akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/workflows/exec/param-secrets.js

@@ -71,9 +71,10 @@ function valueLooksSecret(value) {
         return true;
     return false;
 }
-const MOVE_TO_ENV = "Workflow params are copied verbatim into every unit prompt shown to any driver (they are part of the unit " +
-    "input hash and CANNOT be redacted) — move secrets to an env binding (`env:` ref), which `brief` surfaces by " +
-    "name only and never resolves.";
+const MOVE_TO_ENV = "Workflow params are copied verbatim into every native unit execution context and returned in `akm workflow run` and " +
+    "`akm workflow status` output (they are part of the unit input hash and CANNOT be redacted) — move " +
+    "secrets to an env binding (`env:` ref), whose value native execution resolves only at dispatch instead of storing " +
+    "it as a run param.";
 /**
  * Scan run params for secret-shaped values. Returns human-readable WARNING
  * strings (best-effort; never throws, never blocks). Recurses into nested

package/dist/workflows/exec/run-workflow.js

@@ -69,11 +69,11 @@ import { disposeDispatchResources } from "../../integrations/agent/runner-dispat
 import { withWorkflowRunsConnection, withWorkflowRunsRepo } from "../../storage/repositories/workflow-runs-repository.js";
 import { assertRunParamsSatisfyPlan } from "../ir/params.js";
 import { computePlanHash } from "../ir/plan-hash.js";
-import { decodeWorkflowPlanV3 } from "../ir/schema.js";
+import { decodeWorkflowPlanV4 } from "../ir/schema-v4.js";
 import { requireExecutableWorkflowPlan } from "../runtime/plan-classifier.js";
 import { completeWorkflowStep, getNextWorkflowStep, resumeWorkflowRun } from "../runtime/runs.js";
-import { GATE_EVALUATION_PHASE } from "../runtime/unit-phases.js";
 import { frozenSummaryJudge } from "./frozen-judge.js";
+import { mergeLoweringNotices } from "./lowering-notices.js";
 import { defaultUnitDispatcher, executeStepPlan, } from "./native-executor.js";
 // Shared step semantics — route evaluation + cascaded-skip bookkeeping,
 // gate-evaluation journaling, and the whole step-completion path
@@ -103,7 +103,8 @@ export async function runWorkflowSteps(options) {
         }, liveEvidence);
         executed.push(...result.executed);
         stepsProcessed += result.stepsProcessed;
-        const aggregate = { ...result, executed, stepsProcessed };
+        const notices = mergeLoweringNotices(...executed.map((step) => step.notices));
+        const aggregate = { ...result, executed, stepsProcessed, ...(notices ? { notices } : {}) };
         if (result.run.status !== "failed" || result.aborted || result.gateRejection || remainingRetries <= 0) {
             return aggregate;
         }
@@ -128,7 +129,7 @@ async function runWorkflowAttempt(options, liveEvidence) {
     });
     // Version/canonical/hash validation precedes every executable mutation,
     // including lease acquisition. Historical rows remain inspectable/abandonable.
-    if (!next.done && !options.loadPlan) {
+    if (!next.done) {
         await withWorkflowRunsRepo((repo) => {
             const row = repo.getRunById(next.run.id);
             if (!row)
@@ -367,22 +368,20 @@ async function completedRunResult(runId) {
         ...(doneState.run.status === "completed" ? { done: true } : {}),
     };
 }
-function workflowSummaryJudge(options, plan, stepPlan, signal, owner) {
+function workflowSummaryJudge(options, stepPlan, signal, owner) {
     if (options.summaryJudge !== undefined)
         return options.summaryJudge;
     // The judge dispatches under the REAL run/step identity; the per-loop gate row
     // identity is threaded in per call by the completion path that journals it.
-    return frozenSummaryJudge(plan, stepPlan.gate.judge, signal, options.dispatcher ?? defaultUnitDispatcher, owner);
+    return frozenSummaryJudge(stepPlan.gate.frozenJudge, signal, options.dispatcher ?? defaultUnitDispatcher, owner);
 }
 /**
  * Seed the lifetime unit cap AND the budget ceilings from the journal so
  * both are truly per-RUN: a resumed or re-invoked run must not restart the
- * runaway backstop — or a declared `budget` — at zero. Journal rows = past
- * dispatch ATTEMPTS (counted against `budget.max_units`); their summed
- * `tokens` column is the run's spend so far (counted against
- * `budget.max_tokens`). The executor consumes both only on new dispatches
- * (durable-row reuses are free), so a large partially-completed fan-out
- * stays resumable.
+ * runaway backstop — or a declared `budget` — at zero. The append-only attempt
+ * journal is authoritative: dispatch attempts count against
+ * `budget.max_units`, and their known tokens count against
+ * `budget.max_tokens`. Durable result reuse is free.
  *
  * Gate-evaluation rows (`phase = "gate"`, journaled by the completion-gate
  * judge) are EXCLUDED from the seed: the live path never consumes
@@ -392,20 +391,14 @@ function workflowSummaryJudge(options, plan, stepPlan, signal, owner) {
  * that `on_error` cannot soften. The seed must reproduce exactly what live
  * accounting would have accumulated.
  *
- * The seed sums each dispatch row's `attempts` (migration 008), NOT the row
- * COUNT: a crash between a unit's dispatch and its finish leaves a `running`
- * row that resume re-dispatches under the SAME content-derived unit_id, and
- * `insertUnit` REPLACES that one row while bumping `attempts`. Counting rows
- * would erase every prior crash-retried dispatch from budget/lifetime
- * accounting, letting the run spend past its declared ceiling; summing
- * `attempts` charges each dispatch exactly once.
+ * Attempt rows are append-only, so retries cannot collapse or erase prior
+ * dispatch accounting.
  */
 async function seedRunAccountingFromJournal(runId) {
-    const journaledUnits = await withWorkflowRunsRepo((repo) => repo.getUnitsForRun(runId));
-    const journaledDispatches = journaledUnits.filter((row) => row.phase !== GATE_EVALUATION_PHASE);
+    const accounting = await withWorkflowRunsRepo((repo) => repo.getAttemptAccounting(runId));
     return {
-        unitsDispatched: journaledDispatches.reduce((sum, row) => sum + row.attempts, 0),
-        tokensUsed: journaledDispatches.reduce((sum, row) => sum + (row.tokens ?? 0), 0),
+        unitsDispatched: accounting.dispatchAttempts,
+        tokensUsed: accounting.dispatchTokens,
     };
 }
 /**
@@ -418,14 +411,14 @@ async function seedRunAccountingFromJournal(runId) {
  * unit is dispatched (start already validated the params it stored).
  */
 async function loadAuthoritativeRunPlan(options, next) {
-    const plan = await loadFrozenPlan(next.run.id);
+    const stored = await loadStoredPlan(next.run.id);
     if (options.loadPlan) {
-        const expected = decodeWorkflowPlanV3(await options.loadPlan(next.run.workflowRef));
-        if (computePlanHash(expected) !== computePlanHash(plan))
+        const expected = decodeWorkflowPlanV4(await options.loadPlan(next.run.workflowRef));
+        if (computePlanHash(expected) !== computePlanHash(stored))
             throw new UsageError(`Injected workflow plan for run ${next.run.id} differs from its frozen plan.`);
     }
-    assertRunParamsSatisfyPlan(next.run.id, plan, next.run.params ?? {});
-    return plan;
+    assertRunParamsSatisfyPlan(next.run.id, stored, next.run.params ?? {});
+    return stored;
 }
 /**
  * Complete a branch target no completed router selected as `skipped` — no
@@ -515,7 +508,6 @@ async function executeStepSubgraph(ctx, loop) {
             // Budget ceilings ride the FROZEN plan (addendum R2): a mid-run
             // asset edit can never loosen or tighten a run's budget.
             ...(plan.budget ? { budget: plan.budget } : {}),
-            ...(plan.execution ? { engines: plan.execution.engines } : {}),
             gateLoop,
             ...(gateFeedback ? { gateFeedback } : {}),
             // The heartbeat's signal is the effective dispatch signal: a lost
@@ -571,6 +563,7 @@ async function runStepGateLoop(ctx, gate, totals) {
             unitCount: result.units.length,
             failedUnits: result.units.filter((u) => !u.ok).length,
             summary: result.summary,
+            ...(result.notices ? { notices: result.notices } : {}),
         });
         // Route evaluation + artifact-judged completion gate + gate-row
         // journaling + the bounded-loop rejection contract are the SHARED
@@ -594,7 +587,6 @@ async function runStepGateLoop(ctx, gate, totals) {
                 routeSelected,
                 routeUnselected,
                 summaryJudge,
-                ...(ctx.plan.execution ? { engines: ctx.plan.execution.engines } : {}),
                 signal: options.signal,
                 // The judge runs under the DISPATCH signal, so the completion path must
                 // see it too: an abort delivered there (a lost lease, a caller Ctrl-C)
@@ -783,7 +775,7 @@ liveEvidence) {
         // verify. No gate loop is consumed and nothing is dispatched.
         let summaryJudge;
         try {
-            summaryJudge = workflowSummaryJudge(options, plan, stepPlan, dispatchSignal, {
+            summaryJudge = workflowSummaryJudge(options, stepPlan, dispatchSignal, {
                 runId: next.run.id,
                 stepId: step.id,
             });
@@ -838,10 +830,12 @@ liveEvidence) {
     }
     // Re-read for the freshest run state (the loop may have exited on maxSteps).
     const finalState = await getNextWorkflowStep(next.run.id);
+    const notices = mergeLoweringNotices(...executed.map((step) => step.notices));
     return {
         run: finalState.run,
         executed,
         stepsProcessed,
+        ...(notices ? { notices } : {}),
         ...(finalState.run.status === "completed" ? { done: true } : {}),
         ...(gateRejection ? { gateRejection } : {}),
         ...(judgeFailure ? { judgeFailure } : {}),
@@ -858,7 +852,7 @@ liveEvidence) {
  * Missing and non-current plans fail validation and are never rebuilt from a
  * mutable source asset.
  */
-async function loadFrozenPlan(runId) {
+async function loadStoredPlan(runId) {
     const row = await withWorkflowRunsRepo((repo) => {
         const run = repo.getRunById(runId);
         return run;

package/dist/workflows/exec/step-work.js

@@ -38,14 +38,12 @@
  * the executor's job (`native-executor.ts`), advancing the gated spine is the
  * engine loop's job (`run-workflow.ts` via `completeWorkflowStep`).
  */
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import unitPreambleTemplate from "../../assets/prompts/workflow-unit-preamble.md" with { type: "text" };
 import { UsageError } from "../../core/errors.js";
-import { appendEvent } from "../../core/events.js";
 import { validateJsonSchemaSubset } from "../../core/json-schema.js";
-import { withWorkflowRunsRepo } from "../../storage/repositories/workflow-runs-repository.js";
+import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
 import { canonicalJson as canonicalJsonString } from "../ir/plan-hash.js";
-import { engineRuntimeKind } from "../ir/schema.js";
 import { parseReference, resolveReferenceString, } from "../program/expressions.js";
 import { clip, WORKFLOW_MAX_MAP_EXPANSION, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
 import { completeWorkflowStep, isTruncatedEvidence, } from "../runtime/runs.js";
@@ -67,7 +65,7 @@ const GATE_ARTIFACT_CLIP = 4_000;
  *
  * Whole-list failures (missing subgraph, unresolvable / non-array `over`,
  * null or duplicate fan-out items) return `{ ok: false }`. Per-unit resolution
- * cannot fail in the unified format — prose is never scanned for references,
+ * cannot fail in the shared source IR — prose is never scanned for references,
  * and everything that CAN fail (map.over / route.input / inputs:) resolves
  * once per step, failing the whole list above.
  */
@@ -119,8 +117,13 @@ function validateFanOutItems(stepId, items) {
  * goes through here.
  */
 function resolveStepReference(reference, scope) {
-    const resolved = resolveReferenceString(reference, scope);
-    const truncated = truncatedReferenceTarget(reference, scope, resolved);
+    // Source adapters may retain GitHub's whole-value `${{ ... }}` spelling.
+    // The source IR owns GitHub's whole-value spelling; this work-list seam
+    // unwraps only an exact whole-value wrapper and never interpolates prose.
+    const exactWrapper = /^\$\{\{\s*([^{}]+?)\s*\}\}$/.exec(reference);
+    const canonicalReference = exactWrapper?.[1] ?? reference;
+    const resolved = resolveReferenceString(canonicalReference, scope);
+    const truncated = truncatedReferenceTarget(canonicalReference, scope, resolved);
     if (!truncated)
         return resolved;
     return {
@@ -212,22 +215,11 @@ export function computeStepWorkList(plan, input) {
         return { ok: false, error: fanOutProblem };
     // Content-derived unit identity: compute every id up front (duplicate items
     // were rejected above — identity requires distinct items).
-    const unitIds = items.map((item) => unitIdFor(template.id, item, isFanOut));
+    const unitIds = items.map((item) => unitIdFor(template.id, item, isFanOut, true));
     const gateLoop = input.gateLoop ?? 1;
-    // An `exec` unit dispatches a child process instead of an engine call, so it
-    // carries a frozen exec spec and NO invocation (the frozen-plan decoder
-    // enforces that exclusive-or). Everything downstream — identity, hashing,
-    // journaling, retry, budget — is shared; only the dispatch mechanism differs.
-    const frozenExec = template.exec;
-    const frozenInvocation = template.invocation;
-    if (!frozenExec && !frozenInvocation)
-        return { ok: false, error: `Step "${plan.stepId}" has no frozen invocation.` };
-    const frozenEngine = frozenInvocation ? input.engines?.[frozenInvocation.engine] : undefined;
-    if (frozenInvocation && !frozenEngine) {
-        return { ok: false, error: `Step "${plan.stepId}" references missing frozen engine "${frozenInvocation.engine}".` };
-    }
-    // No frozen engine at all means an exec unit: it carries argv, not an invocation.
-    const runner = frozenEngine ? engineRuntimeKind(frozenEngine) : "exec";
+    const target = template.frozenTarget;
+    const frozenExec = target.kind === "shell" || target.kind === "script" ? target.exec : undefined;
+    const runner = target.kind === "command" ? target.runner.kind : "exec";
     // Taken VERBATIM from the frozen plan — there is no engine-side backstop, by
     // design. The whole timeout decision happens once at freeze time
     // (`ir/freeze.ts` `effectiveTimeout`: unit `timeout:` → document
@@ -243,7 +235,7 @@ export function computeStepWorkList(plan, input) {
     // An exec unit's budget is frozen on its exec spec (there is no engine to
     // inherit one from); `ir/freeze.ts` resolved it once from unit `timeout:` →
     // `defaults.timeout` → DEFAULT_EXEC_TIMEOUT_MS.
-    const timeoutMs = frozenExec ? frozenExec.timeoutMs : (frozenInvocation?.timeoutMs ?? null);
+    const timeoutMs = target.kind === "command" ? (target.runner.timeoutMs ?? null) : target.exec.timeoutMs;
     // Step-constant exec context: `AKM_PARAMS` / `AKM_INPUTS` depend only on
     // step-level values, so they are serialized ONCE here and shared by every
     // unit. Building them inside the per-unit loop deep-cloned and re-stringified
@@ -262,8 +254,7 @@ export function computeStepWorkList(plan, input) {
         resolvedInputs,
         runner,
         timeoutMs,
-        ...(frozenEngine ? { frozenEngine } : {}),
-        ...(frozenInvocation ? { frozenInvocation } : {}),
+        target,
         ...(frozenExec ? { frozenExec } : {}),
         ...(execParamsJson !== undefined ? { execParamsJson } : {}),
         ...(execInputsJson !== undefined ? { execInputsJson } : {}),
@@ -286,7 +277,7 @@ export function computeStepWorkList(plan, input) {
  * repo's 220-line function bar.
  */
 function buildStepWorkUnit(ctx, unitId, item, index) {
-    const { plan, input, template, isFanOut, resolvedInputs, frozenEngine, frozenInvocation, frozenExec } = ctx;
+    const { plan, input, template, isFanOut, resolvedInputs, target, frozenExec } = ctx;
     // Gate loops (>= 2) journal under `<unitId>~l<loop>` so loop 1's rows are
     // never clobbered; the content-derived identity (and the prompt's
     // {{UNIT_ID}}) stays the base id.
@@ -324,21 +315,12 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
         isFanOut,
         journalBaseId,
         runner: ctx.runner,
-        ...(frozenEngine ? { engine: frozenEngine } : {}),
-        ...(frozenEngine?.kind === "agent" &&
-            frozenEngine.fallbackLlmEngine &&
-            input.engines?.[frozenEngine.fallbackLlmEngine]?.kind === "llm"
-            ? {
-                fallbackEngine: input.engines[frozenEngine.fallbackLlmEngine],
-            }
-            : {}),
-        ...(frozenInvocation ? { invocation: frozenInvocation } : {}),
-        ...(frozenExec ? { exec: frozenExec } : {}),
+        frozenTarget: target,
+        environment: template.environment,
         ...(frozenExec ? { execContext: buildExecContextEnv({ ctx, unitId, item, index }) } : {}),
-        ...(frozenInvocation?.model ? { model: frozenInvocation.model } : {}),
+        ...(target.kind === "command" && target.request.model?.resolved ? { model: target.request.model.resolved } : {}),
         timeoutMs: ctx.timeoutMs,
         ...(template.schema ? { schema: template.schema } : {}),
-        ...(template.env ? { env: template.env } : {}),
         ...(template.retry ? { retry: template.retry } : {}),
         onError: template.onError,
         ...(template.isolation ? { isolation: template.isolation } : {}),
@@ -349,7 +331,7 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
 /**
  * The `AKM_*` context environment an exec unit's child receives.
  *
- * An exec unit's argv is FROZEN and never interpolated (the unified format has
+ * An exec unit's argv is FROZEN and never interpolated (the shared source IR has
  * no substitution language at all), so this is how a fan-out item, the run
  * params, and the step's declared `inputs:` artifacts actually reach a command
  * — as attached environment, exactly as they reach an engine unit as attached
@@ -405,8 +387,8 @@ function buildExecContextEnv(args) {
  * declared-input artifacts + the params snapshot — instead of a
  * resolved/spliced prompt string, since there is no more splicing.
  *
- * Included beyond the R4 baseline (template/runner/model/schema): resolved
- * timeoutMs (via `invocation`/`exec`), the env asset ref NAMES, and isolation —
+ * Included beyond the template/runner/model/schema baseline: resolved
+ * timeoutMs, named environment bindings, and isolation —
  * each reaches dispatch and a changed one yields a materially different call.
  * `env` carries NAMES ONLY, never resolved values: hashing a resolved secret
  * would leak it into a durable hash oracle and would spuriously re-dispatch on
@@ -421,33 +403,30 @@ function buildExecContextEnv(args) {
  * the rejected attempt. Replay-safe: feedback is re-derived from the journaled
  * gate decision, so a resumed retry re-hashes identically.
  *
- * `exec` is likewise conditional, which is what made the exec unit ADDITIVE:
- * an exec unit has no engine and no invocation, and its frozen spec (argv, cwd,
- * resolved timeout) is exactly what makes its dispatch different — so it gets
- * its own key, present only on exec units, and `hashVersion` stays 4. Every
- * previously-frozen llm/agent/sdk unit therefore hashes byte-identically to
- * before, and no in-flight run re-dispatches work it already completed.
+ * Command targets carry their frozen argv/script/cwd/timeout identity in the
+ * same target slot used by agent, SDK, and direct-LLM work. The complete
+ * current target is hashed once, so a completed unit is reused only for the
+ * exact durable request that originally produced it.
  *
- * Ambient config is DELIBERATELY excluded — the model-alias table, the resolved
- * backend/connection, and the working directory (`ctx.workDir` /
- * `process.cwd()`) are NOT plan-frozen. The frozen plan is the identity
- * boundary (redesign addendum determinism bar #2): config drift under an
- * in-flight run is out of scope by design.
+ * Ambient config is deliberately excluded because it is not consulted during
+ * execution. The frozen target and named environment bindings are the runtime
+ * identity boundary; only the values behind those names remain live.
  */
 function computeUnitInputHash(ctx, item) {
-    const dispatch = ctx.frozenEngine ? transitiveDispatchSnapshot(ctx.frozenEngine, ctx.input.engines ?? {}) : null;
     return createHash("sha256")
+        .update("akm.workflow.unit\0v5\0")
         .update(canonicalJsonString({
-        hashVersion: 4,
+        hashVersion: 5,
+        role: "unit",
+        stepId: ctx.plan.stepId,
+        nodeId: ctx.template.id,
         template: ctx.template.instructions,
         item: ctx.isFanOut ? (item ?? null) : null,
         inputs: ctx.resolvedInputs,
         params: ctx.input.params,
-        dispatch,
-        invocation: ctx.frozenInvocation ?? null,
-        ...(ctx.frozenExec ? { exec: ctx.frozenExec } : {}),
+        frozenTarget: ctx.target,
+        environment: ctx.template.environment,
         schema: ctx.template.schema ?? null,
-        env: ctx.template.env ?? null,
         isolation: ctx.template.isolation ?? "none",
         ...(ctx.input.gateFeedback ? { gateFeedback: ctx.input.gateFeedback } : {}),
     }))
@@ -498,27 +477,18 @@ export function buildUnitPrompt(input) {
     return `${preamble}\n${instructions}${itemBlock}${inputsBlock}${gateBlock}${schemaDirective}`;
 }
 /**
- * Content-derived unit identity (module doc): `<node_id>:<hash12>` for a
+ * Content-derived unit identity (module doc): `<node_id>:<sha256>` for a
  * fan-out item, `<node_id>:solo` otherwise. The hash is over the item's
  * canonical JSON (sorted keys — same canonicalization the vote reducer
  * counts with), so identity survives list reordering/regeneration and is
  * independent of item position. Retry attempts stack `~r<n>` on top.
  */
-export function unitIdFor(nodeId, item, isFanOut) {
+export function unitIdFor(nodeId, item, isFanOut, collisionSafe = false) {
     if (!isFanOut)
         return `${nodeId}:solo`;
     const canonical = canonicalJson(item) ?? "null";
-    return `${nodeId}:${createHash("sha256").update(canonical).digest("hex").slice(0, 12)}`;
-}
-/** Include an SDK fallback in v3 call identity without copying catalog entries onto nodes. */
-function transitiveDispatchSnapshot(engine, engines) {
-    if (engine.kind !== "agent" || !engine.fallbackLlmEngine)
-        return engine;
-    const fallback = engines[engine.fallbackLlmEngine];
-    if (!fallback || fallback.kind !== "llm") {
-        throw new UsageError(`Frozen agent engine "${engine.name}" has no valid LLM fallback snapshot.`);
-    }
-    return { engine, fallback };
+    const digest = createHash("sha256").update(canonical).digest("hex");
+    return `${nodeId}:${collisionSafe ? digest : digest.slice(0, 12)}`;
 }
 // ── Step outputs + reducers + typed artifacts ────────────────────────────────
 /**
@@ -856,7 +826,8 @@ export function gateUnitId(stepId, loop) {
  */
 export function effectiveGateMaxLoops(stepPlan) {
     const declared = Math.max(1, stepPlan.gate.maxLoops ?? 1);
-    return stepTemplate(stepPlan)?.exec ? 1 : declared;
+    const target = stepTemplate(stepPlan)?.frozenTarget;
+    return target && target.kind !== "command" ? 1 : declared;
 }
 /**
  * The gate loop the engine is about to (re-)run for an ACTIVE step, derived
@@ -958,26 +929,27 @@ function gateCorruptionMessage(row, why) {
 /** Insert the gate-evaluation unit row (running) just before the judge runs. */
 export async function journalGateEvaluationStart(gate) {
     const unitId = gateUnitId(gate.stepId, gate.loop);
-    await enqueueUnitWrite(() => withWorkflowRunsRepo((repo) => repo.insertUnit({
+    const now = new Date().toISOString();
+    const claimHolder = gate.claimHolder ?? `direct:${randomUUID()}`;
+    const reserved = await enqueueUnitWrite(() => withWorkflowRunsRepo((repo) => repo.reserveUnitAttempt({
         runId: gate.runId,
         unitId,
         stepId: gate.stepId,
         nodeId: gateNodeId(gate.stepId),
-        parentUnitId: null,
-        // Marks the row as a judge call, NOT a dispatch: the budget/lifetime
-        // seed in `driveRun` skips these so resume accounting matches live.
         phase: GATE_EVALUATION_PHASE,
         runner: gate.runner,
-        engine: gate.invocation.engine,
-        model: gate.invocation.model,
+        engine: gate.engine,
+        model: gate.model,
         inputHash: gate.inputHash,
-        startedAt: new Date().toISOString(),
+        claimHolder,
+        claimExpiresAt: new Date(Date.parse(now) + 90_000).toISOString(),
+        now,
+        leaseMode: gate.claimHolder === undefined ? "direct" : "engine",
     })));
-    appendEvent({
-        eventType: "workflow_unit_started",
-        ref: gate.workflowRef,
-        metadata: { runId: gate.runId, stepId: gate.stepId, unitId },
-    });
+    if (reserved.kind === "busy") {
+        throw new UsageError(`Gate ${unitId} has a live durable attempt held by another engine.`);
+    }
+    return { ...gate, claimHolder, durableAttempt: reserved.attempt };
 }
 /**
  * Finish the gate-evaluation unit row with the verdict as observed from the
@@ -997,20 +969,26 @@ export async function journalGateEvaluationFinish(gate, errored, rejection) {
             ? { complete: false, missing: rejection.missing, feedback: rejection.feedback }
             : { complete: true, missing: [] };
     const status = errored ? "failed" : "completed";
-    await enqueueUnitWrite(() => withWorkflowRunsRepo((repo) => repo.finishUnit({
-        runId: gate.runId,
-        unitId,
-        status,
-        resultJson: verdict ? JSON.stringify(verdict) : null,
-        tokens: null,
-        failureReason: errored ? "dispatch_error" : null,
-        finishedAt: new Date().toISOString(),
-    })));
-    appendEvent({
-        eventType: "workflow_unit_finished",
-        ref: gate.workflowRef,
-        metadata: { runId: gate.runId, stepId: gate.stepId, unitId, status },
-    });
+    if (!gate.durableAttempt)
+        throw new UsageError(`Gate ${unitId} has no durable attempt to finish.`);
+    const durableAttempt = gate.durableAttempt;
+    const finished = await enqueueUnitWrite(() => withWorkflowRunsRepo((repo) => {
+        return repo.finishUnitAttempt({
+            runId: gate.runId,
+            unitId,
+            attempt: durableAttempt.attempt,
+            dispatchId: durableAttempt.dispatch_id,
+            claimHolder: durableAttempt.claim_holder,
+            status,
+            resultJson: verdict ? JSON.stringify(verdict) : null,
+            tokens: gate.tokens ?? null,
+            failureReason: errored ? "dispatch_error" : null,
+            finishedAt: new Date().toISOString(),
+        });
+    }));
+    if (!finished) {
+        throw new UsageError(`Gate ${unitId} no longer owns its durable attempt; refusing a late terminal write.`);
+    }
 }
 /**
  * Resolve a route's input (a single whole-value reference string — `params.x` or
@@ -1290,8 +1268,7 @@ export async function finalizeExecutedStep(input) {
     // Journal engine-driven judge calls as unit rows. With no criteria there is
     // no judge invocation or row; a criteria-bearing plan without a judge is a
     // configuration error rather than a silent bypass.
-    const gateInvocation = innerJudge ? (stepPlan.gate.judge ?? null) : null;
-    const gateEngine = gateInvocation ? (input.engines?.[gateInvocation.engine] ?? null) : null;
+    const gateTarget = innerJudge ? stepPlan.gate.frozenJudge : null;
     let gateUnit;
     // `judgeFailure` records a verifier INFRASTRUCTURE failure observed during
     // the judge call — a throw (transport/service error) or a response that is
@@ -1301,32 +1278,51 @@ export async function finalizeExecutedStep(input) {
     let judgeFailure;
     const summaryJudge = innerJudge
         ? async (prompt) => {
-            if (gateInvocation) {
+            if (gateTarget) {
+                const engineName = gateTarget.request.engine.name;
+                if (!engineName)
+                    throw new Error(`Gate ${stepId} has no frozen engine identity.`);
                 gateUnit = {
                     runId,
                     workflowRef,
                     stepId,
                     loop: gateLoop,
-                    invocation: gateInvocation,
-                    // No engine snapshot means the built-in llm judge.
-                    runner: gateEngine ? engineRuntimeKind(gateEngine) : "llm",
+                    engine: engineName,
+                    model: gateTarget.request.model?.resolved ?? null,
+                    runner: gateTarget.runner.kind,
                     inputHash: createHash("sha256")
+                        .update("akm.workflow.gate\0v5\0")
                         .update(canonicalJsonString({
-                        hashVersion: 3,
-                        dispatch: gateEngine,
-                        invocation: gateInvocation,
+                        hashVersion: 5,
+                        dispatch: gateTarget,
+                        invocation: null,
                         prompt,
                     }))
                         .digest("hex"),
+                    ...(input.leaseHolder !== undefined ? { claimHolder: input.leaseHolder } : {}),
                 };
-                await journalGateEvaluationStart(gateUnit);
+                gateUnit = await journalGateEvaluationStart(gateUnit);
             }
             // The judge dispatch must describe the SAME thing the gate row does, so
             // the row identity is threaded down to the dispatcher from right here —
             // the one place that computes it — instead of being re-derived (or, as
             // before, synthesized as a constant "gate"). Both ids come from the same
             // helpers `journalGateEvaluationStart/Finish` use.
-            const identity = { runId, stepId, unitId: gateUnitId(stepId, gateLoop) };
+            const identity = {
+                runId,
+                stepId,
+                unitId: gateUnitId(stepId, gateLoop),
+                ...(gateUnit?.durableAttempt
+                    ? {
+                        attempt: gateUnit.durableAttempt.attempt,
+                        dispatchId: gateUnit.durableAttempt.dispatch_id,
+                        recordTokens: (tokens) => {
+                            if (gateUnit)
+                                gateUnit.tokens = tokens;
+                        },
+                    }
+                    : {}),
+            };
             let raw;
             try {
                 raw = await innerJudge(prompt, identity);