@namzu/sdk 36.0.0 → 37.0.0

package/src/run/workspace-fingerprint.ts

@@ -1,5 +1,5 @@
 /**
- * A hash of everything a run could have changed in its working tree.
+ * A change detector for Git-visible workspace state.
  *
  * It exists to answer one question, asked between two attempts at the same
  * verification: **did anything happen since it last failed?** A verify-then-fix
@@ -10,7 +10,7 @@
  *
  * ## What is hashed, and why each part
  *
- * Three sources, because no one of them is complete:
+ * Four sources, because no one of them is complete:
  *
  *  1. **`git status --porcelain`** — which paths differ from the index at all.
  *     Cheap, and it catches additions, deletions and mode changes. On its own
@@ -23,6 +23,13 @@
  *  3. **Untracked file contents**, which no `git diff` covers. A new file is
  *     named by `status` but its CONTENT is not, so successive edits to a
  *     brand-new file would otherwise look like no change at all.
+ *  4. **`git rev-parse HEAD`** — the committed baseline. Two clean checkouts
+ *     can contain different code while all three sources above are empty.
+ *     Commit identity also covers verification that inspects Git history.
+ *
+ * Ignored files, external services and other command inputs are not covered.
+ * Reads are not an atomic snapshot. Matching hashes are an optimization hint,
+ * not proof that a command must produce the same result.
  *
  * ### Symlinks are recorded as their target, not read through
  *
@@ -131,7 +138,7 @@ async function untrackedEntry(cwd: string, rel: string, fs: FingerprintFs): Prom
 }
 
 /**
- * A hash of the working tree's uncommitted state, or `null` when it cannot be
+ * A hash of the commit and Git-visible working state, or `null` when it cannot be
  * established.
  *
  * **`null` is never "unchanged".** It means "I cannot tell", and the caller
@@ -152,15 +159,17 @@ export async function fingerprintWorkspace(
 		} catch {
 			return null
 		}
-		// A timeout surfaces here as a non-zero exit, and so does "not a
-		// repository" and "no commits yet". All three mean the same thing to
-		// this function: it has no basis for a comparison.
-		if (result.exitCode !== 0) return null
+		// A terminated process may handle its signal and exit zero. Its
+		// retained output still cannot establish a complete fingerprint.
+		if (result.exitCode !== 0 || result.termination !== undefined) return null
 		if (result.stdoutTruncated === true || result.stderrTruncated === true) return null
 		if (Buffer.byteLength(result.stdout, 'utf8') > maxBytes) return null
 		return result.stdout
 	}
 
+	const head = await git(['rev-parse', '--verify', 'HEAD'])
+	if (head === null) return null
+
 	const status = await git(['status', '--porcelain'])
 	if (status === null) return null
 
@@ -170,7 +179,7 @@ export async function fingerprintWorkspace(
 	const untracked = await git(['ls-files', '--others', '--exclude-standard', '-z'])
 	if (untracked === null) return null
 
-	const parts = [`status ${status}`, `diff ${diff}`]
+	const parts = [`head ${head}`, `status ${status}`, `diff ${diff}`]
 	// Split on NUL, which is what `-z` is for: a path may contain a newline,
 	// and splitting on one would turn a single strange filename into two
 	// ordinary-looking ones.

package/src/runtime/query/checkpoint.ts

@@ -10,7 +10,7 @@ import type {
 	IterationCheckpoint,
 	PendingDecision,
 } from '../../types/hitl/index.js'
-import type { AssistantMessage } from '../../types/message/index.js'
+import type { AssistantMessage, UserMessage } from '../../types/message/index.js'
 import type {
 	CheckpointRunScope,
 	CheckpointStore,
@@ -20,7 +20,53 @@ import type { EmergencySaveData } from '../../types/run/emergency.js'
 import type { CheckpointListEntry } from '../../types/run/replay.js'
 import { ZERO_COST } from '../../utils/cost.js'
 import { buildToolResultHashes } from '../../utils/hash.js'
-import { asCheckpointId, asEmergencySaveId, generateCheckpointId } from '../../utils/id.js'
+import {
+	asCheckpointId,
+	asEmergencySaveId,
+	asGoalId,
+	generateCheckpointId,
+} from '../../utils/id.js'
+
+/** Keep intent text/provenance without copying attachment payloads into a second slot. */
+function snapshotUserIntent(value: unknown): UserMessage {
+	const invalid = (): never => {
+		throw new Error('Checkpoint latestUserMessage has invalid operator intent or provenance')
+	}
+	if (!value || typeof value !== 'object') return invalid()
+	const message = value as Record<string, unknown>
+	if (message.role !== 'user' || typeof message.content !== 'string') return invalid()
+	const result: UserMessage = { role: 'user', content: message.content }
+	if (message.timestamp !== undefined) {
+		if (typeof message.timestamp !== 'number' || !Number.isFinite(message.timestamp))
+			return invalid()
+		result.timestamp = message.timestamp
+	}
+	if (message.source === undefined) return result
+	if (!message.source || typeof message.source !== 'object') return invalid()
+	const source = message.source as Record<string, unknown>
+	if (source.type === 'runtime-context' && source.kind === 'steering') {
+		result.source = { type: 'runtime-context', kind: 'steering' }
+		return result
+	}
+	if (
+		source.type !== 'goal-round' ||
+		typeof source.goalId !== 'string' ||
+		typeof source.objective !== 'string' ||
+		![source.goalRevision, source.round, source.maxGoalRounds].every(
+			(value) => typeof value === 'number' && Number.isInteger(value) && value > 0,
+		)
+	)
+		return invalid()
+	result.source = {
+		type: 'goal-round',
+		goalId: asGoalId(source.goalId),
+		objective: source.objective,
+		goalRevision: source.goalRevision as number,
+		round: source.round as number,
+		maxGoalRounds: source.maxGoalRounds as number,
+	}
+	return result
+}
 
 /**
  * Projection from a full checkpoint payload to the public listing entry.
@@ -166,6 +212,12 @@ export class CheckpointManager {
 	 * activity, and the record of everything before the resume is gone.
 	 */
 	private workingStateSource?: () => WorkingStateSnapshot | undefined
+	private latestUserMessageSource?: () => UserMessage | undefined
+	private restoredUserMessage?: UserMessage
+	private structuredReviewAttemptsSource?: () => number
+	private restoredReviewAttempts = 0
+	private nativeStructuredAttemptsSource?: () => number
+	private restoredNativeAttempts = 0
 
 	/**
 	 * The most recent checkpoint this manager wrote, if any.
@@ -237,6 +289,30 @@ export class CheckpointManager {
 		this.workingStateSource = source
 	}
 
+	/** One current intent snapshot, including checkpoints created by tool/HITL paths. */
+	setLatestUserMessageSource(source: () => UserMessage | undefined): void {
+		this.latestUserMessageSource = source
+	}
+
+	get restoredLatestUserMessage(): UserMessage | undefined {
+		return this.restoredUserMessage
+	}
+
+	setNativeStructuredAttemptsSource(source: () => number): void {
+		this.nativeStructuredAttemptsSource = source
+	}
+	get restoredNativeStructuredAttempts(): number {
+		return this.restoredNativeAttempts
+	}
+
+	setStructuredReviewAttemptsSource(source: () => number): void {
+		this.structuredReviewAttemptsSource = source
+	}
+
+	get restoredStructuredReviewAttempts(): number {
+		return this.restoredReviewAttempts
+	}
+
 	/**
 	 * The run's root span, so every checkpoint records the trace it was
 	 * taken inside and a resume can join it rather than starting a second,
@@ -260,6 +336,7 @@ export class CheckpointManager {
 		// fact, and naming it after the earlier one would make it wrong in
 		// exactly the way that is hard to notice.
 		this.runCreatedAt ??= runMgr.getSession().startedAt ?? Date.now()
+		const latestUserMessage = this.latestUserMessageSource?.() ?? this.restoredUserMessage
 
 		const checkpoint: IterationCheckpoint = {
 			id: generateCheckpointId(),
@@ -267,6 +344,11 @@ export class CheckpointManager {
 			runCreatedAt: this.runCreatedAt,
 			iteration,
 			messages: [...runMgr.messages],
+			nativeStructuredAttempts:
+				this.nativeStructuredAttemptsSource?.() ?? this.restoredNativeAttempts,
+			structuredReviewAttempts:
+				this.structuredReviewAttemptsSource?.() ?? this.restoredReviewAttempts,
+			...(latestUserMessage ? { latestUserMessage: snapshotUserIntent(latestUserMessage) } : {}),
 			tokenUsage: { ...runMgr.tokenUsage },
 			budgetBinding: runMgr.budget?.binding,
 			budgetAccountId: runMgr.budget?.accountId,
@@ -457,6 +539,18 @@ export class CheckpointManager {
 		// its origin's age. A guard that no input can trip would have read as
 		// protection and been none.
 		this.runCreatedAt ??= checkpoint.runCreatedAt
+		const nativeAttempts = checkpoint.nativeStructuredAttempts ?? 0
+		if (!Number.isSafeInteger(nativeAttempts) || nativeAttempts < 0)
+			throw new Error('Invalid nativeStructuredAttempts in checkpoint')
+		this.restoredNativeAttempts = nativeAttempts
+		const reviewAttempts = checkpoint.structuredReviewAttempts ?? 0
+		if (!Number.isSafeInteger(reviewAttempts) || reviewAttempts < 0)
+			throw new Error('Checkpoint structuredReviewAttempts must be a nonnegative safe integer')
+		this.restoredReviewAttempts = reviewAttempts
+		this.restoredUserMessage =
+			checkpoint.latestUserMessage === undefined
+				? undefined
+				: snapshotUserIntent(checkpoint.latestUserMessage)
 
 		return checkpoint
 	}

package/src/runtime/query/executor.ts

@@ -50,6 +50,7 @@ import type { Logger } from '../../utils/logger.js'
 import { compressShellOutput } from '../../utils/shell-compress.js'
 import { type BackgroundJobRegistry, type JobProcess, bindOwner } from '../jobs/registry.js'
 import type { ToolResultObservation } from './project-instructions.js'
+import { ToolCallBudget, assertMaxToolCalls } from './tool-call-budget.js'
 import {
 	DEFAULT_MAX_TOOL_OUTPUT_CHARS,
 	type ToolOutputBudgetResult,
@@ -356,6 +357,10 @@ export interface ToolExecutorConfig {
 	toolRetryBackoff?: Partial<BackoffPolicy>
 	/** Max concurrently-executing concurrency-safe tools. */
 	maxToolConcurrency?: number
+	/** Per-run cumulative attempt admission limit; unset is unlimited. */
+	maxToolCalls?: number
+	/** Complete strict event replay for restoring a configured call budget. */
+	readToolCallBudgetEvents?: () => Promise<readonly RunEvent[]>
 
 	/**
 	 * Builds the durable-pause seam handed to one tool call.
@@ -492,6 +497,7 @@ export class ToolExecutor {
 	private workingStateManager?: WorkingStateManager
 	private probes: ProbeEnforcement
 	private parentSpan?: Span
+	private readonly toolCallBudget?: ToolCallBudget
 	private readonly preparedBatches = new WeakSet<PreparedToolBatch>()
 	/** Set per turn by the orchestrator; see {@link setStepAllowedTools}. */
 	private stepAllowedTools?: readonly string[]
@@ -517,6 +523,15 @@ export class ToolExecutor {
 		log: Logger,
 		probes: ProbeEnforcement = defaultProbeRegistry,
 	) {
+		assertMaxToolCalls(config.maxToolCalls)
+		if (config.maxToolCalls !== undefined) {
+			this.toolCallBudget = new ToolCallBudget(
+				config.maxToolCalls,
+				config.runId,
+				emitEvent,
+				config.readToolCallBudgetEvents,
+			)
+		}
 		this.config = config
 		this.activityStore = activityStore
 		this.emitEvent = emitEvent
@@ -730,6 +745,18 @@ export class ToolExecutor {
 			if (owned && !this.preparedBatches.has(owned)) {
 				throw new Error('Prepared tool batch is not owned by this executor.')
 			}
+			const refusal = this.toolCallBudget
+				? await this.toolCallBudget.admit(
+						toolCalls.filter((call) => prior?.get(call.id) === undefined).length,
+						'batch',
+						this.config.abortSignal,
+					)
+				: undefined
+			if (refusal) {
+				const refused = new Map(denials)
+				for (const call of toolCalls) if (!refused.has(call.id)) refused.set(call.id, refusal)
+				return await this.runBatch(toolCalls, refused, prior, owned)
+			}
 			return await this.runBatch(toolCalls, denials, prior, owned)
 		} finally {
 			// Cleared so a later single execution outside a batch resolves
@@ -779,6 +806,24 @@ export class ToolExecutor {
 		const results: ToolCallOutcome[] = new Array(toolCalls.length)
 		const parallel: Promise<void>[] = []
 		let serial: Promise<void> = Promise.resolve()
+		let barrier: Promise<void> | undefined
+		const schedule = (run: () => Promise<void>, safe: boolean, isBarrier: boolean): void => {
+			if (isBarrier) {
+				// Settle the entire preceding segment, even when host plumbing
+				// rejects. A rejected host operation prevents dependent execution.
+				barrier = Promise.allSettled([...parallel, serial]).then(async (settled) => {
+					const failed = settled.find((entry) => entry.status === 'rejected')
+					if (failed?.status === 'rejected') throw failed.reason
+					await run()
+				})
+				parallel.length = 0
+				serial = barrier
+			} else if (safe) {
+				parallel.push(barrier ? barrier.then(run) : run())
+			} else {
+				serial = serial.then(run)
+			}
+		}
 		// Bounded fan-out. A model emitting fifty parallel reads used to open
 		// fifty file handles and fifty activity records simultaneously; the
 		// gate keeps that at a working-set size while preserving completion
@@ -786,6 +831,8 @@ export class ToolExecutor {
 		const gate = new Semaphore(this.config.maxToolConcurrency ?? DEFAULT_TOOL_CONCURRENCY)
 		toolCalls.forEach((toolCall, i) => {
 			const preparedCall = preparedBatch?.calls.get(toolCall.id)
+			const tool = this.config.tools.get(preparedCall?.toolName ?? toolCall.function.name)
+			const isBarrier = tool?.executionBarrier === true
 			const recovered = prior?.get(toolCall.id)
 			if (recovered !== undefined) {
 				// This call already ran, in a process that died before the
@@ -798,19 +845,21 @@ export class ToolExecutor {
 					output: recovered.result,
 					isError: recovered.isError,
 				}
+				if (isBarrier) schedule(async () => {}, true, true)
 				return
 			}
 
 			const denialReason = denials?.get(toolCall.id)
 			if (denialReason !== undefined) {
 				// Denied calls never touch the tool; they still get a result
-				// message so the assistant turn stays fully answered. Run them
-				// on the parallel branch — they perform no side effects, so
-				// serialization would only add latency.
-				parallel.push(
-					this.recordDenial(toolCall, denialReason, preparedCall).then((r) => {
-						results[i] = r
-					}),
+				// message so the assistant turn stays fully answered. They can
+				// overlap other calls within a segment, respecting its barriers.
+				schedule(
+					async () => {
+						results[i] = await this.recordDenial(toolCall, denialReason, preparedCall)
+					},
+					true,
+					isBarrier,
 				)
 				return
 			}
@@ -868,13 +917,8 @@ export class ToolExecutor {
 			} catch {
 				// non-JSON args → treat as unsafe (serialize), the conservative path
 			}
-			const preparedToolName = preparedCall?.toolName
-			const safe =
-				this.config.tools
-					.get(preparedToolName ?? toolCall.function.name)
-					?.isConcurrencySafe?.(input) === true
-			if (safe) parallel.push(gated())
-			else serial = serial.then(run)
+			const safe = tool?.isConcurrencySafe?.(input) === true
+			schedule(safe ? gated : run, safe, isBarrier)
 		})
 		await Promise.all([...parallel, serial])
 
@@ -942,8 +986,14 @@ export class ToolExecutor {
 		// retained closure must be observationally inert after its invocation
 		// ends, not merely unable to finish the registry call it already started.
 		signal.throwIfAborted()
+		// Preparation detaches input synchronously before its first await.
+		// Admission must not add an earlier yield where the caller can mutate it.
 		const preparedCall = await this.prepareNestedCall(name, input, signal)
 		signal.throwIfAborted()
+		if (this.toolCallBudget) {
+			const refusal = await this.toolCallBudget.admit(1, 'nested', signal)
+			if (refusal) return { success: false, output: '', error: refusal }
+		}
 		const preparedInput = preparedCall.input
 
 		const parent = context.toolUseId
@@ -1550,6 +1600,19 @@ export class ToolExecutor {
 				break
 			}
 
+			let refusal: string | undefined
+			try {
+				if (this.toolCallBudget)
+					refusal = await this.toolCallBudget.admit(1, 'retry', this.config.abortSignal)
+			} catch (error) {
+				if (this.config.abortSignal.aborted) break
+				throw error
+			}
+			if (refusal) {
+				result = { success: false, output: '', error: refusal }
+				post = { override: null, retry: false }
+				break
+			}
 			result = await this.runOnce(toolName, input, toolContext, prepared)
 			post = await this.runPostToolHook(toolName, input, result)
 		}

package/src/runtime/query/index.ts

@@ -149,8 +149,9 @@ import {
 	resolveSandboxTeardownTimeoutMs,
 	teardownSandbox,
 } from './sandbox-lifecycle.js'
-import { SteeringBinding, type SteeringChannel } from './steering.js'
+import { SteeringBinding, type SteeringChannel, isOperatorUserMessage } from './steering.js'
 import { resolveQueryBudget } from './token-budget.js'
+import { assertMaxToolCalls } from './tool-call-budget.js'
 import { ToolGrantSet } from './tool-grants.js'
 import { createToolPause } from './tool-pause.js'
 import { ToolingBootstrap } from './tooling.js'
@@ -349,6 +350,8 @@ export interface QueryParams {
 
 	/** Max concurrently-executing concurrency-safe tools in one batch. */
 	maxToolConcurrency?: number
+	/** Per-run cumulative tool attempt limit, including nested calls and retries. Unset is unlimited. Re-supply on resume; durable reservations are never refunded. */
+	maxToolCalls?: number
 
 	/**
 	 * Model-visible size cap for a single tool result. Over-budget output is
@@ -450,14 +453,9 @@ export interface QueryParams {
 	beforeStep?: BeforeStep
 
 	/**
-	 * Force the run to finish by calling a schema-validated tool, and land
-	 * the parsed value on `Run.structuredOutput`.
-	 *
-	 * Both leaf pieces already shipped and neither was reachable:
-	 * `createStructuredOutputTool` is excluded from the default builtin set,
-	 * and `StructuredOutputConfig` had no field on QueryParams at all. A host
-	 * needing a typed result had to register the tool by hand and hope —
-	 * nothing forced the call, and nothing stopped the loop when it came.
+	 * Produce a locally validated structured result. Defaults to an output tool;
+	 * mode:'native' requests JSON Schema from an explicitly capable driver.
+	 * Host review and bounded corrections apply before publication.
 	 */
 	structuredOutput?: StructuredOutputConfig
 
@@ -1027,6 +1025,19 @@ function withoutOwnedResumeTurn(
 }
 
 export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run> {
+	assertMaxToolCalls(params.maxToolCalls)
+	// Required types do not protect JavaScript callers. Reject missing scope
+	// before opening a budget or persisting a run without its owning identity.
+	const missingFields = (['sessionId', 'topicId', 'projectId', 'tenantId'] as const).filter(
+		(field) => !params[field],
+	)
+	if (missingFields.length > 0) {
+		throw new NamzuError({
+			code: 'invalid_config',
+			message: `query requires sessionId, topicId, projectId, and tenantId; missing: ${missingFields.join(', ')}.`,
+			details: { missingFields },
+		})
+	}
 	const selectedResumeState = selectedResumeStates.get(params)
 	selectedResumeStates.delete(params)
 	// Resolved at the DOOR, before a run id exists or a logger is built.
@@ -1154,6 +1165,8 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 		runConfig.timeoutMs,
 		log,
 	)
+	const modelContextWindows = new Map<string, number | undefined>()
+	if (runConfig.model) modelContextWindows.set(runConfig.model, providerContextWindow)
 
 	// The mode this conversation was left in, when the run config names none.
 	// Read once, before the loop exists, for the same reason the context
@@ -1556,7 +1569,11 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 	// invalidate the whole prompt cache for the rest of the run — the same
 	// reason the forced-final turn keeps its tools array and uses
 	// `toolChoice: 'none'` instead of dropping it.
-	if (params.structuredOutput && !params.tools.has(STRUCTURED_OUTPUT_TOOL_NAME)) {
+	if (
+		params.structuredOutput &&
+		params.structuredOutput.mode !== 'native' &&
+		!params.tools.has(STRUCTURED_OUTPUT_TOOL_NAME)
+	) {
 		params.tools.register(createStructuredOutputTool(params.structuredOutput.schema))
 	}
 
@@ -1718,6 +1735,13 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 			...(params.toolRetryBackoff !== undefined
 				? { toolRetryBackoff: params.toolRetryBackoff }
 				: {}),
+			...(params.maxToolCalls !== undefined
+				? {
+						maxToolCalls: params.maxToolCalls,
+						readToolCallBudgetEvents: () =>
+							ctx.runMgr.getRunStore().readEvents({ integrity: 'strict' }),
+					}
+				: {}),
 			...(params.maxToolConcurrency !== undefined
 				? { maxToolConcurrency: params.maxToolConcurrency }
 				: {}),
@@ -1970,11 +1994,27 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 		...(params.repeatCallAdvisory === false ? {} : { repeatCalls: new RepeatCallTracker() }),
 		compactionConfig,
 		...(params.inboundMessages ? { inboundMessages: params.inboundMessages } : {}),
+		...(params.resumeFromCheckpoint ? { resumedInput: queuedForThisRun } : {}),
 		...(params.waitForInbound ? { waitForInbound: params.waitForInbound } : {}),
 		...(params.projectInstructionContext
 			? { projectInstructionContext: params.projectInstructionContext }
 			: {}),
 		...(providerContextWindow !== undefined ? { providerContextWindow } : {}),
+		resolveModelContextWindow: async (model) => {
+			if (!modelContextWindows.has(model)) {
+				modelContextWindows.set(
+					model,
+					await resolveProviderContextWindow(
+						resilientProvider,
+						model,
+						ctx.abortController.signal,
+						runConfig.timeoutMs,
+						log,
+					),
+				)
+			}
+			return modelContextWindows.get(model)
+		},
 		workingStateManager,
 		taskRouter: params.taskRouter,
 		contextReducer: params.contextReducer,
@@ -2333,7 +2373,6 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 				}
 			} else {
 				pushSystemMessages()
-				let isFirstUserMessage = true
 				for (const msg of initialMessages) {
 					if (msg.role === 'system') {
 						// A fresh run rebuilds its current static/dynamic prompt above,
@@ -2351,11 +2390,18 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 						continue
 					}
 					ctx.runMgr.pushMessage(msg)
-
-					if (workingStateManager && msg.role === 'user' && msg.content) {
-						extractFromUserMessage(workingStateManager, msg.content, isFirstUserMessage)
-						isFirstUserMessage = false
-					}
+				}
+			}
+			// Fresh and continuation histories seed the same operator state.
+			// A worker report or project-policy message may have role `user`,
+			// but it must not become the task or an operator requirement.
+			// Resume restores this state and adopts only its newer queue arrivals.
+			if (!params.resumeFromCheckpoint && workingStateManager) {
+				let isFirstUserMessage = true
+				for (const message of initialMessages) {
+					if (!isOperatorUserMessage(message) || !message.content.trim()) continue
+					extractFromUserMessage(workingStateManager, message.content, isFirstUserMessage)
+					isFirstUserMessage = false
 				}
 			}
 
@@ -2713,6 +2759,16 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 					ctx.log,
 				)
 
+				if (outputVerdict.blocked || outputVerdict.rewritten !== undefined) {
+					ctx.runMgr.clearStructuredOutput()
+					if (
+						params.structuredOutput &&
+						outputVerdict.rewritten !== undefined &&
+						ctx.runMgr.stopReason === 'end_turn'
+					)
+						ctx.runMgr.setStopReason('output_guardrail')
+				}
+
 				if (outputVerdict.blocked) {
 					await eventTranslator.emitEvent({
 						type: 'guardrail_triggered',
@@ -2773,6 +2829,7 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 					}
 				}
 			}
+			if (ctx.abortController.signal.aborted) ctx.runMgr.markCancelled()
 			yield* resultAssembler.completeRun(rootSpan)
 		} catch (err) {
 			// A failed run still spent its steps; report them.