@inflexa-ai/harness 0.46.2 → 0.47.0

package/dist/tools/workspace/run-exec.js

@@ -1,17 +1,17 @@
 /**
- * Internal helper used by dependency-bearing tools to drive one sandbox exec
- * through the `SandboxClient`. It wraps each sandbox event in a
- * `data-sandbox-event` part, thus `execute_command` and the container readout
- * of `scan_inputs` report progress in one shape.
+ * Internal helper of the tools that run a sandbox command through the lease of their step. It wraps each sandbox
+ * event in a `data-sandbox-event` part, thus `execute_command` and the container readout of `scan_inputs` report
+ * progress in one shape.
  *
- * Not a registered tool — `defineTool` is called by the user-facing tools
- * (`execute-command.ts`) which wrap this.
+ * Not a registered tool — `defineTool` is called by the user-facing tools (`execute-command.ts`) which wrap this.
  */
-export function runSandboxExec(args) {
-    return args.sandboxClient.exec(args.sandbox, {
-        command: args.command,
-        cwd: args.cwd,
-        env: args.env,
-        timeoutSeconds: args.timeoutSeconds,
-    }, (event) => args.emit({ type: "data-sandbox-event", data: { event } }), args.deadlineMs);
+import { err, ok } from "neverthrow";
+/** The error of an exec with no lease. The order "acquire, then exec" is a rule of the code, not of a prompt. */
+export const NO_SANDBOX_ERROR = "No sandbox is held. Call acquire_sandbox with the size that the command needs, then run the command again.";
+export async function runSandboxExec(args) {
+    const ran = await args.lease.exec({ command: args.command, cwd: args.cwd, env: args.env, timeoutSeconds: args.timeoutSeconds }, (event) => args.emit({ type: "data-sandbox-event", data: { event } }));
+    if (ran.isOk())
+        return ok(ran.value);
+    const detail = ran.error.detail === undefined ? "" : ` (${ran.error.detail})`;
+    return err({ error: `${NO_SANDBOX_ERROR}${detail}`, retryable: false });
 }

package/dist/tools/workspace/scan-inputs.d.ts

@@ -12,17 +12,14 @@
  * footer-indexed container reaches into the sandbox (see `input-scan/enrich.ts`).
  */
 import { z } from "zod";
-import type { SandboxClient } from "../../sandbox/client.js";
-import type { SandboxRef } from "../../sandbox/types.js";
+import type { BoundLease } from "../../sandbox/leases.js";
 import type { WorkspaceFilesystem } from "../../workspace/filesystem.js";
 import { type Tool } from "../define-tool.js";
 export type ScanInputsDeps = {
     readonly workspaceFs: WorkspaceFilesystem;
     readonly analysisId: string;
     /** Omit to skip the container readouts; the prefix readouts run regardless. */
-    readonly sandboxClient?: SandboxClient;
-    readonly sandbox?: SandboxRef;
-    readonly deadlineMs: () => number;
+    readonly lease?: BoundLease;
 };
 type ScanInputsOutput = {
     readonly path: string;

package/dist/tools/workspace/scan-inputs.js

@@ -32,6 +32,7 @@ const ScanInputsInputSchema = z.object({
 export function createScanInputsTool(deps) {
     return defineTool({
         id: "scan_inputs",
+        ownStep: true,
         description: "Scan a directory of input files and report what is OBSERVABLE about it: per-format counts, " +
             "the shapes its filenames form (sets of files whose names differ only at marked positions), " +
             "the distinct values each varying position takes, how those positions co-occur, value overlap " +
@@ -55,10 +56,8 @@ export function createScanInputsTool(deps) {
                 shapes: scan.manifest.shapes,
                 session: ctx.session,
                 fs: deps.workspaceFs,
-                sandboxClient: deps.sandboxClient,
-                sandbox: deps.sandbox,
+                lease: deps.lease,
                 mountRoot: `/${deps.analysisId}`,
-                deadlineMs: deps.deadlineMs(),
                 emit: ctx.emit,
             });
             const manifest = { ...scan.manifest, shapes };

package/dist/tools/workspace/show-file.js

@@ -30,7 +30,7 @@ const ShowFileInputSchema = z.object({
 });
 export const showFileTool = defineTool({
     id: "show_file",
-    description: "Display EXISTING analysis artifacts in chat by path — images, CSVs, PDFs, notebooks, logs. " +
+    description: "Display EXISTING analysis artifacts in chat by path — images, CSVs, PDFs, notebooks, logs, and a `.pdb` or `.cif` structure that a step wrote. " +
         "The card references the file directly and its content is fetched when the user views it: you never read, " +
         "inline, or paste the bytes. Pick this tool by what you are referencing, not by how the output looks: " +
         "NOT for content you synthesized (a chart, a table, a snippet you invented — use `show_user`), NOT for a stored plan (`show_plan`). " +

package/dist/tools/workspace/show-plan.js

@@ -26,12 +26,13 @@ export function createShowPlanTool(pool) {
     return defineTool({
         id: "show_plan",
         description: "Display a STORED plan in chat by its planId. The plan is loaded from storage and embedded in the card, " +
-            "so the UI renders it directly. Use it to present the plan `generate_plan` just produced, and when the user " +
-            "asks to see an earlier plan again. " +
+            "so the UI renders it directly. Use it when the user asks to see an earlier plan again: `generate_plan` shows the card " +
+            "of the plan that it makes. " +
             "Pick this tool by what you are referencing, not by how the output looks: " +
             "NOT for a plan you are drafting in conversation (that is `generate_plan`), NOT for other synthesized content " +
             "(`show_user`), NOT for analysis files (`show_file`). Never re-type a plan's steps into a `show_user` markdown " +
-            "card — that renders a second, divergent copy of the same plan.",
+            "card — that renders a second, divergent copy of the same plan. " +
+            "`shown: false` with `plan_not_found` means that the planId is no longer valid: generate a new plan, because a retry of the same planId fails the same way.",
         inputSchema: ShowPlanInputSchema,
         describeCall: ({ planId }) => planId,
         execute: async ({ planId, title }, ctx) => {

package/dist/tools/workspace/write-file.js

@@ -27,7 +27,8 @@ export function createWriteFileTool(deps) {
             "missing parent directories. On success it returns `status: ok`, the absolute " +
             "'/<analysisId>/...' path, and `bytesWritten`. A path outside the working directory " +
             "returns an `out_of_prefix` data variant (no I/O), one escaping the analysis tree returns " +
-            "`out_of_scope`, and a symbolic link on the path returns `symlink_denied`.",
+            "`out_of_scope`, and a symbolic link on the path returns `symlink_denied`. A path under the staged " +
+            "inputs returns `read_only` with the reason.",
         inputSchema: WriteFileInputSchema,
         // The path only. `content` is a whole file and must never ride a display
         // channel, which the emit-site length cap enforces regardless.

package/dist/workflows/execute-analysis-scheduler.d.ts

@@ -17,7 +17,6 @@
  * pure means parent recovery replays the same dispatch sequence given the
  * same persisted child outcomes.
  */
-import type { MachineBudget, ResourceSpec } from "../config/resource-limits.js";
 /**
  * The minimum shape the scheduler needs from a plan step. Larger workflow-state
  * schemas are a superset of this, keeping the scheduler decoupled.
@@ -26,22 +25,6 @@ export type PlanStep = {
     readonly id: string;
     readonly depends_on: readonly string[];
 };
-/** Budget-admission inputs — the snapshotted machine budget from the workflow
- *  input plus each step's plan-declared resources. */
-export type BudgetAdmission = {
-    readonly budget: MachineBudget;
-    readonly resourcesByStepId: Readonly<Record<string, ResourceSpec>>;
-};
-/** Partition of the dependency-satisfied steps under budget admission. */
-export type ScheduledSteps = {
-    /** Steps to start now — they fit the remaining budget capacity. */
-    readonly admit: readonly string[];
-    /** Dependency-satisfied steps held until in-flight steps free capacity. */
-    readonly heldForCapacity: readonly string[];
-    /** Steps whose declared resources exceed the budget outright — they could
-     *  never be admitted even against an empty budget. */
-    readonly neverFits: readonly string[];
-};
 /** Thrown when the plan DAG contains a dependency cycle. */
 export declare class CycleError extends Error {
     readonly involvedSteps: readonly string[];
@@ -71,17 +54,8 @@ export declare function validatePlanDag<S extends PlanStep>(steps: readonly S[])
  * completion (or on parent recovery) and dispatches each returned id via
  * `DBOS.startWorkflow`. Order in the returned array follows the plan's
  * declared order for deterministic dispatch.
- *
- * With `admission`, the dependency-satisfied steps are additionally gated on
- * the machine budget and partitioned instead of returned flat: a step is
- * admitted only while the declared resources of the in-flight steps
- * (`startedSet`) plus every step admitted earlier in the round leave room for
- * it. Admission is greedy in plan order with skip-over — a candidate that does
- * not fit never blocks a later, smaller one. Determinism holds because every
- * input derives from the workflow input and checkpointed completion state.
  */
 export declare function scheduleReady(steps: readonly PlanStep[], completedSet: ReadonlySet<string>, startedSet?: ReadonlySet<string>): string[];
-export declare function scheduleReady(steps: readonly PlanStep[], completedSet: ReadonlySet<string>, startedSet: ReadonlySet<string>, admission: BudgetAdmission): ScheduledSteps;
 /**
  * Compute a depth per step. A step with no dependencies is level 0; a step
  * with deps is `max(level(dep)) + 1`. Used by the UI for column layout in

package/dist/workflows/execute-analysis-scheduler.js

@@ -113,7 +113,17 @@ function detectCycle(steps) {
         }
     }
 }
-export function scheduleReady(steps, completedSet, startedSet = new Set(), admission) {
+// ── Scheduling ───────────────────────────────────────────────────────
+/**
+ * Return every step that is now eligible to start: all of its `depends_on`
+ * are in `completedSet`, and the step itself is not yet in `startedSet`.
+ *
+ * Pure function — the parent workflow recomputes this after every child
+ * completion (or on parent recovery) and dispatches each returned id via
+ * `DBOS.startWorkflow`. Order in the returned array follows the plan's
+ * declared order for deterministic dispatch.
+ */
+export function scheduleReady(steps, completedSet, startedSet = new Set()) {
     const ready = [];
     for (const step of steps) {
         if (startedSet.has(step.id) || completedSet.has(step.id))
@@ -122,37 +132,7 @@ export function scheduleReady(steps, completedSet, startedSet = new Set(), admis
             ready.push(step.id);
         }
     }
-    if (!admission)
-        return ready;
-    const { budget, resourcesByStepId } = admission;
-    // A step with no declared resources weighs nothing — it is never throttled,
-    // matching the unbudgeted legacy behavior for that step.
-    const weightOf = (id) => resourcesByStepId[id] ?? { cpu: 0, memoryGb: 0 };
-    let usedCpu = 0;
-    let usedMemoryGb = 0;
-    for (const id of startedSet) {
-        const w = weightOf(id);
-        usedCpu += w.cpu;
-        usedMemoryGb += w.memoryGb;
-    }
-    const admit = [];
-    const heldForCapacity = [];
-    const neverFits = [];
-    for (const id of ready) {
-        const w = weightOf(id);
-        if (w.cpu > budget.cpu || w.memoryGb > budget.memoryGb) {
-            neverFits.push(id);
-        }
-        else if (usedCpu + w.cpu <= budget.cpu && usedMemoryGb + w.memoryGb <= budget.memoryGb) {
-            admit.push(id);
-            usedCpu += w.cpu;
-            usedMemoryGb += w.memoryGb;
-        }
-        else {
-            heldForCapacity.push(id);
-        }
-    }
-    return { admit, heldForCapacity, neverFits };
+    return ready;
 }
 // ── Topological levels (UI layout) ───────────────────────────────────
 /**

package/dist/workflows/execute-analysis.d.ts

@@ -37,9 +37,6 @@
  *       part, and are never dispatched. In-flight siblings and independent
  *       ready steps continue; the loop drains and the run finalises (typically
  *       `partial`).
- *     - the halt cascade (cancel in-flight via
- *       `Promise.allSettled(handles.map(h => DBOS.cancelWorkflow(h.workflowID)))`,
- *       stop scheduling) survives only for the `neverFits` plan-validation guard.
  *  4. Pause (work-pause spec)
  *     - a step pauses in its own workflow, and the parent waits for its result as
  *       for a step that runs. The other steps go on, and the run row stays
@@ -65,8 +62,9 @@
  *     - WRITES NOTHING to the conversation thread (results are pull-only
  *       via `inspectRun`)
  */
+import type { WorkspaceFilesystem } from "../workspace/filesystem.js";
+import type { ScriptRuntime } from "../tools/script/run-script.js";
 import type { Querier } from "../state/db.js";
-import type { MachineBudget, ResourceSpec } from "../config/resource-limits.js";
 import type { RunSession } from "../auth/types.js";
 import type { RunAuthorizer } from "../execution/run-authorizer.js";
 import type { Logger } from "../lib/logger.js";
@@ -113,24 +111,10 @@ export type ExecuteAnalysisInput = {
      * plan row (a mid-run plan edit cannot change a running run's instructions).
      */
     readonly planStepById: Readonly<Record<string, AnalysisStep>>;
+    /** The request that the plan answers, which the seed of each step renders. Absent when the plan stores none. */
+    readonly request?: string;
     /** Per-step agent id (sandbox catalog entry). */
     readonly agentByStepId: Readonly<Record<string, string>>;
-    /** Per-step planner-estimated sandbox resource request. */
-    readonly resourcesByStepId: Readonly<Record<string, ResourceSpec>>;
-    /**
-     * Per-step execution timeout in seconds, from the plan's `step.timeout`.
-     * Only present for steps that declared one; the child falls back to
-     * `DEFAULT_STEP_TIMEOUT_SECONDS` when a step is absent here.
-     */
-    readonly timeoutByStepId?: Readonly<Record<string, number>>;
-    /**
-     * Machine resource budget snapshotted by `executePlan` at the async edge.
-     * The scheduler admits dependency-satisfied steps only while the declared
-     * resources of concurrently running steps fit within it. Absent (no policy
-     * configured, or a workflow persisted before this field existed), every
-     * dependency-satisfied step starts immediately — the legacy fan-out.
-     */
-    readonly budget?: MachineBudget;
     /**
      * Replay-stable run-level synthesis decision. Absent preserves the legacy
      * behavior for workflows persisted before this field existed.
@@ -159,12 +143,10 @@ export type ExecuteAnalysisResult = {
     readonly canceledSteps: readonly string[];
 };
 /**
- * A step's in-run display state. Wider than the ledger's `StepExecutionStatus`: `queued` is a
- * scheduler-only condition (dependency-satisfied but held for budget capacity) that never reaches a
- * database row, and `skipped` is asserted mid-run for a doomed dependent whose ledger row stays
- * `pending` until the terminal sweep.
+ * A step's in-run display state. Wider than the ledger's `StepExecutionStatus`: `skipped` is asserted
+ * mid-run for a doomed dependent whose ledger row stays `pending` until the terminal sweep.
  */
-export type StepRuntimeStatus = "pending" | "queued" | "running" | "completed" | "failed" | "skipped";
+export type StepRuntimeStatus = "pending" | "running" | "completed" | "failed" | "skipped";
 /**
  * One step's state inside a {@link RunObservation}. `id` is the plan slug the ledger and the
  * dependency edges use; `name` is the human phrase the plan author wrote, which is the only field
@@ -221,21 +203,21 @@ export type ExecuteAnalysisDeps = {
     readonly sandboxStepCallable: SandboxStepCallable;
     /** Workspace-root resolution seam — run dir creation + synthesis disk reads. */
     readonly resolveWorkspaceRoot: ResolveWorkspaceRoot;
+    /** The read path of the workspace. The synthesizer reads the files of the run through it. */
+    readonly workspaceFs: WorkspaceFilesystem;
     /** Model id for the synthesizer agent loop. */
     readonly synthesisModel: string;
-    /** The `literature_reviewer` tool of the synthesis. The runtime registers its sub-agent one time. */
-    readonly literatureReviewer: Tool;
+    /** The lookup tools of the synthesis (`createSynthesisLookupTools`). */
+    readonly synthesisLookups: readonly Tool[];
+    /** Where the VM of `run_script` comes from, for the lookups of the synthesizer. */
+    readonly scriptRuntime?: ScriptRuntime;
     /** Run-level billing-bracket seam (managed: external bracket; OSS: no-op). */
     readonly runCharge: RunCharge;
     /** The delays of the timer of an outage. Absent: the default of the pause. */
     readonly pauseRetryDelaysMs?: readonly number[];
     /** Run-authorization seam — the terminal path revokes through `revoke`. */
     readonly runAuthorizer: RunAuthorizer;
-    /**
-     * LLM usage-accounting seam for the in-body synthesizer loop (and the
-     * literature reviewer it delegates to); omitted falls back to the no-op
-     * recorder.
-     */
+    /** LLM usage-accounting seam for the in-body synthesizer loop; omitted falls back to the no-op recorder. */
     readonly usageRecorder?: UsageRecorder;
     /** The store of the loops of the run synthesis and of their read tools. */
     readonly toolOutputStore?: ToolOutputStore;
@@ -297,7 +279,7 @@ export type ExecuteAnalysisDeps = {
  * level computation and the seed (`prompt`, composed by `composeStepSeed` at
  * dispatch); the rest comes from `ExecuteAnalysisInput`. The body fills in
  * `runSession` via `forStep` after this returns. Exported for the
- * projection/timeout-propagation tests.
+ * projection tests.
  */
 export declare function buildChildInput(args: {
     input: ExecuteAnalysisInput;
@@ -388,8 +370,8 @@ export declare function synthesisRowUpdate(outcome: {
  * quick-display findings for the run-completed card; empty when synthesis is
  * skipped or produced no synthesizable content. A genuine failure re-throws,
  * failing the run (D10). It runs in the body of the run workflow: each read and
- * write is a step, each model call is a step, and each reviewer call starts a
- * child workflow. Exported so integration tests can drive the wired synthesis
+ * write is a step, each model call is a step, and each lookup call is a step.
+ * Exported so integration tests can drive the wired synthesis
  * without a full parent body.
  */
 export declare function synthesizeFindings(args: {

package/dist/workflows/execute-analysis.js

@@ -37,9 +37,6 @@
  *       part, and are never dispatched. In-flight siblings and independent
  *       ready steps continue; the loop drains and the run finalises (typically
  *       `partial`).
- *     - the halt cascade (cancel in-flight via
- *       `Promise.allSettled(handles.map(h => DBOS.cancelWorkflow(h.workflowID)))`,
- *       stop scheduling) survives only for the `neverFits` plan-validation guard.
  *  4. Pause (work-pause spec)
  *     - a step pauses in its own workflow, and the parent waits for its result as
  *       for a step that runs. The other steps go on, and the run row stays
@@ -81,7 +78,6 @@ import { recordRunCompleted, recordStepCompleted, stepOutcomeOf } from "../lib/m
 import { describeDbError, withTransaction } from "../lib/db-result.js";
 import { unwrapOrThrow } from "../lib/result.js";
 import { countArtifactsByRuns, insertStepExecution, loadDataProfileStatus, queryActiveRun, queryStepArtifactPaths, queryStepsByRun, seedStepExecutions, setRunSynthesisOutcome, sweepPendingStepExecutions, updateRunStatus, updateStepExecution, } from "../state/index.js";
-import { clearPausesOfWork } from "../state/paused-work.js";
 import { addChatUsage, hasReportedUsage } from "../loop/metrics.js";
 import { flattenDataPart } from "../contracts/chat-frame.js";
 import { SYNTHESIS_AGENT_ID, loadStepSummariesFromDisk } from "../execution/run-synthesis.js";
@@ -90,7 +86,6 @@ import { SYNTHESIS_STEP_ID, runDir, runStepDir, stepSubdir, stepWritePrefix, toS
 import { isChatDataPart, synthesisEmission } from "../sandbox/sandbox-step-translate.js";
 import { synthesizeRun } from "../app/synthesize-run.js";
 import { computeTopologicalLevels, scheduleReady, validatePlanDag } from "./execute-analysis-scheduler.js";
-import { recordCancelledChild } from "./metrics.js";
 import { pauseAtGate, workPause } from "./pause.js";
 import { presentGet } from "../lib/present.js";
 // ── In-body orchestration helpers ────────────────────────────────────
@@ -183,14 +178,10 @@ function observeRunGuarded(deps, observation) {
  * level computation and the seed (`prompt`, composed by `composeStepSeed` at
  * dispatch); the rest comes from `ExecuteAnalysisInput`. The body fills in
  * `runSession` via `forStep` after this returns. Exported for the
- * projection/timeout-propagation tests.
+ * projection tests.
  */
 export function buildChildInput(args) {
     const { input, stepId, level, runId, prompt, templateBinding } = args;
-    const resources = input.resourcesByStepId[stepId];
-    if (!resources) {
-        throw new Error(`executeAnalysis: step "${stepId}" missing from resourcesByStepId — every step must declare resources`);
-    }
     const planStep = input.planStepById[stepId];
     if (!planStep) {
         throw new Error(`executeAnalysis: step "${stepId}" missing from planStepById — every step must carry its plan data`);
@@ -213,8 +204,6 @@ export function buildChildInput(args) {
         templateBinding,
         level,
         prompt,
-        resources,
-        timeoutSeconds: input.timeoutByStepId?.[stepId],
     };
 }
 // ── Seed composition (at dispatch, not at plan submission) ────────────
@@ -303,6 +292,7 @@ export async function gatherStepPackage(args) {
             profile: profile?.result ?? null,
             upstream,
             memory: { goal: memory.goal, constraints: memory.constraints },
+            request: input.request,
             ...contract.briefing,
         },
         templateBinding: contract.binding,
@@ -504,8 +494,8 @@ export function synthesisRowUpdate(outcome, durationMs) {
  * quick-display findings for the run-completed card; empty when synthesis is
  * skipped or produced no synthesizable content. A genuine failure re-throws,
  * failing the run (D10). It runs in the body of the run workflow: each read and
- * write is a step, each model call is a step, and each reviewer call starts a
- * child workflow. Exported so integration tests can drive the wired synthesis
+ * write is a step, each model call is a step, and each lookup call is a step.
+ * Exported so integration tests can drive the wired synthesis
  * without a full parent body.
  */
 export function synthesizeFindings(args) {
@@ -536,8 +526,10 @@ export function synthesizeFindings(args) {
         provider: deps.provider,
         embedding: deps.embedding,
         resolveWorkspaceRoot: deps.resolveWorkspaceRoot,
+        workspaceFs: deps.workspaceFs,
         synthesisModel: deps.synthesisModel,
-        literatureReviewer: deps.literatureReviewer,
+        synthesisLookups: deps.synthesisLookups,
+        scriptRuntime: deps.scriptRuntime,
         usageRecorder: deps.usageRecorder,
         toolOutputStore: deps.toolOutputStore,
     }, {
@@ -845,12 +837,6 @@ async function runSchedulerLoop(args) {
     // exactly without a second channel. A child that settled by throwing carries
     // no result and therefore contributes nothing — same rule as its duration.
     const runUsage = {};
-    // Child workflow ids the parent itself cancelled (the neverFits halt cascade). Their `getResult`
-    // rejects with a DBOS cancellation error and lands in the settlement error branch — but the step was
-    // CANCELED by us, not failed on its own merits. Keyed here (deterministic: `cancelInFlight` runs the
-    // same way on a replay) so that branch records it as canceled everywhere, matching how a child that
-    // returns a graceful `{status:"canceled"}` is already handled.
-    const canceledByParent = new Set();
     const stepRuntime = new Map();
     for (const step of input.steps) {
         stepRuntime.set(step.id, { status: "pending" });
@@ -872,7 +858,7 @@ async function runSchedulerLoop(args) {
      * can never become dependency-satisfied and will never be dispatched.
      * Stream-only — ledger rows stay `pending` until the terminal sweep flips
      * them to `skipped`. Dependents of an unfinished step are necessarily
-     * `pending` (never queued/running); an already-`skipped` one is not
+     * `pending` (never running); an already-`skipped` one is not
      * re-walked.
      */
     const markDependentsSkipped = (failedStepId) => {
@@ -887,9 +873,6 @@ async function runSchedulerLoop(args) {
             }
         }
     };
-    // Halts scheduling entirely — reserved for the `neverFits` guard. An ordinary
-    // step failure does NOT set it: it dooms only that step's transitive dependents.
-    let halted = false;
     let failureReason = null;
     const stepIndexById = new Map(input.steps.map((s, i) => [s.id, i]));
     const emitDagSnapshot = async () => {
@@ -932,59 +915,14 @@ async function runSchedulerLoop(args) {
         observeRunGuarded(deps, buildRunObservation({ input, runId, status: "running", stepStates: stepRuntime }));
     };
     const dispatchReady = async () => {
-        if (halted)
-            return;
         const inFlightStepIds = new Set([...inFlight.values()].map((h) => h.stepId));
         // A settled-but-not-completed step (failed / blocked / canceled) is not
         // in `completed` and not in flight, so `scheduleReady` would offer it
-        // again — filter it out of the candidate list. This also stops its
-        // declared resources from weighing against the budget: settled steps
-        // hold no capacity.
+        // again — filter it out of the candidate list.
         const candidates = input.steps.filter((s) => !failed.has(s.id) && !canceled.has(s.id));
-        let admit;
-        let queuedChanged = false;
-        if (input.budget) {
-            const scheduled = scheduleReady(candidates, completed, inFlightStepIds, {
-                budget: input.budget,
-                resourcesByStepId: input.resourcesByStepId,
-            });
-            if (scheduled.neverFits.length > 0) {
-                // An over-budget step can never be admitted — plan-time validation
-                // makes this unreachable for new plans; stored plans fail loudly
-                // instead of waiting forever. The stored plan is invalid against
-                // this machine, so the run halts outright — unlike an ordinary
-                // step failure, which dooms only its dependents.
-                for (const stepId of scheduled.neverFits) {
-                    const r = input.resourcesByStepId[stepId];
-                    const declared = r ? `${r.cpu} CPU / ${r.memoryGb} GB` : "undeclared";
-                    failed.add(stepId);
-                    stepRuntime.set(stepId, {
-                        status: "failed",
-                        error: `step resources (${declared}) exceed the machine budget (${input.budget.cpu} CPU / ${input.budget.memoryGb} GB)`,
-                    });
-                }
-                halted = true;
-                failureReason = `step "${String(scheduled.neverFits[0])}" exceeds the machine resource budget`;
-                await cancelInFlight(inFlight, "fail_fast", canceledByParent);
-                await emitDagSnapshot();
-                return;
-            }
-            for (const stepId of scheduled.heldForCapacity) {
-                if (presentGet(stepRuntime, stepId, "the runtime of the step").status !== "queued") {
-                    stepRuntime.set(stepId, { status: "queued" });
-                    queuedChanged = true;
-                }
-            }
-            admit = scheduled.admit;
-        }
-        else {
-            admit = scheduleReady(candidates, completed, inFlightStepIds);
-        }
-        if (admit.length === 0) {
-            if (queuedChanged)
-                await emitDagSnapshot();
+        const admit = scheduleReady(candidates, completed, inFlightStepIds);
+        if (admit.length === 0)
             return;
-        }
         for (const stepId of admit) {
             const idx = presentGet(stepIndexById, stepId, "the index of the step");
             const childWorkflowId = `${workflowId}-${idx}`;
@@ -1072,8 +1010,7 @@ async function runSchedulerLoop(args) {
                 // failed or blocked — a blocker (see the harness-sandbox-agents spec)
                 // is treated exactly like a failure: the step declared it cannot
                 // deliver, so only its transitive dependents can never run. In-flight
-                // siblings and independent ready steps continue; the dispatch round
-                // below also lets a budget-held step claim the freed capacity.
+                // siblings and independent ready steps continue.
                 failed.add(settled.stepId);
                 failureReason ??= r.error ?? (r.status === "blocked" ? "step_blocked" : "step_failed");
                 stepRuntime.set(settled.stepId, {
@@ -1088,26 +1025,8 @@ async function runSchedulerLoop(args) {
                 await dispatchReady();
             }
         }
-        else if (canceledByParent.has(settled.childId)) {
-            // The child threw because the PARENT cancelled it (the neverFits halt cascade), not
-            // because it failed on its own — its `getResult` rejects with a DBOS cancellation error.
-            // Record it as canceled, mirroring the graceful `{status:"canceled"}` branch above so the
-            // `canceled` set, the terminal result, and the `step_completed` provenance all agree. No
-            // halt / cancel cascade here: the run is already halted (that is why this child was cancelled).
-            canceled.add(settled.stepId);
-            stepRuntime.set(settled.stepId, {
-                // `stepRuntime` (the DAG snapshot) has no canceled tier; the graceful-cancel branch above
-                // likewise renders canceled steps as "failed", so this stays consistent with it.
-                status: "failed",
-                error: errorMessageOf(settled.err) ?? textOf(settled.err),
-            });
-            stepStatus = "canceled";
-            stepDurationMs = undefined;
-            await emitDagSnapshot();
-        }
         else {
-            // The child threw on its own (not a parent-driven cancel). A throw is
-            // treated exactly like a step failure:
+            // The child threw. A throw is treated exactly like a step failure:
             // dependents doomed, siblings continue.
             failed.add(settled.stepId);
             failureReason ??= errorMessageOf(settled.err) ?? textOf(settled.err);
@@ -1148,17 +1067,6 @@ async function runSchedulerLoop(args) {
         usage: hasReportedUsage(runUsage) ? { ...runUsage } : undefined,
     };
 }
-async function cancelInFlight(inFlight, cause, canceledByParent) {
-    const ids = [...inFlight.keys()];
-    // Record every id BEFORE the cancel so the settlement loop classifies the resulting
-    // DBOS-cancellation rejection as canceled rather than failed (see `canceledByParent`).
-    for (const childId of ids)
-        canceledByParent.add(childId);
-    await Promise.allSettled(ids.map((childId) => DBOS.cancelWorkflow(childId)));
-    for (let i = 0; i < ids.length; i++) {
-        recordCancelledChild({ cause });
-    }
-}
 // ── (6) collectAndComplete ────────────────────────────────────────────
 /** The waits between the attempts are 1, 2, 4, and 8 seconds. */
 const FINAL_STATUS_WRITE_RETRY = { retriesAllowed: true, maxAttempts: 5, intervalSeconds: 1, backoffRate: 2 };
@@ -1294,8 +1202,6 @@ async function collectAndComplete(args) {
     }
     // Sweep never-started steps to `skipped`. Log-don't-rollback, like every other finalisation step here.
     await ledgerStep(logger, "sweep-pending-steps", () => sweepPendingStepExecutions(deps.pool, runId));
-    // A step that the neverFits halt canceled in its pause leaves its row, thus the end of the run clears each row of the run.
-    await ledgerStep(logger, "clear-run-pauses", () => clearPausesOfWork(deps.pool, runId));
     // The run end was emitted above. These branches only fan out the UI stream part, whose
     // completed/failed shapes genuinely differ — the provenance record does not.
     if (status === "completed" || status === "partial") {

package/dist/workflows/pause.js

@@ -14,6 +14,7 @@ import { DBOS } from "@dbos-inc/dbos-sdk";
 import { z } from "zod";
 import { createNoopLogger } from "../lib/console-logger.js";
 import { deliverNotice } from "../lib/hooks.js";
+import { trackWorkPaused } from "../lib/metrics.js";
 import { unwrapOrThrow } from "../lib/result.js";
 import { isTurnCredentialMissing } from "../loop/turn-credentials.js";
 import { modelFailureOf } from "../providers/errors.js";
@@ -123,30 +124,36 @@ export function workPause(scope) {
             await suspendCredential("pause.suspend");
         await scope.emit({ type: "data-pause", id: workflowId, ...work, state, cause, attempt, retryAt });
         log.warn("work paused", { workflowId, ...work, state, cause: cause.kind, attempt });
-        const waited = await waitForMessage(topic, delayMs, signal);
         let end;
-        if (waited === "hold") {
-            // A person held the work: the timer stops, and the work waits for a resume.
-            await DBOS.runStep(async () => unwrapOrThrow(await recordPause(scope.pool, {
-                workflowId,
-                ...work,
-                analysisId: scope.analysisId,
-                threadId: scope.threadId,
-                state: "paused",
-                cause,
-                attempt,
-                topic,
-                pausedAt: new Date(pausedAt).toISOString(),
-                runSession: scope.run?.session,
-            })), { name: "pause.hold" });
-            await suspendCredential("pause.hold.suspend");
-            await scope.emit({ type: "data-pause", id: workflowId, ...work, state: "paused", cause, attempt });
-            log.info("work held", { workflowId, ...work, attempt });
-            const held = await waitForMessage(topic, undefined, signal);
-            end = held === "hold" ? "resume" : held;
+        const untrack = trackWorkPaused({ workKind: scope.workKind });
+        try {
+            const waited = await waitForMessage(topic, delayMs, signal);
+            if (waited === "hold") {
+                // A person held the work: the timer stops, and the work waits for a resume.
+                await DBOS.runStep(async () => unwrapOrThrow(await recordPause(scope.pool, {
+                    workflowId,
+                    ...work,
+                    analysisId: scope.analysisId,
+                    threadId: scope.threadId,
+                    state: "paused",
+                    cause,
+                    attempt,
+                    topic,
+                    pausedAt: new Date(pausedAt).toISOString(),
+                    runSession: scope.run?.session,
+                })), { name: "pause.hold" });
+                await suspendCredential("pause.hold.suspend");
+                await scope.emit({ type: "data-pause", id: workflowId, ...work, state: "paused", cause, attempt });
+                log.info("work held", { workflowId, ...work, attempt });
+                const held = await waitForMessage(topic, undefined, signal);
+                end = held === "hold" ? "resume" : held;
+            }
+            else {
+                end = waited;
+            }
         }
-        else {
-            end = waited;
+        finally {
+            untrack();
         }
         await DBOS.runStep(async () => unwrapOrThrow(await clearPause(scope.pool, workflowId)), { name: "pause.clear" });
         await scope.emit({ type: "data-pause", id: workflowId, ...work, state: "running" });