@wildo-ai/platform-core-shared 1.1.10 → 1.1.12

package/dist/esm/workbench/workbench-creation-plane.custom.shared.schemas.js

@@ -1,5 +1,5 @@
-import { ApplicationInterviewDepth, MetaWorkflow_ClarificationAction, MetaWorkflow_EvaluationVerdict } from '@wildo-ai/saas-models/meta-workflows';
-import { EngineCapability, HumanDecision_FieldKind, } from '@wildo-ai/saas-models';
+import { ApplicationInterviewDepth, MetaWorkflow_ClarificationAction, MetaWorkflow_ElicitationNonAnswer, MetaWorkflow_EvaluationVerdict } from '@wildo-ai/saas-models/meta-workflows';
+import { AgentWorkShortfallKind, EngineCapability, FlowsActors_Status, HumanDecision_FieldKind, } from '@wildo-ai/saas-models';
 import { z } from 'zod';
 import { initZodDecorators, StringEditMode } from '@wildo-ai/zod-decorators';
 import { WorkbenchSpecificationArtifactConcern } from './workbench-resources.custom.shared.schemas.js';
@@ -53,6 +53,8 @@ export var WorkbenchCreationPlaneBehavior;
     /** The build lane's dispatch history, one row per attempt. */
     WorkbenchCreationPlaneBehavior["BUILD_DISPATCH_PLAN"] = "creation-plane.build-dispatch-plan";
     WorkbenchCreationPlaneBehavior["BUILD_DISPATCHES"] = "creation-plane.build-dispatches";
+    /** Everything the build knows about each task (#2530): its attempts, whose failures they were, what they cost, why it has not landed. */
+    WorkbenchCreationPlaneBehavior["BUILD_TASK_RECORDS"] = "creation-plane.build-task-records";
     /** The playbook runs suspended waiting on a person. */
     WorkbenchCreationPlaneBehavior["PLAYBOOK_RUNS"] = "creation-plane.playbook-runs";
     WorkbenchCreationPlaneBehavior["WAITING_PLAYBOOK_RUNS"] = "creation-plane.waiting-playbook-runs";
@@ -171,18 +173,13 @@ export var WorkbenchBuildPlanTaskStatus;
  */
 export var Workbench_BuildTaskStuckReason;
 (function (Workbench_BuildTaskStuckReason) {
-    /** It already ran, and its declared product is absent even from the working tree: fix the declaration or the work. */
-    Workbench_BuildTaskStuckReason["COMPLETED_UNLANDED"] = "completed_unlanded";
     /**
-     * It already ran, and its declared product IS in the working tree but not committed. Landing means
-     * committed because acceptance is a commit.
+     * It already ran, and its declared product is absent from the working tree: fix the declaration or the work.
      *
-     * Under GUIDED that is the whole story, and the remedy is to review and commit what the run wrote.
-     * Under the autonomy posture the loop has ALREADY tried to commit it (#1534), so reaching this state
-     * means its accept REFUSED a path — carried changes from before the run, edited since, or not this
-     * run's — and the companion's warning names which. The remedy is that refusal's, not a blind commit.
+     * There is no "written, awaiting a commit" reason (#3514): a task lands when its product is in the working tree and
+     * something checked it (#3204), and a commit is a build checkpoint that records, never a condition of landing.
      */
-    Workbench_BuildTaskStuckReason["COMPLETED_AWAITING_COMMIT"] = "completed_awaiting_commit";
+    Workbench_BuildTaskStuckReason["COMPLETED_UNLANDED"] = "completed_unlanded";
     /** Its run suspended on a question nobody has answered; re-dispatching would abandon that session. */
     Workbench_BuildTaskStuckReason["PARKED_AWAITING_ANSWER"] = "parked_awaiting_answer";
     /** It produces a governed document the engine catalog does not define, so no run can author it. */
@@ -200,7 +197,147 @@ export var Workbench_BuildTaskStuckReason;
      * or two agents would build the same task. Nobody's move: it clears when that run settles.
      */
     Workbench_BuildTaskStuckReason["IN_FLIGHT"] = "in_flight";
+    /**
+     * A live run of ANOTHER task may write one of the files this task's declared products are written to (#3204). Two runs
+     * writing one file in the shared worktree interfere: one overwrites the other, and the wave repairs it after the fact
+     * with a re-check or a re-run. So the wave's own selection passes over it for a ready task whose declared products
+     * meet nothing in flight. Only DECLARED products are compared; a shared file no product names (a module barrel, a
+     * registry) is still left to the after-the-fact repair. Nobody's move: it clears when that run settles.
+     */
+    Workbench_BuildTaskStuckReason["CONTENDED"] = "contended";
+    /**
+     * Its latest run failed its checks while other runs of the wave were writing beside it, so the failure may be theirs
+     * (#3204): a sibling's half-written file turned a shared typecheck red, or left a package's compiled output stale so the
+     * check could not be asked at all. It is not dispatched again in the same wave, where it would meet the same tree: the
+     * wave's end re-runs its checks ALONE, a pass lands it and a failure offers it to the next wave. Measured on reference run
+     * 42621319676: two schema tasks re-dispatched five times in nine minutes, each failing on a sibling's red build, spent their
+     * attempt budget while their checks passed alone. Nobody's move: it clears when the wave ends.
+     */
+    Workbench_BuildTaskStuckReason["AWAITING_ISOLATED_RECHECK"] = "awaiting_isolated_recheck";
+    /**
+     * A generation step whose landing check could not be ANSWERED right now (#3223): a schema-plan check that neither passed
+     * nor reported drift, a design-token block the CLI could not validate, a brand nobody could read. Not "not landed": it
+     * is UNKNOWN, so it is never dispatched — running it would either fail the same way or redo work that may well have
+     * landed (a companion restart re-ran a landed `design-system-brand` step this way). It clears on its own once the check
+     * answers; when it does not, the dispatch refusal names the check and the command that shows why.
+     */
+    Workbench_BuildTaskStuckReason["LANDING_UNKNOWN"] = "landing_unknown";
+    /**
+     * A FOLLOW-UP the host derived from a reported gap (#3227), waiting for the creator's review before it runs: the
+     * autonomy posture (`one-source-of-truth.md` D5) keeps approving a result a person's act, and a follow-up is work the
+     * accepted plan never listed. `wildo build approve <ref>` lets it run; `wildo build close <ref> --declined` closes it.
+     * Never reached under the automatic posture, where follow-ups run as they are derived.
+     */
+    Workbench_BuildTaskStuckReason["FOLLOW_UP_AWAITING_REVIEW"] = "follow_up_awaiting_review";
+    /**
+     * A generation step whose panel refused to seat expert charters older than their inputs (#3244): a build task changed
+     * what they read (the design system, say). Passed over so the rest of the plan proceeds, and offered again once the
+     * staffing step, `top_down.expert-personas`, has derived them again, which the build-dispatch step runs on its own
+     * (reference run 42218788356, where the refusal ended the build lane at 32 of 98 tasks). A charter a person edited is
+     * never derived again: its remedy is the hand edit.
+     */
+    Workbench_BuildTaskStuckReason["STALE_EXPERT_CHARTERS"] = "stale_expert_charters";
 })(Workbench_BuildTaskStuckReason || (Workbench_BuildTaskStuckReason = {}));
+/**
+ * The stuck reasons that only WAIT for a live run to settle (#1528, #3204): progress, never a finding, and proof that a
+ * run is live. One set, so the dispatch's warning and the Home projection cannot disagree about which reasons mean it.
+ */
+export const WORKBENCH_BUILD_TASK_STUCK_REASONS_WAITING_ON_A_LIVE_RUN = new Set([
+    Workbench_BuildTaskStuckReason.IN_FLIGHT,
+    Workbench_BuildTaskStuckReason.CONTENDED,
+]);
+/**
+ * The stuck reasons a RE-ARM releases (#2530): the task is held by its own runs, and the remedy is to fix why and put it
+ * back — `WorkbenchBuildPlanTasks_Operations.REARM` is offered for these and no other.
+ *
+ * - `completed_unlanded`: a completed run holds it through the loop guard, and a re-arm releases that run.
+ * - `attempts_exhausted`: its failed runs hold it through the attempt budget, and a re-arm releases them.
+ *
+ * Left out, each because a re-arm would be the wrong remedy: `parked_awaiting_answer` (a question waits), `in_flight` (a run is
+ * live), `no_document_blueprint` (no run can produce it), `landing_unknown` (nothing holds it but a check that has not
+ * answered yet).
+ */
+export const WORKBENCH_REARMABLE_STUCK_REASONS = [
+    Workbench_BuildTaskStuckReason.COMPLETED_UNLANDED,
+    Workbench_BuildTaskStuckReason.ATTEMPTS_EXHAUSTED,
+];
+/**
+ * Whose failure a failed coding run was (#1581), as the run's output records it.
+ *
+ * TASK runs are counted against the task's attempt budget; HOST runs (the run could not be recorded, or the turn was
+ * taken away: a mid-turn kill, a provider's 529/429, an exhausted quota, an expired login, an operator's cancel) are
+ * forgiven up to a bound. Declared here rather than beside its producer (the companion's coding dispatch) for the reason
+ * `Workbench_BuildTaskStuckReason` gives: the workbench shows it per attempt (#2530), and a browser bundle cannot import
+ * the companion.
+ */
+export var CodingRunFailureAttribution;
+(function (CodingRunFailureAttribution) {
+    /** The task's own failure: its checks went red, or its agent ran and failed at the work. Counted. */
+    CodingRunFailureAttribution["TASK"] = "task";
+    /** The host's: it could not record the run, or the turn was taken away. Forgiven, up to a bound. */
+    CodingRunFailureAttribution["HOST"] = "host";
+})(CodingRunFailureAttribution || (CodingRunFailureAttribution = {}));
+/**
+ * WHY a build task was put back in the queue (#1535) — the one question a later reader of a re-arm asks.
+ *
+ * A re-arm keeps a task's run history and adds one fact to it, on the runs it releases: they no longer hold the task,
+ * and here is why. Declared here rather than beside its producer (the companion's build dispatch) because the workbench
+ * both offers the re-arm (`WorkbenchBuildPlanTasks_Operations.REARM`) and shows each attempt's reason (#2530), and a
+ * browser bundle cannot import the companion.
+ */
+export var BuildTaskRearmReason;
+(function (BuildTaskRearmReason) {
+    /** The landing check was wrong about this task, and has been corrected. */
+    BuildTaskRearmReason["PROBE_CORRECTED"] = "probe-corrected";
+    /** A defect outside the task made its product impossible to produce, and has been fixed. */
+    BuildTaskRearmReason["BLOCKING_DEFECT_FIXED"] = "blocking-defect-fixed";
+    /** Neither of the above: an operator judged the work should run again. The note says why. */
+    BuildTaskRearmReason["OPERATOR_JUDGEMENT"] = "operator-judgement";
+    /**
+     * The ENVIRONMENT failed the runs, not the task (#3236): the network or the machine went away (DNS lost, a connection
+     * cut, a sleep) and the runs the outage took are released. Distinct from `operator-judgement` so a later reader of the
+     * task's history sees that its failed attempts said nothing about the work.
+     */
+    BuildTaskRearmReason["ENVIRONMENT"] = "environment";
+    /**
+     * Set by the BUILD WAVE, never by a person (#2210): the run completed while other runs edited the same tree, and its
+     * declared product is missing from a file one of them also changed, so the loss is theirs rather than the task's. The
+     * wave re-arms the task and re-runs it alone, a bounded number of times (`MAXIMUM_INTERFERENCE_REARMS`).
+     * The run also carries the interference the wave found (`BuildTaskInterference`, companion-side).
+     *
+     * Like every re-arm it also releases the task's FAILED runs not yet re-armed, so the attempt budget starts afresh.
+     * Deliberate: the task did complete, so its earlier failures say nothing about whether the work can be done, and the
+     * interference bound still stops a task that keeps losing its product.
+     */
+    BuildTaskRearmReason["INTERFERED_BY_CONCURRENT_RUN"] = "interfered-by-concurrent-run";
+})(BuildTaskRearmReason || (BuildTaskRearmReason = {}));
+/**
+ * How a build task a PERSON closed is accounted for (`wildo build close`, #3224, #3225, #3227) — the one question a reader
+ * of a closed task asks: what made it done, if anything did. A closure never makes a task's product true; it records that
+ * a person said it is done another way, or that a derived follow-up is not wanted. Declared here rather than beside its
+ * producer (the companion's build dispatch) because the workbench shows it on the task's record, and a browser bundle
+ * cannot import the companion.
+ */
+export var BuildTaskClosureKind;
+(function (BuildTaskClosureKind) {
+    /** Another task of the plan built what this one was for. It counts as landed while that task is landed. */
+    BuildTaskClosureKind["SATISFIED_BY_TASK"] = "satisfied_by_task";
+    /** A commit HEAD contains built it (a person's, a reconciliation's). It counts as landed while the closure is committed. */
+    BuildTaskClosureKind["SATISFIED_BY_COMMIT"] = "satisfied_by_commit";
+    /** A host-derived follow-up the creator declines: the gap it answers is not worked. Follow-ups only. */
+    BuildTaskClosureKind["DECLINED"] = "declined";
+})(BuildTaskClosureKind || (BuildTaskClosureKind = {}));
+/**
+ * The reasons a PERSON may give (`wildo build rearm`, the companion's re-arm route, the workbench's `rearm` operation).
+ * The wave's own reason is left out: it asserts a measurement (a sibling changed the product's file during the run)
+ * that only the wave makes, and an operator choosing it would record a detection that never happened.
+ */
+export const OPERATOR_BUILD_TASK_REARM_REASONS = [
+    BuildTaskRearmReason.PROBE_CORRECTED,
+    BuildTaskRearmReason.BLOCKING_DEFECT_FIXED,
+    BuildTaskRearmReason.OPERATOR_JUDGEMENT,
+    BuildTaskRearmReason.ENVIRONMENT,
+];
 /**
  * How far one BUILD DISPATCH got — the whole of what `GET /build/dispatches` can honestly say.
  *
@@ -229,7 +366,10 @@ export var Workbench_BuildDispatchPhase;
 (function (Workbench_BuildDispatchPhase) {
     /** Selected and handed to its executor; nothing has resolved yet. */
     Workbench_BuildDispatchPhase["SUBMITTED"] = "submitted";
-    /** A coding run was admitted and is running. Its outcome is the durable actor-task row `codingTaskId`. */
+    /**
+     * A coding run was admitted. The phase names the HAND-OFF and stays ADMITTED however the run ends: how
+     * the run stands is `Workbench_BuildDispatch.runStatus`, read off the same execution row (#2523).
+     */
     Workbench_BuildDispatchPhase["ADMITTED"] = "admitted";
     /** A companion generation step ran to completion. */
     Workbench_BuildDispatchPhase["FINISHED"] = "finished";
@@ -315,6 +455,27 @@ export const Workbench_Playbook_Schema = z.object({
      * is for. The default instance is not listed; it is the playbook itself. Absent without a line.
      */
     openInstances: z.array(z.object({ instanceKey: z.string().min(1), purpose: z.string().min(1) })).optional().isSummaryField(),
+    /*
+     * The playbook's DECLARED edges (#2530), each a reference a process map draws. With `outputOwners` (the families it
+     * writes) they make the catalogue a graph: a family feeds the playbooks that read it, which write the families that
+     * feed the next, and a composite admits its children.
+     *
+     * The family fields address the specification-artifact row of that family (its id IS the family); a family no row
+     * holds is a dangling reference, which the edge tolerates. `inputFamilyIds` and `preconditionFamilyIds` stay apart:
+     * a playbook gated on a family waits for it without reading it, and reads families it is not gated on. So does
+     * `conditionFamilyIds` (#2670): a family whose decision decides what the playbook waits for, which it never waits for.
+     */
+    /** The families it reads, from its declared inputs. */
+    inputFamilyIds: z.array(z.string().min(1).isForeignKey()).isSummaryField(),
+    /** The families its preconditions name: an artifact that must exist, be valid, be stale or decide. */
+    preconditionFamilyIds: z.array(z.string().min(1).isForeignKey()).isSummaryField(),
+    /**
+     * The families whose DECISION decides whether one of its preconditions applies: an `artifact_expected` gate's `when`
+     * (#2494). The build decomposition expects a website plan only once the capability composition decided it is NEEDED.
+     */
+    conditionFamilyIds: z.array(z.string().min(1).isForeignKey()).isSummaryField(),
+    /** The playbooks it admits as children when it is a composite, by their row id; empty otherwise. */
+    admittedPlaybookIds: z.array(z.string().min(1).isForeignKey()).isSummaryField(),
     /** When the served board was computed — the cache's honesty field, rendered as "as of". */
     computedAt: z.date().isSummaryField(),
 });
@@ -340,6 +501,24 @@ export const Workbench_BuildPlanTask_Schema = z.object({
     /** Task refs that must land first — the only thing that decides what may run next. */
     prerequisiteTaskRefs: z.array(z.string()).isSummaryField(),
 });
+/**
+ * The BUILD PLAN view's `ref` (#2531): the plan drawn as a graph, a menubar destination beside the domain model. Its
+ * nodes are the build-plan tasks and its edges their prerequisites; a node opens the task's own page.
+ *
+ * It must not contain a dot, for the reason `WORKBENCH_DOMAIN_MODEL_VIEW_REF` records: the label lookup splits the
+ * whole `composite_views.<translationRef>.<key>` path on `.`.
+ */
+export const WORKBENCH_BUILD_PLAN_VIEW_REF = 'build-plan';
+/** The label key the view's title and description hang off: the engine's `app.<ref>` derivation, restated. */
+export const WORKBENCH_BUILD_PLAN_TRANSLATION_REF = `app.${WORKBENCH_BUILD_PLAN_VIEW_REF}`;
+/**
+ * The PLAYBOOK MAP view's `ref` (#2531): the playbook catalog drawn as what unlocks what, a menubar destination beside
+ * the build plan. Its nodes are the playbooks and the families they name; its edges what each writes, reads, waits for
+ * and, as a composite, runs (the playbook row's declared edges, #2530). No dot, for the domain model's reason.
+ */
+export const WORKBENCH_PLAYBOOK_MAP_VIEW_REF = 'playbook-map';
+/** The label key the view's title and description hang off: the engine's `app.<ref>` derivation, restated. */
+export const WORKBENCH_PLAYBOOK_MAP_TRANSLATION_REF = `app.${WORKBENCH_PLAYBOOK_MAP_VIEW_REF}`;
 /**
  * One run's write record — the evidence lane behind every dispatch.
  *
@@ -382,6 +561,17 @@ export const Workbench_RunWriteRecord_Schema = z.object({
     fileCount: z.number().int().isSummaryField(),
     /** The commit the workbench's `accept` made of these writes (#1454, Step 7); NULL until one has. */
     acceptedCommitSha: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * The run FAILED after writing these files (#3265): a half-applied composition the autonomy posture never commits and no
+     * coding door takes. Not a landing, and shown as failed wherever the record is listed, with its accept and revert doors,
+     * because nothing else prompts a person to settle it. `false` on every completed landing.
+     */
+    landingFailed: z.boolean().isSummaryField(),
+    /**
+     * For a failed landing, the two commands that settle it (`wildo creation accept <runId>` / `revert <runId>`), as the
+     * companion names them on every surface that lists the run (#3265). NULL on a completed landing.
+     */
+    failedLandingRemedies: z.object({ accept: z.string().min(1), revert: z.string().min(1) }).isSummaryField().nullable(),
 });
 /** One execution-trace session — the queryable index the board links from. */
 export const Workbench_TraceSession_Schema = z.object({
@@ -457,6 +647,17 @@ export var WorkbenchDossierEntryStanding;
      * Changing it records the creator's own answer in its place.
      */
     WorkbenchDossierEntryStanding["ASSUMED"] = "assumed";
+    /**
+     * The creator said the question does not concern this application, and why (#3437). Answered — nothing is
+     * blocked — and never filled in by a run. Changing it records an answer, or the other non-answer, in its place.
+     */
+    WorkbenchDossierEntryStanding["NOT_APPLICABLE"] = "not-applicable";
+    /**
+     * The creator said the question concerns this application and is not decided yet, and why (#3437). Nothing waits
+     * on it: the step runs and marks what rests on it as owed; a governed document shows the clause as owed. Listed
+     * to revisit, like an assumption.
+     */
+    WorkbenchDossierEntryStanding["DEFERRED"] = "deferred";
 })(WorkbenchDossierEntryStanding || (WorkbenchDossierEntryStanding = {}));
 /**
  * Whether a CHOICE question's options can be offered right now — for a question whose options are
@@ -532,9 +733,12 @@ export const Workbench_GovernanceQuestion_Schema = z.object({
         /** What choosing this option MEANS, in the creator's language rather than the schema's. */
         creatorMeaning: z.string().min(1),
     })).isSummaryField(),
-    /** Answered in the authored facts (from you) or not (still needed) — the same standing vocabulary the interview dossier uses. */
+    /**
+     * Answered in the authored facts (from you), deferred in the dossier (not decided yet, #3437), or neither (still
+     * needed) — the same standing vocabulary the interview dossier uses.
+     */
     standing: z.enum(WorkbenchDossierEntryStanding).systemEnum('WorkbenchDossierEntryStanding').isSummaryField(),
-    /** The answer as a person reads it — the text, the chosen options, or the "does not apply" reason. `null` when still needed. */
+    /** The answer as a person reads it — the text, the chosen options, the "does not apply" reason, or why it was deferred. `null` when still needed. */
     answerSummary: z.string().nullable().isSummaryField(),
     /** When the answer was decided (the declaration's own instant). `null` when still needed. */
     answeredAt: z.date().nullable().isSummaryField(),
@@ -594,6 +798,13 @@ export var WorkbenchBuildPlanTasks_Operations;
      * A non-ready task answers 409 naming what it waits on. Costs a coding run.
      */
     WorkbenchBuildPlanTasks_Operations["DISPATCH_TASK"] = "dispatch_task";
+    /**
+     * Put THIS task back in the queue once the reason it did not land is fixed (#1535, #2530): its completed runs that
+     * still hold it, and its failed runs not yet re-armed, stop counting, each recording why. Offered for a task held by
+     * either guard (`completed_unlanded`, `attempts_exhausted`); a task with no such run answers 409, since there is
+     * nothing to release. Runs nothing itself: the next dispatch offers the task again.
+     */
+    WorkbenchBuildPlanTasks_Operations["REARM"] = "rearm";
     /**
      * ACCEPT what this task's latest completed coding run wrote: commit exactly those paths, from the
      * coding-run write register, in one commit whose message names the task. Paths carrying another
@@ -691,6 +902,13 @@ export const Workbench_BuildPlanDispatchTaskRequest_Schema = z.object({
     /** The conversation this dispatch belongs to, so the thread shows the run as a card. */
     conversationId: z.string().min(1).optional(),
 });
+/** Why a build task goes back in the queue (#2530): a person's reason, and what was fixed. */
+export const Workbench_BuildTaskRearmRequest_Schema = z.object({
+    /* A person's reasons only: the wave's own records a detection only the wave makes. */
+    reason: z.enum(OPERATOR_BUILD_TASK_REARM_REASONS).systemEnum('BuildTaskRearmReason'),
+    /** What was fixed, in a sentence. Required: a reason alone cannot say which defect. */
+    note: z.string().trim().min(1),
+});
 export const Workbench_AcceptChangesRequest_Schema = z.object({
     /** Commit paths that diverged since the run. NOT defaulted on — a human edit is never silently swept in. */
     force: z.boolean().optional(),
@@ -725,10 +943,27 @@ export const Workbench_PlaybookRunOutcome_Schema = z.looseObject({
     status: z.enum(Workbench_PlaybookRunOutcomeStatus).optional(),
     note: z.string().optional(),
 });
+/**
+ * How a build dispatch answers (#2531 review M1): the companion forwards its dispatch result as it is. One task run
+ * answers the task it dispatched (`plan`) and what started for it, a coding run's `admission` or the result of a
+ * `generationStep` the companion ran itself, exactly one of the two. A parallel `dispatch_next` answers the `wave` it
+ * started, with a `note`.
+ *
+ * There is no top-level `taskRef`. This schema declared one, which no answer ever carried, so the line saying what a run
+ * started was never shown and the raw answer opened in its place.
+ */
 export const Workbench_BuildPlanDispatchOutcome_Schema = z.looseObject({
-    taskRef: z.string().optional(),
+    plan: z.looseObject({ taskRef: z.string().min(1) }).optional(),
+    admission: z.looseObject({}).optional(),
+    generationStep: z.looseObject({}).optional(),
+    wave: z.looseObject({}).optional(),
     note: z.string().optional(),
 });
+/** How a re-arm answers: the runs it released, and the reason it recorded on them. */
+export const Workbench_BuildTaskRearmOutcome_Schema = z.looseObject({
+    rearmedRunTaskIds: z.array(z.string()).optional(),
+    rearm: z.looseObject({ reason: z.enum(BuildTaskRearmReason), note: z.string(), rearmedAt: z.string() }).optional(),
+});
 export const Workbench_BuildPlanAddTaskOutcome_Schema = z.looseObject({
     taskRef: z.string().optional(),
     /** TRUE when no plan existed and this task is its first. */
@@ -739,6 +974,13 @@ export const Workbench_BuildPlanAddTaskOutcome_Schema = z.looseObject({
 });
 /** How ACCEPT answers, for a task's coding run or a playbook run alike: what was committed, what was refused and why. */
 export const Workbench_AcceptChangesOutcome_Schema = z.looseObject({
+    /**
+     * TRUE when no new commit was made because what it would commit was already committed: the run was accepted before, or
+     * its files were committed by hand (#2531 review M3). `commitSha` is then that earlier commit, not a new one. An accept
+     * can be partial, holding back the files it cannot vouch for, and the task waits on them; only a forced accept
+     * (`force`) commits those.
+     */
+    alreadyCommitted: z.boolean().optional(),
     commitSha: z.string().optional(),
     committedPaths: z.array(z.string()).optional(),
     refusedPaths: z.array(z.object({ path: z.string(), reason: z.string() })).optional(),
@@ -755,6 +997,11 @@ export const Workbench_RunWriteRevertOutcome_Schema = z.looseObject({
      * would destroy that run's work. Each names the run to revert first (#1666).
      */
     refusedLaterRun: z.array(z.object({ path: z.string(), runId: z.string() })).optional(),
+    /**
+     * Binary files the run replaced while their earlier version was uncommitted (#3264): the record holds their hash, not
+     * their bytes, so nothing can restore them. Refused even under force.
+     */
+    refusedWithoutPreImage: z.array(z.string()).optional(),
     note: z.string().optional(),
 });
 /**
@@ -827,8 +1074,15 @@ export const Workbench_BuildDispatchPlan_Schema = z.object({
      * counted as landed on pages that listed none. Named so "92 of 92 landed" can never hide it. Empty is healthy.
      */
     landedBeforeAnyRunTaskRefs: z.array(z.string().min(1)).isSummaryField(),
-    /** TRUE when there is no next task because every one has landed. */
+    /** TRUE when there is no next task because every one has landed, and no specifications module is failing. */
     exhausted: z.boolean().isSummaryField(),
+    /**
+     * The specifications modules failing while the plan has no next task (#3258). Such a plan is not `exhausted`: what landed
+     * may only have run, and no check of the package can answer. Empty otherwise.
+     */
+    failingSpecificationModules: z.array(z.string().min(1)).isSummaryField(),
+    /** TRUE when that plan's next dispatch repairs the failing module (#3258), so nothing is asked of a person yet. */
+    specificationRepairOwed: z.boolean(),
     /**
      * Every READY task dispatch passed over because it cannot make progress, and why (#1451).
      *
@@ -845,8 +1099,6 @@ export const Workbench_BuildDispatchPlan_Schema = z.object({
         reason: z.enum(Workbench_BuildTaskStuckReason).systemEnum('Workbench_BuildTaskStuckReason'),
         /** The run that proves it is stuck; NULL for a task that is unbuildable before any run. */
         priorTaskId: z.string().min(1).nullable(),
-        /** `completed_awaiting_commit` only: the probed paths present in the working tree and not committed. */
-        uncommittedPaths: z.array(z.string().min(1)),
         /** `parked_awaiting_answer` (and a parked `no_document_blueprint`): the question the run is waiting on. */
         question: z.string().min(1).nullable(),
         /** `no_document_blueprint` only: the governed document the catalog does not define. */
@@ -858,7 +1110,10 @@ export const Workbench_BuildDispatchPlan_Schema = z.object({
     landedCount: z.number().int().isSummaryField(),
 });
 export const Workbench_BuildDispatch_Schema = z.object({
-    /** Emitted by the behavior as `<taskRef>--<startedAt>`, sanitized — a task can be dispatched twice. */
+    /**
+     * The dispatch's own EXECUTION id (#2530): a task can be dispatched twice, even in the same second, and was keyed on its
+     * task and start instant until two such attempts shared one id.
+     */
     workbenchBuildDispatchId: z.string().min(1).isPrimaryKey().isSummaryField(),
     /** The build-plan task this attempt ran. */
     taskRef: z.string().min(1).isSummaryField(),
@@ -890,18 +1145,321 @@ export const Workbench_BuildDispatch_Schema = z.object({
     codingTaskId: z.string().min(1).isForeignKey().isSummaryField().nullable(),
     /** Why it failed, verbatim. NULL on every dispatch that did not. */
     error: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * Whose failure a failed coding run was (#1581): the task's, or the host's. HOST is everything that is not the task's: the
+     * agent's turn taken by the environment (a signed-out agent, a spent quota, a killed turn, an operator's cancel) or a
+     * change set or trace the host could not capture. Only the first kind is the coding lane's, so the dispatch's page and
+     * card offer to see whether the lane is ready, never to explain the failure (#2530 review M2, #2531 review L1). NULL for
+     * a run that did not fail, a generation step, and a run recorded before it.
+     */
+    failureAttribution: z.enum(CodingRunFailureAttribution).systemEnum('CodingRunFailureAttribution').nullable(),
     /**
      * The conversation the dispatch was started from (#1454, Step 7), so the thread shows it as a
      * card. NULL for a dispatch started from the plan's next-task door or before conversations existed.
      */
     conversationId: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * How the dispatch's RUN stands — the status of the actor execution the dispatch is (#2523).
+     *
+     * Every dispatch is one execution (#1359): a coding run on `application-coding.system`, a generation step
+     * on `application-build.system`. Its status is the one truthful answer to "did it work", for both
+     * executors. The phase cannot give it: a coding dispatch's phase resolves at ADMITTED, by design, so a run
+     * that has since completed, failed or is waiting on an answer still reads ADMITTED there. Every consumer
+     * that keyed a coding run's end on `phase === FINISHED` was asking a question no coding run could answer:
+     * the conversation's dispatch card never offered Accept, and Home never listed a coding run as settled.
+     */
+    runStatus: z.enum(FlowsActors_Status).systemEnum('FlowsActors_Status').isSummaryField(),
+    /** When the run ENDED. NULL while it is pending, running or waiting on an answer. */
+    runFinishedAt: z.date().isSummaryField().nullable(),
     /**
      * Whether the coding run's writes have been ACCEPTED — committed through the `accept` verb, or
-     * found already committed. NULL when there is nothing to accept: a generation step, a failed run,
-     * a run that wrote nothing, or a run older than the coding-run write register.
+     * found already committed.
+     *
+     * FALSE means exactly one thing: a coding run that COMPLETED, recorded writes, and has none committed
+     * yet — the state the `accept` verb addresses. NULL when there is nothing to accept NOW: a generation
+     * step, a run still running or waiting on an answer, a failed run, a run that wrote nothing, or a run
+     * older than the coding-run write register.
      */
     accepted: z.boolean().isSummaryField().nullable(),
 });
+/**
+ * One ATTEMPT at a build task (#2530): one actor execution, as the build's record reads it. A coding run, or a companion
+ * generation step (labels, migrations, translations).
+ */
+export const Workbench_BuildTaskAttempt_Schema = z.object({
+    /** The execution's own task id: the coding run's actor task, or the generation step's. */
+    runTaskId: z.string().min(1),
+    startedAt: z.date(),
+    settledAt: z.date().nullable(),
+    status: z.enum(FlowsActors_Status).systemEnum('FlowsActors_Status'),
+    /**
+     * A companion generation step (labels, migrations, translations) rather than a coding run. No agent ran, so its cost and
+     * tokens are what its own model calls were MEASURED at, and may be a floor (`spendIsFloor`) where some reported nothing.
+     */
+    generationStep: z.boolean(),
+    /**
+     * Refused by the host before it started (an admission refusal, a run a stopped process left selected). In the
+     * history, because it explains why nothing ran; counted by no figure, because it was no attempt of the task's.
+     */
+    refusedBeforeStart: z.boolean(),
+    /** Nothing ran: a host refusal, or admission refusing the task's own contract (which the budget does count). */
+    ranNothing: z.boolean(),
+    /** Whose failure a failed run was; null for a run that did not fail, and for a run recorded before the field. */
+    failureAttribution: z.enum(CodingRunFailureAttribution).systemEnum('CodingRunFailureAttribution').nullable(),
+    /** It failed while other runs were editing the tree, so the failure may be theirs. */
+    interferenceSuspected: z.boolean(),
+    /**
+     * Why the task was put back in the queue after this run, which then no longer held it; null when it was not. A person's
+     * reason, or the build wave's own when the run's product was lost to a sibling run editing the same file.
+     */
+    rearmReason: z.enum(BuildTaskRearmReason).systemEnum('BuildTaskRearmReason').nullable(),
+    /** What was fixed, as the re-arm recorded it; null when the run was not re-armed. */
+    rearmNote: z.string().min(1).nullable(),
+    /** Why it failed, verbatim; null when it did not. */
+    error: z.string().min(1).nullable(),
+    /**
+     * What the run cost, with its currency: what the agent reported for a coding run, what its model calls were measured at
+     * for a generation step (in one currency; a step that spent in several shows none). Null when nothing reported a cost —
+     * never read as zero.
+     */
+    costAmount: z.number().nullable(),
+    costCurrency: z.string().min(1).nullable(),
+    /** The cost and tokens are a FLOOR: a generation step some of whose model calls reported no usage. */
+    spendIsFloor: z.boolean(),
+    /**
+     * The tokens the run reported in all; null when it reported none. Mostly prompt-cache reads for a coding run, so a
+     * large figure is the agent re-reading its context, not that much new work.
+     */
+    totalTokens: z.number().int().min(0).nullable(),
+    /** Files the run itself changed; null when the run recorded none. */
+    filesChanged: z.number().int().nullable(),
+    /** The checks the run itself failed, by ref (a check already red when it started is not its failure, so not here). */
+    failedCheckRefs: z.array(z.string().min(1)),
+    /** Paths the run changed outside the task's declared scope: recorded, never refused. */
+    outOfScopePaths: z.array(z.string().min(1)),
+    /**
+     * The run COMPLETED and a sibling of its wave overwrote its product (#2210): which runs, which of the task's product
+     * files both changed, and whether the wave re-ran the task for it. Null for a run nobody overwrote. The case a person's
+     * re-arm answers once the wave's own re-runs are spent.
+     */
+    interference: z.object({
+        overlappingTaskRefs: z.array(z.string().min(1)),
+        contendedProductPaths: z.array(z.string().min(1)),
+        requeued: z.boolean(),
+    }).nullable(),
+    /*
+     * NOT carried: why the agent's turn ended (`max_tokens`, `refusal`), which is the agent's own vocabulary with no
+     * words here yet; the run's own page shows it.
+     */
+});
+/**
+ * What `wildo db diff --check` could tell the host about the resource model versus the accepted schema plan.
+ *
+ * THREE answers, not two. A boolean merged the two failures that lead to opposite places (found in review,
+ * 2026-09-13): DRIFTED means the migration step has work and must run first; UNANSWERABLE means the check did not
+ * report drift and did not pass — no accepted plan and an undeterminable store declaration, no built backend registry, a compiled model older than its
+ * sources (`assessCompiledModelCurrency`, #403: before it, a dead watcher's stale dist answered IN_SYNC and landed
+ * this step with drift on disk), a CLI that could not import
+ * it or could not be spawned, a timeout, a lockfile that fails strict parsing, or an ENGINE planner-contract
+ * mismatch (whose remedy is `wildo db generate --accept-planner-contract`, not a rebuild) — and
+ * running the step then only throws. Read as one "not in sync", an unanswerable check put a step that can
+ * only fail at the head of the build queue on every dispatch, so no other task could run.
+ *
+ * Only IN_SYNC ever lands the step: an unanswered question must not land a migration step either.
+ *
+ * Declared here rather than beside its producer (the companion's generation steps) because the workbench shows it on a
+ * step's record (#2530).
+ */
+export var SchemaPlanSyncState;
+(function (SchemaPlanSyncState) {
+    /** The model and the accepted plan agree: the migration step has landed. */
+    SchemaPlanSyncState["IN_SYNC"] = "in_sync";
+    /** The check ran and reported ungenerated changes: the migration step has work to do. */
+    SchemaPlanSyncState["DRIFTED"] = "drifted";
+    /** The check neither passed nor reported drift (see above for the causes); running the step now would refuse or fail. */
+    SchemaPlanSyncState["UNANSWERABLE"] = "unanswerable";
+})(SchemaPlanSyncState || (SchemaPlanSyncState = {}));
+/**
+ * What `wildo design-tokens validate` could tell the host about the stylesheet's generated block.
+ *
+ * Three answers, for the reason {@link SchemaPlanSyncState} has three: the command exits non-zero for a
+ * stale block AND for every could-not-ask failure (a config that does not load, a stylesheet with no
+ * markers, a CLI that cannot start or times out), and the two lead to opposite places. STALE means the
+ * `design-tokens` step has work; UNANSWERABLE means running it would refuse or fail the same way, so the
+ * dispatch host passes over it while other work is ready.
+ *
+ * Declared here for the reason {@link SchemaPlanSyncState} is (#2530).
+ */
+export var DesignTokenBlockState;
+(function (DesignTokenBlockState) {
+    /** The block is exactly what `generate` would write from the config. */
+    DesignTokenBlockState["CURRENT"] = "current";
+    /** The block differs from what `generate` would write: the step has work. */
+    DesignTokenBlockState["STALE"] = "stale";
+    /** The command neither confirmed nor refuted the block; running the step now would fail the same way. */
+    DesignTokenBlockState["UNANSWERABLE"] = "unanswerable";
+})(DesignTokenBlockState || (DesignTokenBlockState = {}));
+/**
+ * Does every module the brand step writes (the frontend's brand design, and the website's colours when a website is
+ * declared) say what the brand's visual tone now renders?
+ *
+ * Three answers, for the reason {@link DesignTokenBlockState} has three: STALE means the step has work and runs,
+ * UNANSWERABLE means the brand could not be read (the specifications do not evaluate, or this host has no
+ * introspection), and running the step then only throws, so the selector passes it over while other work is ready.
+ *
+ * Declared here for the reason {@link SchemaPlanSyncState} is (#2530).
+ */
+export var BrandDesignState;
+(function (BrandDesignState) {
+    /** Every module exists and equals the render of the brand's current visual tone. */
+    BrandDesignState["CURRENT"] = "current";
+    /** A module is absent or says something the brand no longer does. */
+    BrandDesignState["STALE"] = "stale";
+    /** The brand's visual tone could not be read, so currency cannot be decided either way. */
+    BrandDesignState["UNANSWERABLE"] = "unanswerable";
+})(BrandDesignState || (BrandDesignState = {}));
+/** A landing probe the working tree does not satisfy (#2530, #3204): what landing searched for there, and what is missing. */
+export const Workbench_BuildTaskUnmetProbe_Schema = z.object({
+    /**
+     * The files the probe reads, and how they are read: ONE path is that file, present (and declaring `declarations`
+     * when it names any); SEVERAL paths with `declarations` are candidates, any one of which may declare them; several with
+     * `keyPrefix` are the language packs, every present one of which must carry a key under it. Empty for a shell probe,
+     * which reads the resolved shell rather than a fixed file (`shellSurface`, `shell`). The probe's KIND is the
+     * companion's (`BuildPlanTaskLandedProbeKind`): these fields are what it looks for, and between them say which kind.
+     */
+    paths: z.array(z.string().min(1)),
+    /**
+     * The symbols the probe looks for in those files; empty for a probe that asks only that a file be present. WHERE in
+     * the file they must sit (a set, one call's arguments, a key at an object path, a list's entry) is the companion's
+     * probe relation and is not carried: its parameters are code locations the companion derives only when it probes, and
+     * no surface shows them, a run's included (#2531 review L4). A reader learns WHAT is missing here, not where it goes.
+     */
+    declarations: z.array(z.string().min(1)),
+    /** The key every present label pack must carry one under (a website section's words); null for other probes. */
+    keyPrefix: z.string().min(1).nullable(),
+    /**
+     * The shell surface a placement probe reads — a `PlacementSurface` value of the specifications. A string declaring that
+     * vocabulary, so it reads `system_enums.PlacementSurface` like the enum, since this package does not depend on the
+     * specifications. Null for the probe that asks whether ANY surface carries a placement, and for every probe that reads
+     * files.
+     */
+    shellSurface: z.string().min(1).systemEnum('PlacementSurface').nullable(),
+    /** A shell probe's explanation: what the surface lacks, still carries, or could not be asked. Null for a file probe. */
+    shell: z.object({
+        /** Why the surface could not be read, verbatim: the probe is then unsatisfied without being a "no". */
+        unanswerable: z.string().min(1).nullable(),
+        /** Subjects the plan placed there that the surface does not carry. */
+        missing: z.array(z.string().min(1)),
+        /** Subjects the plan declined that the surface still carries. */
+        declinedButPresent: z.array(z.string().min(1)),
+        /** Files contributing the surface that the working tree does not hold (#3514). */
+        absentPaths: z.array(z.string().min(1)),
+    }).nullable(),
+    /**
+     * A REGISTRY probe's explanation (#2966): an agent, an approval gate, a work unit, a metered usage recording (#2305
+     * S5) or a retention binding, proven from what the backend registers, and a role a relationship confers (#2305 S6),
+     * proven from `wildo.saas.config.ts`. Null for every other probe. Kept apart from `shell`, which reads a surface: these read a registry, and
+     * a "declined" entry has no meaning here.
+     */
+    registered: z.object({
+        /** Why the registry could not be read, verbatim: the probe is then unsatisfied without being a "no". */
+        unanswerable: z.string().min(1).nullable(),
+        /**
+         * What the task's module does not register as planned, one entry per shortfall: WHY (worded from
+         * `system_enums.AgentWorkShortfallKind`), the ref it is about, and the planned and registered values where it compares
+         * them (for a refused gate, the engine's refusal, verbatim).
+         */
+        missing: z.array(z.object({
+            kind: z.enum(AgentWorkShortfallKind).systemEnum('AgentWorkShortfallKind'),
+            ref: z.string().min(1),
+            planned: z.string().min(1).nullable(),
+            registered: z.string().min(1).nullable(),
+        })),
+        /** Registration files, or files the agent index imports, that the working tree does not hold (#3514). */
+        absentPaths: z.array(z.string().min(1)),
+    }).nullable(),
+});
+/**
+ * Everything the build knows about ONE task, in one row (#2530, from the companion's per-task record, #1521).
+ *
+ * The case it exists for: "not landed" hid three facts — never dispatched, dispatched and FAILED, dispatched,
+ * SUCCEEDED and unprovable — and they are three shapes here: no attempts; a failed attempt; a completed attempt with
+ * unmet probes. Its id IS the build-plan task row's id, so a task's detail reads its record by the id it already has;
+ * it is its own resource because reading attempts, classifying a stuck task and probing the tree is too much to pay on
+ * every row of the task list.
+ *
+ * The attempts are read from the actor plane by ONE listing per coding system, bounded far above a whole build's runs;
+ * `attemptsTruncated` says when that bound was met, so an early task's oldest runs may be missing and "never run" is not
+ * claimed.
+ */
+export const Workbench_BuildTaskRecord_Schema = z.object({
+    workbenchBuildTaskRecordId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The build-plan task this is the record of (the same id). */
+    workbenchBuildPlanTaskId: z.string().min(1).isForeignKey().isSummaryField(),
+    taskRef: z.string().min(1).isSummaryField(),
+    status: z.enum(WorkbenchBuildPlanTaskStatus).systemEnum('WorkbenchBuildPlanTaskStatus').isSummaryField(),
+    /**
+     * Attempts that count (every one but a host refusal before start). Which FAILED ones count against the attempt
+     * budget is the budget's own question (host failures and suspected interference are forgiven up to a bound); each
+     * attempt says what it needs for that, and a spent budget is `stuckReason` ATTEMPTS_EXHAUSTED, never re-derived here.
+     */
+    attemptCount: z.number().int().min(0).isSummaryField(),
+    /** Newest first. Empty: never dispatched (unless `attemptsTruncated`). */
+    attempts: z.array(Workbench_BuildTaskAttempt_Schema),
+    /** The attempt listing met its bound: the oldest attempts of an early task may be missing. */
+    attemptsTruncated: z.boolean(),
+    /** READY and passed over by dispatch: why, from the same classification the selector uses. */
+    stuckReason: z.enum(Workbench_BuildTaskStuckReason).systemEnum('Workbench_BuildTaskStuckReason').isSummaryField().nullable(),
+    /** `parked_awaiting_answer`: the question its run is waiting on. */
+    stuckQuestion: z.string().min(1).nullable(),
+    /** `no_document_blueprint`: the governed document no blueprint defines. */
+    stuckDocumentRef: z.string().min(1).nullable(),
+    /** BLOCKED: the prerequisites that have not landed. */
+    waitingOnTaskRefs: z.array(z.string().min(1)),
+    /** Not landed and attempted: the probes the working tree, which landing reads (#3204), does not satisfy. */
+    unmetProbes: z.array(Workbench_BuildTaskUnmetProbe_Schema),
+    /*
+     * A GENERATION STEP lands on something other than a file it writes, and when it has not, which of these three it is
+     * says whether running it again can help: the step's own state, null when it is current or is not that step.
+     */
+    /** The migration step: whether the model and the accepted schema plan agree. */
+    schemaPlanSyncState: z.enum(SchemaPlanSyncState).systemEnum('SchemaPlanSyncState').nullable(),
+    /** The design-tokens step: whether the stylesheet's generated block is what the config would generate. */
+    designTokenBlockState: z.enum(DesignTokenBlockState).systemEnum('DesignTokenBlockState').nullable(),
+    /** The brand-design step: whether the generated module says what the brand's visual tone renders. */
+    brandDesignState: z.enum(BrandDesignState).systemEnum('BrandDesignState').nullable(),
+    /**
+     * A generation step whose landing cannot be judged, and why, verbatim (#2504): today a labels plan that hides units
+     * the application owes. Named before the step's first run too, since it holds the step back from running. Null when
+     * nothing holds its landing.
+     */
+    landingBlockedBy: z.string().min(1).nullable(),
+    /*
+     * The follow-up tasks (#2496): what the host derived from a gap this task's latest completed run reported still unmet,
+     * and on a follow-up, the task whose gap derived it. By build-plan task row id, so each opens the task it names
+     * (#2652); `wildo context journey` prints the same two facts.
+     */
+    /** The follow-up tasks derived from this task's reported gaps; empty when none was derived. */
+    followUpTaskIds: z.array(z.string().min(1).isForeignKey()),
+    /** On a follow-up task: the task whose reported gap derived it; null on every other task. */
+    followUpOfTaskId: z.string().min(1).isForeignKey().nullable(),
+    /*
+     * A person's CLOSURE (`wildo build close`, #3224, #3227): the task counts as landed because a person said it is done
+     * another way, or declined it, never because its own probe found its product. Null on every task nobody closed.
+     */
+    /** How the closure accounts for the task. */
+    closureKind: z.enum(BuildTaskClosureKind).systemEnum('BuildTaskClosureKind').nullable(),
+    /** The task or the commit that built it; null when declined or not closed. */
+    closureSatisfiedBy: z.string().min(1).nullable(),
+    /** Why, in the person's words. */
+    closureReason: z.string().min(1).nullable(),
+    /** LANDED with no product to prove: it ran, and nothing can show what it made. */
+    unverifiable: z.boolean(),
+    /** LANDED before any run of its own started: something else made its product, or the probe reads the wrong thing. */
+    landedBeforeAnyRun: z.boolean(),
+    /** Where the probe found that product, so a reader can see what it took for it; empty unless `landedBeforeAnyRun`. */
+    landedBeforeAnyRunPaths: z.array(z.string().min(1)),
+});
 /**
  * One playbook run SUSPENDED waiting on a person.
  *
@@ -944,6 +1502,50 @@ export var Workbench_PlaybookRunState;
      */
     Workbench_PlaybookRunState["AWAITING_ANSWER"] = "awaiting_answer";
 })(Workbench_PlaybookRunState || (Workbench_PlaybookRunState = {}));
+/**
+ * One child of a composite run's round (#2530): the playbook that ran in it, why it was on the table, what it landed and
+ * whether it failed — the record's own summary (`PlaybookRunChoreographyChildSummary`), with its measurement left on the
+ * run's record. A child that was itself a LANE is known by the rounds that name it as their lane.
+ */
+export const Workbench_PlaybookRunRoundChild_Schema = z.object({
+    playbookRef: z.string().min(1),
+    /** Why it was on the table, in the runtime's own sentence (a first run, a refresh and what moved, a re-opening). */
+    ranBecause: z.string().min(1).nullable(),
+    /**
+     * TRUE when it re-ran over a landing the record already held — the runtime's rerun verdict was a refresh or a current
+     * landing re-opened, never a first run (#3213). A failure of such a child left that earlier landing standing, which is
+     * what makes it a non-fatal repair failure; `ranBecause` is a sentence and is written for a first run too, so it cannot
+     * say this. NULL on a row recorded without a verdict.
+     */
+    reranOverLanding: z.boolean().nullable(),
+    /** The specification files it landed, in landing order. Empty is a finding, not a gap. */
+    landed: z.array(z.string().min(1)),
+    /** Why it failed, bounded as the record keeps it; null when it did not. */
+    failure: z.string().min(1).nullable(),
+});
+/**
+ * One round of a composite run (#2530): the root's, or a nested lane's. FLAT rather than nested: a lane's rounds follow
+ * the round whose child ran the lane and name it (`parentRoundKey`, `lanePlaybookRef`), so a process map nests them as
+ * groups without a recursive contract, and every depth the record keeps reaches the row.
+ *
+ * The choreography's own stop reason (`PlaybookChoreographyStopReason`) is NOT here: it is a closed vocabulary of the
+ * runtime, which this package does not depend on, and a raw code would render as words nobody authored. Each round's
+ * `stopRationale` is the selector's own sentence for why that round ended the run; the reason code stays on the record.
+ */
+export const Workbench_PlaybookRunRound_Schema = z.object({
+    /** The round's place in the run: `3` for the root's third, `3/<lane playbook>/2` for the second round of that lane. */
+    roundKey: z.string().min(1),
+    /** The round whose child ran this lane; null for a round of the run itself. */
+    parentRoundKey: z.string().min(1).nullable(),
+    /** The child playbook whose lane this round belongs to; null for a round of the run itself. */
+    lanePlaybookRef: z.string().min(1).nullable(),
+    iteration: z.number().int().min(1),
+    /** The earlier round of the same lane that began from the very same input state: a lane spending without converging. */
+    sameInputStateAsIteration: z.number().int().min(1).nullable(),
+    /** Why the selector stopped after this round, in its own sentence; null when it went on. */
+    stopRationale: z.string().min(1).nullable(),
+    children: z.array(Workbench_PlaybookRunRoundChild_Schema),
+});
 /**
  * One playbook run, in whatever state it is in.
  *
@@ -1030,6 +1632,12 @@ export const Workbench_PlaybookRun_Schema = z.object({
     })).nullable(),
     /** Why the judge stayed silent, in its own words — a failed call, or an evaluation that never ran. */
     judgeSkipped: z.string().min(1).nullable(),
+    /**
+     * A COMPOSITE run's rounds, its own and every nested lane's, in run order (#2530), each with the children that ran in
+     * it — what a process map draws as rounds, then child runs. Null for a run of a single playbook, and for a run not
+     * settled yet (its rounds are on the record once it ends).
+     */
+    choreographyRounds: z.array(Workbench_PlaybookRunRound_Schema).nullable(),
 });
 export const Workbench_WaitingPlaybookRun_Schema = z.object({
     /** The run's own id, sanitized — run ids carry dots (see the playbook id note). */
@@ -1084,13 +1692,10 @@ export const Workbench_WaitingPlaybookRun_Schema = z.object({
     routedToUserId: z.string().min(1).isSummaryField().nullable(),
 });
 /**
- * One coding run PARKED on a question.
- *
- * It arrives inside the coding-agent status payload, which is a singleton and stays a companion
- * read. These do not: a parked question is identified by the task that parked on it, it persists
- * until somebody answers, and a queue of work waiting on a person is the last thing that should be
- * reachable only by reading a status blob.
+ * The coding lane's one row id. Named, because the workbench links to the row from where the lane's trouble shows (an
+ * attempt, a dispatch or a dispatch card the host failed, #2530) and the companion stamps it: two copies of the literal would be two ids.
  */
+export const WORKBENCH_CODING_LANE_STATUS_ROW_ID = 'coding-lane';
 /**
  * The coding lane's own posture — ONE row, always present.
  *
@@ -1113,7 +1718,7 @@ export const Workbench_WaitingPlaybookRun_Schema = z.object({
  * outstanding — which is why the parked queue has to be read beside it.
  */
 export const Workbench_CodingLaneStatus_Schema = z.object({
-    /** One row, one id. The projection stamps a constant: there is exactly one coding lane. */
+    /** One row, one id ({@link WORKBENCH_CODING_LANE_STATUS_ROW_ID}): there is exactly one coding lane. */
     workbenchCodingLaneStatusId: z.string().min(1).isPrimaryKey().isSummaryField(),
     /** Every declared coding agent resolves in the registry. NOT a claim that the transport works. */
     codingAgentRegistered: z.boolean().isSummaryField(),
@@ -1176,6 +1781,14 @@ export var Workbench_ParkedCodingQuestionOptionRef;
 })(Workbench_ParkedCodingQuestionOptionRef || (Workbench_ParkedCodingQuestionOptionRef = {}));
 /** The single field a parked run asks: the agent's own question, verbatim. */
 export const WORKBENCH_PARKED_CODING_QUESTION_FIELD_REF = 'answer';
+/**
+ * One coding run PARKED on a question.
+ *
+ * It arrives inside the coding-agent status payload, which is a singleton and stays a companion
+ * read. These do not: a parked question is identified by the task that parked on it, it persists
+ * until somebody answers, and a queue of work waiting on a person is the last thing that should be
+ * reachable only by reading a status blob.
+ */
 export const Workbench_ParkedCodingQuestion_Schema = z.object({
     /** The parked task's id, sanitized. */
     workbenchParkedCodingQuestionId: z.string().min(1).isPrimaryKey().isSummaryField(),
@@ -1243,8 +1856,20 @@ export const Workbench_DossierEntry_Schema = z.object({
     standing: z.enum(WorkbenchDossierEntryStanding).systemEnum('WorkbenchDossierEntryStanding').isSummaryField(),
     /** Whether the options can be offered now — see {@link WorkbenchDossierEntryOptionsState}. */
     optionsState: z.enum(WorkbenchDossierEntryOptionsState).systemEnum('WorkbenchDossierEntryOptionsState').isSummaryField(),
-    /** The answer as stored, when there is one. */
+    /** The answer as stored, when there is one. Null for a question answered without a value (#3437). */
     value: z.string().nullable().isSummaryField(),
+    /**
+     * Why the creator answered WITHOUT a value (#3437): the reason it does not apply, or what it waits on. Null for any
+     * other standing. Kept apart from `value` so nothing reads the reason as an answer.
+     */
+    nonAnswerReason: z.string().nullable().isSummaryField(),
+    /**
+     * The ways this question may be answered WITHOUT a value (#3439): what its playbook declares its output can carry,
+     * and none for a question only the creator may answer — the shared `admittedElicitationNonAnswers`, so the
+     * workbench, the console and the landing agree. Empty offers neither "does not apply" nor "later"; the answer
+     * operation refuses a kind not listed here.
+     */
+    admittedNonAnswers: z.array(z.enum(MetaWorkflow_ElicitationNonAnswer).systemEnum('MetaWorkflow_ElicitationNonAnswer')).isSummaryField(),
     answeredAt: z.date().nullable().isSummaryField(),
     answeredByRef: z.string().nullable().isSummaryField(),
     /** What the person was shown beside the option they chose (#2337), recorded with the answer; null when nothing was. */
@@ -1360,9 +1985,21 @@ export const Workbench_DossierInterviewDepthOutcome_Schema = z.looseObject({
     interviewDepth: z.enum(ApplicationInterviewDepth),
     packageRelativePath: z.string(),
 });
+/**
+ * An answer to a dossier question: a VALUE, or (#3439) a NON-ANSWER with its reason — never both, and one of the two.
+ * The exclusivity and the admission are decided by the operation against the ROW (`admittedNonAnswers`), not here: a
+ * cross-field refinement would hide the one sentence that says what to change behind a generic schema error.
+ */
 export const Workbench_DossierAnswerRequest_Schema = z.object({
-    /** The answer, in the creator's words — validated against the question's kind before it is stored. */
-    value: z.string().min(1),
+    /** The answer, in the creator's words — validated against the question's kind before it is stored. Absent with `nonAnswer`. */
+    value: z.string().min(1).optional(),
+    /**
+     * Answer WITHOUT a value (#3439): the question does not apply to this application, or it is not decided yet. Refused
+     * where the row's `admittedNonAnswers` does not list it, and alongside a `value` or an assumption.
+     */
+    nonAnswer: z.enum(MetaWorkflow_ElicitationNonAnswer).optional(),
+    /** Required with `nonAnswer`: why it does not apply, or what it waits on — recorded so the person can revisit it. */
+    reason: z.string().min(1).optional(),
     /**
      * TRUE when the value is a PROPOSAL the creator let stand because they did not know (#2129): it is
      * recorded as an assumption, authored by the companion's proposer, and the dossier lists it to revisit.
@@ -1373,8 +2010,10 @@ export const Workbench_DossierAnswerRequest_Schema = z.object({
     assumptionRationale: z.string().min(1).optional(),
 });
 export const Workbench_DossierAnswerOutcome_Schema = z.looseObject({
-    /** The answer as STORED (canonical for a `confirm`). */
-    value: z.string(),
+    /** The answer as STORED (canonical for a `confirm`); null for a question answered without a value (#3439). */
+    value: z.string().nullable(),
+    /** The non-answer recorded instead of a value (#3439); null when a value was. */
+    nonAnswer: z.enum(MetaWorkflow_ElicitationNonAnswer).nullable(),
     answeredAt: z.string(),
     /** The dossier file this landed in, package-relative. */
     packageRelativePath: z.string(),
@@ -1419,16 +2058,62 @@ export var WorkbenchCreationHomeLineKind;
     WorkbenchCreationHomeLineKind["RUN_INTERRUPTED"] = "run-interrupted";
     /** A build dispatch finished or failed; `acceptable` says whether its writes wait to be committed. */
     WorkbenchCreationHomeLineKind["DISPATCH_SETTLED"] = "dispatch-settled";
+    /**
+     * A re-run inside a lane — a repair of a GAP, a refresh — FAILED while the family's earlier landing still stands
+     * (#3213): a NON-FATAL repair failure, whether the re-run was refused or the environment failed it. The landing it would have replaced is what its consumers read, and the lane
+     * went on with them (e.g. a refused build-decompose repair: the plan on disk still dispatches). `playbookRef` is the
+     * re-run's playbook, `subject` its failure; the target is the lane's run. `failed` stays false, because nothing the
+     * creation built is lost; the refusal is shown so it can be repaired when it matters.
+     */
+    WorkbenchCreationHomeLineKind["REPAIR_FAILED_LANDING_STANDS"] = "repair-failed-landing-stands";
     /**
      * The coding agent's account hit its usage limit, and the build dispatches nothing until it resets
      * (#2388). `subject` is when the build resumes (`08:11 Europe/Paris`); the target is the dispatch that met
      * the limit. Shown only while the limit holds, so it disappears once the build has resumed.
      */
     WorkbenchCreationHomeLineKind["CODING_AGENT_USAGE_LIMITED"] = "coding-agent-usage-limited";
+    /**
+     * The coding agent's provider ACCOUNT refused its turn: no credits left, a spend or usage limit, billing (#3204).
+     * Distinct from {@link CODING_AGENT_USAGE_LIMITED}: nothing resets on its own, a PERSON adds credits or raises the
+     * limit. The build holds and asks again every thirty minutes, charging no attempt, so a person who fixes the account
+     * while a drive waits loses nothing; an unattended drive stops on it. `subject` is the refusal in the providers'
+     * sentence (`describeModelProviderAccountRefusal`); the target is the dispatch that met it. Shown while the hold lasts.
+     */
+    WorkbenchCreationHomeLineKind["CODING_AGENT_ACCOUNT_REFUSED"] = "coding-agent-account-refused";
+    /**
+     * A coding run lost the network, and no coding turn is admitted until a probe of the agent's API answers along the
+     * agent's own route (#3236, #3262). `at` is when the loss was met, `taskRef` the task whose run met it, `subject` the
+     * route the probe takes (`api.anthropic.com via proxy proxy.corp:3128`), absent when no route is known. Shown only
+     * while the hold lasts; what ends it is the probe answering, a turn started after the loss succeeding, or
+     * `wildo build rearm <task> --reason environment`.
+     */
+    WorkbenchCreationHomeLineKind["CODING_AGENT_CONNECTIVITY_LOST"] = "coding-agent-connectivity-lost";
+    /**
+     * A verification check's command cannot be executed (#3423): `wildo`, say, is not on the companion's PATH, so every
+     * task's check would fail the same way, and no coding turn is admitted. `subject` is the command, `taskRef` the task
+     * whose run met it, `at` when. Nothing lifts it on its own: a person puts the command on PATH, and the next admission
+     * looks it up first (or `wildo build rearm <task> --reason environment` ends it). Shown while the hold lasts; an
+     * unattended drive stops on it.
+     */
+    WorkbenchCreationHomeLineKind["VERIFICATION_TOOL_UNAVAILABLE"] = "verification-tool-unavailable";
+    /**
+     * A person CLOSED a build task (`wildo build close`, #3224, #3227): done another way, or a derived follow-up declined.
+     * `at` is when, `taskRef` the task, `subject` the reason they gave. Shown so a reader of the build's history sees that a
+     * person, not a probe, said the task is done.
+     */
+    WorkbenchCreationHomeLineKind["BUILD_TASK_CLOSED"] = "build-task-closed";
     /** A playbook run suspended on questions only the creator can answer. */
     WorkbenchCreationHomeLineKind["CLARIFICATION"] = "clarification";
     /** A coding run parked on a question the agent could not answer alone. */
     WorkbenchCreationHomeLineKind["PARKED_QUESTION"] = "parked-question";
+    /**
+     * An interview still waiting on the creator whose answer would date work the next unattended round could run
+     * (#3361): a step reading the creator's stated facts, which an answer given later re-derives. The round withholds
+     * that work (`findReadersDatedByWaitingInterviews`), so this line is what moves it, and an unattended drive stops on
+     * it. `playbookRef` is the interview's playbook, `subject` the steps it holds (refs, comma-separated); the target is
+     * the interview's playbook. Not shown for a quick interview's questions an unattended round assumes (#2129).
+     */
+    WorkbenchCreationHomeLineKind["INTERVIEW_DATES_NEXT_WORK"] = "interview-dates-next-work";
     /** A governed document the creator asked for (a draft exists) still needing a fact only they can give. */
     WorkbenchCreationHomeLineKind["GOVERNANCE_DOCUMENT"] = "governance-document";
     /** The next READY build task of the dispatch plan. */
@@ -1436,13 +2121,42 @@ export var WorkbenchCreationHomeLineKind;
     /**
      * The plan can run NOTHING: every ready task is stuck, and `stuckReason` says what unblocks it.
      *
-     * ASKED rather than SUGGESTION, because every reason is the creator's move — committing what a
-     * finished run wrote under GUIDED, or, under the autonomy posture where the loop commits (#1534),
-     * resolving the path its accept refused or correcting a declaration no run can satisfy.
+     * ASKED rather than SUGGESTION, because every reason it is shown for is the creator's move — correcting a
+     * declaration no run can satisfy, re-arming a task that spent its attempts, approving a follow-up. (A run's work
+     * awaiting a commit was one until #3514: a task lands from the working tree since #3204.)
      * Without it the plan simply falls silent: `CONTINUE_THE_PLAN` is derived from the next ready task,
      * and a stuck queue has none (#1451, #1463).
      */
     WorkbenchCreationHomeLineKind["UNBLOCK_THE_PLAN"] = "unblock-the-plan";
+    /**
+     * Nothing in the plan can run and it is not finished, because a specifications module fails (#3258). `subject` names the
+     * modules. ASKED because the remedy is fixing the module, and without this line such a plan reads as nothing at all: no
+     * next task, not finished, and no stuck task to explain it.
+     */
+    WorkbenchCreationHomeLineKind["SPECIFICATION_FAULT_HOLDS_THE_PLAN"] = "specification-fault-holds-the-plan";
+    /**
+     * A FOLLOW-UP task landed while its latest completed run still reports a requirement unmet (#2583): advisory, never a
+     * reason the loop stops. `taskRef` is the follow-up, `subject` names each requirement and what the run said is
+     * missing. The door is running it again on purpose: `wildo build run <ref> --despite-landed --reason operator-judgement`.
+     */
+    WorkbenchCreationHomeLineKind["FOLLOW_UP_LANDED_WITH_GAP"] = "follow-up-landed-with-gap";
+    /**
+     * Files a build task's coding runs left UNCOMMITTED that no automatic door will commit (#3267): a failed run's file a
+     * retry refused, or a file dirty at a retry's baseline with what earlier failed runs left, and no run of the task live.
+     * ASKED, because only a person can settle it: `taskRef` is the task, `subject` names each file and the runs whose
+     * record holds it. The doors are `wildo build accept <ref> --leftovers` (commit, under those runs) and the discard
+     * command `wildo build tasks` prints per file. Derived from the write register and the tree, so it disappears once
+     * each file is committed or discarded.
+     */
+    WorkbenchCreationHomeLineKind["RUN_LEFTOVER_UNCOMMITTED"] = "run-leftover-uncommitted";
+    /**
+     * A build task LANDED and something its landing does not cover is unfinished (#3285): a billing catalogue committed
+     * while the backend does not enable billing, so nothing serves it. Advisory, a mark beside the landing and never a
+     * reason anything stops. `taskRef` is the task, `subject` names each setting still to set and the file that holds it;
+     * `wildo build tasks` prints what each needs first. Derived from the committed tree, so it disappears once the setting
+     * is committed.
+     */
+    WorkbenchCreationHomeLineKind["LANDED_WITH_ADVISORY"] = "landed-with-advisory";
     /** An eligible playbook whose output family is missing. */
     WorkbenchCreationHomeLineKind["PRODUCE_MISSING"] = "produce-missing";
     /** An eligible playbook whose output is stale — derived before one of its inputs last changed. */
@@ -1547,7 +2261,8 @@ export const Workbench_CreationOutcome_Schema = z.object({
     tasksLanded: z.number().int().min(0).nullable().isSummaryField(),
     /**
      * APPLICATION_WORKS only: the application's runtimes whose dev-loop supervisor has PAUSED them — it
-     * will not start them until something changes (#1537). While any is listed the outcome is not DONE,
+     * will not start them until something changes (#1537) — or is CRASH-LOOPING them, restarting each at most every five
+     * minutes while it keeps failing to start (#3365). While any is listed the outcome is not DONE,
      * whatever has landed: an application that cannot start does not work. Null on the other three,
      * and null when no supervisor could answer, which is "cannot tell" rather than "all up".
      */
@@ -1574,8 +2289,10 @@ export const Workbench_RunWriteFileDiff_Schema = z.object({
     existedBefore: z.boolean(),
     /** The file on disk no longer holds what the run wrote; the diff still describes what the RUN did. */
     diverged: z.boolean(),
-    /** Unified diff. Empty when the run rewrote a file with identical bytes. */
+    /** Unified diff. Empty when the run rewrote a file with identical bytes. For a binary file, one line naming its hashes. */
     diff: z.string(),
+    /** A binary file (#3264): its record holds a hash, so `diff` is one descriptive line and no lines of text. */
+    binary: z.literal(true).optional(),
 });
 export const Workbench_RunWriteDiff_Schema = z.object({
     runId: z.string().min(1),
@@ -1682,7 +2399,8 @@ export const Workbench_CodingRunCancelOutcome_Schema = z.looseObject({
  * The governed document's one verb: LAND the facts a person established for it as the
  * `document-facts-authored` family. The row is the document; the body carries the governance scope,
  * the answers and, for a reviewed fact, the review — a per-question verb with a bare value could
- * carry none of that, which is why the question resource has no write verb of its own.
+ * carry none of that, which is why ANSWERING stays on the document. Deferring one question carries
+ * only a reason and asserts nothing, so it is the question's own verb (`WorkbenchGovernanceQuestions_Operations`).
  */
 export var WorkbenchGovernanceDocuments_Operations;
 (function (WorkbenchGovernanceDocuments_Operations) {
@@ -1710,6 +2428,35 @@ export const Workbench_GovernanceFactsLandingRequest_Schema = z.object({
     /** Run the whole pipe and write nothing — what lets a person see the exact file their answers produce BEFORE anything touches the tree. */
     dryRun: z.boolean().optional(),
 });
+/**
+ * The governance question's one verb (#3439): DEFER it — the person says the fact concerns this application and is not
+ * decided yet, and why. A dossier write (`deferredDocumentFacts`), never a fact declaration, so the fact stays absent
+ * and every clause resting on it stays owed. It names no governance scope and records no review, which is why it can be
+ * a per-question verb while answering cannot (see {@link WorkbenchGovernanceDocuments_Operations}).
+ */
+export var WorkbenchGovernanceQuestions_Operations;
+(function (WorkbenchGovernanceQuestions_Operations) {
+    WorkbenchGovernanceQuestions_Operations["DEFER"] = "defer";
+})(WorkbenchGovernanceQuestions_Operations || (WorkbenchGovernanceQuestions_Operations = {}));
+/**
+ * Whether a governance question in this standing may be DEFERRED (#3439): one still needed, and one already deferred
+ * (re-deferring rewords the reason). A fact the product establishes is read, never deferred; and an ANSWERED fact is
+ * not either, because a landed declaration wins over a deferral of the same fact (`deriveOpenGovernanceQuestions`), so
+ * the deferral would change nothing anyone sees. The ONE predicate the operation refuses by and the workbench offers by.
+ */
+export function governanceQuestionAdmitsDeferral(standing) {
+    return standing === WorkbenchDossierEntryStanding.STILL_NEEDED || standing === WorkbenchDossierEntryStanding.DEFERRED;
+}
+export const Workbench_GovernanceQuestionDeferRequest_Schema = z.object({
+    /** Why it is not decided yet — what it waits on. Required: a deferral with no reason cannot be revisited. */
+    reason: z.string().min(1),
+});
+export const Workbench_GovernanceQuestionDeferOutcome_Schema = z.looseObject({
+    /** The fact deferred. */
+    factRef: z.string().min(1),
+    /** The dossier file the deferral landed in, package-relative. */
+    packageRelativePath: z.string().min(1),
+});
 export const Workbench_GovernanceFactsLandingOutcome_Schema = z.object({
     family: z.string().min(1),
     packageRelativePath: z.string().min(1),
@@ -1736,7 +2483,10 @@ export var ApplicationSecretStanding;
     ApplicationSecretStanding["NEEDED"] = "needed";
     /** It has a value in this environment, and something reads it. */
     ApplicationSecretStanding["SET"] = "set";
-    /** Unset, and nothing waits for it: an optional key, or a capability another provider already serves. */
+    /**
+     * Unset, and nothing waits for it: an optional key, or a capability another provider already serves, ready, in every
+     * runtime that would use this key for it (a provider ready in the backend serves nothing to the companion, #2985).
+     */
     ApplicationSecretStanding["AVAILABLE"] = "available";
     /**
      * It has a value, and nothing CONSUMES it: a provider key no provider declares, a system-of-record key
@@ -1854,7 +2604,11 @@ export const Workbench_ApplicationSecret_Schema = z.object({
     ownerRef: z.string().min(1).nullable().isSummaryField(),
     /** Its owner's own description of it, when it has one. */
     description: z.string().nullable(),
-    /** The enabled capabilities a provider serves for this application — why the secret is needed. Empty for the other kinds. */
+    /**
+     * The enabled capabilities this secret serves — why it is needed: those of the provider arms that READ it, not every
+     * capability its provider serves (#2978). Empty for a key no capability-serving arm reads (a sign-in client secret)
+     * and for the other kinds.
+     */
     capabilities: z.array(z.enum(EngineCapability).systemEnum('EngineCapability')),
     /**
      * The runtimes that RECEIVE it in their environment — the ones a change regenerates and restarts: `backend`,