@makaio/framework 1.0.0-dev-1788897280508 → 1.0.0-dev-1788914730846

package/dist/{execution-attempt-repository-CtFZfBfp.d.mts → execution-attempt-repository-dE889kHj.d.mts}

@@ -1,4 +1,3 @@
-import { a as ProviderOperationClaim, i as ProcessBoundProvisionerLossProof, l as ProviderOperationOwnershipRecord, o as ProviderOperationClaimDecision, s as ProviderOperationMutationDecision } from "./provider-operation-BwrIrOeY.mjs";
 import { BoundedRecoveryEvidence, ExecutionAttemptInstruction, ExecutionAttemptOperationKind, ExecutionAttemptOperationReportRequest, ExecutionAttemptOperationReportResponse, ExecutionAttemptPreparationResult, ExecutionAttemptWorkspaceBinding, ProviderAllocationRef, WorkerAllocationLifetime } from "@makaio/framework/contracts";
 
 //#region subsystems/workflow-engine/src/execution-attempt-owner-recovery.d.ts
@@ -109,6 +108,453 @@ declare function replayEnsuredAttempt(input: EnsureExecutionAttemptInput, boundA
  */
 declare function readAttemptSettlementSnapshot<TOutcome>(input: ReadAttemptSettlementInput, snapshot: AttemptSettlementSnapshot, codec: OutcomeCodec<TOutcome>): AttemptSettlementRead<TOutcome>;
 //#endregion
+//#region subsystems/workflow-engine/src/provider-operation.d.ts
+/**
+ * Provider-operation ownership protocol.
+ *
+ * An execution attempt owns canonical workflow state. A *provider operation*
+ * is the separate, fenced record of who is currently allowed to act on that
+ * attempt's provider-side infrastructure, and what remediation debt is still
+ * outstanding for it. Completion is a separate, positive fact: an attempt
+ * settlement cannot prove that the provider has released its allocation.
+ *
+ * The two records are deliberately distinct:
+ * - the attempt answers "what is the canonical workflow answer?";
+ * - the operation answers "who may talk to the provider right now, and what
+ *   does that provider still owe us?".
+ *
+ * Worker outcome commitment is therefore independent of operation ownership:
+ * a worker that produces a result never needs a claim.
+ * @packageDocumentation
+ */
+/**
+ * Outstanding provider-side debt for one execution attempt.
+ *
+ * - `provisioning-resolution`: a provider call was authorized but no
+ *   allocation is known yet. Either an allocation exists and must be found,
+ *   or its absence must be positively proven.
+ * - `allocation-control`: an allocation reference is known and the operation
+ *   owns its infrastructure lifecycle.
+ * - `terminal-convergence`: a known allocation has been confirmed terminated,
+ *   and the attempt still needs a canonical workflow answer.
+ */
+type ProviderOperationObligation = 'provisioning-resolution' | 'allocation-control' | 'terminal-convergence';
+/**
+ * Ordered constant array of every provider-operation obligation.
+ *
+ * The order is the monotonic progression an operation may follow. A stored
+ * obligation never moves backwards, and callers never supply it: the durable
+ * repository derives it from the transition being applied.
+ */
+declare const PROVIDER_OPERATION_OBLIGATIONS: readonly ["provisioning-resolution", "allocation-control", "terminal-convergence"];
+/**
+ * Proof that the holder currently owns an attempt's provider operation.
+ *
+ * A claim is the only authorization for a provider-side evidence mutation.
+ * It is fenced on two axes: `generation` advances on every takeover, and
+ * `token` is reissued with it, so a claim from a superseded owner is rejected
+ * even if that owner's lease has not visibly expired yet.
+ *
+ * `ownerId` identifies a controller *process incarnation*. It is not a
+ * machine identifier, a workflow node identifier, an execution identifier,
+ * or a security principal.
+ */
+interface ProviderOperationClaim {
+  /** Attempt whose provider operation this claim authorizes. */
+  readonly executionAttemptId: string;
+  /** Ownership generation this claim was issued for. */
+  readonly generation: number;
+  /** Controller process incarnation that holds the claim. */
+  readonly ownerId: string;
+  /** Opaque fencing token issued by the durable repository. */
+  readonly token: string;
+  /**
+   * Instant after which the lease may be taken over.
+   *
+   * Canonical UTC ISO-8601 with millisecond precision, as issued by the
+   * durable repository, and ordered as an instant rather than as text.
+   */
+  readonly leaseExpiresAt: string;
+}
+/**
+ * Durable ownership and remediation state for one attempt's provider operation.
+ *
+ * Until {@link isProviderOperationResolved} returns `true`, `ownerId`,
+ * `token`, and `leaseExpiresAt` describe the current claim and are all `null`
+ * when the operation is unowned. Positive completion evidence may be recorded
+ * before the attempt settles; that evidence is immutable, but it does not
+ * freeze the live claim or make the operation ineligible for recovery. Once
+ * the operation is resolved, the fields retain the final control snapshot,
+ * which may be unowned after a handoff and is not proof-writing provenance.
+ * `generation` and `obligation` survive both handoff and completion.
+ *
+ * All fields are JSON-safe and non-secret. `lastFailure` holds bounded
+ * evidence only; plaintext credentials, stack traces, and raw provider
+ * responses never reach this record.
+ */
+interface ProviderOperationOwnershipRecord {
+  /** Attempt this operation belongs to. */
+  readonly executionAttemptId: string;
+  /** Monotonic ownership generation, incremented by every takeover. */
+  readonly generation: number;
+  /**
+   * Current controller process incarnation while unresolved, retained as the
+   * final control snapshot once {@link isProviderOperationResolved} returns
+   * `true`, or `null` when the operation is unowned.
+   */
+  readonly ownerId: string | null;
+  /**
+   * Current fencing token while unresolved, retained as the final control
+   * snapshot once {@link isProviderOperationResolved} returns `true`, or
+   * `null` when the operation is unowned.
+   */
+  readonly token: string | null;
+  /**
+   * Current lease deadline while unresolved, retained with the final control
+   * snapshot once {@link isProviderOperationResolved} returns `true`, or
+   * `null` when the operation is unowned.
+   */
+  readonly leaseExpiresAt: string | null;
+  /** Outstanding provider-side debt, owned by the durable repository. */
+  readonly obligation: ProviderOperationObligation;
+  /** Number of recorded uncertainty observations for this operation. */
+  readonly failureCount: number;
+  /** Most recent bounded evidence recorded against this operation. */
+  readonly lastFailure: BoundedRecoveryEvidence | null;
+  /**
+   * Positive, immutable proof that every provider-side responsibility for this
+   * operation is complete, or `null` while the proof has not been observed.
+   *
+   * This is deliberately independent of the attempt's settlement and of
+   * {@link obligation}: a settled attempt can still need provider cleanup, and
+   * an unsettled attempt with this proof stays recoverable until it has a
+   * canonical settlement.
+   */
+  readonly completionEvidence: BoundedRecoveryEvidence | null;
+}
+/**
+ * Whether an operation has both of the independent facts needed to resolve it.
+ *
+ * Provider evidence can arrive before an outcome. That fact must be retained,
+ * but it does not close control ownership: recovery may still need to hold or
+ * hand off the operation until the attempt settles. Conversely, settlement
+ * alone never proves provider work is complete.
+ * @param attempt - Minimal durable settlement fact from the attempt record.
+ * @param operation - Minimal positive provider-completion fact from the operation record.
+ * @returns Whether no provider-operation ownership or recovery work remains.
+ */
+declare function isProviderOperationResolved(attempt: Pick<ExecutionAttemptRecord, 'settlementKind'>, operation: Pick<ProviderOperationOwnershipRecord, 'completionEvidence'>): boolean;
+/**
+ * Durable decision for acquiring or extending provider-operation ownership.
+ *
+ * - `claimed`: the caller now holds the operation; the returned claim is the
+ *   only value that authorizes subsequent provider-side mutations.
+ * - `stale`: the request does not match durable ownership — a superseded
+ *   generation or token on renewal, or a lease that has not expired yet on
+ *   takeover. The caller must re-read before retrying.
+ * - `resolved`: positive completion evidence and attempt settlement were both
+ *   recorded, so there is nothing left to own. Neither fact alone produces
+ *   this decision.
+ * - `not-found`: no provider operation exists for the attempt.
+ */
+type ProviderOperationClaimDecision = {
+  readonly kind: 'claimed';
+  readonly claim: ProviderOperationClaim;
+} | {
+  readonly kind: 'stale';
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'not-found';
+};
+/**
+ * Durable decision for a claim-fenced mutation of provider-operation state.
+ *
+ * - `recorded`: the mutation was applied.
+ * - `stale`: the caller's view of durable state is out of date — either the
+ *   claim no longer matches the stored generation/token, or the stored
+ *   obligation cannot make the requested transition. In both cases the
+ *   caller must re-read; it may not pick a different write path instead.
+ * - `resolved`: positive completion evidence and attempt settlement were both
+ *   recorded, so the operation is closed.
+ * - `not-found`: no provider operation exists for the attempt.
+ */
+type ProviderOperationMutationDecision = {
+  readonly kind: 'recorded';
+} | {
+  readonly kind: 'stale';
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'not-found';
+};
+/**
+ * Durable decision for recording positive completion of a provider operation.
+ *
+ * Completion evidence is immutable once written. The repository validates the
+ * current claim before recording it, and no later call can replace the first
+ * proof. `evidence-recorded` means the evidence is durable but the attempt
+ * remains unsettled, so the operation stays recoverable. `completed` means
+ * the same write also resolves the operation because the attempt was already
+ * settled. Replaying after evidence exists but before settlement returns
+ * `evidence-recorded`; replaying after resolution returns `already-completed`.
+ */
+type ProviderOperationCompletionDecision = {
+  readonly kind: 'evidence-recorded';
+} | {
+  readonly kind: 'completed';
+} | {
+  readonly kind: 'already-completed';
+} | {
+  readonly kind: 'stale';
+} | {
+  readonly kind: 'not-found';
+};
+/**
+ * Durable decision for recording positively proven pre-allocation absence.
+ *
+ * - `recorded`: absence evidence was stored and the same positive proof
+ *   completed the operation while newly settling the attempt as `abandoned`.
+ * - `completed`: absence evidence was stored and completed the operation, but
+ *   an existing canonical settlement was preserved — all in one transaction.
+ * - `allocated`: an allocation won the race. Absence must never terminalize
+ *   an attempt that owns live infrastructure.
+ * - `resolved`: positive provider completion evidence and attempt settlement
+ *   were already recorded.
+ * - `stale`: the claim no longer matches durable ownership.
+ * - `not-found`: no provider operation exists for the attempt.
+ */
+type ProvisioningAbsenceDecision = {
+  readonly kind: 'recorded';
+} | {
+  readonly kind: 'completed';
+} | {
+  readonly kind: 'allocated';
+  readonly allocationRef: ProviderAllocationRef;
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'stale';
+} | {
+  readonly kind: 'not-found';
+};
+/**
+ * Durable decision for closing pre-allocation debt on proven loss of the
+ * provisioner process incarnation.
+ *
+ * The counterpart of {@link ProvisioningAbsenceDecision} for the one lifetime
+ * where nothing needs to be observed to conclude: a
+ * `provisioner-process-bound` allocation cannot outlive the process that
+ * created it, so proof that the exact recorded incarnation is gone is proof
+ * that no allocation survives. Every refusal below is a statement about why the
+ * proof does not apply, and each is reported distinctly because they oblige the
+ * caller to do different things.
+ *
+ * - `recorded`: the proof was stored and the same positive proof completed the
+ *   operation while newly settling the attempt as `abandoned`.
+ * - `completed`: the proof was stored and completed the operation, but an
+ *   existing canonical settlement was preserved — all in one transaction.
+ * - `not-process-bound`: the attempt's recorded lifetime is not
+ *   `provisioner-process-bound`, so losing a process says nothing about its
+ *   allocation. The reported lifetime is the stored one, `null` before
+ *   provisioning began.
+ * - `incarnation-mismatch`: the proof names a different provisioner
+ *   incarnation, or the attempt has none recorded, so the proof says nothing
+ *   about this attempt. The reported identifier is the stored one.
+ * - `allocated`: an allocation is already recorded, so the attempt owes
+ *   allocation control rather than pre-allocation closure. Terminate the known
+ *   allocation instead of closing the attempt from a proof.
+ * - `resolved`: positive provider completion evidence and attempt settlement
+ *   were already recorded.
+ * - `stale`: the claim no longer matches durable ownership.
+ * - `not-found`: no provider operation exists for the attempt, or it does not
+ *   belong to the named execution.
+ */
+type ProvisionerIncarnationLossDecision = {
+  readonly kind: 'recorded';
+} | {
+  readonly kind: 'completed';
+} | {
+  readonly kind: 'not-process-bound';
+  readonly allocationLifetime: WorkerAllocationLifetime | null;
+} | {
+  readonly kind: 'incarnation-mismatch';
+  readonly provisionerIncarnationId: string | null;
+} | {
+  readonly kind: 'allocated';
+  readonly allocationRef: ProviderAllocationRef;
+} | {
+  readonly kind: 'resolved';
+} | {
+  readonly kind: 'stale';
+} | {
+  readonly kind: 'not-found';
+};
+/** Input for extending the lease of a currently held provider operation. */
+interface RenewProviderOperationClaimInput {
+  /** Claim the caller currently believes it holds. */
+  readonly claim: ProviderOperationClaim;
+  /** New ISO-8601 lease deadline. */
+  readonly leaseExpiresAt: string;
+}
+/**
+ * Input for taking ownership of an unowned or expired provider operation.
+ *
+ * Takeover needs no prior claim — that is the point. It succeeds only when
+ * the operation is unowned or its lease has expired relative to `observedAt`,
+ * and it always increments the generation so every claim issued before it is
+ * fenced immediately.
+ */
+interface TakeOverProviderOperationInput {
+  /** Attempt whose provider operation is being taken over. */
+  readonly executionAttemptId: string;
+  /** Controller process incarnation requesting ownership. */
+  readonly ownerId: string;
+  /** ISO-8601 observation time used to evaluate lease expiry. */
+  readonly observedAt: string;
+  /** ISO-8601 deadline for the new lease. */
+  readonly leaseExpiresAt: string;
+}
+/**
+ * Input for releasing a held provider operation without resolving it.
+ *
+ * Handoff is a graceful release, not a failure: optional evidence explains
+ * why control was released but does not count towards the failure total.
+ */
+interface HandoffProviderOperationInput {
+  /** Claim being released. */
+  readonly claim: ProviderOperationClaim;
+  /** Optional bounded evidence explaining the release. */
+  readonly evidence?: BoundedRecoveryEvidence;
+}
+/**
+ * Input for recording that a provider observation stayed inconclusive.
+ *
+ * Uncertainty is the only honest record for an ambiguous provider result. It
+ * retains the current obligation and never terminalizes the attempt.
+ */
+interface RecordProviderOperationUncertaintyInput {
+  /** Claim authorizing the record. */
+  readonly claim: ProviderOperationClaim;
+  /** Bounded evidence describing what blocked a conclusion. */
+  readonly evidence: BoundedRecoveryEvidence;
+}
+/** Input for recording positive completion evidence of a provider operation. */
+interface CompleteProviderOperationInput {
+  /** Claim that currently owns the provider operation. */
+  readonly claim: ProviderOperationClaim;
+  /** Bounded, durable, non-secret proof that provider work is complete. */
+  readonly evidence: BoundedRecoveryEvidence;
+}
+/** Bounded, caller-timed selector for provider operations eligible for takeover. */
+interface ListOpenProviderOperationsInput {
+  /** ISO-8601 instant at which the caller observed lease eligibility. */
+  readonly observedAt: string;
+  /** Positive safe-integer maximum number of records to return; no implicit default exists. */
+  readonly limit: number;
+}
+/**
+ * One provider operation that still needs infrastructure work.
+ *
+ * The joined shape returns the existing durable attempt and operation records
+ * rather than introducing another lifecycle ledger. The operation is open
+ * when {@link isProviderOperationResolved} returns `false`; its completion
+ * evidence and settlement may each be present independently.
+ */
+interface OpenProviderOperationRecord {
+  /** Attempt whose provider-side infrastructure remains open. */
+  readonly attempt: ExecutionAttemptRecord;
+  /** Open provider operation, including current or expired claim facts. */
+  readonly operation: ProviderOperationOwnershipRecord;
+}
+/**
+ * Controller identity and lease policy for an attempt's first claim.
+ *
+ * Supplied by the host, never invented by the code that dispatches work.
+ * A dispatcher knows which attempt it is starting; it does not know which
+ * process incarnation it belongs to or how long a lease should last.
+ */
+interface InitialProviderOperationClaimContext {
+  /** Controller process incarnation that will hold the initial claim. */
+  readonly ownerId: string;
+  /**
+   * Provisioner process incarnation that performs the provider call.
+   *
+   * Stable for the lifetime of the provisioning process. It is never
+   * regenerated per attempt: process-loss proof is only meaningful when the
+   * recorded incarnation identifies the process that actually provisioned.
+   */
+  readonly provisionerIncarnationId: string;
+  /** ISO-8601 deadline for the initial lease, per host lease policy. */
+  readonly leaseExpiresAt: string;
+}
+/**
+ * Host policy for renewing one live provider-operation claim.
+ *
+ * The policy supplies time only. The Authority remains the sole writer of the
+ * durable claim, so a host cannot turn a local timer into a second ownership
+ * protocol.
+ */
+interface ProviderOperationLeasePolicy {
+  /**
+   * State the next requested lease deadline and when local custody must renew.
+   * @param claim - Current durable claim whose lease is still held locally.
+   * @returns Next durable deadline and the host-chosen delay before renewal.
+   */
+  nextRenewal(claim: ProviderOperationClaim): ProviderOperationLeaseRenewal;
+}
+/** Host-selected schedule for one claim renewal. */
+interface ProviderOperationLeaseRenewal {
+  /** ISO-8601 deadline requested from the durable Authority on renewal. */
+  readonly leaseExpiresAt: string;
+  /** Positive delay in milliseconds after which local custody must renew. */
+  readonly renewAfterMs: number;
+}
+/**
+ * Host seam that produces the initial claim context for an attempt.
+ *
+ * Hosts implement this to inject controller identity and lease policy.
+ * There is deliberately no default implementation and no default lease
+ * duration: a hidden default would silently attach remediation authority to
+ * an anonymous owner.
+ */
+interface InitialProviderOperationClaimContextSource extends ProviderOperationLeasePolicy {
+  /**
+   * Produce the initial claim context for one attempt about to be provisioned.
+   * @param input - Execution, attempt, and provider the claim is being created for.
+   * @param signal - AbortSignal for cooperative cancellation.
+   * @returns Controller identity, provisioner incarnation, and lease deadline.
+   */
+  create(input: {
+    /** Workflow execution identifier. */readonly executionId: string; /** Attempt identifier the claim is created for. */
+    readonly executionAttemptId: string; /** Provider identifier that will be bound to the attempt. */
+    readonly providerId: string;
+  }, signal: AbortSignal): Promise<InitialProviderOperationClaimContext>;
+}
+/**
+ * Positive proof that a specific provisioner process incarnation is gone.
+ *
+ * Only meaningful for attempts whose allocation lifetime is
+ * `provisioner-process-bound`: such an allocation cannot outlive the process
+ * that created it, so proving that process is gone proves the allocation is
+ * gone too.
+ *
+ * A remediator may act on this proof only when `provisionerIncarnationId`
+ * exactly equals the attempt's immutable `provisionerIncarnationId`. Proof
+ * naming a different incarnation says nothing about this attempt.
+ *
+ * An expired lease is never such proof: leases expire for slow controllers
+ * as readily as for dead ones.
+ */
+interface ProcessBoundProvisionerLossProof {
+  /** Discriminant for provisioner incarnation loss. */
+  readonly kind: 'provisioner-incarnation-lost';
+  /** Provisioner process incarnation this proof is about. */
+  readonly provisionerIncarnationId: string;
+  /** Bounded, durable, non-secret evidence supporting the loss claim. */
+  readonly evidence: BoundedRecoveryEvidence;
+}
+//#endregion
 //#region subsystems/workflow-engine/src/execution-attempt-decisions.d.ts
 /** Facts read coherently by a realization before decoding runtime control state. */
 interface AttemptReachability {
@@ -252,7 +698,8 @@ declare const ATTEMPT_OPERATION_START_GATES: readonly ["open", "closed"];
  *   guard.
  * - `closed`: the attempt will never admit another operation. Closing is
  *   one-way and happens exactly where the attempt stops being a place work may
- *   begin — when a newer attempt supersedes it, and when it settles.
+ *   begin — when a newer attempt supersedes it, when cancellation is requested,
+ *   and when it settles.
  */
 type AttemptOperationStartGate = (typeof ATTEMPT_OPERATION_START_GATES)[number];
 /** Coherent durable facts required before an attempt may enter runtime registration. */
@@ -300,6 +747,20 @@ declare function sameAllocationRef(stored: ProviderAllocationRef, candidate: Pro
  * workflow-storage lookup keys keep plain `string`.
  */
 type ExecutionOwnerId = string;
+/** A durable request to stop an attempt, never evidence that it stopped. */
+interface ExecutionAttemptCancellationIntent {
+  /** First accepted request time, preserved across duplicate requests and controller handoff. */
+  readonly requestedAt: string;
+  /** Optional owner-supplied explanation. */
+  readonly reason?: string;
+}
+/** Owner-scoped cancellation of attempts that exist when the request commits. */
+interface RequestExecutionCancellationInput {
+  /** Owner authorizing the cancellation of its existing attempts. */
+  readonly executionId: ExecutionOwnerId;
+  /** Explanation retained only when this is the first request for an attempt. */
+  readonly reason?: string;
+}
 /**
  * Compare two durable outcome texts as values.
  *
@@ -549,8 +1010,8 @@ interface AttemptControlState {
    * Whether the attempt still admits operations.
    *
    * `open` from creation. Closed by {@link ExecutionAttemptRepository.createAttempt}
-   * on the attempt it supersedes, and by every terminal settlement on the
-   * attempt it settles. Closing is one-way.
+   * on the attempt it supersedes, by an owner cancellation request, and by every
+   * terminal settlement on the attempt it settles. Closing is one-way.
    */
   readonly operationStartGate: AttemptOperationStartGate;
   /**
@@ -848,55 +1309,6 @@ declare class RuntimeOutcomeFenceMismatchError extends Error {
  * @throws RuntimeOutcomeFenceMismatchError when the originating runtime slot changed.
  */
 declare function assertRuntimeOutcomeFence(control: AttemptControlState, fence: RuntimeOutcomeFence | undefined): void;
-/** Input for extending the lease of a currently held provider operation. */
-interface RenewProviderOperationClaimInput {
-  /** Claim the caller currently believes it holds. */
-  readonly claim: ProviderOperationClaim;
-  /** New ISO-8601 lease deadline. */
-  readonly leaseExpiresAt: string;
-}
-/**
- * Input for taking ownership of an unowned or expired provider operation.
- *
- * Takeover needs no prior claim — that is the point. It succeeds only when
- * the operation is unowned or its lease has expired relative to `observedAt`,
- * and it always increments the generation so every claim issued before it is
- * fenced immediately.
- */
-interface TakeOverProviderOperationInput {
-  /** Attempt whose provider operation is being taken over. */
-  readonly executionAttemptId: string;
-  /** Controller process incarnation requesting ownership. */
-  readonly ownerId: string;
-  /** ISO-8601 observation time used to evaluate lease expiry. */
-  readonly observedAt: string;
-  /** ISO-8601 deadline for the new lease. */
-  readonly leaseExpiresAt: string;
-}
-/**
- * Input for releasing a held provider operation without resolving it.
- *
- * Handoff is a graceful release, not a failure: optional evidence explains
- * why control was released but does not count towards the failure total.
- */
-interface HandoffProviderOperationInput {
-  /** Claim being released. */
-  readonly claim: ProviderOperationClaim;
-  /** Optional bounded evidence explaining the release. */
-  readonly evidence?: BoundedRecoveryEvidence;
-}
-/**
- * Input for recording that a provider observation stayed inconclusive.
- *
- * Uncertainty is the only honest record for an ambiguous provider result. It
- * retains the current obligation and never terminalizes the attempt.
- */
-interface RecordProviderOperationUncertaintyInput {
-  /** Claim authorizing the record. */
-  readonly claim: ProviderOperationClaim;
-  /** Bounded evidence describing what blocked a conclusion. */
-  readonly evidence: BoundedRecoveryEvidence;
-}
 /** Input for recording an allocation reference against a held operation. */
 interface RecordAllocationInput {
   /** Claim authorizing the record. */
@@ -1076,9 +1488,10 @@ interface MarkRuntimeReadyInput {
  * - `already-provisioning`: a begin already succeeded for this attempt. The
  *   caller must converge the existing operation instead of calling again.
  * - `allocated`: an allocation is already recorded for this attempt.
- * - `resolved`: the attempt has settled; the operation is closed.
+ * - `resolved`: the attempt has settled, so it cannot begin provisioning.
  * - `fenced`: the attempt exists but is no longer the active attempt for its
- *   execution, so it may not bootstrap a new provider call.
+ *   execution, or its operation start gate is closed by cancellation, so it
+ *   may not bootstrap a new provider call.
  * - `not-found`: no such attempt for the given execution.
  */
 type ProvisioningClaimDecision = {
@@ -1109,7 +1522,8 @@ type ProvisioningClaimDecision = {
  * - `duplicate`: a reference {@link sameAllocationRef} judges identical was
  *   already stored; this is a replay.
  * - `conflict`: a different reference is already stored for this attempt.
- * - `resolved`: the attempt has settled; the operation is closed.
+ * - `resolved`: positive provider completion evidence and attempt settlement
+ *   were already recorded.
  * - `stale`: the claim no longer matches durable ownership.
  * - `not-found`: no provider operation exists for the attempt.
  */
@@ -1137,76 +1551,6 @@ type AllocationRecordingDecision = {
  * discovered allocation never makes its attempt bootstrap-claimable.
  */
 type DiscoveredAllocationDecision = AllocationRecordingDecision;
-/**
- * Durable decision for recording positively proven pre-allocation absence.
- *
- * - `recorded`: absence evidence was stored, the attempt settled as
- *   `abandoned`, and the operation closed — all in one transaction.
- * - `allocated`: an allocation won the race. Absence must never terminalize
- *   an attempt that owns live infrastructure.
- * - `resolved`: the attempt has already settled; the operation is closed.
- * - `stale`: the claim no longer matches durable ownership.
- * - `not-found`: no provider operation exists for the attempt.
- */
-type ProvisioningAbsenceDecision = {
-  readonly kind: 'recorded';
-} | {
-  readonly kind: 'allocated';
-  readonly allocationRef: ProviderAllocationRef;
-} | {
-  readonly kind: 'resolved';
-} | {
-  readonly kind: 'stale';
-} | {
-  readonly kind: 'not-found';
-};
-/**
- * Durable decision for closing pre-allocation debt on proven loss of the
- * provisioner process incarnation.
- *
- * The counterpart of {@link ProvisioningAbsenceDecision} for the one lifetime
- * where nothing needs to be observed to conclude: a
- * `provisioner-process-bound` allocation cannot outlive the process that
- * created it, so proof that the exact recorded incarnation is gone is proof
- * that no allocation survives. Every refusal below is a statement about why the
- * proof does not apply, and each is reported distinctly because they oblige the
- * caller to do different things.
- *
- * - `recorded`: the proof was stored, the attempt settled as `abandoned`, and
- *   the operation closed — all in one transaction.
- * - `not-process-bound`: the attempt's recorded lifetime is not
- *   `provisioner-process-bound`, so losing a process says nothing about its
- *   allocation. The reported lifetime is the stored one, `null` before
- *   provisioning began.
- * - `incarnation-mismatch`: the proof names a different provisioner
- *   incarnation, or the attempt has none recorded, so the proof says nothing
- *   about this attempt. The reported identifier is the stored one.
- * - `allocated`: an allocation is already recorded, so the attempt owes
- *   allocation control rather than pre-allocation closure. Terminate the known
- *   allocation instead of closing the attempt from a proof.
- * - `resolved`: the attempt has already settled; the operation is closed.
- * - `stale`: the claim no longer matches durable ownership.
- * - `not-found`: no provider operation exists for the attempt, or it does not
- *   belong to the named execution.
- */
-type ProvisionerIncarnationLossDecision = {
-  readonly kind: 'recorded';
-} | {
-  readonly kind: 'not-process-bound';
-  readonly allocationLifetime: WorkerAllocationLifetime | null;
-} | {
-  readonly kind: 'incarnation-mismatch';
-  readonly provisionerIncarnationId: string | null;
-} | {
-  readonly kind: 'allocated';
-  readonly allocationRef: ProviderAllocationRef;
-} | {
-  readonly kind: 'resolved';
-} | {
-  readonly kind: 'stale';
-} | {
-  readonly kind: 'not-found';
-};
 /**
  * Durable decision for settling an allocated attempt as an infrastructure
  * failure.
@@ -1214,8 +1558,8 @@ type ProvisionerIncarnationLossDecision = {
  * This terminal CAS competes with outcome submission; the first durable
  * transition wins and the loser observes `resolved`.
  *
- * - `recorded`: the failure was persisted, the attempt settled, and the
- *   operation closed.
+ * - `recorded`: the failure was persisted and the attempt settled. The
+ *   provider operation remains open until positive completion is recorded.
  * - `resolved`: the attempt already has a terminal settlement.
  * - `not-allocated`: the attempt owns no allocation, so it cannot have
  *   suffered an infrastructure failure. Prove absence instead.
@@ -1256,7 +1600,8 @@ type InfrastructureFailureDecision = {
  * - `not-allocated`: the claim is current, but no allocation is known for the
  *   attempt. Prove absence instead of claiming termination.
  * - `stale`: the claim no longer matches durable ownership.
- * - `resolved`: the attempt has settled, so the operation is closed.
+ * - `resolved`: positive provider completion evidence and attempt settlement
+ *   were already recorded.
  * - `not-found`: no provider operation exists for the attempt.
  */
 type AllocationTerminationDecision = ProviderOperationMutationDecision | {
@@ -1269,7 +1614,8 @@ type AllocationTerminationDecision = ProviderOperationMutationDecision | {
  * - `stale`: the caller's view is out of date — either `currentRef` does not
  *   match the stored reference, or the claim no longer matches durable
  *   ownership. `storedRef` carries the current reference when one exists.
- * - `resolved`: the attempt has settled; the operation is closed.
+ * - `resolved`: positive provider completion evidence and attempt settlement
+ *   were already recorded.
  * - `not-allocated`: the attempt has no allocation to evolve.
  * - `not-found`: no provider operation exists for the attempt.
  */
@@ -1554,10 +1900,11 @@ type RuntimeReadinessDecision = {
  * ```text
  * begin                       => provisioning-resolution
  * record allocation/discovery => allocation-control
- * record confirmed absence    => settled(abandoned) + operation closed
- * prove provisioner loss      => settled(abandoned) + operation closed
+ * record confirmed absence    => provider completion + settle(abandoned) if unsettled
+ * prove provisioner loss      => provider completion + settle(abandoned) if unsettled
  * record termination          => terminal-convergence
- * infrastructure failure CAS  => settled(infrastructure-failure) + closed
+ * infrastructure failure CAS  => settled(infrastructure-failure)
+ * complete provider operation => durable positive evidence; resolves with settlement
  * uncertainty                 => retain current obligation
  * ```
  *
@@ -1611,7 +1958,7 @@ type RuntimeReadinessDecision = {
  *
  * An operation stays remediable after its attempt stops being the active
  * attempt for its execution. Claim-fenced discovery, absence, cleanup, and
- * terminal convergence may update such an attempt and close its operation,
+ * terminal convergence may update such an attempt and complete its operation,
  * but must never change which attempt is active, reactivate it, or make it
  * bootstrap-claimable.
  *
@@ -1687,6 +2034,22 @@ type RuntimeReadinessDecision = {
  * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
  */
 interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepository<TOutcome> {
+  /**
+   * Persist first-wins cancellation intent and close operation start gates atomically
+   * for every existing attempt of this owner, including historical allocations.
+   * This does not settle an attempt or confirm provider termination. The owner must
+   * prevent later attempts after cancellation; this port does not install a permanent
+   * owner-wide creation fence. Repeated requests preserve the first time and reason.
+   * @param input - Owner identity and optional explanation, snapshotted before awaiting.
+   */
+  requestCancellation(input: RequestExecutionCancellationInput): Promise<void>;
+  /**
+   * Read replayable cancellation intent independently of controller ownership.
+   * Intent is never cleared merely because a controller delivered a cancel call.
+   * @param executionAttemptId - Attempt whose provider control is being adopted.
+   * @returns First accepted intent, or null when absent (including an unknown attempt).
+   */
+  readCancellation(executionAttemptId: string): Promise<ExecutionAttemptCancellationIntent | null>;
   /**
    * Persist a new execution attempt record.
    *
@@ -1787,10 +2150,10 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
   /**
    * Take ownership of an unowned or lease-expired provider operation.
    *
-   * Succeeds only when the operation is unowned or its lease has expired at
-   * `observedAt`. On success the generation increments and a fresh token is
-   * issued, which fences every previously issued claim immediately. The
-   * obligation and accumulated evidence are preserved.
+   * Succeeds only when the unresolved operation is unowned or its lease has
+   * expired at `observedAt`. On success the generation increments and a fresh
+   * token is issued, which fences every previously issued claim immediately.
+   * The obligation and accumulated evidence are preserved.
    * @param input - Attempt identity, requesting owner, observation time, and lease deadline.
    * @returns The durable claim decision.
    */
@@ -1817,6 +2180,19 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
    * @returns The durable mutation decision.
    */
   recordProviderOperationUncertainty(input: RecordProviderOperationUncertaintyInput): Promise<ProviderOperationMutationDecision>;
+  /**
+   * Record positive completion evidence of a provider operation.
+   *
+   * The repository validates the current claim before it records the first
+   * immutable evidence. A current claim may persist that evidence before
+   * settlement; it does not discard a pending `terminal-convergence` duty or
+   * create a canonical attempt answer. The operation becomes resolved only
+   * when durable settlement and completion evidence are both present; until
+   * then its claim remains live and it stays eligible for recovery.
+   * @param input - Current provider-operation claim and bounded completion proof.
+   * @returns The durable completion or a fenced/idempotent refusal.
+   */
+  completeProviderOperation(input: CompleteProviderOperationInput): Promise<ProviderOperationCompletionDecision>;
   /**
    * Record the provider allocation reference for a claimed operation.
    *
@@ -1839,10 +2215,14 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
   /**
    * Record positively proven absence of any allocation for the attempt.
    *
-   * The atomic terminal CAS for the pre-allocation case: it stores bounded
-   * absence evidence, settles the attempt as `abandoned`, and closes the
-   * operation in one transaction. It never produces `terminal-convergence` —
-   * that obligation is reserved for a known allocation whose termination was
+   * The atomic positive-proof transition for the pre-allocation case: it stores
+   * bounded absence evidence and completes the operation in one transaction.
+   * It settles an unsettled attempt as `abandoned`, but never replaces an
+   * existing canonical settlement. Its decision distinguishes a newly written
+   * abandonment (`recorded`) from preserving an existing settlement
+   * (`completed`), so an Authority can preserve an outcome waiter that still
+   * needs owner convergence. It never produces `terminal-convergence` — that
+   * obligation is reserved for a known allocation whose termination was
    * already confirmed.
    * @param input - Claim, owning execution, and bounded absence evidence.
    * @returns The durable absence decision.
@@ -1851,9 +2231,9 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
   /**
    * Close pre-allocation debt on proof that a provisioner incarnation is gone.
    *
-   * The atomic terminal CAS for an attempt whose allocation could not have
-   * outlived its provisioner. It exists because such an attempt has no other
-   * reachable terminal state: its provider need not advertise recovery, so
+   * The atomic positive-proof transition for an attempt whose allocation could
+   * not have outlived its provisioner. It exists because such an attempt has
+   * no other reachable provider conclusion: its provider need not advertise recovery, so
    * there may be nothing to discover, inspect, or terminate, and
    * {@link abandonPendingAttempt} refuses an attempt that already began
    * provisioning.
@@ -1866,9 +2246,11 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
    * statement about the attempt rather than about the caller's view of it. An
    * expired lease can never satisfy either check.
    *
-   * On success it stores the proof's bounded evidence, settles the attempt as
-   * `abandoned`, and closes the operation in one transaction. `abandoned` is
-   * the honest kind: no allocation was ever recorded for the attempt, so it
+   * On success it stores the proof's bounded evidence and completes the
+   * operation in one transaction. If the attempt is still unsettled it also
+   * settles it as `abandoned`; otherwise it preserves the existing canonical
+   * settlement and returns `completed`, not `recorded`. `abandoned` is the
+   * honest new kind: no allocation was ever recorded for the attempt, so it
    * cannot have suffered an infrastructure failure in the sense
    * {@link recordInfrastructureFailure} defines.
    * @param input - Claim, owning execution, and the provisioner loss proof.
@@ -2052,7 +2434,8 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
    *
    * Deliberately claim-independent: a worker's canonical answer never depends
    * on who currently owns the attempt's provider operation. A successful
-   * commit settles the attempt and closes its operation.
+   * commit settles the attempt but leaves provider responsibilities open until
+   * positive completion evidence is recorded separately.
    *
    * The repository makes the durable decision in exactly this precedence
    * order. An implementation that reorders it is non-conforming, because each
@@ -2079,8 +2462,9 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
    *    {@link RuntimeOutcomeFenceMismatchError} without changing the attempt.
    *    Checking this in the same write prevents owner decoding/validation awaits
    *    from committing a startup failure against a replacement runtime.
-   * 5. `accepted` — the outcome becomes canonical, the attempt settles as
-   *    `outcome`, and its operation closes.
+   * 5. `accepted` — the outcome becomes canonical and the attempt settles as
+   *    `outcome`. Its provider operation remains open until positive completion
+   *    evidence is recorded separately.
    *
    * The submission arrives already rendered, as the {@link DurableOutcome} the
    * caller obtained from {@link canonicalizeOutcome}. An implementation
@@ -2123,12 +2507,12 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
 /**
  * Coherent recovery capability of the execution attempt port.
  *
- * Recovery is one indivisible capability: a repository implements all four
- * operations or none. Partial implementation is a type error because all four
+ * Recovery is one indivisible capability: a repository implements all five
+ * operations or none. Partial implementation is a type error because all five
  * are required members of this interface, exactly as they are on the provider
  * side of the same capability.
  *
- * The four exist together because a recovery pass needs all of them: it reads
+ * The five exist together because a recovery pass needs all of them: it reads
  * a superseded attempt, records what discovery found for it, refines the
  * reference as correlation narrows it, and lists what is still outstanding. A
  * repository that answered three of them would strand the pass at whichever
@@ -2203,6 +2587,20 @@ interface ExecutionAttemptRecoveryOperations {
    * @returns Allocated, non-settled attempts eligible for recovery, oldest first.
    */
   getRecoverableAttempts(executionId: ExecutionOwnerId): Promise<readonly RecoverableAttemptRecord[]>;
+  /**
+   * List open provider operations eligible for takeover, including ones whose
+   * attempts already settled.
+   *
+   * The query excludes only operations with both positive completion evidence
+   * and a settled attempt, plus those held by a lease that has not expired at
+   * the caller-supplied observation time. That filter happens before the
+   * bound, so active leases cannot hide eligible work behind a first page.
+   * Results are oldest first by the joined attempt's `createdAt` instant, ties
+   * broken by `executionAttemptId`.
+   * @param input - Explicit observation time and positive bounded result limit.
+   * @returns Joined open operations eligible for provider takeover, oldest first.
+   */
+  listOpenProviderOperations(input: ListOpenProviderOperationsInput): Promise<readonly OpenProviderOperationRecord[]>;
 }
 //#endregion
-export { RuntimeReadinessDecision as $, MarkRuntimeReadyInput as A, ReadBootstrapStartStateInput as B, ExecutionAttemptRepository as C, replayEnsuredAttempt as Ct, GetInstructionInput as D, ExecutionOwnerId as E, snapshotReadAttemptSettlementInput as Et, PendingAttemptAbandonmentDecision as F, RecordProvisionerIncarnationLostInput as G, RecordAllocationTerminatedInput as H, PreparationReceipt as I, RegisterRuntimeInput as J, RecordProvisioningAbsentInput as K, ProvisionerIncarnationLossDecision as L, OperationCompletionDecision as M, OperationReportDecision as N, HandoffProviderOperationInput as O, OutcomeCodec as P, RuntimeOutcomeFenceMismatchError as Q, ProvisioningAbsenceDecision as R, ExecutionAttemptRecoveryOperations as S, readAttemptSettlementSnapshot as St, ExecutionAttemptStatus as T, snapshotEnsureExecutionAttemptPersistenceInput as Tt, RecordInfrastructureFailureInput as U, RecordAllocationInput as V, RecordProviderOperationUncertaintyInput as W, ReportOperationInput as X, RenewProviderOperationClaimInput as Y, RuntimeOutcomeFence as Z, EXECUTION_ATTEMPT_STATUSES as _, AttemptSettlementSnapshot as _t, AllocationRefEvolutionDecision as a, sameAllocationRef as at, ExecutionAttemptOutcomeDecision as b, EnsureExecutionAttemptPersistenceInput as bt, AttemptExecutionState as c, AttemptReachabilityDecision as ct, BootstrapStartState as d, evaluateOperationCompletion as dt, RuntimeRegistrationDecision as et, CompleteOperationInput as f, evaluatePreparationReport as ft, EXECUTION_ATTEMPT_SETTLEMENT_KINDS as g, AttemptSettlementRead as gt, DurableOutcome as h, evaluateRuntimeRegistration as ht, AllocationRefEvolution as i, durableOutcome as it, OperationAdmissionDecision as j, InfrastructureFailureDecision as k, AttemptOperationStartGate as l, evaluateAttemptReachability as lt, DuplicateExecutionAttemptError as m, evaluateRuntimeReadiness as mt, AdmitOperationInput as n, assertRuntimeOutcomeFence as nt, AllocationTerminationDecision as o, sameDurableOutcome as ot, DiscoveredAllocationDecision as p, evaluateProvisionerIncarnationLoss as pt, RecoverableAttemptRecord as q, AllocationRecordingDecision as r, decodeDurableOutcome as rt, AttemptControlState as s, AttemptReachability as st, ATTEMPT_OPERATION_START_GATES as t, TakeOverProviderOperationInput as tt, BeginProvisioningInput as u, evaluateOperationAdmission as ut, ExecutionAttemptCreate as v, EnsureExecutionAttemptDecision as vt, ExecutionAttemptSettlementKind as w, snapshotEnsureExecutionAttemptInput as wt, ExecutionAttemptRecord as x, ReadAttemptSettlementInput as xt, ExecutionAttemptOutcomeCommit as y, EnsureExecutionAttemptInput as yt, ProvisioningClaimDecision as z };
+export { decodeDurableOutcome as $, MarkRuntimeReadyInput as A, RecordProviderOperationUncertaintyInput as At, RecordAllocationTerminatedInput as B, readAttemptSettlementSnapshot as Bt, ExecutionAttemptRecoveryOperations as C, ProviderOperationLeasePolicy as Ct, ExecutionOwnerId as D, ProviderOperationOwnershipRecord as Dt, ExecutionAttemptStatus as E, ProviderOperationObligation as Et, PendingAttemptAbandonmentDecision as F, AttemptSettlementSnapshot as Ft, RegisterRuntimeInput as G, RecordProvisionerIncarnationLostInput as H, snapshotEnsureExecutionAttemptInput as Ht, PreparationReceipt as I, EnsureExecutionAttemptDecision as It, RuntimeOutcomeFence as J, ReportOperationInput as K, ProvisioningClaimDecision as L, EnsureExecutionAttemptInput as Lt, OperationCompletionDecision as M, TakeOverProviderOperationInput as Mt, OperationReportDecision as N, isProviderOperationResolved as Nt, GetInstructionInput as O, ProvisionerIncarnationLossDecision as Ot, OutcomeCodec as P, AttemptSettlementRead as Pt, assertRuntimeOutcomeFence as Q, ReadBootstrapStartStateInput as R, EnsureExecutionAttemptPersistenceInput as Rt, ExecutionAttemptRecord as S, ProviderOperationCompletionDecision as St, ExecutionAttemptSettlementKind as T, ProviderOperationMutationDecision as Tt, RecordProvisioningAbsentInput as U, snapshotEnsureExecutionAttemptPersistenceInput as Ut, RecordInfrastructureFailureInput as V, replayEnsuredAttempt as Vt, RecoverableAttemptRecord as W, snapshotReadAttemptSettlementInput as Wt, RuntimeReadinessDecision as X, RuntimeOutcomeFenceMismatchError as Y, RuntimeRegistrationDecision as Z, EXECUTION_ATTEMPT_STATUSES as _, OpenProviderOperationRecord as _t, AllocationRefEvolutionDecision as a, evaluateAttemptReachability as at, ExecutionAttemptOutcomeCommit as b, ProviderOperationClaim as bt, AttemptExecutionState as c, evaluatePreparationReport as ct, BootstrapStartState as d, evaluateRuntimeRegistration as dt, durableOutcome as et, CompleteOperationInput as f, CompleteProviderOperationInput as ft, EXECUTION_ATTEMPT_SETTLEMENT_KINDS as g, ListOpenProviderOperationsInput as gt, DurableOutcome as h, InitialProviderOperationClaimContextSource as ht, AllocationRefEvolution as i, AttemptReachabilityDecision as it, OperationAdmissionDecision as j, RenewProviderOperationClaimInput as jt, InfrastructureFailureDecision as k, ProvisioningAbsenceDecision as kt, AttemptOperationStartGate as l, evaluateProvisionerIncarnationLoss as lt, DuplicateExecutionAttemptError as m, InitialProviderOperationClaimContext as mt, AdmitOperationInput as n, sameDurableOutcome as nt, AllocationTerminationDecision as o, evaluateOperationAdmission as ot, DiscoveredAllocationDecision as p, HandoffProviderOperationInput as pt, RequestExecutionCancellationInput as q, AllocationRecordingDecision as r, AttemptReachability as rt, AttemptControlState as s, evaluateOperationCompletion as st, ATTEMPT_OPERATION_START_GATES as t, sameAllocationRef as tt, BeginProvisioningInput as u, evaluateRuntimeReadiness as ut, ExecutionAttemptCancellationIntent as v, PROVIDER_OPERATION_OBLIGATIONS as vt, ExecutionAttemptRepository as w, ProviderOperationLeaseRenewal as wt, ExecutionAttemptOutcomeDecision as x, ProviderOperationClaimDecision as xt, ExecutionAttemptCreate as y, ProcessBoundProvisionerLossProof as yt, RecordAllocationInput as z, ReadAttemptSettlementInput as zt };