@makaio/framework 1.0.0-dev-1788258714339 → 1.0.0-dev-1788721567504

package/dist/{execution-attempt-repository-BJ2W6wwx.d.mts → execution-attempt-repository-CRdrgou3.d.mts}

@@ -1,5 +1,5 @@
 import { a as ProviderOperationClaim, i as ProcessBoundProvisionerLossProof, l as ProviderOperationOwnershipRecord, o as ProviderOperationClaimDecision, s as ProviderOperationMutationDecision } from "./provider-operation-DbdyFwNm.mjs";
-import { BoundedRecoveryEvidence, ProviderAllocationRef, WorkerNodeAllocationLifetime, WorkflowRunResult } from "@makaio/framework/contracts";
+import { BoundedRecoveryEvidence, ExecutionAttemptOperationKind, ProviderAllocationRef, WorkerAllocationLifetime } from "@makaio/framework/contracts";
 
 //#region subsystems/workflow-engine/src/execution-attempt-repository.d.ts
 /**
@@ -28,9 +28,9 @@ declare const EXECUTION_ATTEMPT_SETTLEMENT_KINDS: readonly ["outcome", "abandone
 /**
  * How a settled attempt reached its terminal state.
  *
- * - `outcome`: a worker submitted a workflow result that was accepted.
+ * - `outcome`: a worker submitted an outcome that was accepted.
  * - `infrastructure-failure`: the provider allocation terminated without
- *   an acknowledged worker outcome. The workflow run may be retried.
+ *   an acknowledged worker outcome. The owner may retry the work.
  * - `abandoned`: dispatch ended before allocation, including a positively
  *   proven absence recorded through
  *   {@link ExecutionAttemptRepository.recordProvisioningAbsent} or a
@@ -40,6 +40,25 @@ declare const EXECUTION_ATTEMPT_SETTLEMENT_KINDS: readonly ["outcome", "abandone
  * `null` when the attempt has not yet settled.
  */
 type ExecutionAttemptSettlementKind = (typeof EXECUTION_ATTEMPT_SETTLEMENT_KINDS)[number] | null;
+/**
+ * Constant array of every state the attempt's operation start gate can hold.
+ *
+ * Declared as an array for the same reason the status vocabulary is: a stored
+ * value outside it is corruption, and a realization narrows what it read
+ * against this list rather than against a literal of its own.
+ */
+declare const ATTEMPT_OPERATION_START_GATES: readonly ["open", "closed"];
+/**
+ * State of the single durable ordering point an attempt admits operations
+ * through.
+ *
+ * - `open`: the attempt may still admit operations, subject to every other
+ *   guard.
+ * - `closed`: the attempt will never admit another operation. Closing is
+ *   one-way and happens exactly where the attempt stops being a place work may
+ *   begin — when a newer attempt supersedes it, and when it settles.
+ */
+type AttemptOperationStartGate = (typeof ATTEMPT_OPERATION_START_GATES)[number];
 /**
  * Compare two provider allocation references as values.
  *
@@ -54,16 +73,196 @@ type ExecutionAttemptSettlementKind = (typeof EXECUTION_ATTEMPT_SETTLEMENT_KINDS
  */
 declare function sameAllocationRef(stored: ProviderAllocationRef, candidate: ProviderAllocationRef): boolean;
 /**
- * Compare two terminal workflow results as values.
- *
- * The rule {@link sameAllocationRef} states, for the same reason: a result may
- * carry caller-authored data whose key order is incidental, and a replay of the
- * identical result must be reported as `duplicate` by every realization.
- * @param committed - Result already committed for the attempt.
- * @param candidate - Result the caller presented.
- * @returns `true` when the two denote the same terminal result.
+ * Identifier of the durable aggregate that owns a series of attempts.
+ *
+ * For the workflow adapter this is the `WorkflowExecution` id. The generic
+ * port never interprets it; it is the fence key that decides which attempt is
+ * active for an owner. The alias is scoped to the repository port, the
+ * authority, the dispatch runner, and the convergence ports — wire claims and
+ * workflow-storage lookup keys keep plain `string`.
+ */
+type ExecutionOwnerId = string;
+/**
+ * Compare two durable outcome texts as values.
+ *
+ * The rule {@link sameAllocationRef} states, for the same reason: an outcome
+ * may carry caller-authored data whose key order is incidental, and a replay
+ * of the identical outcome must be reported as `duplicate` by every
+ * realization. The texts are parsed back before canonicalization because a
+ * codec is free to emit whatever key order it likes, and key order is not
+ * part of the value.
+ *
+ * Both operands are the codec's durable text — the only representation every
+ * realization shares. The stored one is what the attempt actually holds, read
+ * out of the realization's own record rather than reproduced from the decoded
+ * value: a codec may normalize while serializing, and the contract requires
+ * `parse(JSON.parse(serialize(outcome)))` only to succeed, never to serialize
+ * back to the same text. Re-serializing the decoded outcome would therefore
+ * compare a retry against a text the first commit never wrote, and would
+ * answer `conflict` for a worker's honest replay. Comparing texts also keeps
+ * a value such as a `bigint` — which a codec may legitimately encode, and
+ * which has no JSON form of its own — away from the canonicalizer entirely.
+ * @param stored - Durable text the attempt committed.
+ * @param candidate - Durable text the caller's submission would commit.
+ * @returns `true` when the two denote the same outcome.
  */
-declare function sameWorkflowResult(committed: WorkflowRunResult, candidate: WorkflowRunResult): boolean;
+declare function sameDurableOutcome(stored: string, candidate: string): boolean;
+/**
+ * The durable text a submission commits as, with the value that text yields.
+ *
+ * The two are produced together, by one call to {@link durableOutcome}, because
+ * they are one durable fact: the text is what a realization writes, and the
+ * outcome is what a reload of that text returns. Deriving either from the
+ * other later would re-serialize an already-normalized value, and a codec is
+ * not required to serialize such a value back to the text it came from.
+ *
+ * It is the currency of the whole outcome path. A caller renders a submission
+ * once through {@link ExecutionAttemptRepository.canonicalizeOutcome},
+ * validates `outcome`, and hands the same rendering to
+ * {@link ExecutionAttemptRepository.commitOutcome}, which stores `text`
+ * verbatim. Nothing between those steps re-reads the submitter's object, so a
+ * mutable outcome the caller changes afterwards cannot make the committed
+ * value differ from the validated one.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface DurableOutcome<TOutcome> {
+  /** The codec text a realization persists for this submission. */
+  readonly text: string;
+  /** The outcome that text reads back as, produced by the same rendering. */
+  readonly outcome: TOutcome;
+}
+/**
+ * Render a caller-supplied outcome as the durable fact a commit would write.
+ *
+ * The rendering rule every realization owes, stated once here for the same
+ * reason {@link sameDurableOutcome} is: it decides what an attempt holds, so
+ * two realizations deriving it independently could disagree about it.
+ *
+ * Three steps, in this order and each exactly once. `parse` validates the
+ * submission before any durable decision, so a value the codec rejects is
+ * refused at the same point by every realization. `serialize` produces the
+ * text to persist — the single serialization the pair is built from.
+ * `parse(JSON.parse(text))` yields what a reload returns, which is the
+ * outcome the port reports and an owner converges on; a codec may normalize
+ * while serializing, so it is not in general the submitted value.
+ *
+ * Nothing is cloned and nothing is frozen. The round trip already produces a
+ * value derived from freshly parsed JSON rather than from the caller's
+ * object, so no reference reaches back into anything the caller still holds.
+ * A `structuredClone` in front of it would reject an outcome type that is
+ * codec-serializable but not structured-cloneable, such as a `URL`, and an
+ * `Object.freeze` behind it would throw outright for one that is not
+ * freezable, such as a non-empty `Uint8Array` — both of which the codec
+ * contract allows. What keeps a committed outcome stable instead is that a
+ * realization stores the text and decodes it afresh on every read, so a
+ * caller that mutates the value it was handed changes nothing a later read
+ * reports.
+ * @param codec - Owner-injected codec that owns the durable representation.
+ * @param outcome - Outcome the caller presented.
+ * @returns The text to persist and the outcome it reads back as.
+ * @throws When the codec rejects the outcome or its own durable text.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+declare function durableOutcome<TOutcome>(codec: OutcomeCodec<TOutcome>, outcome: TOutcome): DurableOutcome<TOutcome>;
+/**
+ * Read a committed durable text back as the outcome it holds.
+ *
+ * The read rule every realization owes, stated once here for the same reason
+ * {@link durableOutcome} states the write rule: what a stored text yields
+ * must not depend on which realization reads it. `JSON.parse` undoes the
+ * transport form and `parse` validates the envelope, so a text the codec
+ * refuses — durable corruption, or a codec an owner changed under an existing
+ * row — fails loudly rather than reaching a caller as an ordinary outcome.
+ *
+ * Every read decodes afresh, and nothing is shared, cloned, or frozen. A
+ * codec may reconstruct a mutable object whose state a freeze does not even
+ * reach, such as a `URL`, so one reader mutating the value it was handed must
+ * not change what the next read reports; the stored text stays the only
+ * source of truth.
+ * @param codec - Owner-injected codec that owns the durable representation.
+ * @param text - Durable text an attempt committed.
+ * @returns The outcome that text holds, held by nobody else.
+ * @throws When the text is not JSON, or not JSON the codec accepts.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+declare function decodeDurableOutcome<TOutcome>(codec: OutcomeCodec<TOutcome>, text: string): TOutcome;
+/**
+ * Validates and serializes the owner-specific outcome type of an attempt.
+ *
+ * Injected into every {@link ExecutionAttemptRepository} realization so the
+ * generic port can enforce "input validation precedes every durable decision"
+ * without knowing the outcome shape. `parse` runs on every submitted outcome
+ * before the durable decision and on every committed outcome read back from
+ * storage; `serialize` produces the durable representation.
+ *
+ * **The durable representation is JSON text, and the two members round-trip
+ * through it.** A realization persists exactly what `serialize` returned,
+ * reads it back with `JSON.parse`, and hands the parsed value to `parse`; a
+ * codec must therefore accept `JSON.parse(serialize(outcome))` for every
+ * outcome it produced. Which envelope lives inside that text is the codec's
+ * own choice — no realization may assume it is `JSON.stringify(outcome)`.
+ *
+ * **The text is strict JSON, in the sense `JSON.stringify` defines.** Only
+ * values that function can represent are inside the contract: finite numbers,
+ * strings, booleans, `null`, arrays, and plain objects. A non-finite number —
+ * `Infinity`, `-Infinity`, `NaN`, written as `1e9999` or any other spelling —
+ * is outside it, as is anything else JSON has no form for, because the port
+ * decides outcome equality by canonicalizing the parsed text with
+ * `canonicalStringify` (see {@link sameDurableOutcome}), which renders every
+ * such value as `null` and would report two different outcomes as the same
+ * one. A codec whose outcomes need those values encodes them as values JSON
+ * does have — a string, or a tagged envelope — which is the codec's own job
+ * and not something a realization can do for it. Equality follows JSON
+ * semantics for the same reason: signed zero is outside the contract, `-0`
+ * and `0` are one and the same outcome, because `JSON.stringify` renders both
+ * as `0` and the canonical form cannot tell them apart. A codec that needs the
+ * sign encodes it explicitly, as it would any other value JSON does not carry.
+ *
+ * **Both members are deterministic, pure functions of their argument.** The
+ * same outcome serializes to the same text every time and the same value
+ * parses to the same outcome every time; neither may consult history, a
+ * counter, a clock, or any state outside the argument it was handed.
+ *
+ * The port itself renders a submission exactly once, through
+ * {@link ExecutionAttemptRepository.canonicalizeOutcome}, and carries that one
+ * {@link DurableOutcome} into {@link ExecutionAttemptRepository.commitOutcome}
+ * — so validation, the durable write, and convergence are one rendering and
+ * cannot drift apart. Determinism is still owed, because two renderings of
+ * the same outcome do meet: `commitOutcome` compares the text a retry renders
+ * against the text the first commit stored, and a codec that closed over a
+ * counter would misclassify a worker's honest retry.
+ *
+ * Determinism is not idempotence. `serialize` need not map its own decoded
+ * output back to the text it came from: a codec may normalize, and every
+ * decision the port makes about a committed outcome is made on the text that
+ * commit actually stored rather than on a re-serialization of it.
+ *
+ * `null` and `undefined` are not outcomes. A realization records "no outcome
+ * committed" as the absence of a stored value, so a codec that accepted a
+ * nullish outcome would make the two indistinguishable.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface OutcomeCodec<TOutcome> {
+  /**
+   * Validate an untrusted value as an outcome.
+   *
+   * Deterministic and pure: the same input always yields the same outcome.
+   * @param input - Value to validate.
+   * @returns The validated outcome.
+   * @throws When the value violates the outcome contract, including when it is nullish.
+   */
+  parse(input: unknown): TOutcome;
+  /**
+   * Serialize an outcome for durable storage.
+   *
+   * Deterministic and pure: the same outcome always yields the same text,
+   * because a retry's rendering is compared against the text an earlier
+   * commit stored.
+   * @param outcome - Outcome to serialize.
+   * @returns The JSON text to persist, which `parse` accepts after `JSON.parse`.
+   */
+  serialize(outcome: TOutcome): string;
+}
 /**
  * Rejection of an attempt identifier that already names a durable attempt.
  *
@@ -83,17 +282,136 @@ declare class DuplicateExecutionAttemptError extends Error {
    */
   constructor(executionAttemptId: string, options?: ErrorOptions);
 }
+/**
+ * The runtime and operation control state of one attempt.
+ *
+ * Ten facts that together decide who may act on an attempt's runtime endpoint
+ * and whether an operation may start. They live *on* the attempt rather than in
+ * a record beside it: every guard that reads them is also a guard the write has
+ * to repeat, and a single-row compare-and-set is what keeps that expressible.
+ *
+ * The three fences are independent and each answers a different question:
+ * {@link runtimeGeneration} says which runtime incarnation is current,
+ * {@link operationStartGate} says whether the attempt still starts work at all,
+ * and {@link activeOperationId} says whether it is already busy.
+ *
+ * It is also the shape {@link ExecutionAttemptRepository.getAttemptControlState}
+ * reports, so a process that lost its own memory of an attempt can read back
+ * exactly what a fresh decision would be made against.
+ */
+interface AttemptControlState {
+  /**
+   * Monotonic fence over runtime incarnations, `0` before any registered.
+   *
+   * Allocated by {@link ExecutionAttemptRepository.registerRuntime} and never
+   * proposed by a caller: a runtime only ever echoes the generation it was
+   * given. Anything presented against an older generation is
+   * `stale-generation`.
+   */
+  readonly runtimeGeneration: number;
+  /**
+   * Runtime incarnation currently registered, or `null` before any was.
+   *
+   * The registration idempotency key. A report naming the stored incarnation
+   * is a replay and is answered `duplicate`; a different one is a new
+   * incarnation and takes the next generation.
+   */
+  readonly runtimeIncarnationId: string | null;
+  /**
+   * ISO-8601 instant at which readiness was accepted for the current
+   * generation, or `null` while it has not been.
+   *
+   * Written by {@link ExecutionAttemptRepository.markRuntimeReady} and cleared
+   * by every {@link ExecutionAttemptRepository.registerRuntime} that allocates
+   * a new generation: readiness is a property of one incarnation, so it can
+   * never outlive the incarnation that proved it.
+   */
+  readonly runtimeReadyAt: string | null;
+  /**
+   * Whether the attempt still admits operations.
+   *
+   * `open` from creation. Closed by {@link ExecutionAttemptRepository.createAttempt}
+   * on the attempt it supersedes, and by every terminal settlement on the
+   * attempt it settles. Closing is one-way.
+   */
+  readonly operationStartGate: AttemptOperationStartGate;
+  /**
+   * Operation currently occupying the attempt, or `null` when it is idle.
+   *
+   * The at-most-one guard: an attempt runs one operation at a time. Cleared by
+   * {@link ExecutionAttemptRepository.completeOperation} together with
+   * {@link activeOperationKind}, {@link activeOperationKey},
+   * {@link activeOperationGeneration}, and {@link activeOperationAdmittedAt} —
+   * one write, because a half-cleared
+   * operation would be neither active nor absent.
+   *
+   * A terminal settlement deliberately leaves it in place, so a completion that
+   * arrives after the attempt settled reads `resolved` rather than
+   * `not-active`.
+   */
+  readonly activeOperationId: string | null;
+  /**
+   * Kind of the active operation, or `null` when the attempt is idle.
+   *
+   * Kept because the bounded runtime probe and a durable owner's run are not
+   * interchangeable: the probe is admitted while readiness is still unproven
+   * and is never announced to anyone but its own runtime.
+   */
+  readonly activeOperationKind: ExecutionAttemptOperationKind | null;
+  /**
+   * Idempotency key the active operation was admitted under, or `null` when the
+   * attempt is idle.
+   *
+   * A second admission presenting this key is the same admission retried, and
+   * is answered `duplicate` with the operation identifier the first one
+   * received.
+   */
+  readonly activeOperationKey: string | null;
+  /**
+   * Runtime generation the active operation is fenced against, or `null` when
+   * the attempt is idle.
+   *
+   * A completion reported against an older generation belongs to a runtime that
+   * has since been superseded and is refused as `stale-generation`.
+   */
+  readonly activeOperationGeneration: number | null;
+  /**
+   * ISO-8601 instant at which the active operation was admitted, or `null`
+   * when the attempt is idle.
+   *
+   * Recorded so a replayed admission announces the instant the authority
+   * admitted the operation, not the instant of the replay. Cleared together
+   * with the other active-operation members.
+   */
+  readonly activeOperationAdmittedAt: string | null;
+  /**
+   * Operation identifier of the most recent completion, or `null` before any.
+   *
+   * What makes a replayed completion answerable: the active operation is gone
+   * by then, so without it the replay would be indistinguishable from a
+   * completion for an operation that never existed.
+   */
+  readonly lastCompletedOperationId: string | null;
+}
 /**
  * Durable record for one execution attempt.
  *
  * Produced by the injected {@link ExecutionAttemptRepository} and consumed by
  * the Authority service. All fields are JSON-safe and contain no secrets.
+ *
+ * The {@link AttemptControlState} members are part of the record because they
+ * are columns on the attempt, not a separate aggregate — and they are required,
+ * unlike {@link claimable} and {@link settlementKind}. Every attempt holds all
+ * ten from {@link ExecutionAttemptRepository.createAttempt} onwards, so a
+ * record that omits one describes an attempt that cannot exist. Requiring them
+ * is what makes that omission a type error at the place the record is built,
+ * rather than a default silently resolved at each place it is read.
  */
-interface ExecutionAttemptRecord {
+interface ExecutionAttemptRecord extends AttemptControlState {
   /** Authority-created attempt identifier. */
   readonly executionAttemptId: string;
-  /** Workflow execution identifier this attempt belongs to. */
-  readonly executionId: string;
+  /** Owner identifier of the aggregate this attempt belongs to. */
+  readonly executionId: ExecutionOwnerId;
   /** Current lifecycle status of the attempt. */
   readonly status: ExecutionAttemptStatus;
   /** Provider allocation reference, set after allocation recording. */
@@ -116,7 +434,7 @@ interface ExecutionAttemptRecord {
    * Immutable alongside {@link providerId}. Remediation reads it to decide
    * whether losing the provisioning process also loses the allocation.
    */
-  readonly allocationLifetime: WorkerNodeAllocationLifetime | null;
+  readonly allocationLifetime: WorkerAllocationLifetime | null;
   /**
    * Provisioner process incarnation that performed the provider call, or
    * `null` before provisioning began.
@@ -182,7 +500,7 @@ interface RecoverableAttemptRecord extends ExecutionAttemptRecord {
   /** Always bound for recoverable attempts. */
   readonly providerId: string;
   /** Always bound for recoverable attempts. */
-  readonly allocationLifetime: WorkerNodeAllocationLifetime;
+  readonly allocationLifetime: WorkerAllocationLifetime;
   /** Always bound for recoverable attempts. */
   readonly provisionerIncarnationId: string;
 }
@@ -194,8 +512,8 @@ interface RecoverableAttemptRecord extends ExecutionAttemptRecord {
 interface ExecutionAttemptCreate {
   /** Authority-created attempt identifier. */
   readonly executionAttemptId: string;
-  /** Workflow execution identifier. */
-  readonly executionId: string;
+  /** Owner identifier the attempt belongs to. */
+  readonly executionId: ExecutionOwnerId;
 }
 /**
  * Input for claiming the provisioning phase of an attempt.
@@ -208,12 +526,12 @@ interface ExecutionAttemptCreate {
 interface BeginProvisioningInput {
   /** Attempt whose provider call is about to begin. */
   readonly executionAttemptId: string;
-  /** Workflow execution identifier the attempt must belong to. */
-  readonly executionId: string;
+  /** Owner identifier the attempt must belong to. */
+  readonly executionId: ExecutionOwnerId;
   /** Provider to bind to the attempt, immutably. */
   readonly providerId: string;
   /** Allocation lifetime declared by that provider, immutably. */
-  readonly allocationLifetime: WorkerNodeAllocationLifetime;
+  readonly allocationLifetime: WorkerAllocationLifetime;
   /** Provisioner process incarnation performing the call, immutably. */
   readonly provisionerIncarnationId: string;
   /** Controller process incarnation that will hold the initial claim. */
@@ -228,14 +546,22 @@ interface BeginProvisioningInput {
  * and returns the canonical outcome for convergence. Outcome commitment
  * carries no claim: a worker's answer never depends on who currently owns
  * the attempt's provider operation.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
  */
-interface ExecutionAttemptOutcomeCommit {
+interface ExecutionAttemptOutcomeCommit<TOutcome> {
   /** Authority-created attempt identifier. */
   readonly executionAttemptId: string;
-  /** Workflow execution identifier. */
-  readonly executionId: string;
-  /** Terminal workflow result to commit. */
-  readonly result: WorkflowRunResult;
+  /** Owner identifier the attempt belongs to. */
+  readonly executionId: ExecutionOwnerId;
+  /**
+   * The rendering to commit, from
+   * {@link ExecutionAttemptRepository.canonicalizeOutcome}.
+   *
+   * A rendering rather than a raw outcome so the value a caller validated and
+   * the value that becomes durable are the same one: the caller renders the
+   * submission once and never reads its own object again.
+   */
+  readonly result: DurableOutcome<TOutcome>;
 }
 /** Input for extending the lease of a currently held provider operation. */
 interface RenewProviderOperationClaimInput {
@@ -311,8 +637,8 @@ interface RecordAllocationInput {
 interface RecordProvisioningAbsentInput {
   /** Claim authorizing the record. */
   readonly claim: ProviderOperationClaim;
-  /** Workflow execution identifier the attempt must belong to. */
-  readonly executionId: string;
+  /** Owner identifier the attempt must belong to. */
+  readonly executionId: ExecutionOwnerId;
   /** Bounded evidence supporting the absence claim. */
   readonly evidence: BoundedRecoveryEvidence;
 }
@@ -327,8 +653,8 @@ interface RecordProvisioningAbsentInput {
 interface RecordProvisionerIncarnationLostInput {
   /** Claim authorizing the record. */
   readonly claim: ProviderOperationClaim;
-  /** Workflow execution identifier the attempt must belong to. */
-  readonly executionId: string;
+  /** Owner identifier the attempt must belong to. */
+  readonly executionId: ExecutionOwnerId;
   /** Proof that a specific provisioner process incarnation is gone. */
   readonly proof: ProcessBoundProvisionerLossProof;
 }
@@ -348,8 +674,8 @@ interface RecordAllocationTerminatedInput {
 interface RecordInfrastructureFailureInput {
   /** Claim authorizing the settlement. */
   readonly claim: ProviderOperationClaim;
-  /** Workflow execution identifier the attempt must belong to. */
-  readonly executionId: string;
+  /** Owner identifier the attempt must belong to. */
+  readonly executionId: ExecutionOwnerId;
 }
 /**
  * Input for a compare-and-set evolution of an allocation reference.
@@ -365,8 +691,8 @@ interface RecordInfrastructureFailureInput {
 interface AllocationRefEvolution {
   /** Claim authorizing the evolution. */
   readonly claim: ProviderOperationClaim;
-  /** Workflow execution identifier the attempt must belong to. */
-  readonly executionId: string;
+  /** Owner identifier the attempt must belong to. */
+  readonly executionId: ExecutionOwnerId;
   /**
    * The allocation reference the caller believes is currently stored.
    *
@@ -381,6 +707,78 @@ interface AllocationRefEvolution {
   /** The new allocation reference to store if the CAS check passes. */
   readonly nextRef: ProviderAllocationRef;
 }
+/**
+ * Input for registering a runtime incarnation as an attempt's endpoint.
+ *
+ * `executionId` is the active-attempt fence, not merely an ownership check: a
+ * superseded attempt must never acquire a fresh runtime endpoint, because
+ * nothing would ever address it again.
+ *
+ * No generation is supplied. The repository allocates it, exactly as
+ * {@link ExecutionAttemptRepository.beginProvisioning} mints the first claim,
+ * so a runtime can never propose a fence for itself.
+ */
+interface RegisterRuntimeInput {
+  /** Attempt whose runtime endpoint is being registered. */
+  readonly executionAttemptId: string;
+  /** Owner identifier the attempt must belong to, and be active for. */
+  readonly executionId: ExecutionOwnerId;
+  /** Identifier of this concrete runtime incarnation, unique per boot. */
+  readonly runtimeIncarnationId: string;
+}
+/**
+ * Input for admitting one operation through an attempt's start gate.
+ *
+ * `admissionKey` is the caller's idempotency key and the only thing that makes
+ * a retry answerable: the repository mints the operation identifier, so a
+ * caller that lost the reply has no other way to ask which operation it got.
+ */
+interface AdmitOperationInput {
+  /** Attempt the operation would run under. */
+  readonly executionAttemptId: string;
+  /** Owner identifier the attempt must belong to, and be active for. */
+  readonly executionId: ExecutionOwnerId;
+  /** Kind of operation being admitted. */
+  readonly operationKind: ExecutionAttemptOperationKind;
+  /** Caller-chosen idempotency key for this admission. */
+  readonly admissionKey: string;
+  /** Runtime generation the caller fences the admission against. */
+  readonly runtimeGeneration: number;
+}
+/**
+ * Input for completing the operation an attempt currently runs.
+ *
+ * Carries no `executionId`: completion frees a slot the attempt already
+ * occupies, and a superseded attempt owes that release just as much as an
+ * active one does. Refusing it would strand the operation forever.
+ */
+interface CompleteOperationInput {
+  /** Attempt whose active operation is completing. */
+  readonly executionAttemptId: string;
+  /** Operation the caller believes it is completing. */
+  readonly operationId: string;
+  /** Runtime generation the completion is fenced against. */
+  readonly runtimeGeneration: number;
+}
+/**
+ * Input for recording that a registered runtime proved itself ready.
+ *
+ * Carries `executionId`, unlike {@link CompleteOperationInput}: completion
+ * releases a slot the attempt already occupies, but readiness asserts that the
+ * attempt's endpoint is current, and an attempt superseded between the probe's
+ * completion and this write no longer has a current endpoint. The generation
+ * fence alone cannot see that — a superseded attempt keeps its generation.
+ */
+interface MarkRuntimeReadyInput {
+  /** Attempt whose runtime proved ready. */
+  readonly executionAttemptId: string;
+  /** Owner identifier the attempt must belong to, and be active for. */
+  readonly executionId: ExecutionOwnerId;
+  /** Generation the readiness belongs to. */
+  readonly runtimeGeneration: number;
+  /** ISO-8601 instant at which readiness was observed. */
+  readonly readyAt: string;
+}
 /**
  * Durable decision for claiming provider provisioning ownership.
  *
@@ -510,7 +908,7 @@ type ProvisionerIncarnationLossDecision = {
   readonly kind: 'recorded';
 } | {
   readonly kind: 'not-process-bound';
-  readonly allocationLifetime: WorkerNodeAllocationLifetime | null;
+  readonly allocationLifetime: WorkerAllocationLifetime | null;
 } | {
   readonly kind: 'incarnation-mismatch';
   readonly provisionerIncarnationId: string | null;
@@ -620,25 +1018,220 @@ type PendingAttemptAbandonmentDecision = {
  * Durable outcome decision returned by {@link ExecutionAttemptRepository.commitOutcome}.
  *
  * - `accepted`: the outcome was committed as canonical for the first time.
- * - `duplicate`: an outcome {@link sameWorkflowResult} judges identical to the
- *   committed one was submitted again; this is a replay. The committed outcome
- *   is reported, never the caller's copy of it.
+ *   The stored text decoded is reported, never the caller's copy of it.
+ * - `duplicate`: an outcome whose durable text {@link sameDurableOutcome}
+ *   judges identical to the committed one was submitted again; this is a
+ *   replay. The committed outcome is reported, never the caller's copy of it.
  * - `conflict`: the attempt already reached a different terminal state — either
  *   a different committed outcome, or a competing terminal transition that
  *   settled it without one.
  * - `fenced`: the attempt is no longer the active attempt for this execution.
+ *
+ * Both settling kinds carry `text`: the durable text the attempt holds for
+ * this outcome. For `accepted` that is the text the commit just wrote; for
+ * `duplicate` it is the text the earlier commit wrote, which is not
+ * necessarily the retry's own rendering — {@link sameDurableOutcome} judges
+ * two texts the same outcome while member order, and anything else a codec
+ * may render differently, still differs between them. A caller that needs a
+ * copy of the committed outcome nobody else has held decodes this text
+ * through {@link ExecutionAttemptRepository.decodeOutcome}; decoding its own
+ * submission's text instead would hand out the retry's representation rather
+ * than the committed one.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
  */
-type ExecutionAttemptOutcomeDecision = {
+type ExecutionAttemptOutcomeDecision<TOutcome> = {
   readonly kind: 'accepted';
-  readonly outcome: WorkflowRunResult;
+  readonly outcome: TOutcome;
+  readonly text: string;
 } | {
   readonly kind: 'duplicate';
-  readonly outcome: WorkflowRunResult;
+  readonly outcome: TOutcome;
+  readonly text: string;
 } | {
   readonly kind: 'conflict';
 } | {
   readonly kind: 'fenced';
 };
+/**
+ * Durable decision for registering a runtime incarnation as an attempt's
+ * endpoint.
+ *
+ * - `registered`: the incarnation now owns the attempt's runtime endpoint at
+ *   `runtimeGeneration`, and everything it later presents must carry that
+ *   generation. Readiness starts unproven.
+ * - `duplicate`: the attempt already holds exactly this incarnation. The
+ *   report is a replay, so the stored generation is reported unchanged
+ *   together with the readiness that generation has — `runtimeReadyAt` is
+ *   `null` when readiness was not proven yet, and an instant when it was,
+ *   which is what lets a caller tell "register again" from "already ready"
+ *   without a second read.
+ * - `not-found`: no such attempt, or it does not belong to the named owner.
+ * - `resolved`: the attempt has settled, so it will never run anything again.
+ * - `fenced`: the attempt is no longer the active attempt for its owner.
+ * - `not-allocated`: no allocation is recorded, or the recorded one is durably
+ *   confirmed terminated and only awaits its settlement, so there is no
+ *   infrastructure a runtime could be the endpoint of.
+ * - `operation-active`: a workload operation is running against the current
+ *   generation. Registering would fence it mid-flight, so the reported
+ *   operation must complete first. A `runtime-probe` left active is not in the
+ *   way: the probe is the authority's own proof of an endpoint, and one that
+ *   was never completed belongs to a handshake that died. Registration
+ *   reclaims it in the same write that allocates the new generation, so a
+ *   crashed handshake cannot block the attempt's next incarnation.
+ */
+type RuntimeRegistrationDecision = {
+  readonly kind: 'registered';
+  readonly runtimeGeneration: number;
+} | {
+  readonly kind: 'duplicate';
+  readonly runtimeGeneration: number;
+  readonly runtimeReadyAt: string | null;
+} | {
+  readonly kind: 'not-found';
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'fenced';
+} | {
+  readonly kind: 'not-allocated';
+} | {
+  readonly kind: 'operation-active';
+  readonly operationId: string;
+};
+/**
+ * Durable decision for admitting one operation through an attempt's start gate.
+ *
+ * - `admitted`: the operation now occupies the attempt, under the reported
+ *   identifier and fenced against the reported generation.
+ * - `duplicate`: an operation admitted under the same `admissionKey` is already
+ *   the active one. The retry receives that operation's identifier and the
+ *   generation it was admitted under rather than a second admission.
+ * - `not-found`: no such attempt, or it does not belong to the named owner.
+ * - `resolved`: the attempt has settled.
+ * - `fenced`: the attempt is no longer the active attempt for its owner.
+ * - `not-allocated`: no allocation is recorded, or the recorded one is durably
+ *   confirmed terminated and only awaits its settlement, so there is nothing
+ *   to run on.
+ * - `operation-active`: a different operation already occupies the attempt.
+ * - `gate-closed`: the attempt was superseded or settled, so it will never
+ *   admit another operation. Distinct from `fenced` and `resolved` because the
+ *   gate is the durable fact, and the two of them are how it came to be closed.
+ * - `not-ready`: readiness has not been proven for the current generation.
+ *   Every kind but `runtime-probe` waits for it — the probe is precisely what
+ *   proves readiness, so it cannot require it.
+ * - `stale-generation`: the caller fenced against a generation the attempt has
+ *   moved past. The current generation is reported so the caller can re-fence
+ *   rather than re-read.
+ */
+type OperationAdmissionDecision = {
+  readonly kind: 'admitted';
+  readonly operationId: string;
+  readonly runtimeGeneration: number; /** ISO-8601 instant the admission was recorded at. */
+  readonly admittedAt: string;
+} | {
+  readonly kind: 'duplicate';
+  readonly operationId: string;
+  readonly runtimeGeneration: number; /** ISO-8601 instant the first pass recorded the admission at. */
+  readonly admittedAt: string;
+} | {
+  readonly kind: 'not-found';
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'fenced';
+} | {
+  readonly kind: 'not-allocated';
+} | {
+  readonly kind: 'operation-active';
+  readonly operationId: string;
+} | {
+  readonly kind: 'gate-closed';
+} | {
+  readonly kind: 'not-ready';
+} | {
+  readonly kind: 'stale-generation';
+  readonly runtimeGeneration: number;
+};
+/**
+ * Durable decision for completing the operation an attempt currently runs.
+ *
+ * - `completed`: the operation was the active one and the attempt is idle
+ *   again.
+ * - `duplicate`: this operation was already completed. A replay, answered from
+ *   {@link AttemptControlState.lastCompletedOperationId} rather than from an
+ *   active operation that is by then gone.
+ * - `mismatch`: a different operation occupies the attempt. The active one is
+ *   reported, because the caller's next move depends on which it is.
+ * - `not-active`: no operation occupies the attempt and this one is not the
+ *   last completed one, so the caller is completing something that never ran.
+ * - `stale-generation`: the completion is fenced against an older generation
+ *   than the operation it names, so it comes from a superseded runtime.
+ * - `resolved`: the attempt has settled. Reported ahead of `not-active`
+ *   because a terminal settlement leaves the active operation in place
+ *   precisely so a late completion learns why nobody is waiting for it.
+ * - `not-found`: no such attempt.
+ */
+type OperationCompletionDecision = {
+  readonly kind: 'completed';
+} | {
+  readonly kind: 'duplicate';
+} | {
+  readonly kind: 'mismatch';
+  readonly activeOperationId: string;
+} | {
+  readonly kind: 'not-active';
+} | {
+  readonly kind: 'stale-generation';
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'not-found';
+};
+/**
+ * Durable decision for recording that a registered runtime proved itself ready.
+ *
+ * Evaluated in this order, in both realizations:
+ * `not-found → resolved → fenced → not-allocated → stale-generation → duplicate → operation-active`.
+ *
+ * - `ready`: readiness is now durable for the fenced generation, at the
+ *   reported instant.
+ * - `duplicate`: readiness was already recorded for this generation. The
+ *   instant reported is the stored one, not the caller's, so two callers
+ *   converge on one answer.
+ * - `operation-active`: an operation occupies the attempt. Readiness is a
+ *   statement about an idle runtime, and recording it under a running
+ *   operation would claim a proof nothing performed.
+ * - `stale-generation`: the caller fenced against a generation the attempt has
+ *   moved past, so the readiness it proved belongs to a runtime that is gone.
+ * - `not-allocated`: no allocation is recorded, or the recorded one is durably
+ *   confirmed terminated and only awaits its settlement. A probe completed on
+ *   a dead allocation proves nothing that can be announced.
+ * - `fenced`: the attempt is no longer the active attempt for its owner. Its
+ *   generation may still match, but a superseded attempt has no current
+ *   endpoint to declare ready.
+ * - `resolved`: the attempt has settled.
+ * - `not-found`: no such attempt for the given execution.
+ */
+type RuntimeReadinessDecision = {
+  readonly kind: 'ready';
+  readonly acceptedAt: string;
+} | {
+  readonly kind: 'duplicate';
+  readonly acceptedAt: string;
+} | {
+  readonly kind: 'operation-active';
+  readonly operationId: string;
+} | {
+  readonly kind: 'stale-generation';
+} | {
+  readonly kind: 'not-allocated';
+} | {
+  readonly kind: 'fenced';
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'not-found';
+};
 /**
  * Passive injected port for durable execution attempt persistence.
  *
@@ -682,11 +1275,37 @@ type ExecutionAttemptOutcomeDecision = {
  *    let a caller assert that infrastructure ended without ever recording the
  *    evidence that it did, and the settlement is irreversible.
  *
- * 2. **Provider-side evidence is claim-fenced; workflow outcome is not.**
+ * 2. **Provider-side evidence is claim-fenced; the worker outcome is not.**
  *    Every provider-side mutation requires the current generation and token.
  *    {@link commitOutcome} deliberately requires neither, so a worker can
  *    always deliver its canonical answer.
  *
+ * 3. **An attempt starts work through one gate, and the gate closes for
+ *    good.** {@link AttemptControlState.operationStartGate} is the single
+ *    durable ordering point between "this attempt may still run something" and
+ *    "it never will again". It opens at {@link createAttempt} and closes
+ *    exactly twice over an attempt's life, both times inside the transaction
+ *    that made the closing true: on the attempt a newer {@link createAttempt}
+ *    supersedes, and on the attempt a terminal settlement settles. Closing it
+ *    anywhere else, or reopening it, would let work begin on an attempt whose
+ *    answer is already fixed.
+ *
+ *    The gate orders admission only. It never gates {@link commitOutcome}: a
+ *    settled attempt closes its gate and *keeps* its active operation, so a
+ *    worker's canonical answer and a late completion both still find the state
+ *    that explains them.
+ *
+ *    The runtime fence beside it is monotonic in the same one-way sense.
+ *    {@link registerRuntime} allocates each generation, refuses while an
+ *    operation is active, and clears readiness when it advances — so a
+ *    generation always names one incarnation, and readiness always names one
+ *    generation.
+ *
+ *    Every refusal these transitions report is evaluated in one fixed order,
+ *    stated with {@link RuntimeRegistrationDecision} and
+ *    {@link OperationAdmissionDecision}. A realization that reorders it is
+ *    non-conforming.
+ *
  * An operation stays remediable after its attempt stops being the active
  * attempt for its execution. Claim-fenced discovery, absence, cleanup, and
  * terminal convergence may update such an attempt and close its operation,
@@ -725,9 +1344,46 @@ type ExecutionAttemptOutcomeDecision = {
  * — including when the caller's claim is also stale. Validating after the
  * guards would make the rejection depend on ownership, so the same malformed
  * payload would throw against one implementation and return `stale` from
- * another.
+ * another. Submitted outcomes follow the same rule through the injected
+ * {@link OutcomeCodec}: `parse` runs before the durable outcome decision. A
+ * committed outcome is always a defined value — a nullish outcome is outside
+ * this port, because "no outcome committed" is itself recorded as the absence
+ * of a stored value and the two would be indistinguishable.
+ *
+ * **The codec's durable text is what an attempt holds, and it is rendered
+ * exactly once per submission.** {@link canonicalizeOutcome} produces the
+ * {@link DurableOutcome} — the text to persist and the outcome that text
+ * reads back as — and {@link commitOutcome} receives that rendering rather
+ * than a raw value, persisting `text` verbatim. What an attempt reports is
+ * therefore never the submitter's copy, which a normalizing codec makes a
+ * different value, and never a second serialization, which a codec whose
+ * serialization is not a fixed point makes a different text. Every later
+ * decision about that outcome is made on the stored text or on the value it
+ * yields: {@link commitOutcome} compares a retry's rendered text against the
+ * stored one through {@link sameDurableOutcome}.
+ *
+ * **Every stored outcome is parsed before it decides anything.** An
+ * implementation that finds a committed text takes it through `parse` ahead
+ * of the duplicate-or-conflict decision, not only on the branch that reports
+ * a value. A text the codec rejects is broken durable state — corruption, or
+ * a codec changed under an existing row — and it fails loudly rather than
+ * reaching the caller as an ordinary competing outcome. For the same reason
+ * an outcome is decoded on every read instead of being handed out as one
+ * shared instance: a codec may reconstruct a mutable object — one that no
+ * freeze even reaches, or that cannot be frozen at all — and one reader
+ * mutating it must not change what the next read reports.
+ * {@link decodeOutcome} is that read, stated on the port so a caller holding
+ * only a durable text can perform it too.
+ *
+ * **An `accepted` decision reports that same fresh decode of the text it just
+ * stored**, not the outcome half of the rendering it was handed. The two are
+ * one value only until someone touches it: a caller validates
+ * {@link DurableOutcome.outcome} before the commit, and a mutable outcome it
+ * changed there would otherwise be reported back as the committed one — a
+ * value no reload of the attempt ever yields.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
  */
-interface ExecutionAttemptRepository {
+interface ExecutionAttemptRepository<TOutcome> {
   /**
    * Persist a new execution attempt record.
    *
@@ -735,6 +1391,17 @@ interface ExecutionAttemptRepository {
    * `executionAttemptId` generation; the repository only persists. The new
    * attempt atomically becomes the active attempt for its execution.
    *
+   * The new attempt starts with its {@link AttemptControlState} at rest:
+   * generation `0`, no incarnation, no readiness, no active operation, and
+   * {@link AttemptControlState.operationStartGate} `open`.
+   *
+   * **The attempt it supersedes has its start gate closed in this same
+   * transaction**, alongside the active pointer moving. A superseded attempt
+   * whose gate stayed open could admit an operation between the pointer move
+   * and any later cleanup, which is work begun on an attempt nobody addresses
+   * any more. The pointer and the gate therefore become true together or not
+   * at all.
+   *
    * `executionAttemptId` is unique for all time. Creating an attempt whose
    * identifier already exists is a caller bug and is rejected — never
    * answered with a decision and never applied. There is no correct way to
@@ -905,16 +1572,145 @@ interface ExecutionAttemptRepository {
    * @returns The durable termination decision.
    */
   recordAllocationTerminated(input: RecordAllocationTerminatedInput): Promise<AllocationTerminationDecision>;
+  /**
+   * Register a runtime incarnation as the attempt's endpoint.
+   *
+   * The repository allocates the generation — the caller supplies only the
+   * incarnation identifier, which is both what it is registering and the
+   * idempotency key for having registered it. A registration that succeeds
+   * advances the generation by exactly one and clears
+   * {@link AttemptControlState.runtimeReadyAt}, because the readiness the
+   * previous incarnation proved says nothing about this one.
+   *
+   * It refuses while an operation is active. Advancing the generation there
+   * would fence a running operation's own completion, so the reported
+   * operation has to finish first — and this is why a replay by the incarnation
+   * that is already registered is answered `duplicate` ahead of that refusal:
+   * the operation in the way is frequently the very probe that registration
+   * started.
+   *
+   * The refusal order is the fixed one; see {@link RuntimeRegistrationDecision}.
+   * @param input - Attempt identity, owning execution, and the runtime incarnation.
+   * @returns The durable registration decision.
+   */
+  registerRuntime(input: RegisterRuntimeInput): Promise<RuntimeRegistrationDecision>;
+  /**
+   * Admit one operation through the attempt's start gate.
+   *
+   * At most one operation occupies an attempt at a time, and the repository
+   * mints its identifier. `admissionKey` is what makes a retry answerable: a
+   * second admission presenting the key the active operation was admitted
+   * under receives that operation's identifier rather than a second slot.
+   *
+   * Every kind requires proven readiness except `runtime-probe`, which is
+   * admitted while {@link AttemptControlState.runtimeReadyAt} is still `null` —
+   * the probe is the bounded no-op that *proves* the endpoint, so requiring
+   * readiness of it would make readiness unreachable.
+   *
+   * The refusal order is the fixed one; see {@link OperationAdmissionDecision}.
+   * @param input - Attempt identity, owning execution, kind, idempotency key, and fence.
+   * @returns The durable admission decision.
+   */
+  admitOperation(input: AdmitOperationInput): Promise<OperationAdmissionDecision>;
+  /**
+   * Release the attempt's active operation.
+   *
+   * Clears the four active-operation members in one write and records the
+   * completed identifier, so a replay is answered `duplicate` rather than
+   * mistaken for a completion of something that never ran.
+   *
+   * Deliberately unfenced by the active-attempt pointer: a superseded attempt
+   * owes the release exactly as much as an active one, and refusing it would
+   * leave the operation occupying the attempt for good.
+   * @param input - Attempt identity, the operation being completed, and its fence.
+   * @returns The durable completion decision.
+   */
+  completeOperation(input: CompleteOperationInput): Promise<OperationCompletionDecision>;
+  /**
+   * Record that the registered runtime proved itself ready.
+   *
+   * Written only for the generation the caller fences against, so a proof that
+   * a superseded incarnation produced can never mark the current one ready, and
+   * only while the attempt is still the active attempt for its owner, so a
+   * proof that completed before the attempt was superseded is refused `fenced`
+   * rather than announced for an endpoint nobody will address. Recording is
+   * idempotent: a second call for the same generation reports the instant
+   * already stored, never the caller's own.
+   * @param input - Attempt identity, the generation the proof belongs to, and when it was observed.
+   * @returns The durable readiness decision.
+   */
+  markRuntimeReady(input: MarkRuntimeReadyInput): Promise<RuntimeReadinessDecision>;
+  /**
+   * Read an attempt's runtime and operation control state.
+   *
+   * The recovery read of {@link AttemptControlState}: a process that lost its
+   * own memory of an attempt — a restart, a second controller — asks what the
+   * durable state is instead of inferring it. Unfenced and regardless of
+   * status, exactly like
+   * {@link ExecutionAttemptRecoveryOperations.getAttemptWithAllocation}, because
+   * the state of a superseded or settled attempt is precisely what a recovering
+   * process needs to see.
+   * @param executionAttemptId - Attempt whose control state to read.
+   * @returns The control state, or `null` when no such attempt exists.
+   */
+  getAttemptControlState(executionAttemptId: string): Promise<AttemptControlState | null>;
   /**
    * Retrieve the active attempt for a given execution.
    *
    * Returns `null` when the attempt does not exist or has been superseded
    * (fenced) by a newer attempt for the same execution.
-   * @param executionId - Workflow execution identifier.
+   * @param executionId - Owner identifier the attempt belongs to.
    * @param executionAttemptId - Attempt identifier to look up.
    * @returns The attempt record if active, or `null`.
    */
-  getActiveAttempt(executionId: string, executionAttemptId: string): Promise<ExecutionAttemptRecord | null>;
+  getActiveAttempt(executionId: ExecutionOwnerId, executionAttemptId: string): Promise<ExecutionAttemptRecord | null>;
+  /**
+   * Render a submission as the durable fact a commit of it would write.
+   *
+   * **The port renders an outcome exactly once, and this is where.** A
+   * realization stores the codec's durable text and reports what a reload of
+   * that text yields, so the value an owner converges on is not in general
+   * the value the submitter handed in — a codec may normalize while
+   * serializing. This member produces both halves of that fact together,
+   * without committing anything, so a caller can validate the outcome it will
+   * actually receive and then hand the very same rendering to
+   * {@link commitOutcome}.
+   *
+   * Carrying the rendering rather than re-deriving it is what closes the gap
+   * between the two calls: the submitter's object is read once, so neither a
+   * mutation of it nor a second serialization can make the committed outcome
+   * differ from the validated one.
+   *
+   * Synchronous and free of durable effects: it consults the injected
+   * {@link OutcomeCodec} and nothing else — {@link durableOutcome} is the
+   * rendering rule, and a realization has no freedom to deviate from it.
+   * @param outcome - Outcome a caller is about to submit.
+   * @returns The text a commit would persist and the outcome that text yields.
+   * @throws When the codec rejects the outcome or its own durable text.
+   */
+  canonicalizeOutcome(outcome: TOutcome): DurableOutcome<TOutcome>;
+  /**
+   * Read a committed durable text back as the outcome it holds.
+   *
+   * The counterpart of {@link canonicalizeOutcome}: that member says what a
+   * commit writes, this one says what a read of that text yields. Both are
+   * the codec's rules rather than a realization's, so
+   * {@link decodeDurableOutcome} is the rendering and a realization has no
+   * freedom to deviate from it.
+   *
+   * It exists because the durable text is the only copy of an outcome nobody
+   * can have touched. Every value the port hands out is decoded from it, and
+   * a caller that has passed one on — to an owner validation, to convergence
+   * — and needs the committed outcome again asks for a fresh decode instead
+   * of reusing a value some other step may have mutated. Each call returns
+   * its own value; a mutation of one changes nothing the next one reports.
+   *
+   * Synchronous and free of durable effects: the caller supplies the text.
+   * @param text - Durable text an attempt committed, as {@link DurableOutcome.text} carries it.
+   * @returns The outcome that text holds, held by nobody else.
+   * @throws When the text is not JSON, or not JSON the codec accepts.
+   */
+  decodeOutcome(text: string): TOutcome;
   /**
    * Commit a terminal outcome for an attempt.
    *
@@ -928,12 +1724,13 @@ interface ExecutionAttemptRepository {
    *
    * 1. `fenced` — the attempt is no longer the active attempt for its
    *    execution. Evaluated first because `accepted` and `duplicate` oblige
-   *    the caller to converge workflow state, and a superseded attempt must
+   *    the caller to converge owner state, and a superseded attempt must
    *    never drive that convergence.
    * 2. `duplicate` / `conflict` — an outcome is already committed for this
-   *    attempt: `duplicate` when {@link sameWorkflowResult} judges it
-   *    canonically equal, including member-order-insensitive objects;
-   *    `conflict` when it differs under that rule.
+   *    attempt: `duplicate` when {@link sameDurableOutcome} judges the text
+   *    the submission would commit canonically equal to the stored one,
+   *    including member-order-insensitive objects; `conflict` when it differs
+   *    under that rule.
    * 3. `conflict` — a competing terminal transition already settled the
    *    attempt without committing an outcome, that is
    *    {@link recordInfrastructureFailure} or
@@ -943,10 +1740,24 @@ interface ExecutionAttemptRepository {
    *    `settlementKind` nor reopen the attempt.
    * 4. `accepted` — the outcome becomes canonical, the attempt settles as
    *    `outcome`, and its operation closes.
-   * @param input - Attempt identity and terminal result to commit.
+   *
+   * The submission arrives already rendered, as the {@link DurableOutcome} the
+   * caller obtained from {@link canonicalizeOutcome}. An implementation
+   * persists `result.text` verbatim and never re-serializes: a second
+   * rendering is what would let the durable answer differ from the one the
+   * owner validated. What it reports for `accepted` is that text decoded
+   * again — {@link decodeOutcome} of `result.text` — rather than
+   * `result.outcome`, which the caller has held since before its own
+   * validation and may have mutated there.
+   *
+   * A settling decision also reports the durable text the attempt holds:
+   * `result.text` for `accepted`, and the stored text for `duplicate` — the
+   * record's own, not the submission's, because the two are the same outcome
+   * without being the same text.
+   * @param input - Attempt identity and the rendering to commit.
    * @returns The durable decision with the canonical outcome when applicable.
    */
-  commitOutcome(input: ExecutionAttemptOutcomeCommit): Promise<ExecutionAttemptOutcomeDecision>;
+  commitOutcome(input: ExecutionAttemptOutcomeCommit<TOutcome>): Promise<ExecutionAttemptOutcomeDecision<TOutcome>>;
   /**
    * Settle a pending attempt when dispatch cannot continue before provisioning.
    *
@@ -954,10 +1765,10 @@ interface ExecutionAttemptRepository {
    * mean provisioning already began, so the caller must converge the provider
    * operation instead of abandoning the attempt.
    * @param executionAttemptId - Pending attempt to abandon.
-   * @param executionId - Workflow execution identifier.
+   * @param executionId - Owner identifier the attempt belongs to.
    * @returns The durable abandonment decision.
    */
-  abandonPendingAttempt(executionAttemptId: string, executionId: string): Promise<PendingAttemptAbandonmentDecision>;
+  abandonPendingAttempt(executionAttemptId: string, executionId: ExecutionOwnerId): Promise<PendingAttemptAbandonmentDecision>;
   /**
    * Recovery operations, present only on a recovery-capable repository.
    *
@@ -1047,10 +1858,10 @@ interface ExecutionAttemptRecoveryOperations {
    * same millisecond from ordering differently on two stores. An
    * implementation that returned an arbitrary order would make a caller that
    * bounds its pass reclaim a different subset on each realization.
-   * @param executionId - Workflow execution identifier.
+   * @param executionId - Owner identifier the attempts belong to.
    * @returns Allocated, non-settled attempts eligible for recovery, oldest first.
    */
-  getRecoverableAttempts(executionId: string): Promise<readonly RecoverableAttemptRecord[]>;
+  getRecoverableAttempts(executionId: ExecutionOwnerId): Promise<readonly RecoverableAttemptRecord[]>;
 }
 //#endregion
-export { RecoverableAttemptRecord as A, ProvisioningClaimDecision as C, RecordProviderOperationUncertaintyInput as D, RecordInfrastructureFailureInput as E, TakeOverProviderOperationInput as M, sameAllocationRef as N, RecordProvisionerIncarnationLostInput as O, sameWorkflowResult as P, ProvisioningAbsenceDecision as S, RecordAllocationTerminatedInput as T, ExecutionAttemptStatus as _, BeginProvisioningInput as a, PendingAttemptAbandonmentDecision as b, EXECUTION_ATTEMPT_SETTLEMENT_KINDS as c, ExecutionAttemptOutcomeCommit as d, ExecutionAttemptOutcomeDecision as f, ExecutionAttemptSettlementKind as g, ExecutionAttemptRepository as h, AllocationTerminationDecision as i, RenewProviderOperationClaimInput as j, RecordProvisioningAbsentInput as k, EXECUTION_ATTEMPT_STATUSES as l, ExecutionAttemptRecoveryOperations as m, AllocationRefEvolution as n, DiscoveredAllocationDecision as o, ExecutionAttemptRecord as p, AllocationRefEvolutionDecision as r, DuplicateExecutionAttemptError as s, AllocationRecordingDecision as t, ExecutionAttemptCreate as u, HandoffProviderOperationInput as v, RecordAllocationInput as w, ProvisionerIncarnationLossDecision as x, InfrastructureFailureDecision as y };
+export { OutcomeCodec as A, RecordProvisioningAbsentInput as B, ExecutionAttemptStatus as C, MarkRuntimeReadyInput as D, InfrastructureFailureDecision as E, RecordAllocationInput as F, RuntimeRegistrationDecision as G, RegisterRuntimeInput as H, RecordAllocationTerminatedInput as I, durableOutcome as J, TakeOverProviderOperationInput as K, RecordInfrastructureFailureInput as L, ProvisionerIncarnationLossDecision as M, ProvisioningAbsenceDecision as N, OperationAdmissionDecision as O, ProvisioningClaimDecision as P, RecordProviderOperationUncertaintyInput as R, ExecutionAttemptSettlementKind as S, HandoffProviderOperationInput as T, RenewProviderOperationClaimInput as U, RecoverableAttemptRecord as V, RuntimeReadinessDecision as W, sameDurableOutcome as X, sameAllocationRef as Y, ExecutionAttemptOutcomeCommit as _, AllocationRefEvolutionDecision as a, ExecutionAttemptRecoveryOperations as b, AttemptOperationStartGate as c, DiscoveredAllocationDecision as d, DuplicateExecutionAttemptError as f, ExecutionAttemptCreate as g, EXECUTION_ATTEMPT_STATUSES as h, AllocationRefEvolution as i, PendingAttemptAbandonmentDecision as j, OperationCompletionDecision as k, BeginProvisioningInput as l, EXECUTION_ATTEMPT_SETTLEMENT_KINDS as m, AdmitOperationInput as n, AllocationTerminationDecision as o, DurableOutcome as p, decodeDurableOutcome as q, AllocationRecordingDecision as r, AttemptControlState as s, ATTEMPT_OPERATION_START_GATES as t, CompleteOperationInput as u, ExecutionAttemptOutcomeDecision as v, ExecutionOwnerId as w, ExecutionAttemptRepository as x, ExecutionAttemptRecord as y, RecordProvisionerIncarnationLostInput as z };