@intx/workflow-host 0.2.2 → 0.4.0

package/dist/supervisor/supervisor.js

@@ -43,49 +43,90 @@ import { type } from "arktype";
 import { getLogger } from "@intx/log";
 import { sampleStructuralCounters, forceRepack, } from "./dispatch-attribution.js";
 import { generateKeyPair } from "@intx/crypto";
-import { enqueueInbox as defaultEnqueueInbox, dequeueToProcessing as defaultDequeueToProcessing, markConsumed as defaultMarkConsumed, readOwnedMessageIds, replayProcessingToInbox as defaultReplayProcessingToInbox, DEFAULT_CONSUMED_RETENTION_MS, } from "@intx/hub-sessions/substrate";
-import { base64Decode, base64Encode, hexEncode } from "@intx/types";
+import { enqueueInbox as defaultEnqueueInbox, dequeueToProcessing as defaultDequeueToProcessing, markConsumed as defaultMarkConsumed, scanRunsForBoot, readWorkflowRunLifecycle, replayProcessingToInbox as defaultReplayProcessingToInbox, StaleInboxEnqueueError, DEFAULT_CONSUMED_RETENTION_MS, } from "@intx/hub-sessions/substrate";
+import { base64Decode, base64Encode, deriveMessageId, deriveWorkflowRunId, signalName, } from "@intx/types";
 import { RepoId } from "@intx/types/sidecar";
 import { createControlChannelSender, generateChannelId, generateHmacKey, receiveControlChannel, receiveEventChannel, } from "../ipc/index.js";
 import { assembleCredentialsSnapshot, } from "./credentials.js";
 import { commitCancelRequested } from "./cancel-signing.js";
+import { commitRunFailed } from "./terminal-commit.js";
 import { buildChildSpawnEnv } from "./spawn-env.js";
 import { compactRunEvents } from "./run-event-compaction.js";
+import { recoverInterruptedCompactions } from "./run-event-recovery.js";
+import { decodeMail } from "@intx/mime";
+import { commitMail, InvalidMailError } from "../adapters/mail-part-store.js";
+import { mergeCredentialDelivery } from "../child/credential-cell.js";
+import { createSubstrateMailboxStore, MAILBOX_INBOX_DIR, } from "../adapters/substrate-mailbox-store.js";
 import { createDrainTimeoutAccumulator, DEFAULT_DRAIN_TIMEOUT_MS, } from "./drain-timeout.js";
 import { createRecyclePolicy, triggerRecycle, } from "./recycle.js";
 import { createTerminalBroadcaster, } from "./terminal-broadcaster.js";
 import { DEFAULT_KILL_TIMEOUT_MS, DEFAULT_READY_TIMEOUT_MS, defaultClearTimer, defaultSetTimer, killChildHandle, waitDeadline, } from "./child-termination.js";
 const logger = getLogger(["workflow-host", "supervisor"]);
+/** IMAP system flag marking a dispatched mailbox entry as read. */
+const MAILBOX_FLAG_SEEN = "\\Seen";
 /**
- * Default watchdog timeout for the supervisor's
- * `synchronouslyDispatchTerminalWrite`. The handler holds the
- * `substrate.write.response` back to the child until the dispatch
- * loop's `markConsumed` settles for the matching terminal event; an
- * unbounded wait would chain into a child / runtime / dispatch loop
- * deadlock if `markConsumed` never armed (bug in the dispatch loop, a
- * torn-down cohort, a stalled inbox primitive). 30s sits between the
- * recycle path's `DEFAULT_KILL_TIMEOUT_MS` (5s, a hard process-level
- * kill cap) and `DEFAULT_DRAIN_TIMEOUT_MS` (60s, the per-deployment
- * drain budget) -- generous enough to absorb a slow legitimate
- * markConsumed, tight enough to surface a real deadlock long before
- * the drainTimeout would otherwise mask it.
+ * Interchange keyword flag marking a mailbox entry the supervisor has dispatched
+ * as a workflow turn (a `trigger.fire` or `signal.deliver`).
  */
-export const DEFAULT_TERMINAL_WRITE_WATCHDOG_MS = 30_000;
+const MAILBOX_FLAG_PROCESSED = "$Processed";
 /**
- * Raised when a `pendingMerges` entry or a
- * `markConsumedCompletionWaiters` waiter is rejected because the
- * cohort it was registered against has been aborted (cohort transition
- * during a recycle, or a supervisor shutdown). Callers awaiting the
- * resolved value receive an instance of this error so the failure mode
- * is recognisable from a generic substrate-merge or markConsumed
- * failure.
+ * IMAP system flag marking a mailbox entry for expunge. The warm agent sets it
+ * (via `mail_flag`) to consume a processed message; a subsequent `expunge`
+ * sweeps every entry carrying it out of the live INBOX.
  */
-export class MergeAbortedError extends Error {
-    constructor(reason) {
-        super(`supervisor cohort aborted before completion: ${reason}`);
-        this.name = "MergeAbortedError";
-    }
-}
+const MAILBOX_FLAG_DELETED = "\\Deleted";
+/**
+ * Default crash-loop bound: the supervisor stops respawning and latches
+ * the deployment once the workflow-process child exits unexpectedly this
+ * many times within `DEFAULT_CRASH_LOOP_WINDOW_MS`. Overridable via
+ * `WorkflowSupervisorBindings.crashLoopMaxCount`.
+ */
+export const DEFAULT_CRASH_LOOP_MAX_COUNT = 3;
+/**
+ * Default sliding window (ms) over which `DEFAULT_CRASH_LOOP_MAX_COUNT`
+ * unexpected exits latch the deployment. Overridable via
+ * `WorkflowSupervisorBindings.crashLoopWindowMs`.
+ */
+export const DEFAULT_CRASH_LOOP_WINDOW_MS = 60_000;
+/**
+ * Default stable-run duration (ms): once a respawned child stays up this
+ * long, the crash counter resets so flapping followed by stability does
+ * not permanently latch. Overridable via
+ * `WorkflowSupervisorBindings.crashLoopStableResetMs`.
+ */
+export const DEFAULT_CRASH_LOOP_STABLE_RESET_MS = 60_000;
+/**
+ * Default initial respawn backoff (ms): the wait before the first respawn
+ * after an unexpected exit. Overridable via
+ * `WorkflowSupervisorBindings.respawnBackoffInitialMs`.
+ */
+export const DEFAULT_RESPAWN_BACKOFF_INITIAL_MS = 1_000;
+/**
+ * Default cap (ms) on the exponential respawn backoff. Kept below
+ * `DEFAULT_CRASH_LOOP_WINDOW_MS` so a slow flapper's crashes still fall
+ * within the window and latch the guard. Overridable via
+ * `WorkflowSupervisorBindings.respawnBackoffMaxMs`.
+ */
+export const DEFAULT_RESPAWN_BACKOFF_MAX_MS = 30_000;
+/**
+ * Default watchdog for `reEmitParkedCorrelations`' wait on the child's
+ * `parked-correlations.response`. 30s is generous enough for a healthy child
+ * to enumerate its in-flight runs and load each parked snapshot, tight
+ * enough that a wedged-but-alive child does not hang the reconnect caller
+ * until some coarser timeout intervenes.
+ */
+export const DEFAULT_PARKED_QUERY_WATCHDOG_MS = 30_000;
+/**
+ * Backstop for `waitForRunTerminalOrPark`. A dispatch waits here for the child
+ * to park or terminate the run before releasing `markConsumed`; a lost park
+ * wake or a wedged child would otherwise hang the deployment's dispatch loop
+ * forever. Five minutes is far beyond any healthy per-message dispatch (which
+ * settles in well under a second), so this never fires on a legitimately long
+ * run without also being a genuine fault -- and when it does fire it is logged
+ * loudly and fails the dispatch (the mail is left reclaimable, never consumed
+ * on the assumption the run made progress), not silently swallowed.
+ */
+export const TERMINAL_OR_PARK_BACKSTOP_MS = 300_000;
 /**
  * Construct a per-deployment supervisor. All host-specific
  * dependencies are pulled in via `bindings`; nothing in the
@@ -93,23 +134,74 @@ export class MergeAbortedError extends Error {
  */
 export function createWorkflowSupervisor(bindings) {
     let state = { phase: "idle" };
+    // The live credential delivery to seed the child on every spawn and every
+    // pre-trigger barrier. Initialized from the deploy-time delivery and MUTATED
+    // by `deliverCredentials` on every runtime update, so a mid-life revocation or
+    // rotation is durable: the re-assertion sites read THIS mirror, not the frozen
+    // `bindings.credentialDelivery`. Reading the frozen delivery would re-add an
+    // evicted credential on the next spawn/barrier, and the warm-recycle path
+    // (seeded only by the barrier) would lose every runtime update. Normalized on
+    // init via the same merge the child applies, so the mirror matches the child's
+    // deduped cell from step zero. Lives outside `state` because `state` is a
+    // phase union replaced on every transition; this must survive them.
+    let currentCredentialDelivery = bindings.credentialDelivery !== undefined
+        ? mergeCredentialDelivery(null, bindings.credentialDelivery, undefined)
+        : null;
     /**
-     * In-flight runIds the supervisor knows about. A runId enters this
-     * set when the supervisor forwards a `trigger.fire` for it on the
-     * control channel; the runId leaves the set when the dispatch
-     * loop's terminal-event watcher fires `markConsumed`. The drain
-     * path arms one accumulator per entry here.
+     * ALL runIds the current child cohort is driving, regardless of
+     * who spawned them: supervisor-dispatched + self-discovered.
+     * Populated at `trigger.fire` time and when the child reports
+     * `resumed.runs`. Removed on terminal event or cohort teardown.
+     *
+     * Used by: `drain()` to arm one drainTimeout accumulator per run.
+     */
+    const cohortRunIds = new Set();
+    /**
+     * Runs observed terminal in this supervisor process. The terminal control
+     * frame follows the durable event commit, but retaining the observation
+     * closes the short visibility window before the working tree reflects that
+     * commit. Terminal membership is permanent for a deployment: the stable
+     * top-level run is never cleared and fired again.
+     */
+    const terminalRunIds = new Set();
+    /**
+     * Per-run input channel cache. When a long-lived run parks on an input
+     * signal, the child sends `park.notify` with `parkKind: "input"`. The
+     * supervisor stores the `correlationId` here so that subsequent mail
+     * deliveries can fire `signal.deliver` without re-reading the substrate.
+     * Cleared on terminal event or cohort abort.
+     */
+    const runInputChannels = new Map();
+    /**
+     * Waiters for dispatch loops blocked on a `park.notify` for a
+     * specific runId. When `park.notify` arrives, the handler resolves
+     * the waiter so the dispatch loop re-evaluates routing.
      */
-    const inFlightRuns = new Set();
-    // D2 attribution (measurement-only): the runId the dispatch loop is
+    const parkNotifyWaiters = new Map();
+    /**
+     * Monotonic per-run INPUT-park generation. Bumped on every
+     * `park.notify(input)` for a runId. `waitForRunTerminalOrPark` captures a
+     * `sinceGen` before its caller's pre-wait awaits and returns `"parked"` when
+     * the generation later exceeds it, so the wait keys on the park EDGE rather
+     * than `runInputChannels`' LEVEL state: a park that fired during the pre-wait
+     * awaits (before the waiter armed, so `resolveParkNotifyWaiter` no-op'd) is
+     * still observed, and a stale `runInputChannels` entry from a prior run or
+     * incarnation cannot false-positive because it did not bump the generation
+     * past `sinceGen`. Incarnation-scoped: cleared with `parkNotifyWaiters` on
+     * recycle/teardown so a reused runId cannot carry a stale captured generation
+     * across incarnations.
+     */
+    const parkGenerations = new Map();
+    // D2 attribution (measurement-only): the messageId the dispatch loop is
     // currently servicing. Set at `dispatch-start`, cleared after
     // `reply-produced`. The dispatch loop is strictly serial (one message
     // in flight at a time -- the sustained interactive case the bench
-    // drives), so a child-proxied WAL `substrate.write.request` (whose
-    // `agent-state/<key>/...` preservePrefix carries no runId) is
-    // unambiguously attributable to this runId. Run-event writes carry the
-    // runId in their `runs/<runId>/events/` prefix and do not need it.
-    let currentDispatchRunId = null;
+    // drives), so a child-proxied `substrate.write.request` is unambiguously
+    // attributable to this message. Both the WAL leg (whose `agent-state/...`
+    // prefix names no run) and the run-event leg (whose `runs/<runId>/events/`
+    // prefix names only the stable per-deployment run id, not the message)
+    // take their per-message key from here.
+    let currentDispatchMessageId = null;
     /**
      * Per-run drainTimeout accumulators armed by `drain()`. Held so
      * `shutdown()` can stop every accumulator cleanly before tearing
@@ -134,21 +226,21 @@ export function createWorkflowSupervisor(bindings) {
             }
         });
     const drainTimeoutMs = bindings.drainTimeoutMs ?? DEFAULT_DRAIN_TIMEOUT_MS;
-    const terminalWriteWatchdogMs = bindings.terminalWriteWatchdogMs ?? DEFAULT_TERMINAL_WRITE_WATCHDOG_MS;
+    const parkedQueryWatchdogMs = bindings.parkedQueryWatchdogMs ?? DEFAULT_PARKED_QUERY_WATCHDOG_MS;
     // Pure observability: invoke the dispatch-timing hook (when wired) at
     // the two per-message boundaries the 4.7 latency gate brackets. A
     // throwing observer is swallowed and logged so a benchmark hook bug
     // cannot wedge the dispatch loop.
-    function emitDispatchTiming(runId, marker, atMs) {
+    function emitDispatchTiming(messageId, marker, atMs) {
         const observer = bindings.onDispatchTiming;
         if (observer === undefined)
             return;
         try {
-            observer({ kind: "roundtrip", runId, marker, atMs });
+            observer({ kind: "roundtrip", messageId, marker, atMs });
         }
         catch (cause) {
             const message = cause instanceof Error ? cause.message : String(cause);
-            logger.warn `onDispatchTiming observer threw for ${runId} (${marker}): ${message}`;
+            logger.warn `onDispatchTiming observer threw for ${messageId} (${marker}): ${message}`;
         }
     }
     // D2 per-leg attribution (measurement-only). Emits a paired
@@ -160,14 +252,14 @@ export function createWorkflowSupervisor(bindings) {
     // observability: a throwing observer is swallowed + logged so a
     // benchmark hook bug cannot wedge dispatch, and no clock or directory
     // is sampled when the observer is unwired.
-    function legMarkStart(runId, leg) {
+    function legMarkStart(messageId, leg) {
         if (bindings.onDispatchTiming === undefined)
             return 0;
         const atMs = performance.now();
         try {
             bindings.onDispatchTiming({
                 kind: "leg",
-                runId,
+                messageId,
                 leg,
                 phase: "start",
                 atMs,
@@ -175,11 +267,11 @@ export function createWorkflowSupervisor(bindings) {
         }
         catch (cause) {
             const message = cause instanceof Error ? cause.message : String(cause);
-            logger.warn `onDispatchTiming leg observer threw for ${runId} (${leg} start): ${message}`;
+            logger.warn `onDispatchTiming leg observer threw for ${messageId} (${leg} start): ${message}`;
         }
         return atMs;
     }
-    function legMarkEnd(runId, leg) {
+    function legMarkEnd(messageId, leg) {
         const observer = bindings.onDispatchTiming;
         if (observer === undefined)
             return;
@@ -193,12 +285,12 @@ export function createWorkflowSupervisor(bindings) {
             // surface it on the log and emit the end mark without counters so
             // the timing slope is still recoverable.
             const message = cause instanceof Error ? cause.message : String(cause);
-            logger.warn `structural-counter sample failed for ${runId} (${leg}): ${message}`;
+            logger.warn `structural-counter sample failed for ${messageId} (${leg}): ${message}`;
         }
         try {
             observer({
                 kind: "leg",
-                runId,
+                messageId,
                 leg,
                 phase: "end",
                 atMs,
@@ -207,7 +299,7 @@ export function createWorkflowSupervisor(bindings) {
         }
         catch (cause) {
             const message = cause instanceof Error ? cause.message : String(cause);
-            logger.warn `onDispatchTiming leg observer threw for ${runId} (${leg} end): ${message}`;
+            logger.warn `onDispatchTiming leg observer threw for ${messageId} (${leg} end): ${message}`;
         }
     }
     // §10c forced-repack A/B (measurement-only). Absent toggle => never
@@ -244,27 +336,26 @@ export function createWorkflowSupervisor(bindings) {
     }
     /**
      * Classify a child-proxied `substrate.write.request` into the D2 leg it
-     * represents, plus the runId the per-message OLS fit groups on.
-     * `runs/<runId>/events/` is the run-event bracket commit (runId from the
-     * prefix); `agent-state/...` is the D1 conversation WAL append (no runId
-     * in the prefix -- attributed to the dispatch loop's current serial
-     * runId). Any other prefix is an unmarked proxied write. Returns `null`
-     * when no observer is wired (so the supervisor samples nothing) or the
-     * prefix is not an attributed leg.
+     * represents, plus the messageId the per-message OLS fit groups on.
+     * `runs/<runId>/events/` is the run-event bracket commit and `agent-state/...`
+     * is the D1 conversation WAL append; neither prefix carries the message
+     * identity (the run-event prefix names only the stable per-deployment run
+     * id), so both are attributed to the dispatch loop's current serial
+     * message. Any other prefix is an unmarked proxied write. Returns `null`
+     * when no observer is wired (so the supervisor samples nothing), when the
+     * prefix is not an attributed leg, or when no message is in flight to
+     * attribute it to.
      */
     function classifyProxiedWriteLeg(preservePrefix) {
         if (bindings.onDispatchTiming === undefined)
             return null;
-        const runEventMatch = /^runs\/([^/]+)\/events\/$/.exec(preservePrefix);
-        if (runEventMatch !== null) {
-            const runId = runEventMatch[1];
-            if (runId !== undefined)
-                return { leg: "runevent", runId };
+        if (currentDispatchMessageId === null)
+            return null;
+        if (/^runs\/[^/]+\/events\/$/.test(preservePrefix)) {
+            return { leg: "runevent", messageId: currentDispatchMessageId };
         }
         if (preservePrefix.startsWith("agent-state/")) {
-            if (currentDispatchRunId !== null) {
-                return { leg: "wal", runId: currentDispatchRunId };
-            }
+            return { leg: "wal", messageId: currentDispatchMessageId };
         }
         return null;
     }
@@ -286,7 +377,7 @@ export function createWorkflowSupervisor(bindings) {
     const deriveMailAuditRef = bindings.deriveMailAuditRef ?? defaultInProcessMailAuditRef;
     const defaultInboxWritePrincipal = {
         kind: "supervisor",
-        deploymentId: bindings.deploymentId,
+        anchorRunId: bindings.anchorRunId,
     };
     const inboxWritePrincipal = bindings.inboxWritePrincipal ?? defaultInboxWritePrincipal;
     // Resolve the consumed-dedup retention horizon once at the bindings
@@ -302,6 +393,17 @@ export function createWorkflowSupervisor(bindings) {
     const readyTimeoutMs = bindings.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
     const readySetTimer = bindings.setTimer ?? defaultSetTimer;
     const readyClearTimer = bindings.clearTimer ?? defaultClearTimer;
+    // Resolve the crash-loop guard bounds once at the bindings edge (the
+    // layer that owns the operator config). The stable-run reset timer
+    // reuses the same injectable `setTimer`/`clearTimer` pair as the ready
+    // handshake, and the wall clock reuses the recycle-policy `now` seam, so
+    // tests drive the whole guard deterministically through existing knobs.
+    const crashLoopMaxCount = bindings.crashLoopMaxCount ?? DEFAULT_CRASH_LOOP_MAX_COUNT;
+    const crashLoopWindowMs = bindings.crashLoopWindowMs ?? DEFAULT_CRASH_LOOP_WINDOW_MS;
+    const crashLoopStableResetMs = bindings.crashLoopStableResetMs ?? DEFAULT_CRASH_LOOP_STABLE_RESET_MS;
+    const respawnBackoffInitialMs = bindings.respawnBackoffInitialMs ?? DEFAULT_RESPAWN_BACKOFF_INITIAL_MS;
+    const respawnBackoffMaxMs = bindings.respawnBackoffMaxMs ?? DEFAULT_RESPAWN_BACKOFF_MAX_MS;
+    const crashNow = bindings.recyclePolicyNow ?? defaultNow;
     /**
      * Resolved on every successful `enqueueInbox`; the dispatch loop
      * awaits this promise after a null dequeue so it returns to
@@ -332,12 +434,482 @@ export function createWorkflowSupervisor(bindings) {
      */
     let spawnContext = null;
     let recyclePolicy = null;
-    let recycleInProgress = false;
+    // Mutual-exclusion latch shared by every respawn path (operator/policy/
+    // self recycle and crash-respawn). `runRespawn` owns the set/clear; each
+    // caller owns the contention read because the two paths diverge on
+    // contention (recycle throws, crash-respawn declines silently).
+    let respawnInProgress = false;
+    // Monotonic child-cohort generation, bumped atomically with each
+    // transition to `running` (initial spawn and every respawn's
+    // `installNewChild`). The exit-watcher captures the generation it was
+    // armed for; a watcher whose generation is no longer current is stale
+    // (a newer child already superseded it) and is ignored. Generation plus
+    // the phase guard plus `respawnInProgress` together classify every child
+    // exit as planned or unexpected without a separate per-handle marker.
+    let childGeneration = 0;
+    // An unexpected child exit that could not be handled the instant it was
+    // observed (a respawn was already in flight). Recorded generation-tagged
+    // and drained by `maybeHandleChildExit` once `runRespawn` clears the
+    // latch; a pending exit for a superseded generation is dropped as stale.
+    let pendingChildExit = null;
+    // Monotonic timestamps (ms, from `crashNow`) of recent unexpected exits,
+    // pruned to `crashLoopWindowMs`. The crash-loop guard latches when the
+    // count within the window reaches `crashLoopMaxCount`.
+    const crashTimestamps = [];
+    // Handle for the armed stable-run reset timer (or null). Cleared and
+    // re-armed on every transition to `running`; cleared on teardown.
+    let stableRunResetTimer = null;
+    // Current exponential respawn backoff (ms). Advances by doubling on each
+    // respawn (capped at `respawnBackoffMaxMs`) and resets to the initial
+    // value when a respawned child runs stably. See `waitRespawnBackoff`.
+    let respawnBackoffMs = respawnBackoffInitialMs;
+    // Every armed backoff wait: the injected timer handle plus the promise
+    // resolver, so a shutdown can cancel all of them and unblock the parked
+    // respawn coroutines (each then bails at its phase/generation re-check).
+    // A SET, not a single slot: more than one coroutine can be parked at once
+    // -- a recycle can install a fresh, live child DURING one crash's backoff
+    // wait, and that child crashing parks a second coroutine. A single slot
+    // would drop the earlier one's timer and leak it past shutdown.
+    const respawnBackoffWaits = new Set();
+    // =====================================================================
+    // CRASH-RESPAWN -- auto-recovery from an unexpected workflow-process exit
+    // =====================================================================
+    //
+    // An UNEXPECTED child exit (crash, OOM, panic, signal -- not a
+    // supervisor-initiated shutdown, drain, or recycle) is detected by
+    // watching `handle.exited`, the only universal death signal: a clean
+    // process death ends the IPC channel readers without a protocol-level
+    // crash callback (see `onChildCrash`). `armChildForRunning` arms that
+    // watcher and bumps `childGeneration` on every transition to `running`;
+    // an exit is classified as unexpected iff its generation is still current
+    // AND the phase is still `running` (a planned kill is observed in a
+    // non-running phase, or against a superseded generation).
+    //
+    // On an unexpected exit `handleUnexpectedChildExit` runs: it records the
+    // crash against the crash-loop guard and either
+    //   - RESPAWNS -- after an exponential backoff (`waitRespawnBackoff`,
+    //     1s doubling to a 30s cap), it reuses the recycle path's
+    //     `runRespawn` with a no-op drain (the child is already dead) so the
+    //     stranded-mail replay and fresh-child spawn happen exactly as a
+    //     recycle's do; or
+    //   - LATCHES -- once the guard trips (`crashLoopMaxCount` exits within
+    //     `crashLoopWindowMs`), it tears down to the terminal `crash-looping`
+    //     phase and commits a `RunFailed` for the deployment's run so the
+    //     crash-loop is durably observable as a failed run status.
+    //
+    // A respawned child that survives `crashLoopStableResetMs`
+    // (`armStableRunResetTimer`) resets both the crash counter and the
+    // backoff. The backoff wait sits OUTSIDE the `respawnInProgress` latch,
+    // so the generation re-check after the wait is what stops a recycle that
+    // installed a fresh cohort mid-wait from being respawned a second time.
+    // Full policy: `packages/workflow-host/README.md` "Respawn policy".
+    // A protocol violation on a live cohort's control or event channel. The
+    // channel receiver ends its iterator and invokes this; a clean process
+    // death does NOT (it just ends the reader with no crash callback), so
+    // the exit-watcher on `handle.exited` is the universal death signal and
+    // this path only covers the frame-level violations the receiver detects.
+    // On the live (`running`) cohort, force the child down so its `exited`
+    // fires the exit-watcher and the crash flows through the SAME
+    // respawn/crash-loop path a clean death takes -- a violation that emits a
+    // garbage frame just before dying must not divert to `stopped` while a
+    // clean SIGKILL respawns. In any other phase the owning lifecycle path
+    // (spawn handshake, recycle reap, shutdown) owns teardown.
     function onChildCrash(reason) {
-        logger.error `workflow-process control channel crash: {reason}`;
-        void shutdownInternal({ reason });
+        if (state.phase === "running") {
+            logger.error `workflow-process channel crash on live cohort; forcing child down to respawn: ${reason}`;
+            state.handle.kill();
+            return;
+        }
+        logger.error `workflow-process channel crash: ${reason}`;
+        // Only a live, registered supervisor driven down by a channel crash is a
+        // self-termination the host must reclaim, and that is `recycling`:
+        // `running` took the kill branch above (its exit reaches the crash-loop
+        // latch, which carries its own flag), `starting` is the pre-registration
+        // initial spawn handshake whose failure the deploy unwind owns, and
+        // `stopping` is a teardown already in flight (a host `shutdown()`, or a
+        // self-termination already firing). An allowlist, not a denylist, so a
+        // future phase defaults to no self-terminate rather than a spurious one.
+        const selfTerminated = state.phase === "recycling";
+        void shutdownInternal({ reason, selfTerminated });
+    }
+    // Prune crash timestamps older than the sliding window relative to `nowMs`.
+    function pruneCrashTimestamps(nowMs) {
+        const cutoff = nowMs - crashLoopWindowMs;
+        while (true) {
+            const oldest = crashTimestamps[0];
+            if (oldest === undefined || oldest > cutoff)
+                break;
+            crashTimestamps.shift();
+        }
+    }
+    function clearStableRunResetTimer() {
+        if (stableRunResetTimer !== null) {
+            readyClearTimer(stableRunResetTimer);
+            stableRunResetTimer = null;
+        }
+    }
+    // Arm (or re-arm) the stable-run reset for the cohort that just reached
+    // `running`. If the child is still that same live cohort when the timer
+    // fires, the run has been stable for `crashLoopStableResetMs` and the
+    // crash counter is cleared so a flap-then-stabilize sequence does not
+    // latch. A crash before the timer fires re-arms it for the next cohort;
+    // teardown clears it.
+    function armStableRunResetTimer(generation) {
+        clearStableRunResetTimer();
+        stableRunResetTimer = readySetTimer(() => {
+            stableRunResetTimer = null;
+            if (generation === childGeneration && state.phase === "running") {
+                // The cohort ran stably: reset both the crash counter and the
+                // exponential backoff so a flap followed by stability starts over.
+                crashTimestamps.length = 0;
+                respawnBackoffMs = respawnBackoffInitialMs;
+            }
+        }, crashLoopStableResetMs);
+    }
+    // Wait the current respawn backoff before a respawn. The wait uses the
+    // injected timer so tests drive it deterministically, and is cancellable:
+    // `cancelRespawnBackoffWaits` (called on shutdown) clears the timer and
+    // resolves the promise early so the parked respawn coroutine unblocks and
+    // bails at its phase/generation re-check rather than sleeping out a full
+    // 30s backoff against a torn-down supervisor.
+    function waitRespawnBackoff(ms) {
+        return new Promise((resolve) => {
+            const entry = {
+                timer: null,
+                resolve,
+            };
+            entry.timer = readySetTimer(() => {
+                respawnBackoffWaits.delete(entry);
+                resolve();
+            }, ms);
+            respawnBackoffWaits.add(entry);
+        });
+    }
+    // Cancel every armed backoff wait. Idempotent: an empty set is a no-op,
+    // and each entry's own fire path has already removed it.
+    function cancelRespawnBackoffWaits() {
+        for (const entry of respawnBackoffWaits) {
+            readyClearTimer(entry.timer);
+            entry.resolve();
+        }
+        respawnBackoffWaits.clear();
+    }
+    // Bump the generation and arm the `handle.exited` watcher for a child
+    // that just became the `running` cohort. Called atomically with the
+    // state swap to `running` (no await between the swap and this call).
+    // `exited` resolving OR rejecting both mean the process is gone. The
+    // stable-run reset timer is NOT armed here: on the pristine first spawn
+    // there is no crash counter to reset, so it is armed only after a
+    // respawn (see `handleUnexpectedChildExit`).
+    function armChildForRunning(handle) {
+        childGeneration += 1;
+        const generation = childGeneration;
+        void handle.exited
+            .then(() => {
+            onChildExited(generation, "workflow-process child exited");
+        })
+            .catch(() => {
+            onChildExited(generation, "workflow-process child exited (exit promise rejected)");
+        });
+    }
+    // Record a child exit and try to act on it. Stale exits (a newer cohort
+    // already installed) are dropped.
+    function onChildExited(generation, reason) {
+        if (generation !== childGeneration)
+            return;
+        pendingChildExit = { generation, reason };
+        maybeHandleChildExit();
     }
-    function onMailMessage(rawMessage) {
+    // Drain a recorded child exit if the supervisor is in a state to act on
+    // it. Declines (leaving the exit pending) while a respawn is in flight;
+    // `runRespawn`'s `finally` re-invokes this after clearing the latch so
+    // an exit observed during the respawn is not lost. A pending exit for a
+    // superseded generation, or one observed after the deployment left the
+    // `running` phase (shutdown/recycle owns that teardown), is dropped.
+    function maybeHandleChildExit() {
+        if (respawnInProgress)
+            return;
+        const pending = pendingChildExit;
+        if (pending === null)
+            return;
+        if (pending.generation !== childGeneration) {
+            pendingChildExit = null;
+            return;
+        }
+        if (state.phase !== "running")
+            return;
+        pendingChildExit = null;
+        void handleUnexpectedChildExit(pending.reason).catch((cause) => {
+            // Fire-and-forget context (the exit-watcher has no caller to catch
+            // this). `runRespawn` already ran its own failure teardown to a
+            // terminal state before rethrowing, so the deployment is not wedged;
+            // surface the failure and stop.
+            const message = cause instanceof Error ? cause.message : String(cause);
+            logger.error `crash-respawn handling failed; deployment torn down: ${message}`;
+        });
+    }
+    // Handle one unexpected child exit: record it against the crash-loop
+    // guard and either latch the deployment (guard tripped) or respawn.
+    async function handleUnexpectedChildExit(reason) {
+        if (state.phase !== "running" || spawnContext === null) {
+            // Raced a shutdown/recycle between the drain check and here; the
+            // owning lifecycle path handles teardown.
+            return;
+        }
+        // A cohort that just crashed did not earn a stability reward: disarm its
+        // stable-run reset timer up front so it cannot fire during the backoff
+        // wait below (where the phase is still `running` and the generation is
+        // still this dead cohort's -- exactly the state the timer's own guard
+        // reads as "alive and stable") and wrongly clear the crash counter.
+        clearStableRunResetTimer();
+        // Capture the crashing cohort's generation. If a recycle or policy
+        // respawn installs a fresh cohort while the backoff wait below is
+        // parked, the generation advances and this handler must NOT respawn
+        // that healthy cohort -- the post-wait guard bails on the mismatch.
+        const armedGeneration = childGeneration;
+        const nowMs = crashNow();
+        crashTimestamps.push(nowMs);
+        pruneCrashTimestamps(nowMs);
+        if (crashTimestamps.length >= crashLoopMaxCount) {
+            // Crash-loop latch. The deployment stops respawning and tears down
+            // to the terminal `crash-looping` state so a rapidly-flapping child
+            // cannot saturate the host.
+            const crashCount = crashTimestamps.length;
+            logger.error `workflow-process crash-looped: ${String(crashCount)} unexpected exits within ${String(crashLoopWindowMs)}ms; stopping the deployment (${reason})`;
+            await shutdownInternal({
+                reason: `crash-loop: ${reason}`,
+                terminalPhase: "crash-looping",
+                selfTerminated: true,
+            });
+            // Commit the RunFailed tombstone AFTER teardown: shutdownInternal has
+            // quiesced the drain accumulators (stop + await disposed), so the
+            // run-event tree is settled and no escalation commit races this write.
+            // This RunFailed is the SOLE durable, externally-queryable signal of
+            // the crash-loop (the `crash-looping` phase is in-memory only), so a
+            // failure to write it is logged loudly rather than swallowed. Best-
+            // effort: the deployment is already terminal, so the write not landing
+            // costs observability, not correctness.
+            try {
+                // `anchorRunId` and the tombstone's `runId` are DISTINCT ids and must
+                // not be conflated. `bindings.anchorRunId` is the workflow-run repo
+                // slug (`deriveWorkflowRunRepoId`), which the supervisor principal's
+                // authz check keys on (`repoId.id === anchorRunId`). The RunFailed must
+                // land on the deployment's ONE top-level run, whose id is the local
+                // part of the deployment's mail address (`deriveWorkflowRunId`) -- the
+                // same id the dispatch loop writes every run event under. For a domain
+                // like `integration.interchange` the two ids differ (the repo slug
+                // carries a domain suffix), so writing the tombstone under the repo
+                // slug would strand it in a run subtree no reader consults.
+                await commitRunFailed({
+                    substrate: bindings.repoStore,
+                    repoId: bindings.workflowRunRepoId,
+                    ref: bindings.workflowRunRef,
+                    anchorRunId: bindings.anchorRunId,
+                    runId: deriveWorkflowRunId(bindings.deploymentMailAddress),
+                    at: new Date(nowMs).toISOString(),
+                    message: `workflow-process crash-looped: ${String(crashCount)} unexpected exits within ${String(crashLoopWindowMs)}ms`,
+                });
+            }
+            catch (cause) {
+                const message = cause instanceof Error ? cause.message : String(cause);
+                logger.error `crash-loop RunFailed commit failed; deployment has no durable failure tombstone: ${message}`;
+            }
+            return;
+        }
+        const thisBackoffMs = respawnBackoffMs;
+        logger.warn `workflow-process exited unexpectedly; respawning after ${String(thisBackoffMs)}ms backoff (${reason})`;
+        await waitRespawnBackoff(thisBackoffMs);
+        // A recycle/policy respawn, or a shutdown, may have run during the
+        // backoff wait. Bail unless THIS dead cohort is still the current
+        // running one: the generation guard prevents respawning a healthy
+        // cohort a recycle just installed, and the phase guard prevents acting
+        // after teardown. No await separates this re-check from `runRespawn`'s
+        // synchronous `respawnInProgress` set, so nothing can interleave.
+        if (childGeneration !== armedGeneration ||
+            state.phase !== "running" ||
+            spawnContext === null) {
+            // The backoff above announced a respawn before parking. Report the bail
+            // too, so a deployment that stops respawning does not leave an operator
+            // with a promised respawn and no record of what happened to it.
+            logger.info `respawn backoff elapsed but the crashed cohort is no longer the running one; skipping respawn (phase=${state.phase}, armed generation ${String(armedGeneration)}, current generation ${String(childGeneration)}): ${reason}`;
+            return;
+        }
+        const priorRunning = state;
+        const priorContext = spawnContext;
+        // Advance the backoff only now that a respawn is actually happening, so
+        // a bail above does not inflate the wait for a respawn that never ran.
+        respawnBackoffMs = Math.min(respawnBackoffMs * 2, respawnBackoffMaxMs);
+        await runRespawn({
+            origin: "crash",
+            reason,
+            prior: priorRunning,
+            priorContext,
+            // The child is already dead: there is nothing to drain, and
+            // `runRespawn`'s kill step is a no-op on a dead handle. The replay
+            // step still runs, moving any mail stranded mid-flight back to the
+            // inbox tail before dispatch resumes.
+            drain: async () => undefined,
+        });
+        // The respawned child is now the running cohort. Arm the stable-run
+        // reset against its generation: if it survives `crashLoopStableResetMs`
+        // the crash counter and backoff reset, so a flap followed by stability
+        // does not latch on a later, unrelated crash.
+        armStableRunResetTimer(childGeneration);
+    }
+    // Eager per-run mailbox (§3b inbound). On arrival the supervisor commits each
+    // fresh inbound message into the deployment's substrate-backed INBOX and fires
+    // a one-way `mailbox.notify` to the child, so the warm agent's `watch` /
+    // `mail_wait` observes the arrival mid-turn -- decoupled from the FIFO claim-
+    // check dispatch that resolves a run's step input. The supervisor is the sole
+    // mailbox writer; the store is its long-lived in-memory mirror over the
+    // committed `mailbox/INBOX/` subtree, constructed lazily on the first arrival.
+    const mailboxWritePrincipal = {
+        kind: "supervisor",
+        anchorRunId: bindings.anchorRunId,
+    };
+    let mailboxStore = null;
+    // Claim-check messageId -> assigned mailbox uid, so a message dispatched as a
+    // turn can be flagged \Seen/$Processed by uid. In-memory only: a missing entry
+    // (a restart, an arrival whose eager commit failed, or an already-processed
+    // message whose entry was pruned) skips the flag mark, which is a cosmetic
+    // IMAP flag, never a delivery guarantee. `markMailboxProcessed` prunes an
+    // entry once its mark completes, so the map holds only messages awaiting the
+    // flag mark rather than growing for the deployment's life.
+    const mailboxUidByMessageId = new Map();
+    // Serializes every mailbox mutation (lazy construction, the arrival
+    // append+flush, the dispatch flag mark) so concurrent arrivals and a fire-and-
+    // forget flag mark never interleave against the shared in-memory mirror.
+    let mailboxTail = Promise.resolve();
+    function runMailboxExclusive(fn) {
+        const run = mailboxTail.then(fn, fn);
+        mailboxTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    async function getMailboxStore() {
+        if (mailboxStore === null) {
+            mailboxStore = await createSubstrateMailboxStore({
+                substrate: bindings.repoStore,
+                repoId: bindings.workflowRunRepoId,
+                principal: mailboxWritePrincipal,
+                ref: bindings.workflowRunRef,
+            });
+        }
+        return mailboxStore;
+    }
+    function storedEnvelopeFromHeaders(headers, receivedAt) {
+        // The Date header is unvalidated external input; fall back to the arrival
+        // time when it is absent or unparseable so the store's `toISOString`
+        // serialization cannot throw on an Invalid Date.
+        const parsed = new Date(headers.date);
+        const date = Number.isNaN(parsed.getTime()) ? new Date(receivedAt) : parsed;
+        return {
+            messageId: headers.messageId,
+            from: headers.from,
+            to: headers.to,
+            subject: headers.subject ?? "",
+            date,
+            inReplyTo: headers.inReplyTo,
+            references: headers.references ?? [],
+            interchangeType: headers.interchangeType,
+            interchangeCorrelationId: headers.interchangeCorrelationId,
+        };
+    }
+    /**
+     * Eager-commit one freshly-arrived inbound message into the deployment's
+     * substrate mailbox, then notify the child. Runs on the mail-arrival path,
+     * before and independent of FIFO dispatch, so the warm agent's `mail_wait`
+     * observes the message mid-turn. Best-effort: the claim-check inbox is the
+     * durable delivery contract, so a decode or substrate fault here is logged
+     * loudly and never withholds the mail's ack -- the message still reaches the
+     * agent as its turn's step input via `trigger.fire`. The `mailbox.notify` is
+     * sent only AFTER the append is flushed, so the child reads committed state.
+     */
+    async function commitInboundToMailbox(messageId, rawMessage, receivedAt) {
+        try {
+            await runMailboxExclusive(async () => {
+                // The caller gates on a fresh `enqueued` outcome, so a redelivery never
+                // reaches here; this guard is belt-and-suspenders against a double
+                // append of the same messageId.
+                if (mailboxUidByMessageId.has(messageId))
+                    return;
+                let decoded;
+                try {
+                    decoded = decodeMail(rawMessage);
+                }
+                catch (cause) {
+                    const message = cause instanceof Error ? cause.message : String(cause);
+                    logger.error `eager mailbox commit: dropping undecodable inbound mail ${messageId}: ${message}`;
+                    return;
+                }
+                const store = await getMailboxStore();
+                const uid = store.append(rawMessage, storedEnvelopeFromHeaders(decoded.headers, receivedAt), []);
+                mailboxUidByMessageId.set(messageId, uid);
+                await store.flush();
+                const commit = await bindings.repoStore.resolveRef(mailboxWritePrincipal, bindings.workflowRunRepoId, bindings.workflowRunRef);
+                if (commit === null) {
+                    logger.error `eager mailbox commit: ${bindings.workflowRunRef} did not resolve after flush; skipping mailbox.notify for ${messageId}`;
+                    return;
+                }
+                const sender = activeControlSender();
+                if (sender === null) {
+                    logger.info `eager mailbox commit: no active control sender; committed ${messageId} as uid ${String(uid)} without mailbox.notify`;
+                    return;
+                }
+                await sender.send({
+                    type: "mailbox.notify",
+                    data: {
+                        runId: deriveWorkflowRunId(bindings.deploymentMailAddress),
+                        mailbox: MAILBOX_INBOX_DIR,
+                        uid,
+                        headers: decoded.headers,
+                    },
+                });
+            });
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            logger.error `eager mailbox commit failed for ${messageId}; mail still delivered via claim-check dispatch: ${message}`;
+        }
+    }
+    /**
+     * Flag a dispatched message's mailbox entry \Seen/$Processed. Fire-and-forget
+     * off the dispatch critical path: the flag is a cosmetic IMAP marker, so a
+     * missing uid (no eager mailbox entry) or a substrate fault is logged and
+     * dropped, never failing the turn.
+     */
+    function markMailboxProcessed(messageId) {
+        const uid = mailboxUidByMessageId.get(messageId);
+        if (uid === undefined)
+            return;
+        void runMailboxExclusive(async () => {
+            try {
+                const store = await getMailboxStore();
+                if (store.find(uid) === undefined)
+                    return;
+                store.addFlags(uid, [MAILBOX_FLAG_SEEN, MAILBOX_FLAG_PROCESSED]);
+                await store.flush();
+            }
+            finally {
+                // The id->uid mapping exists only to flag this message once. After the
+                // mark runs (or the message is already gone), the entry is dead weight,
+                // so drop it to bound the map over a long-lived conversational mailbox.
+                // Redelivery dedup is owned by the durable inbox index, not this map.
+                // The delete runs inside the exclusive section so it never interleaves
+                // with the arrival path's `has(messageId)` check.
+                mailboxUidByMessageId.delete(messageId);
+            }
+        }).catch((cause) => {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            logger.warn `mailbox flag mark failed for ${messageId} (uid ${String(uid)}): ${message}`;
+        });
+    }
+    // Resolves once the inbound mail is durably accepted (its inbox write landed
+    // or the message was already durably present); rejects when it was not (a
+    // phase where the deployment is not accepting mail, a transient enqueue
+    // failure, or a stale refusal). The host propagates that settlement to the
+    // wire, so resolution is the durable-receipt ACK signal and rejection is the
+    // WITHHOLD signal -- a withheld message is redelivered by the hub.
+    async function onMailMessage(rawMessage) {
         // Every inbound mail flows through the FIFO inbox claim-check
         // queue, regardless of the supervisor's current phase. The
         // dispatch loop (started by `spawn()` and restarted by the
@@ -349,16 +921,33 @@ export function createWorkflowSupervisor(bindings) {
         // the envelope's `receivedAt` prefix on the inbox filename.
         if (state.phase === "idle" ||
             state.phase === "stopping" ||
-            state.phase === "stopped") {
-            // The host's higher-level lifecycle is already tearing the
-            // deployment down; the message drops on the floor rather than
-            // landing in an inbox no live dispatch loop will service.
-            return;
+            state.phase === "stopped" ||
+            state.phase === "crash-looping") {
+            // The host's higher-level lifecycle is already tearing the deployment
+            // down; nothing is enqueued. Reject rather than silently drop so the
+            // ack is WITHHELD and the hub redelivers -- a later generation (or a
+            // recycle-installed dispatch loop) may accept it, and a permanently
+            // torn-down address exhausts the hub's bounded retry budget instead of
+            // losing a message a transiently-idle deployment would have taken.
+            throw new Error(`inbound mail not accepted: supervisor phase is "${state.phase}"`);
+        }
+        try {
+            await enqueueInboundMail(rawMessage);
+        }
+        catch (cause) {
+            // Both branches WITHHOLD (rethrow); the split only sets log severity so
+            // a stale refusal surfaces as its own loud signal rather than blending
+            // into ordinary enqueue-failure noise. The ack/withhold decision is the
+            // rethrow itself, never this classification.
+            if (cause instanceof StaleInboxEnqueueError) {
+                logger.error `inbound mail refused as stale, withholding ack (hub will redeliver): ${cause.message}`;
+            }
+            else {
+                const message = cause instanceof Error ? cause.message : String(cause);
+                logger.error `enqueueInbox failed, withholding ack (hub will redeliver): ${message}`;
+            }
+            throw cause;
         }
-        void enqueueInboundMail(rawMessage).catch((cause) => {
-            const message = cause instanceof Error ? cause.message : String(cause);
-            logger.error `enqueueInbox failed: ${message}`;
-        });
     }
     async function enqueueInboundMail(rawMessage) {
         const messageId = await deriveMessageId(rawMessage);
@@ -373,11 +962,11 @@ export function createWorkflowSupervisor(bindings) {
         const rawMessageBase64 = base64Encode(rawMessage);
         // D2 leg: `enqueueInbox` runs in `onMailMessage` BEFORE dispatch, so
         // it is paid OUTSIDE the dispatch-start..reply-produced window -- its
-        // growth is invisible to the 4.7 bracket. The leg mark, keyed by the
-        // same messageId the dispatch loop later uses as the runId, makes the
-        // out-of-window cost visible and joinable to the in-window legs.
+        // growth is invisible to the 4.7 bracket. This leg mark is keyed by the
+        // messageId, the same per-message key every in-window leg uses, so the
+        // D2 per-message OLS fit groups the enqueue leg with the rest.
         legMarkStart(messageId, "enqueue");
-        await inboxPrimitives.enqueueInbox(bindings.repoStore, inboxWritePrincipal, bindings.workflowRunRepoId, {
+        const outcome = await inboxPrimitives.enqueueInbox(bindings.repoStore, inboxWritePrincipal, bindings.workflowRunRepoId, {
             address: bindings.deploymentMailAddress,
             messageId,
             receivedAt,
@@ -385,7 +974,25 @@ export function createWorkflowSupervisor(bindings) {
             rawMessage: rawMessageBase64,
         });
         legMarkEnd(messageId, "enqueue");
-        wakeDispatch();
+        // Only a fresh enqueue added a new inbox entry; wake the dispatch loop for
+        // it alone. An `already-present` outcome landed nothing new -- returning
+        // (which acks) without waking is correct, since the earlier delivery of
+        // the same messageId already drives dispatch. This resolves for both
+        // outcomes: both mean the bytes are durably accounted for, so both ack.
+        if (outcome.outcome === "enqueued") {
+            // Eager-commit the fresh message into the per-run mailbox and notify the
+            // child BEFORE waking dispatch, so the warm agent's mail_wait can observe
+            // it committed. Non-fatal by contract: the enqueue above already secured
+            // the durable delivery, so this never withholds the ack.
+            await commitInboundToMailbox(messageId, rawMessage, receivedAt);
+            wakeDispatch();
+        }
+        else {
+            // A redelivery of a message already durably present: the ack still
+            // fires (it is on disk), but no new run is dispatched. Surface it so an
+            // at-least-once redelivery being made effectively-once is observable.
+            logger.info `inbound mail ${messageId} already durably present (${outcome.reason}); acknowledging without re-dispatch`;
+        }
     }
     /**
      * Pump child-initiated upstream control frames after `ready` has
@@ -448,6 +1055,18 @@ export function createWorkflowSupervisor(bindings) {
                 });
                 continue;
             }
+            if (payload.type === "mailbox.mutate.request") {
+                // INBOUND half of mailbox ownership (§3b). The child asked the
+                // supervisor -- the sole mailbox writer -- to apply a flag write or
+                // expunge. Run it off the iterator's loop so the iterator keeps
+                // draining while the store flushes; the handler owns the
+                // `mailbox.mutate.response` reply that resolves the child's awaiter.
+                void handleMailboxMutation(payload.data).catch((cause) => {
+                    const message = cause instanceof Error ? cause.message : String(cause);
+                    logger.error `mailbox.mutate.request handler crashed: ${message}`;
+                });
+                continue;
+            }
             if (payload.type === "terminal.event") {
                 // The workflow-process child mirrors every terminal-run commit
                 // over the control IPC. Fan it out to the COHORT'S broadcaster
@@ -456,16 +1075,98 @@ export function createWorkflowSupervisor(bindings) {
                 // to-one with its cohort's `controlIncoming` iterator: a
                 // buffered `terminal.event` the OLD child emitted before kill
                 // landed must NEVER route to the NEW cohort's broadcaster.
-                // Without this binding, a stale OLD-cohort frame for a runId
-                // the NEW cohort happens to be dispatching under the same id
-                // (the normal recycle/replay case) would falsely settle the
-                // NEW cohort's `waitForRunTerminal` and commit `markConsumed`
+                // Every run shares the stable runId (the deployment mail
+                // address), so an OLD-cohort frame and a NEW-cohort run collide
+                // on that id by construction (the recycle/replay case); without
+                // this binding the stale frame would falsely settle the NEW
+                // cohort's `waitForRunTerminalOrPark` and commit `markConsumed`
                 // on a run still in flight. The broadcaster's own `dispose()`
                 // on cohort teardown turns post-dispose notify into a no-op,
                 // so a stale frame dequeued after the cohort was torn down
                 // drops cleanly without leaking into any successor cohort.
                 const event = terminalEventFromPayload(payload.data);
                 cohortBroadcaster.notify(payload.data.runId, event);
+                terminalRunIds.add(payload.data.runId);
+                // Clean up cohort tracking for the terminated run. Self-discovered
+                // runs have no dispatch-loop entry, so their cleanup happens here.
+                cohortRunIds.delete(payload.data.runId);
+                runInputChannels.delete(payload.data.runId);
+                continue;
+            }
+            if (payload.type === "park.notify") {
+                // The workflow-process child reported a control-plane suspension: an
+                // agent step parked on a reserved `signalName(correlationId)` channel.
+                if (payload.data.parkKind === "input") {
+                    // Input parks are owned by the supervisor, not the hub. Register
+                    // cohort membership BEFORE caching the correlationId so a run is
+                    // never a channel-without-cohort entry (the routing-hygiene
+                    // invariant); a live run that parked is always in cohortRunIds
+                    // already, so this is idempotent belt-and-suspenders. Cache the
+                    // correlationId so the dispatch loop can fire signal.deliver on
+                    // subsequent mail without a substrate round-trip.
+                    cohortRunIds.add(payload.data.runId);
+                    runInputChannels.set(payload.data.runId, {
+                        correlationId: payload.data.correlationId,
+                        parkKind: "input",
+                    });
+                    // Stop any drain accumulator for a run that has parked. Input parks
+                    // own this because a drain arms no accumulator for a run that already
+                    // holds an input channel; an approval park never carries one, so its
+                    // drain interaction is a separate concern and stays out of this arm.
+                    const accumulator = drainAccumulators.get(payload.data.runId);
+                    if (accumulator !== undefined) {
+                        accumulator.stop();
+                        drainAccumulators.delete(payload.data.runId);
+                    }
+                }
+                else if (payload.data.parkKind === "approval") {
+                    // Approval parks are hub-registered through the shared
+                    // `registerSuspension` transform.
+                    registerSuspension({
+                        runId: payload.data.runId,
+                        correlationId: payload.data.correlationId,
+                        parkKind: "approval",
+                        ...(payload.data.snapshot !== undefined
+                            ? { snapshot: payload.data.snapshot }
+                            : {}),
+                    });
+                }
+                else {
+                    // A `signal-relay` park is relayed down into the body child by the
+                    // section runtime and is never hub-registered, so it does not ride
+                    // `park.notify`. One arriving here is a protocol violation; log and
+                    // drop rather than mis-registering it as an approval.
+                    logger.error `park.notify for run ${payload.data.runId} carried parkKind=${payload.data.parkKind}, which is not a hub-registered kind; dropping`;
+                }
+                // A park of ANY kind suspends the run, so a dispatch loop waiting on
+                // `waitForRunTerminalOrPark` after firing the trigger (or delivering
+                // the last signal) must be released here regardless of park kind. An
+                // approval park that only registered its suspension would leave that
+                // loop hanging to the terminal-or-park backstop. Bump the park
+                // generation BEFORE resolving the waiter: a dispatch loop that captured
+                // `sinceGen` for this run must see the newer generation both when its
+                // armed waiter fires here and when it re-reads the generation after
+                // arming (the check-after-register).
+                parkGenerations.set(payload.data.runId, (parkGenerations.get(payload.data.runId) ?? 0) + 1);
+                // Wake any dispatch loop waiting for this run to park.
+                resolveParkNotifyWaiter(payload.data.runId);
+                continue;
+            }
+            if (payload.type === "parked-correlations.response") {
+                // The child answered a `reEmitParkedCorrelations` query. Resolve the
+                // awaiting driver; a response with no pending entry (the query already
+                // timed out and dropped it) is logged and dropped, never thrown, so it
+                // cannot tear the pump down.
+                resolveParkedResponse(payload.data);
+                continue;
+            }
+            if (payload.type === "resumed.runs") {
+                // The child self-discovered runs from the substrate after reconnect
+                // or recycle. Seed cohort tracking so drain accumulators and dispatch
+                // routing account for runs the supervisor did not personally fire.
+                for (const runId of payload.data.runIds) {
+                    cohortRunIds.add(runId);
+                }
                 continue;
             }
             logger.warn `workflow-process upstream control payload ignored: type=${payload.type}`;
@@ -473,22 +1174,26 @@ export function createWorkflowSupervisor(bindings) {
     }
     const pendingMerges = new Map();
     /**
-     * Reject every pending merge round-trip and every
-     * `markConsumed` completion waiter. Invoked on cohort transitions
-     * (shutdown, recycle's `installNewChild`) so closures awaiting these
-     * promises do not outlive the cohort that armed them. Without this,
-     * a `handleSubstrateWriteRequest` mid-merge or a dispatch-loop
-     * caller awaiting `markConsumed` would sit on a resolver that the
-     * dying control channel will never invoke.
+     * Reject every pending merge round-trip and every park-notify
+     * waiter. Invoked on cohort transitions (shutdown, recycle's
+     * `installNewChild`) so closures awaiting these promises do not
+     * outlive the cohort that armed them. Without this, a
+     * `handleSubstrateWriteRequest` mid-merge or a dispatch loop
+     * waiting for park would sit on a resolver that the dying control
+     * channel will never invoke.
      */
     function rejectCohortAwaiters(reason) {
         for (const [requestId, entry] of pendingMerges) {
             pendingMerges.delete(requestId);
             entry.resolve({ ok: false, reason: `cohort aborted: ${reason}` });
         }
-        for (const [runId, waiter] of markConsumedCompletionWaiters.entries()) {
-            markConsumedCompletionWaiters.delete(runId);
-            waiter.reject(new MergeAbortedError(`markConsumed waiter (${runId}): ${reason}`));
+        for (const [requestId, entry] of pendingParkedQueries) {
+            pendingParkedQueries.delete(requestId);
+            entry.settle(null);
+        }
+        for (const [runId, resolve] of parkNotifyWaiters.entries()) {
+            parkNotifyWaiters.delete(runId);
+            resolve();
         }
     }
     function resolveMergeResponse(data) {
@@ -525,6 +1230,125 @@ export function createWorkflowSupervisor(bindings) {
         }
         entry.resolve({ ok: false, reason: data.result.reason });
     }
+    // Stamp the deployment identity the supervisor owns onto a child-supplied
+    // park and hand it to the host's suspension-register sink. Shared by the
+    // `park.notify` arm (the happy-path emit) and `reEmitParkedCorrelations`
+    // (the re-establishment re-emit). Best-effort: a throwing sink is logged,
+    // not rethrown, so it cannot tear the upstream pump down or abort a re-emit
+    // partway through the parked set. The sink (production: the sidecar) turns
+    // the stamped registration into a `signal.correlation.register` frame the
+    // hub co-writes the run's routing + approval rows from.
+    function registerSuspension(park) {
+        if (bindings.onSuspensionRegister === undefined) {
+            logger.warn `suspension register for runId=${park.runId} but no onSuspensionRegister sink is wired; correlation ${park.correlationId} not registered`;
+            return;
+        }
+        try {
+            bindings.onSuspensionRegister({
+                runId: park.runId,
+                correlationId: park.correlationId,
+                kind: park.parkKind,
+                anchorRunId: bindings.anchorRunId,
+                agentAddress: bindings.deploymentMailAddress,
+                ...(park.snapshot !== undefined
+                    ? { approvalSnapshot: park.snapshot }
+                    : {}),
+            });
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            logger.error `onSuspensionRegister sink threw for runId=${park.runId} correlationId=${park.correlationId}: ${message}`;
+        }
+    }
+    const pendingParkedQueries = new Map();
+    let parkedQuerySeq = 0;
+    function resolveParkedResponse(data) {
+        const entry = pendingParkedQueries.get(data.requestId);
+        if (entry === undefined) {
+            logger.warn `parked-correlations.response landed with no pending entry; requestId=${data.requestId} dropped`;
+            return;
+        }
+        pendingParkedQueries.delete(data.requestId);
+        entry.settle(data.parked);
+    }
+    async function reEmitParkedCorrelations() {
+        // No-op (NOT throw) when the child is not addressable. `deliverSignal`
+        // throws on non-running/starting (including recycling) because it points a
+        // write at the dying child's closing pipe and wants the caller to retry;
+        // this driver's contract is the opposite -- the next re-establishment
+        // re-drives it -- so skipping recycling and letting the next spawn's
+        // re-emit cover it is correct here, not a missed guard.
+        if (state.phase !== "running" && state.phase !== "starting") {
+            logger.info `reEmitParkedCorrelations: child not addressable (phase=${state.phase}); skipping`;
+            return;
+        }
+        const controlSender = state.controlSender;
+        const requestId = `pc-${String((parkedQuerySeq += 1))}`;
+        const responded = new Promise((resolve) => {
+            pendingParkedQueries.set(requestId, { settle: resolve });
+        });
+        // Watchdog: a wedged-but-alive child never tears its cohort down, so the
+        // cohort-abort settle would never fire and this await would hang the
+        // re-establishment caller. On expiry, drop the pending entry and return;
+        // the next re-establishment re-drives (the hub co-write is idempotent).
+        let timeoutHandle = null;
+        const watchdog = new Promise((resolve) => {
+            timeoutHandle = setTimeout(() => {
+                timeoutHandle = null;
+                if (pendingParkedQueries.delete(requestId)) {
+                    logger.warn `reEmitParkedCorrelations: requestId=${requestId} did not respond within ${String(parkedQueryWatchdogMs)}ms; re-registration retries on the next re-establishment`;
+                }
+                resolve("timeout");
+            }, parkedQueryWatchdogMs);
+        });
+        let outcome;
+        try {
+            await controlSender.send({
+                type: "parked-correlations.request",
+                data: { requestId },
+            });
+            outcome = await Promise.race([responded, watchdog]);
+        }
+        catch (cause) {
+            // The downstream send failed (a closing pipe). Best-effort: drop the
+            // pending entry, log, and return; the next re-establishment re-drives.
+            pendingParkedQueries.delete(requestId);
+            if (timeoutHandle !== null)
+                clearTimeout(timeoutHandle);
+            const message = cause instanceof Error ? cause.message : String(cause);
+            logger.warn `reEmitParkedCorrelations query failed: ${message}; re-registration retries on the next re-establishment`;
+            return;
+        }
+        if (timeoutHandle !== null)
+            clearTimeout(timeoutHandle);
+        // `timeout` (watchdog fired) or `null` (cohort torn down before the child
+        // answered): nothing to re-emit; the next re-establishment re-drives.
+        if (outcome === "timeout" || outcome === null)
+            return;
+        for (const parked of outcome) {
+            if (parked.parkKind === "input") {
+                // Register cohort membership BEFORE the input channel so the run is
+                // never a channel-without-cohort entry: the dispatch loop's routing
+                // hygiene drops exactly such entries, and a live resumed run must not
+                // be mistaken for a dead one and have its channel deleted.
+                cohortRunIds.add(parked.runId);
+                runInputChannels.set(parked.runId, {
+                    correlationId: parked.correlationId,
+                    parkKind: "input",
+                });
+            }
+            else {
+                registerSuspension({ ...parked, parkKind: "approval" });
+            }
+        }
+    }
+    function resolveParkNotifyWaiter(runId) {
+        const resolve = parkNotifyWaiters.get(runId);
+        if (resolve === undefined)
+            return;
+        parkNotifyWaiters.delete(runId);
+        resolve();
+    }
     /**
      * OUTBOUND half of mailbox ownership (§3a). The workflow-process child
      * never holds the agent's signing key; it forwards the structured
@@ -577,6 +1401,111 @@ export function createWorkflowSupervisor(bindings) {
             });
         }
     }
+    /**
+     * Apply a child-requested mailbox mutation to the owned store (INBOUND
+     * half of mailbox ownership, §3b). The supervisor is the sole writer to
+     * the workflow-run mailbox; the child never flushes it. A flag write
+     * (`addFlags` / `removeFlags`) targets one uid; an `expunge` sweeps every
+     * `\Deleted` message out of the live INBOX. The mutation is applied under
+     * `runMailboxExclusive` and flushed before the reply, so the child's next
+     * committed read observes it -- the flush-before-signal ordering
+     * `commitInboundToMailbox` uses. A failure (unknown uid, wrong mailbox,
+     * substrate fault) surfaces back as a structured `{ ok: false, reason }`
+     * so the agent's mail-tool call fails loudly rather than dropping the
+     * mutation silently.
+     */
+    async function handleMailboxMutation(data) {
+        // Capture the sender once. Re-fetching after the flush could return a
+        // successor cohort's sender and misroute the reply to the wrong child
+        // (see the substrate-write handler's note). A null sender means the
+        // supervisor is mid-recycle or tearing down: there is nothing to reply
+        // on, so drop and warn -- the child's read end is closing alongside, so
+        // its pending awaiter is rejected by the control loop's `cancelAll`.
+        const controlSender = activeControlSender();
+        if (controlSender === null) {
+            logger.warn `mailbox.mutate.request received outside running phase; requestId=${data.requestId} dropped (child awaiter will fail on pipe close)`;
+            return;
+        }
+        // The supervisor owns exactly one mailbox, the substrate INBOX. Reject a
+        // request for any other name rather than silently mutate INBOX under it,
+        // which would be a wrong-target durable write reported as success. The
+        // frame carries an unconstrained mailbox string, so this is validated
+        // here at the owning layer, not trusted from the child transport.
+        if (data.mailbox !== MAILBOX_INBOX_DIR) {
+            await controlSender.send({
+                type: "mailbox.mutate.response",
+                data: {
+                    requestId: data.requestId,
+                    result: {
+                        ok: false,
+                        reason: `unknown mailbox "${data.mailbox}"; only ${MAILBOX_INBOX_DIR} is writable`,
+                    },
+                },
+            });
+            return;
+        }
+        try {
+            const expungedUids = await runMailboxExclusive(async () => {
+                const store = await getMailboxStore();
+                if (data.op === "expunge") {
+                    // Snapshot the \Deleted uids before removing: `store.messages` is
+                    // the live array, so `.filter().map()` materializes the targets
+                    // before any `remove` splices it. The whole sweep runs
+                    // synchronously under the lock, so no snapshotted uid can vanish
+                    // before its `remove`.
+                    const uids = store.messages
+                        .filter((m) => m.flags.has(MAILBOX_FLAG_DELETED))
+                        .map((m) => m.uid);
+                    for (const uid of uids) {
+                        store.remove(uid);
+                        // Bound the id->uid map: drop any entry now pointing at a removed
+                        // uid. Not load-bearing -- `markMailboxProcessed` guards with
+                        // `find` -- but keeps the map from retaining dead uids.
+                        for (const [messageId, mappedUid] of mailboxUidByMessageId) {
+                            if (mappedUid === uid)
+                                mailboxUidByMessageId.delete(messageId);
+                        }
+                    }
+                    await store.flush();
+                    return uids;
+                }
+                if (data.op === "addFlags") {
+                    store.addFlags(data.uid, data.flags);
+                }
+                else {
+                    store.removeFlags(data.uid, data.flags);
+                }
+                await store.flush();
+                return undefined;
+            });
+            await controlSender.send({
+                type: "mailbox.mutate.response",
+                data: {
+                    requestId: data.requestId,
+                    result: expungedUids === undefined
+                        ? { ok: true }
+                        : { ok: true, expungedUids },
+                },
+            });
+        }
+        catch (cause) {
+            // Reply on the same captured sender. If this send itself throws (a
+            // broken pipe), it propagates to the pump's `.catch`, and the child's
+            // awaiter is rejected by the control loop's `cancelAll` -- the backstop
+            // `handleOutboundMessage` also relies on. Accepted window: a mutation
+            // can flush durably while its reply is undeliverable, so the agent tool
+            // errors on a mutation that landed. This is inherent to apply-then-reply
+            // across a teardown boundary and identical to `handleOutboundMessage`.
+            const reason = cause instanceof Error ? cause.message : String(cause);
+            await controlSender.send({
+                type: "mailbox.mutate.response",
+                data: {
+                    requestId: data.requestId,
+                    result: { ok: false, reason },
+                },
+            });
+        }
+    }
     async function handleSubstrateWriteRequest(data) {
         const controlSender = activeControlSender();
         if (controlSender === null) {
@@ -628,7 +1557,7 @@ export function createWorkflowSupervisor(bindings) {
         // is which process owns the substrate write contract.
         const writePrincipal = {
             kind: "workflow-process",
-            deploymentId: bindings.deploymentId,
+            anchorRunId: bindings.anchorRunId,
         };
         // The commit's terminal detection comes from the kind handler's
         // typed `newlyTerminalRuns` signal (returned below), not a sniff of
@@ -656,7 +1585,7 @@ export function createWorkflowSupervisor(bindings) {
         // benchmark's per-message OLS fit groups on.
         const legClassification = classifyProxiedWriteLeg(data.preservePrefix);
         if (legClassification !== null) {
-            legMarkStart(legClassification.runId, legClassification.leg);
+            legMarkStart(legClassification.messageId, legClassification.leg);
         }
         try {
             const { commitSha, newlyTerminalRuns } = await bindings.repoStore.writeTreePreservingPrefix(writePrincipal, validatedRepoId, data.ref, {
@@ -701,22 +1630,11 @@ export function createWorkflowSupervisor(bindings) {
             });
             // D2 leg end: the substrate commit (hash objects, write tree,
             // advance ref under the per-repo lock) just resolved. Stamped here,
-            // before the terminal-write markConsumed-coupling wait below, so the
-            // run-event/wal leg measures only its own commit and not the
-            // dispatch loop's markConsumed (which the `markconsumed` leg owns).
+            // before the response, so the run-event/wal leg measures only its own
+            // commit and not the dispatch loop's markConsumed (which the
+            // `markconsumed` leg owns).
             if (legClassification !== null) {
-                legMarkEnd(legClassification.runId, legClassification.leg);
-            }
-            const watchdog = await synchronouslyDispatchTerminalWrite(newlyTerminalRuns);
-            if (!watchdog.ok) {
-                await controlSender.send({
-                    type: "substrate.write.response",
-                    data: {
-                        requestId: data.requestId,
-                        result: { ok: false, reason: watchdog.reason },
-                    },
-                });
-                return;
+                legMarkEnd(legClassification.messageId, legClassification.leg);
             }
             await controlSender.send({
                 type: "substrate.write.response",
@@ -740,7 +1658,7 @@ export function createWorkflowSupervisor(bindings) {
                     substrate: bindings.repoStore,
                     repoId: validatedRepoId,
                     ref: data.ref,
-                    deploymentId: bindings.deploymentId,
+                    anchorRunId: bindings.anchorRunId,
                     runId,
                 }).catch((cause) => {
                     logger.warn `compaction of run ${runId} failed: ${cause instanceof Error ? cause.message : String(cause)}`;
@@ -765,129 +1683,6 @@ export function createWorkflowSupervisor(bindings) {
             });
         }
     }
-    // Per-runId synchronization between the substrate-write handler
-    // and the dispatch loop's `markConsumed`. The handler arms a
-    // waiter when it commits a terminal-event blob and waits for the
-    // dispatch loop to fire `resolveMarkConsumedWaiter(runId)` before
-    // sending the substrate.write.response back to the child.
-    const markConsumedCompletionWaiters = new Map();
-    function resolveMarkConsumedWaiter(runId) {
-        const waiter = markConsumedCompletionWaiters.get(runId);
-        if (waiter === undefined)
-            return;
-        markConsumedCompletionWaiters.delete(runId);
-        waiter.resolve();
-    }
-    /**
-     * Hold the substrate.write.response until the dispatch loop's
-     * markConsumed settles for each run the kind handler reports as newly
-     * terminal in this commit. Terminal-ness comes from the handler's typed
-     * `newlyTerminalRuns` signal -- determined authoritatively during
-     * validation -- not re-derived from the committed path shape, so it
-     * survives the run-event layout changing (e.g. compaction folding a
-     * run's per-event files into one combined file). The wait is per-runId
-     * so multiple runs can proceed concurrently if a future dispatch loop
-     * ever processes more than one mail in parallel.
-     *
-     * A watchdog timeout (`terminalWriteWatchdogMs`) caps each wait so a
-     * never-arming markConsumed (a bug in the dispatch loop, a torn-down
-     * cohort, a stalled inbox primitive) does not deadlock the child's
-     * write -- and therefore the runtime body, and therefore the dispatch
-     * loop. On expiry the waiter is force-released and a structured failure
-     * propagates back to the child as
-     * `{ ok: false, reason: "terminal-write watchdog timeout: ..." }`.
-     */
-    async function synchronouslyDispatchTerminalWrite(newlyTerminalRuns) {
-        const holds = [];
-        for (const { runId, terminalEventJson } of newlyTerminalRuns) {
-            if (!inFlightRuns.has(runId))
-                continue;
-            holds.push(holdResponseForMarkConsumed(runId, terminalEventJson));
-        }
-        if (holds.length === 0)
-            return { ok: true };
-        const results = await Promise.all(holds);
-        return results.find((r) => !r.ok) ?? { ok: true };
-    }
-    async function holdResponseForMarkConsumed(runId, terminalEventJson) {
-        const completed = new Promise((resolve, reject) => {
-            markConsumedCompletionWaiters.set(runId, { resolve, reject });
-        });
-        const broadcaster = activeTerminalBroadcaster();
-        if (broadcaster !== null) {
-            const synthetic = synthesizeTerminalEvent(terminalEventJson);
-            if (synthetic !== null) {
-                broadcaster.notify(runId, synthetic);
-            }
-        }
-        let timeoutHandle = null;
-        const watchdog = new Promise((resolve) => {
-            timeoutHandle = setTimeout(() => {
-                timeoutHandle = null;
-                // Force-release the waiter so the dispatch loop's eventual
-                // resolve does not strand a dangling map entry, then surface
-                // the structured failure to the caller. The reason text is
-                // logged through the package logger so the watchdog is not
-                // silent on the host side.
-                const stillPending = markConsumedCompletionWaiters.get(runId) !== undefined;
-                if (stillPending) {
-                    markConsumedCompletionWaiters.delete(runId);
-                }
-                const reason = `terminal-write watchdog timeout: markConsumed for runId=${runId} did not settle within ${String(terminalWriteWatchdogMs)}ms`;
-                logger.error `${reason}`;
-                resolve({ ok: false, reason });
-            }, terminalWriteWatchdogMs);
-        });
-        const result = await Promise.race([
-            completed.then(() => ({ ok: true })),
-            watchdog,
-        ]);
-        if (timeoutHandle !== null) {
-            clearTimeout(timeoutHandle);
-        }
-        return result;
-    }
-    function synthesizeTerminalEvent(terminalEventJson) {
-        let parsed;
-        try {
-            parsed = JSON.parse(terminalEventJson);
-        }
-        catch {
-            return null;
-        }
-        if (typeof parsed !== "object" ||
-            parsed === null ||
-            !("type" in parsed) ||
-            !("seq" in parsed)) {
-            return null;
-        }
-        const body = parsed;
-        if (typeof body.seq !== "number")
-            return null;
-        const at = typeof body.at === "string" ? body.at : new Date().toISOString();
-        if (body.type === "RunCompleted") {
-            return { kind: "RunCompleted", seq: body.seq, at };
-        }
-        if (body.type === "RunCancelled") {
-            return { kind: "RunCancelled", seq: body.seq, at };
-        }
-        if (body.type === "RunFailed") {
-            // The wire schema makes `error.message` required when the event
-            // type is `RunFailed`. An event that doesn't carry one is a
-            // contract violation upstream of the supervisor; coercing it to an
-            // empty string would silently hide the producer bug.
-            if (typeof body.error?.message !== "string") {
-                throw new Error(`synthesizeTerminalEvent: RunFailed event missing required error.message`);
-            }
-            return {
-                kind: "RunFailed",
-                seq: body.seq,
-                at,
-                error: { message: body.error.message },
-            };
-        }
-        return null;
-    }
     function activeControlSender() {
         if (state.phase === "starting" ||
             state.phase === "running" ||
@@ -896,14 +1691,6 @@ export function createWorkflowSupervisor(bindings) {
         }
         return null;
     }
-    function activeTerminalBroadcaster() {
-        if (state.phase === "starting" ||
-            state.phase === "running" ||
-            state.phase === "recycling") {
-            return state.terminalBroadcaster;
-        }
-        return null;
-    }
     async function wireChild(args) {
         const controlSender = createControlChannelSender({
             privateKeySeed: args.ipcKeypair.privateKey,
@@ -921,10 +1708,11 @@ export function createWorkflowSupervisor(bindings) {
             hmacKey: args.hmacKey,
             channelId: args.channelId,
             reader: args.handle.eventReader,
-            onCrash: (reason) => {
-                logger.error `workflow-process event channel crash: {reason}`;
-                void shutdownInternal({ reason });
-            },
+            // Route event-channel crashes through the same funnel as
+            // control-channel crashes so both drive the respawn/crash-loop path
+            // uniformly on the live cohort (and defer to the owning lifecycle
+            // path in every other phase).
+            onCrash: onChildCrash,
         });
         const eventPump = pumpEvents(eventIter, args.onInferenceEvent);
         return {
@@ -951,7 +1739,7 @@ export function createWorkflowSupervisor(bindings) {
             channelId,
             hmacKey,
             hostPublicKey: ipcKeypair.publicKey,
-            deploymentId: bindings.deploymentId,
+            anchorRunId: bindings.anchorRunId,
             deploymentMailAddress: bindings.deploymentMailAddress,
             stepCount: bindings.stepCount,
             definitionHash: opts.definitionHash,
@@ -1016,6 +1804,7 @@ export function createWorkflowSupervisor(bindings) {
             terminalBroadcaster: createTerminalBroadcaster(),
             dispatchLoop: null,
             replayDone: null,
+            sweepDone: null,
         };
         // Everything from here to the successful `return` runs with the state
         // record in "starting" (then "running"). A throw at any of these
@@ -1029,7 +1818,7 @@ export function createWorkflowSupervisor(bindings) {
                 repoStore: bindings.repoStore,
                 principal: bindings.readPrincipal,
                 stepOrder: opts.stepOrder,
-                deploymentId: bindings.deploymentId,
+                anchorRunId: bindings.anchorRunId,
                 deriveStepAddress: bindings.deriveStepAddress,
                 ...(bindings.deriveStepRepoId !== undefined
                     ? { deriveStepRepoId: bindings.deriveStepRepoId }
@@ -1048,8 +1837,13 @@ export function createWorkflowSupervisor(bindings) {
             // first `dequeueToProcessing` so a fresh inbound mail that lands
             // during the replay window cannot ship ahead of the orphan once
             // the replay completes.
-            const replayDone = readOwnedMessageIds(bindings.repoStore, bindings.workflowRunRepoId)
-                .then((ownedMessageIds) => inboxPrimitives.replayProcessingToInbox(bindings.repoStore, inboxWritePrincipal, bindings.workflowRunRepoId, bindings.deploymentMailAddress, { ownedMessageIds }))
+            // One scan of `runs/` feeds both spawn-time recovery consumers: the
+            // orphan replay (which gates dispatch) and the compaction sweep (which
+            // does not). Sharing the walk keeps recovery off a second O(total-runs)
+            // scan.
+            const scanDone = scanRunsForBoot(bindings.repoStore, bindings.workflowRunRepoId);
+            const replayDone = scanDone
+                .then(({ ownedMessageIds }) => inboxPrimitives.replayProcessingToInbox(bindings.repoStore, inboxWritePrincipal, bindings.workflowRunRepoId, bindings.deploymentMailAddress, { ownedMessageIds }))
                 .then(() => {
                 wakeDispatch();
             })
@@ -1067,7 +1861,7 @@ export function createWorkflowSupervisor(bindings) {
                 // sweep that picks up parked orphans. Left as logged
                 // best-effort until that lands.
                 const message = cause instanceof Error ? cause.message : String(cause);
-                logger.warn `replayProcessingToInbox on spawn failed: ${message}`;
+                logger.warn `boot recovery scan or processing replay failed on spawn: ${message}`;
             });
             // Hold the replay promise on the active-state record so
             // `shutdownInternal` awaits its settlement before tearing the
@@ -1075,6 +1869,36 @@ export function createWorkflowSupervisor(bindings) {
             // flight would otherwise leave the substrate write pending past
             // the supervisor's exit.
             state.replayDone = replayDone;
+            // Re-seal runs a crash left terminal-but-per-event when their
+            // fire-and-forget fold never ran. Unlike the replay above, this must
+            // NOT gate dispatch: reclaiming leaked per-event files is housekeeping
+            // and cannot be allowed to delay the first dequeue. Best-effort, held
+            // on the active-state record so shutdown awaits its settlement (see the
+            // `sweepDone` field docstring for the teardown-latency tradeoff).
+            const sweepDone = scanDone
+                .then(({ pendingSealRunIds }) => recoverInterruptedCompactions({
+                substrate: bindings.repoStore,
+                repoId: bindings.workflowRunRepoId,
+                ref: bindings.workflowRunRef,
+                anchorRunId: bindings.anchorRunId,
+                pendingSealRunIds,
+            }))
+                .then(({ sealed, failed }) => {
+                if (sealed > 0) {
+                    logger.info `recovery sweep sealed ${String(sealed)} interrupted run(s)`;
+                }
+                if (failed.length > 0) {
+                    const detail = failed
+                        .map((f) => `${f.runId} (${f.message})`)
+                        .join("; ");
+                    logger.warn `recovery sweep left ${String(failed.length)} run(s) unsealed: ${detail}`;
+                }
+            })
+                .catch((cause) => {
+                const message = cause instanceof Error ? cause.message : String(cause);
+                logger.warn `boot recovery scan or compaction sweep failed on spawn: ${message}`;
+            });
+            state.sweepDone = sweepDone;
             bindings.mailBus.registerAddress(bindings.deploymentMailAddress);
             const mailUnsubscribe = bindings.mailBus.subscribeMailForAddress(bindings.deploymentMailAddress, onMailMessage);
             state.mailUnsubscribe = mailUnsubscribe;
@@ -1124,19 +1948,47 @@ export function createWorkflowSupervisor(bindings) {
             // same control channel `trigger.fire` uses, so the ordering
             // guarantee (`grants-updated` lands before `trigger.fire`) holds
             // for buffered and post-ready inbound mail alike.
-            await wired.wiring.controlSender.send({
-                type: "grants-updated",
-                data: {
-                    snapshot: {
-                        steps: credentialsSnapshot.steps.map((s) => ({
-                            stepId: s.stepId,
-                            address: s.address,
-                            grants: [...s.grants],
-                            contentHash: s.contentHash,
-                        })),
+            //
+            // Suppressed when `onRunStart` is wired: that binding makes the
+            // dispatch loop push a per-run snapshot before each `trigger.fire`,
+            // so the spawn-time push would only mask a broken per-run barrier
+            // (the child would already hold grants and never hit its throw-on-
+            // null guard). The per-run push is then the sole grants source.
+            if (bindings.onRunStart === undefined) {
+                await wired.wiring.controlSender.send({
+                    type: "grants-updated",
+                    data: {
+                        snapshot: {
+                            steps: credentialsSnapshot.steps.map((s) => ({
+                                stepId: s.stepId,
+                                address: s.address,
+                                grants: [...s.grants],
+                                contentHash: s.contentHash,
+                            })),
+                        },
                     },
-                },
-            });
+                });
+            }
+            // Deliver the run's credential material to the child on EVERY spawn, not
+            // only through the per-trigger `onRunStart` barrier. A restored run resumes
+            // from its parked state without a fresh `trigger.fire` (a signal wakes it),
+            // so the barrier would never re-deliver the cell and the resumed run's
+            // inference would fail closed. Seeding the live cell here at spawn lets an
+            // offline restart resolve each source's credential from the persisted
+            // (unsealed) delivery without waiting on a hub reconnect. Unlike the grants
+            // push above this is NOT suppressed when `onRunStart` is wired: the barrier
+            // fires per trigger, but a resume has no trigger, so the spawn push is the
+            // only credential source on the resume path. Idempotent with the barrier's
+            // own push on a fresh run: the child merges both, and both carry the same
+            // mirror. Absent when the deployment binds no credentials. Reads the live
+            // mirror, not the frozen deploy delivery, so a credential revoked earlier
+            // this process stays evicted.
+            if (currentCredentialDelivery !== null) {
+                await wired.wiring.controlSender.send({
+                    type: "credentials-updated",
+                    data: { delivery: currentCredentialDelivery },
+                });
+            }
             // Transition to running. The dispatch loop (started below)
             // picks up any pre-ready buffered mail through the FIFO inbox
             // queue rather than through an in-memory buffer; arrival order
@@ -1169,7 +2021,13 @@ export function createWorkflowSupervisor(bindings) {
                 terminalBroadcaster: startingPhaseBroadcaster,
                 dispatchLoop,
                 replayDone,
+                sweepDone,
             };
+            // Bump the generation and arm the exit-watcher atomically with the
+            // running transition (no await between the swap above and this call)
+            // so an unexpected exit of this child is classified against the
+            // right generation.
+            armChildForRunning(handle);
             // Kick the dispatch loop in case mail landed in the inbox
             // before the loop's first `await dispatchWake`. A wake against a
             // freshly-minted promise is a no-op; the dispatch loop's first
@@ -1200,6 +2058,18 @@ export function createWorkflowSupervisor(bindings) {
                 const message = cause instanceof Error ? cause.message : String(cause);
                 logger.error `upstream control pump failed: ${message}`;
             });
+            // Trigger A: re-register every correlation the freshly-ready child is
+            // parked on. A `park.notify` register can be lost while the hub is down
+            // at the original suspend; a child that resumes such a parked run (a
+            // sidecar restart re-spawning this deployment, or a recycle -- see the
+            // matching call in `installNewChild`) re-parks without re-emitting, so
+            // the supervisor re-drives it from every re-establishment. Fire-and-
+            // forget after the pump is armed to route the response: best-effort,
+            // watchdog-bounded, and an empty round-trip when nothing is parked.
+            void reEmitParkedCorrelations().catch((cause) => {
+                const message = cause instanceof Error ? cause.message : String(cause);
+                logger.warn `re-emit of parked correlations on re-establishment failed: ${message}`;
+            });
             // Arm the recycle policy. The policy is a no-op when all bounds
             // are `undefined`; bounds resolution lives inside `createRecyclePolicy`.
             if (bindings.recyclePolicy !== undefined) {
@@ -1318,60 +2188,200 @@ export function createWorkflowSupervisor(bindings) {
     }
     /**
      * Forward one dequeued inbox entry to the child as `trigger.fire`
-     * and record its runId as in-flight. The runId is the messageId
-     * the envelope carries (one run per trigger fire per discovery
-     * Q3.1); the same value is what the dispatch loop waits on via
-     * `terminalEventSource`.
+     * and record its runId as in-flight. The runId is the local part of the
+     * deployment's mail address (see `deriveWorkflowRunId`), identifying its one
+     * top-level run. The resolved `Mail` (headers plus committed part references)
+     * rides in the frame as the run's trigger payload; the `messageId`
+     * accompanies it for correlation and audit. The runId is the same value the
+     * dispatch loop waits on via `terminalEventSource`.
      */
-    async function forwardDispatchedEntry(sender, messageId, receivedAt) {
+    async function forwardDispatchedEntry(sender, messageId, receivedAt, runId, payload) {
         await sender.send({
             type: "trigger.fire",
             data: {
-                runId: messageId,
+                runId,
                 messageId,
                 receivedAt,
+                payload,
             },
         });
-        inFlightRuns.add(messageId);
-        return messageId;
+        cohortRunIds.add(runId);
+        return runId;
+    }
+    /**
+     * Resolve a dequeued inbound mail to the run's input: a decoded `Mail`
+     * (headers plus part descriptors that reference the part bytes committed to
+     * the workflow-run substrate). The supervisor is the sole mail owner and
+     * commits the parts here (a direct workflow-run write; the workflow child's
+     * control loop cannot do a synchronous proxied write without deadlock), so
+     * both turns share this one preparation site.
+     *
+     * The two failure modes are deliberately distinct:
+     *   - A DETERMINISTIC input rejection -- missing bytes, unparseable MIME, or
+     *     a messageId that cannot form a path segment -- returns `{ ok: false }`
+     *     so the caller drops the mail. Replaying it would fail identically.
+     *   - A TRANSIENT substrate write failure propagates (thrown), so the caller
+     *     treats it as a dispatch fault and leaves the mail reclaimable rather
+     *     than silently discarding it on an infrastructure hiccup.
+     */
+    async function prepareMail(envelope, runId) {
+        if (envelope.rawMessage === undefined) {
+            return {
+                ok: false,
+                rejection: {
+                    code: "malformed_mail",
+                    message: `inbound mail ${envelope.messageId} carries no rawMessage bytes`,
+                },
+            };
+        }
+        let decoded;
+        try {
+            decoded = decodeMail(base64Decode(envelope.rawMessage));
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            return {
+                ok: false,
+                rejection: {
+                    code: "malformed_mail",
+                    message: `inbound mail ${envelope.messageId} could not be decoded: ${message}`,
+                },
+            };
+        }
+        const writePrincipal = {
+            kind: "supervisor",
+            anchorRunId: bindings.anchorRunId,
+        };
+        try {
+            const mail = await commitMail({
+                substrate: bindings.repoStore,
+                repoId: bindings.workflowRunRepoId,
+                principal: writePrincipal,
+                runId,
+                ref: bindings.workflowRunRef,
+            }, envelope.messageId, decoded);
+            return { ok: true, mail };
+        }
+        catch (cause) {
+            if (cause instanceof InvalidMailError) {
+                return {
+                    ok: false,
+                    rejection: { code: "malformed_mail", message: cause.message },
+                };
+            }
+            throw cause;
+        }
+    }
+    /**
+     * Push the run's grants snapshot to the child ahead of its
+     * `trigger.fire`. Returns `true` if the barrier FAILED (the caller must
+     * skip the fire; the run has already been settled as `RunFailed`) and
+     * `false` if the barrier passed or is not armed (`onRunStart` unwired,
+     * where `spawn` supplied the snapshot instead).
+     *
+     * The sink is a request/response contract: the supervisor awaits the
+     * returned snapshot and awaits the `grants-updated` send so both land on
+     * the child's control channel before the trigger. A throw from either --
+     * the sink itself or the control send -- is surfaced as a synthesized
+     * `RunFailed` fanned out to this run's broadcaster watcher, never
+     * swallowed, so the run fails deterministically instead of the child
+     * authorizing against a stale or absent snapshot.
+     */
+    async function pushRunGrants(sender, runId, broadcaster) {
+        if (bindings.onRunStart === undefined)
+            return false;
+        try {
+            const snapshot = await bindings.onRunStart({
+                runId,
+                anchorRunId: bindings.anchorRunId,
+            });
+            await sender.send({
+                type: "grants-updated",
+                data: {
+                    snapshot: {
+                        steps: snapshot.steps.map((s) => ({
+                            stepId: s.stepId,
+                            address: s.address,
+                            grants: [...s.grants],
+                            contentHash: s.contentHash,
+                        })),
+                    },
+                },
+            });
+            // Deliver the deployment's credential material on the same pre-trigger
+            // barrier, so a tool that resolves a credential on the first step already
+            // has it in the child's cell. Reads the live mirror, not the frozen deploy
+            // delivery: a rotation or revocation delivered earlier via
+            // `deliverCredentials` is reflected here, and a recycled child (seeded only
+            // by this barrier) inherits the current set instead of the deploy-time one.
+            // Absent when the deployment binds none.
+            if (currentCredentialDelivery !== null) {
+                await sender.send({
+                    type: "credentials-updated",
+                    data: { delivery: currentCredentialDelivery },
+                });
+            }
+            return false;
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            logger.error `onRunStart grants barrier failed for run ${runId}; failing the run: ${message}`;
+            broadcaster.notify(runId, {
+                kind: "RunFailed",
+                seq: 0,
+                at: new Date().toISOString(),
+                error: {
+                    message: `workflow-host supervisor: run ${runId} not authorized; grants barrier failed before trigger.fire: ${message}`,
+                },
+            });
+            return true;
+        }
     }
     /**
      * One iteration of the dispatch loop: dequeue the FIFO-first inbox
-     * entry, forward it as a `trigger.fire`, wait for the corresponding
-     * run's terminal event (or for the cohort to abort), then
-     * `markConsumed`. Returns `true` if a dispatch landed (caller should
-     * loop immediately) and `false` if the inbox was empty (caller
-     * should await the next wake).
+     * entry, decide whether to `signal.deliver` or `trigger.fire` (or wait
+     * if the run is in-flight but not yet parked), then `markConsumed`
+     * once the child has taken up the message -- for a `trigger.fire` that
+     * means after the run reaches a terminal event or parks, so the
+     * claim-check entry the child still needs to read is not deleted out
+     * from under it. Returns `true` if a dispatch landed (caller should
+     * loop immediately) and `false` if the inbox was empty (caller should
+     * await the next wake).
      */
     async function dispatchOne(sender, cohortAbort, broadcaster) {
         if (cohortAbort.signal.aborted)
             return false;
-        // Subscribe to the terminal broadcaster BEFORE forwarding the
-        // trigger.fire so a terminal event the child notifies between
-        // forward and subscribe cannot be missed. The broadcaster fires
-        // its listeners synchronously inside `notify`; with the subscribe
-        // ordered first the listener buffers the event until the
-        // dispatch loop's `iter.next()` consumes it.
         const beforeDequeueMs = dispatchTimingEnabled() ? performance.now() : 0;
         const dequeued = await inboxPrimitives.dequeueToProcessing(bindings.repoStore, inboxWritePrincipal, bindings.workflowRunRepoId, bindings.deploymentMailAddress);
         if (dequeued === null)
             return false;
         const envelope = dequeued.envelope;
-        const runId = envelope.messageId;
-        currentDispatchRunId = runId;
-        emitDispatchTiming(runId, "dispatch-start", beforeDequeueMs);
+        const runId = deriveWorkflowRunId(bindings.deploymentMailAddress);
+        const messageId = envelope.messageId;
+        let rejection;
+        const rejectTerminalRun = () => {
+            if (rejection !== undefined)
+                return;
+            rejection = {
+                code: "workflow_run_terminal",
+                message: `Workflow run ${runId} is terminal and cannot be fired again`,
+            };
+            logger.warn `rejecting inbound mail ${messageId}: workflow run ${runId} is terminal`;
+        };
+        currentDispatchMessageId = messageId;
+        emitDispatchTiming(messageId, "dispatch-start", beforeDequeueMs);
         // D2 leg: the claim-check dequeue READ. `dispatch-start` is sampled
         // BEFORE the dequeue (so the roundtrip bracket includes the read);
         // the dequeue leg's own start mark is that same pre-dequeue sample
         // re-stamped under the leg channel, and its end is now (the read just
         // completed). Emitting the start retroactively here -- rather than
-        // before the await -- keeps the leg keyed by the runId, which is only
-        // known after the dequeue resolves.
+        // before the await -- keeps the leg keyed by the messageId, which is
+        // only known after the dequeue resolves.
         if (bindings.onDispatchTiming !== undefined) {
             try {
                 bindings.onDispatchTiming({
                     kind: "leg",
-                    runId,
+                    messageId,
                     leg: "dequeue",
                     phase: "start",
                     atMs: beforeDequeueMs,
@@ -1379,28 +2389,233 @@ export function createWorkflowSupervisor(bindings) {
             }
             catch (cause) {
                 const message = cause instanceof Error ? cause.message : String(cause);
-                logger.warn `onDispatchTiming leg observer threw for ${runId} (dequeue start): ${message}`;
+                logger.warn `onDispatchTiming leg observer threw for ${messageId} (dequeue start): ${message}`;
+            }
+        }
+        legMarkEnd(messageId, "dequeue");
+        // In-memory cohort membership is deliberately not the lifecycle
+        // authority: it is empty for a new run, after a terminal frame, and while
+        // a child is rediscovering a live run after restart. Consult the durable
+        // log before deciding that "no cohort" means "fire". A live log is added
+        // back to cohort tracking so the existing terminal/park wait handles the
+        // recovery window; a terminal log is rejected permanently.
+        if (!cohortRunIds.has(runId)) {
+            const lifecycle = terminalRunIds.has(runId)
+                ? "terminal"
+                : await readWorkflowRunLifecycle(bindings.repoStore, bindings.workflowRunRepoId, runId);
+            if (lifecycle === "terminal") {
+                rejectTerminalRun();
+            }
+            else if (lifecycle === "live") {
+                cohortRunIds.add(runId);
+            }
+        }
+        if (rejection === undefined) {
+            // Subscribe to the terminal broadcaster BEFORE the grants barrier so
+            // a synthetic `RunFailed` from a barrier failure can be captured.
+            const preIter = broadcaster.source(runId)[Symbol.asyncIterator]();
+            // Per-run grants barrier. When `onRunStart` is wired, push this run's
+            // grants snapshot BEFORE the trigger/signal so the child's authorize
+            // closure binds to it rather than throwing on a null snapshot. The push
+            // and the fire share the child's control channel, so a `grants-updated`
+            // awaited here is observed by the child ahead of the trigger. A barrier
+            // failure (the sink throws, or the push fails) fails the run loudly --
+            // a synthesized `RunFailed` fanned out to this run's watcher -- and the
+            // trigger is NOT fired, so no step ever runs against absent grants.
+            const barrierFailed = await pushRunGrants(sender, runId, broadcaster);
+            if (barrierFailed) {
+                // Wait for the synthetic RunFailed before consuming the message.
+                await waitForRunTerminal(preIter, cohortAbort.signal);
+                // Clean up for synthetic barrier failure (real terminal events are
+                // cleaned up by pumpUpstreamControl, but synthetic ones are not).
+                cohortRunIds.delete(runId);
+                runInputChannels.delete(runId);
+            }
+            else {
+                // Dispose the pre-created iterator; the normal path creates fresh
+                // iterators inside the dispatch-decision loop when waiting.
+                if (typeof preIter.return === "function") {
+                    await preIter.return();
+                }
+                // Unified dispatch: park → signal.deliver; no live run → trigger.fire;
+                // in-flight but undecided → wait for terminal or park, then re-evaluate.
+                while (!cohortAbort.signal.aborted) {
+                    if (terminalRunIds.has(runId)) {
+                        rejectTerminalRun();
+                        break;
+                    }
+                    // Capture the park generation BEFORE this iteration's pre-wait awaits
+                    // so `waitForRunTerminalOrPark` can accept a strictly-newer park that
+                    // fires during them (see the latch there). Re-captured each iteration
+                    // so a wait that returned "parked" is not re-counted next time around.
+                    const sinceGen = parkGenerations.get(runId) ?? 0;
+                    // Routing hygiene (defense-in-depth the latch never depends on): a
+                    // runInputChannels entry with no live run in this cohort is a stale
+                    // routing hazard left by a dead incarnation. Drop it BEFORE the signal
+                    // branch so a fresh mail cannot be routed onto a dead run's
+                    // correlation. The resumed.runs invariant (cohortRunIds registered
+                    // before its input channel) keeps a LIVE resumed run out of this
+                    // branch, so this only ever drops genuinely-dead entries.
+                    if (!cohortRunIds.has(runId) && runInputChannels.has(runId)) {
+                        runInputChannels.delete(runId);
+                    }
+                    const inputChannel = runInputChannels.get(runId);
+                    if (inputChannel !== undefined) {
+                        // Resolve the inbound mail to the run's input HERE, the single site
+                        // that knows this payload's provenance is mail, applying the SAME
+                        // preparation the turn-1 trigger does. The signal.deliver frame's
+                        // payload is the resume decision in FINAL form -- a Mail (headers plus committed part references); deliverSignal's structured signals ship their own
+                        // payload unchanged. Done BEFORE minting the terminal watcher so a
+                        // failure here cannot leak an un-finalized iterator.
+                        const prepared = await prepareMail(envelope, runId);
+                        if (!prepared.ok) {
+                            // A DETERMINISTICALLY malformed turn-2 mail cannot resume the
+                            // parked agent. DROP it: log loudly and consume it (break to the
+                            // post-loop markConsumed) rather than throwing -- replay would
+                            // re-deliver the same poison mail forever. The run stays parked
+                            // on its current correlation, ready for the next valid mail; one
+                            // bad mail must not tear down a long-lived conversation. A
+                            // TRANSIENT write failure is NOT caught here: `prepareMail`
+                            // throws it, so it propagates as a dispatch fault and the mail
+                            // stays reclaimable for retry.
+                            logger.error `signal.deliver for run ${runId}: dropping malformed inbound mail ${envelope.messageId}: ${prepared.rejection.message}`;
+                            break;
+                        }
+                        // Mint the terminal watcher only now, after the payload resolved, so
+                        // a terminal the resumed run reaches right after applying the signal
+                        // is not missed; the park watcher is armed inside
+                        // waitForRunTerminalOrPark.
+                        const iter = broadcaster.source(runId)[Symbol.asyncIterator]();
+                        let waitEntered = false;
+                        try {
+                            await sender.send({
+                                type: "signal.deliver",
+                                data: {
+                                    runId,
+                                    signalName: signalName(inputChannel.correlationId),
+                                    signalId: envelope.messageId,
+                                    payload: prepared.mail,
+                                },
+                            });
+                            // Invalidate the cached input channel: its correlation is now
+                            // consumed by this delivery, so the NEXT mail must not reuse it.
+                            // The resumed run re-parks on a FRESH correlation (a new
+                            // park.notify repopulates runInputChannels); a mail arriving before
+                            // that re-park waits via the in-flight branch rather than
+                            // delivering onto the stale channel. Routing hygiene only -- the
+                            // wait keys on the park-generation edge, not this level state.
+                            runInputChannels.delete(runId);
+                            // The message was dispatched as a turn: mark its eager mailbox
+                            // entry \Seen/$Processed. Fire-and-forget off the dispatch path.
+                            markMailboxProcessed(envelope.messageId);
+                            // Durable-consume contract, mirroring the trigger.fire path: hold
+                            // markConsumed until the child has durably taken up the signal --
+                            // the resumed run re-parks or reaches a terminal event. That gate
+                            // is downstream of durability DESPITE the child's fire-and-forget
+                            // SignalReceived writer: the runtime reaches re-park/terminal only
+                            // by resuming from the COMMITTED SignalReceived, which its per-run
+                            // subscribeKind substrate subscription surfaces only after the
+                            // commit lands -- so the substrate subscription IS the ack, and a
+                            // failed deliver commit is observed by nothing, never re-parks, and
+                            // never releases markConsumed (the mail stays reclaimable). A crash
+                            // before the re-park/terminal leaves the claim-check entry in
+                            // processing/, so replayProcessingToInbox re-delivers the signal on
+                            // restart. On cohort abort the wait returns and the post-loop guard
+                            // skips markConsumed.
+                            waitEntered = true;
+                            await waitForRunTerminalOrPark(iter, cohortAbort.signal, runId, sinceGen);
+                        }
+                        finally {
+                            // waitForRunTerminalOrPark finalizes the iterator it consumes; the
+                            // only leak is when `sender.send` throws before the wait is
+                            // entered, so finalize only in that case.
+                            if (!waitEntered && typeof iter.return === "function") {
+                                await iter.return(undefined).catch(() => {
+                                    /* best-effort finalisation of the watcher iterator. */
+                                });
+                            }
+                        }
+                        break;
+                    }
+                    if (!cohortRunIds.has(runId)) {
+                        // Resolve the inbound mail to the run's input before firing. A
+                        // DETERMINISTICALLY malformed first trigger cannot start the run:
+                        // record the rejection on the consumed entry and drop it (break to
+                        // the post-loop markConsumed), since replay would fail identically.
+                        // A TRANSIENT write failure instead propagates from
+                        // `prepareMail` as a dispatch fault, leaving the mail
+                        // reclaimable. Unlike a turn-2 parse failure (which leaves a live
+                        // run parked), a malformed first trigger produces no run at all --
+                        // the rejection surfaces on the consumed entry, not as a RunFailed
+                        // terminal event.
+                        const prepared = await prepareMail(envelope, runId);
+                        if (!prepared.ok) {
+                            if (rejection === undefined)
+                                rejection = prepared.rejection;
+                            logger.error `trigger.fire for run ${runId}: rejecting malformed inbound mail ${envelope.messageId}: ${prepared.rejection.message}`;
+                            break;
+                        }
+                        // Subscribe the terminal watcher BEFORE the trigger fires. The
+                        // broadcaster drops a notify that has no listener (its subscribe-
+                        // before-fire contract), so a terminal that lands while
+                        // forwardDispatchedEntry is in flight would be lost and the wait
+                        // would hang to the backstop.
+                        const iter = broadcaster.source(runId)[Symbol.asyncIterator]();
+                        let waitEntered = false;
+                        try {
+                            await forwardDispatchedEntry(sender, envelope.messageId, envelope.receivedAt, runId, prepared.mail);
+                            // The message was dispatched as a turn: mark its eager mailbox
+                            // entry \Seen/$Processed. Fire-and-forget off the dispatch path.
+                            markMailboxProcessed(envelope.messageId);
+                            // Wait for the child to durably take up this trigger (RunStarted
+                            // committed, then the run parks or terminates) before allowing
+                            // `markConsumed` to move the claim-check entry out of
+                            // `processing/`. The payload now rides the frame, so the child no
+                            // longer reads it from the entry -- but the durable-consume
+                            // contract still holds markConsumed until the run's uptake is
+                            // committed, so a crash before RunStarted leaves the entry in
+                            // processing/ for replayProcessingToInbox to re-deliver. On cohort
+                            // abort the wait returns and the post-loop guard skips
+                            // markConsumed.
+                            waitEntered = true;
+                            await waitForRunTerminalOrPark(iter, cohortAbort.signal, runId, sinceGen);
+                        }
+                        finally {
+                            // waitForRunTerminalOrPark finalizes the iterator it consumes; the
+                            // only leak is when forward throws before the wait is
+                            // entered, so finalize only in that case.
+                            if (!waitEntered && typeof iter.return === "function") {
+                                await iter.return(undefined).catch(() => {
+                                    /* best-effort finalisation of the watcher iterator. */
+                                });
+                            }
+                        }
+                        break;
+                    }
+                    const iter = broadcaster.source(runId)[Symbol.asyncIterator]();
+                    const outcome = await waitForRunTerminalOrPark(iter, cohortAbort.signal, runId, sinceGen);
+                    if (outcome === "aborted")
+                        break;
+                    if (outcome === "terminal") {
+                        // This message was waiting for an already-live run to expose its
+                        // next input correlation. The run terminated first, so the mail
+                        // was never delivered and must not fall through to trigger.fire.
+                        rejectTerminalRun();
+                        break;
+                    }
+                    // Continue loop: re-evaluate runInputChannels / cohortRunIds
+                }
             }
         }
-        legMarkEnd(runId, "dequeue");
-        const iterable = broadcaster.source(runId);
-        const iter = iterable[Symbol.asyncIterator]();
-        await forwardDispatchedEntry(sender, envelope.messageId, envelope.receivedAt);
-        await waitForRunTerminal(iter, cohortAbort.signal);
-        emitDispatchTiming(runId, "reply-produced", performance.now());
-        inFlightRuns.delete(runId);
         if (cohortAbort.signal.aborted) {
-            // The cohort tore down before the terminal event arrived (or
-            // alongside it). Skip `markConsumed` so the recycle path's
-            // drain-side replay can reclaim the processing entry.
-            currentDispatchRunId = null;
-            resolveMarkConsumedWaiter(runId);
+            currentDispatchMessageId = null;
             return false;
         }
-        // D2 leg: `markConsumed` is paid AFTER `reply-produced` (stamped
-        // above), so its growth is invisible to the 4.7 round-trip bracket --
-        // the leg mark makes the out-of-window cost visible.
-        legMarkStart(runId, "markconsumed");
+        emitDispatchTiming(messageId, "reply-produced", performance.now());
+        // D2 leg: `markConsumed` is paid AFTER `reply-produced`, so its growth
+        // is invisible to the 4.7 round-trip bracket -- the leg mark makes the
+        // out-of-window cost visible.
+        legMarkStart(messageId, "markconsumed");
         try {
             await inboxPrimitives.markConsumed(bindings.repoStore, inboxWritePrincipal, bindings.workflowRunRepoId, {
                 address: bindings.deploymentMailAddress,
@@ -1408,17 +2623,21 @@ export function createWorkflowSupervisor(bindings) {
                 runId,
                 consumedAt: Date.now(),
                 retentionHorizonMs: consumedRetentionMs,
+                ...(rejection !== undefined ? { rejection } : {}),
             });
         }
         catch (cause) {
-            const message = cause instanceof Error ? cause.message : String(cause);
-            logger.error `markConsumed failed for run ${runId}: ${message}`;
-        }
-        legMarkEnd(runId, "markconsumed");
-        resolveMarkConsumedWaiter(runId);
-        // §10c forced-repack A/B (measurement-only; no-op when unwired).
+            // A markConsumed failure is fatal:
+            // swallowing it treats the dispatch as complete while the mail is NOT
+            // durably recorded consumed, hiding the failure and leaving a mail that
+            // is neither cleanly consumed nor visibly failed. Propagate into the
+            // dispatch fault handler so the failure surfaces and the mail stays
+            // reclaimable.
+            throw new Error(`failed to markConsumed for run ${runId}`, { cause });
+        }
+        legMarkEnd(messageId, "markconsumed");
         maybeRepack(runId);
-        currentDispatchRunId = null;
+        currentDispatchMessageId = null;
         return true;
     }
     /**
@@ -1460,6 +2679,94 @@ export function createWorkflowSupervisor(bindings) {
             }
         }
     }
+    /**
+     * Wait until the run's terminal event lands on the cohort
+     * broadcaster's iterator, the child parks the run (bumping the park
+     * generation past `sinceGen`), or the cohort aborts. Returns `"terminal"`
+     * when a terminal event arrived, `"parked"` when the run parked,
+     * and `"aborted"` when the cohort tore down. Throws when the backstop
+     * fires (see `TERMINAL_OR_PARK_BACKSTOP_MS`).
+     *
+     * `sinceGen` is the park generation the CALLER captured before its pre-wait
+     * awaits; the wait accepts only a STRICTLY NEWER park (`generation >
+     * sinceGen`). Keying on that edge -- not `runInputChannels`' level state --
+     * makes the wait's correctness local: a park during the pre-wait awaits is
+     * observed even though its `resolveParkNotifyWaiter` no-op'd, and a stale
+     * channel entry from a prior run or incarnation cannot false-positive.
+     */
+    async function waitForRunTerminalOrPark(iter, abortSignal, runId, sinceGen) {
+        let onAbort = null;
+        const abortPromise = new Promise((resolve) => {
+            if (abortSignal.aborted) {
+                resolve({ source: "abort" });
+                return;
+            }
+            onAbort = () => resolve({ source: "abort" });
+            abortSignal.addEventListener("abort", onAbort, { once: true });
+        });
+        let parkResolve = null;
+        const parkPromise = new Promise((resolve) => {
+            parkResolve = () => resolve({ source: "park" });
+            parkNotifyWaiters.set(runId, parkResolve);
+        });
+        let timeoutHandle;
+        const timeoutPromise = new Promise((resolve) => {
+            timeoutHandle = setTimeout(() => resolve({ source: "timeout" }), TERMINAL_OR_PARK_BACKSTOP_MS);
+        });
+        try {
+            if (abortSignal.aborted)
+                return "aborted";
+            // Check-after-register: read the generation now that the waiter above is
+            // armed, SYNCHRONOUSLY (no await between arming and this read, so no
+            // `park.notify` can interleave). A generation past `sinceGen` means the
+            // run already parked -- during the caller's pre-wait awaits, before the
+            // waiter armed, so `resolveParkNotifyWaiter` no-op'd and the armed
+            // parkPromise would never fire -- and this catches it rather than hanging
+            // to the backstop.
+            if ((parkGenerations.get(runId) ?? 0) > sinceGen)
+                return "parked";
+            const result = await Promise.race([
+                iter.next().then((r) => ({ source: "iter", r })),
+                abortPromise,
+                parkPromise,
+                timeoutPromise,
+            ]);
+            if (result.source === "abort")
+                return "aborted";
+            if (result.source === "park")
+                return "parked";
+            if (result.source === "timeout") {
+                // Backstop against a lost wake or a wedged child: the run neither
+                // parked, terminated, nor aborted within a generous window. Surface it
+                // LOUDLY and throw so the dispatch fails -- the caller does not
+                // markConsumed on a throw, so the mail stays reclaimable in
+                // processing/ and is never consumed on the assumption the run
+                // progressed.
+                logger.error `waitForRunTerminalOrPark backstop fired for run ${runId} after ${TERMINAL_OR_PARK_BACKSTOP_MS}ms; failing the dispatch so the mail stays reclaimable`;
+                throw new Error(`waitForRunTerminalOrPark backstop: run ${runId} did not park or terminate within ${TERMINAL_OR_PARK_BACKSTOP_MS}ms`);
+            }
+            if (result.r.done === true)
+                return "aborted";
+            // A terminal event for this runId arrived; stop waiting.
+            return "terminal";
+        }
+        finally {
+            if (timeoutHandle !== undefined) {
+                clearTimeout(timeoutHandle);
+            }
+            if (parkResolve !== null) {
+                parkNotifyWaiters.delete(runId);
+            }
+            if (onAbort !== null) {
+                abortSignal.removeEventListener("abort", onAbort);
+            }
+            if (typeof iter.return === "function") {
+                await iter.return(undefined).catch(() => {
+                    /* swallowed: best-effort finalisation of the watcher iterator. */
+                });
+            }
+        }
+    }
     /**
      * The dispatch loop body. Runs until the cohort aborts; each
      * iteration drains one inbox entry through the FIFO claim-check
@@ -1482,6 +2789,13 @@ export function createWorkflowSupervisor(bindings) {
                 return;
         }
         while (!cohortAbort.signal.aborted) {
+            // Capture the wake BEFORE the dispatch iteration (capture-before-check,
+            // same discipline as the park-generation latch). `wakeDispatch` resolves
+            // the CURRENT promise and swaps in a fresh one, so a mail that enqueues
+            // DURING dispatchOne resolves THIS captured promise; capturing it after
+            // dispatchOne would await the fresh, unresolved promise and strand that
+            // mail until some later wake.
+            const wake = dispatchWake.promise;
             let dispatched;
             try {
                 dispatched = await dispatchOne(sender, cohortAbort, broadcaster);
@@ -1499,7 +2813,6 @@ export function createWorkflowSupervisor(bindings) {
                 continue;
             if (cohortAbort.signal.aborted)
                 return;
-            const wake = dispatchWake.promise;
             const abortPromise = new Promise((resolve) => {
                 if (cohortAbort.signal.aborted) {
                     resolve();
@@ -1517,7 +2830,7 @@ export function createWorkflowSupervisor(bindings) {
             substrate: bindings.repoStore,
             repoId: bindings.workflowRunRepoId,
             ref: bindings.workflowRunRef,
-            deploymentId: bindings.deploymentId,
+            anchorRunId: bindings.anchorRunId,
             runId: opts.runId,
             origin: opts.origin,
             reason: opts.reason,
@@ -1530,7 +2843,9 @@ export function createWorkflowSupervisor(bindings) {
         await shutdownInternal({ reason: "shutdown requested" });
     }
     async function shutdownInternal(opts) {
-        if (state.phase === "idle" || state.phase === "stopped")
+        if (state.phase === "idle" ||
+            state.phase === "stopped" ||
+            state.phase === "crash-looping")
             return;
         const prior = state;
         state = { phase: "stopping" };
@@ -1566,11 +2881,15 @@ export function createWorkflowSupervisor(bindings) {
                 }
             }
             drainAccumulators.clear();
+            cohortRunIds.clear();
+            runInputChannels.clear();
+            parkNotifyWaiters.clear();
+            parkGenerations.clear();
             if (prior.phase === "starting" ||
                 prior.phase === "running" ||
                 prior.phase === "recycling") {
                 prior.terminalCohortAbort.abort();
-                // Reject every pending merge round-trip and markConsumed waiter
+                // Reject every pending merge round-trip and park-notify waiter
                 // so handler closures awaiting them (including fire-and-forget
                 // `handleSubstrateWriteRequest` instances) cannot outlive the
                 // dying cohort. Without this, the `await new Promise` inside
@@ -1618,6 +2937,21 @@ export function createWorkflowSupervisor(bindings) {
                        path only waits for the substrate write to settle. */
                 });
             }
+            if ((prior.phase === "starting" ||
+                prior.phase === "running" ||
+                prior.phase === "recycling") &&
+                prior.sweepDone !== null) {
+                // Await the spawn-time compaction sweep before teardown so an
+                // in-flight fold's substrate commit does not outlive the supervisor
+                // and interleave with the next incarnation's boot. Teardown latency
+                // is bounded by the recovery backlog (see the `sweepDone` field
+                // docstring); a normal boot has zero or one pending fold.
+                await prior.sweepDone.catch(() => {
+                    /* swallowed: the sweep's own catch already surfaces failures to
+                       the supervisor's warn channel; the shutdown path only waits for
+                       the in-flight fold's substrate commit to settle. */
+                });
+            }
             if (recyclePolicy !== null) {
                 try {
                     recyclePolicy.stop();
@@ -1628,6 +2962,24 @@ export function createWorkflowSupervisor(bindings) {
                 }
                 recyclePolicy = null;
             }
+            // Disarm the crash-loop stable-run reset timer so it cannot fire
+            // against a torn-down supervisor. Also drop any pending child exit
+            // that `maybeHandleChildExit` recorded but declined to act on -- it
+            // leaves one pending when a respawn was in flight, or when the phase
+            // had already left `running`. (The crash-loop latch path does NOT
+            // leave one pending: `maybeHandleChildExit` nulls `pendingChildExit`
+            // before invoking the handler that latches.) A shutdown-initiated
+            // kill of a live child in the `finally` below resolves its
+            // `handle.exited`, so the watcher may re-record a pending exit AFTER
+            // this clear -- harmless: the phase is terminal, so
+            // `maybeHandleChildExit` no-ops on it, and `spawn()` requires `idle`,
+            // so the stale slot is never re-examined.
+            clearStableRunResetTimer();
+            // Cancel every armed respawn backoff wait. The phase was flipped to
+            // `stopping` synchronously above, so each parked respawn coroutine
+            // this unblocks re-checks the phase and bails without respawning.
+            cancelRespawnBackoffWaits();
+            pendingChildExit = null;
             spawnContext = null;
             if (prior.phase === "starting" ||
                 prior.phase === "running" ||
@@ -1675,7 +3027,27 @@ export function createWorkflowSupervisor(bindings) {
                     /* swallowed for the same reason as above. */
                 });
             }
-            state = { phase: "stopped" };
+            state = { phase: opts.terminalPhase ?? "stopped" };
+        }
+        // Surface a self-termination to the host after the terminal transition is
+        // committed. The already-terminal early-return at the top dedups the common
+        // case, but it does NOT cover the `stopping` window, so two self-terminating
+        // callers interleaving through teardown can each fire (e.g. an onChildCrash
+        // during `recycling` plus the recycle-failure catch). The sink is therefore
+        // idempotent-required, not exactly-once; the reclaim it drives absorbs a
+        // repeat by design. Wrapped so a throwing sink cannot re-escape here and
+        // break the documented shutdown totality.
+        if (opts.selfTerminated === true) {
+            try {
+                bindings.onSelfTerminate?.({
+                    phase: opts.terminalPhase ?? "stopped",
+                    reason: opts.reason,
+                });
+            }
+            catch (cause) {
+                const message = cause instanceof Error ? cause.message : String(cause);
+                logger.warn `onSelfTerminate sink threw: ${message}`;
+            }
         }
         logger.info `supervisor shutdown complete (${opts.reason})`;
     }
@@ -1702,11 +3074,11 @@ export function createWorkflowSupervisor(bindings) {
      */
     async function drainImpl(opts, ctx) {
         // Drain is meaningful only when a workflow-process child is up;
-        // calling it from `idle`/`stopping`/`stopped` is a no-op so the
-        // higher-level host shutdown sequence can call drain
-        // unconditionally without sniffing the phase. The recycle path
-        // calls drain via `drainImpl({}, { fromRecycle: true })` and
-        // admits `recycling` because the drain step runs against a
+        // calling it from any non-active phase (`idle`/`stopping`/`stopped`/
+        // `crash-looping`) is a no-op so the higher-level host shutdown
+        // sequence can call drain unconditionally without sniffing the phase.
+        // The recycle path calls drain via `drainImpl({}, { fromRecycle: true })`
+        // and admits `recycling` because the drain step runs against a
         // still-live controlSender before the kill lands.
         if (state.phase !== "running" &&
             state.phase !== "starting" &&
@@ -1730,15 +3102,22 @@ export function createWorkflowSupervisor(bindings) {
         // body's cancellation cascade tears the run down without the
         // supervisor having to thread any per-run wiring beyond what the
         // accumulator already encapsulates.
+        //
+        // Runs that are already parked do not need drain escalation; the
+        // runtime parks the run and the supervisor simply stops delivering
+        // new mail. The cohort abort on shutdown/recycle will eventually
+        // tear the run down.
         const cohortSource = perCohortTerminalSource(state.terminalCohortAbort, state.terminalBroadcaster);
-        for (const runId of inFlightRuns) {
+        for (const runId of cohortRunIds) {
             if (drainAccumulators.has(runId))
                 continue;
+            if (runInputChannels.has(runId))
+                continue;
             const accumulator = accumulatorFactory({
                 substrate: bindings.repoStore,
                 repoId: bindings.workflowRunRepoId,
                 ref: bindings.workflowRunRef,
-                deploymentId: bindings.deploymentId,
+                anchorRunId: bindings.anchorRunId,
                 runId,
                 signAsPrincipal: bindings.signAsPrincipal,
                 drainTimeoutMs,
@@ -1752,7 +3131,7 @@ export function createWorkflowSupervisor(bindings) {
         }
     }
     async function recycle(opts) {
-        if (recycleInProgress) {
+        if (respawnInProgress) {
             throw new Error("supervisor: recycle already in progress");
         }
         if (state.phase !== "running") {
@@ -1761,10 +3140,43 @@ export function createWorkflowSupervisor(bindings) {
         if (spawnContext === null) {
             throw new Error("supervisor: recycle called without a spawn context; spawn() must complete first");
         }
-        recycleInProgress = true;
-        const origin = opts.origin ?? "operator";
-        const prior = state;
-        const priorContext = spawnContext;
+        // The contention read (`respawnInProgress`) stays here in the caller's
+        // precondition zone rather than inside `runRespawn`: an operator double-
+        // recycle is an error and must throw. `runRespawn` sets the latch
+        // synchronously at entry, so this read and that set are never separated
+        // by an await, and no second respawn can interleave between them.
+        return runRespawn({
+            origin: opts.origin ?? "operator",
+            reason: opts.reason,
+            prior: state,
+            priorContext: spawnContext,
+            drain: async (deadlineMs) => {
+                // The recycle path's drain step shares the drain primitive but
+                // bypasses the public surface's `recycling` silent-no-op so the
+                // still-live controlSender (this step runs BEFORE abortPriorCohort
+                // + kill) receives the frame. The public `drain()` silently no-ops
+                // on `recycling` for external callers because the kill/respawn gap
+                // can leave the controlSender dying.
+                await drainImpl({ deadlineMs }, { fromRecycle: true });
+            },
+        });
+    }
+    /**
+     * Shared kill/replay/respawn/install driver. The caller has already
+     * verified the supervisor is `running` with a live spawn context and
+     * snapshotted both as `prior`/`priorContext`; this function transitions
+     * to `recycling`, runs the six-step `triggerRecycle` sequence with the
+     * caller-supplied `drain` step, and swaps in the new cohort via the
+     * inline `installNewChild` callback. The operator/policy/self recycle
+     * path is the sole caller today; the crash-respawn path will call it with
+     * a no-op drain (its child is already dead).
+     */
+    async function runRespawn(args) {
+        // Set synchronously at entry (before any await) so the caller's
+        // contention read and this set cannot be separated by an event-loop
+        // turn; two respawns can never interleave.
+        respawnInProgress = true;
+        const { origin, reason, prior, priorContext, drain } = args;
         // The cohort abort no longer fires up-front. triggerRecycle drives
         // the drain and replay steps against a LIVE cohort first, then
         // invokes `abortPriorCohort` (the callback below) between replay
@@ -1793,6 +3205,7 @@ export function createWorkflowSupervisor(bindings) {
             terminalBroadcaster: prior.terminalBroadcaster,
             dispatchLoop: null,
             replayDone: null,
+            sweepDone: prior.sweepDone,
         };
         let attempt;
         try {
@@ -1808,16 +3221,7 @@ export function createWorkflowSupervisor(bindings) {
                     channelId: prior.channelId,
                     eventPump: prior.eventPump,
                 },
-                drain: async (deadlineMs) => {
-                    // The recycle path's drain step shares the drain
-                    // primitive but bypasses the public surface's `recycling`
-                    // silent-no-op so the still-live controlSender (this
-                    // step runs BEFORE abortPriorCohort + kill) receives the
-                    // frame. The public `drain()` silently no-ops on
-                    // `recycling` for external callers because the
-                    // kill/respawn gap can leave the controlSender dying.
-                    await drainImpl({ deadlineMs }, { fromRecycle: true });
-                },
+                drain,
                 replayProcessingToInbox: async () => {
                     await inboxPrimitives.replayProcessingToInbox(bindings.repoStore, inboxWritePrincipal, bindings.workflowRunRepoId, bindings.deploymentMailAddress);
                 },
@@ -1828,6 +3232,13 @@ export function createWorkflowSupervisor(bindings) {
                     prior.terminalCohortAbort.abort();
                     wakeDispatch();
                 },
+                // Kept inline rather than extracted: this cohort-swap closes over
+                // the supervisor's full mutable cohort state (drainAccumulators,
+                // cohortRunIds, runInputChannels, parkNotifyWaiters, parkGenerations,
+                // rejectCohortAwaiters, spawnContext, plus `prior`/`priorContext`).
+                // A standalone helper would take all of it as parameters for zero
+                // reuse -- the crash-respawn path reaches this callback transitively
+                // through `runRespawn`, so it needs no separate extraction.
                 installNewChild: ({ wiring, credentialsSnapshot, controlIncoming, }) => {
                     // Phase guard: a `shutdown()` that landed during the
                     // kill/respawn gap (between `subprocessSpawner` and this
@@ -1871,7 +3282,11 @@ export function createWorkflowSupervisor(bindings) {
                         accumulator.stop();
                     }
                     drainAccumulators.clear();
-                    // Reject every pending merge round-trip and markConsumed
+                    cohortRunIds.clear();
+                    runInputChannels.clear();
+                    parkNotifyWaiters.clear();
+                    parkGenerations.clear();
+                    // Reject every pending merge round-trip and park-notify
                     // waiter registered against the dying cohort so handler
                     // closures cannot survive the kill/respawn gap. The new
                     // child will re-issue substrate writes through fresh
@@ -1906,7 +3321,14 @@ export function createWorkflowSupervisor(bindings) {
                         terminalBroadcaster: newBroadcaster,
                         dispatchLoop: newDispatchLoop,
                         replayDone: null,
+                        sweepDone: prior.sweepDone,
                     };
+                    // Bump the generation and arm the exit-watcher for the
+                    // respawned child atomically with this running transition, so
+                    // the predecessor's watcher (already stale by generation) never
+                    // drives a spurious respawn and a crash of THIS child is
+                    // classified against the new generation.
+                    armChildForRunning(wiring.handle);
                     // Cache fresh spawn context with the updated spawnedAt
                     // so the policy timer's uptime check resets on recycle.
                     const now = bindings.recyclePolicyNow ?? defaultNow;
@@ -1934,6 +3356,16 @@ export function createWorkflowSupervisor(bindings) {
                     // entries the previous cohort's replayProcessingToInbox
                     // just moved back.
                     wakeDispatch();
+                    // Trigger A on the recycle seam: the respawned child re-parks any
+                    // surviving parked run without re-emitting, and a recycle leaves
+                    // the hub link untouched so the reconnect trigger never fires --
+                    // so re-drive the re-registration here too. Same fire-and-forget
+                    // contract as the spawn seam; the fresh cohort's controlSender is
+                    // in `state` now, and its pump (armed above) routes the response.
+                    void reEmitParkedCorrelations().catch((cause) => {
+                        const message = cause instanceof Error ? cause.message : String(cause);
+                        logger.warn `re-emit of parked correlations on re-establishment failed: ${message}`;
+                    });
                 },
                 onCrash: onChildCrash,
                 // Edge-resolved once at the supervisor factory; recycle bounds
@@ -1945,7 +3377,7 @@ export function createWorkflowSupervisor(bindings) {
                 ...(bindings.recyclePolicyClearTimer !== undefined
                     ? { clearTimer: bindings.recyclePolicyClearTimer }
                     : {}),
-            }, { origin, reason: opts.reason });
+            }, { origin, reason });
             // After the recycle, await the previous cohort's dispatch
             // loop so a teardown coroutine cannot survive past the
             // recycle's return point.
@@ -1963,11 +3395,23 @@ export function createWorkflowSupervisor(bindings) {
             // level shutdown. Tear the prior cohort down through the same
             // path a real shutdown uses so the supervisor reaches a clean
             // `stopped` state, then re-throw so the operator sees the
-            // recycle failure and can redeploy.
+            // failure and can redeploy.
+            //
+            // This teardown-to-`stopped` is shared by both callers, and that is
+            // deliberate. A crash-origin respawn whose spawn/wire/handshake fails
+            // is a broken deploy (a bad binary, unreadable credentials), NOT a
+            // flapping child, so it does NOT feed the crash-loop exit counter and
+            // does NOT reach `crash-looping`; conflating a mechanism failure with
+            // a flap would muddy what that counter means. It reaches `stopped`,
+            // the same terminal a failed operator recycle reaches. (Consequence:
+            // this path leaves no `RunFailed` tombstone, unlike the exit-count
+            // latch; the crash-respawn happy path -- a clean child death whose
+            // respawn succeeds -- is what the crash-loop guard bounds.)
             const message = cause instanceof Error ? cause.message : String(cause);
             logger.error `recycle failed; tearing supervisor down: ${message}`;
             await shutdownInternal({
                 reason: `recycle failed: ${message}`,
+                selfTerminated: true,
             }).catch((shutdownCause) => {
                 const inner = shutdownCause instanceof Error
                     ? shutdownCause.message
@@ -1977,7 +3421,12 @@ export function createWorkflowSupervisor(bindings) {
             throw cause;
         }
         finally {
-            recycleInProgress = false;
+            respawnInProgress = false;
+            // Drain any child exit observed during the respawn. A crash of the
+            // freshly-installed child that raced this respawn's completion was
+            // deferred (respawnInProgress was set); handle it now that the latch
+            // is clear. A pending exit for a superseded generation drops as stale.
+            maybeHandleChildExit();
         }
         return attempt;
     }
@@ -1998,6 +3447,27 @@ export function createWorkflowSupervisor(bindings) {
         if (state.phase !== "running" && state.phase !== "starting") {
             throw new Error(`supervisor: deliverSignal called in phase ${state.phase}; expected starting/running`);
         }
+        // Refresh the run's grant floor on the SAME control channel immediately
+        // before the signal, so a standing ("always") approval resolved for a
+        // parked run lowers the floor for the resumed run's later calls. Ordering
+        // is structural: both frames ride this single seq-ordered FIFO, so the
+        // `grants-updated` is observed by the child ahead of the `signal.deliver`
+        // -- no dependence on hub-side dispatch timing. Best-effort by design; a
+        // failed refresh is non-fatal (the durable file still governs the next
+        // barrier), and it only re-reads that file, so a signal with no standing
+        // approval just re-pushes the unchanged floor.
+        await deliverGrants(opts.runId);
+        // `deliverGrants` awaits a substrate read, yielding the event loop. A
+        // crash/recycle can land in that window and swap `state` (its
+        // `controlSender` then points at the dying child). Re-assert the phase the
+        // pre-await guard checked, so the signal is never written into a recycling
+        // child's closing pipe; the caller retries once the recycle completes. The
+        // phase is read through the full union type because the pre-await guard
+        // control-flow-narrowed `state`, which the yield may have invalidated.
+        const phaseAfterRefresh = state.phase;
+        if (phaseAfterRefresh !== "running" && phaseAfterRefresh !== "starting") {
+            throw new Error(`supervisor: deliverSignal raced a recycle in phase ${phaseAfterRefresh}; expected starting/running`);
+        }
         await state.controlSender.send({
             type: "signal.deliver",
             data: {
@@ -2026,6 +3496,85 @@ export function createWorkflowSupervisor(bindings) {
             },
         });
     }
+    async function deliverCredentials(opts) {
+        // Compute the next mirror first. It must advance regardless of phase so the
+        // NEXT spawn/barrier re-asserts this update: a credential revoked while the
+        // supervisor holds no live child (a crash-loop retry, a recycle transient)
+        // must still be gone when the child (re)starts, not resurrected from the
+        // frozen deploy delivery. This is what makes an offline-revoke reconcile
+        // durable even when it arrives at a supervisor without a running child.
+        const next = mergeCredentialDelivery(currentCredentialDelivery, opts.delivery, opts.revoke);
+        // Send to the live child ONLY in starting/running. Outside those the control
+        // sender points at a dying/absent child, so a frame would buffer behind a
+        // SIGTERM or write into a closed pipe; the mirror advance below is the sole
+        // effect, and the child that eventually spawns is seeded from it. The
+        // supervisor is the single producer of `credentials-updated` frames.
+        if (state.phase === "running" || state.phase === "starting") {
+            await state.controlSender.send({
+                type: "credentials-updated",
+                data: {
+                    delivery: opts.delivery,
+                    ...(opts.revoke !== undefined ? { revoke: opts.revoke } : {}),
+                },
+            });
+        }
+        // Advance the mirror. A throw from `send` above skips this, leaving the
+        // mirror matching the child that never received the frame. A whole-object
+        // swap via the same merge the child applies, so a concurrent reader sees a
+        // coherent object.
+        currentCredentialDelivery = next;
+    }
+    /**
+     * Refresh a live run's grant floor mid-run: re-read this run's durable
+     * `runs/<runId>/grants.json` (via `onRunStart`, the same read the pre-trigger
+     * barrier uses) and push it to the child as a `grants-updated` frame. The
+     * enforcement path for a standing (`scope: "always"`) approval, which lowers
+     * a tool's `ask` to `allow` in that file: the barrier only runs before a
+     * trigger/signal dispatch, so a run already executing (or being resumed
+     * without a fresh barrier) needs this to observe the change now.
+     *
+     * Distinct from `pushRunGrants` on two axes, both deliberate:
+     * - It NEVER synthesizes a `RunFailed`. A refresh for a run whose child is
+     *   not live is normal (the durable file already carries the change and the
+     *   next barrier or respawn re-reads it), so it no-ops (`skipped`) rather
+     *   than failing the run, and a send failure to a live child is logged
+     *   loudly but stays non-fatal (the file still wins at the next barrier).
+     * - It only ever pushes the durable file's contents through `onRunStart`; it
+     *   accepts no caller-supplied grants, so it can only tighten or refresh a
+     *   floor, never inject one a deploy did not approve.
+     */
+    async function deliverGrants(runId) {
+        if (bindings.onRunStart === undefined)
+            return "skipped";
+        if (state.phase !== "running" && state.phase !== "starting") {
+            return "skipped";
+        }
+        try {
+            const snapshot = await bindings.onRunStart({
+                runId,
+                anchorRunId: bindings.anchorRunId,
+            });
+            await state.controlSender.send({
+                type: "grants-updated",
+                data: {
+                    snapshot: {
+                        steps: snapshot.steps.map((s) => ({
+                            stepId: s.stepId,
+                            address: s.address,
+                            grants: [...s.grants],
+                            contentHash: s.contentHash,
+                        })),
+                    },
+                },
+            });
+            return "pushed";
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            logger.error `deliverGrants refresh failed for run ${runId}; the durable grants file still governs the next barrier/respawn: ${message}`;
+            return "skipped";
+        }
+    }
     function getCredentialsSnapshot() {
         if (state.phase === "starting" || state.phase === "running") {
             return state.credentialsSnapshot;
@@ -2040,6 +3589,9 @@ export function createWorkflowSupervisor(bindings) {
         recycle,
         deliverSignal,
         deliverSources,
+        deliverCredentials,
+        deliverGrants,
+        reEmitParkedCorrelations,
         getCredentialsSnapshot,
     };
 }
@@ -2097,71 +3649,6 @@ async function pumpEvents(iter, onInferenceEvent) {
 function defaultInProcessMailAuditRef(messageId, _rawMessage) {
     return { store: "in-process", path: messageId };
 }
-/**
- * Derive a stable message identifier from the raw bytes the bus
- * delivered. The RFC 2822 `Message-ID` header (if present) is the
- * canonical identifier the audit log surfaces as
- * `RunStarted.consumedMessageId`; downstream consumers join inbound
- * mail to workflow-run events on this value, so the header parse must
- * win when the sender emitted one. A message that lacks a
- * `Message-ID` header falls back to a sha256 of the raw bytes so
- * runs originating from non-RFC 2822 transports still receive a
- * deterministic identifier.
- *
- * The parser walks the message until the headers/body separator
- * (`CRLF CRLF` per RFC 2822 §2.1, with the lone-`LF` variant tolerated
- * to match common in-memory senders). Header-field unfolding follows
- * RFC 2822 §2.2.3: a continuation line begins with whitespace and
- * appends to the prior line. Header-name comparison is
- * case-insensitive per RFC 2822 §1.2.2.
- */
-async function deriveMessageId(rawMessage) {
-    const messageIdFromHeader = parseMessageIdHeader(rawMessage);
-    if (messageIdFromHeader !== null) {
-        return messageIdFromHeader;
-    }
-    const digest = await crypto.subtle.digest("SHA-256", 
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- ArrayBuffer-backed at the call site; Web Crypto's BufferSource type rejects Uint8Array<ArrayBufferLike> under TS 5.9 (microsoft/TypeScript#62240)
-    rawMessage);
-    return hexEncode(new Uint8Array(digest));
-}
-function parseMessageIdHeader(rawMessage) {
-    const text = new TextDecoder("utf-8", { fatal: false }).decode(rawMessage);
-    // Headers end at the first blank line. RFC 2822 mandates `CRLF CRLF`
-    // but tolerate `LF LF` for callers that normalize line endings.
-    let headerSection = text;
-    const crlfBoundary = text.indexOf("\r\n\r\n");
-    const lfBoundary = text.indexOf("\n\n");
-    if (crlfBoundary >= 0 && (lfBoundary < 0 || crlfBoundary < lfBoundary)) {
-        headerSection = text.slice(0, crlfBoundary);
-    }
-    else if (lfBoundary >= 0) {
-        headerSection = text.slice(0, lfBoundary);
-    }
-    // Unfold continuation lines (a line starting with WSP belongs to
-    // the prior header field).
-    const lines = headerSection.split(/\r?\n/);
-    const unfolded = [];
-    for (const line of lines) {
-        if (line.length > 0 && (line[0] === " " || line[0] === "\t")) {
-            if (unfolded.length === 0)
-                continue;
-            unfolded[unfolded.length - 1] += " " + line.trim();
-            continue;
-        }
-        unfolded.push(line);
-    }
-    for (const line of unfolded) {
-        const colon = line.indexOf(":");
-        if (colon < 0)
-            continue;
-        const name = line.slice(0, colon).trim().toLowerCase();
-        if (name !== "message-id")
-            continue;
-        return line.slice(colon + 1).trim();
-    }
-    return null;
-}
 /**
  * Project the wire shape of a `terminal.event` upstream control frame
  * into the workflow-vocabulary `TerminalRunEvent` discriminated union
@@ -2220,6 +3707,8 @@ function outboundMessageFromPayload(payload) {
         message.summary = payload.summary;
     if (payload.inReplyTo !== undefined)
         message.inReplyTo = payload.inReplyTo;
+    if (payload.references !== undefined)
+        message.references = payload.references;
     if (payload.correlationId !== undefined) {
         message.correlationId = payload.correlationId;
     }