@rulvar/core 1.59.3 → 1.60.0

package/dist/index.d.ts

@@ -2652,6 +2652,7 @@ declare class Replayer {
   private readonly runId;
   private readonly store;
   private readonly lease?;
+  private readonly leaseOf?;
   private readonly now;
   private readonly priceUsd?;
   private readonly onWarn?;
@@ -2683,6 +2684,14 @@ declare class Replayer {
     * is asserted instead of fenced (the embedded default).
     */
     lease?: Lease;
+    /**
+    * Late-bound lease lookup (P0.2): consulted at EVERY append,
+    * winning over the static `lease` when it returns one. The engine
+    * passes its segment-lease holder here, because the
+    * engine-acquired genesis lease exists only after the ownership
+    * boot, which runs after this constructor.
+    */
+    leaseOf?: () => Lease | undefined;
   });
   /**
   * Forward-matches one live call against the prior journal. Fresh
@@ -3867,6 +3876,24 @@ interface UsageLimits {
     max: number;
     costs?: Record<string, number>;
   };
+  /**
+  * The guaranteed finalization turn (the experiment-review P1.1): when
+  * a TOOL budget limiter (maxToolCalls or toolUnits) expires, the
+  * runtime closes the current batch's remaining calls with explicit
+  * skipped-call error results instead of dropping them silently, then
+  * grants the model exactly ONE summary turn with tools withheld
+  * before the invocation settles as status 'limit' with the exact
+  * limiter named in the terminal error. The summary text becomes the
+  * limit result's output for schema-less calls; a ridden schema
+  * validates into typed output when the summary parses (one attempt,
+  * no re-prompt). `maxOutputTokens` bounds the summary turn only;
+  * absent, the ordinary per-turn output policy applies. Off by
+  * default: the skip results and the summary instruction enter the
+  * conversation, so enabling it changes recorded model requests.
+  */
+  finalizationReserve?: {
+    maxOutputTokens?: number;
+  };
 }
 declare const DEFAULT_MAX_TURNS = 32;
 declare const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 12e4;
@@ -3887,6 +3914,9 @@ interface EffectiveUsageLimits {
     max: number;
     costs?: Record<string, number>;
   };
+  finalizationReserve?: {
+    maxOutputTokens?: number;
+  };
 }
 /**
 * Limits merge per spawn: AgentOpts.limits over profile limits over engine
@@ -5682,6 +5712,25 @@ interface CreateEngineOptions {
   security?: {
     argsHashSalt?: string;
   };
+  /**
+  * The genesis ownership protocol (P0.2): over a journal store with
+  * the lease capability, a run or resume segment that was NOT handed
+  * a lease acquires its own before its first durable mutation, renews
+  * it at ttl/3 exactly like a queue worker, and releases it at
+  * settle. Fresh start, in-process resume, and worker takeover then
+  * share ONE owner/lease contract: at most one live driver per run
+  * across processes, a second driver's acquire rejects with the typed
+  * LeaseHeldError before any write or provider dispatch, and a
+  * crashed owner's lease expires after the store ttl so a worker
+  * sweep recovers the run. Default 'auto'. 'none' restores the
+  * pre-1.59.4 behavior (no engine-acquired leases) for hosts that
+  * coordinate ownership entirely outside the engine; a lease passed
+  * via RunOptions.lease or ResumeOptions.lease always wins over both
+  * modes (the caller owns acquire, renew, and release). Stores
+  * without the lease capability are unaffected: the embedded
+  * single-process default keeps the single-writer precondition.
+  */
+  ownership?: "auto" | "none";
 }
 interface RunOptions {
   /** Explicit id; otherwise the engine mints a ULID. */
@@ -5713,6 +5762,19 @@ interface RunOptions {
   tags?: string[];
   /** Host-initiated cancellation. */
   signal?: AbortSignal;
+  /**
+  * A lease the caller already holds for this run (the genesis side of
+  * the ResumeOptions.lease contract): the engine carries it on EVERY
+  * durable mutation of the fresh segment (every journal append, every
+  * putMeta, every transcript blob write) and never acquires, renews,
+  * or releases it itself; lifecycle stays with the caller. Passing it
+  * disables the engine's own ownership acquisition for this run
+  * regardless of the `ownership` mode. Hosts that admit runs through
+  * an external queue acquire the lease at admission time and hand it
+  * here, so admission and the first dispatch are covered by ONE
+  * fencing epoch.
+  */
+  lease?: Lease;
 }
 /** Resume-time hit/miss/orphan accounting. */
 interface ResumePreview extends ResumeReport {
@@ -7334,8 +7396,12 @@ interface RunInternals {
   * worktree patches) exactly as the Replayer threads it into every
   * journal append, so a store declaring fencedWrites refuses a
   * superseded segment's blob overwrites (fenced run state RFC, F2).
+  * The engine binds this as a live getter over its segment-lease
+  * holder (P0.2), so the union with undefined is explicit: before
+  * the ownership boot (and on non-leasable stores) it reads
+  * undefined.
   */
-  lease?: Lease;
+  lease?: Lease | undefined;
   adapters: ReadonlyMap<string, ProviderAdapter>;
   defaults: {
     routing?: Partial<Record<InvocationRole, ModelSpec>>;

package/dist/index.js

@@ -420,6 +420,7 @@ function wrapJournalStore(inner, hook) {
 		wrapped.acquire = (runId, owner) => inner.acquire(runId, owner);
 		wrapped.renew = (l) => inner.renew(l);
 		wrapped.release = (l) => inner.release(l);
+		if (typeof leasable.leaseTtlMs === "number") wrapped.leaseTtlMs = leasable.leaseTtlMs;
 	}
 	if (typeof inner.getMeta === "function") wrapped.getMeta = (runId) => inner.getMeta(runId);
 	return wrapped;
@@ -6779,6 +6780,7 @@ var Replayer = class {
 	runId;
 	store;
 	lease;
+	leaseOf;
 	now;
 	priceUsd;
 	onWarn;
@@ -6796,6 +6798,7 @@ var Replayer = class {
 		this.runId = options.runId;
 		this.store = options.store;
 		if (options.lease !== void 0) this.lease = options.lease;
+		if (options.leaseOf !== void 0) this.leaseOf = options.leaseOf;
 		this.now = options.now ?? realNow;
 		if (options.priceUsd !== void 0) this.priceUsd = options.priceUsd;
 		if (options.onWarn !== void 0) this.onWarn = options.onWarn;
@@ -7083,7 +7086,7 @@ var Replayer = class {
 		} });
 		const shapeIssues = validateEntryShape(entry);
 		if (shapeIssues.length > 0) throw new ConfigError(`journal entry shape violation (kind '${entry.kind}'): ` + shapeIssues.map((i) => i.message).join("; "));
-		await this.store.append(this.runId, entry, this.lease);
+		await this.store.append(this.runId, entry, this.leaseOf?.() ?? this.lease);
 		this.entries.push(entry);
 		if (entry.status === "suspended") this.foldInternal.registerSuspended(entry);
 		else if (entry.kind !== "resolution" && entry.kind !== "abandon") this.foldInternal.registerEntry(entry);
@@ -9325,6 +9328,8 @@ function mergeUsageLimits(call, profile, engine) {
 	if (maxCallsPerTool !== void 0) merged.maxCallsPerTool = maxCallsPerTool;
 	const toolUnits = pick("toolUnits");
 	if (toolUnits !== void 0) merged.toolUnits = toolUnits;
+	const finalizationReserve = pick("finalizationReserve");
+	if (finalizationReserve !== void 0) merged.finalizationReserve = finalizationReserve;
 	return merged;
 }
 /**
@@ -9364,6 +9369,12 @@ function validateUsageLimits(limits, site) {
 			for (const [name, cost] of Object.entries(costs)) requireNonNegativeInteger(cost, `${site}.toolUnits.costs['${name}']`);
 		}
 	}
+	if (limits.finalizationReserve !== void 0) {
+		const reserve = limits.finalizationReserve;
+		if (typeof reserve !== "object" || reserve === null || Array.isArray(reserve)) throw new ConfigError(`${site}.finalizationReserve must be { maxOutputTokens? }`);
+		const { maxOutputTokens } = reserve;
+		if (maxOutputTokens !== void 0) requirePositiveInteger(maxOutputTokens, `${site}.finalizationReserve.maxOutputTokens`);
+	}
 }
 //#endregion
 //#region src/runtime/model-retry.ts
@@ -10527,8 +10538,27 @@ async function runAgent(options) {
 	let toolCallsUsed = 0;
 	let escalationRequest;
 	let abortClass;
+	/**
+	* Set at a tool-budget expiry when limits.finalizationReserve is
+	* configured (P1.1); the reserve turn itself runs at ONE site after
+	* the loop ends (the pending-turn path trips before the dispatch
+	* machinery below is even defined), inside the still-open loop phase.
+	*/
+	let reserveRequest;
 	const noProgress = new NoProgressDetector(limits.noProgressTurns);
 	const guard = explorationTrackingEnabled(limits) ? new ExplorationGuard(limits) : void 0;
+	/**
+	* The exact limiter behind a tool-budget expiry, with its counts: the
+	* wording rides the finalization-reserve instruction and the 'limit'
+	* terminal's errorMessage (P1.1 criterion: the terminal names the
+	* limiter, never a bare status).
+	*/
+	const toolBudgetDetail = (limiter) => {
+		if (limiter === "maxToolCalls") return `maxToolCalls (${String(toolCallsUsed)}/${String(limits.maxToolCalls ?? 0)})`;
+		const max = limits.toolUnits?.max ?? 0;
+		const used = guard === void 0 ? max : guard.summary(toolCallsUsed).toolUnitsUsed ?? max;
+		return `toolUnits (${String(used)}/${String(max)})`;
+	};
 	if (limits.toolBudgetNotices === true && limits.maxToolCalls === void 0) events?.emit({
 		type: "log",
 		level: "warn",
@@ -10650,15 +10680,42 @@ async function runAgent(options) {
 			part.isError = true;
 			return part;
 		};
+		/**
+		* Closes the batch tail at a tool-budget expiry (P1.1): with the
+		* finalization reserve configured every not-admitted call gets a
+		* typed skipped-call error result naming the limiter, so the model
+		* (and the transcript) sees exactly which calls never executed and
+		* the summary turn's history stays well formed (providers reject
+		* tool calls without matching results). Without the reserve the
+		* tail stays unanswered, byte-identical to before.
+		*/
+		const closeSkippedTail = (skippedCalls, limiter) => {
+			if (limits.finalizationReserve === void 0) return;
+			for (const call of skippedCalls) parts.push(errorPart(call, {
+				error: "skipped: the tool budget is exhausted; the call was not executed",
+				limiter,
+				skipped: true
+			}));
+		};
 		for (const [index, call] of calls.entries()) {
-			if (limits.maxToolCalls !== void 0 && toolCallsUsed >= limits.maxToolCalls) return {
-				parts,
-				limitHit: true
-			};
-			if (guard !== void 0 && guard.unitsExhausted()) return {
-				parts,
-				limitHit: true
-			};
+			if (limits.maxToolCalls !== void 0 && toolCallsUsed >= limits.maxToolCalls) {
+				closeSkippedTail(calls.slice(index), "maxToolCalls");
+				return {
+					parts,
+					limitHit: true,
+					limiter: "maxToolCalls",
+					skipped: calls.length - index
+				};
+			}
+			if (guard !== void 0 && guard.unitsExhausted()) {
+				closeSkippedTail(calls.slice(index), "toolUnits");
+				return {
+					parts,
+					limitHit: true,
+					limiter: "toolUnits",
+					skipped: calls.length - index
+				};
+			}
 			const def = runtime.defs.find((candidate) => candidate.name === call.name);
 			events?.emit({
 				type: "tool:start",
@@ -10860,7 +10917,7 @@ async function runAgent(options) {
 			if (record.isError === true) part.isError = true;
 			return part;
 		});
-		const { parts, limitHit, escalated, finished, guardTrip } = await runToolCalls([restored.pending.awaiting, ...restored.pending.remaining], priorParts);
+		const { parts, limitHit, escalated, finished, guardTrip, limiter, skipped } = await runToolCalls([restored.pending.awaiting, ...restored.pending.remaining], priorParts);
 		if (parts.length > 0) messages.push({
 			role: "tool",
 			parts
@@ -10881,6 +10938,16 @@ async function runAgent(options) {
 					retryable: false
 				};
 				errorMessage = guard.describeTrip();
+			} else if (limiter !== void 0 && limits.finalizationReserve !== void 0) {
+				agentError = {
+					kind: "terminal",
+					retryable: false
+				};
+				errorMessage = `tool budget exhausted: ${toolBudgetDetail(limiter)}; skipped tool calls: ${String(skipped ?? 0)}`;
+				reserveRequest = {
+					limiter,
+					skipped: skipped ?? 0
+				};
 			}
 		} else {
 			maybePushBudgetNotice();
@@ -11282,7 +11349,7 @@ async function runAgent(options) {
 		}
 		if (options.tools !== void 0 && outcome.turn.toolCalls.length > 0) {
 			noProgress.recordTurn({ toolCalls: outcome.turn.toolCalls.length });
-			const { parts, limitHit, escalated, finished, guardTrip } = await runToolCalls(outcome.turn.toolCalls, []);
+			const { parts, limitHit, escalated, finished, guardTrip, limiter, skipped } = await runToolCalls(outcome.turn.toolCalls, []);
 			if (parts.length > 0) messages.push({
 				role: "tool",
 				parts
@@ -11307,6 +11374,16 @@ async function runAgent(options) {
 						retryable: false
 					};
 					errorMessage = guard.describeTrip();
+				} else if (limiter !== void 0 && limits.finalizationReserve !== void 0) {
+					agentError = {
+						kind: "terminal",
+						retryable: false
+					};
+					errorMessage = `tool budget exhausted: ${toolBudgetDetail(limiter)}; skipped tool calls: ${String(skipped ?? 0)}`;
+					reserveRequest = {
+						limiter,
+						skipped: skipped ?? 0
+					};
 				}
 				break;
 			}
@@ -11492,6 +11569,110 @@ async function runAgent(options) {
 		await saveBoundary();
 		continue loop;
 	}
+	if (status === "limit" && reserveRequest !== void 0) {
+		const { limiter, skipped } = reserveRequest;
+		let proceed = true;
+		try {
+			options.budget?.beforeTurn();
+		} catch {
+			events?.emit({
+				type: "log",
+				level: "warn",
+				msg: "the finalization reserve turn was skipped: the budget blocks further turns"
+			});
+			proceed = false;
+		}
+		if (proceed) {
+			turns += 1;
+			const reserveMessages = [...messages, {
+				role: "user",
+				parts: [{
+					type: "text",
+					text: `The tool budget is exhausted (${toolBudgetDetail(limiter)}). Skipped tool calls: ${String(skipped)}; no further tool calls will execute. This is the final turn: produce your best final answer from the evidence already collected.`
+				}]
+			}];
+			let reserveDispatch;
+			try {
+				reserveDispatch = await dispatchPhase({
+					role: primaryRole,
+					chain: loopChain,
+					cursor: loopCursor,
+					requestFor: (target) => {
+						let req = buildRequest(target.resolved, projectHistory(reserveMessages, providerOf(target.adapter)), limits, options.tools?.contracts);
+						if (options.schema !== void 0 && options.canonicalSchema !== void 0 && !separateExtract) req = applyStructuredOutputTier(req, rideTierFor(target), options.canonicalSchema);
+						if (req.tools !== void 0) req = {
+							...req,
+							toolChoice: "none"
+						};
+						const reserveMax = limits.finalizationReserve?.maxOutputTokens;
+						if (reserveMax !== void 0) req = {
+							...req,
+							maxOutputTokens: Math.min(req.maxOutputTokens ?? reserveMax, reserveMax)
+						};
+						return applyOutputBudget(req, target, options.budget);
+					},
+					streamOptionsFor: (target) => {
+						const reserveStreamOptions = {
+							idleTimeoutMs: limits.streamIdleTimeoutMs,
+							signals: options.signal === void 0 ? [] : [options.signal],
+							onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
+						};
+						if (options.budget?.signal !== void 0) reserveStreamOptions.budgetSignal = options.budget.signal;
+						if (options.stream === true) reserveStreamOptions.onDelta = (delta) => events?.emit({
+							type: "agent:stream",
+							delta
+						});
+						return reserveStreamOptions;
+					}
+				});
+			} catch (thrown) {
+				if (!(thrown instanceof BudgetExhaustedError)) throw thrown;
+				events?.emit({
+					type: "log",
+					level: "warn",
+					msg: `the finalization reserve turn was skipped: ${thrown.message}`
+				});
+			}
+			if (reserveDispatch !== void 0) {
+				const { outcome, target: reserveTarget } = reserveDispatch;
+				servedBy = reserveTarget.resolved.ref;
+				usageApprox = usageApprox || outcome.usageApprox;
+				messages.push(assistantMsg(outcome.turn, liftRetainedParts(outcome.providerMetadata, reserveTarget.adapter)));
+				if (invariantViolation !== void 0) {
+					status = "error";
+					agentError = {
+						kind: "transport",
+						retryable: false
+					};
+					errorMessage = invariantViolation;
+				} else if (outcome.aborted === "external") status = "cancelled";
+				else if (outcome.aborted === "budget") {
+					status = "cancelled";
+					agentError = {
+						kind: "budget",
+						retryable: false
+					};
+				} else {
+					await saveBoundary();
+					if (outcome.wireError !== void 0 || outcome.aborted === "idle") events?.emit({
+						type: "log",
+						level: "warn",
+						msg: "the finalization reserve turn failed; the limit terminal stands" + (outcome.wireError === void 0 ? " (stream idle timeout)" : ` (${outcome.wireError.message})`)
+					});
+					else if (options.schema === void 0) {
+						const summary = outcome.turn.text;
+						if (summary.trim() !== "") output = summary;
+					} else if (!separateExtract && options.canonicalSchema !== void 0) {
+						const candidate = extractCandidate(outcome.turn, rideTierFor(reserveTarget));
+						if (candidate !== void 0) {
+							const validation = await validateSchemaSpec(options.schema, candidate.raw);
+							if (validation.valid) output = validation.value;
+						}
+					}
+				}
+			}
+		}
+	}
 	endPhase(loopPhase, phaseOutcome(), servedBy);
 	if (status === "ok" && !finishedViaTool && options.finalize !== void 0) {
 		const finalizeResolved = options.finalize.resolved;
@@ -14206,7 +14387,7 @@ function createCtx(internals, rootWorkflow) {
 			transcriptRef: result.transcriptRef
 		};
 		if (result.status === "escalated" && result.escalation !== void 0) terminalPatch.escalation = result.escalation;
-		if (result.output !== null && result.status === "ok") terminalPatch.value = result.output;
+		if (result.output !== null && (result.status === "ok" || result.status === "limit")) terminalPatch.value = result.output;
 		if (result.error !== void 0) terminalPatch.error = agentErrorToWire(result.error, result.errorMessage ?? `agent terminated with status ${result.status}`);
 		const resultUsageApprox = result.usageApprox === true;
 		if (resultUsageApprox) terminalPatch.usageApprox = true;
@@ -17119,6 +17300,28 @@ function hashRunOutput(value) {
 		return;
 	}
 }
+/**
+* Engine ownership identity: a process-local counter, not Math.random()
+* (the queue worker's identity convention): owner strings need
+* uniqueness within the store, and the dev-mode bare-randomness guard
+* stays armed while any run is live.
+*/
+let engineOrdinal = 0;
+function engineIdentity() {
+	engineOrdinal += 1;
+	return `rulvar-engine:${process.pid}:${engineOrdinal}`;
+}
+/** Lease capability guard, mirroring createWorker's detection. */
+function leaseCapable(store) {
+	const candidate = store;
+	return typeof candidate.acquire === "function" && typeof candidate.renew === "function" && typeof candidate.release === "function";
+}
+/**
+* The renew-cadence fallback when a leasable store exposes no
+* leaseTtlMs: the Appendix A interim reference ttl the shipped stores
+* default to (60000 ms).
+*/
+const ENGINE_DEFAULT_LEASE_TTL_MS = 6e4;
 function createEngine(options) {
 	const adapters = buildAdapterRegistry(options.adapters);
 	const rawJournal = options.stores?.journal ?? new InMemoryStore();
@@ -17128,6 +17331,17 @@ function createEngine(options) {
 	const maskEvents = options.redaction?.maskEvents ?? true;
 	const eventMasker = options.redaction?.patterns === void 0 ? void 0 : compileSecretMasker(options.redaction.patterns, "createEngine redaction.patterns");
 	const defaults = options.defaults ?? {};
+	const ownership = options.ownership ?? "auto";
+	if (ownership !== "auto" && ownership !== "none") throw new ConfigError(`createEngine ownership must be 'auto' or 'none'; got '${String(ownership)}'`);
+	const engineOwner = engineIdentity();
+	let ownershipRenewMs = Math.max(1, Math.floor(ENGINE_DEFAULT_LEASE_TTL_MS / 3));
+	if (ownership === "auto" && leaseCapable(journal)) {
+		const storeTtlMs = journal.leaseTtlMs;
+		if (storeTtlMs !== void 0) {
+			if (!Number.isInteger(storeTtlMs) || storeTtlMs < 1 || storeTtlMs > 2147483647) throw new ConfigError(`the journal store's leaseTtlMs capability must report an integer between 1 and 2147483647 ms for the engine's ownership renew cadence; got ${String(storeTtlMs)}`);
+			ownershipRenewMs = Math.max(1, Math.floor(storeTtlMs / 3));
+		}
+	}
 	if (defaults.retry !== void 0) validateRetryPolicy(defaults.retry, "createEngine defaults.retry");
 	if (options.concurrency?.perRun !== void 0) requirePositiveInteger(options.concurrency.perRun, "createEngine concurrency.perRun");
 	for (const [adapterId, cap] of Object.entries(options.concurrency?.perProvider ?? {})) requirePositiveInteger(cap, `createEngine concurrency.perProvider['${adapterId}']`);
@@ -17182,6 +17396,10 @@ function createEngine(options) {
 		if (compiled !== void 0 && options.runners?.sandbox === void 0) throw new ConfigError("running a CompiledWorkflow requires a sandbox runner: pass createEngine({ runners: { sandbox: new WorkerSandboxRunner() } }) from @rulvar/planner ");
 		const runId = resumeCtx?.runId ?? opts?.runId ?? mintRunId();
 		assertSafeRunId(runId, "engine.run");
+		const suppliedLease = resumeCtx?.lease ?? opts?.lease;
+		if (suppliedLease !== void 0 && suppliedLease.runId !== runId) throw new ConfigError(`the supplied lease is for run '${suppliedLease.runId}', not '${runId}'; a lease fences exactly the run it was acquired for`);
+		const segmentLease = {};
+		if (suppliedLease !== void 0) segmentLease.current = suppliedLease;
 		const registry = buildDeriverRegistry(options.extraDerivers);
 		const segmentsBefore = resumeCtx?.segmentsBefore ?? 0;
 		const telemetryBase = segmentsBefore * EVENT_SEGMENT_STRIDE;
@@ -17218,7 +17436,7 @@ function createEngine(options) {
 			}, rootSpanId),
 			keyRing: registryKeyRing(registry),
 			...resumeCtx === void 0 ? {} : { priorEntries: resumeCtx.priorEntries },
-			...resumeCtx?.lease === void 0 ? {} : { lease: resumeCtx.lease },
+			leaseOf: () => segmentLease.current,
 			strict: resumeCtx?.strict ?? false
 		});
 		for (const seqToInvalidate of invalidated) replayer.invalidate(seqToInvalidate);
@@ -17313,7 +17531,9 @@ function createEngine(options) {
 			external,
 			mintTranscriptRef: () => `${runId}/t${transcriptCounter++}`,
 			now: realNow,
-			...resumeCtx?.lease === void 0 ? {} : { lease: resumeCtx.lease }
+			get lease() {
+				return segmentLease.current;
+			}
 		};
 		const argsBinding = {};
 		if (resumeCtx === void 0) {
@@ -17341,15 +17561,60 @@ function createEngine(options) {
 			workflowName: wf.name,
 			workflowHash: compiled === void 0 ? hashWorkflowBody(wf) : hashWorkflowSource(compiled.source),
 			...compiled === void 0 ? {} : { workflowSourceRef: workflowSourceRef(runId) }
-		}, resumeCtx?.lease);
+		}, segmentLease.current);
 		if (activeSegments.has(runId)) throw new ConfigError(`run '${runId}' already has a live execution segment in this engine; await its settled result before starting another one (exactly one segment owns a run; https://docs.rulvar.com/guide/durability#resolving-a-settled-run)`);
 		activeSegments.add(runId);
+		let ownershipTeardown = () => Promise.resolve();
 		const result = (async () => {
+			let ownedLease;
+			let renewTimer;
+			const settleOwnership = async () => {
+				if (renewTimer !== void 0) {
+					clearInterval(renewTimer);
+					renewTimer = void 0;
+				}
+				const held = ownedLease;
+				ownedLease = void 0;
+				if (held !== void 0) {
+					segmentLease.current = void 0;
+					try {
+						await journal.release(held);
+					} catch {}
+				}
+			};
+			ownershipTeardown = settleOwnership;
+			if (ownership === "auto" && segmentLease.current === void 0 && resumeCtx?.strict !== true && leaseCapable(journal)) {
+				let acquired;
+				try {
+					acquired = await journal.acquire(runId, engineOwner);
+				} catch (thrown) {
+					if (deadlineTimer !== void 0) deadlineTimer.cancel();
+					external.close();
+					bus.end();
+					throw thrown;
+				}
+				ownedLease = acquired;
+				segmentLease.current = acquired;
+				renewTimer = setInterval(() => {
+					journal.renew(acquired).catch(() => {
+						bus.emit({
+							type: "log",
+							level: "warn",
+							msg: `run '${runId}' ownership lost: the lease could not be renewed and its fencing epoch may be superseded`
+						}, rootSpanId);
+						requestCancel("run ownership lost: lease fencing epoch superseded");
+						if (renewTimer !== void 0) {
+							clearInterval(renewTimer);
+							renewTimer = void 0;
+						}
+					});
+				}, ownershipRenewMs);
+			}
 			let status = "ok";
 			let value;
 			let wireError;
 			let pending = [];
-			if (compiled !== void 0 && resumeCtx?.strict !== true) await transcripts.put(workflowSourceRef(runId), new TextEncoder().encode(compiled.source), resumeCtx?.lease);
+			if (compiled !== void 0 && resumeCtx?.strict !== true) await transcripts.put(workflowSourceRef(runId), new TextEncoder().encode(compiled.source), segmentLease.current);
 			await putMeta("running");
 			bus.emit({
 				type: "run:start",
@@ -17476,9 +17741,11 @@ function createEngine(options) {
 				...replayer.resumeReport(),
 				invalidResolutions: replayer.fold.invalidResolutions()
 			});
+			await settleOwnership();
 			return outcome;
 		})();
 		result.catch(() => void 0).finally(() => {
+			ownershipTeardown();
 			activeSegments.delete(runId);
 		});
 		return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.59.3",
+  "version": "1.60.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",