@lostgradient/weft 0.20.0 → 0.22.0

package/dist/core/engine/attributes-tags.js

@@ -10,7 +10,8 @@ import { assertWorkflowTagCount, coerceStartWorkflowTags } from "../start-workfl
 import { buildWorkflowTagIndexOperations, normalizeWorkflowTags } from "../workflow-tags.js";
 import { WorkflowNotFoundError } from "./errors.js";
 import {
-  commitFencedWorkflowStateOperations,
+  commitExternalTerminalWorkflowStateOperations,
+  commitSelfWorkflowStateOperations,
   runSerializedWorkflowStateWrite
 } from "./storage-io.js";
 import {
@@ -63,7 +64,7 @@ export function buildTerminalWorkflowIndexOperations(previousState, nextState) {
     });
   return operations;
 }
-export async function updateWorkflowState(internals, workflowId, updates, options = {}) {
+export async function updateWorkflowState(internals, workflowId, updates, category, options = {}) {
   return await runSerializedWorkflowStateWrite(internals, workflowId, async () => {
     const bytes = await internals.storage.get(KEYS.workflow(workflowId));
     if (!bytes)
@@ -76,7 +77,7 @@ export async function updateWorkflowState(internals, workflowId, updates, option
       ...updates,
       updatedAt
     }, additionalOperations = options.buildAdditionalOperations?.(state, updatedAt) ?? [];
-    await commitFencedWorkflowStateOperations(internals, state, [
+    await (category === "self" ? commitSelfWorkflowStateOperations : commitExternalTerminalWorkflowStateOperations)(internals, state, [
       ...buildTerminalWorkflowIndexOperations(state, updated),
       { type: "put", key: KEYS.workflow(workflowId), value: encode(updated) },
       ...buildWorkflowVisibilityIndexTransition(workflowId, state, updated).batchOps,

package/dist/core/engine/bulk-operations-purge.js

@@ -14,6 +14,7 @@ import { commitFencedEngineWrite } from "./fenced-write.js";
 import { streamWorkflowStates } from "./listing.js";
 import { decodeScheduleRunMetadata } from "./schedule-run-metadata.js";
 import { createTerminalCleanupTimerId } from "./state-utilities.js";
+import { buildExternalTerminalRotationFragment } from "./storage-io.js";
 import {
   decodeWorkflowState,
   isTerminalWorkflowStatus,
@@ -132,8 +133,10 @@ function getWorkflowRetentionDeadline(internals, state) {
   return state.updatedAt + retentionMs;
 }
 export async function purgeWorkflow(internals, state, cleanupWaiters) {
-  const deleteOperations = await collectWorkflowPurgeDeleteOperations(internals, state);
-  await commitFencedEngineWrite(internals, deleteOperations, [], () => Error(`Purge commit for workflow "${state.id}" lost its precondition.`));
+  const deleteOperations = await collectWorkflowPurgeDeleteOperations(internals, state), rotation = await buildExternalTerminalRotationFragment(internals, state.id), operations = [...deleteOperations, ...rotation.operations];
+  await commitFencedEngineWrite(internals, null, operations, rotation.conditions, () => {
+    return Error(`Purge commit for workflow "${state.id}" lost its precondition.`);
+  });
   clearPurgedWorkflowInMemoryState(internals, state.id, cleanupWaiters);
 }
 export async function collectWorkflowPurgeDeleteOperations(internals, state) {

package/dist/core/engine/bulk-operations.js

@@ -31,6 +31,11 @@ import { BULK_OPERATION_BATCH_SIZE } from "./listing.js";
 import { createTerminalCleanupTimerId } from "./state-utilities.js";
 import { loadWorkflowState, runSerializedWorkflowStateWrite } from "./storage-io.js";
 import { decodeWorkflowState, isTerminalWorkflowStatus } from "./validation.js";
+import {
+  commitWithWorkflowClaimFold,
+  prepareWorkflowClaimFold,
+  throwWorkflowClaimUnavailable
+} from "./workflow-claim-fold.js";
 import { buildWorkflowConcurrencyStartOperations } from "./workflow-concurrency.js";
 import { buildWorkflowVisibilityIndexTransition } from "./workflow-indexes.js";
 export { purgeInternal, TERMINAL_CLEANUP_DELAY_MS } from "./bulk-operations-purge.js";
@@ -171,17 +176,24 @@ async function reactivateFailedWorkflowFromCheckpointSerialized(internals, workf
       }),
       ...concurrencyStartOperations?.operations ?? []
     ], conditions = concurrencyStartOperations?.conditions ?? [];
-    if (await commitFailedWorkflowReactivation(internals, operations, conditions))
+    if (await commitFailedWorkflowReactivation(internals, workflowId, operations, conditions))
       return {
         terminalCleanupTimerId: currentState.terminalCleanupToken === void 0 ? void 0 : createTerminalCleanupTimerId(!1, currentState.terminalCleanupToken)
       };
   }
   throw Error(`Workflow concurrency admission for "${lastConcurrencyStateKey ?? workflowId}" changed too many times while retrying failed workflow "${workflowId}"`);
 }
-async function commitFailedWorkflowReactivation(internals, operations, conditions) {
-  if (conditions.length > 0)
-    requireStorageCapability(internals.storage, "conditionalBatch", "retry failed workflow");
-  return commitFencedEngineWriteAllowingPreconditionFailure(internals, operations, conditions);
+async function commitFailedWorkflowReactivation(internals, workflowId, operations, conditions) {
+  const claimFold = await prepareWorkflowClaimFold(internals, workflowId);
+  if (claimFold === void 0) {
+    if (conditions.length > 0)
+      requireStorageCapability(internals.storage, "conditionalBatch", "retry failed workflow");
+    return commitFencedEngineWriteAllowingPreconditionFailure(internals, workflowId, operations, conditions);
+  }
+  const result = await commitWithWorkflowClaimFold(internals, claimFold, operations, conditions, "retry failed workflow claim acquisition");
+  if (result.status === "committed")
+    return !0;
+  return result.claimConflict ? throwWorkflowClaimUnavailable(internals, workflowId) : !1;
 }
 function buildReactivatedWorkflowState(internals, state) {
   const reactivatedState = {

package/dist/core/engine/callback-creators-bundles.js

@@ -154,7 +154,7 @@ export function createUpdateCallbacks(engine) {
 async function persistCoordinatedUpdateResponse(engine, workflowId, updateName, updateId, idempotencyKey, value) {
   const internals = getInternals(engine), responseOperations = internals.updateCoordinator.buildResponseOperations(updateId, workflowId, value, void 0, idempotencyKey);
   try {
-    await commitFencedEngineWrite(internals, responseOperations, [], () => Error(`Coordinated update response for workflow "${workflowId}" lost its CAS race.`));
+    await commitFencedEngineWrite(internals, workflowId, responseOperations, [], () => Error(`Coordinated update response for workflow "${workflowId}" lost its CAS race.`));
     engine.dispatchEvent(new UpdateCompletedEvent(updateId, workflowId, updateName, value));
     broadcastFromInternals(internals, { type: "update:completed", workflowId, updateId }, createBroadcastCallbacks(engine));
   } catch (error) {

package/dist/core/engine/callback-creators-core.js

@@ -18,7 +18,8 @@ import {
 import { resolveWorkflowTypeTarget } from "./registration.js";
 import { cleanupReviews } from "./reviews.js";
 import {
-  commitFencedWorkflowStateOperations,
+  commitExternalTerminalWorkflowStateOperations,
+  commitSelfWorkflowStateOperations,
   loadWorkflowState,
   runSerializedWorkflowStateWrite
 } from "./storage-io.js";
@@ -94,7 +95,8 @@ export function createTerminationCallbacksWith(engine, handleScheduledWorkflowTe
     handleScheduledWorkflowTerminal,
     loadWorkflowState: (workflowId) => loadWorkflowState(getInternals(engine), workflowId),
     runSerializedWorkflowStateWrite: (workflowId, writeOperation) => runSerializedWorkflowStateWrite(getInternals(engine), workflowId, writeOperation),
-    commitWorkflowStateOperations: (state, operations, options) => commitFencedWorkflowStateOperations(getInternals(engine), state, operations, options),
+    commitSelfWorkflowStateOperations: (state, operations, options) => commitSelfWorkflowStateOperations(getInternals(engine), state, operations, options),
+    commitExternalTerminalWorkflowStateOperations: (state, operations, options) => commitExternalTerminalWorkflowStateOperations(getInternals(engine), state, operations, options),
     cleanupReviews: (workflowId) => cleanupReviews(getInternals(engine), workflowId)
   };
 }

package/dist/core/engine/checkpoint-io.js

@@ -122,7 +122,7 @@ async function commitCheckpoint(internals, workflowId, operation, commit, callba
   if (pendingSideEffects !== void 0)
     commit.operations.push(...pendingSideEffects.operations);
   const storageSupportsConditionalBatch = internals.storage.capabilities().conditionalBatch, sideEffectConditions = checkpointSideEffectConditions(pendingSideEffects, storageSupportsConditionalBatch), conditions = buildCheckpointCommitConditions(workflowId, commit, storageSupportsConditionalBatch, sideEffectConditions);
-  await commitFencedEngineWrite(internals, commit.operations, conditions, () => {
+  await commitFencedEngineWrite(internals, workflowId, commit.operations, conditions, () => {
     return Error(`Checkpoint commit for workflow "${workflowId}" lost its CAS race against a newer checkpoint.`);
   });
   if (pendingSideEffects !== void 0)

package/dist/core/engine/child-workflow.js

@@ -5,6 +5,7 @@ import {
   registerChildCancellationHandler
 } from "./child-workflow-cancellation.js";
 import { WorkflowAlreadyExistsError } from "./errors.js";
+import { getGeneratorOwnedWorkflowResultPromise } from "./handle-result.js";
 import { encodedValuesEqual } from "./state-utilities.js";
 export async function processChildWorkflowOperation(internals, workflowId, operation, callbacks) {
   return callbacks.runOperationWithResult(workflowId, operation, () => executeChildWorkflow(internals, workflowId, operation, assertChildWorkflowNestingDepth(internals, workflowId), callbacks));
@@ -83,7 +84,7 @@ export async function executeChildWorkflow(internals, workflowId, operation, cur
       registerChildCancellationHandler(internals, workflowId, childHandle.id, callbacks);
       return createChildWorkflowHandleReference(childHandle.id);
     }
-    return childHandle.result();
+    return getGeneratorOwnedWorkflowResultPromise(internals, childHandle.id, workflowId);
   }, composedInterceptor = callbacks.getComposedWorkflowInterceptor();
   if (!composedInterceptor)
     return executeChild();

package/dist/core/engine/completed-review-storage.js

@@ -35,7 +35,7 @@ export async function listCompletedReviewsFromStorage(storage, filter) {
 }
 export async function persistCompletedReviewRecord(internals, reviewKey, reviewData, decisionResult) {
   const completedReview = toCompletedReviewEntry(reviewData, decisionResult);
-  await commitFencedEngineWrite(internals, [
+  await commitFencedEngineWrite(internals, reviewData.workflowId, [
     {
       type: "put",
       key: completedReviewStorageKey(reviewData.workflowId, reviewData.reviewId),

package/dist/core/engine/condition-waiters.d.ts

@@ -1,14 +1,56 @@
 import type { EngineInternals } from './internals.ts';
+import { type WakeOwnershipDecision } from './wake-ownership-guard.ts';
 /**
  * Re-drive every in-process `ctx.waitUntil` waiter registered for a workflow.
- * Called after an inline `onUpdate` handler runs (`tryInlineUpdateHandler`),
- * since the handler may have mutated the workflow-local state a predicate reads.
- * Each call wakes the parked `processWaitConditionOperation`, which re-evaluates
+ * Called after an inline `onUpdate` handler runs (`tryInlineUpdateHandler`) —
+ * since the handler may have mutated the workflow-local state a predicate
+ * reads. Wakes the parked `processWaitConditionOperation`, which re-evaluates
  * its predicate against the (possibly mutated) state.
  *
  * Weft signals are pull-only (`ctx.waitForSignal`) and run no state-mutating
  * handler, so signal delivery is intentionally NOT a re-drive trigger — `onUpdate`
  * is the push path. Lives in its own module so `updates.ts` can call it without
  * an import cycle through `operations-coordination.ts`.
+ *
+ * **`wakeOwnershipCheck` under `ownership: 'workflow-lease'`.** This is a
+ * claim-requiring wake site (ADR 0002's `wait-condition` kind): resolving
+ * `conditionWaiters` drives a parked generator turn. This function's only
+ * remaining callers — `updates.ts` and `pending-updates.ts` — invoke it from
+ * an `onUpdate` handler with no associated durable timer to protect, so they
+ * call it synchronously with no `await` and must stay that way: this
+ * function's signature stays `void`, never `Promise<void>`, so neither
+ * becomes a floating-promise lint violation. Under `'none'`/`'lease'`
+ * (`workflowClaimRegistry === null`) the resolver is looked up and called
+ * synchronously — byte-identical to before this check existed. Under
+ * `'workflow-lease'` the ownership re-read runs as a fire-and-forget async
+ * check, and the resolver is looked up fresh (never captured before the
+ * await) once that check settles, so a newer waiter registered in the
+ * meantime is never resolved by a stale reference.
+ *
+ * The durable-timer-driven wake (a `wait-condition` deadline timer firing)
+ * does NOT use this function — see {@link notifyConditionWaitersForTimerFire}
+ * below. That caller feeds directly into the `Scheduler`'s "was this fire
+ * processed" decision, so it cannot be fire-and-forget the way an
+ * `onUpdate`-driven poke safely can.
  */
 export declare function notifyConditionWaiters(internals: EngineInternals, workflowId: string): void;
+/**
+ * Timer-driven counterpart to {@link notifyConditionWaiters}, used only by
+ * `operations-time.ts`'s `resolveConditionTimer` when a durable
+ * `ctx.waitUntil()` deadline timer fires under `ownership: 'workflow-lease'`.
+ *
+ * Unlike the `onUpdate`-driven path above, this caller feeds directly into
+ * the `Scheduler`'s `#processSelectedTimer`: once the returned promise
+ * settles, the caller decides whether the Scheduler may treat this fire as
+ * "processed" and durably delete the timer key. A fire-and-forget check here
+ * (mirroring `notifyConditionWaiters`'s `'workflow-lease'` branch) would let
+ * the Scheduler delete the timer before the ownership decision — and, on a
+ * `'proceed'`, the wake dispatch itself — has actually happened, stranding a
+ * parked workflow with no deterministic timeout record if the process exits
+ * or disposes in that window. So this returns the raw {@link
+ * WakeOwnershipDecision} instead of swallowing it: the caller uses a
+ * `'discard'` to decide retain-vs-collect via
+ * `sleep-timer-acknowledgements.ts`'s `resolveDiscardedTimerDisposition`,
+ * the same disposal policy the `sleep` wake kind shares this hazard with.
+ */
+export declare function notifyConditionWaitersForTimerFire(internals: EngineInternals, workflowId: string): Promise<WakeOwnershipDecision>;

package/dist/core/engine/condition-waiters.js

@@ -1,5 +1,14 @@
+import { confirmWakeOwnership } from "./wake-ownership-guard.js";
 export function notifyConditionWaiters(internals, workflowId) {
-  const resolve = internals.conditionWaiters.get(workflowId);
-  if (resolve)
-    resolve();
+  if (internals.workflowClaimRegistry === null) {
+    internals.conditionWaiters.get(workflowId)?.();
+    return;
+  }
+  confirmWakeOwnership(internals, workflowId, "wait-condition").then((decision) => decision === "proceed" ? internals.conditionWaiters.get(workflowId)?.() : void 0);
+}
+export async function notifyConditionWaitersForTimerFire(internals, workflowId) {
+  const decision = await confirmWakeOwnership(internals, workflowId, "wait-condition");
+  if (decision === "proceed")
+    internals.conditionWaiters.get(workflowId)?.();
+  return decision;
 }

package/dist/core/engine/disposal.js

@@ -8,6 +8,11 @@ function settleSleepResolverReadyWaitersForTesting(internals) {
       notifyReady();
   internals.sleepResolverReadyWaitersForTesting?.clear();
 }
+function clearPendingResultPollTimers(internals) {
+  for (const timer of internals.pendingResultPollTimers)
+    clearTimeout(timer);
+  internals.pendingResultPollTimers.clear();
+}
 export function disposeEngine(internals) {
   internals.disposed = !0;
   internals.alertManager?.[Symbol.dispose]();
@@ -52,6 +57,7 @@ export function disposeEngine(internals) {
   for (const controller of internals.pendingWebhooks)
     controller.abort();
   internals.pendingWebhooks.clear();
+  clearPendingResultPollTimers(internals);
   internals.sleepResolvers.clear();
   internals.sleepResolversByWorkflow.clear();
   settleSleepResolverReadyWaitersForTesting(internals);

package/dist/core/engine/engine-internal-types.d.ts

@@ -46,17 +46,25 @@ export interface ResolvedOptions {
     /** Heartbeat interval (ms) for the second-instance detector when enabled. */
     secondInstanceHeartbeatIntervalMs: number;
     /**
-     * Single-writer ownership posture. `'none'` recovers immediately (infra owns
-     * mutual exclusion); `'lease'` acquires a storage lease before recovery. The
-     * lease tuning fields below are only meaningful when this is `'lease'`.
+     * Ownership posture. `'none'` recovers immediately (infra owns mutual
+     * exclusion); `'lease'` acquires a single store-wide storage lease before
+     * recovery; `'workflow-lease'` fences execution per workflow instead
+     * (ADR 0002), letting multiple engines share one durable store. The lease
+     * tuning fields below are only meaningful when this is `'lease'`; the
+     * workflow-claim tuning fields are only meaningful when this is
+     * `'workflow-lease'`.
      */
-    ownershipMode: 'none' | 'lease';
+    ownershipMode: 'none' | 'lease' | 'workflow-lease';
     /** Lease time-to-live (ms) when `ownershipMode` is `'lease'`. */
     leaseTtlMs: number;
     /** Lease renewal interval (ms) when `ownershipMode` is `'lease'`. */
     leaseRenewIntervalMs: number;
     /** Boot-time lease acquisition wait window (ms) when `ownershipMode` is `'lease'`. */
     leaseWaitTimeoutMs: number;
+    /** Per-workflow claim time-to-live (ms) when `ownershipMode` is `'workflow-lease'`. */
+    workflowClaimTtlMs: number;
+    /** Per-workflow claim renewal interval (ms) when `ownershipMode` is `'workflow-lease'`. */
+    workflowClaimRenewIntervalMs: number;
     getNow: () => number;
     /**
      * Re-provides the non-serialized per-run `services` value on recovery; `null`

package/dist/core/engine/fenced-write.d.ts

@@ -1,5 +1,6 @@
 /**
- * Step-2 epoch fencing for `ownership: 'lease'` (issue #470).
+ * Step-2 epoch fencing for `ownership: 'lease'` (issue #470), extended by ADR
+ * 0002 to per-workflow fencing under `ownership: 'workflow-lease'`.
  *
  * Step 1 made a rolling deploy a clean lease handoff but added no correctness
  * backstop: a deposed zombie instance (GC pause, partition) that emerged after
@@ -15,6 +16,20 @@
  * from silently spinning on swallowed write losses, surface the deposition to the
  * operator, and release resources. They are not what makes the system safe.
  *
+ * ADR 0002 adds a SECOND, independent fencing token: `wf-owner-epoch:<workflowId>`.
+ * Every caller of {@link commitFencedEngineWrite} / {@link
+ * commitFencedEngineWriteAllowingPreconditionFailure} now states, via the
+ * required `workflowId` parameter, whether the write is scoped to one
+ * workflow's execution (pass its id) or is engine-scoped/cross-workflow (pass
+ * `null`) — an optional parameter would let a call site silently forget the
+ * fence, which is exactly the correctness hole this mechanism exists to close.
+ * Under `ownership: 'workflow-lease'` with a non-null `workflowId`, the write
+ * is fenced on THAT workflow's claim epoch instead of the global lease epoch;
+ * losing that fence deposes only that one workflow (warn + throw), never the
+ * whole engine. Under `'lease'` and `'none'`, and under `'workflow-lease'`
+ * with `workflowId: null`, behavior is byte-for-byte unchanged from Step 2 —
+ * `workflowId` is only consulted in the one new branch.
+ *
  * This module is allow-listed for import only from `src/core/engine/**`.
  */
 import type { BatchOperation, ConditionalBatchCondition } from '../../storage/interface.ts';
@@ -31,37 +46,53 @@ import type { EngineInternals } from './internals.ts';
  * `pauseSchedule`, `resumeSchedule`, `cancelSchedule`, and `updateSchedule`) would
  * reach `resolveFenceEpochOrHalt` with no held epoch and be misreported as a
  * deposition (warn + teardown) rather than the true "lease not held yet"
- * condition. A no-op under `ownership: 'none'`.
+ * condition. A no-op under `ownership: 'none'` and under `ownership:
+ * 'workflow-lease'` — the analogous "claim not held yet" guard for a
+ * workflow-scoped write is a later stage's concern (folding `acquire()` into
+ * the enabling write), not this global-lease-only assertion.
  */
 export declare function assertLeaseHeldForEngineWork(internals: EngineInternals): void;
 /**
- * Commit an engine-generator-owned durable write, fenced on the held lease epoch
- * under `ownership: 'lease'` (a byte-for-byte no-op under `ownership: 'none'`). A
- * lost CAS race throws the caller-supplied `onLostRace` error so existing retry
- * semantics apply; a deposition halts the engine and throws
- * {@link EngineDeposedError}. The helper owns the batch-vs-conditionalBatch
- * decision — pass plain operations plus whatever base conditions you already need.
+ * Commit an engine-generator-owned durable write, fenced on the applicable
+ * epoch: the global lease epoch under `ownership: 'lease'`, this workflow's
+ * claim epoch under `ownership: 'workflow-lease'` when `workflowId` is
+ * non-null, or — under `'none'` and every other `workflowId`/mode
+ * combination — byte-for-byte unfenced. A lost CAS race throws the
+ * caller-supplied `onLostRace` error so existing retry semantics apply; a
+ * deposition halts (the engine under global `'lease'`, or just this one
+ * workflow under `'workflow-lease'`) and throws {@link EngineDeposedError}.
+ * The helper owns the batch-vs-conditionalBatch decision — pass plain
+ * operations plus whatever base conditions you already need.
  *
- * @param internals - the engine internals (ownership mode, lease manager, deposed flag)
+ * @param internals - the engine internals (ownership mode, lease manager,
+ *   workflow claim registry, deposed flag)
+ * @param workflowId - the workflow this write is scoped to, fenced on that
+ *   workflow's claim epoch under `ownership: 'workflow-lease'`; or `null` for
+ *   an engine-scoped/cross-workflow write, which is never fenced on a
+ *   per-workflow claim regardless of ownership mode. Required — there is no
+ *   default — so every call site states its scope explicitly.
  * @param operations - the durable operations to commit atomically
  * @param baseConditions - CAS conditions the caller already requires (may be empty)
  * @param onLostRace - builds the error thrown on a same-epoch lost CAS race
  */
-export declare function commitFencedEngineWrite(internals: EngineInternals, operations: BatchOperation[], baseConditions: ConditionalBatchCondition[], onLostRace: () => Error): Promise<void>;
+export declare function commitFencedEngineWrite(internals: EngineInternals, workflowId: string | null, operations: BatchOperation[], baseConditions: ConditionalBatchCondition[], onLostRace: () => Error): Promise<void>;
 /**
  * Like {@link commitFencedEngineWrite}, but the caller treats a base-precondition
  * failure as a legitimate outcome rather than an error — used by the idempotent
  * start path, where a `false` means a concurrent same-key caller already wrote the
  * record (resolve to the existing run) rather than "retry". Returns `true` when the
  * batch committed and `false` when a base condition failed. Deposition is still a
- * hard halt: if the epoch condition is the one that failed, this drives
- * {@link handleDeposition} and throws {@link EngineDeposedError} — a deposed engine
- * must never report a precondition-failure the caller would read as "already exists"
- * and silently move on.
+ * hard halt: if the epoch condition is the one that failed, this drives the
+ * applicable deposition path and throws {@link EngineDeposedError} — a deposed
+ * engine (or a deposed single workflow, under `workflow-lease`) must never report a
+ * precondition-failure the caller would read as "already exists" and silently
+ * move on.
  *
  * @param internals - the engine internals
+ * @param workflowId - see {@link commitFencedEngineWrite} — the workflow this
+ *   write is scoped to, or `null` for an engine-scoped write
  * @param operations - the durable operations to commit atomically
  * @param baseConditions - the caller's required CAS conditions (non-empty in
  *   practice — this path is for conditional starts, which always carry one)
  */
-export declare function commitFencedEngineWriteAllowingPreconditionFailure(internals: EngineInternals, operations: BatchOperation[], baseConditions: ConditionalBatchCondition[]): Promise<boolean>;
+export declare function commitFencedEngineWriteAllowingPreconditionFailure(internals: EngineInternals, workflowId: string | null, operations: BatchOperation[], baseConditions: ConditionalBatchCondition[]): Promise<boolean>;

package/dist/core/engine/fenced-write.js

@@ -1,6 +1,6 @@
 import { KEYS, storageConditionalBatch } from "../../storage/interface.js";
 import { decodeEpoch } from "./lease-codec.js";
-import { handleDeposition } from "./lease-deposition.js";
+import { emitWorkflowClaimLostWarning, handleDeposition } from "./lease-deposition.js";
 import { EngineDeposedError, EngineLeaseNotHeldError } from "./lease-errors.js";
 export function assertLeaseHeldForEngineWork(internals) {
   if (internals.options.ownershipMode !== "lease")
@@ -8,7 +8,9 @@ export function assertLeaseHeldForEngineWork(internals) {
   if (!(!internals.deposed && internals.leaseManager !== null && internals.leaseManager.currentEpochBytes() !== null))
     throw new EngineLeaseNotHeldError;
 }
-async function fencedCommit(internals, operations, baseConditions) {
+async function fencedCommit(internals, workflowId, operations, baseConditions) {
+  if (internals.options.ownershipMode === "workflow-lease" && workflowId !== null)
+    return fencedCommitForWorkflow(internals, workflowId, operations, baseConditions);
   const epochBytes = resolveFenceEpochOrHalt(internals);
   if (epochBytes === null) {
     if (baseConditions.length === 0) {
@@ -41,12 +43,30 @@ function resolveFenceEpochOrHalt(internals) {
   }
   return epochBytes;
 }
-export async function commitFencedEngineWrite(internals, operations, baseConditions, onLostRace) {
-  if (await fencedCommit(internals, operations, baseConditions) === "lost-race")
+async function fencedCommitForWorkflow(internals, workflowId, operations, baseConditions) {
+  const epochBytes = internals.workflowClaimRegistry?.currentEpochBytes(workflowId) ?? null;
+  if (epochBytes === null)
+    haltWorkflowClaim(workflowId);
+  const conditions = [
+    ...baseConditions,
+    { key: KEYS.workflowOwnerEpoch(workflowId), expectedValue: epochBytes }
+  ];
+  if (await storageConditionalBatch(internals.storage, conditions, operations))
+    return "committed";
+  if (await isWorkflowDeposed(internals, workflowId, epochBytes))
+    haltWorkflowClaim(workflowId);
+  return "lost-race";
+}
+function haltWorkflowClaim(workflowId) {
+  emitWorkflowClaimLostWarning(workflowId);
+  throw new EngineDeposedError(workflowId);
+}
+export async function commitFencedEngineWrite(internals, workflowId, operations, baseConditions, onLostRace) {
+  if (await fencedCommit(internals, workflowId, operations, baseConditions) === "lost-race")
     throw onLostRace();
 }
-export async function commitFencedEngineWriteAllowingPreconditionFailure(internals, operations, baseConditions) {
-  return await fencedCommit(internals, operations, baseConditions) === "committed";
+export async function commitFencedEngineWriteAllowingPreconditionFailure(internals, workflowId, operations, baseConditions) {
+  return await fencedCommit(internals, workflowId, operations, baseConditions) === "committed";
 }
 function epochBytesEqual(a, b) {
   if (b === null || a.byteLength !== b.byteLength)
@@ -69,3 +89,16 @@ async function isDeposed(internals, heldEpochBytes) {
     return !0;
   return !epochBytesEqual(heldEpochBytes, currentEpochRaw);
 }
+async function isWorkflowDeposed(internals, workflowId, heldEpochBytes) {
+  let currentEpochRaw;
+  try {
+    currentEpochRaw = await internals.storage.get(KEYS.workflowOwnerEpoch(workflowId));
+  } catch {
+    return !0;
+  }
+  if (currentEpochRaw === null)
+    return !0;
+  if (decodeEpoch(currentEpochRaw) === null)
+    return !0;
+  return !epochBytesEqual(heldEpochBytes, currentEpochRaw);
+}

package/dist/core/engine/finalizer-state.d.ts

@@ -16,7 +16,9 @@ import type { EngineInternals } from './internals.ts';
  * the next checkpoint still flushes the staged op in the terminal batch, so the
  * finalizer always sees the resource id. The staged op inherits the lease-epoch
  * fence (#470) for free, since checkpoint and terminal commits route through
- * `commitFencedWorkflowStateOperations`.
+ * `commitSelfWorkflowStateOperations` (completion) or
+ * `commitExternalTerminalWorkflowStateOperations` (cancel/timeout/suspend —
+ * ADR 0002), both in `storage-io.ts`.
  *
  * Oversized payloads are rejected before staging (the same hostile-input guard
  * activity results use). A call made once the workflow is already terminalizing

package/dist/core/engine/handle-result.d.ts

@@ -4,5 +4,53 @@ import type { EngineInternals } from './internals.ts';
 export declare function createWorkflowHandleWithResultPromise(internals: EngineInternals, workflowId: string): WorkflowHandle;
 export declare function createWorkflowResultWaiter(internals: EngineInternals, workflowId: string): WorkflowResultWaiter;
 export declare function getWorkflowResultPromise(internals: EngineInternals, workflowId: string): Promise<unknown>;
-export declare function bootstrapWorkflowResultResolver(internals: EngineInternals, workflowId: string, waiter: WorkflowResultWaiter): Promise<void>;
+/**
+ * Result promise for a parent generator parked on `ctx.startChild()`'s
+ * default `parentClosePolicy: 'await'` — the ONLY intended caller (see
+ * `child-workflow.ts`'s `executeChildWorkflow`, which must call this instead
+ * of the plain `childHandle.result()` / `handle.result()` path). Identical to
+ * {@link getWorkflowResultPromise} except the waiter this settles is marked
+ * generator-owned for `parentWorkflowId`: under `ownership: 'workflow-lease'`
+ * a settle attempt first confirms `parentWorkflowId` still holds the claim
+ * generation it parked under (`confirmWakeOwnership`, `'child-completion'`),
+ * fencing duplicate generator advancement (WFT-79 F1) — see
+ * {@link bootstrapWorkflowResultResolver}. Top-level, non-generator callers
+ * must keep using {@link getWorkflowResultPromise}, which stays unfenced by
+ * design: cross-engine `handle.result()` polling has no generator to
+ * duplicate and must remain settleable from durable state alone.
+ *
+ * If `internals.resultResolvers` already holds a waiter for `workflowId` —
+ * e.g. an observational `handle.result()` caller got there first — that
+ * SHARED waiter is untouched: {@link fenceResultOnParentGeneration} wraps
+ * only THIS caller's derived promise, so the observational caller's own
+ * promise settles normally from the shared waiter regardless of the parent's
+ * claim generation. See that function's doc for why fencing lives on the
+ * parent's view instead of the shared waiter itself.
+ */
+export declare function getGeneratorOwnedWorkflowResultPromise(internals: EngineInternals, workflowId: string, parentWorkflowId: string): Promise<unknown>;
+/**
+ * Settle result waiters for workflows this engine does not own, whose terminal
+ * transition lands on another engine and so never touches this engine's
+ * in-memory resolver map.
+ *
+ * Exported for `backgroundTasks: 'manual'`, where no timer runs and the host
+ * drives every background step through an awaited `runMaintenance()`.
+ */
+export declare function pollPendingCrossEngineResultWaiters(internals: EngineInternals): Promise<void>;
+/**
+ * Outcome of one {@link bootstrapWorkflowResultResolver} attempt, used by
+ * this file's callers to decide whether to keep polling:
+ *
+ * - `'settled'`: the waiter was resolved or rejected.
+ * - `'pending'`: no terminal result yet (still running, or a transient read
+ *   failure under a guaranteed-retry ownership mode). Keep polling.
+ *
+ * A generator-owned caller's discarded parent generation needs no outcome
+ * here at all: `fenceResultOnParentGeneration` withholds settlement on that
+ * caller's own derived promise, independent of whether the SHARED waiter
+ * this function settles ever resolves.
+ */
+type ResultResolutionOutcome = 'settled' | 'pending';
+export declare function bootstrapWorkflowResultResolver(internals: EngineInternals, workflowId: string, waiter: WorkflowResultWaiter): Promise<ResultResolutionOutcome>;
 export declare function cacheHandle(internals: EngineInternals, workflowId: string, handle: WorkflowHandle): void;
+export {};