@stigmer/server 3.41.0 → 3.41.1-dev.20261003133619.g58ac1f23a411

package/src/temporal/schedule/run-starter.ts

@@ -4,14 +4,14 @@
  * client, so the FULL create pipeline runs (session auto-create, execution
  * context, persist, workflow start). Where the cloud starter mints a
  * schedule token and re-enters the pipeline behind FGA gates, OSS has no
- * caller identity by design (DD-015 D-G): the org is stamped from the
- * schedule's own metadata. A composition restores the Java posture through
- * the scheduleFireCaller driver point (stigmer-cloud#572): when composed,
- * every fire mints its caller and the create propagates it via the R5
- * in-process header; a mint failure propagates like any infrastructure
+ * caller identity by design: the org is stamped from the schedule's own
+ * metadata. A composition gives fires an identity through the
+ * scheduleFireCaller driver point: when composed, every fire mints its
+ * caller and the create propagates it via the in-process caller header; a mint
+ * failure propagates like any infrastructure
  * fault (the tick activity retries, the trigger surfaces it).
  *
- * Idempotency is the CLOCK's job here (DD-015 D-F): the OSS create
+ * Idempotency is the CLOCK's job here: the OSS create
  * pipeline deliberately has no duplicate check (it would tax every
  * execution create in the product), so the starter looks up its own
  * deterministic execution name before creating. Within one tick activity
@@ -19,7 +19,7 @@
  * one reminder per fire, by construction.
  *
  * Serves BOTH fire paths: the tick's start-run activity (origin=cron) and
- * the trigger RPC's direct-run step (origin=manual, DD-017 D-5).
+ * the trigger RPC's direct-run step (origin=manual).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { create } from "@bufbuild/protobuf";
@@ -69,11 +69,11 @@ export const SESSION_SUBJECT_PREFIX = "Scheduled run: ";
  * key the cloud edition's scope step writes (Go ScheduleIDLabelKey).
  *
  * In OSS the label is also the environment-resolution key: the execution
- * context step reads it to merge the schedule's environment_refs (DD-017
- * D-4). Cloud deliberately resolves through the validated token claim
+ * context step reads it to merge the schedule's environment_refs. Cloud
+ * deliberately resolves through the validated token claim
  * instead — a client-suppliable label must not widen what a cloud sandbox
  * reads — but OSS is single-user with no trust boundary, and it has no
- * tokens to carry a claim (the DD-015 divergence posture).
+ * tokens to carry a claim.
  */
 export const SCHEDULE_ID_LABEL_KEY = "stigmer.ai/schedule-id";
 
@@ -91,7 +91,7 @@ export type RunOutcomeResult =
  * starter needs (Go ExecutionCreator; satisfied through
  * src/boot/inprocess.ts). `fireCaller`, when present, is the composed
  * edition identity the fire acts as — the implementation propagates it
- * through the R5 in-process header; absent, the create enters as the
+ * through the in-process caller header; absent, the create enters as the
  * `internal` class (the OSS default, byte-identical).
  */
 export interface ScheduleExecutionCreator {
@@ -295,7 +295,7 @@ export class RunStarter {
       return { kind: "started", executionId, alreadyExisted: true };
     }
 
-    // The composed fire-caller mint (stigmer-cloud#572): minted per fire,
+    // The composed fire-caller mint: minted per fire,
     // after the idempotency lookup (a found winner needs no credential)
     // and before the create it authenticates. Failure is an
     // infrastructure fault — thrown, so the tick activity retries under
@@ -457,7 +457,7 @@ export class RunStarter {
     const executionConfig = create(ExecutionConfigSchema, {
       approvalMode: ApprovalMode.UNATTENDED,
       // The platform profile, then the schedule's own run_config CLAMPED
-      // by it (DD-017 D-3): per field, min(owner, platform) when the
+      // by it: per field, min(owner, platform) when the
       // platform cap is set; the owner value stands when the platform cap
       // is unset. The owner can lower spend, never raise it past the
       // platform.
@@ -494,12 +494,12 @@ export class RunStarter {
       executionConfig.thinkingMode = runConfig.thinkingMode;
     }
 
-    // The fresh per-fire session speaks the invocation's session half
-    // (DD-018 D-3): harness and workspace come from the owner's spec. An
+    // The fresh per-fire session speaks the invocation's session half:
+    // harness and workspace come from the owner's spec. An
     // unspecified harness stays unset — the platform default applies (OSS:
     // native). Workspace entries are git-only by write-time validation;
     // credentials, when a repo is private, ride an org-shared environment
-    // holding GITHUB_TOKEN (DD-018 D-4).
+    // holding GITHUB_TOKEN.
     const sessionSpec = create(SessionSpecSchema, {
       subject: SESSION_SUBJECT_PREFIX + (schedule.metadata?.slug ?? ""),
       workspaceEntries: invocation?.workspaceEntries ?? [],
@@ -521,7 +521,7 @@ export class RunStarter {
         // own org is stamped directly — it is load-bearing for the session
         // and execution context.
         org: schedule.metadata?.org ?? "",
-        // The audit link (DD-008 D4) AND this edition's
+        // The audit link AND this edition's
         // environment-resolution key — see SCHEDULE_ID_LABEL_KEY.
         labels: { [SCHEDULE_ID_LABEL_KEY]: schedule.metadata?.id ?? "" },
       }),

package/src/temporal/schedule/syncer.ts

@@ -12,18 +12,17 @@
  * unrepresentable here.
  *
  * Status writes go through store.updateResource — the OSS equivalent of
- * the cloud's targeted leaf patches (DD-015 D-C): SQLite stores one
+ * the cloud's targeted leaf patches: SQLite stores one
  * protobuf blob, so the atomic read-modify-write under the store's write
  * lock is what keeps a concurrent `stigmer apply` from clobbering the
  * stamp (and vice versa). status.next_fire_at is the contract's arming
  * witness: stamped from Temporal's own answer when armed, cleared when the
  * artifact is paused, absent while nothing has converged.
  *
- * Go's Clock/Syncer also carries a Trigger method (the DD-014
- * artifact-trigger lane); DD-017 D-5 rewired the trigger RPC to the
- * direct-run path and left it with zero production callers, so this port
- * deliberately omits it (sub-project decision 2, owner-ratified at the
- * plan gate; disclosed in the PR register).
+ * Go's Clock/Syncer also carries a Trigger method (the artifact-trigger
+ * lane); the trigger RPC runs through the direct-run path instead, which
+ * left it with zero production callers, so this port deliberately omits
+ * it.
  */
 import type { Client, ScheduleDescription } from "@temporalio/client";
 import { ScheduleAlreadyRunning, ScheduleNotFoundError } from "@temporalio/client";
@@ -45,7 +44,7 @@ import { ensureStatus } from "./status-writes.js";
 /**
  * The syncer's answer when no Temporal client exists right now (Go
  * ErrTemporalUnavailable). Callers on the write path treat it as "converge
- * later" (arming is best-effort — DD-015 D-A).
+ * later" (arming is best-effort).
  */
 export class TemporalUnavailableError extends Error {
   constructor() {

package/src/temporal/schedule/workflows/tick.ts

@@ -1,6 +1,6 @@
 /**
  * The tick workflow — ports pkg/domain/schedule/temporal/tick_workflow.go:
- * one schedule fire, spanning its run (DD-013 via DD-015): record the
+ * one schedule fire, spanning its run: record the
  * fire, start the run, poll it to a terminal phase, record the verdict.
  * Spanning is what makes the artifact's overlap SKIP genuinely mean "never
  * start a run while the last is active", and the verdict is what feeds the
@@ -9,7 +9,7 @@
  * WHY A TIMER-DRIVEN POLL AND NOT THE CALLBACK TOKEN — read before
  * "fixing" this. The platform already uses async activity completion for
  * call:agent, so the token is the tempting shape here too. It loses on
- * grounds that are edition-neutral (DD-015 D-E): the token cannot be
+ * grounds that are edition-neutral: the token cannot be
  * re-armed after a create-then-crash, and its completion fire is
  * best-effort — two silent-hang modes on a surface where a hang is a
  * silenced reminder. The poll holds no worker thread (the workflow is
@@ -20,11 +20,11 @@
  * FORWARD CONSTRAINT: ticks live for minutes-to-an-hour once tracking is
  * real, and OSS releases cut every 1-3 days — an in-flight tick WILL
  * straddle a binary upgrade. Any behavioral change to this workflow body
- * must be gated with patched()/deprecatePatch() (OD-6 discipline), and the
+ * must be gated with patched()/deprecatePatch(), and the
  * replay gate (__tests__/replay.test.ts) must stay green against the
  * committed histories.
  *
- * ERROR POSTURE (the #18 panel lesson, applied from day one): Go's
+ * ERROR POSTURE: Go's
  * `return err` fails the WORKFLOW EXECUTION; a plain thrown Error in the
  * TS sandbox fails only the workflow TASK and retries forever. Every Go
  * error return is therefore an ApplicationFailure here. Cancellation

package/src/temporal/workflow-source.ts

@@ -7,12 +7,11 @@
  * Workflow code runs inside Temporal's deterministic sandbox and must be
  * bundled separately from host code. Two production modes:
  *
- * 1. **Runtime** (this sub-project's operative mode, ratified brief #7 of
- *    sub-project 20260824.03): the worker bundles the compiled dist entry
+ * 1. **Runtime** (the operative mode): the worker bundles the compiled dist entry
  *    on boot via the SDK's built-in webpack. This is how conformance and
  *    the CLI-launched dev server boot — node_modules present, no native
  *    packaging needed.
- * 2. **Prebuilt** (the hook #24 cli-cutover fills): the slim artifact
+ * 2. **Prebuilt** (slim artifacts): the slim artifact
  *    cannot bundle at runtime (no webpack/@swc shipped), so the build
  *    emits the bundle next to main.js and this resolver finds it as a
  *    sibling — exactly the runner's discovery rule.
@@ -20,14 +19,14 @@
  * Callers pass URLs relative to their own module (import.meta.url): in the
  * tsc dist the sibling bundle never exists so dev builds always take the
  * runtime path; in a slim artifact every module collapses into main.js and
- * the sibling resolves next to it, where #24's build will emit it.
+ * the sibling resolves next to it, where scripts/bundle-slim.mjs emits it.
  */
 import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 export type WorkflowSource =
   | {
-      /** Pre-built bundle on disk (slim artifacts; #24). */
+      /** Pre-built bundle on disk (slim artifacts). */
       readonly kind: "prebuilt";
       readonly codePath: string;
     }

package/src/temporal/workflowexecution/__tests__/activities.test.ts

@@ -1,7 +1,7 @@
 /**
  * Pins the worker's UpdateWorkflowExecutionStatus activity against Go's
  * update_status_impl.go — the ACTIVITY merge, deliberately distinct from
- * the RPC's applyUpdateStatusMerge (sub-project DD-001 brief):
+ * the RPC's applyUpdateStatusMerge:
  *
  *   - the statusAudit bump is UNCONDITIONAL (the RPC bumps only on phase
  *     transitions) — the pin that would catch a "consolidate the merges"
@@ -11,7 +11,9 @@
  *   - a missing execution is a wrapped ordinary error with Go's
  *     "workflow execution not found:" text, not a NotFound RPC error;
  *   - the persist rides the atomic updateResource and broadcasts through
- *     the domain broker after commit.
+ *     the domain broker after commit;
+ *   - DeleteExecutionContext hands the run's context to the server's own
+ *     delete edge (stigmer#1647), idempotently.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -29,6 +31,7 @@ import {
 } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
 import type { WorkflowExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
 import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import { createLogger } from "../../../boot/logger.js";
@@ -40,6 +43,7 @@ import {
   createWorkflowExecutionActivities,
 } from "../activities.js";
 import { UPDATE_WORKFLOW_EXECUTION_STATUS_ACTIVITY_NAME } from "../names.js";
+import { DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME } from "../../../domain/executioncontext/temporal/delete-execution-context.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -165,6 +169,9 @@ describe("UpdateWorkflowExecutionStatus activity (real store)", () => {
       logger: silentLogger,
       broker,
       sandboxTerminalObserver: () => {},
+      executionContextDeleter: () => ({
+        delete: () => Promise.reject(new Error("unused in this suite")),
+      }),
     });
     return activities[UPDATE_WORKFLOW_EXECUTION_STATUS_ACTIVITY_NAME] as (
       executionId: string,
@@ -260,3 +267,55 @@ describe("UpdateWorkflowExecutionStatus activity (real store)", () => {
     ).rejects.toThrowError(/^workflow execution not found: /);
   });
 });
+
+describe("DeleteExecutionContext activity (real store)", () => {
+  let dir: string;
+  let store: Store;
+
+  beforeAll(() => {
+    dir = mkdtempSync(path.join(tmpdir(), "wfexec-ec-activity-"));
+    store = SqliteStore.open(path.join(dir, "test.db"));
+  });
+
+  afterAll(async () => {
+    await store.close();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("hands the execution's ExecutionContext to the server's delete edge, idempotently", async () => {
+    await store.saveResource(
+      ApiResourceKind.execution_context,
+      "ectx_wf_1",
+      ExecutionContextSchema,
+      create(ExecutionContextSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "ExecutionContext",
+        metadata: { id: "ectx_wf_1", name: "ec", org: "o" },
+        spec: { executionId: "wfe_del_1" },
+      }),
+    );
+    // The edge as a recording fake that removes the row the way the delete
+    // chain does (the chain itself: extension-composition.test.ts).
+    const deleted: string[] = [];
+    const activities = createWorkflowExecutionActivities({
+      store,
+      logger: silentLogger,
+      broker: new StreamBroker(silentLogger),
+      sandboxTerminalObserver: () => {},
+      executionContextDeleter: () => ({
+        delete: async (contextId) => {
+          deleted.push(contextId);
+          await store.deleteResource(ApiResourceKind.execution_context, contextId);
+        },
+      }),
+    });
+    const remove = activities[DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME] as (
+      executionId: string,
+    ) => Promise<void>;
+
+    await remove("wfe_del_1");
+    await expect(remove("wfe_del_1")).resolves.toBeUndefined();
+
+    expect(deleted, "one delete, through the edge").toEqual(["ectx_wf_1"]);
+  });
+});

package/src/temporal/workflowexecution/__tests__/{invoke-workflow.test.ts → invoke-workflow.temporal.test.ts}

@@ -18,9 +18,10 @@
  *     task-specific channel with its payload; a malformed envelope is
  *     ignored without burning a relay.
  *
- * Follows #18's discipline: TestWorkflowEnvironment.createLocal (needs
- * the `temporal` CLI); every test skips VISIBLY when the local test
- * server cannot start — never a vacuous green (panel finding B3).
+ * Follows the other Temporal suites' discipline:
+ * TestWorkflowEnvironment.createLocal (needs the `temporal` CLI); every
+ * test skips VISIBLY when the local test server cannot start — never a
+ * vacuous green.
  * Delete-recorder pins are at-least-once-honest (oss#892): Temporal
  * activities re-execute when a completion fails to commit, so the pin is
  * identity + at-least-once, never an exact count.
@@ -171,7 +172,7 @@ function expectExecutionContextDeleted(executionId: string): void {
  * Releases a holding stub child THROUGH the orchestrator's relay lane —
  * the orchestrator has no test-release handler of its own; the envelope
  * is exactly how any task-specific signal reaches the child in
- * production (June DD-013).
+ * production.
  */
 async function releaseChild(
   handle: import("@temporalio/client").WorkflowHandle,

package/src/temporal/workflowexecution/__tests__/replay-histories/child-failed.json

@@ -253,7 +253,7 @@
         "failure": {
           "message": "child engine boom",
           "source": "TypeScriptSDK",
-          "stackTrace": "ApplicationFailure: child engine boom\n    at Function.create (/Users/suresh/scm/github.com/stigmer/.worktrees/stigmer/feat-20260825.04.sp.workflowexecution-orchestration/backend/services/stigmer-server-ts/node_modules/@temporalio/common/src/failure.ts:227:11)\n    at create (/Users/suresh/scm/github.com/stigmer/.worktrees/stigmer/feat-20260825.04.sp.workflowexecution-orchestration/backend/services/stigmer-server-ts/src/temporal/workflowexecution/__tests__/test-workflows.ts:57:29)",
+          "stackTrace": "ApplicationFailure: child engine boom\n    at Function.create (/repo/backend/services/stigmer-server-ts/node_modules/@temporalio/common/src/failure.ts:227:11)\n    at create (/repo/backend/services/stigmer-server-ts/src/temporal/workflowexecution/__tests__/test-workflows.ts:57:29)",
           "applicationFailureInfo": {}
         },
         "namespace": "default",
@@ -645,13 +645,13 @@
         "failure": {
           "message": "Workflow execution failed",
           "source": "TypeScriptSDK",
-          "stackTrace": "ApplicationFailure: Workflow execution failed\n    at Function.create (/Users/suresh/scm/github.com/stigmer/.worktrees/stigmer/feat-20260825.04.sp.workflowexecution-orchestration/backend/services/stigmer-server-ts/node_modules/@temporalio/common/src/failure.ts:227:11)\n    at create (/Users/suresh/scm/github.com/stigmer/.worktrees/stigmer/feat-20260825.04.sp.workflowexecution-orchestration/backend/services/stigmer-server-ts/src/temporal/workflowexecution/workflows/invoke-workflow-execution.ts:205:29)",
+          "stackTrace": "ApplicationFailure: Workflow execution failed\n    at Function.create (/repo/backend/services/stigmer-server-ts/node_modules/@temporalio/common/src/failure.ts:227:11)\n    at create (/repo/backend/services/stigmer-server-ts/src/temporal/workflowexecution/workflows/invoke-workflow-execution.ts:205:29)",
           "cause": {
             "message": "Child Workflow execution failed",
             "cause": {
               "message": "child engine boom",
               "source": "TypeScriptSDK",
-              "stackTrace": "ApplicationFailure: child engine boom\n    at Function.create (/Users/suresh/scm/github.com/stigmer/.worktrees/stigmer/feat-20260825.04.sp.workflowexecution-orchestration/backend/services/stigmer-server-ts/node_modules/@temporalio/common/src/failure.ts:227:11)\n    at create (/Users/suresh/scm/github.com/stigmer/.worktrees/stigmer/feat-20260825.04.sp.workflowexecution-orchestration/backend/services/stigmer-server-ts/src/temporal/workflowexecution/__tests__/test-workflows.ts:57:29)",
+              "stackTrace": "ApplicationFailure: child engine boom\n    at Function.create (/repo/backend/services/stigmer-server-ts/node_modules/@temporalio/common/src/failure.ts:227:11)\n    at create (/repo/backend/services/stigmer-server-ts/src/temporal/workflowexecution/__tests__/test-workflows.ts:57:29)",
               "applicationFailureInfo": {}
             },
             "childWorkflowExecutionFailureInfo": {

package/src/temporal/workflowexecution/__tests__/replay.test.ts

@@ -1,6 +1,6 @@
 /**
  * Replay determinism gate for the workflow-execution orchestrator — the
- * twin of the agentexecution gate (see its header for the OD-6
+ * twin of the agentexecution gate (see its header for the
  * discipline): committed histories from released workflow code must
  * replay green on the CURRENT code; a red run means a change is not
  * replay-safe for in-flight executions and needs patched(), never a

package/src/temporal/workflowexecution/activities.ts

@@ -1,13 +1,15 @@
 /**
  * Server-side activity implementations for the workflow-execution worker —
  * ports pkg/domain/workflowexecution/temporal/activities
- * (update_status_impl.go) and registers #15's DeleteExecutionContext seam.
+ * (update_status_impl.go) and registers DeleteExecutionContext, the
+ * server's own delete of the run's context through the context's delete
+ * chain (domain/executioncontext/internal-delete.ts, stigmer#1647).
  *
  * UpdateWorkflowExecutionStatus deliberately does NOT reuse the domain's
  * updateStatus RPC merge (the choice agentexecution's port made): in Go
  * the two merges are DIFFERENT code with different semantics, and the
  * differences are wire-visible for exactly the payloads this workflow
- * sends (sub-project DD-001 brief, owner-ratified):
+ * sends:
  *
  *   - The activity bumps statusAudit.updatedAt on EVERY call; the RPC
  *     bumps only on phase TRANSITIONS (the recents-sidebar rule). A
@@ -18,12 +20,12 @@
  *     ("workflow execution not found: …"), not the RPC's NotFound.
  *
  * What IS adopted from the domain: the atomic `updateResource` persist
- * (the #20 DD-001 posture — Go's activity is a load-then-save with the
+ * (Go's activity is a load-then-save with the
  * same lost-update window its RPC has; not ported) and the post-persist
  * broadcast through the domain's StreamBroker (Go wires the same broker
  * into both).
  *
- * Payload boundary (sub-project 20260824.03 design rule): statuses cross
+ * Payload boundary: statuses cross
  * as proto-JSON — the TS default payload converter cannot serialize the
  * bigint int64 fields of typed messages. Server-internal payloads; only
  * the activity NAMES are byte-pinned.
@@ -47,10 +49,9 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 
 import type { Logger } from "../../boot/logger.js";
 import type { StreamBroker } from "../../domain/workflowexecution/stream-broker.js";
-import {
-  DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME,
-  deleteExecutionContextForExecution,
-} from "../../domain/executioncontext/temporal/delete-execution-context.js";
+import { deleteExecutionContextForExecution } from "../../domain/executioncontext/internal-delete.js";
+import type { ExecutionContextDeleter } from "../../domain/executioncontext/internal-delete.js";
+import { DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME } from "../../domain/executioncontext/temporal/delete-execution-context.js";
 import type { WorkflowSandboxTerminalObserver } from "../../sandbox/steps.js";
 import type { Store } from "../../store/interface.js";
 import { UPDATE_WORKFLOW_EXECUTION_STATUS_ACTIVITY_NAME } from "./names.js";
@@ -60,12 +61,18 @@ export interface WorkflowExecutionActivityDeps {
   readonly logger: Logger;
   readonly broker: StreamBroker;
   /**
-   * Fires the workflow-sandbox teardown on terminal transitions (§6d,
-   * O6) — this activity is the orchestrator's failure/cancellation
-   * persist site, one of the three status write sites the Q3b ruling
-   * wires.
+   * Fires the workflow-sandbox teardown on terminal transitions — this
+   * activity is the orchestrator's failure/cancellation persist site, one
+   * of the three status write sites that fire it.
    */
   readonly sandboxTerminalObserver: WorkflowSandboxTerminalObserver;
+  /**
+   * The server's own delete of a run's ExecutionContext, read per call:
+   * the context's delete chain over the in-process transport, which exists
+   * only once the routes do (the composition root's requireInProcess
+   * idiom).
+   */
+  readonly executionContextDeleter: () => ExecutionContextDeleter;
 }
 
 /**
@@ -84,7 +91,7 @@ export function createWorkflowExecutionActivities(
      * The orchestrator's status persist, invoked as a LOCAL activity
      * (pause/resume handlers) AND a REGULAR activity (failure/
      * cancellation paths) — one implementation serves both modes,
-     * exactly one named registration (see names.ts's DD-002 note on why
+     * exactly one named registration (see names.ts's note on why
      * the NAME is load-bearing).
      */
     [UPDATE_WORKFLOW_EXECUTION_STATUS_ACTIVITY_NAME]: async (
@@ -95,7 +102,7 @@ export function createWorkflowExecutionActivities(
 
       let updated: WorkflowExecution;
       // The phase BEFORE this merge, read under the write lock — the
-      // sandbox observer below keys on the transition (§6d, O6).
+      // sandbox observer below keys on the transition.
       let previousPhase = ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;
       try {
         updated = await store.updateResource(
@@ -141,11 +148,15 @@ export function createWorkflowExecutionActivities(
       );
     },
 
-    /** #15's seam, shared with the agent-execution worker exactly as in Go. */
+    /** The server's own delete of the run's context, shared with the agent-execution worker exactly as in Go. */
     [DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME]: async (
       executionId: string,
     ): Promise<void> => {
-      await deleteExecutionContextForExecution(store, logger, executionId);
+      await deleteExecutionContextForExecution(
+        { store, deleter: deps.executionContextDeleter, logger },
+        executionId,
+        "run-end",
+      );
     },
   };
 }

package/src/temporal/workflowexecution/engine-client.ts

@@ -5,10 +5,10 @@
  * operations the lifecycle steps consume (lifecycle_steps.go: raw
  * signal, cancel, terminate).
  *
- * #20 modeled the engine as the ConnectedWorkflowExecutionEngine seam
+ * The domain models the engine as the ConnectedWorkflowExecutionEngine seam
  * (src/domain/workflowexecution/engine.ts); this module fills it.
  * Dispatch-queue resolution lives INSIDE startInvokeWorkflow/
- * signalWithStart (the seam's ratified boundary — Go's controller calls
+ * signalWithStart (the seam's boundary — Go's controller calls
  * ResolveWorkflowTaskQueue immediately before Create/SignalWithStart).
  * Unlike agentexecution's dispatch it is PURE (no store read), so there
  * is no EngineDispatchError lane — Go's Create has no dispatch failure
@@ -185,7 +185,7 @@ export class TemporalWorkflowExecutionEngine
    * The slim input with Go's omitempty shape (workflow-input.ts): zero
    * values are omitted so TS-authored histories carry the same keys a
    * Go-authored one would. The cloud-only fields are unmodeled (the
-   * seam's ratified boundary). The run credential is the one key minted
+   * seam's boundary). The run credential is the one key minted
    * here rather than copied from the caller (module header).
    */
   private buildWorkflowInput(
@@ -231,8 +231,7 @@ export interface WorkflowExecutionEngineStateProviderDeps {
 
 /**
  * Builds the provider compose hands the workflowexecution registration —
- * replacing the pre-#21 `() => WORKFLOW_EXECUTION_ENGINE_DISCONNECTED`
- * lambda.
+ * in place of a fixed `() => WORKFLOW_EXECUTION_ENGINE_DISCONNECTED`.
  *
  * Availability parity with Go (manager.ts module header): disconnected
  * ONLY until the first successful connect; afterwards the engine wraps

package/src/temporal/workflowexecution/names.ts

@@ -4,19 +4,18 @@
  * workflows/invoke_workflow.go, workflows/workflow_creator.go,
  * activities/update_status.go, dispatch.go).
  *
- * Every value here is a byte-pinned cross-edition wire constant (D2 §4).
+ * Every value here is a byte-pinned cross-edition wire constant.
  * The orchestrator workflow NAME, its ID format, the child workflow ID,
  * and the pause/resume/relaySignal channel names are canonically owned by
  * the DOMAIN's constants module (src/domain/workflowexecution/
- * constants.ts — #20 shipped them for the lifecycle steps) and re-exported
+ * constants.ts, where the lifecycle steps read them) and re-exported
  * here so the temporal slice has one import surface and the program has
  * one definition.
  *
  * This module is imported by BOTH the workflow bundle and host code, so it
  * must stay free of node built-ins and framework imports (the Temporal
- * workflow sandbox bundler hard-fails on node imports — sub-project
- * 20260824.03 workflow-bundle import discipline; the domain constants
- * module it re-exports from is import-free).
+ * workflow sandbox bundler hard-fails on node imports; the domain
+ * constants module it re-exports from is import-free).
  */
 export {
   INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME,
@@ -40,8 +39,8 @@ export const CHILD_WORKFLOW_TYPE = "stigmer/workflow/execute-from-execution";
  * The ONLY memo key this domain writes (workflow_creator.go); the
  * workflow reads it back to place the child. Go also falls back to the
  * legacy "activityTaskQueue" key for pre-migration in-flight histories —
- * NOT ported: no Go-era history can replay on this server (OD-6
- * start-clean), so the legacy read would be dead code.
+ * NOT ported: no Go-era history can replay on this server (it started
+ * clean), so the legacy read would be dead code.
  */
 export const MEMO_RUNNER_TASK_QUEUE = "runnerTaskQueue";
 
@@ -59,12 +58,12 @@ export const DEFAULT_RUNNER_TASK_QUEUE = "stigmer_runner";
  * the Go-SDK RECORD_MARKER replay bug; the history shape is contract).
  *
  * The name is Go's UpdateWorkflowExecutionStatusActivityName constant.
- * NOTE (sub-project DD-002): Go's production worker registers this
+ * NOTE: Go's production worker registers this
  * activity WITHOUT an explicit name, deriving "UpdateExecutionStatus"
  * from the method — so Go's own orchestrator persists never resolve the
  * activity and fail silently behind their best-effort call sites. This
  * server registers AND invokes under the one constant name, making the
- * lane work (the #18 DD-001 broken-Go-lane precedent; Go issue filed).
+ * lane work.
  */
 export const UPDATE_WORKFLOW_EXECUTION_STATUS_ACTIVITY_NAME =
   "UpdateWorkflowExecutionStatus";

package/src/temporal/workflowexecution/worker.ts

@@ -18,11 +18,12 @@
  * workflow types from export names, so no explicit registration option
  * exists or is needed.
  *
- * Workflow source: runtime bundling from the compiled entry (ratified
- * brief #7 of sub-project 20260824.03 — the operative mode until #24
- * ships prebuilt bundles; the prebuilt sibling is the hook it fills).
+ * Workflow source: runtime bundling from the compiled entry in a tsc
+ * build, and the prebuilt sibling bundle in a slim artifact (see
+ * workflow-source.ts).
  */
 import type { Logger } from "../../boot/logger.js";
+import type { ExecutionContextDeleter } from "../../domain/executioncontext/internal-delete.js";
 import type { WorkflowExecutionTemporalConfig } from "../../domain/workflowexecution/temporal/config.js";
 import type { StreamBroker } from "../../domain/workflowexecution/stream-broker.js";
 import type { WorkflowSandboxTerminalObserver } from "../../sandbox/steps.js";
@@ -36,8 +37,14 @@ export interface WorkflowExecutionWorkerDeps {
   readonly logger: Logger;
   readonly broker: StreamBroker;
   readonly temporalConfig: WorkflowExecutionTemporalConfig;
-  /** The activity persist site's sandbox teardown observer (§6d, O6). */
+  /** The activity persist site's sandbox teardown observer. */
   readonly sandboxTerminalObserver: WorkflowSandboxTerminalObserver;
+  /**
+   * The server's own delete of a run's ExecutionContext (the run-end
+   * activity): the context's delete chain over the in-process transport,
+   * resolved lazily because the worker is built before the routes exist.
+   */
+  readonly executionContextDeleter: () => ExecutionContextDeleter;
 }
 
 export function newWorkflowExecutionWorkerFactory(
@@ -49,6 +56,7 @@ export function newWorkflowExecutionWorkerFactory(
       logger: deps.logger,
       broker: deps.broker,
       sandboxTerminalObserver: deps.sandboxTerminalObserver,
+      executionContextDeleter: deps.executionContextDeleter,
     });
 
     const workflowSource = resolveWorkflowSource({

package/src/temporal/workflowexecution/workflow-input.ts

@@ -12,8 +12,8 @@
  * cross-component contract with the runner's execute-from-execution.
  *
  * Go's callback_token / invoker_identity_account_id fields have no OSS
- * producer (cloud-only lanes) and are not modeled — the seam's ratified
- * boundary (src/domain/workflowexecution/engine.ts).
+ * producer (cloud-only lanes) and are not modeled — the seam's boundary
+ * (src/domain/workflowexecution/engine.ts).
  *
  * Sandbox-shared module: type-only, no imports.
  */
@@ -45,8 +45,8 @@ export interface InvokeWorkflowExecutionWorkflowInput {
 }
 
 /**
- * The relaySignal envelope (invoke_workflow_impl.go RelaySignalPayload,
- * June DD-013): an arbitrary signal to forward to the child, sent by the
+ * The relaySignal envelope (invoke_workflow_impl.go RelaySignalPayload):
+ * an arbitrary signal to forward to the child, sent by the
  * controller's sendSignal / submitWorkflowTaskApproval through
  * SignalWithStart. JSON keys are the Go struct tags.
  */