@treeseed/sdk 0.12.60 → 0.12.62

package/dist/workflow/operations.js

@@ -153,7 +153,6 @@ import {
   archiveWorkflowRun,
   cacheWorkflowGateResult,
   classifyWorkflowRunJournal,
-  classifyWorkflowRunJournals,
   createWorkflowRunJournal,
   generateWorkflowRunId,
   getCachedSuccessfulWorkflowGate,
@@ -479,6 +478,14 @@ async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
         env: gateEnv,
         onProgress: options.onProgress
       });
+    } else if (result.status === "completed" && result.conclusion !== "success" && options.retryFailedOnce) {
+      const retry = await rerunGitHubActionsFailedJobs(result, gateEnv);
+      options.onProgress?.(`[${operation}][gate][${gateWithTimeout.name}] Retrying failed jobs once for adopted immutable release run ${retry.runId}.`);
+      result = await waitForGitHubActionsGate(gateWithTimeout, {
+        operation,
+        env: gateEnv,
+        onProgress: options.onProgress
+      });
     }
     const normalized = {
       name: gateWithTimeout.name,
@@ -551,11 +558,12 @@ function selectorFromWorkflowHostingGraph(graph) {
     ].filter((hostId) => hostId !== "smtp" && hostId !== "local-process" && hostId !== "local-docker"))],
     serviceId: [...new Set(graph.units.flatMap((unit) => [
       unit.id,
+      typeof unit.config.poolKey === "string" ? unit.config.poolKey : null,
       typeof unit.config.serviceName === "string" ? unit.config.serviceName : null
     ]).concat(domainServiceIds).filter((value) => Boolean(value)))],
     serviceType: [...new Set(graph.units.flatMap((unit) => {
       if (unit.id === "api") return ["api-runtime", "railway-service:api", "custom-domain:api", "dns-record"];
-      if (unit.id === "operationsRunner") return ["operations-runner-runtime", "railway-service:operations-runner"];
+      if (unit.id === "operationsRunner" || unit.config.poolKey === "operationsRunner") return ["operations-runner-runtime", "railway-service:operations-runner"];
       if (unit.placement === "runner-capacity") return ["api-runtime", "operations-runner-runtime", "railway-service:api", "railway-service:operations-runner"];
       if (unit.host.id === "cloudflare") return ["web-ui", "edge-worker", "content-store", "database", "kv-form-guard", "turnstile-widget", "pages-project", "custom-domain:web", "dns-record"];
       return [];
@@ -707,6 +715,40 @@ ${liveFailures.join("\n")}`, {
   }
   return live;
 }
+async function verifyReleaseApiEnvironmentIsolation(root, helpers, releaseImageRefs) {
+  const reports = {};
+  for (const environment of ["prod", "staging"]) {
+    const env = {
+      ...helpers.context.env,
+      ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env),
+      ...environment === "prod" ? releaseImageRefs : {}
+    };
+    helpers.write(`[release][railway] read-only ${environment} source-invariance verification started.`, "stderr");
+    const report = await collectTreeseedLiveHostedServiceChecks({
+      tenantRoot: root,
+      target: environment,
+      appId: "api",
+      serviceKeys: ["api", "operationsRunner", "public-treedx-node-01"],
+      strict: true,
+      requireLiveRailway: true,
+      requireLiveHttp: true,
+      env
+    });
+    const failures = [
+      ...report.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.issues.join("; ") || "failed"}`),
+      ...report.liveObservation.issues
+    ];
+    if (failures.length > 0) {
+      workflowError("release", "hosted_live_verification_failed", `${environment} API source-invariance verification failed after production deployment:
+${failures.join("\n")}`, {
+        details: { environment, report }
+      });
+    }
+    reports[environment] = report;
+    helpers.write(`[release][railway] read-only ${environment} source-invariance verification passed.`, "stderr");
+  }
+  return { status: "verified", order: ["prod", "staging"], reports };
+}
 function productionReleaseImageRefEnv(selectedVersions) {
   const refs = {};
   const apiVersion = selectedVersions.get("@treeseed/api");
@@ -1285,6 +1327,62 @@ function ensureReleaseTag(repoDir, tagName, commitSha, message) {
     remote: remoteCommit ? "existing" : "pushed"
   };
 }
+async function adoptPublishedPackageRelease(pkg, version) {
+  const commitSha = tagCommitSha(pkg.dir, version);
+  if (!commitSha) return null;
+  const remoteCommit = remoteTagCommit(pkg.dir, version);
+  if (remoteCommit !== commitSha) {
+    throw new Error(`Release tag ${version} for ${pkg.name} is inconsistent: local=${commitSha}, origin=${remoteCommit ?? "(missing)"}.`);
+  }
+  let taggedManifest;
+  try {
+    taggedManifest = JSON.parse(runGit(["show", `${commitSha}:package.json`], { cwd: pkg.dir, capture: true }));
+  } catch (error) {
+    throw new Error(`Release tag ${version} for ${pkg.name} does not contain a valid package.json: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (taggedManifest.name !== pkg.name || taggedManifest.version !== version) {
+    throw new Error(`Release tag ${version} does not identify ${pkg.name}@${version}.`);
+  }
+  if (hasMeaningfulChanges(pkg.dir)) {
+    throw new Error(`Cannot adopt published ${pkg.name}@${version} while ${pkg.dir} has uncommitted changes.`);
+  }
+  const publishedArtifacts = await verifyPublishedReleaseArtifacts(/* @__PURE__ */ new Map([[pkg.name, version]]));
+  const previousStagingHead = remoteHeadCommit(pkg.dir, STAGING_BRANCH);
+  if (previousStagingHead !== commitSha) {
+    runGit([
+      "push",
+      `--force-with-lease=refs/heads/${STAGING_BRANCH}:${previousStagingHead}`,
+      "origin",
+      `${commitSha}:refs/heads/${STAGING_BRANCH}`
+    ], { cwd: pkg.dir });
+  }
+  const previousProductionHead = remoteHeadCommit(pkg.dir, PRODUCTION_BRANCH);
+  if (previousProductionHead !== commitSha) {
+    promoteCommitToProductionBranch(pkg.dir, commitSha);
+  }
+  if (currentBranch(pkg.dir) !== STAGING_BRANCH) {
+    checkoutBranch(pkg.dir, STAGING_BRANCH);
+  }
+  if (headCommit(pkg.dir) !== commitSha) {
+    runGit(["reset", "--hard", commitSha], { cwd: pkg.dir });
+  }
+  const observedStagingHead = remoteHeadCommit(pkg.dir, STAGING_BRANCH);
+  const observedProductionHead = remoteHeadCommit(pkg.dir, PRODUCTION_BRANCH);
+  if (headCommit(pkg.dir) !== commitSha || observedStagingHead !== commitSha || observedProductionHead !== commitSha) {
+    throw new Error(`Published release adoption failed for ${pkg.name}@${version}; local=${headCommit(pkg.dir)}, staging=${observedStagingHead}, main=${observedProductionHead}, expected=${commitSha}.`);
+  }
+  return {
+    name: pkg.name,
+    version,
+    commit: { commitSha, status: "adopted-published-tag" },
+    tag: { tagName: version, local: "existing", remote: "existing" },
+    branches: {
+      staging: previousStagingHead === commitSha ? "existing" : "restored",
+      production: previousProductionHead === commitSha ? "existing" : "restored"
+    },
+    publishedArtifacts
+  };
+}
 function promoteCommitToProductionBranch(repoDir, commitSha) {
   const expectedBefore = remoteBranchExists(repoDir, PRODUCTION_BRANCH) ? remoteHeadCommit(repoDir, PRODUCTION_BRANCH) : null;
   const lease = expectedBefore ? `--force-with-lease=refs/heads/${PRODUCTION_BRANCH}:${expectedBefore}` : "--force-with-lease";
@@ -1797,7 +1895,32 @@ function gateForSavedRootReport(report, branch, scope) {
 }
 function findAutoResumableTaskRun(root, command, branch) {
   if (!branch) return null;
-  return listInterruptedWorkflowRuns(root).find((journal) => journal.command === command && journal.resumable && journal.session.branchName === branch) ?? null;
+  const currentHeads = Object.fromEntries([
+    ["@treeseed/market", runGit(["rev-parse", "HEAD"], { cwd: repoRoot(root), capture: true }).trim()],
+    ...checkedOutWorkspacePackageRepos(root).map((repo) => [
+      repo.name,
+      runGit(["rev-parse", "HEAD"], { cwd: repo.dir, capture: true }).trim()
+    ])
+  ]);
+  return listInterruptedWorkflowRuns(root).find((journal) => {
+    if (journal.command !== command || !journal.resumable || journal.session.branchName !== branch) {
+      return false;
+    }
+    const classification = classifyWorkflowRunJournal(journal, {
+      currentBranch: branch,
+      currentHeads
+    });
+    if (classification.state === "resumable") {
+      return true;
+    }
+    if (classification.state === "stale") {
+      archiveWorkflowRun(root, journal.runId, {
+        ...classification,
+        reasons: [`${command} implicit resume skipped stale failed run`, ...classification.reasons]
+      });
+    }
+    return false;
+  }) ?? null;
 }
 function rejectImplicitWorkflowResume(operation, journal) {
   if (!journal) return;
@@ -1980,7 +2103,8 @@ function findAutoResumableReleaseRun(root, branch, rootRepo, packageReports, opt
     }
     const classification = classifyWorkflowRunJournal(journal, {
       currentBranch: branch,
-      currentHeads
+      currentHeads,
+      acceptedReleaseHeads: acceptedPublishedReleaseHeads(root, journal, currentHeads)
     });
     if (classification.state !== "resumable") {
       if (options.archiveStale && classification.state === "stale") {
@@ -2002,6 +2126,45 @@ function findAutoResumableReleaseRun(root, branch, rootRepo, packageReports, opt
     return releasePlan ? releasePlanMatchesCurrentHeads(releasePlan, rootRepo, packageReports) : true;
   }) ?? null;
 }
+function acceptedPublishedReleaseHeads(root, journal, currentHeads) {
+  if (journal.command !== "release") return {};
+  const plan = stringRecord(journal.steps.find((step) => step.id === "release-plan")?.data);
+  const plannedVersions = stringRecord(plan?.plannedVersions);
+  if (!plannedVersions) return {};
+  const repos = new Map(checkedOutWorkspacePackageRepos(root).map((repo) => [repo.name, repo.dir]));
+  const accepted = {};
+  for (const [name, versionValue] of Object.entries(plannedVersions)) {
+    if (name === "@treeseed/market" || typeof versionValue !== "string") continue;
+    const repoDir = repos.get(name);
+    const currentHead = currentHeads[name];
+    if (!repoDir || !currentHead) continue;
+    let manifestVersion = null;
+    try {
+      manifestVersion = JSON.parse(readFileSync(resolve(repoDir, "package.json"), "utf8")).version ?? null;
+    } catch {
+      continue;
+    }
+    const tagHead = tagCommitSha(repoDir, versionValue);
+    const remoteTagHead = remoteTagCommit(repoDir, versionValue);
+    const productionHead = remoteHeadCommit(repoDir, PRODUCTION_BRANCH);
+    const stagingHead = remoteHeadCommit(repoDir, STAGING_BRANCH);
+    const exactPublishedHead = tagHead === currentHead && productionHead === currentHead && stagingHead === currentHead;
+    const boundedInterruptedRetry = tagHead.length > 0 && remoteTagHead === tagHead && !hasMeaningfulChanges(repoDir) && [productionHead, stagingHead].every((head) => head === currentHead || head === tagHead);
+    if (manifestVersion !== versionValue || !exactPublishedHead && !boundedInterruptedRetry) {
+      if (process.env.TREESEED_RECONCILE_TRACE === "1") {
+        process.stderr.write(`[release][resume-adoption] package=${name} accepted=false manifest=${manifestVersion === versionValue} tag=${tagHead === currentHead} remoteTag=${remoteTagHead === tagHead} main=${productionHead === currentHead} staging=${stagingHead === currentHead} bounded=${boundedInterruptedRetry}
+`);
+      }
+      continue;
+    }
+    accepted[name] = currentHead;
+    if (process.env.TREESEED_RECONCILE_TRACE === "1") {
+      process.stderr.write(`[release][resume-adoption] package=${name} accepted=true
+`);
+    }
+  }
+  return accepted;
+}
 async function executeJournalStep(root, runId, stepId, action, options = {}) {
   const current = readWorkflowRunJournal(root, runId);
   const step = current?.steps.find((entry) => entry.id === stepId) ?? null;
@@ -2011,17 +2174,48 @@ async function executeJournalStep(root, runId, stepId, action, options = {}) {
   if (step.status === "completed" && !options.rerunCompleted) {
     return step.data ?? null;
   }
-  const data = await Promise.resolve(action());
+  const startedAt = /* @__PURE__ */ new Date();
+  const retryCount = Number(step.retryCount ?? 0) + (step.startedAt ? 1 : 0);
+  updateWorkflowRunJournal(root, runId, (journal) => ({
+    ...journal,
+    steps: journal.steps.map((entry) => entry.id === stepId ? { ...entry, startedAt: startedAt.toISOString(), retryCount, lastFailure: null } : entry)
+  }));
+  refreshWorkflowLock(root, runId);
+  const lockHeartbeat = setInterval(() => refreshWorkflowLock(root, runId), 15e3);
+  lockHeartbeat.unref();
+  process.stderr.write(`[workflow][step] start ${stepId} attempt=${retryCount + 1}
+`);
+  let data;
+  try {
+    data = await Promise.resolve(action());
+  } catch (error) {
+    clearInterval(lockHeartbeat);
+    const elapsedMs2 = Date.now() - startedAt.getTime();
+    const message = error instanceof Error ? error.message : String(error);
+    updateWorkflowRunJournal(root, runId, (journal) => ({
+      ...journal,
+      steps: journal.steps.map((entry) => entry.id === stepId ? { ...entry, elapsedMs: elapsedMs2, lastFailure: message } : entry)
+    }));
+    process.stderr.write(`[workflow][step] fail ${stepId} elapsed=${Math.ceil(elapsedMs2 / 1e3)}s retries=${retryCount}
+`);
+    throw error;
+  }
+  clearInterval(lockHeartbeat);
+  const elapsedMs = Date.now() - startedAt.getTime();
   updateWorkflowRunJournal(root, runId, (journal) => ({
     ...journal,
     steps: journal.steps.map((entry) => entry.id === stepId ? {
       ...entry,
       status: "completed",
       completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      elapsedMs,
+      lastFailure: null,
       data: data ?? null
     } : entry)
   }));
   refreshWorkflowLock(root, runId);
+  process.stderr.write(`[workflow][step] complete ${stepId} elapsed=${Math.ceil(elapsedMs / 1e3)}s retries=${retryCount}
+`);
   return data;
 }
 function skipJournalStep(root, runId, stepId, data = null) {
@@ -2185,7 +2379,7 @@ function productionPackageDeployGates(root, versions) {
     })];
   });
 }
-function prepareAdapterReleaseMetadata(root, pkg, version) {
+async function prepareAdapterReleaseMetadata(root, pkg, version) {
   const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === pkg.name || entry.name === pkg.name);
   if (adapter?.kind === "beam-elixir-rust" && existsSync(resolve(pkg.dir, "scripts", "bump-release-version.ts"))) {
     const tsx = resolve(root, "node_modules/.bin/tsx");
@@ -2199,7 +2393,7 @@ function prepareAdapterReleaseMetadata(root, pkg, version) {
     return {
       status: "npm-install",
       adapter: adapter?.id ?? pkg.name,
-      ...runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
+      ...await runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
     };
   }
   return { status: "skipped", adapter: adapter?.id ?? pkg.name, reason: "no package metadata updater" };
@@ -2237,42 +2431,96 @@ function npmCommandForWorkflowSpawn(args) {
     ]
   };
 }
-function runReleaseNpmInstall(repoDir, options = {}) {
-  if (shouldSkipReleaseInstall()) {
-    return { status: "skipped", reason: "disabled" };
+function lockfileRootMatchesManifest(repoDir) {
+  try {
+    const manifest = JSON.parse(readFileSync(resolve(repoDir, "package.json"), "utf8"));
+    const lockfile = JSON.parse(readFileSync(resolve(repoDir, "package-lock.json"), "utf8"));
+    const root = lockfile.packages?.[""];
+    if (!root || root.version !== manifest.version) return false;
+    for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+      const expected = manifest[field] ?? {};
+      const observed = root[field] ?? {};
+      if (JSON.stringify(expected) !== JSON.stringify(observed)) return false;
+    }
+    return true;
+  } catch {
+    return false;
   }
-  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
-  const spawnCommand = npmCommandForWorkflowSpawn(args);
-  let lastDetail = "";
-  for (let attempt = 1; attempt <= 10; attempt += 1) {
-    const result = spawnSync(spawnCommand.command, spawnCommand.args, {
+}
+function waitForReleaseInstall(command, args, repoDir, attempt) {
+  return new Promise((resolvePromise) => {
+    const startedAt = Date.now();
+    let settled = false;
+    const child = spawn(command, args, {
       cwd: repoDir,
       env: {
         ...process.env,
         npm_config_audit: "false",
-        npm_config_fetch_retries: "4",
+        npm_config_fetch_retries: "2",
         npm_config_fund: "false",
-        npm_config_foreground_scripts: "true",
+        npm_config_foreground_scripts: "false",
         npm_config_loglevel: "warn",
         npm_config_maxsockets: "4",
-        npm_config_prefer_online: "true",
+        npm_config_prefer_offline: "true",
         npm_config_progress: "false"
       },
-      stdio: "pipe",
-      encoding: "utf8"
+      stdio: ["ignore", "pipe", "pipe"]
     });
+    const output = [];
+    child.stdout?.on("data", (chunk) => output.push(Buffer.from(chunk)));
+    child.stderr?.on("data", (chunk) => output.push(Buffer.from(chunk)));
+    const heartbeat = setInterval(() => {
+      process.stderr.write(`[release][restore] repository=${repoDir} phase=package-lock attempt=${attempt} elapsed=${Math.ceil((Date.now() - startedAt) / 1e3)}s
+`);
+    }, 15e3);
+    child.once("close", (status) => {
+      if (settled) return;
+      settled = true;
+      clearInterval(heartbeat);
+      resolvePromise({ status, detail: Buffer.concat(output).toString("utf8").trim() });
+    });
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearInterval(heartbeat);
+      output.push(Buffer.from(error.message));
+      resolvePromise({ status: null, detail: Buffer.concat(output).toString("utf8").trim() });
+    });
+  });
+}
+async function runReleaseNpmInstall(repoDir, options = {}) {
+  if (shouldSkipReleaseInstall()) {
+    return { status: "skipped", reason: "disabled" };
+  }
+  if (repoDir === options.workspaceRoot && lockfileRootMatchesManifest(repoDir)) {
+    return { status: "skipped", reason: "root-lockfile-already-matches", attempts: 0 };
+  }
+  const baseArgs = ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
+  const propagationDelaysMs = [15e3, 3e4, 6e4, 12e4, 18e4];
+  const startedAt = Date.now();
+  let lastDetail = "";
+  for (let attempt = 1; attempt <= propagationDelaysMs.length + 1; attempt += 1) {
+    const args = [...baseArgs, attempt === 1 ? "--prefer-offline" : "--prefer-online"];
+    const spawnCommand = npmCommandForWorkflowSpawn(args);
+    process.stderr.write(`[release][restore] repository=${repoDir} phase=package-lock attempt=${attempt} elapsed=${Math.ceil((Date.now() - startedAt) / 1e3)}s
+`);
+    const result = await waitForReleaseInstall(spawnCommand.command, spawnCommand.args, repoDir, attempt);
     if (result.status === 0) {
       return { status: "completed", reason: null, attempts: attempt };
     }
-    lastDetail = [
-      result.error?.message,
-      result.stderr?.trim(),
-      result.stdout?.trim()
-    ].filter(Boolean).join("\n");
-    if (!/No matching version found|notarget|ETARGET|E404/u.test(lastDetail) || attempt === 10) break;
-    spawnSync("sleep", ["30"], { stdio: "ignore" });
+    lastDetail = result.detail;
+    const propagationDelayMs = propagationDelaysMs[attempt - 1];
+    if (!/No matching version found|notarget|ETARGET|E404/u.test(lastDetail) || propagationDelayMs == null) break;
+    let remainingMs = propagationDelayMs;
+    while (remainingMs > 0) {
+      process.stderr.write(`[release][restore] repository=${repoDir} phase=registry-propagation nextAttempt=${attempt + 1} remaining=${Math.ceil(remainingMs / 1e3)}s elapsed=${Math.ceil((Date.now() - startedAt) / 1e3)}s
+`);
+      const sliceMs = Math.min(15e3, remainingMs);
+      await new Promise((resolvePromise) => setTimeout(resolvePromise, sliceMs));
+      remainingMs -= sliceMs;
+    }
   }
-  throw new Error(lastDetail || `npm ${args.join(" ")} failed`);
+  throw new Error(lastDetail || `npm ${baseArgs.join(" ")} failed`);
 }
 function pathIsWithin(parent, candidate) {
   const path = relative(parent, candidate);
@@ -4543,7 +4791,7 @@ async function workflowSave(helpers, input) {
       const recursiveWorkspace = session.mode === "recursive-workspace";
       const mode = session.mode;
       const executionMode = normalizeExecutionMode(input);
-      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? null;
+      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? input.resumeRunId ?? null;
       const autoResumeRun = executionMode === "execute" && !explicitResumeRunId ? findAutoResumableSaveRun(root, branch) : null;
       rejectImplicitWorkflowResume("save", autoResumeRun);
       const planAutoResumeRun = null;
@@ -4708,7 +4956,10 @@ async function workflowSave(helpers, input) {
             resumable: true
           }] : []
         ],
-        autoResumeRun ? {
+        explicitResumeRunId ? {
+          ...helpers.context,
+          workflow: { ...helpers.context.workflow ?? {}, resumeRunId: explicitResumeRunId }
+        } : autoResumeRun ? {
           ...helpers.context,
           workflow: {
             ...helpers.context.workflow ?? {},
@@ -4994,7 +5245,7 @@ async function workflowClose(helpers, input) {
       const root = workspaceRoot(tenantRoot);
       const executionMode = normalizeExecutionMode(input);
       const session = resolveTreeseedWorkflowSession(root);
-      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? null;
+      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? input.resumeRunId ?? null;
       const autoResumeRun = executionMode === "execute" && !explicitResumeRunId ? findAutoResumableTaskRun(root, "close", session.branchName) : null;
       rejectImplicitWorkflowResume("close", autoResumeRun);
       const planAutoResumeRun = null;
@@ -5081,7 +5332,13 @@ async function workflowClose(helpers, input) {
           { id: "workspace-link", description: "Restore local workspace links", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           ...isManagedWorkflowWorktree(root) ? [{ id: "worktree-cleanup", description: "Remove managed workflow worktree", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: false }] : []
         ],
-        autoResumeRun ? {
+        explicitResumeRunId ? {
+          ...helpers.context,
+          workflow: {
+            ...helpers.context.workflow ?? {},
+            resumeRunId: explicitResumeRunId
+          }
+        } : autoResumeRun ? {
           ...helpers.context,
           workflow: {
             ...helpers.context.workflow ?? {},
@@ -5192,6 +5449,7 @@ async function workflowClose(helpers, input) {
 }
 function stagingCandidateWorkflowGates(root, manifest) {
   const gates = [];
+  const adapters = discoverTreeseedPackageAdapters(root);
   const add = (name, repoPath, headSha, workflow, deploy = false) => {
     if (!workflowFileExists(repoPath, workflow)) return;
     const gate = { name, repoPath, workflow, branch: STAGING_BRANCH, headSha };
@@ -5199,10 +5457,11 @@ function stagingCandidateWorkflowGates(root, manifest) {
   };
   for (const pkg of manifest.packages) {
     const repoPath = resolve(root, pkg.path);
+    const adapter = adapters.find((candidate) => candidate.id === pkg.name || candidate.name === pkg.name);
     if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit) {
       add(pkg.name, repoPath, pkg.commit, "verify.yml");
     }
-    if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit && existsSync(resolve(repoPath, "treeseed.site.yaml"))) {
+    if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit && adapter?.capabilities.deploy === true && existsSync(resolve(repoPath, "treeseed.site.yaml"))) {
       add(pkg.name, repoPath, pkg.commit, "deploy.yml", true);
     }
   }
@@ -5476,7 +5735,7 @@ async function workflowStage(helpers, input) {
       const root = workspaceRoot(tenantRoot);
       const executionMode = normalizeExecutionMode(input);
       const session = resolveTreeseedWorkflowSession(root);
-      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? null;
+      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? input.resumeRunId ?? null;
       const rawAutoResumeRun = executionMode === "execute" && !explicitResumeRunId ? findAutoResumableTaskRun(root, "stage", session.branchName) : null;
       rejectImplicitWorkflowResume("stage", rawAutoResumeRun);
       const autoResumeRun = rawAutoResumeRun?.steps.some((step) => step.id === "preflight") ? rawAutoResumeRun : null;
@@ -5891,7 +6150,9 @@ async function workflowRelease(helpers, input) {
       const rootRepo = createWorkspaceRootRepoReport(root);
       const packageReports = createWorkspacePackageReports(root);
       const releaseHelperRepos = checkedOutReleaseHelperRepos(root);
-      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? null;
+      const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? input.resumeRunId ?? null;
+      const explicitResumeJournal = explicitResumeRunId ? readWorkflowRunJournal(root, explicitResumeRunId) : null;
+      const recordedReleasePlan = explicitResumeJournal?.command === "release" ? stringRecord(explicitResumeJournal.steps.find((step) => step.id === "release-plan")?.data) : null;
       const autoResumeRun = executionMode === "execute" && !explicitResumeRunId && input.fresh !== true ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports, { archiveStale: false }) : null;
       const planAutoResumeRun = executionMode === "plan" && input.fresh !== true ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports) : null;
       const effectiveInput = autoResumeRun ? {
@@ -5902,7 +6163,7 @@ async function workflowRelease(helpers, input) {
       const level = effectiveInput.bump ?? "patch";
       const ciMode = normalizeCiMode(effectiveInput.ciMode, "release");
       const packageSelection = session.packageSelection;
-      const plannedRelease = buildReleasePlanSnapshot({
+      const plannedRelease = recordedReleasePlan ?? buildReleasePlanSnapshot({
         root,
         mode: session.mode,
         level,
@@ -5914,12 +6175,14 @@ async function workflowRelease(helpers, input) {
         blockers: []
       });
       const selectedPackageNames = releasePlanPackageSelection(plannedRelease.packageSelection).selected;
-      const blockers = collectReleasePlanBlockers(session, session.mode, selectedPackageNames, {
+      const blockers = explicitResumeJournal ? [] : collectReleasePlanBlockers(session, session.mode, selectedPackageNames, {
         level,
         repairVersionLine: effectiveInput.repairVersionLine === true
       });
-      blockers.push(...collectReleaseHelperRepoBlockers(root));
-      blockers.push(...stageCandidateAttestationBlockers(root));
+      if (!explicitResumeJournal) {
+        blockers.push(...collectReleaseHelperRepoBlockers(root));
+        blockers.push(...stageCandidateAttestationBlockers(root));
+      }
       const selectedVersions = releasePlanVersionMap(plannedRelease.plannedVersions);
       const releaseImageVersions = productionReleaseImageRefVersions(root, selectedVersions);
       const releaseImageRefs = productionReleaseImageRefEnv(releaseImageVersions);
@@ -6018,13 +6281,20 @@ ${blockers.join("\n")}`, {
           },
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "verify-api-environment-isolation", description: "Verify production images and staging Git sources remained isolated", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "persist-production-image-refs", description: "Persist released production image refs and verify deployment readiness", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "workspace-link", description: "Restore local workspace links after release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }
         ],
-        autoResumeRun ? {
+        explicitResumeRunId ? {
+          ...helpers.context,
+          workflow: {
+            ...helpers.context.workflow ?? {},
+            resumeRunId: explicitResumeRunId
+          }
+        } : autoResumeRun ? {
           ...helpers.context,
           workflow: {
             ...helpers.context.workflow ?? {},
@@ -6083,57 +6353,113 @@ ${rendered}`);
         });
         const packageReleases = [];
         const packageRepoByName = new Map(checkedOutWorkspacePackageRepos(root).map((entry) => [entry.name, entry]));
-        for (const packageName of selectedPackageNames) {
+        const pendingPackageReleases = new Set(selectedPackageNames.filter((name) => selectedVersions.has(name) && packageRepoByName.has(name)));
+        const completedPackageReleases = /* @__PURE__ */ new Set();
+        const packageReleaseResults = /* @__PURE__ */ new Map();
+        const selectedPackageDependencies = new Map([...pendingPackageReleases].map((packageName) => {
           const pkg = packageRepoByName.get(packageName);
-          if (!pkg) continue;
-          const version = selectedVersions.get(pkg.name);
-          if (!version) continue;
-          const packageRelease = await executeJournalStep(root, workflowRun.runId, `release-${pkg.name}`, async () => {
-            const metadata = prepareAdapterReleaseMetadata(root, pkg, version);
-            const changelog = updateReleaseChangelog(pkg.dir, {
-              version,
-              sourceRef: `origin/${PRODUCTION_BRANCH}`,
-              targetRef: "HEAD"
-            });
-            const commit = commitAllIfChanged(pkg.dir, releaseAdminMessage({
-              subject: `release: ${pkg.name} ${version}`,
-              version,
-              tagName: version,
-              sourceRef: STAGING_BRANCH,
-              targetRef: PRODUCTION_BRANCH,
-              changelog
-            }));
-            pushBranch(pkg.dir, STAGING_BRANCH);
-            const promotion = promoteCommitToProductionBranch(pkg.dir, commit.commitSha);
-            const tag = ensureReleaseTag(pkg.dir, version, commit.commitSha, `release: ${pkg.name} ${version}`);
-            const publishGate = {
-              name: pkg.name,
-              repoPath: pkg.dir,
-              workflow: releaseWorkflowForPackage(root, pkg.name),
-              branch: version,
-              headSha: commit.commitSha
-            };
-            const publishWait2 = await waitForWorkflowGates("release", [publishGate], ciMode, {
-              root,
-              runId: workflowRun.runId,
-              onProgress: (line, stream) => helpers.write(line, stream)
+          if (!pkg) return [packageName, []];
+          const manifest = readJsonFile(resolve(pkg.dir, "package.json"));
+          if (!manifest) {
+            throw new Error(`Release package manifest is missing or invalid for ${packageName}.`);
+          }
+          const dependencyNames = /* @__PURE__ */ new Set([
+            ...Object.keys(manifest.dependencies ?? {}),
+            ...Object.keys(manifest.optionalDependencies ?? {}),
+            ...Object.keys(manifest.peerDependencies ?? {})
+          ]);
+          const dependencies = [...dependencyNames].filter((name) => pendingPackageReleases.has(name));
+          if (packageName !== "@treeseed/sdk" && pendingPackageReleases.has("@treeseed/sdk") && !dependencies.includes("@treeseed/sdk")) {
+            dependencies.push("@treeseed/sdk");
+          }
+          if (packageName === "@treeseed/api" && pendingPackageReleases.has("@treeseed/cli") && !dependencies.includes("@treeseed/cli")) {
+            dependencies.push("@treeseed/cli");
+          }
+          return [packageName, dependencies];
+        }));
+        while (pendingPackageReleases.size > 0) {
+          const eligible = selectedPackageNames.filter((packageName) => pendingPackageReleases.has(packageName) && (selectedPackageDependencies.get(packageName) ?? []).every((dependency) => completedPackageReleases.has(dependency)));
+          if (eligible.length === 0) {
+            throw new Error(`Release package dependency graph is cyclic or unresolved: ${[...pendingPackageReleases].join(", ")}.`);
+          }
+          const batch = eligible.slice(0, 2);
+          helpers.write(`[release][packages] starting batch ${batch.join(", ")} (concurrency=${batch.length}/2).`, "stderr");
+          const results = await Promise.all(batch.map(async (packageName) => {
+            const pkg = packageRepoByName.get(packageName);
+            const version = selectedVersions.get(pkg.name);
+            const packageRelease = await executeJournalStep(root, workflowRun.runId, `release-${pkg.name}`, async () => {
+              const adopted = await adoptPublishedPackageRelease(pkg, version);
+              if (adopted) {
+                helpers.write(`[release][packages] adopted verified published release ${pkg.name}@${version}.`, "stderr");
+                if (pkg.name === "@treeseed/api") {
+                  const publishWait3 = await waitForWorkflowGates("release", [{
+                    name: pkg.name,
+                    repoPath: pkg.dir,
+                    workflow: releaseWorkflowForPackage(root, pkg.name),
+                    branch: version,
+                    headSha: String(stringRecord(adopted.commit)?.commitSha ?? tagCommitSha(pkg.dir, version))
+                  }], ciMode, {
+                    root,
+                    runId: workflowRun.runId,
+                    onProgress: (line, stream) => helpers.write(line, stream),
+                    retryFailedOnce: true
+                  });
+                  return { ...adopted, publishWait: publishWait3 };
+                }
+                return adopted;
+              }
+              const metadata = await prepareAdapterReleaseMetadata(root, pkg, version);
+              const changelog = updateReleaseChangelog(pkg.dir, {
+                version,
+                sourceRef: `origin/${PRODUCTION_BRANCH}`,
+                targetRef: "HEAD"
+              });
+              const commit = commitAllIfChanged(pkg.dir, releaseAdminMessage({
+                subject: `release: ${pkg.name} ${version}`,
+                version,
+                tagName: version,
+                sourceRef: STAGING_BRANCH,
+                targetRef: PRODUCTION_BRANCH,
+                changelog
+              }));
+              pushBranch(pkg.dir, STAGING_BRANCH);
+              const promotion = promoteCommitToProductionBranch(pkg.dir, commit.commitSha);
+              const tag = ensureReleaseTag(pkg.dir, version, commit.commitSha, `release: ${pkg.name} ${version}`);
+              const publishGate = {
+                name: pkg.name,
+                repoPath: pkg.dir,
+                workflow: releaseWorkflowForPackage(root, pkg.name),
+                branch: version,
+                headSha: commit.commitSha
+              };
+              const publishWait2 = await waitForWorkflowGates("release", [publishGate], ciMode, {
+                root,
+                runId: workflowRun.runId,
+                onProgress: (line, stream) => helpers.write(line, stream)
+              });
+              const publishedArtifacts2 = await verifyPublishedReleaseArtifacts(/* @__PURE__ */ new Map([[pkg.name, version]]));
+              return {
+                name: pkg.name,
+                path: relative(root, pkg.dir),
+                version,
+                changelog,
+                metadata,
+                commit,
+                promotion,
+                tag,
+                publishWait: publishWait2,
+                publishedArtifacts: publishedArtifacts2
+              };
             });
-            const publishedArtifacts2 = await verifyPublishedReleaseArtifacts(/* @__PURE__ */ new Map([[pkg.name, version]]));
-            return {
-              name: pkg.name,
-              path: relative(root, pkg.dir),
-              version,
-              changelog,
-              metadata,
-              commit,
-              promotion,
-              tag,
-              publishWait: publishWait2,
-              publishedArtifacts: publishedArtifacts2
-            };
-          });
-          packageReleases.push(packageRelease);
+            return [packageName, packageRelease];
+          }));
+          for (const [packageName, packageRelease] of results) {
+            pendingPackageReleases.delete(packageName);
+            completedPackageReleases.add(packageName);
+            packageReleaseResults.set(packageName, packageRelease);
+          }
         }
+        packageReleases.push(...selectedPackageNames.map((name) => packageReleaseResults.get(name)).filter((entry) => Boolean(entry)));
         const managedHelperReleases = await executeJournalStep(root, workflowRun.runId, "release-helper-repos", () => {
           const releases = releaseHelperRepos.map((repo) => releaseHelperRepoToProduction(repo));
           syncAllCheckedOutReleaseHelperRepos(root, STAGING_BRANCH);
@@ -6151,6 +6477,10 @@ ${rendered}`);
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates }));
         });
+        const apiEnvironmentIsolation = effectiveInput.verifyDeployedResources === true ? await executeJournalStep(root, workflowRun.runId, "verify-api-environment-isolation", () => verifyReleaseApiEnvironmentIsolation(root, helpers, releaseImageRefs)) : (skipJournalStep(root, workflowRun.runId, "verify-api-environment-isolation", {
+          status: "skipped",
+          reason: "--verify-deployed-resources was not requested"
+        }), { status: "skipped", reason: "--verify-deployed-resources was not requested" });
         const productionImageRefs = await executeJournalStep(root, workflowRun.runId, "persist-production-image-refs", async () => {
           const persisted = persistProductionReleaseImageRefs(root, releaseImageRefs);
           if (helpers.context.env) {
@@ -6171,8 +6501,8 @@ ${failures.join("\n")}`, {
           }
           return { persisted, readiness };
         });
-        const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
-          const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
+        const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", async () => {
+          const rootInstall = await runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
             version: plannedRelease.rootVersion,
             sourceRef: `origin/${PRODUCTION_BRANCH}`,
@@ -6244,6 +6574,7 @@ ${failures.join("\n")}`, {
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionPackageDeployWorkflows,
+          apiEnvironmentIsolation,
           productionImageRefs,
           backMerge,
           workspaceLinks,
@@ -6309,7 +6640,8 @@ async function workflowResume(helpers, input) {
       );
       const classification = classifyWorkflowRunJournal(journal, {
         currentBranch: session.branchName,
-        currentHeads
+        currentHeads,
+        acceptedReleaseHeads: acceptedPublishedReleaseHeads(root, journal, currentHeads)
       });
       if (classification.state !== "resumable") {
         workflowError("resume", "resume_unavailable", `Run ${runId} is ${classification.state} and is not safe to resume.`, {
@@ -6339,7 +6671,10 @@ async function workflowResume(helpers, input) {
         case "stage":
           return workflowStage(resumedHelpers, journal.input);
         case "release":
-          return workflowRelease(resumedHelpers, journal.input);
+          return workflowRelease(resumedHelpers, {
+            ...journal.input,
+            resumeRunId: runId
+          });
         case "destroy":
           return workflowDestroy(resumedHelpers, journal.input);
         default:
@@ -6397,17 +6732,21 @@ async function workflowRecover(helpers, input = {}) {
         return null;
       }).filter((entry) => entry !== null);
       const journals = listWorkflowRunJournals(root);
+      const actionableJournals = journals.filter((journal) => journal.status !== "completed" && !journal.classification?.archivedAt);
       const session = resolveTreeseedWorkflowSession(root);
       const currentHeads = Object.fromEntries(
         [createWorkspaceRootRepoReport(root), ...createWorkspacePackageReports(root)].map((report) => [report.name, report.commitSha ?? null])
       );
-      const classifiedRuns = classifyWorkflowRunJournals(root, {
-        currentBranch: session.branchName,
-        currentHeads
-      });
+      const classifiedRuns = actionableJournals.map((journal) => ({
+        journal,
+        classification: classifyWorkflowRunJournal(journal, {
+          currentBranch: session.branchName,
+          currentHeads
+        })
+      }));
       const markedObsoleteRun = input.obsoleteRunId ? (() => {
-        const entry = classifiedRuns.find((candidate) => candidate.journal.runId === input.obsoleteRunId);
-        if (!entry) {
+        const journal = journals.find((candidate) => candidate.runId === input.obsoleteRunId);
+        if (!journal) {
           workflowError("recover", "validation_failed", `Treeseed recover could not find workflow run ${input.obsoleteRunId}.`);
         }
         const reason = input.obsoleteReason?.trim() || "marked obsolete by operator";
@@ -6416,17 +6755,14 @@ async function workflowRecover(helpers, input = {}) {
           reasons: [reason],
           classifiedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        archiveWorkflowRun(root, entry.journal.runId, classification);
+        archiveWorkflowRun(root, journal.runId, classification);
         return {
-          runId: entry.journal.runId,
-          command: entry.journal.command,
+          runId: journal.runId,
+          command: journal.command,
           reason
         };
       })() : null;
-      const effectiveClassifiedRuns = markedObsoleteRun ? classifyWorkflowRunJournals(root, {
-        currentBranch: session.branchName,
-        currentHeads
-      }) : classifiedRuns;
+      const effectiveClassifiedRuns = markedObsoleteRun ? classifiedRuns.filter((entry) => entry.journal.runId !== markedObsoleteRun.runId) : classifiedRuns;
       const interruptedRuns = effectiveClassifiedRuns.filter((entry) => entry.classification.state === "resumable").map(({ journal }) => ({
         runId: journal.runId,
         command: journal.command,