Terminal stamp for the `synthesis` row — deliberately BEFORE
         // `collectAndComplete` writes the run row's terminal status, so no reader
@@ -782,7 +776,6 @@ export async function runExecuteAnalysisBody(input, deps) {
     // (6) collectAndComplete — terminal block. Runs on EVERY path. When synthesis
     // failed, force a failed terminal status so the charge/run-authorization close correctly
     // and the run row + stream report the failure before we re-throw.
-    const suspension = final.suspension ?? synthesisSuspension;
     const result = await collectAndComplete({
         input,
         runId,
@@ -791,15 +784,8 @@ export async function runExecuteAnalysisBody(input, deps) {
         completed: final.completed,
         failed: final.failed,
         canceled: final.canceled,
-        suspension,
-        ...(final.usage ? { usage: final.usage } : {}),
-        failureReason: synthesisError
-            ? synthesisError instanceof Error
-                ? `synthesis-failed: ${synthesisError.message}`
-                : "synthesis-failed"
-            : final.suspension === null && synthesisSuspension !== null
-                ? synthesisSuspension.reason
-                : final.failureReason,
+        usage: final.usage,
+        failureReason: synthesisError === null ? final.failureReason : synthesisMessage === undefined ? "synthesis-failed" : `synthesis-failed: ${synthesisMessage}`,
         forceFailed: synthesisError !== null,
         findings: synthesisFindings,
         synthesisOutcome,
@@ -807,20 +793,15 @@ export async function runExecuteAnalysisBody(input, deps) {
     });
     // Terminal snapshot, fired here rather than inside `collectAndComplete` because this is the
     // first point where BOTH the derived final status and the scheduler's final step map are in
-    // hand. It precedes the suspension self-cancel below on purpose: that branch raises out of the
-    // body, so an observer placed after it would never see a suspended run's last state.
+    // hand.
     observeRunGuarded(deps, buildRunObservation({ input, runId, status: result.status, stepStates: final.stepStates }));
-    // Synthesis failure takes priority over the suspension cascade: a run whose
-    // synthesis threw is definitively failed (ERROR), not a resumable
-    // suspension. Only self-cancel when synthesis did not throw a failure.
-    if (suspension !== null && synthesisError === null)
-        return cancelSelf("self-cancel-suspended");
     // Re-throw after the terminal block so the workflow record goes to ERROR.
+    // oxlint-disable-next-line typescript/only-throw-error -- the caught synthesis failure rides as-is so the workflow record fails with the original cause; a wrapper would erase its identity.
     if (synthesisError !== null)
         throw synthesisError;
     return result;
 }
-async function validateAndInit(input, runId, deps) {
+async function validateAndInit(input, runId, deps, pause) {
     // The cortex_runs row already exists (inserted by `executePlan`). Sanity-
     // check that no other active run for the same plan won the race — the
     // partial-unique index would have rejected the insert if so, so this is
@@ -837,11 +818,17 @@ async function validateAndInit(input, runId, deps) {
             recursive: true,
         });
     }, { name: "init-run-filesystem" });
-    const opened = await DBOS.runStep(async () => await passGate("RunCharge.open", deps.runCharge.open({
+    const openCharge = () => DBOS.runStep(async () => await passGate("RunCharge.open", deps.runCharge.open({
         analysisId: input.analysisId,
         runId,
         session: input.runSession,
     })), { name: "open-running-charge" });
+    let opened = await openCharge();
+    // A refusal with the suspend flag waits in a pause, and the charge opens again after the resume.
+    while (opened.isErr() && opened.error.kind === "suspended") {
+        await pauseAtGate(pause, opened.error.reason);
+        opened = await openCharge();
+    }
     if (opened.isErr())
         return { kind: "charge-refused", refusal: opened.error };
     return { kind: "fresh" };
@@ -852,14 +839,13 @@ async function runSchedulerLoop(args) {
     const failed = new Set();
     const canceled = new Set();
     const inFlight = new Map();
-    const childSuspensions = new Map();
     // Run-level usage aggregate, folded from the children's own durable results.
     // `getResult` IS the replay-safe source: a recovered parent reads back the
     // identical value from each child's workflow record, so the sum reproduces
     // exactly without a second channel. A child that settled by throwing carries
     // no result and therefore contributes nothing — same rule as its duration.
     const runUsage = {};
-    // Child workflow ids the parent itself cancelled (suspension / neverFits halt cascade). Their `getResult`
+    // Child workflow ids the parent itself cancelled (the neverFits halt cascade). Their `getResult`
     // rejects with a DBOS cancellation error and lands in the settlement error branch — but the step was
     // CANCELED by us, not failed on its own merits. Keyed here (deterministic: `cancelInFlight` runs the
     // same way on a replay) so that branch records it as canceled everywhere, matching how a child that
@@ -893,26 +879,18 @@ async function runSchedulerLoop(args) {
         const stack = [...(dependentsByStepId.get(failedStepId) ?? [])];
         while (stack.length > 0) {
             const id = stack.pop();
-            if (stepRuntime.get(id).status === "pending") {
+            if (id === undefined)
+                break;
+            if (presentGet(stepRuntime, id, "the runtime of the step").status === "pending") {
                 stepRuntime.set(id, { status: "skipped" });
                 stack.push(...(dependentsByStepId.get(id) ?? []));
             }
         }
     };
-    // Halts scheduling entirely — reserved for a suspension of a child and the
-    // `neverFits` guard. An ordinary step failure does NOT set it: it dooms
-    // only that step's transitive dependents.
+    // Halts scheduling entirely — reserved for the `neverFits` guard. An ordinary
+    // step failure does NOT set it: it dooms only that step's transitive dependents.
     let halted = false;
-    let suspension = null;
     let failureReason = null;
-    const haltForSuspension = async (child) => {
-        if (suspension === null) {
-            suspension = { kind: "suspended", reason: child.reason };
-            halted = true;
-            failureReason = child.reason;
-        }
-        await cancelInFlight(inFlight, child.reason, canceledByParent);
-    };
     const stepIndexById = new Map(input.steps.map((s, i) => [s.id, i]));
     const emitDagSnapshot = async () => {
         await emitStreamPart({
@@ -920,7 +898,7 @@ async function runSchedulerLoop(args) {
             id: `dag-${runId}`,
             runId,
             steps: input.steps.map((s) => {
-                const rt = stepRuntime.get(s.id);
+                const rt = presentGet(stepRuntime, s.id, "the runtime of the step");
                 const entry = {
                     id: s.id,
                     // `input.steps` is the SCHEDULER's projection — `{id, depends_on}` and nothing
@@ -953,7 +931,6 @@ async function runSchedulerLoop(args) {
         // the body once `collectAndComplete` has derived the final status.
         observeRunGuarded(deps, buildRunObservation({ input, runId, status: "running", stepStates: stepRuntime }));
     };
-    const dbosParentId = DBOS.workflowID ?? workflowId;
     const dispatchReady = async () => {
         if (halted)
             return;
@@ -987,13 +964,13 @@ async function runSchedulerLoop(args) {
                     });
                 }
                 halted = true;
-                failureReason = `step "${scheduled.neverFits[0]}" exceeds the machine resource budget`;
+                failureReason = `step "${String(scheduled.neverFits[0])}" exceeds the machine resource budget`;
                 await cancelInFlight(inFlight, "fail_fast", canceledByParent);
                 await emitDagSnapshot();
                 return;
             }
             for (const stepId of scheduled.heldForCapacity) {
-                if (stepRuntime.get(stepId).status !== "queued") {
+                if (presentGet(stepRuntime, stepId, "the runtime of the step").status !== "queued") {
                     stepRuntime.set(stepId, { status: "queued" });
                     queuedChanged = true;
                 }
@@ -1009,7 +986,7 @@ async function runSchedulerLoop(args) {
             return;
         }
         for (const stepId of admit) {
-            const idx = stepIndexById.get(stepId);
+            const idx = presentGet(stepIndexById, stepId, "the index of the step");
             const childWorkflowId = `${workflowId}-${idx}`;
             // Compose the seed HERE — the dependencies of `stepId` are all in
             // `completed`, so this is the first (and only) moment their results
@@ -1028,18 +1005,16 @@ async function runSchedulerLoop(args) {
                 stepId,
                 level: levels.get(stepId) ?? 0,
                 runId,
-                workflowId,
                 prompt: seed.prompt,
-                ...(seed.templateBinding ? { templateBinding: seed.templateBinding } : {}),
+                templateBinding: seed.templateBinding,
             });
             const childInput = {
                 ...baseChildInput,
-                parentWorkflowId: dbosParentId,
                 runSession: forStep(input.runSession, stepId),
             };
-            const handle = (await DBOS.startWorkflow(deps.sandboxStepCallable, {
+            const handle = await DBOS.startWorkflow(deps.sandboxStepCallable, {
                 workflowID: childWorkflowId,
-            })(childInput));
+            })(childInput);
             inFlight.set(childWorkflowId, { stepId, handle });
             stepRuntime.set(stepId, { status: "running" });
         }
@@ -1053,7 +1028,7 @@ async function runSchedulerLoop(args) {
         // function-ID-consuming ops and diverge the counter on replay.
         const winner = await DBOS.waitFirst([...inFlight.values()].map((e) => e.handle));
         const childId = winner.workflowID;
-        const entry = inFlight.get(childId);
+        const entry = presentGet(inFlight, childId, "the in-flight entry of the winning child");
         inFlight.delete(childId);
         let settled;
         try {
@@ -1063,8 +1038,6 @@ async function runSchedulerLoop(args) {
         catch (err) {
             settled = { childId, stepId: entry.stepId, kind: "error", err };
         }
-        await drainChildSuspensions(childSuspensions);
-        const childSuspension = childSuspensions.get(settled.childId);
         // Terminal step status + duration for the provenance emission below. Every
         // settlement branch assigns both, so the emission fires exactly once per
         // settled child with the mapped status.
@@ -1077,24 +1050,22 @@ async function runSchedulerLoop(args) {
                 completed.add(settled.stepId);
                 stepRuntime.set(settled.stepId, {
                     status: "completed",
-                    durationMs: r.durationMs ?? undefined,
+                    durationMs: r.durationMs,
                 });
                 stepStatus = "completed";
-                stepDurationMs = r.durationMs ?? undefined;
+                stepDurationMs = r.durationMs;
                 await emitDagSnapshot();
                 await dispatchReady();
             }
             else if (r.status === "canceled") {
                 canceled.add(settled.stepId);
-                if (childSuspension !== undefined)
-                    await haltForSuspension(childSuspension);
                 stepRuntime.set(settled.stepId, {
                     status: "failed",
-                    durationMs: r.durationMs ?? undefined,
+                    durationMs: r.durationMs,
                     error: r.error ?? "canceled",
                 });
                 stepStatus = "canceled";
-                stepDurationMs = r.durationMs ?? undefined;
+                stepDurationMs = r.durationMs;
                 await emitDagSnapshot();
             }
             else {
@@ -1107,18 +1078,18 @@ async function runSchedulerLoop(args) {
                 failureReason ??= r.error ?? (r.status === "blocked" ? "step_blocked" : "step_failed");
                 stepRuntime.set(settled.stepId, {
                     status: "failed",
-                    durationMs: r.durationMs ?? undefined,
+                    durationMs: r.durationMs,
                     error: r.error ?? (r.status === "blocked" ? "step_blocked" : "step_failed"),
                 });
                 markDependentsSkipped(settled.stepId);
                 stepStatus = "failed";
-                stepDurationMs = r.durationMs ?? undefined;
+                stepDurationMs = r.durationMs;
                 await emitDagSnapshot();
                 await dispatchReady();
             }
         }
         else if (canceledByParent.has(settled.childId)) {
-            // The child threw because the PARENT cancelled it (suspension / neverFits halt cascade), not
+            // The child threw because the PARENT cancelled it (the neverFits halt cascade), not
             // because it failed on its own — its `getResult` rejects with a DBOS cancellation error.
             // Record it as canceled, mirroring the graceful `{status:"canceled"}` branch above so the
             // `canceled` set, the terminal result, and the `step_completed` provenance all agree. No
@@ -1128,34 +1099,22 @@ async function runSchedulerLoop(args) {
                 // `stepRuntime` (the DAG snapshot) has no canceled tier; the graceful-cancel branch above
                 // likewise renders canceled steps as "failed", so this stays consistent with it.
                 status: "failed",
-                error: settled.err instanceof Error ? settled.err.message : String(settled.err),
+                error: errorMessageOf(settled.err) ?? textOf(settled.err),
             });
             stepStatus = "canceled";
             stepDurationMs = undefined;
             await emitDagSnapshot();
         }
-        else if (childSuspension !== undefined) {
-            // The child suspended: it sent its typed suspension, then cancelled
-            // itself, thus `getResult` rejects with a DBOS cancellation. The
-            // suspension halts the run — the cascade is a decision of the host,
-            // not a DAG one — and it dooms no dependent: the resumed run needs them.
-            canceled.add(settled.stepId);
-            await haltForSuspension(childSuspension);
-            stepRuntime.set(settled.stepId, { status: "failed", error: childSuspension.reason });
-            stepStatus = "canceled";
-            stepDurationMs = undefined;
-            await emitDagSnapshot();
-        }
         else {
-            // The child threw on its own (not a parent-driven cancel, not a
-            // suspension). A throw is treated exactly like a step failure:
+            // The child threw on its own (not a parent-driven cancel). A throw is
+            // treated exactly like a step failure:
             // dependents doomed, siblings continue.
             failed.add(settled.stepId);
-            failureReason ??= settled.err instanceof Error ? settled.err.message : String(settled.err);
+            failureReason ??= errorMessageOf(settled.err) ?? textOf(settled.err);
             markDependentsSkipped(settled.stepId);
             stepRuntime.set(settled.stepId, {
                 status: "failed",
-                error: settled.err instanceof Error ? settled.err.message : String(settled.err),
+                error: errorMessageOf(settled.err) ?? textOf(settled.err),
             });
             stepStatus = "failed";
             // A child that settled by throwing carries no durable duration.
@@ -1176,30 +1135,19 @@ async function runSchedulerLoop(args) {
             runId,
             stepId: settled.stepId,
             status: stepStatus,
-            ...(stepDurationMs !== undefined ? { durationMs: stepDurationMs } : {}),
+            durationMs: stepDurationMs,
             atMs: settledAtMs,
         }, input.runSession);
     }
-    await drainChildSuspensions(childSuspensions);
     return {
         completed,
         failed,
         canceled,
-        suspension,
         failureReason,
         stepStates: stepRuntime,
-        ...(hasReportedUsage(runUsage) ? { usage: { ...runUsage } } : {}),
+        usage: hasReportedUsage(runUsage) ? { ...runUsage } : undefined,
     };
 }
-async function drainChildSuspensions(suspensions) {
-    while (true) {
-        const msg = await DBOS.recv(CHILD_SUSPENDED_TOPIC, 0);
-        if (!msg)
-            return;
-        if (msg.kind === "suspended" && !suspensions.has(msg.childWorkflowId))
-            suspensions.set(msg.childWorkflowId, msg);
-    }
-}
 async function cancelInFlight(inFlight, cause, canceledByParent) {
     const ids = [...inFlight.keys()];
     // Record every id BEFORE the cancel so the settlement loop classifies the resulting
@@ -1215,9 +1163,7 @@ async function cancelInFlight(inFlight, cause, canceledByParent) {
 /** The waits between the attempts are 1, 2, 4, and 8 seconds. */
 const FINAL_STATUS_WRITE_RETRY = { retriesAllowed: true, maxAttempts: 5, intervalSeconds: 1, backoffRate: 2 };
 async function collectAndComplete(args) {
-    const { input, runId, workflowId, startedAtMs, completed, failed, canceled, suspension, failureReason, forceFailed, deps } = args;
-    // A forced failure is terminal and never a resumable suspension.
-    const suspended = suspension !== null && !forceFailed ? suspension : null;
+    const { input, runId, workflowId, startedAtMs, completed, failed, canceled, failureReason, forceFailed, deps } = args;
     const logger = (deps.logger ?? createNoopLogger()).named("executeAnalysis").with({ runId, analysisId: input.analysisId });
     const status = forceFailed
         ? "failed"
@@ -1226,22 +1172,9 @@ async function collectAndComplete(args) {
             completed,
             failed,
             canceled,
-            suspended: suspended !== null,
         });
-    const chargeOutcome = status === "completed" || status === "partial"
-        ? { kind: "ok" }
-        : status === "failed"
-            ? { kind: "error" }
-            : suspended !== null
-                ? { kind: "suspended", reason: suspended.reason }
-                : { kind: "canceled" };
-    const revokeReason = status === "completed" || status === "partial"
-        ? "workflow-completed"
-        : status === "failed"
-            ? "workflow-failed"
-            : suspended !== null
-                ? "workflow-suspended"
-                : "workflow-canceled";
+    const chargeOutcome = status === "completed" || status === "partial" ? { kind: "ok" } : status === "failed" ? { kind: "error" } : { kind: "canceled" };
+    const revokeReason = status === "completed" || status === "partial" ? "workflow-completed" : status === "failed" ? "workflow-failed" : "workflow-canceled";
     const finalError = failureReason ?? (status === "canceled" ? "external_cancel" : null);
     const terminalAtMs = await DBOS.now();
     const emitRunEnd = () => emitProvenanceGuarded(deps, {
@@ -1252,19 +1185,13 @@ async function collectAndComplete(args) {
         atMs: terminalAtMs,
         durationMs: terminalAtMs - startedAtMs,
     }, input.runSession);
-    // Ownership defaults to true for inputs persisted before the field existed (a
-    // workflow recovered across this deploy) — those were always Cortex-owned.
-    const authorization = {
-        runSession: input.runSession,
-        ownsMandate: input.ownsMandate ?? true, // oss-core-managed-ok
-    };
     const closeCharge = () => deliverNotice(logger.with({ chargeOutcome: chargeOutcome.kind }), "RunCharge.close", deps.runCharge.close({
         analysisId: input.analysisId,
         runId,
         outcome: chargeOutcome,
         session: input.runSession,
     }));
-    const revokeAuthorization = () => deliverNotice(logger.with({ revokeReason }), "RunAuthorizer.revoke", deps.runAuthorizer.revoke(authorization, revokeReason));
+    const revokeAuthorization = () => deliverNotice(logger.with({ revokeReason }), "RunAuthorizer.revoke", deps.runAuthorizer.revoke(input.runSession, revokeReason));
     // The writer that wins the row owns the run end: the `run_completed` emit, the charge close,
     // and the revoke. The step does all three when its write changes the row. An engine cancel
     // cannot stop a step that started, so a won write is never cut before these acts.
@@ -1278,7 +1205,8 @@ async function collectAndComplete(args) {
     // The last attempt returns "failed" instead: the body takes the failed path with no `try`, and a
     // failure of DBOS to record a won step cannot be mistaken for a failed write. A commit can fail
     // after the emit, so `emittedInStep` keeps the later attempts from emitting again.
-    let emittedInStep = false;
+    // The `undefined` in the annotation exists only because control-flow analysis cannot see the closure assignment; no code may depend on the initial state.
+    let emittedInStep;
     const finalWrite = await DBOS.runStep(async () => {
         const stepLog = logger.with({ status }).named("persist-final-status");
         const written = await withTransaction(deps.pool, "runs.persistFinalStatus", (client) => updateRunStatus(client, runId, status, finalError).map((changed) => {
@@ -1350,7 +1278,7 @@ async function collectAndComplete(args) {
             await DBOS.setEvent(RUN_END_EVENT_KEY, recorded);
         }
         catch (error) {
-            if (error instanceof DBOSErrors.DBOSWorkflowCancelledError)
+            if (isWorkflowCancellation(error))
                 throw error;
             logger.error("run end record failed, the run canceler acts as for a run with no record", { status, ...logger.errorFields(error) });
         }
@@ -1364,23 +1292,17 @@ async function collectAndComplete(args) {
     if (outcome !== null) {
         await ledgerStep(logger.with({ synthesisStatus: outcome.status }), "persist-synthesis-outcome", () => setRunSynthesisOutcome(deps.pool, runId, outcome.status, outcome.reason));
     }
-    // Sweep never-started steps to `skipped` — but ONLY on genuinely-terminal
-    // paths. The gate is the BRANCH, not the written run status: the pending rows
-    // of a suspended run must survive for a later resume. Log-don't-rollback, like
-    // every other finalisation step here.
-    if (suspended === null) {
-        await ledgerStep(logger, "sweep-pending-steps", () => sweepPendingStepExecutions(deps.pool, runId));
-    }
-    if (suspended !== null) {
-        await ledgerStep(logger, "suspend-analysis", () => suspendAnalysisQuery(deps.pool, input.analysisId));
-    }
+    // Sweep never-started steps to `skipped`. Log-don't-rollback, like every other finalisation step here.
+    await ledgerStep(logger, "sweep-pending-steps", () => sweepPendingStepExecutions(deps.pool, runId));
+    // A step that the neverFits halt canceled in its pause leaves its row, thus the end of the run clears each row of the run.
+    await ledgerStep(logger, "clear-run-pauses", () => clearPausesOfWork(deps.pool, runId));
     // The run end was emitted above. These branches only fan out the UI stream part, whose
     // completed/failed shapes genuinely differ — the provenance record does not.
     if (status === "completed" || status === "partial") {
         const artifactCount = await DBOS.runStep(async () => await countArtifactsByRuns(deps.pool, input.analysisId, [runId])
             .map((counts) => counts[0]?.count ?? 0)
             .unwrapOr(0), { name: "count-run-artifacts" });
-        await emitStreamPart({
+        const runCompleted = {
             type: "data-run-completed",
             runId,
             status,
@@ -1391,20 +1313,18 @@ async function collectAndComplete(args) {
                 title: f.title,
                 confidence: f.confidence,
             })),
-            ...(status === "partial"
-                ? {
-                    note: `${completed.size} of ${input.steps.length} steps completed; results are partial.`,
-                }
-                : {}),
-            ...(args.usage ? { usage: args.usage } : {}),
-        });
+        };
+        if (status === "partial")
+            runCompleted.note = `${completed.size} of ${input.steps.length} steps completed; results are partial.`;
+        if (args.usage)
+            runCompleted.usage = args.usage;
+        await emitStreamPart(runCompleted);
     }
     else {
         await emitStreamPart({
             type: "data-run-failed",
             runId,
-            error: failureReason ?? (suspended !== null ? suspended.reason : "Run canceled before completion"),
-            ...(suspended !== null ? { reason: suspended.reason } : {}),
+            error: failureReason ?? "Run canceled before completion",
         });
     }
     return {
@@ -1423,9 +1343,7 @@ async function collectAndComplete(args) {
  * status vocabulary without a cast.
  */
 function deriveFinalStatus(args) {
-    const { totalSteps, completed, failed, canceled, suspended } = args;
-    if (suspended)
-        return "suspended_insufficient_funds";
+    const { totalSteps, completed, failed, canceled } = args;
     if (failed.size > 0) {
         return completed.size > 0 ? "partial" : "failed";
     }