@sensigo/realm 0.37.0 → 0.39.0

package/dist/engine/abandon-run.js

@@ -1,5 +1,5 @@
 import { WorkflowError } from '../types/workflow-error.js';
-import { deriveRunPhase } from './eligibility.js';
+import { deriveRunPhase, sealRunLevel } from './eligibility.js';
 /**
  * Explicitly abandon a run by stamping the authoritative `abandoned_at` marker. The run's phase
  * derives to `abandoned` (via {@link deriveRunPhase}) regardless of `failed_steps`/`terminal_reason`.
@@ -51,12 +51,10 @@ export async function abandonRun(store, runId, reason) {
     }
     const abandonedReason = reason ?? 'Abandoned via abandon_run';
     try {
-        return await store.update({
-            ...run,
-            abandoned_at: new Date().toISOString(),
-            terminal_state: true,
-            terminal_reason: abandonedReason,
-        });
+        // issue #367: run-level seal through the ONE bypass-writer chokepoint — it stamps
+        // sealed_by {arm: 'abandon_requested'} alongside abandoned_at and terminal_state in the same
+        // object literal.
+        return await store.update(sealRunLevel(run, 'abandon_requested', abandonedReason));
     }
     catch (err) {
         if (err instanceof WorkflowError && err.code === 'STATE_SNAPSHOT_MISMATCH') {

package/dist/engine/abandon-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"abandon-run.js","sourceRoot":"","sources":["../../src/engine/abandon-run.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAe,EACf,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEnC,wCAAwC;IACxC,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,8FAA8F;IAC9F,yCAAyC;IACzC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,+FAA+F;QAC/F,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,aAAa,CACrB,QAAQ,KAAK,0BAA0B,YAAY,mCAAmC,EACtF;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,CAAC,SAAS,EAAE;SAChF,CACF,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,uEAAuE;IACvE,IAAI,GAAG,CAAC,SAAS,KAAK,cAAc,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CACrB,QAAQ,KAAK,uGAAuG,EACpH;YACE,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;SAC7C,CACF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,IAAI,2BAA2B,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC;YACxB,GAAG,GAAG;YACN,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,eAAe;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC3E,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,OAAO,QAAQ,CAAC,CAAC,8DAA8D;YACjF,CAAC;YACD,MAAM,GAAG,CAAC,CAAC,+DAA+D;QAC5E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"abandon-run.js","sourceRoot":"","sources":["../../src/engine/abandon-run.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAe,EACf,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEnC,wCAAwC;IACxC,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,8FAA8F;IAC9F,yCAAyC;IACzC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,+FAA+F;QAC/F,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,aAAa,CACrB,QAAQ,KAAK,0BAA0B,YAAY,mCAAmC,EACtF;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,CAAC,SAAS,EAAE;SAChF,CACF,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,uEAAuE;IACvE,IAAI,GAAG,CAAC,SAAS,KAAK,cAAc,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CACrB,QAAQ,KAAK,uGAAuG,EACpH;YACE,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;SAC7C,CACF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,IAAI,2BAA2B,CAAC;IAC9D,IAAI,CAAC;QACH,kFAAkF;QAClF,6FAA6F;QAC7F,kBAAkB;QAClB,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC3E,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,OAAO,QAAQ,CAAC,CAAC,8DAA8D;YACjF,CAAC;YACD,MAAM,GAAG,CAAC,CAAC,+DAA+D;QAC5E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/engine/apply-resume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-resume.d.ts","sourceRoot":"","sources":["../../src/engine/apply-resume.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAG1E;;yDAEyD;AACzD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,GAAG,EAAE,SAAS,CAAC;IACf;wEACoE;IACpE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrC;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,kBAAkB,GAC7B,iBAAiB,CAuEnB"}
+{"version":3,"file":"apply-resume.d.ts","sourceRoot":"","sources":["../../src/engine/apply-resume.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAG1E;;yDAEyD;AACzD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,GAAG,EAAE,SAAS,CAAC;IACf;wEACoE;IACpE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrC;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,kBAAkB,GAC7B,iBAAiB,CA2FnB"}

package/dist/engine/apply-resume.js

@@ -58,10 +58,22 @@ export function applyResume(snapshot, stepName, definition) {
     // grandfathered/mixed-fleet record could still carry one), so this is defensive: it can never
     // silently strip a live decision out from under a human, only a stale, zombie one.
     const disclosures = [];
-    const { terminal_reason: _tr, abandoned_at: _aa, pending_gate: strippedGate, ...rest } = snapshot;
+    // issue #367: `sealed_by` joins the strip list — the resumed run is live again, so the seal fact
+    // must leave in the SAME write that flips terminal_state:false. The store boundary's ORPHANED
+    // clause is what catches a future regression of this line.
+    const { terminal_reason: _tr, abandoned_at: _aa, sealed_by: _sb, pending_gate: strippedGate, ...rest } = snapshot;
     if (strippedGate !== undefined) {
         disclosures.push(`zombie gate '${strippedGate.gate_id}' on '${strippedGate.step_name}' cleared by resume — step will re-drive`);
     }
+    // issue #367 (part 4): the STRIP above is lawful and stays exactly as it is — a live run may not
+    // carry a seal. The silence was the defect: an operator's attributed ruling on this run's
+    // outcome vanished without a line, in a system whose whole argument is evidence honesty, while
+    // every voided finalizer and every stripped zombie gate got one.
+    const strippedRuling = snapshot.sealed_by?.adjudicated;
+    if (strippedRuling !== undefined) {
+        disclosures.push(`operator ruling by '${strippedRuling.by}' (at ${strippedRuling.at}) discarded by resume — ` +
+            `the sealed state it ruled on no longer exists`);
+    }
     // Strip terminal_reason + abandoned_at (issue #281); release ALL remaining claims
     // unconditionally (the CLI refusals guarantee none are healthy by the time this runs).
     const run = {

package/dist/engine/apply-resume.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply-resume.js","sourceRoot":"","sources":["../../src/engine/apply-resume.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,QAAmB,EACnB,QAAgB,EAChB,UAA8B;IAE9B,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,cAAc,CACpE;QACE,GAAG,QAAQ;QACX,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,EAAc;QAC7B,YAAY,EAAE,EAAE;KACjB,EACD,UAAU,CACX,CAAC;IAEF,0BAA0B;IAC1B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC5B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,SAAS,CAAC;IAEhB,gFAAgF;IAChF,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,IAAI,eAAe,GAAkC,QAAQ,CAAC,gBAAgB,CAAC;IAC/E,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,UAAU,GAA+C,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,UAAU,EAAE,WAAW;oBACrB,CAAC,CAAC,cAAc,IAAI,2DAA2D;oBAC/E,CAAC,CAAC,cAAc,IAAI,kEAAkE;wBACpF,0CAA0C;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,eAAe,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,0FAA0F;IAC1F,2FAA2F;IAC3F,8FAA8F;IAC9F,2FAA2F;IAC3F,8FAA8F;IAC9F,mFAAmF;IACnF,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAClG,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,WAAW,CAAC,IAAI,CACd,gBAAgB,YAAY,CAAC,OAAO,SAAS,YAAY,CAAC,SAAS,0CAA0C,CAC9G,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,uFAAuF;IACvF,MAAM,GAAG,GAAc;QACrB,GAAG,IAAI;QACP,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,KAAK;QACrB,iBAAiB,EAAE,EAAE;QACrB,MAAM,EAAE,EAAE;QACV,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"apply-resume.js","sourceRoot":"","sources":["../../src/engine/apply-resume.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,QAAmB,EACnB,QAAgB,EAChB,UAA8B;IAE9B,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,cAAc,CACpE;QACE,GAAG,QAAQ;QACX,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,EAAc;QAC7B,YAAY,EAAE,EAAE;KACjB,EACD,UAAU,CACX,CAAC;IAEF,0BAA0B;IAC1B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC5B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,SAAS,CAAC;IAEhB,gFAAgF;IAChF,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,IAAI,eAAe,GAAkC,QAAQ,CAAC,gBAAgB,CAAC;IAC/E,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,UAAU,GAA+C,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,UAAU,EAAE,WAAW;oBACrB,CAAC,CAAC,cAAc,IAAI,2DAA2D;oBAC/E,CAAC,CAAC,cAAc,IAAI,kEAAkE;wBACpF,0CAA0C;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,eAAe,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,0FAA0F;IAC1F,2FAA2F;IAC3F,8FAA8F;IAC9F,2FAA2F;IAC3F,8FAA8F;IAC9F,mFAAmF;IACnF,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,iGAAiG;IACjG,8FAA8F;IAC9F,2DAA2D;IAC3D,MAAM,EACJ,eAAe,EAAE,GAAG,EACpB,YAAY,EAAE,GAAG,EACjB,SAAS,EAAE,GAAG,EACd,YAAY,EAAE,YAAY,EAC1B,GAAG,IAAI,EACR,GAAG,QAAQ,CAAC;IACb,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,WAAW,CAAC,IAAI,CACd,gBAAgB,YAAY,CAAC,OAAO,SAAS,YAAY,CAAC,SAAS,0CAA0C,CAC9G,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,0FAA0F;IAC1F,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IACvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,WAAW,CAAC,IAAI,CACd,uBAAuB,cAAc,CAAC,EAAE,SAAS,cAAc,CAAC,EAAE,0BAA0B;YAC1F,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,uFAAuF;IACvF,MAAM,GAAG,GAAc;QACrB,GAAG,IAAI;QACP,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,KAAK;QACrB,iBAAiB,EAAE,EAAE;QACrB,MAAM,EAAE,EAAE;QACV,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC"}

package/dist/engine/eligibility.d.ts

@@ -1,6 +1,88 @@
 import type { WorkflowDefinition, StepDefinition } from '../types/workflow-definition.js';
-import type { RunRecord, SkipDetail } from '../types/run-record.js';
+import type { RunRecord, SealArm, SkipDetail } from '../types/run-record.js';
 import type { RunPhase } from '../types/run-record.js';
+/** `arm -> RunPhase`. Total, exhaustive, no default. */
+export declare function armToPhase(arm: SealArm): RunPhase;
+/**
+ * `arm -> outcome class`. Total, exhaustive, no default. NOT read by `deriveEffectiveTriggers`
+ * (which keeps its own `mintOutcome` — the two may diverge by design); this exists for readers
+ * that need the class from a STORED record.
+ */
+export declare function armToOutcome(arm: SealArm): 'complete' | 'fail' | 'abort' | 'abandon';
+/** The marker each arm is REQUIRED to co-write (`SEAL_MARKERS_AGREE`'s expectation). */
+export declare function armMarker(arm: SealArm): 'aborted_at' | 'abandoned_at' | undefined;
+/** The record shape both legacy classifiers read. */
+type ClassifiableRun = Pick<RunRecord, 'terminal_state' | 'failed_steps' | 'terminal_reason' | 'aborted_at' | 'abandoned_at'>;
+/**
+ * Classify a LEGACY terminal record (one written before `sealed_by` existed) into the arm it would
+ * have carried. Returns `undefined` when the record cannot be placed — callers must then refuse to
+ * fabricate (`deriveRunPhase` falls back to the pre-#367 ladder; the future migrate vehicle buckets
+ * it `unclassifiable` and exits 1).
+ *
+ * A READ-PATH function, not only a migration function: an unhealed record reached through
+ * `store.get()` never passes through any sweep, so this is a PERMANENT oracle and correctness never
+ * depends on a migration having run.
+ *
+ * Structure (design rev 3 §4 + Amendment 1 defect 4): MARKERS AS A HINT, PROSE REACHABLE WITHOUT
+ * THEM. Markers are checked first when present (they are the strongest legacy signal, and the
+ * legacy ladder gives them precedence), but every prose-identifiable arm is classifiable from
+ * `terminal_reason` alone, because the only external store has no marker columns. That leaves just
+ * the two genuinely prose-less arms — `guard_abort` (reason-less by construction) and
+ * `abandon_requested` (free-text reason) — marker-dependent.
+ */
+export declare function classifyLegacySeal(run: ClassifiableRun): SealArm | undefined;
+/**
+ * The comparator `SEAL_COHERENT` uses at the store boundary (Amendment 2 F2). It is
+ * {@link classifyLegacySeal} with EXACTLY ONE branch removed — the abandoned-marker branch, the
+ * sole measured false-positive source: a record legitimately carrying `abandoned_at` from an
+ * earlier life would classify `abandon_requested` and contradict an honest arm.
+ *
+ * The aborted-marker branch STAYS LIVE here on purpose. A prose-only comparator was the earlier,
+ * superseded bend, and it was refuted because it discards real coverage: the old-binary
+ * `guard_abort` re-seal is reason-less, so it is marker-only-visible, and the markers-first
+ * comparator is what catches it.
+ *
+ * Named blindness, on record: a stale arm on a record carrying `abandoned_at` is invisible here —
+ * that is BOTH abandon-class arms, `abandon_requested` AND `cleanup_sweep`. Their observer is the
+ * migrate sweep's `incoherent` bucket, which uses the FULL classifier.
+ *
+ * SKIPPING MEANS ABSTAINING, and that distinction is load-bearing — measured, not reasoned. An
+ * abandoned-marker record that merely FALLS THROUGH to the prose battery does not go unjudged: an
+ * abandon reason is free text, so the battery reaches its `failed_steps.length > 0` fallback and
+ * returns `step_failure`. `abandonRun` on a run that already has a failed step — an ordinary
+ * production path — would then be refused by the boundary as incoherent. Executed: the full
+ * classifier says `abandon_requested`, the fall-through form says `step_failure`. So the presence
+ * of the marker ends the comparison here rather than redirecting it.
+ */
+export declare function classifyForCoherence(run: ClassifiableRun): SealArm | undefined;
+/**
+ * issue #367 — `SEAL_MARKERS_AGREE`, TRANSFORM-SCOPED: asserted on the records
+ * `applyTerminalPostconditions` / `buildFinalizedSeal` THEMSELVES produce, where congruence is
+ * theirs to guarantee. Never universal, and ONE-DIRECTIONAL (`armMarker(arm)` present ⇒ assert;
+ * foreign markers are NOT forbidden): a transform's INPUT may legitimately carry a marker it did
+ * not write — the published `TERMINAL_STATE_ONLY` law seeds `abandoned_at`/`aborted_at` on a live
+ * run and settles it complete, in contract. A forbids-direction clause makes that record
+ * engine-unconstructible and reds the published law (measured).
+ *
+ * A violation is a transform contract bug, thrown as a plain Error (the `applySettlement`
+ * contract-violation precedent), never a predicate outcome.
+ */
+export declare function assertSealMarkersAgree(run: Pick<RunRecord, 'id' | 'terminal_state' | 'sealed_by' | 'aborted_at' | 'abandoned_at'>): void;
+/**
+ * issue #367 — `SEAL_OUTCOME_COHERENT` (design §10.7), transform-scoped: a fail-class arm that
+ * names a STEP must have that failure on the record. The two startup arms
+ * (`spawn_failure`/`extensions_load_failure`) map to `failed` with an empty `failed_steps` and are
+ * exempt BY the predicate, honestly — no step ever ran.
+ */
+export declare function assertSealOutcomeCoherent(run: Pick<RunRecord, 'id' | 'terminal_state' | 'sealed_by' | 'failed_steps'>): void;
+/**
+ * issue #367 — the ONE chokepoint for the four run-level BYPASS writers (`abandon-run.ts`,
+ * `cleanup.ts`, `listen.ts`, `run-attach.ts`): seals `run` with a run-scoped arm. It also retires
+ * those writers' fossil `run_phase` hand-writes — phase is derived at every store write tail, never
+ * hand-stamped (the #282 class). `step` is deliberately NOT accepted: every run-level arm is
+ * step-less by definition, so `SealedBy.step` stays ABSENT rather than becoming an `''` sentinel.
+ */
+export declare function sealRunLevel(run: RunRecord, arm: SealArm, reason: string, now?: Date): RunRecord;
 /**
  * Derives the run_phase from the run record fields. Called after every store write to keep
  * run_phase consistent — this function's return value is ALWAYS what gets persisted (issue #279,
@@ -23,7 +105,7 @@ import type { RunPhase } from '../types/run-record.js';
  * never had a gate) derives IDENTICALLY either way; only the one previously-mis-derived class
  * changes, and it changes to the CORRECT phase.
  */
-export declare function deriveRunPhase(run: Pick<RunRecord, 'pending_gate' | 'terminal_state' | 'failed_steps' | 'terminal_reason' | 'aborted_at' | 'abandoned_at'>): RunPhase;
+export declare function deriveRunPhase(run: Pick<RunRecord, 'pending_gate' | 'terminal_state' | 'failed_steps' | 'terminal_reason' | 'aborted_at' | 'abandoned_at' | 'sealed_by'>): RunPhase;
 /**
  * Evaluates whether a step's trigger_rule is satisfied given the current run state.
  * Empty or omitted depends_on means the step has no dependencies and is always eligible
@@ -101,10 +183,34 @@ export declare function buildEvidenceByStep(run: RunRecord): Record<string, Reco
  * namespace from the live run record — the shared helper is what makes replay's verdict
  * structurally unable to diverge from the live engine's for a `$settlement`-referencing
  * precondition (issue #220 §4c-M7).
+ *
+ * **`failed` (issue #305) — STATUS ONLY, deliberately.** The entry says THAT a step failed, never
+ * why. Failure detail (messages, causes) stays on the run record, which is where every surveyed
+ * orchestrator keeps it: status enumeration is the field's in-band floor (GitHub Actions'
+ * `needs.<job>.result`; Step Functions and Airflow make it query-reachable), while detail in a
+ * declarative cleanup payload is shipped nowhere. Detail here would also fork the truth away from
+ * the append-only record, and these payloads feed AGENT PROMPTS — provider-generated text of
+ * unbounded size is not something to inject by default.
+ *
+ * **`failed` is a POSITION fact.** It is derived from WHICH half of the domain walk produced the
+ * entry (`completed_steps` ⇒ false, `failed_steps` ⇒ true), not from a lookup. Any future
+ * refactor that flattens those two loops back into one spread MUST re-derive the flag explicitly
+ * — a flattened walk silently marks every entry with whichever literal it inherits.
+ *
+ * **Reading the three settlement outcomes.** A consumer distinguishes them with two fields plus
+ * ABSENCE: a failed step has `failed: true`; a step that completed on its declared default has
+ * `failed: false, settled_by_default: true`; a SKIPPED step has NO ENTRY AT ALL (skipped steps are
+ * deliberately outside this namespace, pinned three ways). In a `when`/precondition, absence is
+ * testable with the load-legal bare presence spelling `$settlement.<dep>.failed == null`, which is
+ * true exactly when the step is absent — so authors are not left unable to discriminate.
+ *
+ * **`failed` is live, not a fossil.** `applyResume` strips a resumed step out of `failed_steps`,
+ * so the marker clears on resume rather than permanently branding a step that has since re-run.
  */
 export declare function buildSettlementNamespace(run: RunRecord): Record<string, {
     settled_by_default: boolean;
     validation_rejections: number;
+    failed: boolean;
 }>;
 /**
  * True iff `stepId` is a member of `completed_steps ∪ failed_steps ∪ skipped_steps ∪
@@ -158,4 +264,5 @@ export interface PropagateSkipsResult {
  * touch `details`. Does not mutate the run record — callers apply the result before writing.
  */
 export declare function propagateSkips(run: RunRecord, definition: WorkflowDefinition): PropagateSkipsResult;
+export {};
 //# sourceMappingURL=eligibility.d.ts.map

package/dist/engine/eligibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eligibility.d.ts","sourceRoot":"","sources":["../../src/engine/eligibility.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EAEf,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,wBAAwB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAKvD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,IAAI,CACP,SAAS,EACP,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,YAAY,GACZ,cAAc,CACjB,GACA,QAAQ,CA2BV;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CA0ClF;AAgDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvD,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACtC,OAAO,CA+CT;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvD,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACtC,OAAO,CAGT;AAoDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwB3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,GACb,MAAM,CAAC,MAAM,EAAE;IAAE,kBAAkB,EAAE,OAAO,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAO/E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,CAiC1F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,CA6B/F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAe1F;AAkHD,sGAAsG;AACtG,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,kBAAkB,GAC7B,oBAAoB,CAgEtB"}
+{"version":3,"file":"eligibility.d.ts","sourceRoot":"","sources":["../../src/engine/eligibility.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EAEf,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAmB,MAAM,wBAAwB,CAAC;AAE9F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAevD,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAoBjD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAoBpF;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,CAKjF;AASD,qDAAqD;AACrD,KAAK,eAAe,GAAG,IAAI,CACzB,SAAS,EACT,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,GAAG,YAAY,GAAG,cAAc,CACtF,CAAC;AA8BF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,GAAG,SAAS,CAO5E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,GAAG,SAAS,CAK9E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,gBAAgB,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC,GAC1F,IAAI,CAaN;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,CAAC,GAC3E,IAAI,CAWN;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACrB,SAAS,CAWX;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,IAAI,CACP,SAAS,EACP,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,YAAY,GACZ,cAAc,GACd,WAAW,CACd,GACA,QAAQ,CA0DV;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CA0ClF;AAgDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvD,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACtC,OAAO,CA+CT;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvD,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACtC,OAAO,CAGT;AAoDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwB3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,GACb,MAAM,CAAC,MAAM,EAAE;IAAE,kBAAkB,EAAE,OAAO,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CA2BjG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAO/E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,CAiC1F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,CA6B/F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAe1F;AAkHD,sGAAsG;AACtG,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,kBAAkB,GAC7B,oBAAoB,CAgEtB"}

package/dist/engine/eligibility.js

@@ -1,6 +1,233 @@
+import { SEAL_ARMS } from '../types/run-record.js';
 import { resolvePath } from './render-template.js';
 import { splitComparison } from './comparison-expr.js';
 import { boundResolvedValue } from '../utils/redaction.js';
+// ---------------------------------------------------------------------------
+// issue #367 — the recorded seal fact: mappings, the permanent legacy read oracle, the run-level
+// writer chokepoint, and the transform-scoped marker assertion.
+//
+// These mappings are the engine-owned TOTAL functions over the recorded value. Changing one
+// changes a JUDGEMENT; it never moves a stored record. The exhaustive no-default switches are the
+// one real compile guarantee this design claims: a 14th arm added to SEAL_ARMS without mappings
+// does not build.
+// ---------------------------------------------------------------------------
+/** `arm -> RunPhase`. Total, exhaustive, no default. */
+export function armToPhase(arm) {
+    switch (arm) {
+        case 'complete':
+        case 'gate_resolution_complete':
+        case 'guard_pass_complete':
+        case 'gate_expiry_default':
+            return 'completed';
+        case 'step_failure':
+        case 'guard_resolution_error':
+        case 'spawn_failure':
+        case 'extensions_load_failure':
+            return 'failed';
+        case 'handler_abort':
+        case 'guard_abort':
+        case 'gate_expiry_abort':
+            return 'aborted';
+        case 'abandon_requested':
+        case 'cleanup_sweep':
+            return 'abandoned';
+    }
+}
+/**
+ * `arm -> outcome class`. Total, exhaustive, no default. NOT read by `deriveEffectiveTriggers`
+ * (which keeps its own `mintOutcome` — the two may diverge by design); this exists for readers
+ * that need the class from a STORED record.
+ */
+export function armToOutcome(arm) {
+    switch (arm) {
+        case 'complete':
+        case 'gate_resolution_complete':
+        case 'guard_pass_complete':
+        case 'gate_expiry_default':
+            return 'complete';
+        case 'step_failure':
+        case 'guard_resolution_error':
+        case 'spawn_failure':
+        case 'extensions_load_failure':
+            return 'fail';
+        case 'handler_abort':
+        case 'guard_abort':
+        case 'gate_expiry_abort':
+            return 'abort';
+        case 'abandon_requested':
+        case 'cleanup_sweep':
+            return 'abandon';
+    }
+}
+/** The marker each arm is REQUIRED to co-write (`SEAL_MARKERS_AGREE`'s expectation). */
+export function armMarker(arm) {
+    const phase = armToPhase(arm);
+    if (phase === 'aborted')
+        return 'aborted_at';
+    if (phase === 'abandoned')
+        return 'abandoned_at';
+    return undefined;
+}
+const GUARD_RESOLUTION_PROSE = /^Guard step '.+' failed: unresolvable path/;
+/** issue #373's multi-failure shape rides here too — `N steps failed:` is a step-failure seal. */
+const FAIL_PROSE = [/^Step '.+' failed:/, /^\d+ steps? failed:/, /^Guard step '.+' failed:/];
+const CLEANUP_SWEEP_PROSE = 'Marked abandoned by realm cleanup';
+const HANDLER_ABORT_PROSE = /^Handler '.+' aborted the run:/;
+const GATE_EXPIRY_ABORT_PROSE = /^Gate '.+' expired and the run aborted/;
+/** The prose battery, reachable with NO markers — the marker-column-less store class. */
+function classifyByProse(run) {
+    const reason = run.terminal_reason;
+    if (reason === 'Workflow completed.')
+        return 'complete'; // gate/guard variants NOT recoverable
+    if (reason === 'spawn_failed')
+        return 'spawn_failure';
+    if (reason === 'extensions_load_failed')
+        return 'extensions_load_failure';
+    if (reason === CLEANUP_SWEEP_PROSE)
+        return 'cleanup_sweep';
+    if (reason !== undefined) {
+        if (HANDLER_ABORT_PROSE.test(reason))
+            return 'handler_abort';
+        if (GATE_EXPIRY_ABORT_PROSE.test(reason))
+            return 'gate_expiry_abort';
+        // Order load-bearing: the resolution-error regex MUST run before the generic guard-failure
+        // member of FAIL_PROSE, which also matches it.
+        if (GUARD_RESOLUTION_PROSE.test(reason))
+            return 'guard_resolution_error';
+        if (FAIL_PROSE.some((re) => re.test(reason)))
+            return 'step_failure';
+    }
+    if (run.failed_steps.length > 0)
+        return 'step_failure';
+    return undefined;
+}
+/** The aborted-marker branch — shared by both classifier entry points (it stays live in both). */
+function classifyByAbortedMarker(run) {
+    const reason = run.terminal_reason;
+    if (reason === undefined)
+        return 'guard_abort'; // the ONLY reason-less abort
+    if (HANDLER_ABORT_PROSE.test(reason))
+        return 'handler_abort';
+    if (GATE_EXPIRY_ABORT_PROSE.test(reason))
+        return 'gate_expiry_abort';
+    return undefined; // an abort we do not recognise — never guess
+}
+/**
+ * Classify a LEGACY terminal record (one written before `sealed_by` existed) into the arm it would
+ * have carried. Returns `undefined` when the record cannot be placed — callers must then refuse to
+ * fabricate (`deriveRunPhase` falls back to the pre-#367 ladder; the future migrate vehicle buckets
+ * it `unclassifiable` and exits 1).
+ *
+ * A READ-PATH function, not only a migration function: an unhealed record reached through
+ * `store.get()` never passes through any sweep, so this is a PERMANENT oracle and correctness never
+ * depends on a migration having run.
+ *
+ * Structure (design rev 3 §4 + Amendment 1 defect 4): MARKERS AS A HINT, PROSE REACHABLE WITHOUT
+ * THEM. Markers are checked first when present (they are the strongest legacy signal, and the
+ * legacy ladder gives them precedence), but every prose-identifiable arm is classifiable from
+ * `terminal_reason` alone, because the only external store has no marker columns. That leaves just
+ * the two genuinely prose-less arms — `guard_abort` (reason-less by construction) and
+ * `abandon_requested` (free-text reason) — marker-dependent.
+ */
+export function classifyLegacySeal(run) {
+    if (run.terminal_state !== true)
+        return undefined;
+    if (run.abandoned_at !== undefined) {
+        return run.terminal_reason === CLEANUP_SWEEP_PROSE ? 'cleanup_sweep' : 'abandon_requested';
+    }
+    if (run.aborted_at !== undefined)
+        return classifyByAbortedMarker(run);
+    return classifyByProse(run);
+}
+/**
+ * The comparator `SEAL_COHERENT` uses at the store boundary (Amendment 2 F2). It is
+ * {@link classifyLegacySeal} with EXACTLY ONE branch removed — the abandoned-marker branch, the
+ * sole measured false-positive source: a record legitimately carrying `abandoned_at` from an
+ * earlier life would classify `abandon_requested` and contradict an honest arm.
+ *
+ * The aborted-marker branch STAYS LIVE here on purpose. A prose-only comparator was the earlier,
+ * superseded bend, and it was refuted because it discards real coverage: the old-binary
+ * `guard_abort` re-seal is reason-less, so it is marker-only-visible, and the markers-first
+ * comparator is what catches it.
+ *
+ * Named blindness, on record: a stale arm on a record carrying `abandoned_at` is invisible here —
+ * that is BOTH abandon-class arms, `abandon_requested` AND `cleanup_sweep`. Their observer is the
+ * migrate sweep's `incoherent` bucket, which uses the FULL classifier.
+ *
+ * SKIPPING MEANS ABSTAINING, and that distinction is load-bearing — measured, not reasoned. An
+ * abandoned-marker record that merely FALLS THROUGH to the prose battery does not go unjudged: an
+ * abandon reason is free text, so the battery reaches its `failed_steps.length > 0` fallback and
+ * returns `step_failure`. `abandonRun` on a run that already has a failed step — an ordinary
+ * production path — would then be refused by the boundary as incoherent. Executed: the full
+ * classifier says `abandon_requested`, the fall-through form says `step_failure`. So the presence
+ * of the marker ends the comparison here rather than redirecting it.
+ */
+export function classifyForCoherence(run) {
+    if (run.terminal_state !== true)
+        return undefined;
+    if (run.abandoned_at !== undefined)
+        return undefined; // abstain — see above
+    if (run.aborted_at !== undefined)
+        return classifyByAbortedMarker(run);
+    return classifyByProse(run);
+}
+/**
+ * issue #367 — `SEAL_MARKERS_AGREE`, TRANSFORM-SCOPED: asserted on the records
+ * `applyTerminalPostconditions` / `buildFinalizedSeal` THEMSELVES produce, where congruence is
+ * theirs to guarantee. Never universal, and ONE-DIRECTIONAL (`armMarker(arm)` present ⇒ assert;
+ * foreign markers are NOT forbidden): a transform's INPUT may legitimately carry a marker it did
+ * not write — the published `TERMINAL_STATE_ONLY` law seeds `abandoned_at`/`aborted_at` on a live
+ * run and settles it complete, in contract. A forbids-direction clause makes that record
+ * engine-unconstructible and reds the published law (measured).
+ *
+ * A violation is a transform contract bug, thrown as a plain Error (the `applySettlement`
+ * contract-violation precedent), never a predicate outcome.
+ */
+export function assertSealMarkersAgree(run) {
+    if (run.terminal_state !== true || run.sealed_by === undefined)
+        return;
+    const marker = armMarker(run.sealed_by.arm);
+    if (marker === 'aborted_at' && run.aborted_at === undefined) {
+        throw new Error(`SEAL_MARKERS_AGREE violated on run '${run.id}': arm '${run.sealed_by.arm}' requires aborted_at`);
+    }
+    if (marker === 'abandoned_at' && run.abandoned_at === undefined) {
+        throw new Error(`SEAL_MARKERS_AGREE violated on run '${run.id}': arm '${run.sealed_by.arm}' requires abandoned_at`);
+    }
+}
+/**
+ * issue #367 — `SEAL_OUTCOME_COHERENT` (design §10.7), transform-scoped: a fail-class arm that
+ * names a STEP must have that failure on the record. The two startup arms
+ * (`spawn_failure`/`extensions_load_failure`) map to `failed` with an empty `failed_steps` and are
+ * exempt BY the predicate, honestly — no step ever ran.
+ */
+export function assertSealOutcomeCoherent(run) {
+    if (run.terminal_state !== true || run.sealed_by === undefined)
+        return;
+    const arm = run.sealed_by.arm;
+    if ((arm === 'step_failure' || arm === 'guard_resolution_error') &&
+        run.failed_steps.length === 0) {
+        throw new Error(`SEAL_OUTCOME_COHERENT violated on run '${run.id}': arm '${arm}' with empty failed_steps`);
+    }
+}
+/**
+ * issue #367 — the ONE chokepoint for the four run-level BYPASS writers (`abandon-run.ts`,
+ * `cleanup.ts`, `listen.ts`, `run-attach.ts`): seals `run` with a run-scoped arm. It also retires
+ * those writers' fossil `run_phase` hand-writes — phase is derived at every store write tail, never
+ * hand-stamped (the #282 class). `step` is deliberately NOT accepted: every run-level arm is
+ * step-less by definition, so `SealedBy.step` stays ABSENT rather than becoming an `''` sentinel.
+ */
+export function sealRunLevel(run, arm, reason, now = new Date()) {
+    const { sealed_by: _priorSeal, ...base } = run;
+    // The carried run_phase may be stale here — every store write tail re-derives it
+    // (PHASE_IS_GENERATED), which is exactly why the callers' fossil hand-writes were deletable.
+    return {
+        ...base,
+        terminal_state: true,
+        sealed_by: { arm },
+        terminal_reason: reason,
+        ...(armMarker(arm) === 'abandoned_at' ? { abandoned_at: now.toISOString() } : {}),
+    };
+}
 /**
  * Derives the run_phase from the run record fields. Called after every store write to keep
  * run_phase consistent — this function's return value is ALWAYS what gets persisted (issue #279,
@@ -24,25 +251,55 @@ import { boundResolvedValue } from '../utils/redaction.js';
  * changes, and it changes to the CORRECT phase.
  */
 export function deriveRunPhase(run) {
-    // abandoned_at is authoritative — explicit operator/cleanup abandonment wins over any field
-    // (failed_steps, pending_gate, terminal_reason, and now checked before the whole terminal
-    // cluster below too). It is only ever set on a running run (gate_waiting abandonment is refused
-    // by abandonRun), so it never co-occurs with pending_gate in practice; top placement is
-    // future-proof and mirrors the aborted_at promotion rationale below.
+    // issue #367: the RECORDED fact wins over every marker and over the prose. Markers are asserted
+    // congruent at the transforms (SEAL_MARKERS_AGREE) and at the store boundary (SEAL_COHERENT);
+    // they are no longer a second oracle once a stamp exists. Three conjuncts, each load-bearing:
+    //  - `terminal_state === true`: an ORPHAN (an old binary's resume keeps `sealed_by` while
+    //    flipping terminal_state:false — executed against the real v0.38 dist) must derive via the
+    //    LIVE ladder below, or both purge gates pass on a live run and destroy it.
+    //  - `sealed_by !== undefined`: the legacy population derives via the classifier + ladder.
+    //  - membership in SEAL_ARMS: an unknown arm (a future binary's record read by this one) falls
+    //    through to the classifier — never an `undefined` phase. Write-side loudness for that case
+    //    is the store boundary's STATE_SEAL_UNKNOWN_ARM.
+    if (run.terminal_state === true &&
+        run.sealed_by !== undefined &&
+        SEAL_ARMS.includes(run.sealed_by.arm)) {
+        return armToPhase(run.sealed_by.arm);
+    }
+    if (run.terminal_state === true) {
+        // INV-CORPUS: every terminal record's cause is recoverable-or-honestly-unknown at read time.
+        // `classifyLegacySeal` is a PERMANENT read oracle — correctness never depends on migration.
+        const legacyArm = classifyLegacySeal(run);
+        if (legacyArm !== undefined)
+            return armToPhase(legacyArm);
+    }
+    // ---- The pre-#367 ladder, UNCHANGED, and now the LEGACY-ONLY path ----
+    // What follows runs only for records with no usable arm: everything written before #367, plus
+    // the honestly-unclassifiable tail. These comments used to say the markers were "authoritative"
+    // for the whole derivation; since #367 that is false as stated — a stamped record never reaches
+    // here, and on the records that do, the markers are the strongest signal available rather than
+    // the primary oracle.
+    //
+    // abandoned_at: explicit operator/cleanup abandonment wins over any other legacy field
+    // (failed_steps, pending_gate, terminal_reason, and the whole terminal cluster below). It is
+    // only ever set on a running run (gate_waiting abandonment is refused by abandonRun), so it
+    // never co-occurs with pending_gate in practice; top placement is future-proof and mirrors the
+    // aborted_at rationale below.
     if (run.abandoned_at !== undefined)
         return 'abandoned';
-    // aborted_at is authoritative and is checked before pending_gate AND before the terminal_state
-    // split below. The only records that carry aborted_at are guard/handler-aborted runs (always
-    // written terminal_state:true); legitimately resumable runs (failed/abandoned) never carry it,
-    // and an aborted run's cancel-gate write (design record §3 applyAbortEdge) clears any OTHER
-    // step's pending_gate in the same write — but a grandfathered/legacy record could still carry
-    // both, and aborted_at must win regardless.
+    // aborted_at is checked before pending_gate AND before the terminal_state split below. The only
+    // records that carry aborted_at are guard/handler-aborted runs (always written
+    // terminal_state:true); legitimately resumable runs (failed/abandoned) never carry it, and an
+    // aborted run's cancel-gate write (design record §3 applyAbortEdge) clears any OTHER step's
+    // pending_gate in the same write — but a grandfathered/legacy record could still carry both,
+    // and aborted_at must win regardless.
     if (run.aborted_at !== undefined)
         return 'aborted';
     if (run.terminal_state) {
-        // A terminal run that completed successfully sets terminal_reason to 'Workflow completed.'.
-        // Recovery workflows end with failed_steps non-empty but are still considered completed
-        // when the final recovery step succeeds, so terminal_reason takes precedence over failed_steps.
+        // A legacy terminal run that completed successfully sets terminal_reason to
+        // 'Workflow completed.'. Recovery workflows end with failed_steps non-empty but are still
+        // considered completed when the final recovery step succeeds, so terminal_reason takes
+        // precedence over failed_steps. (For stamped records this distinction is the arm's job.)
         if (run.terminal_reason === 'Workflow completed.')
             return 'completed';
         if (run.failed_steps.length > 0)
@@ -319,6 +576,29 @@ export function buildEvidenceByStep(run) {
  * namespace from the live run record — the shared helper is what makes replay's verdict
  * structurally unable to diverge from the live engine's for a `$settlement`-referencing
  * precondition (issue #220 §4c-M7).
+ *
+ * **`failed` (issue #305) — STATUS ONLY, deliberately.** The entry says THAT a step failed, never
+ * why. Failure detail (messages, causes) stays on the run record, which is where every surveyed
+ * orchestrator keeps it: status enumeration is the field's in-band floor (GitHub Actions'
+ * `needs.<job>.result`; Step Functions and Airflow make it query-reachable), while detail in a
+ * declarative cleanup payload is shipped nowhere. Detail here would also fork the truth away from
+ * the append-only record, and these payloads feed AGENT PROMPTS — provider-generated text of
+ * unbounded size is not something to inject by default.
+ *
+ * **`failed` is a POSITION fact.** It is derived from WHICH half of the domain walk produced the
+ * entry (`completed_steps` ⇒ false, `failed_steps` ⇒ true), not from a lookup. Any future
+ * refactor that flattens those two loops back into one spread MUST re-derive the flag explicitly
+ * — a flattened walk silently marks every entry with whichever literal it inherits.
+ *
+ * **Reading the three settlement outcomes.** A consumer distinguishes them with two fields plus
+ * ABSENCE: a failed step has `failed: true`; a step that completed on its declared default has
+ * `failed: false, settled_by_default: true`; a SKIPPED step has NO ENTRY AT ALL (skipped steps are
+ * deliberately outside this namespace, pinned three ways). In a `when`/precondition, absence is
+ * testable with the load-legal bare presence spelling `$settlement.<dep>.failed == null`, which is
+ * true exactly when the step is absent — so authors are not left unable to discriminate.
+ *
+ * **`failed` is live, not a fossil.** `applyResume` strips a resumed step out of `failed_steps`,
+ * so the marker clears on resume rather than permanently branding a step that has since re-run.
  */
 export function buildSettlementNamespace(run) {
     const lastDiag = {};
@@ -328,13 +608,23 @@ export function buildSettlementNamespace(run) {
         }
     }
     const result = {};
-    for (const step of [...run.completed_steps, ...run.failed_steps]) {
+    // issue #305: `failed` is derived from LOOP POSITION, not from a membership set built beside
+    // the walk. The domain here IS `completed_steps` then `failed_steps`, so splitting the single
+    // spread into its two halves makes the flag and the membership the same fact — they cannot
+    // drift, and no second structure has to be kept in sync. It also keeps the O(1)-per-step
+    // contract above intact (no set construction, no lookup).
+    const write = (step, failed) => {
         const diag = lastDiag[step];
         result[step] = {
             settled_by_default: diag?.settled_by_default ?? false,
             validation_rejections: diag?.validation_rejections ?? 0,
+            failed,
         };
-    }
+    };
+    for (const step of run.completed_steps)
+        write(step, false);
+    for (const step of run.failed_steps)
+        write(step, true);
     return result;
 }
 /**