@rulvar/core 1.194.0 → 1.195.0

package/dist/index.d.ts

@@ -9329,6 +9329,23 @@ interface OrchestrateOptions {
   /** The opt in child completion policy; see {@link OrchestrateAcceptance}. */
   acceptance?: OrchestrateAcceptance;
   /**
+  * The terminal child barrier policy (RV1903, the four-role
+  * benchmark's recovery arm): what happens to children still running
+  * when the orchestration exits, on EVERY exit path (an accepted or
+  * rejected finish, a typed failure, a budget or exposure terminal).
+  * 'cancel' (the default) aborts them and awaits their journaled
+  * cancelled terminals; 'drain' awaits their natural terminals,
+  * bounded by their own limits and budgets, preserving their evidence
+  * at the price of the wait. Either way the orchestration returns
+  * only after every spawned child has a terminal journal entry, so
+  * `run_settle` can never precede a child's billing row again: the
+  * benchmark's recovery journal recorded three child terminals AFTER
+  * the settle decision, and four mutually inconsistent cost views
+  * followed. The verdict the run settled with is already frozen
+  * before the barrier runs, so late children never change it.
+  */
+  onUnsettledAtExit?: "cancel" | "drain";
+  /**
   * The opt in deterministic host validation of the finish result, with
   * bounded repair; see {@link FinishValidationSpec}.
   */

package/dist/index.js

@@ -20740,6 +20740,7 @@ function validateOrchestrateOptions(opts) {
 	if (opts === void 0) return;
 	if (opts.maxSpawns !== void 0) requireNonNegativeInteger(opts.maxSpawns, "orchestrate maxSpawns");
 	if (opts.renderBudgetChars !== void 0) requireNonNegativeInteger(opts.renderBudgetChars, "orchestrate renderBudgetChars");
+	if (opts.onUnsettledAtExit !== void 0 && opts.onUnsettledAtExit !== "cancel" && opts.onUnsettledAtExit !== "drain") throw new ConfigError(`orchestrate onUnsettledAtExit must be 'cancel' or 'drain'; got ${String(opts.onUnsettledAtExit)}`);
 	if (opts.acceptance !== void 0) {
 		const policy = opts.acceptance.childPolicy;
 		const minSuccessful = typeof policy === "object" && policy !== null && !Array.isArray(policy) ? policy.minSuccessful : void 0;
@@ -21051,7 +21052,7 @@ function filterProfiles(registered, names) {
 */
 function makeOrchestratorWorkflow(goal, opts) {
 	validateOrchestrateOptions(opts);
-	return defineWorkflow({ name: ORCHESTRATE_WORKFLOW_NAME }, async (ctx) => {
+	const orchestrationBody = async (ctx, barrier) => {
 		const runtime = runtimeOf(ctx);
 		const { internals } = runtime;
 		if (internals.admission === void 0) throw new ConfigError("orchestrate requires the engine run context (createEngine)");
@@ -21152,6 +21153,28 @@ function makeOrchestratorWorkflow(goal, opts) {
 		const byOrdinal = /* @__PURE__ */ new Map();
 		const rejectedByOrdinal = /* @__PURE__ */ new Map();
 		/**
+		* The terminal child barrier (RV1903): every exit of this
+		* orchestration, returned or thrown, passes through the finally
+		* below, so a child still running when the verdict froze reaches a
+		* journaled terminal BEFORE the workflow settles. The benchmark's
+		* recovery journal recorded run_settle at sequence 18 and three
+		* child terminals at 19..21; the returned outcome, the terminal
+		* invoice and the event snapshot all disagreed with the final
+		* journal. 'cancel' (default) aborts the stragglers and awaits
+		* their cancelled terminals; 'drain' awaits their natural
+		* terminals, bounded by their own limits. The frozen verdict is
+		* journaled before the barrier runs, so late children never change
+		* it; result promises never reject (SpawnRecord contract), so the
+		* barrier never masks the exit's own error.
+		*/
+		const exitBarrier = async () => {
+			const live = [...byOrdinal.values()].filter((record) => record.settled === void 0);
+			if (live.length === 0) return;
+			if ((opts?.onUnsettledAtExit ?? "cancel") === "cancel") for (const record of live) record.abort();
+			await Promise.allSettled(live.map((record) => record.result));
+		};
+		barrier.run = exitBarrier;
+		/**
 		* The journaled spec behind each recovered ordinal: the idempotent
 		* re-execution guard compares it against the incoming call, because
 		* after a cross-attempt resume a REGENERATED turn (the boundary
@@ -23710,6 +23733,14 @@ function makeOrchestratorWorkflow(goal, opts) {
 				claimConsistencyMeta
 			}
 		};
+	};
+	return defineWorkflow({ name: ORCHESTRATE_WORKFLOW_NAME }, async (ctx) => {
+		const barrier = {};
+		try {
+			return await orchestrationBody(ctx, barrier);
+		} finally {
+			await barrier.run?.();
+		}
 	});
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.194.0",
+  "version": "1.195.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",