@treeseed/sdk 0.12.59 → 0.12.61

package/dist/workflow/operations.js

@@ -153,7 +153,6 @@ import {
   archiveWorkflowRun,
   cacheWorkflowGateResult,
   classifyWorkflowRunJournal,
-  classifyWorkflowRunJournals,
   createWorkflowRunJournal,
   generateWorkflowRunId,
   getCachedSuccessfulWorkflowGate,
@@ -551,11 +550,12 @@ function selectorFromWorkflowHostingGraph(graph) {
     ].filter((hostId) => hostId !== "smtp" && hostId !== "local-process" && hostId !== "local-docker"))],
     serviceId: [...new Set(graph.units.flatMap((unit) => [
       unit.id,
+      typeof unit.config.poolKey === "string" ? unit.config.poolKey : null,
       typeof unit.config.serviceName === "string" ? unit.config.serviceName : null
     ]).concat(domainServiceIds).filter((value) => Boolean(value)))],
     serviceType: [...new Set(graph.units.flatMap((unit) => {
       if (unit.id === "api") return ["api-runtime", "railway-service:api", "custom-domain:api", "dns-record"];
-      if (unit.id === "operationsRunner") return ["operations-runner-runtime", "railway-service:operations-runner"];
+      if (unit.id === "operationsRunner" || unit.config.poolKey === "operationsRunner") return ["operations-runner-runtime", "railway-service:operations-runner"];
       if (unit.placement === "runner-capacity") return ["api-runtime", "operations-runner-runtime", "railway-service:api", "railway-service:operations-runner"];
       if (unit.host.id === "cloudflare") return ["web-ui", "edge-worker", "content-store", "database", "kv-form-guard", "turnstile-widget", "pages-project", "custom-domain:web", "dns-record"];
       return [];
@@ -707,6 +707,40 @@ ${liveFailures.join("\n")}`, {
   }
   return live;
 }
+async function verifyReleaseApiEnvironmentIsolation(root, helpers, releaseImageRefs) {
+  const reports = {};
+  for (const environment of ["prod", "staging"]) {
+    const env = {
+      ...helpers.context.env,
+      ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env),
+      ...environment === "prod" ? releaseImageRefs : {}
+    };
+    helpers.write(`[release][railway] read-only ${environment} source-invariance verification started.`, "stderr");
+    const report = await collectTreeseedLiveHostedServiceChecks({
+      tenantRoot: root,
+      target: environment,
+      appId: "api",
+      serviceKeys: ["api", "operationsRunner", "public-treedx-node-01"],
+      strict: true,
+      requireLiveRailway: true,
+      requireLiveHttp: true,
+      env
+    });
+    const failures = [
+      ...report.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.issues.join("; ") || "failed"}`),
+      ...report.liveObservation.issues
+    ];
+    if (failures.length > 0) {
+      workflowError("release", "hosted_live_verification_failed", `${environment} API source-invariance verification failed after production deployment:
+${failures.join("\n")}`, {
+        details: { environment, report }
+      });
+    }
+    reports[environment] = report;
+    helpers.write(`[release][railway] read-only ${environment} source-invariance verification passed.`, "stderr");
+  }
+  return { status: "verified", order: ["prod", "staging"], reports };
+}
 function productionReleaseImageRefEnv(selectedVersions) {
   const refs = {};
   const apiVersion = selectedVersions.get("@treeseed/api");
@@ -1797,7 +1831,32 @@ function gateForSavedRootReport(report, branch, scope) {
 }
 function findAutoResumableTaskRun(root, command, branch) {
   if (!branch) return null;
-  return listInterruptedWorkflowRuns(root).find((journal) => journal.command === command && journal.resumable && journal.session.branchName === branch) ?? null;
+  const currentHeads = Object.fromEntries([
+    ["@treeseed/market", runGit(["rev-parse", "HEAD"], { cwd: repoRoot(root), capture: true }).trim()],
+    ...checkedOutWorkspacePackageRepos(root).map((repo) => [
+      repo.name,
+      runGit(["rev-parse", "HEAD"], { cwd: repo.dir, capture: true }).trim()
+    ])
+  ]);
+  return listInterruptedWorkflowRuns(root).find((journal) => {
+    if (journal.command !== command || !journal.resumable || journal.session.branchName !== branch) {
+      return false;
+    }
+    const classification = classifyWorkflowRunJournal(journal, {
+      currentBranch: branch,
+      currentHeads
+    });
+    if (classification.state === "resumable") {
+      return true;
+    }
+    if (classification.state === "stale") {
+      archiveWorkflowRun(root, journal.runId, {
+        ...classification,
+        reasons: [`${command} implicit resume skipped stale failed run`, ...classification.reasons]
+      });
+    }
+    return false;
+  }) ?? null;
 }
 function rejectImplicitWorkflowResume(operation, journal) {
   if (!journal) return;
@@ -2011,17 +2070,48 @@ async function executeJournalStep(root, runId, stepId, action, options = {}) {
   if (step.status === "completed" && !options.rerunCompleted) {
     return step.data ?? null;
   }
-  const data = await Promise.resolve(action());
+  const startedAt = /* @__PURE__ */ new Date();
+  const retryCount = Number(step.retryCount ?? 0) + (step.startedAt ? 1 : 0);
+  updateWorkflowRunJournal(root, runId, (journal) => ({
+    ...journal,
+    steps: journal.steps.map((entry) => entry.id === stepId ? { ...entry, startedAt: startedAt.toISOString(), retryCount, lastFailure: null } : entry)
+  }));
+  refreshWorkflowLock(root, runId);
+  const lockHeartbeat = setInterval(() => refreshWorkflowLock(root, runId), 15e3);
+  lockHeartbeat.unref();
+  process.stderr.write(`[workflow][step] start ${stepId} attempt=${retryCount + 1}
+`);
+  let data;
+  try {
+    data = await Promise.resolve(action());
+  } catch (error) {
+    clearInterval(lockHeartbeat);
+    const elapsedMs2 = Date.now() - startedAt.getTime();
+    const message = error instanceof Error ? error.message : String(error);
+    updateWorkflowRunJournal(root, runId, (journal) => ({
+      ...journal,
+      steps: journal.steps.map((entry) => entry.id === stepId ? { ...entry, elapsedMs: elapsedMs2, lastFailure: message } : entry)
+    }));
+    process.stderr.write(`[workflow][step] fail ${stepId} elapsed=${Math.ceil(elapsedMs2 / 1e3)}s retries=${retryCount}
+`);
+    throw error;
+  }
+  clearInterval(lockHeartbeat);
+  const elapsedMs = Date.now() - startedAt.getTime();
   updateWorkflowRunJournal(root, runId, (journal) => ({
     ...journal,
     steps: journal.steps.map((entry) => entry.id === stepId ? {
       ...entry,
       status: "completed",
       completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      elapsedMs,
+      lastFailure: null,
       data: data ?? null
     } : entry)
   }));
   refreshWorkflowLock(root, runId);
+  process.stderr.write(`[workflow][step] complete ${stepId} elapsed=${Math.ceil(elapsedMs / 1e3)}s retries=${retryCount}
+`);
   return data;
 }
 function skipJournalStep(root, runId, stepId, data = null) {
@@ -2185,7 +2275,7 @@ function productionPackageDeployGates(root, versions) {
     })];
   });
 }
-function prepareAdapterReleaseMetadata(root, pkg, version) {
+async function prepareAdapterReleaseMetadata(root, pkg, version) {
   const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === pkg.name || entry.name === pkg.name);
   if (adapter?.kind === "beam-elixir-rust" && existsSync(resolve(pkg.dir, "scripts", "bump-release-version.ts"))) {
     const tsx = resolve(root, "node_modules/.bin/tsx");
@@ -2199,7 +2289,7 @@ function prepareAdapterReleaseMetadata(root, pkg, version) {
     return {
       status: "npm-install",
       adapter: adapter?.id ?? pkg.name,
-      ...runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
+      ...await runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
     };
   }
   return { status: "skipped", adapter: adapter?.id ?? pkg.name, reason: "no package metadata updater" };
@@ -2237,40 +2327,83 @@ function npmCommandForWorkflowSpawn(args) {
     ]
   };
 }
-function runReleaseNpmInstall(repoDir, options = {}) {
-  if (shouldSkipReleaseInstall()) {
-    return { status: "skipped", reason: "disabled" };
+function lockfileRootMatchesManifest(repoDir) {
+  try {
+    const manifest = JSON.parse(readFileSync(resolve(repoDir, "package.json"), "utf8"));
+    const lockfile = JSON.parse(readFileSync(resolve(repoDir, "package-lock.json"), "utf8"));
+    const root = lockfile.packages?.[""];
+    if (!root || root.version !== manifest.version) return false;
+    for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+      const expected = manifest[field] ?? {};
+      const observed = root[field] ?? {};
+      if (JSON.stringify(expected) !== JSON.stringify(observed)) return false;
+    }
+    return true;
+  } catch {
+    return false;
   }
-  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
-  const spawnCommand = npmCommandForWorkflowSpawn(args);
-  let lastDetail = "";
-  for (let attempt = 1; attempt <= 10; attempt += 1) {
-    const result = spawnSync(spawnCommand.command, spawnCommand.args, {
+}
+function waitForReleaseInstall(command, args, repoDir, attempt) {
+  return new Promise((resolvePromise) => {
+    const startedAt = Date.now();
+    let settled = false;
+    const child = spawn(command, args, {
       cwd: repoDir,
       env: {
         ...process.env,
         npm_config_audit: "false",
-        npm_config_fetch_retries: "4",
+        npm_config_fetch_retries: "2",
         npm_config_fund: "false",
-        npm_config_foreground_scripts: "true",
+        npm_config_foreground_scripts: "false",
         npm_config_loglevel: "warn",
         npm_config_maxsockets: "4",
-        npm_config_prefer_online: "true",
+        npm_config_prefer_offline: "true",
         npm_config_progress: "false"
       },
-      stdio: "pipe",
-      encoding: "utf8"
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const output = [];
+    child.stdout?.on("data", (chunk) => output.push(Buffer.from(chunk)));
+    child.stderr?.on("data", (chunk) => output.push(Buffer.from(chunk)));
+    const heartbeat = setInterval(() => {
+      process.stderr.write(`[release][restore] repository=${repoDir} phase=package-lock attempt=${attempt} elapsed=${Math.ceil((Date.now() - startedAt) / 1e3)}s
+`);
+    }, 15e3);
+    child.once("close", (status) => {
+      if (settled) return;
+      settled = true;
+      clearInterval(heartbeat);
+      resolvePromise({ status, detail: Buffer.concat(output).toString("utf8").trim() });
+    });
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearInterval(heartbeat);
+      output.push(Buffer.from(error.message));
+      resolvePromise({ status: null, detail: Buffer.concat(output).toString("utf8").trim() });
     });
+  });
+}
+async function runReleaseNpmInstall(repoDir, options = {}) {
+  if (shouldSkipReleaseInstall()) {
+    return { status: "skipped", reason: "disabled" };
+  }
+  if (repoDir === options.workspaceRoot && lockfileRootMatchesManifest(repoDir)) {
+    return { status: "skipped", reason: "root-lockfile-already-matches", attempts: 0 };
+  }
+  const args = ["install", "--package-lock-only", "--ignore-scripts", "--prefer-offline", "--workspaces=false", "--no-audit", "--no-fund"];
+  const spawnCommand = npmCommandForWorkflowSpawn(args);
+  let lastDetail = "";
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    process.stderr.write(`[release][restore] repository=${repoDir} phase=package-lock attempt=${attempt} elapsed=0s
+`);
+    const result = await waitForReleaseInstall(spawnCommand.command, spawnCommand.args, repoDir, attempt);
     if (result.status === 0) {
       return { status: "completed", reason: null, attempts: attempt };
     }
-    lastDetail = [
-      result.error?.message,
-      result.stderr?.trim(),
-      result.stdout?.trim()
-    ].filter(Boolean).join("\n");
-    if (!/No matching version found|notarget|ETARGET|E404/u.test(lastDetail) || attempt === 10) break;
-    spawnSync("sleep", ["30"], { stdio: "ignore" });
+    lastDetail = result.detail;
+    if (!/No matching version found|notarget|ETARGET|E404/u.test(lastDetail) || attempt === 3) break;
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 15e3));
   }
   throw new Error(lastDetail || `npm ${args.join(" ")} failed`);
 }
@@ -5192,6 +5325,7 @@ async function workflowClose(helpers, input) {
 }
 function stagingCandidateWorkflowGates(root, manifest) {
   const gates = [];
+  const adapters = discoverTreeseedPackageAdapters(root);
   const add = (name, repoPath, headSha, workflow, deploy = false) => {
     if (!workflowFileExists(repoPath, workflow)) return;
     const gate = { name, repoPath, workflow, branch: STAGING_BRANCH, headSha };
@@ -5199,10 +5333,11 @@ function stagingCandidateWorkflowGates(root, manifest) {
   };
   for (const pkg of manifest.packages) {
     const repoPath = resolve(root, pkg.path);
+    const adapter = adapters.find((candidate) => candidate.id === pkg.name || candidate.name === pkg.name);
     if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit) {
       add(pkg.name, repoPath, pkg.commit, "verify.yml");
     }
-    if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit && existsSync(resolve(repoPath, "treeseed.site.yaml"))) {
+    if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit && adapter?.capabilities.deploy === true && existsSync(resolve(repoPath, "treeseed.site.yaml"))) {
       add(pkg.name, repoPath, pkg.commit, "deploy.yml", true);
     }
   }
@@ -6018,6 +6153,7 @@ ${blockers.join("\n")}`, {
           },
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "verify-api-environment-isolation", description: "Verify production images and staging Git sources remained isolated", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "persist-production-image-refs", description: "Persist released production image refs and verify deployment readiness", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
@@ -6083,57 +6219,90 @@ ${rendered}`);
         });
         const packageReleases = [];
         const packageRepoByName = new Map(checkedOutWorkspacePackageRepos(root).map((entry) => [entry.name, entry]));
-        for (const packageName of selectedPackageNames) {
+        const pendingPackageReleases = new Set(selectedPackageNames.filter((name) => selectedVersions.has(name) && packageRepoByName.has(name)));
+        const completedPackageReleases = /* @__PURE__ */ new Set();
+        const packageReleaseResults = /* @__PURE__ */ new Map();
+        const selectedPackageDependencies = new Map([...pendingPackageReleases].map((packageName) => {
           const pkg = packageRepoByName.get(packageName);
-          if (!pkg) continue;
-          const version = selectedVersions.get(pkg.name);
-          if (!version) continue;
-          const packageRelease = await executeJournalStep(root, workflowRun.runId, `release-${pkg.name}`, async () => {
-            const metadata = prepareAdapterReleaseMetadata(root, pkg, version);
-            const changelog = updateReleaseChangelog(pkg.dir, {
-              version,
-              sourceRef: `origin/${PRODUCTION_BRANCH}`,
-              targetRef: "HEAD"
-            });
-            const commit = commitAllIfChanged(pkg.dir, releaseAdminMessage({
-              subject: `release: ${pkg.name} ${version}`,
-              version,
-              tagName: version,
-              sourceRef: STAGING_BRANCH,
-              targetRef: PRODUCTION_BRANCH,
-              changelog
-            }));
-            pushBranch(pkg.dir, STAGING_BRANCH);
-            const promotion = promoteCommitToProductionBranch(pkg.dir, commit.commitSha);
-            const tag = ensureReleaseTag(pkg.dir, version, commit.commitSha, `release: ${pkg.name} ${version}`);
-            const publishGate = {
-              name: pkg.name,
-              repoPath: pkg.dir,
-              workflow: releaseWorkflowForPackage(root, pkg.name),
-              branch: version,
-              headSha: commit.commitSha
-            };
-            const publishWait2 = await waitForWorkflowGates("release", [publishGate], ciMode, {
-              root,
-              runId: workflowRun.runId,
-              onProgress: (line, stream) => helpers.write(line, stream)
+          if (!pkg) return [packageName, []];
+          const manifest = readJsonFile(resolve(pkg.dir, "package.json"));
+          if (!manifest) {
+            throw new Error(`Release package manifest is missing or invalid for ${packageName}.`);
+          }
+          const dependencyNames = /* @__PURE__ */ new Set([
+            ...Object.keys(manifest.dependencies ?? {}),
+            ...Object.keys(manifest.optionalDependencies ?? {}),
+            ...Object.keys(manifest.peerDependencies ?? {})
+          ]);
+          const dependencies = [...dependencyNames].filter((name) => pendingPackageReleases.has(name));
+          if (packageName !== "@treeseed/sdk" && pendingPackageReleases.has("@treeseed/sdk") && !dependencies.includes("@treeseed/sdk")) {
+            dependencies.push("@treeseed/sdk");
+          }
+          return [packageName, dependencies];
+        }));
+        while (pendingPackageReleases.size > 0) {
+          const eligible = selectedPackageNames.filter((packageName) => pendingPackageReleases.has(packageName) && (selectedPackageDependencies.get(packageName) ?? []).every((dependency) => completedPackageReleases.has(dependency)));
+          if (eligible.length === 0) {
+            throw new Error(`Release package dependency graph is cyclic or unresolved: ${[...pendingPackageReleases].join(", ")}.`);
+          }
+          const batch = eligible.slice(0, 2);
+          helpers.write(`[release][packages] starting batch ${batch.join(", ")} (concurrency=${batch.length}/2).`, "stderr");
+          const results = await Promise.all(batch.map(async (packageName) => {
+            const pkg = packageRepoByName.get(packageName);
+            const version = selectedVersions.get(pkg.name);
+            const packageRelease = await executeJournalStep(root, workflowRun.runId, `release-${pkg.name}`, async () => {
+              const metadata = await prepareAdapterReleaseMetadata(root, pkg, version);
+              const changelog = updateReleaseChangelog(pkg.dir, {
+                version,
+                sourceRef: `origin/${PRODUCTION_BRANCH}`,
+                targetRef: "HEAD"
+              });
+              const commit = commitAllIfChanged(pkg.dir, releaseAdminMessage({
+                subject: `release: ${pkg.name} ${version}`,
+                version,
+                tagName: version,
+                sourceRef: STAGING_BRANCH,
+                targetRef: PRODUCTION_BRANCH,
+                changelog
+              }));
+              pushBranch(pkg.dir, STAGING_BRANCH);
+              const promotion = promoteCommitToProductionBranch(pkg.dir, commit.commitSha);
+              const tag = ensureReleaseTag(pkg.dir, version, commit.commitSha, `release: ${pkg.name} ${version}`);
+              const publishGate = {
+                name: pkg.name,
+                repoPath: pkg.dir,
+                workflow: releaseWorkflowForPackage(root, pkg.name),
+                branch: version,
+                headSha: commit.commitSha
+              };
+              const publishWait2 = await waitForWorkflowGates("release", [publishGate], ciMode, {
+                root,
+                runId: workflowRun.runId,
+                onProgress: (line, stream) => helpers.write(line, stream)
+              });
+              const publishedArtifacts2 = await verifyPublishedReleaseArtifacts(/* @__PURE__ */ new Map([[pkg.name, version]]));
+              return {
+                name: pkg.name,
+                path: relative(root, pkg.dir),
+                version,
+                changelog,
+                metadata,
+                commit,
+                promotion,
+                tag,
+                publishWait: publishWait2,
+                publishedArtifacts: publishedArtifacts2
+              };
             });
-            const publishedArtifacts2 = await verifyPublishedReleaseArtifacts(/* @__PURE__ */ new Map([[pkg.name, version]]));
-            return {
-              name: pkg.name,
-              path: relative(root, pkg.dir),
-              version,
-              changelog,
-              metadata,
-              commit,
-              promotion,
-              tag,
-              publishWait: publishWait2,
-              publishedArtifacts: publishedArtifacts2
-            };
-          });
-          packageReleases.push(packageRelease);
+            return [packageName, packageRelease];
+          }));
+          for (const [packageName, packageRelease] of results) {
+            pendingPackageReleases.delete(packageName);
+            completedPackageReleases.add(packageName);
+            packageReleaseResults.set(packageName, packageRelease);
+          }
         }
+        packageReleases.push(...selectedPackageNames.map((name) => packageReleaseResults.get(name)).filter((entry) => Boolean(entry)));
         const managedHelperReleases = await executeJournalStep(root, workflowRun.runId, "release-helper-repos", () => {
           const releases = releaseHelperRepos.map((repo) => releaseHelperRepoToProduction(repo));
           syncAllCheckedOutReleaseHelperRepos(root, STAGING_BRANCH);
@@ -6151,6 +6320,10 @@ ${rendered}`);
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates }));
         });
+        const apiEnvironmentIsolation = effectiveInput.verifyDeployedResources === true ? await executeJournalStep(root, workflowRun.runId, "verify-api-environment-isolation", () => verifyReleaseApiEnvironmentIsolation(root, helpers, releaseImageRefs)) : (skipJournalStep(root, workflowRun.runId, "verify-api-environment-isolation", {
+          status: "skipped",
+          reason: "--verify-deployed-resources was not requested"
+        }), { status: "skipped", reason: "--verify-deployed-resources was not requested" });
         const productionImageRefs = await executeJournalStep(root, workflowRun.runId, "persist-production-image-refs", async () => {
           const persisted = persistProductionReleaseImageRefs(root, releaseImageRefs);
           if (helpers.context.env) {
@@ -6171,8 +6344,8 @@ ${failures.join("\n")}`, {
           }
           return { persisted, readiness };
         });
-        const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
-          const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
+        const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", async () => {
+          const rootInstall = await runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
             version: plannedRelease.rootVersion,
             sourceRef: `origin/${PRODUCTION_BRANCH}`,
@@ -6244,6 +6417,7 @@ ${failures.join("\n")}`, {
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionPackageDeployWorkflows,
+          apiEnvironmentIsolation,
           productionImageRefs,
           backMerge,
           workspaceLinks,
@@ -6397,17 +6571,21 @@ async function workflowRecover(helpers, input = {}) {
         return null;
       }).filter((entry) => entry !== null);
       const journals = listWorkflowRunJournals(root);
+      const actionableJournals = journals.filter((journal) => journal.status !== "completed" && !journal.classification?.archivedAt);
       const session = resolveTreeseedWorkflowSession(root);
       const currentHeads = Object.fromEntries(
         [createWorkspaceRootRepoReport(root), ...createWorkspacePackageReports(root)].map((report) => [report.name, report.commitSha ?? null])
       );
-      const classifiedRuns = classifyWorkflowRunJournals(root, {
-        currentBranch: session.branchName,
-        currentHeads
-      });
+      const classifiedRuns = actionableJournals.map((journal) => ({
+        journal,
+        classification: classifyWorkflowRunJournal(journal, {
+          currentBranch: session.branchName,
+          currentHeads
+        })
+      }));
       const markedObsoleteRun = input.obsoleteRunId ? (() => {
-        const entry = classifiedRuns.find((candidate) => candidate.journal.runId === input.obsoleteRunId);
-        if (!entry) {
+        const journal = journals.find((candidate) => candidate.runId === input.obsoleteRunId);
+        if (!journal) {
           workflowError("recover", "validation_failed", `Treeseed recover could not find workflow run ${input.obsoleteRunId}.`);
         }
         const reason = input.obsoleteReason?.trim() || "marked obsolete by operator";
@@ -6416,17 +6594,14 @@ async function workflowRecover(helpers, input = {}) {
           reasons: [reason],
           classifiedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        archiveWorkflowRun(root, entry.journal.runId, classification);
+        archiveWorkflowRun(root, journal.runId, classification);
         return {
-          runId: entry.journal.runId,
-          command: entry.journal.command,
+          runId: journal.runId,
+          command: journal.command,
           reason
         };
       })() : null;
-      const effectiveClassifiedRuns = markedObsoleteRun ? classifyWorkflowRunJournals(root, {
-        currentBranch: session.branchName,
-        currentHeads
-      }) : classifiedRuns;
+      const effectiveClassifiedRuns = markedObsoleteRun ? classifiedRuns.filter((entry) => entry.journal.runId !== markedObsoleteRun.runId) : classifiedRuns;
       const interruptedRuns = effectiveClassifiedRuns.filter((entry) => entry.classification.state === "resumable").map(({ journal }) => ({
         runId: journal.runId,
         command: journal.command,

package/dist/workflow/runs.d.ts

@@ -30,7 +30,11 @@ export type TreeseedWorkflowRunStep = {
     branch: string | null;
     resumable: boolean;
     status: 'pending' | 'completed' | 'skipped';
+    startedAt?: string | null;
     completedAt: string | null;
+    elapsedMs?: number | null;
+    retryCount?: number;
+    lastFailure?: string | null;
     data: Record<string, unknown> | null;
 };
 export type TreeseedWorkflowRunJournal = {

package/dist/workflow/runs.js

@@ -435,6 +435,18 @@ function collectSaveExpectedHeads(journal) {
   }
   return heads;
 }
+function collectStageExpectedHeads(journal) {
+  const heads = {};
+  const promotion = stringRecord(journal.steps.find((step) => step.id === "promote-to-staging")?.data);
+  const results = Array.isArray(promotion?.results) ? promotion.results : [];
+  for (const entry of results) {
+    const repo = stringRecord(entry);
+    if (typeof repo?.name === "string" && typeof repo.commitSha === "string" && repo.verified === true) {
+      heads[repo.name] = repo.commitSha;
+    }
+  }
+  return heads;
+}
 function classifyWorkflowRunJournal(journal, options = {}) {
   const reasons = [];
   const now = options.now ?? nowIso();
@@ -516,6 +528,15 @@ function classifyWorkflowRunJournal(journal, options = {}) {
       }
     }
   }
+  if (journal.command === "stage" && options.currentHeads) {
+    const expectedHeads = collectStageExpectedHeads(journal);
+    for (const [name, expectedHead] of Object.entries(expectedHeads)) {
+      const currentHead = options.currentHeads[name];
+      if (currentHead && currentHead !== expectedHead) {
+        reasons.push(`${name} head changed from staged candidate ${expectedHead} to ${currentHead}`);
+      }
+    }
+  }
   return {
     state: reasons.length > 0 ? "stale" : "resumable",
     reasons: reasons.length > 0 ? reasons : releaseGateOnlyCompletion ? ["release commits already exist; remaining release gates can be rechecked"] : ["workflow run can be resumed"],
@@ -598,7 +619,11 @@ function createWorkflowRunJournal(root, options) {
     steps: options.steps.map((step) => ({
       ...step,
       status: "pending",
+      startedAt: null,
       completedAt: null,
+      elapsedMs: null,
+      retryCount: 0,
+      lastFailure: null,
       data: null
     })),
     failure: null,

package/dist/workflow-support.d.ts

@@ -10,7 +10,7 @@ export { readTreeseedVerificationCache, treeseedVerificationCacheKey, writeTrees
 export { assertDeploymentInitialized, cleanupDestroyedState, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, destroyCloudflareResources, ensureGeneratedWranglerConfig, finalizeDeploymentState, loadDeployState, printDeploySummary, printDestroySummary, provisionCloudflareResources, runRemoteD1Migrations, syncCloudflareSecrets, validateDeployPrerequisites, validateDestroyPrerequisites, } from './operations/services/deploy.js';
 export { assertCleanWorktree, assertFeatureBranch, branchExists, checkoutBranch, createFeatureBranchFromStaging, currentManagedBranch, deleteLocalBranch, deleteRemoteBranch, ensureLocalBranchTracking, gitWorkflowRoot, listTaskBranches, mergeCurrentBranchIntoStaging, mergeStagingIntoMain, prepareReleaseBranches, PRODUCTION_BRANCH, pushBranch, remoteBranchExists, STAGING_BRANCH, syncBranchWithOrigin, waitForStagingAutomation, } from './operations/services/git-workflow.js';
 export { loadCliDeployConfig, packageScriptPath, resolveWranglerBin, } from './operations/services/runtime-tools.js';
-export { configuredRailwayServices, validateRailwayDeployPrerequisites, } from './operations/services/railway-deploy.js';
+export { configuredRailwayServices, validateRailwayDeployPrerequisites, waitForRailwayManagedDeploymentsSettled, } from './operations/services/railway-deploy.js';
 export { getRailwayAuthProfile, listRailwayEnvironments, listRailwayProjects, listRailwayServices, listRailwayVariables, resolveRailwayApiToken, resolveRailwayApiUrl, resolveRailwayWorkspace, resolveRailwayWorkspaceContext, } from './operations/services/railway-api.js';
 export { githubRepositoryCredentialEnvName, resolveGitHubCredentialForRepository, type TreeseedGitHubCredentialResolution, } from './operations/services/github-credentials.js';
 export { createGitHubApiClient, ensureGitHubActionsEnvironment, getLatestGitHubWorkflowRun, listGitHubEnvironmentSecretNames, listGitHubEnvironmentVariableNames, type GitHubWorkflowDispatchResult, type GitHubWorkflowRunSummary, } from './operations/services/github-api.js';

package/dist/workflow-support.js

@@ -113,7 +113,8 @@ import {
 } from "./operations/services/runtime-tools.js";
 import {
   configuredRailwayServices,
-  validateRailwayDeployPrerequisites
+  validateRailwayDeployPrerequisites,
+  waitForRailwayManagedDeploymentsSettled
 } from "./operations/services/railway-deploy.js";
 import {
   getRailwayAuthProfile,
@@ -379,6 +380,7 @@ export {
   validateRailwayDeployPrerequisites,
   validateTreeseedPackageManifests,
   verifyTreeseedPackageArtifact,
+  waitForRailwayManagedDeploymentsSettled,
   waitForStagingAutomation,
   warnDeprecatedTreeseedLocalEnvFiles,
   withTreeseedKeyAgentAutopromptDisabled,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.59",
+  "version": "0.12.61",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -66,7 +66,6 @@
     "@github/copilot": "1.0.39",
     "@github/copilot-language-server": "1.480.0",
     "@github/copilot-sdk": "0.3.0",
-    "@railway/cli": "5.23.2",
     "@remotion/bundler": "4.0.477",
     "@remotion/renderer": "4.0.477",
     "drizzle-orm": "^0.45.2",