@wildo-ai/saas-models 1.1.8 → 1.1.9

package/dist/esm/meta-workflows/orchestration.meta-workflows.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"orchestration.meta-workflows.shared.schemas.js","sourceRoot":"","sources":["../../../../src/meta-workflows/orchestration.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAN,IAAY,qBAiBX;AAjBD,WAAY,qBAAqB;IAC/B,4DAAmC,CAAA;IACnC,sDAA6B,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,0DAAiC,CAAA;IACjC,wCAAe,CAAA;IACf,gEAAuC,CAAA;AACzC,CAAC,EAjBW,qBAAqB,KAArB,qBAAqB,QAiBhC;AAED,0IAA0I;AAC1I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,4CAAa,CAAA;IACb,gDAAiB,CAAA;IACjB,gEAAiC,CAAA;IACjC,gEAAiC,CAAA;AACnC,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAED;;;;GAIG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,mEAAqC,CAAA;IACrC,6DAA+B,CAAA;AACjC,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AACD,wFAAwF;AAExF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,0BAmEX;AAnED,WAAY,0BAA0B;IACpC,iEAAmC,CAAA;IACnC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,+DAAiC,CAAA;IACjC;;;;;;;;OAQG;IACH,+DAAiC,CAAA;IACjC,+DAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAuC,CAAA;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,mEAAqC,CAAA;AACvC,CAAC,EAnEW,0BAA0B,KAA1B,0BAA0B,QAmErC;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,2BAeX;AAfD,WAAY,2BAA2B;IACrC,4FAA4F;IAC5F,oDAAqB,CAAA;IACrB,8GAA8G;IAC9G,8CAAe,CAAA;IACf,uFAAuF;IACvF,8CAAe,CAAA;IACf;;;;;OAKG;IACH,yGAAyG;IACzG,4CAAa,CAAA;AACf,CAAC,EAfW,2BAA2B,KAA3B,2BAA2B,QAetC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,oCAKX;AALD,WAAY,oCAAoC;IAC9C,yDAAyD;IACzD,6DAAqB,CAAA;IACrB,6GAA6G;IAC7G,qEAA6B,CAAA;AAC/B,CAAC,EALW,oCAAoC,KAApC,oCAAoC,QAK/C;AAED,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACrD;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;;;;OASG;CACJ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,mDAAmD,CAAC;SAC1D,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,sGAAsG;IACtG,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,mDAAmD,CAAC;SAC1D,QAAQ,EAAE;IACb,iHAAiH;IACjH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,0EAA0E;IAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;CACvD,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,iBAAiB,CAAC;QAC7D,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,6FAA6F;QAC7F,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,gBAAgB,CAAC;QAC5D,+BAA+B;QAC/B,QAAQ,EAAE,mCAAmC;QAC7C,wFAAwF;QACxF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,sFAAsF;QACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D;;;;;;;;WAQG;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,6DAA6D;QAC7D,QAAQ,EAAE,qCAAqC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,oCAAoC,CAAC;AAGvC,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;QACrC,mCAAmC;QACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC9C;;;;;;;;;;WAUG;QACH,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;YACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC/B,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;CACV,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,kEAAkE;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,mEAAmE;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,YAAY,CAAC;IACrE,iHAAiH;IACjH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,wHAAwH;IACxH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,8EAA8E;IAC9E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,sGAAsG;IACtG,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,oGAAoG;IACpG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC;IACnE,wGAAwG;IACxG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,QAAQ,EAAE;IAC7E;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,kEAAkE,EAAE,CAAC,CAAC;QAC/J,CAAC;IACH,CAAC,CAAC,CAAC;IACH,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QAChE,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,0EAA0E,EAAE,CAAC,CAAC;YACrK,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,mFAAmF;IACnF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACpC,+FAA+F;IAC/F,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,oGAAoG;IACpG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,mFAAmF;IACnF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,yEAAyE;IACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC","sourcesContent":["/**\n * Playbook-step ORCHESTRATION vocabulary: how a step is executed, gated, budgeted, contracted and\n * deliberated over — independent of what is being built.\n *\n * ## Why these are here and not in application creation\n *\n * They were declared in `@wildo-ai/saas-specifications/application-creation` until 2026-09-19\n * (#1342), which meant a generic orchestration engine could not type a step graph, an executor\n * tier, a budget, a choreography or a deliberation without importing the app-creation domain. The\n * `MetaWorkflow_` prefix these symbols already carried was asserting membership of the shared\n * domain while the declaration sat on the other side of the package line.\n *\n * ## What deliberately did NOT come with them\n *\n * `MetaWorkflow_Phase` (top-down / bottom-up / refinement) and `MetaWorkflow_FunctionalTopic` (the\n * seven-topic app-build taxonomy) name app-creation METHODOLOGY and stay there, as does\n * `MetaWorkflowPlaybookSchema` itself — a playbook is an app-creation artifact composed FROM this\n * vocabulary, which is the dependency running the right way.\n *\n * `MetaWorkflow_ArtifactIntent` DID come, against #1342's own table, and the enum's own heading is\n * why: \"A cross-family shorthand, answered by the aspect registry\". Its four members — audience,\n * value, voice, full (`plan` was removed, #1421) — are cross-family requests, so no per-family\n * vocabulary lives here: each family answers them through `FamilyAspectDeclaration.servesIntents`\n * in saas-specifications, and `MetaWorkflow_ArtifactSelectorSchema` cannot be typed without the enum. It\n * was the single backwards edge in the split, and the classification rather than the code was what\n * turned out to be wrong.\n *\n * ## The elicitation question kind is no longer aliased\n *\n * `MetaWorkflow_ElicitationQuestionKind` was `typeof HumanDecision_FieldKind` — a second name for an\n * engine enum, reached for by the companion specifically to dodge a `TS2742`. On this side of the\n * line the spec names {@link HumanDecision_FieldKind} directly, which is the door that always owned\n * the vocabulary.\n */\nimport { z } from \"zod\";\n\nimport { ExpertWorkDomain } from \"../flows-actors/deliberation.shared.schemas\";\nimport { HumanDecision_FieldKind } from \"../flows-actors/human-decision.shared.schemas\";\nimport { MetaWorkflow_EvaluationVerdict } from \"./decisions.meta-workflows.shared.schemas\";\n\n/**\n * Which execution tier runs a playbook (design plan D4):\n * - COMPANION_AGENT — API-transport LLM agent invoked by the companion\n *   (definition work: market analysis, requirements drafting, judging).\n * - CODING_AGENT — CLI coding agent (Claude Code) dispatched one-shot into\n *   the project workspace with app-knowledge loaded.\n * - HUMAN — the creator performs the step (interview answers, reviews).\n * - DETERMINISTIC_CLI — a non-LLM `wildo` command (config sync, validate…).\n *\n * There is deliberately NO `COMPOSITE`. It was removed 2026-08-29 (issue #115): it answered a\n * different question from every other member — not *which tier runs this step* but *this is not one\n * step* — so it became the catch-all, and four playbooks carried it meaning three different things\n * (a real choreography, a bespoke deterministic executor, and two coding-agent dispatches). Nothing\n * ever branched on it; composition is read from `method.choreography`, and the child dispatch keys\n * there deliberately. Splitting it was rejected too: `CHOREOGRAPHY` / `DETERMINISTIC_EXECUTOR` are\n * the two arms of the engine's `FlowActorSystem` union, and this contract stays engine-agnostic (see\n * P-1 above).\n *\n * The runtime honours FOUR of these five by branching, and refuses the fifth by name. Re-measured\n * 2026-09-02 against `playbook-run.companion.service.ts`:\n *\n * | tier | how it is honoured | authors |\n * |---|---|---|\n * | `COMPANION_AGENT` | the DEFAULT path — right without branching | 17 declared + 2 undeclared |\n * | `RESEARCH_AGENT` | `runChoreographyChild` routes the read-only lane (`:928`) | 1 |\n * | `CODING_AGENT` | dispatches the next build task via `ApplicationBuildDispatchService` (`:2022`), and carries child step outputs (`:959`) | 2 |\n * | `DETERMINISTIC_CLI` | runs the host-owned check set for the playbook's ref (`:2087`) | 1 |\n * | `HUMAN` | REFUSES by name (`:2131`) — the contract is undecided, and silence was the defect | 0 |\n *\n * A tier is therefore a real routing key: any playbook declaring `CODING_AGENT` or\n * `DETERMINISTIC_CLI` gets that mechanism with no host edit, which is precisely what separates a TIER\n * from the bespoke executor keyed to `bottom_up.foundation`'s ref.\n *\n * ## What this paragraph used to say, and why it is worth recording\n *\n * Until 2026-09-02 it said the runtime honours ONE of the five, that `CODING_AGENT` is \"honoured by\n * nothing — reachable only through its own companion HTTP endpoints\", and that `HUMAN` and\n * `DETERMINISTIC_CLI` \"have no authors at all\". All three were true when written (2026-08-29, issue\n * #119) and all three were fixed within days: #119 wired the executor branch, and `assemble-verify`\n * came back with `DETERMINISTIC_CLI` (`11b78bb5`). Nothing updated the sentence.\n *\n * It then did real damage: a session planning new work read this paragraph, concluded a playbook\n * could not reach the coding lane by declaring a tier, and reported that constraint as measured fact.\n * The runtime had disagreed for days. **Prose describing what the runtime does is an artifact that\n * goes stale exactly like a compiled one** — see `.claude/rules/staleness-presents-as-a-logic-defect.md`\n * — and a docstring stating a NEGATIVE capability is the most dangerous shape, because a reader who\n * believes it stops looking. Verify against the branch, not against this comment.\n */\nexport enum MetaWorkflow_Executor {\n  COMPANION_AGENT = \"companion_agent\",\n  CODING_AGENT = \"coding_agent\",\n  /**\n   * READ-ONLY agent with web access — the evidence lane.\n   *\n   * Distinct from {@link CODING_AGENT} despite sharing the transport, because the two have opposite\n   * postures and the difference is enforced, not stylistic: a research run is admitted under a\n   * permission ceiling that pre-approves only the protocol's NON-MUTATING tool kinds, and its\n   * dispatch refuses every filesystem path. Distinct from {@link COMPANION_AGENT} because that is an\n   * API call with no tools at all — which is precisely what left `top_down.market-analysis` claiming\n   * derivation from \"sealed research evidence\" while its executing agent could reach nothing but its\n   * own training data.\n   */\n  RESEARCH_AGENT = \"research_agent\",\n  HUMAN = \"human\",\n  DETERMINISTIC_CLI = \"deterministic_cli\",\n}\n\n/** @wildo_source:part:start saas.specifications.playbook-approval-and-failure-policies facet:layer:shared facet:audience:app-developer */\n/**\n * Per-playbook approval posture (design plan OQ-3).\n *\n * ⚠️ **Read since 2026-09-22 (#111) at ONE KIND of place: the boundary of a COMPOSITE run.** When a\n * lane (a playbook declaring `method.choreography`) ends, ITS OWN `approval` decides whether the run\n * leaves a person an `approve_result` decision on the decision plane about the files its children\n * landed — `auto` owes nothing, `notify` owes a record, `approve_result` and `approve_before` owe the\n * decision (nothing suspends BEFORE a run, so the stronger reading of `approve_before` is honoured\n * at the boundary that exists). One run can therefore leave SEVERAL: a root composite's own, plus\n * one for every nested lane that owed one, because a lane is where the question genuinely arises —\n * inside one run a lane lands the domain plan and the next builds on it. The autonomy posture\n * decides what a decision DOES: under the decided YOLO posture it is recorded on the run's row and\n * the run concludes — a marked gate that notifies and proceeds; holding the run for it is the GUIDED\n * posture's and is not built.\n *\n * On a LEAF playbook the field is still authored intent only: a leaf run is not gated, and a leaf\n * whose JSON reads `\"approval\": \"approve_before\"` runs when it is asked to run. Do not tell a creator\n * a leaf run is held pending approval. The same holds for the failure policy below, which the same\n * lane boundary reads to frame the decision (discard first under `revert_changeset`) and never to\n * revert on its own.\n *\n * **Measured 2026-08-29 alongside issue #103,** before the boundary existed:\n * `MetaWorkflow_ApprovalPolicy` had zero consumers outside this file and the 20 playbook\n * definitions that author it. The same is true of the journey-level `Journey_AutonomyPreset` that\n * was to map over it, and of the `wildo journey set-autonomy` command its JSDoc names — that\n * command exists in no CLI. So a playbook declaring `APPROVE_BEFORE` is not gated, and one\n * declaring `AUTO` is not thereby unattended.\n *\n * It is kept rather than deleted because — unlike the `qualityGates` field removed in the same\n * pass — nothing else delivers it. `qualityGates` was a second description of live checks;\n * this is a real posture nobody has built, and deleting it would discard the design rather than\n * the duplication. Build-or-delete is a decision, tracked as its own issue (#111).\n *\n * **DECIDED 2026-08-30: DEFERRED, and the deferral is the point.** Not \"we did not get to it\" —\n * `application-creation-directive.md` says the system must WORK first and that restrictions arrive\n * later, from a real incident, as judge-style guards rather than ceremony wired into the mechanism.\n * An inert approval policy is therefore the INTENDED posture right now, not a hole to plug.\n *\n * So read the effective state precisely, because the two halves differ:\n *\n * - **Running is unattended.** Nothing gates a playbook run — no preset, no policy, no failure\n *   handling. That is full-YOLO behaviour, arrived at by absence rather than by declaration.\n * - **Accepting is not — but by ABSENCE, not by rule.** Nothing in the runtime performs a commit\n *   (re-verified 2026-09-06), so acceptance is a human `git commit` because no other path exists.\n *\n * The rule conflict this comment used to record — `one-source-of-truth.md` Rule 3 read as \"only a\n * human commits\" against the directive's YOLO row — was SETTLED by D5's amendment on 2026-09-03: the\n * autonomy posture governs who commits, the posture is YOLO for all, and \"only a human commits\"\n * describes GUIDED rather than a floor. So this is now a missing mechanism, not an undecided rule;\n * see `journey.application-creation.schemas.ts` for what building it still owes.\n *\n * The paragraph here claimed until 2026-08-29 that \"the non-bypassable floor (budgets,\n * destructive operations, off-machine effects — implementation-spec P-28) hard-gates in ALL\n * presets regardless of this field.\" Do not restore that sentence: no such gate runs, and a\n * safety claim is the worst thing to leave standing on an unbuilt mechanism.\n */\nexport enum MetaWorkflow_ApprovalPolicy {\n  AUTO = \"auto\",\n  NOTIFY = \"notify\",\n  APPROVE_RESULT = \"approve_result\",\n  APPROVE_BEFORE = \"approve_before\",\n}\n\n/**\n * What the runner does when a playbook run fails mid-flight (review F-5) —\n * a failed CODING_AGENT run must never leave a silent half-applied\n * change-set: it is either reverted or kept and flagged for human triage.\n */\n/**\n * What a playbook run does with its partial work when it fails.\n *\n * **Read at the lane boundary since 2026-09-22 (#111), and only there.** A composite run that ended\n * with every child of an iteration failed carries this policy into the boundary decision it leaves\n * for a person: `revert_changeset` puts DISCARD first among the options, `keep_and_flag` keeps the\n * landings and flags the failure. Neither is performed by the runtime — git already makes every\n * landing visible and reversible, and a lane that failed on its last iteration may have landed good\n * work before it — so the reader decides. On a LEAF run the field is still authored intent only\n * (measured 2026-08-29, issue #103: zero consumers then), and `revert_changeset` has never been\n * performed by anything.\n */\nexport enum MetaWorkflow_FailurePolicy {\n  REVERT_CHANGESET = \"revert_changeset\",\n  KEEP_AND_FLAG = \"keep_and_flag\",\n}\n/** @wildo_source:part:end saas.specifications.playbook-approval-and-failure-policies */\n\n/**\n * Discriminant vocabulary for journey-snapshot predicates.\n *\n * Three of these gate on an artifact family and they are NOT interchangeable — the difference is the\n * PRECONDITION CLASS the runtime assigns each of them (`PRECONDITION_CLASS_BY_KIND`, application-creation\n * runtime), which decides whether a human may deliberately proceed past an unmet one:\n *\n * | kind | asks | class |\n * |---|---|---|\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_EXISTS} | does the family have content? | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_VALID} | …and does it pass its validator? | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_EXPECTED} | it SHOULD come first | SEQUENCING — a human may proceed |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_STALE} | the family's landed output was derived from inputs that have since MOVED | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_DECIDES} | a landed family DECIDED a given value | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.STEP_AVAILABLE} | a sibling in this choreography returned (a value) | READINESS — nobody proceeds |\n */\nexport enum MetaWorkflow_PredicateKind {\n  ARTIFACT_EXISTS = \"artifact_exists\",\n  /**\n   * The family's landed output is DERIVED-STALE: an input it was derived from has a commit newer\n   * than the output's, carries uncommitted edits, or the creator answered the producing interview\n   * after the output was committed (#57 — the loop-back gate; the annotation `staleOutputs` already\n   * computed the fact, this lets a lane AUTHOR route on it).\n   *\n   * Declared on the child that would RE-DERIVE the family, NEVER on the one that first produces it:\n   * a family with no committed version has no derivation to compare against, so the gate is\n   * unsatisfied and the child never runs. It is read against THAT child's own `inputs[]` — \"stale\"\n   * means stale for the purpose of the playbook about to re-derive it — so a re-derive child with an\n   * incomplete `inputs[]` under-reports exactly as the annotation does.\n   *\n   * READINESS: unsatisfied means \"the output is current, so re-deriving it would produce the same\n   * thing from the same inputs\", and nobody proceeds past that — not the loop, not a human. A human\n   * who wants a fresh derivation runs the PRODUCING playbook, which this gate never touches. (It was\n   * SEQUENCING for one day. Inside a choreography every lane child is admitted past SEQUENCING —\n   * the one production caller hardcodes it — so the gate was inert in the one place it exists for.)\n   *\n   * Git-derived and never stored (`one-source-of-truth.md`, Rule 0): the same tree yields the same\n   * answer after any merge, and an UNCOMMITTED output is a working edit, not a stale one.\n   */\n  ARTIFACT_STALE = \"artifact_stale\",\n  /**\n   * A SIBLING step in the same choreography has returned, and optionally returned a particular value.\n   *\n   * READINESS: a child gated on a sibling's return genuinely cannot run without it. It reads the\n   * parent run's step results — data that lives for the run and is never written to the tree — and\n   * NOT `artifactsByFamily`, which holds durable families. Keeping them in separate maps is what\n   * makes \"a step result can never be mistaken for an artifact\" a property of the type rather than a\n   * rule someone has to remember.\n   */\n  STEP_AVAILABLE = \"step_available\",\n  ARTIFACT_VALID = \"artifact_valid\",\n  /**\n   * This family is expected to be produced FIRST, and running without it is a legitimate choice.\n   *\n   * Added 2026-08-28 for a gap the vocabulary could not express. A compliance-document draft is better\n   * when the application's document facts already exist — but it must still be producible without them,\n   * with the statements it could not establish marked incomplete rather than refused. Neither existing\n   * artifact kind can say that: both are READINESS, so an unmet one blocks unconditionally, and simply\n   * dropping the precondition loses the ordering signal (`unmet` stops explaining WHY a run is early).\n   *\n   * Content-wise this asks exactly what {@link MetaWorkflow_PredicateKind.ARTIFACT_EXISTS} asks — one\n   * shared check answers both — so the ONLY difference is the class. Use it whenever running early\n   * degrades the output rather than invalidating it.\n   */\n  ARTIFACT_EXPECTED = \"artifact_expected\",\n  /**\n   * A landed family DECIDED something, and decided it one given way (#1606): \"run the website plan only\n   * when the capability composition says the website is NEEDED\".\n   *\n   * The other artifact kinds ask whether a family exists, is valid or moved. None can ask what it SAID, so\n   * a playbook whose work an earlier decision declined still ran, only to land \"not applicable\".\n   *\n   * `decision` names a DECLARED decision of that family and `equals` one member of its vocabulary. The\n   * declarations live with the families, in `@wildo-ai/saas-specifications`\n   * (`APPLICATION_SPECIFICATION_FAMILY_DECISIONS`), whose playbook contract refuses a decision or a value\n   * they do not declare: a typo here would otherwise make a playbook ineligible forever with nothing\n   * reporting it. A playbook is application-agnostic, so a decision is keyed by a FRAMEWORK vocabulary\n   * (a scenario ref), never by an element one application authored.\n   *\n   * READINESS: a declined website is not an ordering question a person may proceed past. The way forward\n   * is to change what the family decided, which the unmet verdict names.\n   */\n  ARTIFACT_DECIDES = \"artifact_decides\",\n}\n\n/**\n * Selects definition artifacts from the journey's artifact graph.\n *\n * `family` is a kebab-case artifact-family id (e.g. `market-snapshot`,\n * `requirements`, `vision-brief`, `roadmap`, `business-model`). It is intentionally an open string in\n * v1: artifact families grow with the methodology and per-app overrides;\n * the canonical family registry is owned by the assertion surface\n * (AssertionSpecification family, saas-specifications `_core/assertions/`)\n * rather than frozen in this enum. Precondition evaluation fails closed on\n * unknown families at runtime.\n */\n/**\n * WHAT a consumer needs from an artifact family — a request, answered per family by the renderer\n * that composes it into a prompt.\n *\n * ## Why this exists\n *\n * Measured on wonder-crm (2026-08-28): the market snapshot renders at **41KB** across 16\n * collections, and is an input to 10 of the 27 playbooks (re-measured 2026-09-21). A consumer that\n * needs one part of it still received all of it, next to vision, requirements, roadmap and feature\n * drafts, before its method and workspace truth are added.\n *\n * (An earlier revision gave `bottom_up.domain-plan` as the example, saying it \"needs `icps` + `jobs`\".\n * Its method names neither: its load-bearing market input is the BENEFITS wired to their delivering\n * features. The slice built from that sentence removed exactly the benefits — #1428. When a slice is\n * justified by a consumer's need, quote the consumer's method, not a summary of it.)\n *\n * A playbook was previously unable to say what it wanted, so the composer could only hand over\n * everything. That is not merely expensive: an artifact's most relevant paragraph competes for\n * attention with fifteen collections that have nothing to do with the task.\n *\n * ## A cross-family shorthand, answered by the aspect registry\n *\n * Since #1420 a playbook can name the exact aspects it reads (`inputs[].aspects`). Intent stays as the\n * coarse CROSS-FAMILY shorthand, and since #1421 it has no table of its own: each aspect declaration in\n * `FAMILY_ASPECTS_REGISTRY` (saas-specifications) states which intents it serves (`servesIntents`),\n * beside the schema that says what the aspect means. An intent resolves to the family's aspects that\n * declare it. A family none of whose aspects declares the intent renders in full: the request is\n * honoured or answered with everything, never silently narrowed to nothing.\n *\n * ABSENT means {@link MetaWorkflow_ArtifactIntent.FULL} — a playbook that has not been given an\n * intent keeps exactly the behaviour it had.\n */\nexport enum MetaWorkflow_ArtifactIntent {\n  /** Who the product is for. Market segments, personas, the jobs they are hiring it to do. */\n  AUDIENCE = 'audience',\n  /** What it must deliver and why that matters. Benefits, the jobs they advance, pains, gains, requirements. */\n  VALUE = 'value',\n  /** How it is described and sold. Positioning, tone, messaging, objections, pricing. */\n  VOICE = 'voice',\n  /*\n   * `PLAN` (\"what is sequenced and when\") was REMOVED 2026-09-21 (#1421). No playbook declared it and\n   * no family narrowed under it: its intended family, `build-plan`, is `{ version, tasks }`, so a PLAN\n   * slice kept everything, and its bulk is answered by the build-plan RENDERER instead. A member that\n   * looks like a narrowing and never narrows is a control that does nothing.\n   */\n  /** Everything the family holds. The default, and the honest answer when no aspect serves the request. */\n  FULL = 'full',\n}\n\n/**\n * Whether gathered evidence is sufficient to derive an artifact from — the adequacy verdict.\n *\n * Small and deliberately reusable: market analysis is the first consumer, but `compliance-posture`\n * (which regimes apply, in which jurisdictions) and `business-model` (pricing benchmarks) have the\n * same hole and will ask the same question of the same shape.\n *\n * It is a STEP output, never a landed family. The verdict decides whether a sibling may run and is\n * then discarded with the run; nothing downstream reads it, nobody commits it, and giving it a\n * durable home would be inventing a record with a lifecycle to hold a boolean that lived for ninety\n * seconds.\n */\nexport enum MetaWorkflow_EvidenceAdequacyVerdict {\n  /** Enough to derive from. The dependant step may run. */\n  ADEQUATE = 'adequate',\n  /** Not enough yet. `gaps` says what is missing, so the next research round is aimed rather than repeated. */\n  INSUFFICIENT = 'insufficient',\n}\n\nexport const MetaWorkflow_EvidenceAdequacySchema = z.object({\n  verdict: z.enum(MetaWorkflow_EvidenceAdequacyVerdict),\n  /**\n   * What is still missing, in the assessor's own words — the input to the NEXT round's objective.\n   *\n   * Required when INSUFFICIENT and the reason the loop is a loop rather than a retry: a re-run\n   * against the same objective asks the same question again, and the measured failure of that shape\n   * is two attempts spending real tokens to converge on nothing.\n   */\n  gaps: z.array(z.string().min(1)).default([]),\n  /** Why this verdict, against what was actually gathered. */\n  rationale: z.string().min(1),\n});\nexport type MetaWorkflow_EvidenceAdequacy = z.infer<typeof MetaWorkflow_EvidenceAdequacySchema>;\n\nexport const MetaWorkflow_ArtifactSelectorSchema = z.object({\n  family: z.string().min(1),\n  /**\n   * What this consumer needs from the family. Absent = {@link MetaWorkflow_ArtifactIntent.FULL}.\n   *\n   * Advisory to the COMPOSER, never to eligibility: a precondition asks whether an artifact is\n   * present and valid, which no intent changes. Narrowing what a playbook READS must never narrow\n   * what it WAITS FOR.\n   */\n  intent: z.enum(MetaWorkflow_ArtifactIntent).optional(),\n  /*\n   * `refs` and `pathHint` were REMOVED 2026-09-21 (#1420). Nothing read either — the same search that\n   * finds the real `selector.family` readers found none — and 0 of 63 compiled inputs authored one.\n   *\n   * Narrowing what a playbook reads does not belong here at all, because this selector also types\n   * PRECONDITIONS: a ref or an aspect on it would read as a readiness gate that eligibility never\n   * honours. The input-only narrowing (`aspects`, `render`, `related`) lives on\n   * `MetaWorkflowPlaybookInputSchema` in `@wildo-ai/saas-specifications/application-creation`, and it\n   * narrows by ASPECT, never by ref: a playbook is application-agnostic and cannot know element refs.\n   */\n});\nexport type MetaWorkflow_ArtifactSelector = z.infer<typeof MetaWorkflow_ArtifactSelectorSchema>;\n\n/**\n * Contract for an artifact a playbook produces: which family it lands in,\n * which Zod contract validates it, and where it is placed.\n *\n * `schemaRef` uses the pinned `<package-short>:<ExportName>` vocabulary\n * (implementation-spec P-33), e.g.\n * `saas-specifications:AssertionSpecificationSnapshot`. The framework-\n * knowledge audit format-checks it; the generator Zod-validates the whole\n * playbook against this schema.\n */\nexport const MetaWorkflow_ArtifactContractSchema = z.object({\n  family: z.string().min(1),\n  schemaRef: z\n    .string()\n    .regex(/^(saas-models|saas-specifications):[A-Za-z0-9_]+$/)\n    .optional(),\n  description: z.string().optional(),\n});\nexport type MetaWorkflow_ArtifactContract = z.infer<typeof MetaWorkflow_ArtifactContractSchema>;\n\n/**\n * Contract for a value a playbook returns to its PARENT choreography rather than landing as a file.\n *\n * ## The one field it does not have is the point\n *\n * There is no `family`. The landing service is the only thing that writes specification files, it is\n * driven by {@link MetaWorkflow_ArtifactContract}, and every landing target is resolved by FAMILY —\n * so a step output cannot be constructed into a landing request. \"A step result never becomes an\n * application artifact\" is therefore a property of the TYPE, not a convention. (TypeScript erases, so\n * the landing service also refuses a step ref at runtime; the type is the first line, not the whole\n * guarantee.)\n *\n * This paragraph credited `placement` until 2026-08-30, when that field was deleted for never having\n * been read. The invariant did not depend on it — `family` is required here too and a step output has\n * `ref` instead — but the prose had to be corrected rather than left pointing at a deleted field,\n * because a type-level guarantee nobody can locate is one the next author will remove by accident.\n *\n * A run's step results live in memory, feed the siblings that declared them as preconditions, and are\n * discarded when the run ends. Deleting all of them costs a re-run and never a fact\n * (`one-source-of-truth.md`, Rule 5) — which is exactly why they need no digest, receipt, acceptance\n * or lifecycle, and why introducing one would be the ceremony this whole design exists to avoid.\n *\n * ## `condensation` is required, and that is deliberate\n *\n * A parent's context is finite. The published multi-agent research architecture has subagents \"act\n * as intelligent filters\" precisely so the lead is not flooded, and `app-creation-dynamic-context.md`\n * design 4 says the same in our own words: a parent gets summaries at ITS resolution, not the child's\n * whole working set. A schema that permits an unbounded dump will receive one, so the contract asks\n * the producer to state what it is returning and how much.\n */\nexport const MetaWorkflow_StepOutputContractSchema = z.object({\n  /** Stable ref a sibling names in a {@link MetaWorkflow_PredicateKind.STEP_AVAILABLE} precondition. */\n  ref: z.string().min(1),\n  /** The `<package-short>:<ExportName>` contract the returned value is validated against, in memory. */\n  schemaRef: z\n    .string()\n    .regex(/^(saas-models|saas-specifications):[A-Za-z0-9_]+$/)\n    .optional(),\n  /** What this step returns, and at what resolution — the CONDENSATION contract, not a description of the work. */\n  condensation: z.string().min(1),\n  description: z.string().optional(),\n});\nexport type MetaWorkflow_StepOutputContract = z.infer<typeof MetaWorkflow_StepOutputContractSchema>;\n\n/**\n * A value assertion on a sibling's step result — the EVALUATOR-OPTIMIZER half.\n *\n * An adequacy gate that merely RAN is not the same as one that PASSED, and a loop that cannot tell\n * them apart is not a loop. The canonical pattern makes the evaluator's verdict a structured value\n * the loop condition READS, rather than prose narrated to a model that then decides whether it was\n * serious. Reading one declared field of a schema-validated result is not a ceremony.\n */\nexport const MetaWorkflow_StepValueAssertionSchema = z.object({\n  /** Dot path into the step result (e.g. `verdict`, `adequacy.verdict`). */\n  path: z.string().min(1),\n  /** The value that satisfies the gate. Absent means presence alone is enough. */\n  equals: z.union([z.string(), z.number(), z.boolean()]),\n});\nexport type MetaWorkflow_StepValueAssertion = z.infer<typeof MetaWorkflow_StepValueAssertionSchema>;\n\n/**\n * Typed predicates over the Journey Snapshot — playbook ELIGIBILITY gates\n * (design plan D2/KD-F). The choreographer LLM chooses among *eligible*\n * playbooks; it can never skip these gates. Predicates are evaluated\n * deterministically by the PlaybookRegistryService against the derived\n * snapshot; LLM interpretation cannot soften a failing predicate (S1\n * held-condition (a)).\n */\nconst _MetaWorkflow_JourneyPredicateSchema = z.discriminatedUnion(\"kind\", [\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_EXISTS),\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_VALID),\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_EXPECTED),\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_STALE),\n    /** The family whose landed output must be derived-stale for this playbook to be eligible. */\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_DECIDES),\n    /** The family that decides. */\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n    /** A decision that family declares, e.g. a composition scenario ref (`add-website`). */\n    decision: z.string().min(1),\n    /** The member of the decision's vocabulary that satisfies the gate, e.g. `NEEDED`. */\n    equals: z.string().min(1),\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.STEP_AVAILABLE),\n    /**\n     * The sibling's declared {@link MetaWorkflow_StepOutputContract.ref} — or the DERIVED ref under\n     * which a sibling leaf's advisory judge verdict is readable, `judge:<playbookRef>` (#1498, spelled\n     * by the runtime's `judgeVerdictStepRef`). That value is `{ definitionRef, overall, criteria }`\n     * with `criteria` keyed by criterion ref, so a revise child gates on\n     * `requires: { path: 'criteria.<criterionRef>', equals: 'GAP' }` and a waterfall gate on\n     * `requires: { path: 'overall', equals: 'PASS' }`. An unjudged landing stores nothing there: a\n     * technical failure is never a verdict and routes nowhere.\n     */\n    ref: z.string().min(1),\n    /** Optional value assertion. Absent = presence is enough. */\n    requires: MetaWorkflow_StepValueAssertionSchema.optional(),\n  }),\n]);\nexport const MetaWorkflow_JourneyPredicateSchema: typeof _MetaWorkflow_JourneyPredicateSchema =\n  _MetaWorkflow_JourneyPredicateSchema;\nexport type MetaWorkflow_JourneyPredicate = z.infer<typeof _MetaWorkflow_JourneyPredicateSchema>;\n\nexport const MetaWorkflow_ElicitationSpecSchema = z.object({\n  questions: z\n    .array(\n      z.object({\n        ref: z.string().min(1),\n        question: z.string().min(1),\n        kind: z.enum(HumanDecision_FieldKind),\n        /** Required when kind = CHOICE. */\n        options: z.array(z.string().min(1)).optional(),\n        /**\n         * The SAME DECISION another step already asks (#1454, gap 4): this question's answer IS that\n         * question's answer, so the creator is asked once. The dossier lists the decision at the step\n         * that owns it, and a run of this step reads that answer when it has none of its own.\n         *\n         * For a FALLBACK question — one a later step keeps for inputs authored before the earlier step\n         * asked it (`bottom_up.foundation`'s tenancy question, kept for plans without a `tenancy`\n         * field). Two steps asking one decision as two open questions invites two answers that\n         * disagree, and the dossier showed exactly that. Both questions must be the same KIND with the\n         * same OPTIONS, since one answer satisfies both; the catalog test holds that.\n         */\n        sameDecisionAs: z.object({\n          playbookRef: z.string().min(1),\n          questionRef: z.string().min(1),\n        }).optional(),\n      }),\n    )\n    .min(1),\n});\nexport type MetaWorkflow_ElicitationSpec = z.infer<typeof MetaWorkflow_ElicitationSpecSchema>;\n\n/**\n * Per-playbook budget ceilings a playbook may AUTHOR. No runtime currently\n * enforces them: the PlaybookRunner that was to be their enforcer was deleted\n * at the first-activation hard cut, and the demolition removed the budget\n * machinery with it — today the only live bound on unattended work is the\n * loop's iteration ceiling. Wiring an enforcer for these fields is tracked as\n * open work (spend ceiling for the unattended loop). CLI-transport coding\n * runs report no token usage, so cost accounting there would use wall-time +\n * run-count proxies.\n */\nexport const MetaWorkflow_PlaybookBudgetSchema = z.object({\n  maxCostUsd: z.number().positive().optional(),\n  /** Aggregate input allowance across a bounded working episode. */\n  maxInputTokens: z.number().int().positive().optional(),\n  /** Aggregate output allowance across a bounded working episode. */\n  maxOutputTokens: z.number().int().positive().optional(),\n  /** Model calls within an episode; intentionally separate from high-level candidate iterations. */\n  maxModelCalls: z.number().int().positive().optional(),\n  maxDurationMs: z.number().int().positive().optional(),\n  maxRuns: z.number().int().positive().optional(),\n});\nexport type MetaWorkflow_PlaybookBudget = z.infer<typeof MetaWorkflow_PlaybookBudgetSchema>;\n\n/**\n * THE playbook contract (design plan D2, verbatim). See the file-header\n * narrative for what a playbook is and where instances live.\n *\n * Field notes:\n * - `ref` is dot-namespaced `<phase-slug>.<name>` (e.g.\n *   `refinement.compliance-document-candidate`); `ref@version` is unique across the\n *   compiled catalog (audit rule R15).\n * - `method.guidance` is the refinable methodology prose (compiled from\n *   the playbook's `method.md`); `method.skillRefs` point at app-knowledge\n *   skills that carry the technical HOW — never inline it here.\n * - Journey-level autonomy PRESETS are NOT a playbook field — playbooks\n *   carry only their `approval` policy (review F-11).\n */\n/**\n * A composite's LOOP-BACK: when an assessing child's verdict faults, children that already landed in\n * this run are offered again.\n *\n * ## Why the runtime has to do this, and a revise child cannot\n *\n * Within one run a child that LANDED is delivered and never re-offered — landing it again from the\n * same inputs is waste the fourth live run measured. So a gate's GAP on \"requirement coverage\" could\n * reach the reader and route nothing: the leaf that must answer it had landed before the gate ran. A\n * dedicated revise playbook was the other shape, and it was rejected: it restates the leaf's inputs,\n * outputs and skills as a second description that drifts (one per criterion), or claims every family\n * a gate can fault and re-derives all of them when one faulted. The criterion → leaf map already\n * existed as a table in the lane's method, read by a person; this makes that table the mechanism.\n *\n * ## What a reopening does, exactly\n *\n * After the assessing child settles with a routable verdict, every reopening naming it whose verdict\n * (the criterion's, or the overall one when no criterion is named) is in `verdicts` removes the\n * `reopen` children from the run's delivered set. They are then eligible like any other child, and the\n * selector sees why. It re-offers; it never forces a dispatch, and it deletes no artifact. A PASS\n * re-opens nothing, so a lane that passes ends as it did before.\n *\n * ## Across lanes — `via`\n *\n * A verdict raised INSIDE a nested lane stays in that lane's scope unless the lane exports it: a lane\n * that lists the derived ref `judge:<leaf>` in its own `stepOutputs` returns that verdict to its parent\n * like any exported value. The parent then declares the reopening with `via: <that lane>`, and may\n * re-open a SIBLING lane. What the sibling re-runs is not forced from here: the round history tells\n * its selector which verdict re-opened it and on which criterion, and its own selection picks the leaf\n * (#1627). Code gates the kind of work; the model composes the task, as everywhere else in a composite.\n *\n * Refs must be admitted by the same composite (`whenVerdictOf` only when there is no `via`), refused\n * at parse rather than discovered as a loop-back that silently never fires. A child may re-open ITSELF: a leaf that lands and is judged (the business\n * model is both) is re-offered on its own GAP, which is the plainest loop-back there is.\n */\nexport const MetaWorkflow_ChoreographyReopeningSchema = z.strictObject({\n  /** The ASSESSING playbook whose verdict decides, e.g. `top_down.phase-gate` — admitted here, or inside `via`. */\n  whenVerdictOf: z.string().min(1),\n  /** The admitted LANE through which that verdict arrives, when the assessing playbook is inside it. */\n  via: z.string().min(1).optional(),\n  /** One criterion's verdict, e.g. `application-creation:criterion/requirement-coverage`. Absent: the overall verdict. */\n  criterionRef: z.string().min(1).optional(),\n  /** The verdicts that re-open — usually `[GAP]`. */\n  verdicts: z.array(z.enum(MetaWorkflow_EvaluationVerdict)).min(1),\n  /** The admitted children offered again, e.g. `['top_down.scope-roadmap']`. */\n  reopen: z.array(z.string().min(1)).min(1),\n});\nexport type MetaWorkflow_ChoreographyReopening = z.infer<typeof MetaWorkflow_ChoreographyReopeningSchema>;\n\n/**\n * A playbook that ORCHESTRATES other playbooks instead of producing an artifact itself.\n *\n * ## Why this is an admissible SET and never a sequence\n *\n * `admits` is unordered by contract. Order comes from the children's own preconditions, re-evaluated\n * against the tree and the run's step results at every iteration, plus the model's selection among\n * whatever is eligible. That is the difference between a choreography and a workflow, and it is the\n * property the whole design turns on: *\"Playbooks are choreography guides, not static workflows. The\n * system plays a choreography REACTIVELY to determine what should be done\"*\n * (`.claude/rules/application-creation-directive.md`).\n *\n * A recursive `children[]` was considered and rejected in the mined corpus for exactly this reason —\n * the name invites a fixed sequence and the next author writes one. So does an ordered array here.\n *\n * ## The model invents the TASK; code gates only the KIND of work and the bounds\n *\n * A child is dispatched against an OBJECTIVE the model composes for that dispatch, adapted to what\n * earlier rounds returned — which is what makes a research→reframe→re-search loop possible at all,\n * and what would be thrown away by a schema that enumerated the tasks. This is the published\n * orchestrator-worker shape: a lead agent INVENTS its workers' objectives rather than selecting them\n * from a menu; what is authored is the worker's SHAPE.\n *\n * ⚠ An earlier draft of this design put a `MetaWorkflow_ChildKind` enum between `admits` and the\n * playbooks, so a composite named KINDS and a kind resolved to a playbook. It is not built: no\n * playbook implements more than one kind and no kind has more than one playbook, so the vocabulary\n * would have been a 1:1 indirection over the refs — speculative structure, which this plan's own\n * rule (\"no schema without a consumer\") forbids. The anti-sequence property comes from the SET plus\n * the eligibility mechanism, never from the vocabulary. Add the enum when two playbooks genuinely\n * implement one shape of work.\n */\nexport const MetaWorkflow_ChoreographySchema = z.object({\n  /**\n   * Playbook refs this composite may run. UNORDERED — a set, not a sequence.\n   *\n   * At least two: a composite over one child is that child with extra machinery, and the machinery is\n   * the thing worth not having.\n   */\n  admits: z.array(z.string().min(1)).min(2),\n  /**\n   * Iteration ceiling for the child loop — a CIRCUIT BREAKER, deliberately generous.\n   *\n   * It exists to stop a loop spinning, never to refuse work for want of budget. Nothing here or\n   * anywhere else in this lane refuses on grounds of SPEND: a fail-closed accounting guard already\n   * cost this framework a live application once, and CLI-transport runs report no token usage at all,\n   * so a token ceiling on an agent lane is unmeasurable by construction. Spend is measured and\n   * reported; it is never a gate.\n   */\n  maximumIterations: z.number().int().positive().max(20).default(6),\n  /** Children per iteration. Research is breadth-first, so the default matches the journey loop's 3. */\n  maximumLanesPerIteration: z.number().int().positive().max(5).default(3),\n  /**\n   * How deep composition may nest BELOW this composite — a CIRCUIT BREAKER on recursion.\n   *\n   * `1` (the default) means this composite's children may not themselves be composites; `2` admits\n   * a lane of leaves under it, and so on. A nested composite runs through the same choreography\n   * service one level down (#1497): its exported step values return into this run's scope under the\n   * refs its own `stepOutputs[]` declare, its landings report through the same channel, and its\n   * checkpoint nests inside this one so a resumed parent resumes the child.\n   *\n   * The ceiling is INHERITED downward and the tightest ancestor wins: a lane declaring `2` under a\n   * root declaring `2` still cannot open a third level, because the root's breaker is the outer\n   * breaker. A composite selected past the ceiling is withheld from the eligible set (traced, never\n   * silent), and a run started past it stops at once with the `DEPTH_CEILING` stop reason — the\n   * guard the runtime cannot be talked out of by a caller threading the wrong depth.\n   *\n   * It was removed on 2026-09-08 (#488) because the runtime took a `depth` its one caller never\n   * passed, so the ceiling bounded nothing and read as a control. It is back with the recursion\n   * that gives it something to bound, and with the caller that threads depth — the two came back\n   * together, as the removal note required.\n   */\n  maximumDepth: z.number().int().positive().max(5).default(1),\n  /** Wall-clock breaker for the whole composite. A hung agent is the runaway a count cannot catch. */\n  maximumDurationMs: z.number().int().positive().default(30 * 60_000),\n  /** Loop-back on an assessing child's verdict — see {@link MetaWorkflow_ChoreographyReopeningSchema}. */\n  reopenOnVerdict: z.array(MetaWorkflow_ChoreographyReopeningSchema).optional(),\n  /**\n   * Admitted children that act on the APPLICATION even when this composite runs as an INSTANCE (#1608).\n   *\n   * A child inherits its composite's instance by default (#1609), so a segment's research is the segment's.\n   * Some children cannot have an instance: they refresh what the application holds once, such as the domain\n   * plan, the build plan or the build itself, and an instance may never replace those. A composite that\n   * exists to feed such a refresh (a feature line: the feature lands as elements, then the application's\n   * plans re-derive) names those children here, and they run as the default instance.\n   *\n   * Declared, never derived from a child's outputs: deriving \"runs as the application\" from \"produces a\n   * single-value family\" would let a market-segment instance rewrite the application's market snapshot.\n   */\n  actsOnApplication: z.array(z.string().min(1)).optional(),\n}).superRefine((choreography, context) => {\n  const admitted = new Set(choreography.admits);\n  (choreography.actsOnApplication ?? []).forEach((ref, index) => {\n    if (!admitted.has(ref)) {\n      context.addIssue({ code: 'custom', path: ['actsOnApplication', index], message: `\"${ref}\" is not admitted by this composite, so it can never act for it.` });\n    }\n  });\n  (choreography.reopenOnVerdict ?? []).forEach((reopening, index) => {\n    for (const ref of [reopening.via ?? reopening.whenVerdictOf, ...reopening.reopen]) {\n      if (!admitted.has(ref)) {\n        context.addIssue({ code: 'custom', path: ['reopenOnVerdict', index], message: `\"${ref}\" is not admitted by this composite, so this reopening could never fire.` });\n      }\n    }\n  });\n});\nexport type MetaWorkflow_Choreography = z.infer<typeof MetaWorkflow_ChoreographySchema>;\n\n/**\n * The panel a deliberated playbook convenes.\n *\n * Role refs resolve against `EXPERT_ROLE_TEMPLATES`, and the narrowness gate is\n * TWO-AXIS: the rubric-deriver must OWN `workDomain` (`template.workDomains`), while\n * every reviewer need only REVIEW it (`template.reviewScopes`) — which is what lets a\n * design-system guardian sit on an information-architecture panel as the coherence\n * memory without owning the domain.\n */\nexport const MetaWorkflow_PlaybookDeliberationSchema = z.object({\n  /** The routing axis. Every reviewer's role must have this in its review scopes. */\n  workDomain: z.enum(ExpertWorkDomain),\n  /** The reviewing panel — at least two, because one reviewer is a judge, not a deliberation. */\n  reviewerRoleRefs: z.array(z.string().min(1)).min(2),\n  /** The coordinator: shortlist, convergence, synthesis. Not domain-gated — it is the manager hat. */\n  coordinatorRoleRef: z.string().min(1),\n  /** Who derives the rubric. Must OWN the domain. Defaults to the first reviewer. */\n  rubricDeriverRoleRef: z.string().min(1).optional(),\n  /**\n   * How many distinct candidates to generate before the panel sees anything.\n   *\n   * Bounded at 2–5: one candidate is nothing to deliberate over, and past five the\n   * cost grows faster than the disagreement does.\n   */\n  candidateCount: z.number().int().min(2).max(5).default(3),\n  /** Max rounds before forced synthesis. The engine's own default is 2. */\n  roundBudget: z.number().int().min(1).max(3).optional(),\n  /** Top-K candidates revised per round. */\n  shortlistSize: z.number().int().min(1).optional(),\n});\nexport type MetaWorkflow_PlaybookDeliberation = z.infer<typeof MetaWorkflow_PlaybookDeliberationSchema>;"]}
+{"version":3,"file":"orchestration.meta-workflows.shared.schemas.js","sourceRoot":"","sources":["../../../../src/meta-workflows/orchestration.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAEjJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAN,IAAY,qBAiBX;AAjBD,WAAY,qBAAqB;IAC/B,4DAAmC,CAAA;IACnC,sDAA6B,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,0DAAiC,CAAA;IACjC,wCAAe,CAAA;IACf,gEAAuC,CAAA;AACzC,CAAC,EAjBW,qBAAqB,KAArB,qBAAqB,QAiBhC;AAED,0IAA0I;AAC1I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,4CAAa,CAAA;IACb,gDAAiB,CAAA;IACjB,gEAAiC,CAAA;IACjC,gEAAiC,CAAA;AACnC,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAED;;;;GAIG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,mEAAqC,CAAA;IACrC,6DAA+B,CAAA;AACjC,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AACD,wFAAwF;AAExF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,0BAmEX;AAnED,WAAY,0BAA0B;IACpC,iEAAmC,CAAA;IACnC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,+DAAiC,CAAA;IACjC;;;;;;;;OAQG;IACH,+DAAiC,CAAA;IACjC,+DAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAuC,CAAA;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,mEAAqC,CAAA;AACvC,CAAC,EAnEW,0BAA0B,KAA1B,0BAA0B,QAmErC;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,2BAeX;AAfD,WAAY,2BAA2B;IACrC,4FAA4F;IAC5F,oDAAqB,CAAA;IACrB,8GAA8G;IAC9G,8CAAe,CAAA;IACf,uFAAuF;IACvF,8CAAe,CAAA;IACf;;;;;OAKG;IACH,yGAAyG;IACzG,4CAAa,CAAA;AACf,CAAC,EAfW,2BAA2B,KAA3B,2BAA2B,QAetC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,oCAKX;AALD,WAAY,oCAAoC;IAC9C,yDAAyD;IACzD,6DAAqB,CAAA;IACrB,6GAA6G;IAC7G,qEAA6B,CAAA;AAC/B,CAAC,EALW,oCAAoC,KAApC,oCAAoC,QAK/C;AAED,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACrD;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;;;;OASG;CACJ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,mDAAmD,CAAC;SAC1D,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,sGAAsG;IACtG,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,mDAAmD,CAAC;SAC1D,QAAQ,EAAE;IACb,iHAAiH;IACjH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,0EAA0E;IAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;CACvD,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,iBAAiB,CAAC;QAC7D,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D,6FAA6F;QAC7F,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,gBAAgB,CAAC;QAC5D,+BAA+B;QAC/B,QAAQ,EAAE,mCAAmC;QAC7C,wFAAwF;QACxF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,sFAAsF;QACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,cAAc,CAAC;QAC1D;;;;;;;;WAQG;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,6DAA6D;QAC7D,QAAQ,EAAE,qCAAqC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,oCAAoC,CAAC;AAGvC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,qCAQX;AARD,WAAY,qCAAqC;IAC/C;;;;;OAKG;IACH,4GAAmE,CAAA;AACrE,CAAC,EARW,qCAAqC,KAArC,qCAAqC,QAQhD;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;QACrC,uEAAuE;QACvE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC9C;;;;WAIG;QACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;QACrE;;;;;;;;;;WAUG;QACH,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;YACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC/B,CAAC,CAAC,QAAQ,EAAE;QACb;;;WAGG;QACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;QAC/D;;;WAGG;QACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;QACrE;;;WAGG;QACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;CACV,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,kEAAkE;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,mEAAmE;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,YAAY,CAAC;IACrE,iHAAiH;IACjH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,wHAAwH;IACxH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,mDAAmD;IACnD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,8EAA8E;IAC9E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,sGAAsG;IACtG,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,oGAAoG;IACpG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC;IACnE,wGAAwG;IACxG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,QAAQ,EAAE;IAC7E;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD;;;;;;;;;;;OAWG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,YAAY,CAAC,WAAW,yEAAyE,EAAE,CAAC,CAAC;IAC9K,CAAC;IACD,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,kEAAkE,EAAE,CAAC,CAAC;QAC/J,CAAC;IACH,CAAC,CAAC,CAAC;IACH,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QAChE,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,0EAA0E,EAAE,CAAC,CAAC;YACrK,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,mFAAmF;IACnF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACpC,+FAA+F;IAC/F,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,oGAAoG;IACpG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,mFAAmF;IACnF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,yEAAyE;IACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC","sourcesContent":["/**\n * Playbook-step ORCHESTRATION vocabulary: how a step is executed, gated, budgeted, contracted and\n * deliberated over — independent of what is being built.\n *\n * ## Why these are here and not in application creation\n *\n * They were declared in `@wildo-ai/saas-specifications/application-creation` until 2026-09-19\n * (#1342), which meant a generic orchestration engine could not type a step graph, an executor\n * tier, a budget, a choreography or a deliberation without importing the app-creation domain. The\n * `MetaWorkflow_` prefix these symbols already carried was asserting membership of the shared\n * domain while the declaration sat on the other side of the package line.\n *\n * ## What deliberately did NOT come with them\n *\n * `MetaWorkflow_Phase` (top-down / bottom-up / refinement) and `MetaWorkflow_FunctionalTopic` (the\n * seven-topic app-build taxonomy) name app-creation METHODOLOGY and stay there, as does\n * `MetaWorkflowPlaybookSchema` itself — a playbook is an app-creation artifact composed FROM this\n * vocabulary, which is the dependency running the right way.\n *\n * `MetaWorkflow_ArtifactIntent` DID come, against #1342's own table, and the enum's own heading is\n * why: \"A cross-family shorthand, answered by the aspect registry\". Its four members — audience,\n * value, voice, full (`plan` was removed, #1421) — are cross-family requests, so no per-family\n * vocabulary lives here: each family answers them through `FamilyAspectDeclaration.servesIntents`\n * in saas-specifications, and `MetaWorkflow_ArtifactSelectorSchema` cannot be typed without the enum. It\n * was the single backwards edge in the split, and the classification rather than the code was what\n * turned out to be wrong.\n *\n * ## The elicitation question kind is no longer aliased\n *\n * `MetaWorkflow_ElicitationQuestionKind` was `typeof HumanDecision_FieldKind` — a second name for an\n * engine enum, reached for by the companion specifically to dodge a `TS2742`. On this side of the\n * line the spec names {@link HumanDecision_FieldKind} directly, which is the door that always owned\n * the vocabulary.\n */\nimport { z } from \"zod\";\n\nimport { ExpertWorkDomain } from \"../flows-actors/deliberation.shared.schemas\";\nimport { HumanDecision_FieldKind } from \"../flows-actors/human-decision.shared.schemas\";\nimport { MetaWorkflow_EvaluationVerdict } from \"./decisions.meta-workflows.shared.schemas\";\nimport { MetaWorkflow_ElicitationQuestionDepth, MetaWorkflow_ElicitationUnknownPolicy } from \"./elicitation-depth.meta-workflows.shared.schemas\";\n\n/**\n * Which execution tier runs a playbook (design plan D4):\n * - COMPANION_AGENT — API-transport LLM agent invoked by the companion\n *   (definition work: market analysis, requirements drafting, judging).\n * - CODING_AGENT — CLI coding agent (Claude Code) dispatched one-shot into\n *   the project workspace with app-knowledge loaded.\n * - HUMAN — the creator performs the step (interview answers, reviews).\n * - DETERMINISTIC_CLI — a non-LLM `wildo` command (config sync, validate…).\n *\n * There is deliberately NO `COMPOSITE`. It was removed 2026-08-29 (issue #115): it answered a\n * different question from every other member — not *which tier runs this step* but *this is not one\n * step* — so it became the catch-all, and four playbooks carried it meaning three different things\n * (a real choreography, a bespoke deterministic executor, and two coding-agent dispatches). Nothing\n * ever branched on it; composition is read from `method.choreography`, and the child dispatch keys\n * there deliberately. Splitting it was rejected too: `CHOREOGRAPHY` / `DETERMINISTIC_EXECUTOR` are\n * the two arms of the engine's `FlowActorSystem` union, and this contract stays engine-agnostic (see\n * P-1 above).\n *\n * The runtime honours FOUR of these five by branching, and refuses the fifth by name. Re-measured\n * 2026-09-02 against `playbook-run.companion.service.ts`:\n *\n * | tier | how it is honoured | authors |\n * |---|---|---|\n * | `COMPANION_AGENT` | the DEFAULT path — right without branching | 17 declared + 2 undeclared |\n * | `RESEARCH_AGENT` | `runChoreographyChild` routes the read-only lane (`:928`) | 1 |\n * | `CODING_AGENT` | dispatches the next build task via `ApplicationBuildDispatchService` (`:2022`), and carries child step outputs (`:959`) | 2 |\n * | `DETERMINISTIC_CLI` | runs the host-owned check set for the playbook's ref (`:2087`) | 1 |\n * | `HUMAN` | REFUSES by name (`:2131`) — the contract is undecided, and silence was the defect | 0 |\n *\n * A tier is therefore a real routing key: any playbook declaring `CODING_AGENT` or\n * `DETERMINISTIC_CLI` gets that mechanism with no host edit, which is precisely what separates a TIER\n * from the bespoke executor keyed to `bottom_up.foundation`'s ref.\n *\n * ## What this paragraph used to say, and why it is worth recording\n *\n * Until 2026-09-02 it said the runtime honours ONE of the five, that `CODING_AGENT` is \"honoured by\n * nothing — reachable only through its own companion HTTP endpoints\", and that `HUMAN` and\n * `DETERMINISTIC_CLI` \"have no authors at all\". All three were true when written (2026-08-29, issue\n * #119) and all three were fixed within days: #119 wired the executor branch, and `assemble-verify`\n * came back with `DETERMINISTIC_CLI` (`11b78bb5`). Nothing updated the sentence.\n *\n * It then did real damage: a session planning new work read this paragraph, concluded a playbook\n * could not reach the coding lane by declaring a tier, and reported that constraint as measured fact.\n * The runtime had disagreed for days. **Prose describing what the runtime does is an artifact that\n * goes stale exactly like a compiled one** — see `.claude/rules/staleness-presents-as-a-logic-defect.md`\n * — and a docstring stating a NEGATIVE capability is the most dangerous shape, because a reader who\n * believes it stops looking. Verify against the branch, not against this comment.\n */\nexport enum MetaWorkflow_Executor {\n  COMPANION_AGENT = \"companion_agent\",\n  CODING_AGENT = \"coding_agent\",\n  /**\n   * READ-ONLY agent with web access — the evidence lane.\n   *\n   * Distinct from {@link CODING_AGENT} despite sharing the transport, because the two have opposite\n   * postures and the difference is enforced, not stylistic: a research run is admitted under a\n   * permission ceiling that pre-approves only the protocol's NON-MUTATING tool kinds, and its\n   * dispatch refuses every filesystem path. Distinct from {@link COMPANION_AGENT} because that is an\n   * API call with no tools at all — which is precisely what left `top_down.market-analysis` claiming\n   * derivation from \"sealed research evidence\" while its executing agent could reach nothing but its\n   * own training data.\n   */\n  RESEARCH_AGENT = \"research_agent\",\n  HUMAN = \"human\",\n  DETERMINISTIC_CLI = \"deterministic_cli\",\n}\n\n/** @wildo_source:part:start saas.specifications.playbook-approval-and-failure-policies facet:layer:shared facet:audience:app-developer */\n/**\n * Per-playbook approval posture (design plan OQ-3).\n *\n * ⚠️ **Read since 2026-09-22 (#111) at ONE KIND of place: the boundary of a COMPOSITE run.** When a\n * lane (a playbook declaring `method.choreography`) ends, ITS OWN `approval` decides whether the run\n * leaves a person an `approve_result` decision on the decision plane about the files its children\n * landed — `auto` owes nothing, `notify` owes a record, `approve_result` and `approve_before` owe the\n * decision (nothing suspends BEFORE a run, so the stronger reading of `approve_before` is honoured\n * at the boundary that exists). One run can therefore leave SEVERAL: a root composite's own, plus\n * one for every nested lane that owed one, because a lane is where the question genuinely arises —\n * inside one run a lane lands the domain plan and the next builds on it. The autonomy posture\n * decides what a decision DOES: under the decided YOLO posture it is recorded on the run's row and\n * the run concludes — a marked gate that notifies and proceeds; holding the run for it is the GUIDED\n * posture's and is not built.\n *\n * On a LEAF playbook the field is still authored intent only: a leaf run is not gated, and a leaf\n * whose JSON reads `\"approval\": \"approve_before\"` runs when it is asked to run. Do not tell a creator\n * a leaf run is held pending approval. The same holds for the failure policy below, which the same\n * lane boundary reads to frame the decision (discard first under `revert_changeset`) and never to\n * revert on its own.\n *\n * **Measured 2026-08-29 alongside issue #103,** before the boundary existed:\n * `MetaWorkflow_ApprovalPolicy` had zero consumers outside this file and the 20 playbook\n * definitions that author it. The same is true of the journey-level `Journey_AutonomyPreset` that\n * was to map over it, and of the `wildo journey set-autonomy` command its JSDoc names — that\n * command exists in no CLI. So a playbook declaring `APPROVE_BEFORE` is not gated, and one\n * declaring `AUTO` is not thereby unattended.\n *\n * It is kept rather than deleted because — unlike the `qualityGates` field removed in the same\n * pass — nothing else delivers it. `qualityGates` was a second description of live checks;\n * this is a real posture nobody has built, and deleting it would discard the design rather than\n * the duplication. Build-or-delete is a decision, tracked as its own issue (#111).\n *\n * **DECIDED 2026-08-30: DEFERRED, and the deferral is the point.** Not \"we did not get to it\" —\n * `application-creation-directive.md` says the system must WORK first and that restrictions arrive\n * later, from a real incident, as judge-style guards rather than ceremony wired into the mechanism.\n * An inert approval policy is therefore the INTENDED posture right now, not a hole to plug.\n *\n * So read the effective state precisely, because the two halves differ:\n *\n * - **Running is unattended.** Nothing gates a playbook run — no preset, no policy, no failure\n *   handling. That is full-YOLO behaviour, arrived at by absence rather than by declaration.\n * - **Accepting is not — but by ABSENCE, not by rule.** Nothing in the runtime performs a commit\n *   (re-verified 2026-09-06), so acceptance is a human `git commit` because no other path exists.\n *\n * The rule conflict this comment used to record — `one-source-of-truth.md` Rule 3 read as \"only a\n * human commits\" against the directive's YOLO row — was SETTLED by D5's amendment on 2026-09-03: the\n * autonomy posture governs who commits, the posture is YOLO for all, and \"only a human commits\"\n * describes GUIDED rather than a floor. So this is now a missing mechanism, not an undecided rule;\n * see `journey.application-creation.schemas.ts` for what building it still owes.\n *\n * The paragraph here claimed until 2026-08-29 that \"the non-bypassable floor (budgets,\n * destructive operations, off-machine effects — implementation-spec P-28) hard-gates in ALL\n * presets regardless of this field.\" Do not restore that sentence: no such gate runs, and a\n * safety claim is the worst thing to leave standing on an unbuilt mechanism.\n */\nexport enum MetaWorkflow_ApprovalPolicy {\n  AUTO = \"auto\",\n  NOTIFY = \"notify\",\n  APPROVE_RESULT = \"approve_result\",\n  APPROVE_BEFORE = \"approve_before\",\n}\n\n/**\n * What the runner does when a playbook run fails mid-flight (review F-5) —\n * a failed CODING_AGENT run must never leave a silent half-applied\n * change-set: it is either reverted or kept and flagged for human triage.\n */\n/**\n * What a playbook run does with its partial work when it fails.\n *\n * **Read at the lane boundary since 2026-09-22 (#111), and only there.** A composite run that ended\n * with every child of an iteration failed carries this policy into the boundary decision it leaves\n * for a person: `revert_changeset` puts DISCARD first among the options, `keep_and_flag` keeps the\n * landings and flags the failure. Neither is performed by the runtime — git already makes every\n * landing visible and reversible, and a lane that failed on its last iteration may have landed good\n * work before it — so the reader decides. On a LEAF run the field is still authored intent only\n * (measured 2026-08-29, issue #103: zero consumers then), and `revert_changeset` has never been\n * performed by anything.\n */\nexport enum MetaWorkflow_FailurePolicy {\n  REVERT_CHANGESET = \"revert_changeset\",\n  KEEP_AND_FLAG = \"keep_and_flag\",\n}\n/** @wildo_source:part:end saas.specifications.playbook-approval-and-failure-policies */\n\n/**\n * Discriminant vocabulary for journey-snapshot predicates.\n *\n * Three of these gate on an artifact family and they are NOT interchangeable — the difference is the\n * PRECONDITION CLASS the runtime assigns each of them (`PRECONDITION_CLASS_BY_KIND`, application-creation\n * runtime), which decides whether a human may deliberately proceed past an unmet one:\n *\n * | kind | asks | class |\n * |---|---|---|\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_EXISTS} | does the family have content? | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_VALID} | …and does it pass its validator? | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_EXPECTED} | it SHOULD come first | SEQUENCING — a human may proceed |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_STALE} | the family's landed output was derived from inputs that have since MOVED | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.ARTIFACT_DECIDES} | a landed family DECIDED a given value | READINESS — nobody proceeds |\n * | {@link MetaWorkflow_PredicateKind.STEP_AVAILABLE} | a sibling in this choreography returned (a value) | READINESS — nobody proceeds |\n */\nexport enum MetaWorkflow_PredicateKind {\n  ARTIFACT_EXISTS = \"artifact_exists\",\n  /**\n   * The family's landed output is DERIVED-STALE: an input it was derived from has a commit newer\n   * than the output's, carries uncommitted edits, or the creator answered the producing interview\n   * after the output was committed (#57 — the loop-back gate; the annotation `staleOutputs` already\n   * computed the fact, this lets a lane AUTHOR route on it).\n   *\n   * Declared on the child that would RE-DERIVE the family, NEVER on the one that first produces it:\n   * a family with no committed version has no derivation to compare against, so the gate is\n   * unsatisfied and the child never runs. It is read against THAT child's own `inputs[]` — \"stale\"\n   * means stale for the purpose of the playbook about to re-derive it — so a re-derive child with an\n   * incomplete `inputs[]` under-reports exactly as the annotation does.\n   *\n   * READINESS: unsatisfied means \"the output is current, so re-deriving it would produce the same\n   * thing from the same inputs\", and nobody proceeds past that — not the loop, not a human. A human\n   * who wants a fresh derivation runs the PRODUCING playbook, which this gate never touches. (It was\n   * SEQUENCING for one day. Inside a choreography every lane child is admitted past SEQUENCING —\n   * the one production caller hardcodes it — so the gate was inert in the one place it exists for.)\n   *\n   * Git-derived and never stored (`one-source-of-truth.md`, Rule 0): the same tree yields the same\n   * answer after any merge, and an UNCOMMITTED output is a working edit, not a stale one.\n   */\n  ARTIFACT_STALE = \"artifact_stale\",\n  /**\n   * A SIBLING step in the same choreography has returned, and optionally returned a particular value.\n   *\n   * READINESS: a child gated on a sibling's return genuinely cannot run without it. It reads the\n   * parent run's step results — data that lives for the run and is never written to the tree — and\n   * NOT `artifactsByFamily`, which holds durable families. Keeping them in separate maps is what\n   * makes \"a step result can never be mistaken for an artifact\" a property of the type rather than a\n   * rule someone has to remember.\n   */\n  STEP_AVAILABLE = \"step_available\",\n  ARTIFACT_VALID = \"artifact_valid\",\n  /**\n   * This family is expected to be produced FIRST, and running without it is a legitimate choice.\n   *\n   * Added 2026-08-28 for a gap the vocabulary could not express. A compliance-document draft is better\n   * when the application's document facts already exist — but it must still be producible without them,\n   * with the statements it could not establish marked incomplete rather than refused. Neither existing\n   * artifact kind can say that: both are READINESS, so an unmet one blocks unconditionally, and simply\n   * dropping the precondition loses the ordering signal (`unmet` stops explaining WHY a run is early).\n   *\n   * Content-wise this asks exactly what {@link MetaWorkflow_PredicateKind.ARTIFACT_EXISTS} asks — one\n   * shared check answers both — so the ONLY difference is the class. Use it whenever running early\n   * degrades the output rather than invalidating it.\n   */\n  ARTIFACT_EXPECTED = \"artifact_expected\",\n  /**\n   * A landed family DECIDED something, and decided it one given way (#1606): \"run the website plan only\n   * when the capability composition says the website is NEEDED\".\n   *\n   * The other artifact kinds ask whether a family exists, is valid or moved. None can ask what it SAID, so\n   * a playbook whose work an earlier decision declined still ran, only to land \"not applicable\".\n   *\n   * `decision` names a DECLARED decision of that family and `equals` one member of its vocabulary. The\n   * declarations live with the families, in `@wildo-ai/saas-specifications`\n   * (`APPLICATION_SPECIFICATION_FAMILY_DECISIONS`), whose playbook contract refuses a decision or a value\n   * they do not declare: a typo here would otherwise make a playbook ineligible forever with nothing\n   * reporting it. A playbook is application-agnostic, so a decision is keyed by a FRAMEWORK vocabulary\n   * (a scenario ref), never by an element one application authored.\n   *\n   * READINESS: a declined website is not an ordering question a person may proceed past. The way forward\n   * is to change what the family decided, which the unmet verdict names.\n   */\n  ARTIFACT_DECIDES = \"artifact_decides\",\n}\n\n/**\n * Selects definition artifacts from the journey's artifact graph.\n *\n * `family` is a kebab-case artifact-family id (e.g. `market-snapshot`,\n * `requirements`, `vision-brief`, `roadmap`, `business-model`). It is intentionally an open string in\n * v1: artifact families grow with the methodology and per-app overrides;\n * the canonical family registry is owned by the assertion surface\n * (AssertionSpecification family, saas-specifications `_core/assertions/`)\n * rather than frozen in this enum. Precondition evaluation fails closed on\n * unknown families at runtime.\n */\n/**\n * WHAT a consumer needs from an artifact family — a request, answered per family by the renderer\n * that composes it into a prompt.\n *\n * ## Why this exists\n *\n * Measured on wonder-crm (2026-08-28): the market snapshot renders at **41KB** across 16\n * collections, and is an input to 10 of the 27 playbooks (re-measured 2026-09-21). A consumer that\n * needs one part of it still received all of it, next to vision, requirements, roadmap and feature\n * drafts, before its method and workspace truth are added.\n *\n * (An earlier revision gave `bottom_up.domain-plan` as the example, saying it \"needs `icps` + `jobs`\".\n * Its method names neither: its load-bearing market input is the BENEFITS wired to their delivering\n * features. The slice built from that sentence removed exactly the benefits — #1428. When a slice is\n * justified by a consumer's need, quote the consumer's method, not a summary of it.)\n *\n * A playbook was previously unable to say what it wanted, so the composer could only hand over\n * everything. That is not merely expensive: an artifact's most relevant paragraph competes for\n * attention with fifteen collections that have nothing to do with the task.\n *\n * ## A cross-family shorthand, answered by the aspect registry\n *\n * Since #1420 a playbook can name the exact aspects it reads (`inputs[].aspects`). Intent stays as the\n * coarse CROSS-FAMILY shorthand, and since #1421 it has no table of its own: each aspect declaration in\n * `FAMILY_ASPECTS_REGISTRY` (saas-specifications) states which intents it serves (`servesIntents`),\n * beside the schema that says what the aspect means. An intent resolves to the family's aspects that\n * declare it. A family none of whose aspects declares the intent renders in full: the request is\n * honoured or answered with everything, never silently narrowed to nothing.\n *\n * ABSENT means {@link MetaWorkflow_ArtifactIntent.FULL} — a playbook that has not been given an\n * intent keeps exactly the behaviour it had.\n */\nexport enum MetaWorkflow_ArtifactIntent {\n  /** Who the product is for. Market segments, personas, the jobs they are hiring it to do. */\n  AUDIENCE = 'audience',\n  /** What it must deliver and why that matters. Benefits, the jobs they advance, pains, gains, requirements. */\n  VALUE = 'value',\n  /** How it is described and sold. Positioning, tone, messaging, objections, pricing. */\n  VOICE = 'voice',\n  /*\n   * `PLAN` (\"what is sequenced and when\") was REMOVED 2026-09-21 (#1421). No playbook declared it and\n   * no family narrowed under it: its intended family, `build-plan`, is `{ version, tasks }`, so a PLAN\n   * slice kept everything, and its bulk is answered by the build-plan RENDERER instead. A member that\n   * looks like a narrowing and never narrows is a control that does nothing.\n   */\n  /** Everything the family holds. The default, and the honest answer when no aspect serves the request. */\n  FULL = 'full',\n}\n\n/**\n * Whether gathered evidence is sufficient to derive an artifact from — the adequacy verdict.\n *\n * Small and deliberately reusable: market analysis is the first consumer, but `compliance-posture`\n * (which regimes apply, in which jurisdictions) and `business-model` (pricing benchmarks) have the\n * same hole and will ask the same question of the same shape.\n *\n * It is a STEP output, never a landed family. The verdict decides whether a sibling may run and is\n * then discarded with the run; nothing downstream reads it, nobody commits it, and giving it a\n * durable home would be inventing a record with a lifecycle to hold a boolean that lived for ninety\n * seconds.\n */\nexport enum MetaWorkflow_EvidenceAdequacyVerdict {\n  /** Enough to derive from. The dependant step may run. */\n  ADEQUATE = 'adequate',\n  /** Not enough yet. `gaps` says what is missing, so the next research round is aimed rather than repeated. */\n  INSUFFICIENT = 'insufficient',\n}\n\nexport const MetaWorkflow_EvidenceAdequacySchema = z.object({\n  verdict: z.enum(MetaWorkflow_EvidenceAdequacyVerdict),\n  /**\n   * What is still missing, in the assessor's own words — the input to the NEXT round's objective.\n   *\n   * Required when INSUFFICIENT and the reason the loop is a loop rather than a retry: a re-run\n   * against the same objective asks the same question again, and the measured failure of that shape\n   * is two attempts spending real tokens to converge on nothing.\n   */\n  gaps: z.array(z.string().min(1)).default([]),\n  /** Why this verdict, against what was actually gathered. */\n  rationale: z.string().min(1),\n});\nexport type MetaWorkflow_EvidenceAdequacy = z.infer<typeof MetaWorkflow_EvidenceAdequacySchema>;\n\nexport const MetaWorkflow_ArtifactSelectorSchema = z.object({\n  family: z.string().min(1),\n  /**\n   * What this consumer needs from the family. Absent = {@link MetaWorkflow_ArtifactIntent.FULL}.\n   *\n   * Advisory to the COMPOSER, never to eligibility: a precondition asks whether an artifact is\n   * present and valid, which no intent changes. Narrowing what a playbook READS must never narrow\n   * what it WAITS FOR.\n   */\n  intent: z.enum(MetaWorkflow_ArtifactIntent).optional(),\n  /*\n   * `refs` and `pathHint` were REMOVED 2026-09-21 (#1420). Nothing read either — the same search that\n   * finds the real `selector.family` readers found none — and 0 of 63 compiled inputs authored one.\n   *\n   * Narrowing what a playbook reads does not belong here at all, because this selector also types\n   * PRECONDITIONS: a ref or an aspect on it would read as a readiness gate that eligibility never\n   * honours. The input-only narrowing (`aspects`, `render`, `related`) lives on\n   * `MetaWorkflowPlaybookInputSchema` in `@wildo-ai/saas-specifications/application-creation`, and it\n   * narrows by ASPECT, never by ref: a playbook is application-agnostic and cannot know element refs.\n   */\n});\nexport type MetaWorkflow_ArtifactSelector = z.infer<typeof MetaWorkflow_ArtifactSelectorSchema>;\n\n/**\n * Contract for an artifact a playbook produces: which family it lands in,\n * which Zod contract validates it, and where it is placed.\n *\n * `schemaRef` uses the pinned `<package-short>:<ExportName>` vocabulary\n * (implementation-spec P-33), e.g.\n * `saas-specifications:AssertionSpecificationSnapshot`. The framework-\n * knowledge audit format-checks it; the generator Zod-validates the whole\n * playbook against this schema.\n */\nexport const MetaWorkflow_ArtifactContractSchema = z.object({\n  family: z.string().min(1),\n  schemaRef: z\n    .string()\n    .regex(/^(saas-models|saas-specifications):[A-Za-z0-9_]+$/)\n    .optional(),\n  description: z.string().optional(),\n});\nexport type MetaWorkflow_ArtifactContract = z.infer<typeof MetaWorkflow_ArtifactContractSchema>;\n\n/**\n * Contract for a value a playbook returns to its PARENT choreography rather than landing as a file.\n *\n * ## The one field it does not have is the point\n *\n * There is no `family`. The landing service is the only thing that writes specification files, it is\n * driven by {@link MetaWorkflow_ArtifactContract}, and every landing target is resolved by FAMILY —\n * so a step output cannot be constructed into a landing request. \"A step result never becomes an\n * application artifact\" is therefore a property of the TYPE, not a convention. (TypeScript erases, so\n * the landing service also refuses a step ref at runtime; the type is the first line, not the whole\n * guarantee.)\n *\n * This paragraph credited `placement` until 2026-08-30, when that field was deleted for never having\n * been read. The invariant did not depend on it — `family` is required here too and a step output has\n * `ref` instead — but the prose had to be corrected rather than left pointing at a deleted field,\n * because a type-level guarantee nobody can locate is one the next author will remove by accident.\n *\n * A run's step results live in memory, feed the siblings that declared them as preconditions, and are\n * discarded when the run ends. Deleting all of them costs a re-run and never a fact\n * (`one-source-of-truth.md`, Rule 5) — which is exactly why they need no digest, receipt, acceptance\n * or lifecycle, and why introducing one would be the ceremony this whole design exists to avoid.\n *\n * ## `condensation` is required, and that is deliberate\n *\n * A parent's context is finite. The published multi-agent research architecture has subagents \"act\n * as intelligent filters\" precisely so the lead is not flooded, and `app-creation-dynamic-context.md`\n * design 4 says the same in our own words: a parent gets summaries at ITS resolution, not the child's\n * whole working set. A schema that permits an unbounded dump will receive one, so the contract asks\n * the producer to state what it is returning and how much.\n */\nexport const MetaWorkflow_StepOutputContractSchema = z.object({\n  /** Stable ref a sibling names in a {@link MetaWorkflow_PredicateKind.STEP_AVAILABLE} precondition. */\n  ref: z.string().min(1),\n  /** The `<package-short>:<ExportName>` contract the returned value is validated against, in memory. */\n  schemaRef: z\n    .string()\n    .regex(/^(saas-models|saas-specifications):[A-Za-z0-9_]+$/)\n    .optional(),\n  /** What this step returns, and at what resolution — the CONDENSATION contract, not a description of the work. */\n  condensation: z.string().min(1),\n  description: z.string().optional(),\n});\nexport type MetaWorkflow_StepOutputContract = z.infer<typeof MetaWorkflow_StepOutputContractSchema>;\n\n/**\n * A value assertion on a sibling's step result — the EVALUATOR-OPTIMIZER half.\n *\n * An adequacy gate that merely RAN is not the same as one that PASSED, and a loop that cannot tell\n * them apart is not a loop. The canonical pattern makes the evaluator's verdict a structured value\n * the loop condition READS, rather than prose narrated to a model that then decides whether it was\n * serious. Reading one declared field of a schema-validated result is not a ceremony.\n */\nexport const MetaWorkflow_StepValueAssertionSchema = z.object({\n  /** Dot path into the step result (e.g. `verdict`, `adequacy.verdict`). */\n  path: z.string().min(1),\n  /** The value that satisfies the gate. Absent means presence alone is enough. */\n  equals: z.union([z.string(), z.number(), z.boolean()]),\n});\nexport type MetaWorkflow_StepValueAssertion = z.infer<typeof MetaWorkflow_StepValueAssertionSchema>;\n\n/**\n * Typed predicates over the Journey Snapshot — playbook ELIGIBILITY gates\n * (design plan D2/KD-F). The choreographer LLM chooses among *eligible*\n * playbooks; it can never skip these gates. Predicates are evaluated\n * deterministically by the PlaybookRegistryService against the derived\n * snapshot; LLM interpretation cannot soften a failing predicate (S1\n * held-condition (a)).\n */\nconst _MetaWorkflow_JourneyPredicateSchema = z.discriminatedUnion(\"kind\", [\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_EXISTS),\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_VALID),\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_EXPECTED),\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_STALE),\n    /** The family whose landed output must be derived-stale for this playbook to be eligible. */\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.ARTIFACT_DECIDES),\n    /** The family that decides. */\n    selector: MetaWorkflow_ArtifactSelectorSchema,\n    /** A decision that family declares, e.g. a composition scenario ref (`add-website`). */\n    decision: z.string().min(1),\n    /** The member of the decision's vocabulary that satisfies the gate, e.g. `NEEDED`. */\n    equals: z.string().min(1),\n  }),\n  z.object({\n    kind: z.literal(MetaWorkflow_PredicateKind.STEP_AVAILABLE),\n    /**\n     * The sibling's declared {@link MetaWorkflow_StepOutputContract.ref} — or the DERIVED ref under\n     * which a sibling leaf's advisory judge verdict is readable, `judge:<playbookRef>` (#1498, spelled\n     * by the runtime's `judgeVerdictStepRef`). That value is `{ definitionRef, overall, criteria }`\n     * with `criteria` keyed by criterion ref, so a revise child gates on\n     * `requires: { path: 'criteria.<criterionRef>', equals: 'GAP' }` and a waterfall gate on\n     * `requires: { path: 'overall', equals: 'PASS' }`. An unjudged landing stores nothing there: a\n     * technical failure is never a verdict and routes nowhere.\n     */\n    ref: z.string().min(1),\n    /** Optional value assertion. Absent = presence is enough. */\n    requires: MetaWorkflow_StepValueAssertionSchema.optional(),\n  }),\n]);\nexport const MetaWorkflow_JourneyPredicateSchema: typeof _MetaWorkflow_JourneyPredicateSchema =\n  _MetaWorkflow_JourneyPredicateSchema;\nexport type MetaWorkflow_JourneyPredicate = z.infer<typeof _MetaWorkflow_JourneyPredicateSchema>;\n\n/**\n * Where an interview CHOICE question's options come from, when they cannot be written into the catalog\n * because they depend on what the application has already decided.\n *\n * ## Why a named source, and not a model-written question\n *\n * The brand name is the case that forced it. The creator should CHOOSE among names the companion proposed\n * and screened, so the options are the landed screening's candidates — a different list for every\n * application. A mid-run clarification could ask that, but its options are written by the model and its\n * question call fails soft (no question, the run proceeds), which would let the model pick the name\n * itself. A named source is computed by code from landed families, so the options are the same every time\n * they are read, and a creator's answer is checked against exactly the list they were shown.\n *\n * One member per source, each resolved by ONE runtime function; the resolver map is total over this enum,\n * so a member added without its resolver does not compile. A question declaring a source must be a CHOICE\n * and must not ALSO declare `options` — the catalog test holds both.\n */\nexport enum MetaWorkflow_ElicitationOptionsSource {\n  /**\n   * The screened brand-name candidates the creator may choose — computed from the landed\n   * `brand-name-screening` and the market snapshot's competitors (`deriveOfferableBrandNameOptions`).\n   * A conflicting companion proposal is never offered; a conflicting creator-supplied name is offered only\n   * as an explicit \"keep despite conflict\" option.\n   */\n  BRAND_NAME_SCREENING_CANDIDATES = 'brand_name_screening_candidates',\n}\n\nexport const MetaWorkflow_ElicitationSpecSchema = z.object({\n  questions: z\n    .array(\n      z.object({\n        ref: z.string().min(1),\n        question: z.string().min(1),\n        kind: z.enum(HumanDecision_FieldKind),\n        /** Required when kind = CHOICE, unless `optionsFrom` computes them. */\n        options: z.array(z.string().min(1)).optional(),\n        /**\n         * Computed options for a CHOICE (see {@link MetaWorkflow_ElicitationOptionsSource}). Resolved at every\n         * door that shows or accepts an answer; an answer to a question whose options were never resolved is\n         * refused rather than accepted unchecked.\n         */\n        optionsFrom: z.enum(MetaWorkflow_ElicitationOptionsSource).optional(),\n        /**\n         * The SAME DECISION another step already asks (#1454, gap 4): this question's answer IS that\n         * question's answer, so the creator is asked once. The dossier lists the decision at the step\n         * that owns it, and a run of this step reads that answer when it has none of its own.\n         *\n         * For a FALLBACK question — one a later step keeps for inputs authored before the earlier step\n         * asked it (`bottom_up.foundation`'s tenancy question, kept for plans without a `tenancy`\n         * field). Two steps asking one decision as two open questions invites two answers that\n         * disagree, and the dossier showed exactly that. Both questions must be the same KIND with the\n         * same OPTIONS, since one answer satisfies both; the catalog test holds that.\n         */\n        sameDecisionAs: z.object({\n          playbookRef: z.string().min(1),\n          questionRef: z.string().min(1),\n        }).optional(),\n        /**\n         * Which interview depth asks it (#2129). Absent means ESSENTIAL — read it through\n         * `resolveElicitationQuestionDepth`, never directly.\n         */\n        depth: z.enum(MetaWorkflow_ElicitationQuestionDepth).optional(),\n        /**\n         * Whether the companion may propose an answer the creator does not give (#2129). Absent means\n         * PROPOSE — read it through `resolveElicitationUnknownPolicy`, never directly.\n         */\n        whenUnknown: z.enum(MetaWorkflow_ElicitationUnknownPolicy).optional(),\n        /**\n         * The question concerns a regulated domain (#2129): a proposed answer to it is named to the person\n         * explicitly before it is kept. Read it through `isRegulatedDomainElicitationQuestion`.\n         */\n        regulatedDomain: z.boolean().optional(),\n      }),\n    )\n    .min(1),\n});\nexport type MetaWorkflow_ElicitationSpec = z.infer<typeof MetaWorkflow_ElicitationSpecSchema>;\n\n/**\n * Per-playbook budget ceilings a playbook may AUTHOR. No runtime currently\n * enforces them: the PlaybookRunner that was to be their enforcer was deleted\n * at the first-activation hard cut, and the demolition removed the budget\n * machinery with it — today the only live bound on unattended work is the\n * loop's iteration ceiling. Wiring an enforcer for these fields is tracked as\n * open work (spend ceiling for the unattended loop). CLI-transport coding\n * runs report no token usage, so cost accounting there would use wall-time +\n * run-count proxies.\n */\nexport const MetaWorkflow_PlaybookBudgetSchema = z.object({\n  maxCostUsd: z.number().positive().optional(),\n  /** Aggregate input allowance across a bounded working episode. */\n  maxInputTokens: z.number().int().positive().optional(),\n  /** Aggregate output allowance across a bounded working episode. */\n  maxOutputTokens: z.number().int().positive().optional(),\n  /** Model calls within an episode; intentionally separate from high-level candidate iterations. */\n  maxModelCalls: z.number().int().positive().optional(),\n  maxDurationMs: z.number().int().positive().optional(),\n  maxRuns: z.number().int().positive().optional(),\n});\nexport type MetaWorkflow_PlaybookBudget = z.infer<typeof MetaWorkflow_PlaybookBudgetSchema>;\n\n/**\n * THE playbook contract (design plan D2, verbatim). See the file-header\n * narrative for what a playbook is and where instances live.\n *\n * Field notes:\n * - `ref` is dot-namespaced `<phase-slug>.<name>` (e.g.\n *   `refinement.compliance-document-candidate`); `ref@version` is unique across the\n *   compiled catalog (audit rule R15).\n * - `method.guidance` is the refinable methodology prose (compiled from\n *   the playbook's `method.md`); `method.skillRefs` point at app-knowledge\n *   skills that carry the technical HOW — never inline it here.\n * - Journey-level autonomy PRESETS are NOT a playbook field — playbooks\n *   carry only their `approval` policy (review F-11).\n */\n/**\n * A composite's LOOP-BACK: when an assessing child's verdict faults, children that already landed in\n * this run are offered again.\n *\n * ## Why the runtime has to do this, and a revise child cannot\n *\n * Within one run a child that LANDED is delivered and never re-offered — landing it again from the\n * same inputs is waste the fourth live run measured. So a gate's GAP on \"requirement coverage\" could\n * reach the reader and route nothing: the leaf that must answer it had landed before the gate ran. A\n * dedicated revise playbook was the other shape, and it was rejected: it restates the leaf's inputs,\n * outputs and skills as a second description that drifts (one per criterion), or claims every family\n * a gate can fault and re-derives all of them when one faulted. The criterion → leaf map already\n * existed as a table in the lane's method, read by a person; this makes that table the mechanism.\n *\n * ## What a reopening does, exactly\n *\n * After the assessing child settles with a routable verdict, every reopening naming it whose verdict\n * (the criterion's, or the overall one when no criterion is named) is in `verdicts` removes the\n * `reopen` children from the run's delivered set. They are then eligible like any other child, and the\n * selector sees why. It re-offers; it never forces a dispatch, and it deletes no artifact. A PASS\n * re-opens nothing, so a lane that passes ends as it did before.\n *\n * ## Across lanes — `via`\n *\n * A verdict raised INSIDE a nested lane stays in that lane's scope unless the lane exports it: a lane\n * that lists the derived ref `judge:<leaf>` in its own `stepOutputs` returns that verdict to its parent\n * like any exported value. The parent then declares the reopening with `via: <that lane>`, and may\n * re-open a SIBLING lane. What the sibling re-runs is not forced from here: the round history tells\n * its selector which verdict re-opened it and on which criterion, and its own selection picks the leaf\n * (#1627). Code gates the kind of work; the model composes the task, as everywhere else in a composite.\n *\n * Refs must be admitted by the same composite (`whenVerdictOf` only when there is no `via`), refused\n * at parse rather than discovered as a loop-back that silently never fires. A child may re-open ITSELF: a leaf that lands and is judged (the business\n * model is both) is re-offered on its own GAP, which is the plainest loop-back there is.\n */\nexport const MetaWorkflow_ChoreographyReopeningSchema = z.strictObject({\n  /** The ASSESSING playbook whose verdict decides, e.g. `top_down.phase-gate` — admitted here, or inside `via`. */\n  whenVerdictOf: z.string().min(1),\n  /** The admitted LANE through which that verdict arrives, when the assessing playbook is inside it. */\n  via: z.string().min(1).optional(),\n  /** One criterion's verdict, e.g. `application-creation:criterion/requirement-coverage`. Absent: the overall verdict. */\n  criterionRef: z.string().min(1).optional(),\n  /** The verdicts that re-open — usually `[GAP]`. */\n  verdicts: z.array(z.enum(MetaWorkflow_EvaluationVerdict)).min(1),\n  /** The admitted children offered again, e.g. `['top_down.scope-roadmap']`. */\n  reopen: z.array(z.string().min(1)).min(1),\n});\nexport type MetaWorkflow_ChoreographyReopening = z.infer<typeof MetaWorkflow_ChoreographyReopeningSchema>;\n\n/**\n * A playbook that ORCHESTRATES other playbooks instead of producing an artifact itself.\n *\n * ## Why this is an admissible SET and never a sequence\n *\n * `admits` is unordered by contract. Order comes from the children's own preconditions, re-evaluated\n * against the tree and the run's step results at every iteration, plus the model's selection among\n * whatever is eligible. That is the difference between a choreography and a workflow, and it is the\n * property the whole design turns on: *\"Playbooks are choreography guides, not static workflows. The\n * system plays a choreography REACTIVELY to determine what should be done\"*\n * (`.claude/rules/application-creation-directive.md`).\n *\n * A recursive `children[]` was considered and rejected in the mined corpus for exactly this reason —\n * the name invites a fixed sequence and the next author writes one. So does an ordered array here.\n *\n * ## The model invents the TASK; code gates only the KIND of work and the bounds\n *\n * A child is dispatched against an OBJECTIVE the model composes for that dispatch, adapted to what\n * earlier rounds returned — which is what makes a research→reframe→re-search loop possible at all,\n * and what would be thrown away by a schema that enumerated the tasks. This is the published\n * orchestrator-worker shape: a lead agent INVENTS its workers' objectives rather than selecting them\n * from a menu; what is authored is the worker's SHAPE.\n *\n * ⚠ An earlier draft of this design put a `MetaWorkflow_ChildKind` enum between `admits` and the\n * playbooks, so a composite named KINDS and a kind resolved to a playbook. It is not built: no\n * playbook implements more than one kind and no kind has more than one playbook, so the vocabulary\n * would have been a 1:1 indirection over the refs — speculative structure, which this plan's own\n * rule (\"no schema without a consumer\") forbids. The anti-sequence property comes from the SET plus\n * the eligibility mechanism, never from the vocabulary. Add the enum when two playbooks genuinely\n * implement one shape of work.\n */\nexport const MetaWorkflow_ChoreographySchema = z.object({\n  /**\n   * Playbook refs this composite may run. UNORDERED — a set, not a sequence.\n   *\n   * At least two: a composite over one child is that child with extra machinery, and the machinery is\n   * the thing worth not having.\n   */\n  admits: z.array(z.string().min(1)).min(2),\n  /**\n   * Iteration ceiling for the child loop — a CIRCUIT BREAKER, deliberately generous.\n   *\n   * It exists to stop a loop spinning, never to refuse work for want of budget. Nothing here or\n   * anywhere else in this lane refuses on grounds of SPEND: a fail-closed accounting guard already\n   * cost this framework a live application once, and CLI-transport runs report no token usage at all,\n   * so a token ceiling on an agent lane is unmeasurable by construction. Spend is measured and\n   * reported; it is never a gate.\n   */\n  maximumIterations: z.number().int().positive().max(20).default(6),\n  /** Children per iteration. Research is breadth-first, so the default matches the journey loop's 3. */\n  maximumLanesPerIteration: z.number().int().positive().max(5).default(3),\n  /**\n   * How deep composition may nest BELOW this composite — a CIRCUIT BREAKER on recursion.\n   *\n   * `1` (the default) means this composite's children may not themselves be composites; `2` admits\n   * a lane of leaves under it, and so on. A nested composite runs through the same choreography\n   * service one level down (#1497): its exported step values return into this run's scope under the\n   * refs its own `stepOutputs[]` declare, its landings report through the same channel, and its\n   * checkpoint nests inside this one so a resumed parent resumes the child.\n   *\n   * The ceiling is INHERITED downward and the tightest ancestor wins: a lane declaring `2` under a\n   * root declaring `2` still cannot open a third level, because the root's breaker is the outer\n   * breaker. A composite selected past the ceiling is withheld from the eligible set (traced, never\n   * silent), and a run started past it stops at once with the `DEPTH_CEILING` stop reason — the\n   * guard the runtime cannot be talked out of by a caller threading the wrong depth.\n   *\n   * It was removed on 2026-09-08 (#488) because the runtime took a `depth` its one caller never\n   * passed, so the ceiling bounded nothing and read as a control. It is back with the recursion\n   * that gives it something to bound, and with the caller that threads depth — the two came back\n   * together, as the removal note required.\n   */\n  maximumDepth: z.number().int().positive().max(5).default(1),\n  /** Wall-clock breaker for the whole composite. A hung agent is the runaway a count cannot catch. */\n  maximumDurationMs: z.number().int().positive().default(30 * 60_000),\n  /** Loop-back on an assessing child's verdict — see {@link MetaWorkflow_ChoreographyReopeningSchema}. */\n  reopenOnVerdict: z.array(MetaWorkflow_ChoreographyReopeningSchema).optional(),\n  /**\n   * Admitted children that act on the APPLICATION even when this composite runs as an INSTANCE (#1608).\n   *\n   * A child inherits its composite's instance by default (#1609), so a segment's research is the segment's.\n   * Some children cannot have an instance: they refresh what the application holds once, such as the domain\n   * plan, the build plan or the build itself, and an instance may never replace those. A composite that\n   * exists to feed such a refresh (a feature line: the feature lands as elements, then the application's\n   * plans re-derive) names those children here, and they run as the default instance.\n   *\n   * Declared, never derived from a child's outputs: deriving \"runs as the application\" from \"produces a\n   * single-value family\" would let a market-segment instance rewrite the application's market snapshot.\n   */\n  actsOnApplication: z.array(z.string().min(1)).optional(),\n  /**\n   * The admitted child this lane ENDS ON (#2236): a lane may not report itself finished before the closing move\n   * has run in that run. When the selector chooses to stop and the closing move has not run and is on offer, the\n   * runtime runs it instead of stopping; when it is not on offer, the lane ends anyway, the boundary records the\n   * closing move as UNRUN with the reason, and the lane no longer reads as concluded.\n   *\n   * It exists because a closing move that lands nothing — the definition lane's phase gate, whose output is a\n   * verdict — is never marked delivered, so \"has it run?\" was left to the selector reading the lane's intent text.\n   * Measured on app-creation-test-004 (2026-09-30): the definition lane's families landed, the run went on to\n   * conception, compliance and build, and the go/no-go decision never ran. Marking, not refusing: a closing move\n   * that cannot run never stops the lane (`.claude/rules/application-creation-directive.md`).\n   */\n  closingMove: z.string().min(1).optional(),\n}).superRefine((choreography, context) => {\n  const admitted = new Set(choreography.admits);\n  if (choreography.closingMove !== undefined && !admitted.has(choreography.closingMove)) {\n    context.addIssue({ code: 'custom', path: ['closingMove'], message: `\"${choreography.closingMove}\" is not admitted by this composite, so the lane could never end on it.` });\n  }\n  (choreography.actsOnApplication ?? []).forEach((ref, index) => {\n    if (!admitted.has(ref)) {\n      context.addIssue({ code: 'custom', path: ['actsOnApplication', index], message: `\"${ref}\" is not admitted by this composite, so it can never act for it.` });\n    }\n  });\n  (choreography.reopenOnVerdict ?? []).forEach((reopening, index) => {\n    for (const ref of [reopening.via ?? reopening.whenVerdictOf, ...reopening.reopen]) {\n      if (!admitted.has(ref)) {\n        context.addIssue({ code: 'custom', path: ['reopenOnVerdict', index], message: `\"${ref}\" is not admitted by this composite, so this reopening could never fire.` });\n      }\n    }\n  });\n});\nexport type MetaWorkflow_Choreography = z.infer<typeof MetaWorkflow_ChoreographySchema>;\n\n/**\n * The panel a deliberated playbook convenes.\n *\n * Role refs resolve against `EXPERT_ROLE_TEMPLATES`, and the narrowness gate is\n * TWO-AXIS: the rubric-deriver must OWN `workDomain` (`template.workDomains`), while\n * every reviewer need only REVIEW it (`template.reviewScopes`) — which is what lets a\n * design-system guardian sit on an information-architecture panel as the coherence\n * memory without owning the domain.\n */\nexport const MetaWorkflow_PlaybookDeliberationSchema = z.object({\n  /** The routing axis. Every reviewer's role must have this in its review scopes. */\n  workDomain: z.enum(ExpertWorkDomain),\n  /** The reviewing panel — at least two, because one reviewer is a judge, not a deliberation. */\n  reviewerRoleRefs: z.array(z.string().min(1)).min(2),\n  /** The coordinator: shortlist, convergence, synthesis. Not domain-gated — it is the manager hat. */\n  coordinatorRoleRef: z.string().min(1),\n  /** Who derives the rubric. Must OWN the domain. Defaults to the first reviewer. */\n  rubricDeriverRoleRef: z.string().min(1).optional(),\n  /**\n   * How many distinct candidates to generate before the panel sees anything.\n   *\n   * Bounded at 2–5: one candidate is nothing to deliberate over, and past five the\n   * cost grows faster than the disagreement does.\n   */\n  candidateCount: z.number().int().min(2).max(5).default(3),\n  /** Max rounds before forced synthesis. The engine's own default is 2. */\n  roundBudget: z.number().int().min(1).max(3).optional(),\n  /** Top-K candidates revised per round. */\n  shortlistSize: z.number().int().min(1).optional(),\n});\nexport type MetaWorkflow_PlaybookDeliberation = z.infer<typeof MetaWorkflow_PlaybookDeliberationSchema>;"]}

package/dist/esm/meta-workflows.exports.d.ts

@@ -41,6 +41,7 @@ export * from './meta-workflows/catalog.meta-workflows.shared.schemas';
 export * from './meta-workflows/coding-tasks.meta-workflows.shared.schemas';
 export * from './meta-workflows/context-selection.meta-workflows.shared.schemas';
 export * from './meta-workflows/decisions.meta-workflows.shared.schemas';
+export * from './meta-workflows/elicitation-depth.meta-workflows.shared.schemas';
 export * from './meta-workflows/orchestration.meta-workflows.shared.schemas';
 export * from './meta-workflows/portable-primitives.meta-workflows.shared.schemas';
 //# sourceMappingURL=meta-workflows.exports.d.ts.map

package/dist/esm/meta-workflows.exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-workflows.exports.d.ts","sourceRoot":"","sources":["../../../src/meta-workflows.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,cAAc,wDAAwD,CAAC;AACvE,cAAc,wDAAwD,CAAC;AACvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kEAAkE,CAAC;AACjF,cAAc,0DAA0D,CAAC;AACzE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,oEAAoE,CAAC"}
+{"version":3,"file":"meta-workflows.exports.d.ts","sourceRoot":"","sources":["../../../src/meta-workflows.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,cAAc,wDAAwD,CAAC;AACvE,cAAc,wDAAwD,CAAC;AACvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kEAAkE,CAAC;AACjF,cAAc,0DAA0D,CAAC;AACzE,cAAc,kEAAkE,CAAC;AACjF,cAAc,8DAA8D,CAAC;AAC7E,cAAc,oEAAoE,CAAC"}

package/dist/esm/meta-workflows.exports.js

@@ -41,6 +41,7 @@ export * from './meta-workflows/catalog.meta-workflows.shared.schemas.js';
 export * from './meta-workflows/coding-tasks.meta-workflows.shared.schemas.js';
 export * from './meta-workflows/context-selection.meta-workflows.shared.schemas.js';
 export * from './meta-workflows/decisions.meta-workflows.shared.schemas.js';
+export * from './meta-workflows/elicitation-depth.meta-workflows.shared.schemas.js';
 export * from './meta-workflows/orchestration.meta-workflows.shared.schemas.js';
 export * from './meta-workflows/portable-primitives.meta-workflows.shared.schemas.js';
 //# sourceMappingURL=meta-workflows.exports.js.map

package/dist/esm/meta-workflows.exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"meta-workflows.exports.js","sourceRoot":"","sources":["../../../src/meta-workflows.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,cAAc,wDAAwD,CAAC;AACvE,cAAc,wDAAwD,CAAC;AACvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kEAAkE,CAAC;AACjF,cAAc,0DAA0D,CAAC;AACzE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,oEAAoE,CAAC","sourcesContent":["/**\n * Meta-workflow contracts — the portable vocabulary for playbooks, decisions, actions, execution\n * bindings and application continuity.\n *\n * ## Why this is a subpath and not part of the package root\n *\n * These symbols are consumed by exactly one audience: the application-creation runtime, the\n * companion, the CLI's framework-knowledge tooling and the verification harness. They are meta-\n * workflow authoring and continuity contracts, not the general resource/schema vocabulary that the\n * `@wildo-ai/saas-models` root exists to publish. Carrying them at the root put a whole domain in\n * front of every consumer that only wanted a resource schema, and made the root barrel the de-facto\n * home of everything.\n *\n * The domain is DEFINED here — it belongs to this package and shares its primitives — but it is\n * reachable ONLY through this door. That is the distinction the repository is standardising on:\n * separating concerns without minting a package per concern.\n *\n * @see `.claude/rules/package-public-entrypoints.md`\n * @see `.claude/plans/package-entrypoint-barrel-discipline.md`\n *\n * ## Composition note\n *\n * The `meta-workflows/**` modules below own the portable meta-workflow vocabulary,\n * including the separately versioned budget authorities added after the original root split.\n * The execution-binding and continuity-identifier modules are GONE, not merely absent. Measured\n * 2026-09-19: `execution-binding-common` was published by no door and BOTH its importers used zero\n * of its exports, so the vocabularies and branded ids only it referenced were dead with it. That\n * whole cluster — the `Continuum` / `WorkCycle` / `ContextFrame` / `Treatment` identity vocabulary\n * of the layer demolished on 2026-08-23 — was removed. `meta-workflows-entrypoint-boundary.public.test.ts`\n * pins its absence from both doors so a revival is deliberate.\n *\n * `AppsBlueprint_AgentPersonas` was published here too, on the grounds that it was \"the vocabulary\n * playbook definitions key on\". It was not: no playbook authored a persona, its only consumer was a\n * prompt library in `platform-core` that turned out to be commented out, and the whole\n * `apps-blueprint` tree went on 2026-09-19. The generic persona field is and stays an open\n * `z.string()` on `FlowsActors_Agent_PromptSpec` — a closed persona list was never an engine\n * concept.\n */\n\nexport * from './meta-workflows/actions.meta-workflows.shared.schemas';\nexport * from './meta-workflows/catalog.meta-workflows.shared.schemas';\nexport * from './meta-workflows/coding-tasks.meta-workflows.shared.schemas';\nexport * from './meta-workflows/context-selection.meta-workflows.shared.schemas';\nexport * from './meta-workflows/decisions.meta-workflows.shared.schemas';\nexport * from './meta-workflows/orchestration.meta-workflows.shared.schemas';\nexport * from './meta-workflows/portable-primitives.meta-workflows.shared.schemas';\n"]}
+{"version":3,"file":"meta-workflows.exports.js","sourceRoot":"","sources":["../../../src/meta-workflows.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,cAAc,wDAAwD,CAAC;AACvE,cAAc,wDAAwD,CAAC;AACvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kEAAkE,CAAC;AACjF,cAAc,0DAA0D,CAAC;AACzE,cAAc,kEAAkE,CAAC;AACjF,cAAc,8DAA8D,CAAC;AAC7E,cAAc,oEAAoE,CAAC","sourcesContent":["/**\n * Meta-workflow contracts — the portable vocabulary for playbooks, decisions, actions, execution\n * bindings and application continuity.\n *\n * ## Why this is a subpath and not part of the package root\n *\n * These symbols are consumed by exactly one audience: the application-creation runtime, the\n * companion, the CLI's framework-knowledge tooling and the verification harness. They are meta-\n * workflow authoring and continuity contracts, not the general resource/schema vocabulary that the\n * `@wildo-ai/saas-models` root exists to publish. Carrying them at the root put a whole domain in\n * front of every consumer that only wanted a resource schema, and made the root barrel the de-facto\n * home of everything.\n *\n * The domain is DEFINED here — it belongs to this package and shares its primitives — but it is\n * reachable ONLY through this door. That is the distinction the repository is standardising on:\n * separating concerns without minting a package per concern.\n *\n * @see `.claude/rules/package-public-entrypoints.md`\n * @see `.claude/plans/package-entrypoint-barrel-discipline.md`\n *\n * ## Composition note\n *\n * The `meta-workflows/**` modules below own the portable meta-workflow vocabulary,\n * including the separately versioned budget authorities added after the original root split.\n * The execution-binding and continuity-identifier modules are GONE, not merely absent. Measured\n * 2026-09-19: `execution-binding-common` was published by no door and BOTH its importers used zero\n * of its exports, so the vocabularies and branded ids only it referenced were dead with it. That\n * whole cluster — the `Continuum` / `WorkCycle` / `ContextFrame` / `Treatment` identity vocabulary\n * of the layer demolished on 2026-08-23 — was removed. `meta-workflows-entrypoint-boundary.public.test.ts`\n * pins its absence from both doors so a revival is deliberate.\n *\n * `AppsBlueprint_AgentPersonas` was published here too, on the grounds that it was \"the vocabulary\n * playbook definitions key on\". It was not: no playbook authored a persona, its only consumer was a\n * prompt library in `platform-core` that turned out to be commented out, and the whole\n * `apps-blueprint` tree went on 2026-09-19. The generic persona field is and stays an open\n * `z.string()` on `FlowsActors_Agent_PromptSpec` — a closed persona list was never an engine\n * concept.\n */\n\nexport * from './meta-workflows/actions.meta-workflows.shared.schemas';\nexport * from './meta-workflows/catalog.meta-workflows.shared.schemas';\nexport * from './meta-workflows/coding-tasks.meta-workflows.shared.schemas';\nexport * from './meta-workflows/context-selection.meta-workflows.shared.schemas';\nexport * from './meta-workflows/decisions.meta-workflows.shared.schemas';\nexport * from './meta-workflows/elicitation-depth.meta-workflows.shared.schemas';\nexport * from './meta-workflows/orchestration.meta-workflows.shared.schemas';\nexport * from './meta-workflows/portable-primitives.meta-workflows.shared.schemas';\n"]}

package/dist/esm/queue/jobs.shared.schemas.d.ts

@@ -185,6 +185,54 @@ export type QueueRetryBackoffConfig = z.infer<typeof QueueRetryBackoffConfigSche
 /** First receipt is short-lived; persisted recovery has its own policy deadline. */
 export declare const SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS: number;
 export declare const SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS: number;
+/**
+ * How long after its token expired a delivery may still be RECORDED as a missed occurrence (#2212).
+ *
+ * An expired token stays cryptographically valid forever, so without a horizon anyone able to
+ * publish onto the application's queue could replay a captured token of any age and plant a
+ * "missed while absent" record. The horizon is APPROXIMATELY the job-row retention: within it, a
+ * replayed token almost always meets the occurrence's existing row and is recognised as already
+ * held; beyond it, no genuine backlog is plausible and the delivery is rejected as a trust failure.
+ * "Approximately" because a row that ran on time expires measured from its completion while the
+ * horizon is measured from the token's expiry, which leaves a window of a few minutes in which a
+ * replay is recorded as a fresh miss. It never runs anything, and archived run evidence still wins
+ * the occurrence in coverage.
+ *
+ * Equal to `JOB_EXECUTION_TTL_SECONDS` (declared further down, outside this shared block, so it
+ * cannot be referenced here without a temporal-dead-zone hazard); a test pins the two together, so
+ * changing one without the other fails.
+ */
+export declare const SCHEDULED_LATE_DELIVERY_HORIZON_MS: number;
+/**
+ * Why an AUTHENTIC scheduled delivery reached the application too late to be admitted (#2212).
+ *
+ * Either way the occurrence was MISSED: it is recorded as such and not run, and the schedule
+ * continues with its next occurrence. The two gates differ in WHO was late, which is why they are
+ * kept apart:
+ *
+ * - `TOKEN_EXPIRED` — the delivery sat in the queue for longer than its token lives, so nothing
+ *   consumed the application's scheduled queue for that long: the backend (or minion) was stopped,
+ *   restarting or crash-looping. This is the common case after a restart.
+ * - `OUTSIDE_ADMISSION_WINDOW` — the token is still current, but the occurrence it names is older
+ *   than the window. The scheduler may sign up to the window's length AFTER the occurrence, so the
+ *   delay is shared between the scheduler's publication and the application's consumption, and
+ *   cannot be attributed to the application alone.
+ *
+ * A late delivery is never an authentication failure: its signature, issuer and audience were
+ * proven before it was classified late. A token that cannot be proven authentic, that names an
+ * occurrence in the future, or that expired longer ago than `SCHEDULED_LATE_DELIVERY_HORIZON_MS`
+ * is a trust failure instead and is reported loudly.
+ *
+ * Missed occurrences are SKIPPED, never caught up: that is the established cron behaviour (a
+ * Kubernetes `CronJob` past its `startingDeadlineSeconds`, a Quartz trigger with the do-nothing
+ * misfire instruction), and it keeps the short signed window a replay bound rather than a credential.
+ */
+export declare enum ScheduledDeliveryLateness {
+    /** The signed delivery token's `exp` passed before the delivery was consumed. */
+    TOKEN_EXPIRED = "token_expired",
+    /** The token is current, but the occurrence it names is older than `SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS`; scheduler and consumer share the delay. */
+    OUTSIDE_ADMISSION_WINDOW = "outside_admission_window"
+}
 /** How the handler's complete effects tolerate execution after an uncertain outcome. */
 export declare enum ScheduledReplaySafety {
     /** No automatic repetition; a failed call can already have committed effects. */
@@ -239,12 +287,31 @@ export declare const ScheduledEvidencePolicySchema: z.ZodObject<{
     deferredField: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ScheduledEvidencePolicy = z.infer<typeof ScheduledEvidencePolicySchema>;
+/** How a scheduled occurrence's archived evidence came to exist. */
 export declare enum ScheduledEvidenceSource {
+    /** The handler ran and reported completion. */
     EXECUTION = "execution",
+    /** The handler's reconciler established that an interrupted run completed. */
     RECONCILIATION = "reconciliation",
+    /** An operator confirmed completion of an occurrence held for review. */
     OPERATOR_CONFIRMATION = "operator_confirmation",
-    ABANDONMENT = "abandonment"
+    /** An operator decided an occurrence held for review will not run. */
+    ABANDONMENT = "abandonment",
+    /**
+     * The occurrence was never run: its authentic delivery reached the application after the
+     * admission deadline (see `ScheduledDeliveryLateness` for who was late). Coverage reads it as an
+     * EXPLAINED gap: the slot stays missing, because the occurrence did not run, and the record says
+     * why — rather than an unexplained one.
+     */
+    LATE_DELIVERY = "late_delivery"
 }
+/**
+ * The terminal invocation status each evidence source records — the one place that pairing is stated.
+ *
+ * A source whose occurrence never reached a successful invocation records `FAILED`; this follows the
+ * precedent `ABANDONMENT` set, and the SOURCE (never the status) is what says why it did not run.
+ */
+export declare function scheduledEvidenceInvocationStatus(source: ScheduledEvidenceSource): JobExecutionStatus;
 export declare enum ScheduledEvidenceResultStatus {
     CAPTURED = "captured",
     UNAVAILABLE = "unavailable"
@@ -346,6 +413,7 @@ export declare const ScheduledExecutionStateSchema: z.ZodObject<{
     attemptCount: z.ZodNumber;
     reconciledSafe: z.ZodDefault<z.ZodBoolean>;
     reason: z.ZodOptional<z.ZodString>;
+    lateness: z.ZodOptional<z.ZodEnum<typeof ScheduledDeliveryLateness>>;
     attempts: z.ZodArray<z.ZodObject<{
         attemptId: z.ZodUUID;
         phase: z.ZodEnum<typeof ScheduledExecutionPhase>;
@@ -752,6 +820,7 @@ export declare const JobExecutionSchema: z.ZodObject<{
         attemptCount: z.ZodNumber;
         reconciledSafe: z.ZodDefault<z.ZodBoolean>;
         reason: z.ZodOptional<z.ZodString>;
+        lateness: z.ZodOptional<z.ZodEnum<typeof ScheduledDeliveryLateness>>;
         attempts: z.ZodArray<z.ZodObject<{
             attemptId: z.ZodUUID;
             phase: z.ZodEnum<typeof ScheduledExecutionPhase>;

package/dist/esm/queue/jobs.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/queue/jobs.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,8CAA8C,CAAC;AAExE,OAAO,EAA4B,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AASpG;;GAEG;AACH,oBAAY,OAAO;IACjB,uEAAuE;IACvE,kBAAkB,uBAAuB;IACzC,uDAAuD;IACvD,YAAY,iBAAiB;IAC7B,uDAAuD;IACvD,cAAc,mBAAmB;IACjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,gBAAgB;CAC5B;AAED;;GAEG;AACH,oBAAY,SAAS;IACnB,iCAAiC;IACjC,OAAO,YAAY;IACnB,yBAAyB;IACzB,MAAM,WAAW;IACjB,gCAAgC;IAChC,UAAU,eAAe;IACzB,4BAA4B;IAC5B,SAAS,cAAc;IACvB,gCAAgC;IAChC,MAAM,WAAW;IACjB,4BAA4B;IAC5B,QAAQ,aAAa;IACrB,iCAAiC;IACjC,WAAW,gBAAgB;IAC3B,yBAAyB;IACzB,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,4JAA4J;IAC5J,QAAQ,aAAa;IACrB;;;;OAIG;IACH,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,6BAA6B;IAC7B,GAAG,QAAQ;IACX,4CAA4C;IAC5C,OAAO,YAAY;IACnB,sCAAsC;IACtC,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,iCAAiC;IACjC,OAAO,YAAY;IACnB,yBAAyB;IACzB,MAAM,WAAW;IACjB,gCAAgC;IAChC,UAAU,eAAe;IACzB,4BAA4B;IAC5B,SAAS,cAAc;IACvB,gCAAgC;IAChC,MAAM,WAAW;IACjB,4BAA4B;IAC5B,QAAQ,aAAa;IACrB,iCAAiC;IACjC,WAAW,gBAAgB;IAC3B,yBAAyB;IACzB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,WAAW;IACrB,GAAG,QAAQ;IACX,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAMD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAiBvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,6BAA6B;;;;iBAOxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,oHAAoH;AAEpH,oFAAoF;AACpF,eAAO,MAAM,sCAAsC,QAAgB,CAAC;AACpE,eAAO,MAAM,0CAA0C,QAAY,CAAC;AAEpE,wFAAwF;AACxF,oBAAY,qBAAqB;IAC/B,iFAAiF;IACjF,MAAM,WAAW;IACjB,iFAAiF;IACjF,UAAU,eAAe;IACzB,kFAAkF;IAClF,SAAS,cAAc;CACxB;AAED,kFAAkF;AAClF,oBAAY,uBAAuB;IACjC,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED,oBAAY,8BAA8B;IACxC,SAAS,cAAc;IACvB,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED,wFAAwF;AACxF,oBAAY,sBAAsB;IAChC,iBAAiB,sBAAsB;IACvC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,uFAAuF;AACvF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAgBxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,wBAAgB,gCAAgC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GAAG,uBAAuB,CAEnH;AAED,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B;;;;;iBAaxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,oBAAY,uBAAuB;IACjC,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,qBAAqB,0BAA0B;IAC/C,WAAW,gBAAgB;CAC5B;AACD,oBAAY,6BAA6B;IACvC,QAAQ,aAAa;IACrB,WAAW,gBAAgB;CAC5B;AAmBD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,+FAA+F;AAC/F,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kEAAkE;AAElE,2GAA2G;AAC3G,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;iBAO3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC;;;iBAGjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAGtG;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuI3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;;;GAGG;AACH,eAAO,MAAM,+BAA+B,QAAe,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4ClC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAMxE;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,oBAAY,4CAA4C;IACtD,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2CAA2C;;;iBAGtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,qCAAqC,GAAG,SAAS,CAG3G;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;iBAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8F7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"jobs.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/queue/jobs.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,8CAA8C,CAAC;AAExE,OAAO,EAA4B,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AASpG;;GAEG;AACH,oBAAY,OAAO;IACjB,uEAAuE;IACvE,kBAAkB,uBAAuB;IACzC,uDAAuD;IACvD,YAAY,iBAAiB;IAC7B,uDAAuD;IACvD,cAAc,mBAAmB;IACjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,gBAAgB;CAC5B;AAED;;GAEG;AACH,oBAAY,SAAS;IACnB,iCAAiC;IACjC,OAAO,YAAY;IACnB,yBAAyB;IACzB,MAAM,WAAW;IACjB,gCAAgC;IAChC,UAAU,eAAe;IACzB,4BAA4B;IAC5B,SAAS,cAAc;IACvB,gCAAgC;IAChC,MAAM,WAAW;IACjB,4BAA4B;IAC5B,QAAQ,aAAa;IACrB,iCAAiC;IACjC,WAAW,gBAAgB;IAC3B,yBAAyB;IACzB,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,4JAA4J;IAC5J,QAAQ,aAAa;IACrB;;;;OAIG;IACH,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,oBAAY,YAAY;IACtB,6BAA6B;IAC7B,GAAG,QAAQ;IACX,4CAA4C;IAC5C,OAAO,YAAY;IACnB,sCAAsC;IACtC,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,iCAAiC;IACjC,OAAO,YAAY;IACnB,yBAAyB;IACzB,MAAM,WAAW;IACjB,gCAAgC;IAChC,UAAU,eAAe;IACzB,4BAA4B;IAC5B,SAAS,cAAc;IACvB,gCAAgC;IAChC,MAAM,WAAW;IACjB,4BAA4B;IAC5B,QAAQ,aAAa;IACrB,iCAAiC;IACjC,WAAW,gBAAgB;IAC3B,yBAAyB;IACzB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,WAAW;IACrB,GAAG,QAAQ;IACX,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAMD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAiBvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,6BAA6B;;;;iBAOxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,oHAAoH;AAEpH,oFAAoF;AACpF,eAAO,MAAM,sCAAsC,QAAgB,CAAC;AACpE,eAAO,MAAM,0CAA0C,QAAY,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,QAA2B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,yBAAyB;IACnC,iFAAiF;IACjF,aAAa,kBAAkB;IAC/B,wJAAwJ;IACxJ,wBAAwB,6BAA6B;CACtD;AAED,wFAAwF;AACxF,oBAAY,qBAAqB;IAC/B,iFAAiF;IACjF,MAAM,WAAW;IACjB,iFAAiF;IACjF,UAAU,eAAe;IACzB,kFAAkF;IAClF,SAAS,cAAc;CACxB;AAED,kFAAkF;AAClF,oBAAY,uBAAuB;IACjC,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED,oBAAY,8BAA8B;IACxC,SAAS,cAAc;IACvB,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED,wFAAwF;AACxF,oBAAY,sBAAsB;IAChC,iBAAiB,sBAAsB;IACvC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,uFAAuF;AACvF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAgBxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,wBAAgB,gCAAgC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GAAG,uBAAuB,CAEnH;AAED,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B;;;;;iBAaxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,oEAAoE;AACpE,oBAAY,uBAAuB;IACjC,+CAA+C;IAC/C,SAAS,cAAc;IACvB,8EAA8E;IAC9E,cAAc,mBAAmB;IACjC,yEAAyE;IACzE,qBAAqB,0BAA0B;IAC/C,sEAAsE;IACtE,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,aAAa,kBAAkB;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,uBAAuB,GAAG,kBAAkB,CAUrG;AACD,oBAAY,6BAA6B;IACvC,QAAQ,aAAa;IACrB,WAAW,gBAAgB;CAC5B;AAmBD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;iBAyBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,+FAA+F;AAC/F,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kEAAkE;AAElE,2GAA2G;AAC3G,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;iBAO3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC;;;iBAGjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAGtG;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuI3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;;;GAGG;AACH,eAAO,MAAM,+BAA+B,QAAe,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4ClC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAMxE;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,oBAAY,4CAA4C;IACtD,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2CAA2C;;;iBAGtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,qCAAqC,GAAG,SAAS,CAG3G;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;iBAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8F7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/esm/queue/jobs.shared.schemas.js

@@ -216,6 +216,55 @@ export const QueueRetryBackoffConfigSchema = z.object({
 /** First receipt is short-lived; persisted recovery has its own policy deadline. */
 export const SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS = 5 * 60 * 1000;
 export const SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS = 30 * 1000;
+/**
+ * How long after its token expired a delivery may still be RECORDED as a missed occurrence (#2212).
+ *
+ * An expired token stays cryptographically valid forever, so without a horizon anyone able to
+ * publish onto the application's queue could replay a captured token of any age and plant a
+ * "missed while absent" record. The horizon is APPROXIMATELY the job-row retention: within it, a
+ * replayed token almost always meets the occurrence's existing row and is recognised as already
+ * held; beyond it, no genuine backlog is plausible and the delivery is rejected as a trust failure.
+ * "Approximately" because a row that ran on time expires measured from its completion while the
+ * horizon is measured from the token's expiry, which leaves a window of a few minutes in which a
+ * replay is recorded as a fresh miss. It never runs anything, and archived run evidence still wins
+ * the occurrence in coverage.
+ *
+ * Equal to `JOB_EXECUTION_TTL_SECONDS` (declared further down, outside this shared block, so it
+ * cannot be referenced here without a temporal-dead-zone hazard); a test pins the two together, so
+ * changing one without the other fails.
+ */
+export const SCHEDULED_LATE_DELIVERY_HORIZON_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * Why an AUTHENTIC scheduled delivery reached the application too late to be admitted (#2212).
+ *
+ * Either way the occurrence was MISSED: it is recorded as such and not run, and the schedule
+ * continues with its next occurrence. The two gates differ in WHO was late, which is why they are
+ * kept apart:
+ *
+ * - `TOKEN_EXPIRED` — the delivery sat in the queue for longer than its token lives, so nothing
+ *   consumed the application's scheduled queue for that long: the backend (or minion) was stopped,
+ *   restarting or crash-looping. This is the common case after a restart.
+ * - `OUTSIDE_ADMISSION_WINDOW` — the token is still current, but the occurrence it names is older
+ *   than the window. The scheduler may sign up to the window's length AFTER the occurrence, so the
+ *   delay is shared between the scheduler's publication and the application's consumption, and
+ *   cannot be attributed to the application alone.
+ *
+ * A late delivery is never an authentication failure: its signature, issuer and audience were
+ * proven before it was classified late. A token that cannot be proven authentic, that names an
+ * occurrence in the future, or that expired longer ago than `SCHEDULED_LATE_DELIVERY_HORIZON_MS`
+ * is a trust failure instead and is reported loudly.
+ *
+ * Missed occurrences are SKIPPED, never caught up: that is the established cron behaviour (a
+ * Kubernetes `CronJob` past its `startingDeadlineSeconds`, a Quartz trigger with the do-nothing
+ * misfire instruction), and it keeps the short signed window a replay bound rather than a credential.
+ */
+export var ScheduledDeliveryLateness;
+(function (ScheduledDeliveryLateness) {
+    /** The signed delivery token's `exp` passed before the delivery was consumed. */
+    ScheduledDeliveryLateness["TOKEN_EXPIRED"] = "token_expired";
+    /** The token is current, but the occurrence it names is older than `SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS`; scheduler and consumer share the delay. */
+    ScheduledDeliveryLateness["OUTSIDE_ADMISSION_WINDOW"] = "outside_admission_window";
+})(ScheduledDeliveryLateness || (ScheduledDeliveryLateness = {}));
 /** How the handler's complete effects tolerate execution after an uncertain outcome. */
 export var ScheduledReplaySafety;
 (function (ScheduledReplaySafety) {
@@ -286,13 +335,42 @@ export const ScheduledEvidencePolicySchema = z.object({
         ctx.addIssue({ code: 'custom', path: ['deferredField'], message: 'Deferred flag must be a selected result field' });
     }
 });
+/** How a scheduled occurrence's archived evidence came to exist. */
 export var ScheduledEvidenceSource;
 (function (ScheduledEvidenceSource) {
+    /** The handler ran and reported completion. */
     ScheduledEvidenceSource["EXECUTION"] = "execution";
+    /** The handler's reconciler established that an interrupted run completed. */
     ScheduledEvidenceSource["RECONCILIATION"] = "reconciliation";
+    /** An operator confirmed completion of an occurrence held for review. */
     ScheduledEvidenceSource["OPERATOR_CONFIRMATION"] = "operator_confirmation";
+    /** An operator decided an occurrence held for review will not run. */
     ScheduledEvidenceSource["ABANDONMENT"] = "abandonment";
+    /**
+     * The occurrence was never run: its authentic delivery reached the application after the
+     * admission deadline (see `ScheduledDeliveryLateness` for who was late). Coverage reads it as an
+     * EXPLAINED gap: the slot stays missing, because the occurrence did not run, and the record says
+     * why — rather than an unexplained one.
+     */
+    ScheduledEvidenceSource["LATE_DELIVERY"] = "late_delivery";
 })(ScheduledEvidenceSource || (ScheduledEvidenceSource = {}));
+/**
+ * The terminal invocation status each evidence source records — the one place that pairing is stated.
+ *
+ * A source whose occurrence never reached a successful invocation records `FAILED`; this follows the
+ * precedent `ABANDONMENT` set, and the SOURCE (never the status) is what says why it did not run.
+ */
+export function scheduledEvidenceInvocationStatus(source) {
+    switch (source) {
+        case ScheduledEvidenceSource.EXECUTION:
+        case ScheduledEvidenceSource.RECONCILIATION:
+        case ScheduledEvidenceSource.OPERATOR_CONFIRMATION:
+            return JobExecutionStatus.COMPLETED;
+        case ScheduledEvidenceSource.ABANDONMENT:
+        case ScheduledEvidenceSource.LATE_DELIVERY:
+            return JobExecutionStatus.FAILED;
+    }
+}
 export var ScheduledEvidenceResultStatus;
 (function (ScheduledEvidenceResultStatus) {
     ScheduledEvidenceResultStatus["CAPTURED"] = "captured";
@@ -321,8 +399,7 @@ export const ScheduledRunEvidenceSchema = ScheduledRunEvidenceFieldsSchema.super
         : evidence.jobType !== JobType.SCHEDULED_CRON || !(evidence.batchRef || evidence.operationPathKey))) {
         ctx.addIssue({ code: 'custom', message: 'Evidence requires exactly one scheduled batch, operation or minion target' });
     }
-    const expectedStatus = evidence.source === ScheduledEvidenceSource.ABANDONMENT ? JobExecutionStatus.FAILED : JobExecutionStatus.COMPLETED;
-    if (evidence.invocationStatus !== expectedStatus) {
+    if (evidence.invocationStatus !== scheduledEvidenceInvocationStatus(evidence.source)) {
         ctx.addIssue({ code: 'custom', path: ['invocationStatus'], message: 'Terminal outcome must agree with evidence source' });
     }
     if (evidence.expiresAt.getTime() !== evidence.completedAt.getTime() + evidence.policy.retainForMs) {
@@ -361,6 +438,12 @@ export const ScheduledExecutionStateSchema = z.object({
     /** A successful reconciliation authorizes exactly the next execution admission. */
     reconciledSafe: z.boolean().default(false),
     reason: z.string().optional(),
+    /**
+     * Present only on an occurrence recorded from a LATE delivery (#2212): it was never admitted and
+     * never runs. Structured rather than folded into `reason`, so the coverage report and a repeated
+     * late receipt recognise the row without parsing prose.
+     */
+    lateness: z.enum(ScheduledDeliveryLateness).optional(),
     attempts: z.array(z.object({
         attemptId: z.uuid(),
         phase: z.enum(ScheduledExecutionPhase),