@mnemom/mnemom 0.17.34-next.3 → 0.17.34-next.4

package/dist/commands/agent-run.d.ts

@@ -42,6 +42,8 @@ export declare function liveGit(env: NodeJS.ProcessEnv): Git;
 /** A fresh clone on a job branch, plus a fresh, empty HOME for the phases. */
 export declare function prepareWorkspace(git: Git, cloneUrl: string, sessionId: string, root?: string): Promise<Workspace>;
 export declare function cleanupWorkspace(ws: Workspace): Promise<void>;
+/** Commits on the job branch that no origin ref has: the clone's base is origin's default branch. */
+export declare function commitsAhead(git: Git, ws: Workspace): Promise<number>;
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
 export declare function openPr(git: Git, fetch: FetchFn, token: string | null, repo: string, ws: Workspace, title: string, apiBase?: string): Promise<string>;
 /** merge_on_green: GitHub's auto-merge on the PR (squash). */

package/dist/commands/agent-run.js

@@ -138,6 +138,13 @@ async function github(fetch, token, method, path, body, apiBase) {
     }
     return { status: res.status, json };
 }
+/** Commits on the job branch that no origin ref has: the clone's base is origin's default branch. */
+export async function commitsAhead(git, ws) {
+    const n = Number(await git(ws.dir, ["rev-list", "--count", "HEAD", "--not", "--remotes=origin"]));
+    if (!Number.isInteger(n) || n < 0)
+        throw new Error(`git rev-list answered ${n}`);
+    return n;
+}
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
 export async function openPr(git, fetch, token, repo, ws, title, apiBase = GITHUB_BASES.api) {
     await git(ws.dir, ["push", "--quiet", "origin", `HEAD:refs/heads/${ws.branch}`]);
@@ -211,6 +218,7 @@ export function liveJobDeps(api, opts) {
         prepareWorkspace: (repo, sessionId) => prepareWorkspace(git, `${gh.web}/${repo}.git`, sessionId),
         runPhase: (inv, ws, modelUrl, signal) => runPhaseProcess(inv, ws, modelUrl, signal, opts.env),
         openPr: (repo, ws, title) => openPr(git, opts.fetch, token, repo, ws, title, gh.api),
+        commitsAhead: (ws) => commitsAhead(git, ws),
         enableAutoMerge: (prUrl) => enableAutoMerge(opts.fetch, token, prUrl, gh),
         cleanup: cleanupWorkspace,
     };

package/dist/commands/agent.js

@@ -48,7 +48,7 @@ import { isLoggedIn } from "../lib/auth.js";
 import { loadCliConfig } from "../lib/cli-config.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { experimentalNotice } from "../lib/experimental.js";
-import { conductReceiptFor } from "../lib/conduct-receipt.js";
+import { conductReceiptFor, RECEIPT_DEADLINE_MS, } from "../lib/conduct-receipt.js";
 import { fmt } from "../lib/format.js";
 import { askInput, askSelect, askYesNo, isInteractive } from "../lib/prompt.js";
 import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, } from "../lib/login-detect.js";
@@ -1518,28 +1518,39 @@ function launchTerminal(ctx) {
         child.on("exit", (code, signal) => {
             void (async () => {
                 // MNE-8245: best-effort revoke of the minted session-scoped key — a failure
-                // here is non-fatal (the key is 24h-TTL'd regardless); never blocks exit.
-                if (ctx.sessionKeyId) {
-                    await revokeSessionGatewayKey(defaultSessionKeyDeps(say), ctx.sessionKeyId);
-                }
+                // here is non-fatal (the key is 24h-TTL'd regardless). It starts now and is awaited only
+                // before the process ends; with a receipt to print it shares the receipt's deadline, so
+                // with the API down the two bounds overlap instead of adding up (W1.3).
                 // A lock handover SIGKILLs the frozen claude once the daemon's seat runs the conversation:
                 // attach to it instead of dying with the child (C02-R26 step 7). Never relaunches claude.
                 const h = ctx.durableHandover;
-                if (mayBeHandover(h !== undefined, signal) && h) {
+                const handover = mayBeHandover(h !== undefined, signal);
+                // Only an exit that goes straight to the receipt shortens the revoke; a signal or a
+                // handover prints none, so it keeps the full bound.
+                const sharesReceiptDeadline = Boolean(ctx.receipt) && !signal && !handover;
+                const revoked = ctx.sessionKeyId
+                    ? revokeSessionGatewayKey({
+                        ...defaultSessionKeyDeps(say),
+                        ...(sharesReceiptDeadline ? { revokeTimeoutMs: RECEIPT_DEADLINE_MS } : {}),
+                    }, ctx.sessionKeyId)
+                    : Promise.resolve();
+                if (handover && h) {
+                    await revoked;
                     const attached = await liveParentAfterChildEnded(h.row, h.name, h.launcherKey, savedTty);
                     if (attached !== null)
                         process.exit(attached);
                 }
                 if (signal) {
+                    await revoked;
                     process.kill(process.pid, signal);
                     return;
                 }
-                // The conduct receipt and the last commit sweep run side by side, each under its own
-                // hard deadline inside W1.3's exit budget; neither changes the exit code.
+                // The revoke, the conduct receipt and the last commit sweep run side by side, each under
+                // its own hard deadline inside W1.3's exit budget; none changes the exit code.
                 const swept = commits?.finish().catch(() => undefined);
                 if (ctx.receipt)
                     await sayConductReceipt({ ...ctx.receipt, statePath: recordStatePath });
-                await swept;
+                await Promise.all([swept, revoked]);
                 // Claude Code's own last line is "Resume this session with: claude --resume <id>",
                 // which reopens it OUTSIDE Mnemom (ungoverned, unbilled). Ours goes after it, last.
                 if (code === 0 && ctx.resumeHint && wantsResumeHint(ctx.cli, args)) {

package/dist/lib/runner/job.d.ts

@@ -43,6 +43,8 @@ export interface JobDeps {
     runPhase(inv: PhaseInvocation, ws: Workspace, modelUrl: string, signal: AbortSignal): Promise<number>;
     /** Push the job branch and open its PR; resolves the PR URL. */
     openPr(repo: string, ws: Workspace, title: string): Promise<string>;
+    /** Commits on the job branch that the base does not have; 0 means there is nothing to open. */
+    commitsAhead(ws: Workspace): Promise<number>;
     enableAutoMerge(prUrl: string): Promise<void>;
     cleanup(ws: Workspace): Promise<void>;
 }

package/dist/lib/runner/job.js

@@ -348,6 +348,12 @@ export async function runJob(sessionId, opts, deps) {
         }
         if (opensPr) {
             try {
+                // Checked before the push, so an empty diff never reaches GitHub's 422 (amendment 59).
+                if ((await deps.commitsAhead(ws)) === 0) {
+                    deps.log("no commits ahead of the base: there is no PR to open");
+                    await reportFail(deps, sessionId, claim.epoch, "runner_failed", "pr_no_changes");
+                    return { kind: "outcome", outcome: failedOutcome(facts, "pr_no_changes") };
+                }
                 facts.pr_url = await deps.openPr(job.repo, ws, `mnemom: ${bundle.workflow.id} job ${sessionId.slice(0, 8)}`);
             }
             catch (e) {
@@ -477,8 +483,17 @@ export async function reportFail(deps, sessionId, epoch, kind, reason) {
         reason: kind,
         refs: { reason },
     });
-    if (!ok2xx(r))
+    if (!ok2xx(r)) {
         deps.log(`exec_fail ${kind}/${reason}: ${errorCode(r.body) ?? r.networkError ?? r.status}`);
+        return;
+    }
+    // Amendment 59: the api decides retry or fail; the runner only says which.
+    const b = (r.body ?? {});
+    const job = `job ${sessionId.slice(0, 8)}`;
+    if (b.state === "ready" && Number.isInteger(b.attempt) && Number.isInteger(b.retries))
+        deps.log(`${job} returned to the pool for retry (attempt ${b.attempt} of ${b.retries})`);
+    else if (b.state === "failed" && Number.isInteger(b.attempt))
+        deps.log(`${job} failed after ${b.attempt} attempt${b.attempt === 1 ? "" : "s"}`);
 }
 async function release(deps, sessionId, epoch) {
     const r = await deps.api.release(sessionId, { epoch, nonce: deps.nonce });

package/dist/lib/runner/outcome.js

@@ -6,7 +6,7 @@
  * a reason outside S1's closed lists is a bug in the runner, so `outcomeLine` throws on one rather
  * than print a line no consumer can read.
  */
-import { RUNNER_EXIT_CODES, RUNNER_FAILED_PHASE_RE, RUNNER_FAILED_REASONS, RUNNER_OUTCOME_FIELDS, RUNNER_REFUSED_REASONS, } from "../../vendor/durable-contract/index.js";
+import { isRunnerFailedReason, RUNNER_EXIT_CODES, RUNNER_OUTCOME_FIELDS, RUNNER_REFUSED_REASONS, } from "../../vendor/durable-contract/index.js";
 /** `phase_<order>_<name>`: the name lowercased, anything outside [a-z0-9_] replaced by `_`. */
 export function phaseReason(order, name) {
     return `phase_${order}_${name.toLowerCase().replace(/[^a-z0-9_]/g, "_")}`;
@@ -20,8 +20,7 @@ function reasonOk(outcome, reason) {
     if (reason === null)
         return false;
     if (outcome === "failed")
-        return (RUNNER_FAILED_REASONS.includes(reason) ||
-            RUNNER_FAILED_PHASE_RE.test(reason));
+        return isRunnerFailedReason(reason);
     return isRefusedReason(reason);
 }
 const pick = (facts, keep) => ({

package/dist/lib/session-key.d.ts

@@ -24,9 +24,10 @@ export interface SessionKeyDeps {
     revoke: (keyId: string) => Promise<void>;
     say: (line: string) => void;
     /**
-     * Override the mint/revoke timeout, tests only — real callers never set these, so the real
-     * 10s/3s bounds below always apply in production. Exists so a test can exercise "never
-     * settles" against a short, fast timeout rather than waiting out the real one.
+     * Override the mint/revoke timeout. Tests use it; the one real caller is the exit path of a
+     * launch that prints a conduct receipt, which bounds the revoke by the receipt's deadline
+     * (agent.ts, Doors W1.3). Otherwise the 10s/3s bounds below apply. Tests use it to exercise
+     * "never settles" against a short, fast timeout rather than waiting out the real one.
      */
     mintTimeoutMs?: number;
     revokeTimeoutMs?: number;

package/dist/vendor/durable-contract/index.js

@@ -199,7 +199,7 @@ var SUSPENDED_REASONS = [
   "approval_denied"
 ];
 var PAUSED_REASONS = ["owner", "agent_contained", "breakglass"];
-var FAILED_REASONS = ["transcript_lost"];
+var FAILED_REASONS = ["transcript_lost", "runner_failed"];
 var KILLED_REASONS = ["agent_killed"];
 var STATE_REASONS = {
   resuming: [null],
@@ -2034,6 +2034,183 @@ function grantWarningDays(remainingSeconds, warningWindowSeconds) {
   return Math.ceil(remainingSeconds / 86400);
 }
 
+// ../shared/durable-contract/src/doors.ts
+var DURABLE_POOL_CLAIM_FLAG = "DURABLE_POOL_CLAIM";
+function poolClaimEnabled(flagValue, orgId) {
+  return poolClaimOrgs(flagValue).includes(orgId);
+}
+function isPoolSession(s, flagValue) {
+  return s.home_executor_id === null && s.durable_mode === "locked" && poolClaimEnabled(flagValue, s.org_id);
+}
+function poolClaimOrgs(flagValue) {
+  if (flagValue === void 0) return [];
+  const orgs = flagValue.split(",").map((s) => s.trim());
+  if (orgs.some((o) => !ID_RE.test(o))) return [];
+  return [...new Set(orgs)];
+}
+var EXECUTOR_SCOPES = ["user", "org"];
+var ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet"];
+var OIDC_EXCHANGE_REFUSALS = [
+  "bad_issuer",
+  "repo_not_enrolled",
+  "ref_not_allowed",
+  "pool_flag_off"
+];
+var OIDC_EXCHANGE_AUDIENCE = "mnemom-executor";
+var ORG_POLICY_LIMIT_KEYS = ["per_session_budget_usd", "live_lease_cap"];
+var LIVE_LEASE_CAP_MIN = 1;
+var LIVE_LEASE_CAP_MAX = 1e3;
+var ORG_CAP_LOCK_PREFIX = "durable_org_cap:";
+var DEFAULT_LEASE_CAP_ENV = "DURABLE_DEFAULT_LEASE_CAP";
+var capOk = (v) => Number.isInteger(v) && v >= LIVE_LEASE_CAP_MIN && v <= LIVE_LEASE_CAP_MAX;
+function parseDefaultLeaseCap(envValue) {
+  if (envValue === void 0 || !/^[1-9][0-9]{0,3}$/.test(envValue)) return null;
+  const n = Number(envValue);
+  return capOk(n) ? n : null;
+}
+function effectiveLeaseCap(orgLimits, defaultRowLimits, defaultCap) {
+  const present = [orgLimits?.live_lease_cap, defaultRowLimits?.live_lease_cap, defaultCap].filter(
+    (v) => v !== void 0 && v !== null
+  );
+  for (const v of present)
+    if (!capOk(v)) throw new RangeError(`live lease cap out of range: ${String(v)}`);
+  if (present.length === 0)
+    throw new RangeError("no live lease cap: DURABLE_DEFAULT_LEASE_CAP is unset");
+  return present[0];
+}
+var DISPATCH_SESSION_CID_PREFIX = "dispatch-";
+var DISPATCH_SESSION_NAME_PREFIX = "job-";
+var CREATE_READY_SESSION_REFUSALS = [
+  "no_dispatch_agent",
+  "seal_not_found",
+  "cell_unmapped",
+  // 34.10.1 (4): the api-built charter v1 or its envelope does not match the seal; nothing written
+  "charter_mismatch"
+];
+var CREATE_READY_SESSION_OUTCOMES = ["created", "existing", "refused"];
+var CREATE_READY_SESSION_ANSWERS = Object.freeze({
+  created: ["outcome", "session_id"],
+  existing: ["outcome", "session_id"],
+  refused: ["outcome", "reason"]
+});
+function createReadySessionAnswerOk(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const a = v;
+  if (typeof a.outcome !== "string" || !Object.prototype.hasOwnProperty.call(CREATE_READY_SESSION_ANSWERS, a.outcome))
+    return false;
+  const keys = CREATE_READY_SESSION_ANSWERS[a.outcome];
+  if (Object.keys(a).length !== keys.length || !keys.every((k) => k in a)) return false;
+  return a.outcome === "refused" ? CREATE_READY_SESSION_REFUSALS.includes(a.reason) : typeof a.session_id === "string" && UUID_RE.test(a.session_id);
+}
+function sealIdOk(sealId) {
+  if (!UUID_RE.test(sealId)) throw new RangeError(`seal id must be a lowercase uuid: ${sealId}`);
+  return sealId;
+}
+function dispatchConversationId(sealId) {
+  return DISPATCH_SESSION_CID_PREFIX + sealIdOk(sealId);
+}
+function dispatchSessionName(sealId) {
+  return DISPATCH_SESSION_NAME_PREFIX + sealIdOk(sealId).replace(/-/g, "").slice(0, 12);
+}
+var RUNNER_OUTCOMES = ["done", "no_job", "failed", "refused"];
+var RUNNER_OUTCOME_FIELDS = [
+  "v",
+  "outcome",
+  "session_id",
+  "lease_epoch",
+  "contract_sha256",
+  "contract_version",
+  "merge_strategy",
+  "pr_url",
+  "reason"
+];
+var RUNNER_EXIT_CODES = Object.freeze({
+  done: 0,
+  no_job: 0,
+  failed: 1,
+  usage: 2,
+  refused: 3
+});
+var RUNNER_FAILED_REASONS = ["pr_open_failed", "pr_no_changes"];
+var RUNNER_FAILED_PHASE_RE = /^phase_[0-9]+_[a-z0-9_]+$/;
+var RUNNER_FAIL_REFS = ["reason"];
+var RUNNER_FAILED_REASON_PATTERN = `^(${RUNNER_FAILED_REASONS.join("|")}|phase_[0-9]+_[a-z0-9_]+)$`;
+function isRunnerFailedReason(v) {
+  return typeof v === "string" && (RUNNER_FAILED_REASONS.includes(v) || RUNNER_FAILED_PHASE_RE.test(v));
+}
+var POOL_JOB_RETRIES_DEFAULT = 1;
+var POOL_JOB_RETRIES_MIN = 0;
+var POOL_JOB_RETRIES_MAX = 5;
+var POOL_JOB_RETRIES_CONFIG_CAUSE = "pool_job_retries_config";
+function poolJobRetriesOf(limit) {
+  if (limit === void 0 || limit === null) return POOL_JOB_RETRIES_DEFAULT;
+  return Number.isInteger(limit) && limit >= POOL_JOB_RETRIES_MIN && limit <= POOL_JOB_RETRIES_MAX ? limit : null;
+}
+var RUNNER_REFUSED_REASONS = [
+  "bundle_too_large",
+  "bundle_malformed",
+  "bundle_wrong_typ",
+  "bundle_schema",
+  "bundle_unknown_key",
+  "bundle_unusable_key",
+  "bundle_retired_key",
+  "bundle_bad_signature",
+  "bundle_code_digest_mismatch",
+  "bundle_not_yet_valid",
+  "bundle_expired",
+  "bundle_binding_mismatch",
+  "bundle_unavailable",
+  "job_unavailable",
+  "contract_bad_sha",
+  "contract_too_large",
+  "contract_sha_mismatch",
+  "contract_not_a_contract",
+  "contract_mismatch_unrecoverable",
+  "claim_needs_key",
+  "claim_ineligible",
+  "claim_unavailable",
+  "lease_lost",
+  "executor_revoked",
+  "executor_unauthorized",
+  "oidc_bad_issuer",
+  "oidc_repo_not_enrolled",
+  "oidc_ref_not_allowed",
+  "oidc_pool_flag_off",
+  "oidc_unavailable",
+  "api_unavailable"
+];
+var RUNNER_OPEN_MODE_TOLERATED = [
+  "bundle_unavailable",
+  "job_unavailable",
+  "api_unavailable"
+];
+var RUNNER_MERGE_STRATEGIES = ["external", "merge_on_green"];
+var POOL_CLAIM_FIELDS = ["contract_sha256", "contract_version", "cap"];
+var HEX64_RE2 = /^[0-9a-f]{64}$/;
+function poolClaimFieldsOk(body, pool) {
+  if (!pool) return POOL_CLAIM_FIELDS.every((k) => !(k in body));
+  return typeof body.contract_sha256 === "string" && HEX64_RE2.test(body.contract_sha256) && Number.isInteger(body.contract_version) && body.contract_version >= 1 && capOk(body.cap);
+}
+var WAIT_REF_KEYS = Object.freeze({
+  ci: ["repo_id", "head_sha"],
+  question: ["approval_id"],
+  budget: ["approval_id"]
+});
+var HEX40_RE = /^[0-9a-f]{40}$/;
+function waitRefOk(reason, ref) {
+  if (!Object.prototype.hasOwnProperty.call(WAIT_REF_KEYS, reason)) return false;
+  if (ref === null || typeof ref !== "object" || Array.isArray(ref)) return false;
+  const r = ref;
+  const want = WAIT_REF_KEYS[reason];
+  if (Object.keys(r).length !== want.length || !want.every((k) => k in r)) return false;
+  if (reason === "ci")
+    return Number.isSafeInteger(r.repo_id) && r.repo_id > 0 && typeof r.head_sha === "string" && HEX40_RE.test(r.head_sha);
+  return typeof r.approval_id === "string" && UUID_RE.test(r.approval_id);
+}
+var CLEAR_WAIT_OUTCOMES = ["cleared", "stale_ref", "already_clear"];
+var READY_SESSIONS_LIMIT_MIN = 1;
+var READY_SESSIONS_LIMIT_MAX = 50;
+
 // ../shared/durable-contract/src/events.ts
 var EVENT_GROUPS = [
   "lifecycle",
@@ -2337,6 +2514,7 @@ var ENUM = (values) => ({
 });
 var obj = (properties, required = Object.keys(properties), if_then) => if_then ? { type: "object", additionalProperties: false, required, properties, if_then } : { type: "object", additionalProperties: false, required, properties };
 var EMPTY = obj({});
+var RUNNER_REASON = S({ pattern: RUNNER_FAILED_REASON_PATTERN });
 var APPROVAL_KINDS = [
   "question",
   "ask",
@@ -2347,7 +2525,7 @@ var APPROVAL_KINDS = [
   "grant_renewal",
   "limit_raise"
 ];
-var READY_CAUSES = ["dispatched", "lease_expired", "wait_cleared"];
+var READY_CAUSES = ["dispatched", "lease_expired", "wait_cleared", "job_failed"];
 var OWNER_MUTATION_SUBJECTS = [
   "unlock",
   "unpause_contained",
@@ -2404,7 +2582,15 @@ var KIND_REFS = {
       }
     ]
   ),
-  "session.failed": obj({ reason: ENUM([...FAILED_REASONS]) }),
+  // S1 amendment 59: runner_reason is required with runner_failed and absent otherwise.
+  "session.failed": obj(
+    { reason: ENUM([...FAILED_REASONS]), runner_reason: RUNNER_REASON },
+    ["reason"],
+    [
+      { field: "reason", equals: "runner_failed", require: ["runner_reason"] },
+      { field: "reason", equals: "transcript_lost", forbid: ["runner_reason"] }
+    ]
+  ),
   "session.killed": obj({ reason: ENUM(["owner", "agent_killed"]) }),
   "seat.hello": obj({ spawn_id: UUID }),
   "charter.sealed": obj({
@@ -2477,7 +2663,14 @@ var KIND_REFS = {
   "containment.kill": obj({ action: ENUM(["kill"]) }),
   "never.held": obj({ sh_decision_id: UUID }),
   // ---- Doors amendment (rulings 34.02, 34.06) ----
-  "session.ready": obj({ cause: ENUM(READY_CAUSES) }),
+  // S1 amendment 59: a retried job's ready names the runner's reason and the attempt it ends.
+  "session.ready": obj(
+    { cause: ENUM(READY_CAUSES), runner_reason: RUNNER_REASON, attempt: INT(1) },
+    ["cause"],
+    READY_CAUSES.map(
+      (cause) => cause === "job_failed" ? { field: "cause", equals: cause, require: ["runner_reason", "attempt"] } : { field: "cause", equals: cause, forbid: ["runner_reason", "attempt"] }
+    )
+  ),
   "session.waiting": obj(
     {
       wait_reason: ENUM(PARKED_ONLY_WAIT_REASONS),
@@ -3457,7 +3650,8 @@ var M1_COLUMNS = {
     "created_at",
     "updated_at",
     "wait_ref",
-    "new_session"
+    "new_session",
+    "job_failures"
   ],
   durable_lease_keys: [
     "key_hash",
@@ -4430,170 +4624,6 @@ function gatewayEventsBodyOk(v) {
   return validateRefs(kind, v.refs ?? {});
 }
 
-// ../shared/durable-contract/src/doors.ts
-var DURABLE_POOL_CLAIM_FLAG = "DURABLE_POOL_CLAIM";
-function poolClaimEnabled(flagValue, orgId) {
-  return poolClaimOrgs(flagValue).includes(orgId);
-}
-function isPoolSession(s, flagValue) {
-  return s.home_executor_id === null && s.durable_mode === "locked" && poolClaimEnabled(flagValue, s.org_id);
-}
-function poolClaimOrgs(flagValue) {
-  if (flagValue === void 0) return [];
-  const orgs = flagValue.split(",").map((s) => s.trim());
-  if (orgs.some((o) => !ID_RE.test(o))) return [];
-  return [...new Set(orgs)];
-}
-var EXECUTOR_SCOPES = ["user", "org"];
-var ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet"];
-var OIDC_EXCHANGE_REFUSALS = [
-  "bad_issuer",
-  "repo_not_enrolled",
-  "ref_not_allowed",
-  "pool_flag_off"
-];
-var OIDC_EXCHANGE_AUDIENCE = "mnemom-executor";
-var ORG_POLICY_LIMIT_KEYS = ["per_session_budget_usd", "live_lease_cap"];
-var LIVE_LEASE_CAP_MIN = 1;
-var LIVE_LEASE_CAP_MAX = 1e3;
-var ORG_CAP_LOCK_PREFIX = "durable_org_cap:";
-var DEFAULT_LEASE_CAP_ENV = "DURABLE_DEFAULT_LEASE_CAP";
-var capOk = (v) => Number.isInteger(v) && v >= LIVE_LEASE_CAP_MIN && v <= LIVE_LEASE_CAP_MAX;
-function parseDefaultLeaseCap(envValue) {
-  if (envValue === void 0 || !/^[1-9][0-9]{0,3}$/.test(envValue)) return null;
-  const n = Number(envValue);
-  return capOk(n) ? n : null;
-}
-function effectiveLeaseCap(orgLimits, defaultRowLimits, defaultCap) {
-  const present = [orgLimits?.live_lease_cap, defaultRowLimits?.live_lease_cap, defaultCap].filter(
-    (v) => v !== void 0 && v !== null
-  );
-  for (const v of present)
-    if (!capOk(v)) throw new RangeError(`live lease cap out of range: ${String(v)}`);
-  if (present.length === 0)
-    throw new RangeError("no live lease cap: DURABLE_DEFAULT_LEASE_CAP is unset");
-  return present[0];
-}
-var DISPATCH_SESSION_CID_PREFIX = "dispatch-";
-var DISPATCH_SESSION_NAME_PREFIX = "job-";
-var CREATE_READY_SESSION_REFUSALS = [
-  "no_dispatch_agent",
-  "seal_not_found",
-  "cell_unmapped",
-  // 34.10.1 (4): the api-built charter v1 or its envelope does not match the seal; nothing written
-  "charter_mismatch"
-];
-var CREATE_READY_SESSION_OUTCOMES = ["created", "existing", "refused"];
-var CREATE_READY_SESSION_ANSWERS = Object.freeze({
-  created: ["outcome", "session_id"],
-  existing: ["outcome", "session_id"],
-  refused: ["outcome", "reason"]
-});
-function createReadySessionAnswerOk(v) {
-  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
-  const a = v;
-  if (typeof a.outcome !== "string" || !Object.prototype.hasOwnProperty.call(CREATE_READY_SESSION_ANSWERS, a.outcome))
-    return false;
-  const keys = CREATE_READY_SESSION_ANSWERS[a.outcome];
-  if (Object.keys(a).length !== keys.length || !keys.every((k) => k in a)) return false;
-  return a.outcome === "refused" ? CREATE_READY_SESSION_REFUSALS.includes(a.reason) : typeof a.session_id === "string" && UUID_RE.test(a.session_id);
-}
-function sealIdOk(sealId) {
-  if (!UUID_RE.test(sealId)) throw new RangeError(`seal id must be a lowercase uuid: ${sealId}`);
-  return sealId;
-}
-function dispatchConversationId(sealId) {
-  return DISPATCH_SESSION_CID_PREFIX + sealIdOk(sealId);
-}
-function dispatchSessionName(sealId) {
-  return DISPATCH_SESSION_NAME_PREFIX + sealIdOk(sealId).replace(/-/g, "").slice(0, 12);
-}
-var RUNNER_OUTCOMES = ["done", "no_job", "failed", "refused"];
-var RUNNER_OUTCOME_FIELDS = [
-  "v",
-  "outcome",
-  "session_id",
-  "lease_epoch",
-  "contract_sha256",
-  "contract_version",
-  "merge_strategy",
-  "pr_url",
-  "reason"
-];
-var RUNNER_EXIT_CODES = Object.freeze({
-  done: 0,
-  no_job: 0,
-  failed: 1,
-  usage: 2,
-  refused: 3
-});
-var RUNNER_FAILED_REASONS = ["pr_open_failed"];
-var RUNNER_FAILED_PHASE_RE = /^phase_[0-9]+_[a-z0-9_]+$/;
-var RUNNER_REFUSED_REASONS = [
-  "bundle_too_large",
-  "bundle_malformed",
-  "bundle_wrong_typ",
-  "bundle_schema",
-  "bundle_unknown_key",
-  "bundle_unusable_key",
-  "bundle_retired_key",
-  "bundle_bad_signature",
-  "bundle_code_digest_mismatch",
-  "bundle_not_yet_valid",
-  "bundle_expired",
-  "bundle_binding_mismatch",
-  "bundle_unavailable",
-  "job_unavailable",
-  "contract_bad_sha",
-  "contract_too_large",
-  "contract_sha_mismatch",
-  "contract_not_a_contract",
-  "contract_mismatch_unrecoverable",
-  "claim_needs_key",
-  "claim_ineligible",
-  "claim_unavailable",
-  "lease_lost",
-  "executor_revoked",
-  "executor_unauthorized",
-  "oidc_bad_issuer",
-  "oidc_repo_not_enrolled",
-  "oidc_ref_not_allowed",
-  "oidc_pool_flag_off",
-  "oidc_unavailable",
-  "api_unavailable"
-];
-var RUNNER_OPEN_MODE_TOLERATED = [
-  "bundle_unavailable",
-  "job_unavailable",
-  "api_unavailable"
-];
-var RUNNER_MERGE_STRATEGIES = ["external", "merge_on_green"];
-var POOL_CLAIM_FIELDS = ["contract_sha256", "contract_version", "cap"];
-var HEX64_RE2 = /^[0-9a-f]{64}$/;
-function poolClaimFieldsOk(body, pool) {
-  if (!pool) return POOL_CLAIM_FIELDS.every((k) => !(k in body));
-  return typeof body.contract_sha256 === "string" && HEX64_RE2.test(body.contract_sha256) && Number.isInteger(body.contract_version) && body.contract_version >= 1 && capOk(body.cap);
-}
-var WAIT_REF_KEYS = Object.freeze({
-  ci: ["repo_id", "head_sha"],
-  question: ["approval_id"],
-  budget: ["approval_id"]
-});
-var HEX40_RE = /^[0-9a-f]{40}$/;
-function waitRefOk(reason, ref) {
-  if (!Object.prototype.hasOwnProperty.call(WAIT_REF_KEYS, reason)) return false;
-  if (ref === null || typeof ref !== "object" || Array.isArray(ref)) return false;
-  const r = ref;
-  const want = WAIT_REF_KEYS[reason];
-  if (Object.keys(r).length !== want.length || !want.every((k) => k in r)) return false;
-  if (reason === "ci")
-    return Number.isSafeInteger(r.repo_id) && r.repo_id > 0 && typeof r.head_sha === "string" && HEX40_RE.test(r.head_sha);
-  return typeof r.approval_id === "string" && UUID_RE.test(r.approval_id);
-}
-var CLEAR_WAIT_OUTCOMES = ["cleared", "stale_ref", "already_clear"];
-var READY_SESSIONS_LIMIT_MIN = 1;
-var READY_SESSIONS_LIMIT_MAX = 50;
-
 // ../shared/durable-contract/src/journal-approvals.ts
 var JOURNAL_APPROVAL_KINDS = ["approval.resolved", "approval.consumed"];
 var idOf = (e2) => e2.refs !== null && typeof e2.refs.approval_id === "string" ? e2.refs.approval_id : null;
@@ -5584,6 +5614,10 @@ export {
   PLUGIN_MANIFEST_SCHEMA,
   PLUGIN_TOKEN,
   POOL_CLAIM_FIELDS,
+  POOL_JOB_RETRIES_CONFIG_CAUSE,
+  POOL_JOB_RETRIES_DEFAULT,
+  POOL_JOB_RETRIES_MAX,
+  POOL_JOB_RETRIES_MIN,
   POSTURES,
   PRE_M1_LAUNCHER_SUBVERBS,
   PRINCIPAL_REF_VECTOR,
@@ -5620,6 +5654,8 @@ export {
   RUNNER_EXIT_CODES,
   RUNNER_FAILED_PHASE_RE,
   RUNNER_FAILED_REASONS,
+  RUNNER_FAILED_REASON_PATTERN,
+  RUNNER_FAIL_REFS,
   RUNNER_MERGE_STRATEGIES,
   RUNNER_OPEN_MODE_TOLERATED,
   RUNNER_OUTCOMES,
@@ -5794,6 +5830,7 @@ export {
   isLoopbackUrl,
   isPoolSession,
   isRuled,
+  isRunnerFailedReason,
   isSessionState,
   isTerminalState,
   isTestAllowlisted,
@@ -5831,6 +5868,7 @@ export {
   poolClaimEnabled,
   poolClaimFieldsOk,
   poolClaimOrgs,
+  poolJobRetriesOf,
   principalRef,
   protectionRefusals,
   proxyLockPath,

package/dist/vendor/shared/durable-contract/doors.d.ts

@@ -87,8 +87,33 @@ export declare const RUNNER_EXIT_CODES: Readonly<{
     readonly refused: 3;
 }>;
 /** failed reasons besides the phase pattern RUNNER_FAILED_PHASE_RE. */
-export declare const RUNNER_FAILED_REASONS: readonly ["pr_open_failed"];
+export declare const RUNNER_FAILED_REASONS: readonly ["pr_open_failed", "pr_no_changes"];
 export declare const RUNNER_FAILED_PHASE_RE: RegExp;
+/**
+ * S1 amendment 59 (signed by Wassim 2026-10-31): a failed pool job is retried, then failed with the
+ * runner's reason. exec_fail {reason: "runner_failed"} carries exactly `refs: {reason}`, where
+ * refs.reason passes isRunnerFailedReason; anything else is 400 durable_reason_invalid
+ * {field: "refs.reason"} with nothing written. `pr_no_changes` is found before any push (no commit
+ * ahead of the base) and is retried like any other failure.
+ */
+export declare const RUNNER_FAIL_REFS: readonly ["reason"];
+/** RUNNER_FAILED_REASONS and RUNNER_FAILED_PHASE_RE as one anchored pattern (the refs schemas'). */
+export declare const RUNNER_FAILED_REASON_PATTERN: string;
+/** 59 (2): the single check the CLI, the api and E4 share for a runner's failed reason. */
+export declare function isRunnerFailedReason(v: unknown): boolean;
+/**
+ * 59 (3): how many times a failed pool job goes back to ready before it is failed. Configured per
+ * org as organizations.limits.pool_job_retries (operating policy, never the charter); absent means
+ * the default, and a present value outside MIN..MAX fails closed (503 durable_rpc_unavailable
+ * {cause: "pool_job_retries_config"}, nothing written), as 34.05.1 (3) does for the lease cap. A
+ * lease lapse never spends a retry: it stays resume_failures / respawn_failed.
+ */
+export declare const POOL_JOB_RETRIES_DEFAULT = 1;
+export declare const POOL_JOB_RETRIES_MIN = 0;
+export declare const POOL_JOB_RETRIES_MAX = 5;
+export declare const POOL_JOB_RETRIES_CONFIG_CAUSE = "pool_job_retries_config";
+/** The org's retry count from its limits.pool_job_retries: the default when absent, null when invalid. */
+export declare function poolJobRetriesOf(limit: unknown): number | null;
 /** The closed refused list (34.12 (8)). */
 export declare const RUNNER_REFUSED_REASONS: readonly ["bundle_too_large", "bundle_malformed", "bundle_wrong_typ", "bundle_schema", "bundle_unknown_key", "bundle_unusable_key", "bundle_retired_key", "bundle_bad_signature", "bundle_code_digest_mismatch", "bundle_not_yet_valid", "bundle_expired", "bundle_binding_mismatch", "bundle_unavailable", "job_unavailable", "contract_bad_sha", "contract_too_large", "contract_sha_mismatch", "contract_not_a_contract", "contract_mismatch_unrecoverable", "claim_needs_key", "claim_ineligible", "claim_unavailable", "lease_lost", "executor_revoked", "executor_unauthorized", "oidc_bad_issuer", "oidc_repo_not_enrolled", "oidc_ref_not_allowed", "oidc_pool_flag_off", "oidc_unavailable", "api_unavailable"];
 /** Under --fail-mode open, only these may be ridden through, and only once a verified bundle is held (34.12 (2)). */

package/dist/vendor/shared/durable-contract/doors.js

@@ -154,8 +154,44 @@ export const RUNNER_EXIT_CODES = Object.freeze({
     refused: 3,
 });
 /** failed reasons besides the phase pattern RUNNER_FAILED_PHASE_RE. */
-export const RUNNER_FAILED_REASONS = ["pr_open_failed"];
+export const RUNNER_FAILED_REASONS = ["pr_open_failed", "pr_no_changes"];
 export const RUNNER_FAILED_PHASE_RE = /^phase_[0-9]+_[a-z0-9_]+$/;
+/**
+ * S1 amendment 59 (signed by Wassim 2026-10-31): a failed pool job is retried, then failed with the
+ * runner's reason. exec_fail {reason: "runner_failed"} carries exactly `refs: {reason}`, where
+ * refs.reason passes isRunnerFailedReason; anything else is 400 durable_reason_invalid
+ * {field: "refs.reason"} with nothing written. `pr_no_changes` is found before any push (no commit
+ * ahead of the base) and is retried like any other failure.
+ */
+export const RUNNER_FAIL_REFS = ["reason"];
+/** RUNNER_FAILED_REASONS and RUNNER_FAILED_PHASE_RE as one anchored pattern (the refs schemas'). */
+export const RUNNER_FAILED_REASON_PATTERN = `^(${RUNNER_FAILED_REASONS.join("|")}|phase_[0-9]+_[a-z0-9_]+)$`;
+/** 59 (2): the single check the CLI, the api and E4 share for a runner's failed reason. */
+export function isRunnerFailedReason(v) {
+    return (typeof v === "string" &&
+        (RUNNER_FAILED_REASONS.includes(v) || RUNNER_FAILED_PHASE_RE.test(v)));
+}
+/**
+ * 59 (3): how many times a failed pool job goes back to ready before it is failed. Configured per
+ * org as organizations.limits.pool_job_retries (operating policy, never the charter); absent means
+ * the default, and a present value outside MIN..MAX fails closed (503 durable_rpc_unavailable
+ * {cause: "pool_job_retries_config"}, nothing written), as 34.05.1 (3) does for the lease cap. A
+ * lease lapse never spends a retry: it stays resume_failures / respawn_failed.
+ */
+export const POOL_JOB_RETRIES_DEFAULT = 1;
+export const POOL_JOB_RETRIES_MIN = 0;
+export const POOL_JOB_RETRIES_MAX = 5;
+export const POOL_JOB_RETRIES_CONFIG_CAUSE = "pool_job_retries_config";
+/** The org's retry count from its limits.pool_job_retries: the default when absent, null when invalid. */
+export function poolJobRetriesOf(limit) {
+    if (limit === undefined || limit === null)
+        return POOL_JOB_RETRIES_DEFAULT;
+    return Number.isInteger(limit) &&
+        limit >= POOL_JOB_RETRIES_MIN &&
+        limit <= POOL_JOB_RETRIES_MAX
+        ? limit
+        : null;
+}
 /** The closed refused list (34.12 (8)). */
 export const RUNNER_REFUSED_REASONS = [
     "bundle_too_large",

package/dist/vendor/shared/durable-contract/events.d.ts

@@ -90,7 +90,7 @@ export interface RefsSchema {
 /** durable_approvals.kind values, as the approval.* refs enums carry them. */
 export declare const APPROVAL_KINDS: readonly ["question", "ask", "tool_confirmation", "intent_rerun", "card_drift", "owner_mutation", "grant_renewal", "limit_raise"];
 /** session.ready refs.cause: how a session entered ready (ruling 34.02 (3)). */
-export declare const READY_CAUSES: readonly ["dispatched", "lease_expired", "wait_cleared"];
+export declare const READY_CAUSES: readonly ["dispatched", "lease_expired", "wait_cleared", "job_failed"];
 /** refs_schema for every M1 kind; kinds without a specific schema take EMPTY (refs must be {}). */
 export declare function refsSchemaOf(kind: DurableEventKind): RefsSchema;
 /** One refs property against its schema (pure; exported for its direct test). An integer with no minimum accepts any safe integer. */

package/dist/vendor/shared/durable-contract/events.js

@@ -25,6 +25,7 @@ import { canonicalJson, hmacSha256Hex, sha256Hex, HEX64_RE } from "./canonical.j
 import { DETACHED_REASONS, PAUSED_REASONS, SUSPENDED_REASONS, FAILED_REASONS, PARKED_ONLY_WAIT_REASONS, } from "./states.js";
 import { ATTESTATION_CHECKS_M1, CWD_CHECK_CAUSES } from "./codes.js";
 import { EVENT_DETAIL_MAX_CHARS } from "./constants.js";
+import { RUNNER_FAILED_REASON_PATTERN } from "./doors.js";
 export const EVENT_GROUPS = [
     "lifecycle",
     "charter",
@@ -352,6 +353,8 @@ const obj = (properties, required = Object.keys(properties), if_then) => if_then
     ? { type: "object", additionalProperties: false, required, properties, if_then }
     : { type: "object", additionalProperties: false, required, properties };
 const EMPTY = obj({});
+/** A runner's failed reason (S1 amendment 59): RUNNER_FAILED_REASONS or the phase pattern. */
+const RUNNER_REASON = S({ pattern: RUNNER_FAILED_REASON_PATTERN });
 /** durable_approvals.kind values, as the approval.* refs enums carry them. */
 export const APPROVAL_KINDS = [
     "question",
@@ -364,7 +367,7 @@ export const APPROVAL_KINDS = [
     "limit_raise",
 ];
 /** session.ready refs.cause: how a session entered ready (ruling 34.02 (3)). */
-export const READY_CAUSES = ["dispatched", "lease_expired", "wait_cleared"];
+export const READY_CAUSES = ["dispatched", "lease_expired", "wait_cleared", "job_failed"];
 // question joins the M1 four (ruling 34.06.1.1): its wait parks on an owner_mutation approval.
 const OWNER_MUTATION_SUBJECTS = [
     "unlock",
@@ -415,7 +418,11 @@ const KIND_REFS = {
             },
         },
     ]),
-    "session.failed": obj({ reason: ENUM([...FAILED_REASONS]) }),
+    // S1 amendment 59: runner_reason is required with runner_failed and absent otherwise.
+    "session.failed": obj({ reason: ENUM([...FAILED_REASONS]), runner_reason: RUNNER_REASON }, ["reason"], [
+        { field: "reason", equals: "runner_failed", require: ["runner_reason"] },
+        { field: "reason", equals: "transcript_lost", forbid: ["runner_reason"] },
+    ]),
     "session.killed": obj({ reason: ENUM(["owner", "agent_killed"]) }),
     "seat.hello": obj({ spawn_id: UUID }),
     "charter.sealed": obj({
@@ -478,7 +485,10 @@ const KIND_REFS = {
     "containment.kill": obj({ action: ENUM(["kill"]) }),
     "never.held": obj({ sh_decision_id: UUID }),
     // ---- Doors amendment (rulings 34.02, 34.06) ----
-    "session.ready": obj({ cause: ENUM(READY_CAUSES) }),
+    // S1 amendment 59: a retried job's ready names the runner's reason and the attempt it ends.
+    "session.ready": obj({ cause: ENUM(READY_CAUSES), runner_reason: RUNNER_REASON, attempt: INT(1) }, ["cause"], READY_CAUSES.map((cause) => cause === "job_failed"
+        ? { field: "cause", equals: cause, require: ["runner_reason", "attempt"] }
+        : { field: "cause", equals: cause, forbid: ["runner_reason", "attempt"] })),
     "session.waiting": obj({
         wait_reason: ENUM(PARKED_ONLY_WAIT_REASONS),
         head_sha: S({ pattern: HEX40_PATTERN, maxLength: 40 }),

package/dist/vendor/shared/durable-contract/freeze-record.d.ts

@@ -709,7 +709,7 @@ export declare const FREEZE_STRUCTURED: Readonly<{
         }>;
     }>;
     GATEWAY_EVENTS_BODY_KEYS: readonly ["session_id", "kind", "epoch", "idempotency_key", "refs"];
-    READY_CAUSES: readonly ["dispatched", "lease_expired", "wait_cleared"];
+    READY_CAUSES: readonly ["dispatched", "lease_expired", "wait_cleared", "job_failed"];
     WAIT_REASONS: readonly ["approval", "moving", "mnemom_unavailable", "ci", "question", "budget"];
     PARKED_ONLY_WAIT_REASONS: readonly ["ci", "question", "budget"];
     WAIT_REF_KEYS: Readonly<{
@@ -740,7 +740,7 @@ export declare const FREEZE_STRUCTURED: Readonly<{
         readonly usage: 2;
         readonly refused: 3;
     }>;
-    RUNNER_FAILED_REASONS: readonly ["pr_open_failed"];
+    RUNNER_FAILED_REASONS: readonly ["pr_open_failed", "pr_no_changes"];
     RUNNER_REFUSED_REASONS: readonly ["bundle_too_large", "bundle_malformed", "bundle_wrong_typ", "bundle_schema", "bundle_unknown_key", "bundle_unusable_key", "bundle_retired_key", "bundle_bad_signature", "bundle_code_digest_mismatch", "bundle_not_yet_valid", "bundle_expired", "bundle_binding_mismatch", "bundle_unavailable", "job_unavailable", "contract_bad_sha", "contract_too_large", "contract_sha_mismatch", "contract_not_a_contract", "contract_mismatch_unrecoverable", "claim_needs_key", "claim_ineligible", "claim_unavailable", "lease_lost", "executor_revoked", "executor_unauthorized", "oidc_bad_issuer", "oidc_repo_not_enrolled", "oidc_ref_not_allowed", "oidc_pool_flag_off", "oidc_unavailable", "api_unavailable"];
     RUNNER_OPEN_MODE_TOLERATED: readonly ["bundle_unavailable", "job_unavailable", "api_unavailable"];
     RUNNER_MERGE_STRATEGIES: readonly ["external", "merge_on_green"];

package/dist/vendor/shared/durable-contract/schema.d.ts

@@ -22,6 +22,11 @@
  *    transaction with the lock); a plain lock never sets it. The executor learns it only from the
  *    claim success answer (`new_session: true`, while no seat hello was ever accepted for the
  *    session); EXEC_SESSIONS_RESPONSE item keys are unchanged.
+ *
+ * Amendment 59 (signed by Wassim 2026-10-31), appended to its table:
+ *  - agent_sessions.job_failures (INTEGER NOT NULL DEFAULT 0, CHECK >= 0): the pool job's accepted
+ *    runner_failed count, never reset. Separate from resume_failures, so a lease lapse never spends
+ *    a job retry and a job retry never counts towards respawn_failed.
  */
 export declare const M1_TABLES: readonly ["agent_sessions", "durable_lease_keys", "agent_session_charters", "agent_session_events", "durable_event_kinds", "agent_session_chains", "agent_executors", "agent_durable_profiles", "durable_cell_state", "durable_org_policy", "durable_user_policy", "durable_approvals", "durable_approval_attestations"];
 export type M1Table = (typeof M1_TABLES)[number];

package/dist/vendor/shared/durable-contract/schema.js

@@ -23,6 +23,11 @@
  *    transaction with the lock); a plain lock never sets it. The executor learns it only from the
  *    claim success answer (`new_session: true`, while no seat hello was ever accepted for the
  *    session); EXEC_SESSIONS_RESPONSE item keys are unchanged.
+ *
+ * Amendment 59 (signed by Wassim 2026-10-31), appended to its table:
+ *  - agent_sessions.job_failures (INTEGER NOT NULL DEFAULT 0, CHECK >= 0): the pool job's accepted
+ *    runner_failed count, never reset. Separate from resume_failures, so a lease lapse never spends
+ *    a job retry and a job retry never counts towards respawn_failed.
  */
 import { canonicalJson, sha256Hex, UUID_RE } from "./canonical.js";
 import { CANONICAL_CELL_IDS } from "./cell-id.js";
@@ -84,6 +89,7 @@ export const M1_COLUMNS = {
         "updated_at",
         "wait_ref",
         "new_session",
+        "job_failures",
     ],
     durable_lease_keys: [
         "key_hash",

package/dist/vendor/shared/durable-contract/states.d.ts

@@ -12,7 +12,8 @@ export declare const DETACHED_REASONS: readonly ["lease_expired", "hello_missed"
 export declare const SUSPENDED_REASONS: readonly ["budget_reached", "enforce_refused", "charter_breach", "account_balance", "identity_mismatch", "grant_expired", "card_drift", "attestation_failed", "owner_departed", "respawn_failed", "approval_expired", "approval_denied"];
 /** breakglass is P0a-B; it stays in the enum so the CHECK never needs widening. */
 export declare const PAUSED_REASONS: readonly ["owner", "agent_contained", "breakglass"];
-export declare const FAILED_REASONS: readonly ["transcript_lost"];
+/** S1 amendment 59: runner_failed is a pool job's terminal failure, after its retries (doors.ts). */
+export declare const FAILED_REASONS: readonly ["transcript_lost", "runner_failed"];
 export declare const KILLED_REASONS: readonly ["agent_killed"];
 export type DetachedReason = (typeof DETACHED_REASONS)[number];
 export type SuspendedReason = (typeof SUSPENDED_REASONS)[number];

package/dist/vendor/shared/durable-contract/states.js

@@ -51,7 +51,8 @@ export const SUSPENDED_REASONS = [
 ];
 /** breakglass is P0a-B; it stays in the enum so the CHECK never needs widening. */
 export const PAUSED_REASONS = ["owner", "agent_contained", "breakglass"];
-export const FAILED_REASONS = ["transcript_lost"];
+/** S1 amendment 59: runner_failed is a pool job's terminal failure, after its retries (doors.ts). */
+export const FAILED_REASONS = ["transcript_lost", "runner_failed"];
 export const KILLED_REASONS = ["agent_killed"];
 /**
  * The closed state_reason enum per state. `null` in a list means NULL is allowed there and what it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.34-next.3",
+  "version": "0.17.34-next.4",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {