akm-cli 0.9.17-alpha.2 → 0.9.17-alpha.4

package/dist/workflows/exec/step-work.js

@@ -2,19 +2,13 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Shared step semantics — the ONE implementation of a step's orchestration
- * decisions, consumed by the engine loop (`run-workflow.ts` +
- * `native-executor.ts`) on both the fresh-execution and the resume/replay
- * path, so a first run and a resumed run of the same frozen plan produce
- * byte-identical unit graphs. `computeStepWorkList` and its reducer/gate/route
- * helpers are PURE (no clock, no IO, no journal read); the gate-evaluation
- * journaling functions are the one deliberate exception. This module never
- * dispatches a unit and never writes step rows.
- *
- * See docs/architecture/decisions/0002-unit-reuse-and-input-hash-scope.md for
- * the full purity-contract design history.
+ * Shared step semantics: the one implementation of a step's orchestration
+ * decisions, used by the engine on both a fresh run and a resume, so the same
+ * frozen plan produces byte-identical unit graphs. Pure except the
+ * gate-evaluation journaling; never dispatches and never writes step rows.
+ * See docs/architecture/decisions/0002-unit-reuse-and-input-hash-scope.md.
  */
-import { createHash, randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
 import unitPreambleTemplate from "../../assets/prompts/workflow-unit-preamble.md" with { type: "text" };
 import { UsageError } from "../../core/errors.js";
 import { validateJsonSchemaSubset } from "../../core/json-schema.js";
@@ -25,40 +19,18 @@ import { canonicalJson } from "../ir/plan-hash.js";
 import { parseReference, resolveReferenceString, } from "../program/expressions.js";
 import { clip, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
 import { completeWorkflowStep } from "../runtime/runs.js";
-import { GATE_EVALUATION_PHASE } from "../runtime/unit-phases.js";
 import { parseJudgeVerdict } from "../validate-summary.js";
 import { gateNodeId } from "./frozen-judge.js";
 import { enqueueUnitWrite } from "./unit-writer.js";
 /** How much raw unit output is retained in step evidence (full text lives on the unit row). */
 const EVIDENCE_TEXT_CLIP = 2_000;
-/** How much artifact JSON the completion-criteria judge receives (addendum R2, artifact-judging gates). */
+/** How much artifact JSON the completion-criteria judge receives. */
 const GATE_ARTIFACT_CLIP = 4_000;
 /**
- * Compute a step's expected work-list PURELY from the frozen plan and its
- * inputs: resolve the fan-out list, derive content-derived unit ids, assemble
- * each unit's prompt (preamble + interpolated instructions + gate feedback +
- * schema directive), and hash the resolved input. Same inputs ⇒ byte-identical
- * ids/hashes/prompts — the invariant resume/replay relies on to recognize the
- * units an earlier run already journaled.
- *
- * Whole-list failures (missing subgraph, unresolvable / non-array `over`,
- * null or duplicate fan-out items) return `{ ok: false }`. Per-unit resolution
- * cannot fail in the shared source IR — prose is never scanned for references,
- * and everything that CAN fail (map.over / route.input / inputs:) resolves
- * once per step, failing the whole list above.
- */
-/**
- * Validate a fan-out item list BEFORE any identity/dispatch work: expansion
- * within the resource limit, no null/undefined items, no canonical duplicates.
- * Returns the failure message, or undefined when the list is dispatchable.
- *
- * Null items: producer garbage — there is nothing to hand the unit as its work
- * item. The pre-unification format rejected them incidentally (substituting
- * `${{ item }}` failed); with items attached as context instead of spliced,
- * nothing later would stop a unit from being dispatched with "Item: null", so
- * the rejection is explicit here. Duplicates: content-derived unit identity
- * makes canonical duplicates collide on id — an authoring error caught
- * deterministically, before dispatch.
+ * Validate a fan-out item list before any identity/dispatch work: no
+ * null/undefined items (there would be nothing to hand the unit) and no
+ * canonical duplicates (content-derived unit ids would collide). Returns the
+ * failure message, or undefined when the list is dispatchable.
  */
 function validateFanOutItems(stepId, items) {
     const nullIndex = items.findIndex((item) => item === null || item === undefined);
@@ -69,17 +41,9 @@ function validateFanOutItems(stepId, items) {
     return undefined;
 }
 /**
- * Resolve one whole-value reference, refusing a value a persisted TRUNCATION
- * ENVELOPE stands in for (`clipStepEvidenceForPersistence`, runtime/runs.ts).
- *
- * The first occurrence of a given canonical value keeps the byte-identical id
- * {@link unitIdFor} always produced for it — so a plan with no duplicates (the
- * overwhelming common case) is completely unaffected, and no prior journal
- * entry is ever invalidated by this change. Only the SECOND and later
- * occurrences gain a `#<n>` suffix (`#2`, `#3`, …), computed purely from each
- * item's position in `items` — deterministic across a fresh run and a
- * resumed one, since both call this from the same place in
- * {@link computeStepWorkList} over the same resolved list.
+ * Unit ids for a fan-out list: the first occurrence of a canonical value keeps
+ * {@link unitIdFor}'s id; later occurrences gain `#2`, `#3`, … by position, so
+ * a fresh run and a resume derive the same ids.
  */
 function occurrenceSuffixedUnitIds(nodeId, items) {
     const occurrenceByCanonical = new Map();
@@ -91,35 +55,15 @@ function occurrenceSuffixedUnitIds(nodeId, items) {
         return occurrence === 1 ? base : `${base}#${occurrence}`;
     });
 }
-/**
- * Resolve one whole-value reference (`inputs[]`, `map.over`, `route.input`).
- *
- * Every step artifact is now persisted whole (issue C), so this is a thin
- * wrapper: source adapters may retain GitHub's whole-value `${{ ... }}`
- * spelling, and this work-list seam unwraps only an exact whole-value
- * wrapper — it never interpolates prose.
- */
+/** Resolve one whole-value reference (`inputs[]`, `map.over`, `route.input`, a binding's `from`). */
 function resolveStepReference(reference, scope) {
-    // Source adapters may retain GitHub's whole-value `${{ ... }}` spelling.
-    // The source IR owns GitHub's whole-value spelling; this work-list seam
-    // unwraps only an exact whole-value wrapper and never interpolates prose.
-    const exactWrapper = /^\$\{\{\s*([^{}]+?)\s*\}\}$/.exec(reference);
-    const canonicalReference = exactWrapper?.[1] ?? reference;
-    return resolveReferenceString(canonicalReference, scope);
+    return resolveReferenceString(reference, scope);
 }
 /**
- * Pre-attempt resolution of a task-composing step's frozen `inputBindings`
- * (spec docs/plans/specs/p2b-input-bindings.md §3.6, B-31..B-34): a
- * `{kind:"literal"}` passes through unchanged — its schema was already
- * checked at FREEZE (`freezeTaskInputBindings`,
- * `src/workflows/freeze/task-bindings.ts`), so it is never re-validated. A
- * `{kind:"reference"}` resolves via the SAME {@link resolveStepReference}
- * every other whole-value position uses, then validates the resolved value
- * against the binding's own frozen `schema` — a mismatch (or a reference that
- * fails to resolve at all) fails the WHOLE step here, before
- * `reserveUnitAttempt` is ever called by the native executor. Absent
- * `bindings` (the overwhelmingly common case — no `with:` on this step's
- * target) resolves trivially to `{}` with no scope access at all.
+ * Resolve a composing step's frozen `inputBindings` before any attempt: a
+ * literal passes through (checked at freeze); a reference resolves like every
+ * other whole-value position and is validated against its frozen schema. A
+ * failure fails the whole step. No bindings resolve to `{}`.
  */
 function resolveTaskInputBindings(bindings, stepId, scope) {
     if (!bindings || bindings.length === 0)
@@ -155,6 +99,13 @@ function resolveTaskInputBindings(bindings, stepId, scope) {
     }
     return { ok: true, values };
 }
+/**
+ * Compute a step's work list purely from the frozen plan and its inputs:
+ * resolve the fan-out list, derive content-derived unit ids, assemble each
+ * unit's prompt, and hash its input. Same inputs give byte-identical
+ * ids/hashes/prompts — what resume relies on to recognize journaled units.
+ * Every reference resolves once per step, so failures fail the whole list.
+ */
 export function computeStepWorkList(plan, input) {
     const root = plan.root;
     // Route-only steps (YAML `route:`) carry no execution subgraph.
@@ -185,15 +136,7 @@ export function computeStepWorkList(plan, input) {
         }
         resolvedInputs.push({ reference, value: resolved.value });
     }
-    // P2b Lane A2 — pre-attempt resolution of a task-composing step's frozen
-    // `inputBindings` (spec §3.6, B-31..B-34): a `{kind:"literal"}` passes
-    // through unchanged (its schema was already checked at freeze, B-34); a
-    // `{kind:"reference"}` resolves against this SAME scope, then its resolved
-    // value is validated against the binding's own frozen `schema` — a
-    // mismatch fails the WHOLE step here, before `reserveUnitAttempt` is ever
-    // reached (B-32). This runs for every target kind (command/shell/script);
-    // Lane B's delivery consumes the result via `StepWorkUnitContext.taskInputs`
-    // / `taskInputsJson` below.
+    // A composing step's frozen `inputBindings`, resolved against this scope for every target kind.
     const taskInputsResolution = resolveTaskInputBindings(template.frozenTarget.inputBindings, plan.stepId, scope);
     if (!taskInputsResolution.ok)
         return taskInputsResolution;
@@ -235,31 +178,14 @@ export function computeStepWorkList(plan, input) {
     const target = template.frozenTarget;
     const frozenExec = target.kind === "shell" || target.kind === "script" ? target.exec : undefined;
     const runner = target.kind === "command" ? target.runner.kind : "exec";
-    // Taken VERBATIM from the frozen plan — there is no engine-side backstop, by
-    // design. The whole timeout decision happens once at freeze time
-    // (`ir/freeze.ts` `effectiveTimeout`: unit `timeout:` → document
-    // `defaults.timeout` → `engines.<name>.timeoutMs` → the engine-kind default,
-    // `DEFAULT_LLM_TIMEOUT_MS` / `DEFAULT_AGENT_TIMEOUT_MS`). A frozen `null`
-    // means genuinely unbounded and is honored as such: it is reached either by an
-    // author writing `timeout: none` — an explicit, documented opt-out that a
-    // silent cap here would break — or by `DEFAULT_AGENT_TIMEOUT_MS`, which is
-    // itself `null` because agent harnesses own their own lifetime. The frozen IR
-    // collapses both to `timeoutMs: null`, so this layer could not tell them apart
-    // even if it wanted to; anything that should bound a unit belongs in
-    // `effectiveTimeout`, not here.
-    // An exec unit's budget is frozen on its exec spec (there is no engine to
-    // inherit one from); `ir/freeze.ts` resolved it once from unit `timeout:` →
-    // `defaults.timeout` → DEFAULT_EXEC_TIMEOUT_MS.
+    // Taken verbatim from the frozen plan, resolved once at freeze (an exec
+    // unit's on its exec spec). A frozen `null` means genuinely unbounded
+    // (`timeout: none`, or an agent harness that owns its own lifetime).
     const timeoutMs = target.kind === "command"
         ? (target.runner.timeoutMs ?? null)
         : target.kind === "child-workflow"
-            ? // A child-workflow target carries no exec spec of its own (§3.5).
-                // computeStepWorkList still builds this unit's context
-                // unconditionally — the child executor (child-workflow.ts,
-                // reached from native-executor.ts's dispatch seam, P3b §3.2) is
-                // what actually drives a child-workflow unit, not this line, so
-                // `null` only needs to be a value this layer can carry, never one
-                // an engine acts on.
+            ? // A child-workflow target carries no exec spec of its own.
+                // A child-workflow unit is driven by child-workflow.ts, never by this value.
                 null
             : target.exec.timeoutMs;
     // Step-constant exec context: `AKM_PARAMS` / `AKM_INPUTS` depend only on
@@ -271,7 +197,7 @@ export function computeStepWorkList(plan, input) {
     const execInputsJson = frozenExec && resolvedInputs.length > 0
         ? (canonicalJson(Object.fromEntries(resolvedInputs.map((entry) => [entry.reference, entry.value]))) ?? "{}")
         : undefined;
-    // P2b Lane A2 (§3.6): the resolved effective task-composition inputs,
+    // P2b Lane A2: the resolved effective task-composition inputs,
     // serialized ONCE here (mirrors execParamsJson/execInputsJson above) —
     // Lane B's delivery (buildUnitPrompt's "## Task inputs" block,
     // buildExecContextEnv's AKM_TASK_INPUTS) reads both back per unit.
@@ -298,33 +224,17 @@ export function computeStepWorkList(plan, input) {
         list: { template, reducer, isFanOut, ...(concurrency !== undefined ? { concurrency } : {}), items, units },
     };
 }
-/**
- * Build ONE unit of the step's work list: its journal id, its assembled prompt,
- * its exec context env (exec units only), and its canonical input hash.
- *
- * Extracted from {@link computeStepWorkList} verbatim — same inputs, same
- * bytes. It is a separate named pass only because the step-level resolution
- * (inputs, fan-out items, runner, timeout) and the per-unit instantiation are
- * two different jobs, and keeping them in one function had grown it past the
- * repo's 220-line function bar.
- */
+/** Build one unit of the step's work list: journal id, prompt, exec context env, and input hash. */
 function buildStepWorkUnit(ctx, unitId, item, index) {
     const { plan, input, template, isFanOut, resolvedInputs, target, frozenExec, taskInputs } = ctx;
     // Gate loops (>= 2) journal under `<unitId>~l<loop>` so loop 1's rows are
     // never clobbered; the content-derived identity (and the prompt's
     // {{UNIT_ID}}) stays the base id.
     const journalBaseId = ctx.gateLoop > 1 ? `${unitId}~l${ctx.gateLoop}` : unitId;
-    // Context attachment (workflow-format-unification, spec §4): every unit
-    // receives the run params (already in the preamble), its item + index if
-    // it is a map unit, and the artifacts named by its step's `inputs:`.
-    // Instructions reach the unit byte-exact — never interpolated.
-    //
-    // An EXEC unit gets NO prompt: there is no model to read one, the exec
-    // dispatch branch returns before ever touching `request.prompt`, and the input
-    // hash is built from `template.instructions`, not from the assembled string.
-    // Its context reaches the child through {@link buildExecContextEnv} instead —
-    // attached as environment, never spliced into argv, which is the argv-array
-    // analogue of "data is attached context, not string splices".
+    // Every unit receives the run params, its item + index if it is a map unit,
+    // and its step's `inputs:` artifacts as attached context; instructions are
+    // never interpolated. An exec unit gets no prompt: its context reaches the
+    // child as environment ({@link buildExecContextEnv}), never spliced into argv.
     const prompt = frozenExec
         ? ""
         : buildUnitPrompt({
@@ -334,7 +244,7 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
             params: input.params,
             ...(isFanOut ? { item, itemIndex: index } : {}),
             ...(resolvedInputs.length > 0 ? { inputs: resolvedInputs } : {}),
-            // P2b Lane B (§4.2, B-38/B-39): the composed task's resolved
+            // P2b Lane B: the composed task's resolved
             // `inputBindings`, when non-empty — see StepWorkUnitContext.taskInputs.
             ...(taskInputs && Object.keys(taskInputs).length > 0 ? { taskInputs } : {}),
             ...(input.gateFeedback ? { gateFeedback: input.gateFeedback } : {}),
@@ -359,7 +269,7 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
         ...(template.retry ? { retry: template.retry } : {}),
         onError: template.onError,
         ...(template.isolation ? { isolation: template.isolation } : {}),
-        // P3b §3.3 step 2: the SAME resolved `with:` bindings `taskInputs` already
+        // the SAME resolved `with:` bindings `taskInputs` already
         // carries, exposed under the name `child-workflow.ts`'s drive contract
         // reads. Absent (never `{}`) when the step binds nothing.
         ...(taskInputs && Object.keys(taskInputs).length > 0 ? { childParams: taskInputs } : {}),
@@ -368,30 +278,11 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
     };
 }
 /**
- * The `AKM_*` context environment an exec unit's child receives.
- *
- * An exec unit's argv is FROZEN and never interpolated (the shared source IR has
- * no substitution language at all), so this is how a fan-out item, the run
- * params, and the step's declared `inputs:` artifacts actually reach a command
- * — as attached environment, exactly as they reach an engine unit as attached
- * prompt context. Values are canonical JSON so a command can parse them.
- *
- * These are applied on top of the resolved `env:` bindings in the child, so an
- * engine-authored context variable can never be shadowed by a binding. Params
- * are DECLARED NON-SECRET (`exec/param-secrets.ts` explains why: they are in
- * every unit prompt and in the input hash, so they cannot be redacted);
- * secrets belong in `env:` bindings, which reach the child by name.
- *
- * SIZE is not bounded here, on purpose. A workflow artifact has no bound
- * comparable to an OS environment entry, so `AKM_INPUTS` (and `AKM_PARAMS` /
- * `AKM_ITEM` / `AKM_TASK_INPUTS`) can serialize past what `execve` accepts and
- * make PROCESS CREATION
- * fail with a bare `E2BIG`. The check belongs at the spawn boundary, where the
- * failure can be journaled as a unit outcome with an actionable message naming
- * the variable: `checkExecContextSize` in `exec/exec-unit.ts`, against
- * `execContextLimits()` for the platform the run is actually on (a Linux run is
- * checked against Linux's ceiling, not against the smallest supported one).
- * This function stays PURE and total.
+ * The `AKM_*` context environment an exec unit's child receives: how a fan-out
+ * item, the run params, and the step's `inputs:` artifacts reach a frozen argv
+ * (as canonical JSON). Applied over the resolved `env:` bindings so a binding
+ * cannot shadow it. Size is checked at the spawn boundary
+ * (`checkExecContextSize`, exec-unit.ts), where an E2BIG can be reported by name.
  */
 function buildExecContextEnv(args) {
     const { ctx, unitId, item, index } = args;
@@ -409,36 +300,17 @@ function buildExecContextEnv(args) {
     }
     if (ctx.execInputsJson !== undefined)
         env.AKM_INPUTS = ctx.execInputsJson;
-    // P2b Lane B (spec §4.1, B-35/B-36/B-39, B-N1): ONE variable carrying the
-    // composed task's effective `inputBindings` as canonical JSON — never one
-    // var per input. Absent when the frozen target carries no `inputBindings`
-    // or every resolved value is empty. Sizing is enforced by the SAME generic
-    // `checkExecContextSize` loop as every other `AKM_*` entry (exec-unit.ts) —
-    // no change there, the roster is just longer by one name (B-37).
+    // One variable carrying the resolved `inputBindings` as canonical JSON; absent when nothing is bound.
     if (ctx.taskInputsJson !== undefined)
         env.AKM_TASK_INPUTS = ctx.taskInputsJson;
     return env;
 }
 /**
- * The canonical dispatch-input envelope: every field here is an input that
- * changes what the backend is actually asked to do, so a completed unit is
- * reused ONLY when all of them match. `env` carries names only, never
- * resolved secret values. `retry`/`onError` are deliberately excluded — they
- * govern failed-unit re-dispatch, not a completed unit's inputs/output.
- * `gateFeedback` is included conditionally (a gate retry is a materially
- * different ask). `taskInputs` is likewise included conditionally (R-R15,
- * `hashVersion` 7): a reference binding's RESOLVED value reaches the unit's
- * prompt / `AKM_TASK_INPUTS` / `childParams`, so a changed upstream value is a
- * materially different ask even though the binding's authored shape inside
- * `frozenTarget` is unchanged — hashing it makes a resume whose journaled
- * upstream output was altered fail loudly as replay divergence instead of
- * silently reusing the stale row. The key is absent for a unit whose target
- * carries no `inputBindings`, so a binding-free unit's preimage keeps the same
- * shape it had (only the version fields moved 6 → 7). This is the ONE place a
- * unit's inputHash is computed.
- *
- * See docs/architecture/decisions/0002-unit-reuse-and-input-hash-scope.md for
- * the full field-by-field inclusion/exclusion rationale (reviewer finding #1).
+ * The unit's `input_hash`: every input that changes what the backend is asked
+ * to do (names, never secret values). Informational — resume reuses a
+ * completed row by unit id. `gateFeedback`/`taskInputs` are included only when
+ * present so the loop-1, binding-free preimage keeps its `hashVersion` 7 shape.
+ * See docs/architecture/decisions/0002-unit-reuse-and-input-hash-scope.md.
  */
 function computeUnitInputHash(ctx, item) {
     return createHash("sha256")
@@ -462,13 +334,10 @@ function computeUnitInputHash(ctx, item) {
         .digest("hex");
 }
 /**
- * Assemble the final prompt: engine preamble (run params + item/index +
- * declared-input artifacts, all as structured JSON context) + the step's
- * BYTE-EXACT prose instructions (+ gate feedback on loop re-executions, +
- * schema directive). Instructions are NEVER interpolated (workflow-format-
- * unification, spec §2.3) — data reaches the unit as attached context, not
- * string splices; only the ENGINE's own preamble placeholders are substituted
- * here.
+ * Assemble the final prompt: the engine preamble (params, item/index, input
+ * artifacts as JSON context) + the step's byte-exact instructions (+ gate
+ * feedback on a loop, + schema directive). Only the preamble's own
+ * placeholders are substituted.
  */
 export function buildUnitPrompt(input) {
     const { runId, stepId, unitId, params, itemIndex, item, inputs, taskInputs, gateFeedback, schema, instructions } = input;
@@ -489,12 +358,7 @@ export function buildUnitPrompt(input) {
     const inputsBlock = inputs && inputs.length > 0
         ? `\n\n## Declared inputs\n${inputs.map((i) => `### ${i.reference}\n${safeJson(i.value)}`).join("\n\n")}`
         : "";
-    // P2b Lane B (spec §4.2, B-38/B-39, B-N2): the composed task's resolved
-    // `inputBindings`, as a structured fenced JSON block — the same "attached
-    // context, never a splice" mechanism as itemBlock/inputsBlock above.
-    // `canonicalInputJson` (sorted keys) matches the AKM_TASK_INPUTS env var's
-    // own serialization, so the effective-inputs value reads identically on
-    // every delivery surface. Absent (or empty) appends nothing (B-39).
+    // The resolved `inputBindings` as a fenced JSON block, serialized exactly like AKM_TASK_INPUTS.
     const taskInputsBlock = taskInputs && Object.keys(taskInputs).length > 0
         ? `\n\n## Task inputs\nThe composed task's declared inputs resolved to:\n\`\`\`json\n${canonicalInputJson(taskInputs)}\n\`\`\``
         : "";
@@ -556,17 +420,9 @@ function stepTemplate(stepPlan) {
     return root.kind === "map" ? root.template : root;
 }
 /**
- * The step ids that ANOTHER step of the frozen plan can still read: the
- * producers named by an `inputs[]` entry, a `map.over`, or a `route.input`.
- * Those three fields are the WHOLE reference surface — instructions are never
- * scanned (workflow-format-unification, spec §2.3) — so a step outside this set
- * has no in-plan consumer and nothing needs to hold its artifact in memory once
- * it is journaled.
- *
- * Derived from the plan alone: O(plan), independent of run state, and stable
- * across the retry and gate loops (a retry re-opens one failed step, and a
- * looping step has not advanced, so neither can turn an unreferenced producer
- * into a referenced one mid-invocation).
+ * The step ids another step can still read (named by `inputs[]`, `map.over`,
+ * or `route.input` — the whole reference surface). A step outside this set
+ * need not keep its artifact in memory once journaled. Derived from the plan alone.
  */
 export function referencedStepIds(plan) {
     const referenced = new Set();
@@ -586,8 +442,8 @@ export function referencedStepIds(plan) {
     return referenced;
 }
 /**
- * Typed artifacts (addendum, R2): validate the promoted step artifact against
- * `IrStepPlan.outputSchema`. Returns the step-failure summary (validation
+ * Typed artifacts: validate the promoted step artifact against
+ * `WorkflowPlanStep.outputSchema`. Returns the step-failure summary (validation
  * errors included) on mismatch, undefined when valid or when no schema is
  * declared.
  */
@@ -601,14 +457,9 @@ export function validateStepArtifact(plan, evidence) {
         `${errors.join("; ")}.`);
 }
 /**
- * Warn-only check of each successful unit's own promoted value against its
- * template's declared `schema` (`unit.output`) — the one field a harness that
- * cannot request structured output drops during lowering (`untranslated-field`,
- * field `outputSchema`), after which nothing else ever compares the returned
- * text to it. Unlike {@link validateStepArtifact} this never fails the step:
- * a harness that DID honor the schema already returned a compliant `result`
- * (this re-check then finds nothing), and one that could not is exactly the
- * case this exists to surface — the run continues either way.
+ * Warn-only check of each successful unit's value against its declared
+ * `unit.output` schema — the field a harness without structured output drops
+ * during lowering. Never fails the step (unlike {@link validateStepArtifact}).
  */
 export function unitSchemaWarning(plan, units) {
     const schema = stepTemplate(plan)?.schema;
@@ -657,17 +508,9 @@ function unitOutputValue(unit) {
     return unit.text ?? null;
 }
 export function buildEvidence(units, reducer, isFanOut) {
-    // Per-unit evidence is the DURABLE projection of the unit graph — a fresh run
-    // and a resumed run of the same plan must agree on it byte-for-byte. It
-    // therefore carries ONLY fields that can be reproduced from the journal alone:
-    //   - a SUCCESS keeps its promoted contribution (structured `result` or clipped
-    //     `text`) — the reuse path rehydrates exactly these from the unit row;
-    //   - a FAILURE keeps only its `failureReason` (the durable, journaled failure
-    //     vocabulary). The in-memory dispatch diagnostic (`error`) and any residual
-    //     `text` on a failed unit are NOT persisted here: they do not survive a
-    //     restart, so persisting them on the live-dispatch path alone would make
-    //     the durable graph depend on WHEN it was built. The full raw text/reason
-    //     still lives on the unit row for diagnostics; this is the shared graph.
+    // Per-unit evidence carries only what the journal can reproduce, so a fresh
+    // run and a resume agree byte-for-byte: a success keeps its `result`/clipped
+    // `text`, a failure only its `failureReason` (diagnostics stay on the unit row).
     const collected = units.map((u) => u.ok
         ? {
             unitId: u.unitId,
@@ -712,32 +555,17 @@ export function buildEvidence(units, reducer, isFanOut) {
         else {
             const winner = ranked[0].value;
             evidence.vote = { winner, votes: ranked[0].count, total: units.length };
-            // An empty free-text unit normalizes to absent text, so its vote value is
-            // `undefined`. Assigning that to `evidence.output` made the key vanish
-            // under JSON serialization: a LIVE run then saw `output` absent (and fell
-            // back to the whole evidence envelope), while a RESUMED run rehydrated the
-            // same step from the journal and produced a different artifact — with the
-            // raw envelope exposed as `steps.<id>.output`. Normalize to an explicit
-            // empty string so both paths promote the same value.
+            // An empty free-text winner is `undefined`; normalize to "" so a live run
+            // and a resume promote the same `output` key.
             evidence.output = winner === undefined ? "" : winner;
         }
     }
     return evidence;
 }
 /**
- * The FIRST failed unit's diagnostic, appended to the step summary.
- *
- * A failure reason alone is not a diagnosis. `non_zero_exit` says a command
- * failed; for an exec unit the reason it failed is on stderr, and the summary is
- * what `akm workflow run` prints and what the failed step row keeps as its
- * notes. Bounded on both axes: ONE unit (a 10 000-wide fan-out must not turn its
- * summary into a log) clipped to {@link WORKFLOW_UNIT_DIAGNOSTIC_CLIP} — the same
- * bound the journal and `status --units` use.
- *
- * Reproducible on both surfaces: a live dispatch carries the diagnostic as
- * `error`; a unit rehydrated from the journal carries it as `text` (the column
- * `journaledUnitResultJson` wrote it to), so the fallback below composes the
- * SAME summary from either.
+ * The first failed unit's diagnostic (e.g. an exec unit's stderr), clipped to
+ * {@link WORKFLOW_UNIT_DIAGNOSTIC_CLIP}, for the step summary. A live outcome
+ * carries it as `error`, a rehydrated one as `text`; both give the same summary.
  */
 function firstFailureDiagnostic(failed) {
     const first = failed.find((u) => (u.error ?? u.text)?.trim());
@@ -747,13 +575,9 @@ function firstFailureDiagnostic(failed) {
     return ` First failure diagnostic (${first.unitId}): ${clip(diagnostic, WORKFLOW_UNIT_DIAGNOSTIC_CLIP)}`;
 }
 /**
- * Reduce a step's terminal unit outcomes into the promoted artifact + step
- * verdict — the shared semantics between native dispatch and the report path.
- * Applies the `on_error` policy (`fail` vs `continue`), the reducer (via
- * {@link buildEvidence}), the vote-tie failure, and the typed-artifact schema
- * validation (fail-fast, errors in the summary, `artifactSchemaFailure` marker).
- * Callers own dispatch-specific concerns (replay-divergence, budget) BEFORE
- * calling this; those never occur on the report path (units are journaled).
+ * Reduce a step's terminal unit outcomes into the promoted artifact and step
+ * verdict: the `on_error` policy, the reducer, the vote-tie failure, and the
+ * typed-artifact schema check (`artifactSchemaFailure` marks a retryable one).
  */
 export function reduceStepOutcomes(plan, reducer, isFanOut, onError, units) {
     const failed = units.filter((u) => !u.ok);
@@ -784,12 +608,8 @@ export function reduceStepOutcomes(plan, reducer, isFanOut, onError, units) {
         if (schemaWarning !== undefined)
             summary += ` ${schemaWarning}`;
     }
-    // P3b §3.4: a composed child workflow that blocked is carried on the
-    // failed unit's LIVE-ONLY `childRun` field (child-workflow.ts's
-    // driveChildWorkflowUnit). Surfaced here, unconditionally on the unit
-    // list, so `finalizeExecutedStep` can check it before deciding whether
-    // this step's failure is retryable — an `onError: "continue"` step that
-    // tolerates the failure (`ok` stays true) never reaches that check at all.
+    // A blocked child workflow (the failed unit's live-only `childRun`) is
+    // surfaced so `finalizeExecutedStep` blocks the step instead of retrying.
     const blockedChildUnit = failed.find((u) => u.failureReason === "child_workflow_blocked" && u.childRun !== undefined);
     const childBlocked = blockedChildUnit?.childRun
         ? {
@@ -808,18 +628,9 @@ export function reduceStepOutcomes(plan, reducer, isFanOut, onError, units) {
     };
 }
 /**
- * The reduced outcome of a step whose fan-out list resolved to EMPTY (`over: []`
- * or a producer that yielded `[]`): no units are dispatched, so the promoted
- * artifact is the degenerate empty value — the empty array for a `collect`
- * reducer, `null` for `vote` (references into a missing winner fail loudly at
- * resolution rather than silently reading the envelope). Even the degenerate
- * artifact must honor the step's declared `outputSchema` before it can complete.
- *
- * Used by native dispatch (`executeStepPlan`'s `items.length === 0` branch): a
- * zero-unit step can never be advanced by a unit completion, so it is promoted
- * here instead. Deliberately does NOT run the reducer/vote-tie logic: an empty
- * step has no successful results to count, and a vote-tie "failure" would
- * diverge from the engine's long-standing empty-list semantics.
+ * The outcome of a step whose fan-out list is empty: no units dispatch and the
+ * artifact is `[]` (collect) or `null` (vote), still checked against the step's
+ * `outputSchema`. The reducer/vote-tie logic does not run.
  */
 export function reduceEmptyStep(plan, reducer) {
     const evidence = { units: [], itemCount: 0, output: reducer === "collect" ? [] : null };
@@ -833,16 +644,9 @@ export function reduceEmptyStep(plan, reducer) {
     };
 }
 /**
- * Rehydrate a journaled unit row into a {@link UnitOutcome}. The executor's
- * durable-row reuse (`native-executor.ts`) calls it for completed rows; the
- * failed-row branch keeps the mapping TOTAL, so any reduction driven off the
- * journal yields the same outcome the live dispatch produced. A completed row's
- * text unit journals its output as a JSON string; a schema unit journals the
- * validated structure. A failed row carries its `failure_reason` plus whatever
- * `journaledUnitResultJson` (native-executor.ts) wrote to `result_json` —
- * surfaced as `text`, its historical meaning. {@link firstFailureDiagnostic} is
- * the one consumer that wants it as a diagnostic and falls back to `text`, so
- * the step summary stays the same on both surfaces.
+ * Rehydrate a journaled unit row into the {@link UnitOutcome} its live dispatch
+ * produced: a completed row's JSON text or structured result, or a failed row's
+ * `failure_reason` with its journaled diagnostic as `text`.
  */
 export function unitOutcomeFromRow(unitId, row, hasSchema) {
     let parsed;
@@ -879,37 +683,19 @@ export function unitOutcomeFromRow(unitId, row, hasSchema) {
 export { canonicalJson };
 // ── Gate-feedback recovery (PURE) ────────────────────────────────────────────
 //
-// A gate rejection is journaled as `<stepId>.gate:l<loop>` with result_json
-// `{ complete: false, missing, feedback }` (see journalGateEvaluationFinish).
-// The feedback stored there is BYTE-IDENTICAL to what the engine threads into
-// the next loop's prompts — both are the same `rejection.feedback`/`.missing`.
-// A resume recovers it from the journal so its loop-N work-list (and therefore
-// every unit id and input hash in it) matches the one the original run built.
-// `native-executor.test.ts` asserts the round-trip identity.
-// GATE_EVALUATION_PHASE moved to ../runtime/unit-phases.ts (leaf) so
-// unit-checkin can key on it without closing the exec ↔ runtime cycle.
+// A gate rejection journals `{ complete: false, missing, feedback }` under
+// `<stepId>.gate:l<loop>`, byte-identical to what the next loop's prompts
+// carry, so a resume rebuilds the same loop-N work list.
+/** `phase` marker on gate-evaluation unit rows (dispatch rows journal `phase: null`). */
+const GATE_EVALUATION_PHASE = "gate";
 /** The unit id of a step's gate-evaluation row for a given 1-based loop. */
 export function gateUnitId(stepId, loop) {
     return `${stepId}.gate:l${loop}`;
 }
 /**
- * How many times a step's subgraph may run under its completion gate — the
- * bound the engine loop walks and the one `loopsRemaining` is derived from.
- *
- * A gate loop only earns its re-dispatch when the subgraph can ANSWER the
- * judge: an engine unit reads the rejection feedback in its prompt and produces
- * different work. An `exec` unit cannot. Its argv is frozen and never
- * interpolated, {@link buildExecContextEnv} exposes no feedback variable, and
- * the default dispatcher drops feedback for exec — so a second loop re-runs the
- * BYTE-IDENTICAL command for a verdict that cannot change, which for a deploy /
- * publish / migrate command means performing the side effect twice. The same
- * reasoning already pins exec structured output to a single attempt and makes
- * `exec_capture_incomplete` non-retryable (`native-executor.ts`).
- *
- * So an exec step's gate still EVALUATES — the verdict can still fail the step
- * — but it never loops: a rejection lands on the gate-exhausted terminal
- * instead of re-dispatching. An authored `gate.max_loops` on an engine step is
- * untouched.
+ * How many times a step's subgraph may run under its gate. An exec step never
+ * loops: its frozen argv cannot read the judge's feedback, so a second loop
+ * would only repeat the command's side effects. Its gate still evaluates.
  */
 export function effectiveGateMaxLoops(stepPlan) {
     const declared = Math.max(1, stepPlan.gate.maxLoops ?? 1);
@@ -917,17 +703,9 @@ export function effectiveGateMaxLoops(stepPlan) {
     return target && target.kind !== "command" ? 1 : declared;
 }
 /**
- * The gate loop the engine is about to (re-)run for an ACTIVE step, derived
- * purely from the journal: one past the highest journaled loop that REJECTED
- * (`complete: false`). No rejected gate rows ⇒ loop 1 (the first execution).
- * A passed gate would have advanced the spine, so an active step never has a
- * `complete: true` row as its latest gate evaluation.
- *
- * Reviewer #17: a gate row that EXISTS but cannot be parsed (or carries an
- * invalid verdict shape) is CORRUPTION — {@link parseGateVerdict} throws loudly
- * rather than letting `gateRowRejected` swallow the parse error, which would
- * silently drop the loop back to 1 and re-dispatch work whose gate outcome is
- * unknown.
+ * The gate loop the engine is about to run for an active step: one past the
+ * highest journaled rejected loop (loop 1 when none). An unparseable gate row
+ * throws ({@link parseGateVerdict}) rather than silently restarting at loop 1.
  */
 export function activeGateLoop(rows, stepId) {
     let maxRejectedLoop = 0;
@@ -944,14 +722,8 @@ export function activeGateLoop(rows, stepId) {
     return maxRejectedLoop + 1;
 }
 /**
- * Recover the gate feedback the engine threads into `loop`'s unit prompts: the
- * `{ feedback, missing }` journaled by the previous loop's rejection
- * (`<stepId>.gate:l<loop-1>`). Loop 1 (or a missing/passed/errored previous row)
- * has no feedback. Pure — the journal rows are passed in.
- *
- * Reviewer #17: a PRESENT previous gate row that cannot be parsed fails LOUDLY
- * (via {@link parseGateVerdict}) instead of returning undefined — a corrupt row
- * must not make an in-loop step look like loop 1 with no recovered feedback.
+ * The `{ feedback, missing }` the previous loop's rejection journaled, which
+ * `loop`'s prompts carry; none for loop 1. An unparseable previous row throws.
  */
 export function recoverGateFeedback(rows, stepId, loop) {
     if (loop <= 1)
@@ -972,16 +744,9 @@ function gateLoopOf(unitId, stepId) {
     return Number.isInteger(n) && n >= 1 ? n : undefined;
 }
 /**
- * Classify a gate-evaluation row's journaled verdict, failing LOUDLY on a
- * corrupt one (reviewer #17). A NULL `result_json` is the LEGITIMATE
- * completion-error / in-flight shape (`journalGateEvaluationFinish` writes null
- * if completion itself throws after judge invocation, and a `running` row has no
- * verdict yet) and classifies as `empty`. But a PRESENT `result_json` that does
- * not parse as JSON, or parses to
- * anything other than an object with a boolean `complete` field, is corruption —
- * a truncated or hand-edited row — and MUST NOT be silently treated as absent
- * (which would reset an active step's gate loop to 1 and re-dispatch work whose
- * completion outcome is unknown). We refuse to guess.
+ * Classify a gate row's journaled verdict. A NULL `result_json` (in flight, or
+ * a completion error) is `empty`; a present value that is not `{ complete:
+ * boolean }` throws rather than resetting the gate loop to 1.
  */
 function parseGateVerdict(row) {
     if (row.result_json === null)
@@ -1016,8 +781,6 @@ function gateCorruptionMessage(row, why) {
 /** Insert the gate-evaluation unit row (running) just before the judge runs. */
 export async function journalGateEvaluationStart(gate) {
     const unitId = gateUnitId(gate.stepId, gate.loop);
-    const now = new Date().toISOString();
-    const claimHolder = gate.claimHolder ?? `direct:${randomUUID()}`;
     const reserved = await enqueueUnitWrite(() => withWorkflowRunsRepo((repo) => repo.reserveUnitAttempt({
         runId: gate.runId,
         unitId,
@@ -1028,25 +791,15 @@ export async function journalGateEvaluationStart(gate) {
         engine: gate.engine,
         model: gate.model,
         inputHash: gate.inputHash,
-        claimHolder,
-        claimExpiresAt: new Date(Date.parse(now) + 90_000).toISOString(),
-        now,
-        leaseMode: gate.claimHolder === undefined ? "direct" : "engine",
+        now: new Date().toISOString(),
     })));
-    if (reserved.kind === "busy") {
-        throw new UsageError(`Gate ${unitId} has a live durable attempt held by another engine.`);
-    }
-    return { ...gate, claimHolder, durableAttempt: reserved.attempt };
+    return { ...gate, durableAttempt: reserved.attempt };
 }
 /**
- * Finish the gate-evaluation unit row with the verdict as observed from the
- * completion outcome: a rejection journals `{ complete: false, missing,
- * feedback }`; a pass journals `{ complete: true, missing: [] }`. An ERRORED
- * evaluation (thrown judge, malformed verdict, completion failure after the
- * judge ran) journals a failed row with NO verdict (`result_json` NULL) —
- * `errored` takes precedence over any synthesized fail-closed rejection, so
- * `activeGateLoop`/`recoverGateFeedback` never mistake a judge outage for an
- * honest rejection and burn a gate loop on resume.
+ * Finish the gate-evaluation row: a rejection journals `{ complete: false,
+ * missing, feedback }`, a pass `{ complete: true, missing: [] }`. An errored
+ * evaluation journals a failed row with no verdict, so a judge outage never
+ * burns a gate loop on resume.
  */
 export async function journalGateEvaluationFinish(gate, errored, rejection) {
     const unitId = gateUnitId(gate.stepId, gate.loop);
@@ -1065,7 +818,6 @@ export async function journalGateEvaluationFinish(gate, errored, rejection) {
             unitId,
             attempt: durableAttempt.attempt,
             dispatchId: durableAttempt.dispatch_id,
-            claimHolder: durableAttempt.claim_holder,
             status,
             resultJson: verdict ? JSON.stringify(verdict) : null,
             tokens: gate.tokens ?? null,
@@ -1074,7 +826,7 @@ export async function journalGateEvaluationFinish(gate, errored, rejection) {
         });
     }));
     if (!finished) {
-        throw new UsageError(`Gate ${unitId} no longer owns its durable attempt; refusing a late terminal write.`);
+        throw new UsageError(`Gate ${unitId} was already finished; refusing a duplicate terminal write.`);
     }
 }
 /**
@@ -1162,15 +914,7 @@ function journaledRouteSelection(evidence) {
 function routeTargets(route) {
     return new Set([...Object.values(route.when), ...(route.defaultStepId ? [route.defaultStepId] : [])]);
 }
-/**
- * Reviewer #7: a journaled route decision must name a target the route actually
- * DECLARES (`when` branch or `default`). Corrupted or hand-edited evidence can
- * otherwise mark a non-existent step as `selected` — which unselects and skips
- * every REAL branch target, silently steering the run down a phantom branch.
- * `evaluateRoute` can only ever produce a declared target, so a stored value
- * outside that set is provably tampered evidence: fail loudly rather than seed a
- * bogus skip set.
- */
+/** A journaled route decision must name a target the route declares; anything else fails loudly. */
 function assertRouteTargetDeclared(route, stepId, selected, runId) {
     const targets = routeTargets(route);
     if (!targets.has(selected)) {
@@ -1205,7 +949,7 @@ export function seedJournaledRouteDecisions(plan, state, routeSelected, routeUns
             continue;
         let selected = journaledRouteSelection(stepState.evidence);
         if (selected !== undefined) {
-            // Reviewer #7: a stored decision must name a declared target — a bogus one
+            // a stored decision must name a declared target — a bogus one
             // (tampered/hand-edited evidence) fails loudly rather than seeding a skip
             // set that buries the real branches.
             assertRouteTargetDeclared(stepPlan.route, stepPlan.stepId, selected, state.run.id);
@@ -1255,7 +999,6 @@ export async function blockStepForJudgeFailure(input) {
         status: "blocked",
         notes,
         ...(input.evidence !== undefined ? { evidence: input.evidence } : {}),
-        ...(input.leaseHolder !== undefined ? { leaseHolder: input.leaseHolder } : {}),
     });
     return notes;
 }
@@ -1266,19 +1009,10 @@ async function blockFinalizedStep(input, cause) {
         stepId: input.stepId,
         cause,
         evidence: input.result.evidence,
-        ...(input.leaseHolder !== undefined ? { leaseHolder: input.leaseHolder } : {}),
     });
     return { kind: "judge-failed", summary };
 }
-/**
- * §3.4's exact `blockStepForChildWorkflow` notes — the ONE place the
- * blocked-child resume sequence is worded, mirroring {@link judgeFailureNotes}.
- * Two properties this wording pins (each its own test): the CHILD is resumed
- * FIRST, and the PARENT's own re-drive is what advances it (the child drive
- * never calls `resumeWorkflowRun` itself, row A-22); the notes name the child
- * run id and both commands verbatim, so the text renderer needs no change
- * (B-N15 — Lane A touches no output module).
- */
+/** The blocked-child resume notes: resume the child first, then re-drive the parent. */
 function childWorkflowBlockedNotes(runId, stepId, childRunId, childRef, childStepId) {
     return (`Step "${stepId}" composes child workflow run ${childRunId} (${childRef}), ` +
         `which is blocked at its own step "${childStepId ?? "(unknown)"}". Nothing in this run advances ` +
@@ -1287,14 +1021,7 @@ function childWorkflowBlockedNotes(runId, stepId, childRunId, childRef, childSte
         `\`akm workflow resume ${runId}\` and \`akm workflow run ${runId}\` to ` +
         `continue: re-driving the parent drives the resumed child.`);
 }
-/**
- * Complete a step `blocked` because the child workflow it composes is
- * blocked, and return the notes written (P3b §3.4). Sits beside
- * {@link blockStepForJudgeFailure} — the SAME shape of "infrastructure-like"
- * block: the step is completed `blocked`, and `akm workflow resume` is what
- * clears it (of the CHILD first, then the parent) rather than an automatic
- * in-step re-dispatch.
- */
+/** Complete a step `blocked` because its child workflow is blocked; `akm workflow resume` clears it. */
 export async function blockStepForChildWorkflow(input) {
     const notes = childWorkflowBlockedNotes(input.runId, input.stepId, input.childRunId, input.childRef, input.childStepId);
     await completeWorkflowStep({
@@ -1303,7 +1030,6 @@ export async function blockStepForChildWorkflow(input) {
         status: "blocked",
         notes,
         ...(input.evidence !== undefined ? { evidence: input.evidence } : {}),
-        ...(input.leaseHolder !== undefined ? { leaseHolder: input.leaseHolder } : {}),
     });
     return notes;
 }
@@ -1316,38 +1042,25 @@ async function blockFinalizedStepForChildWorkflow(input, childBlocked) {
         childRef: childBlocked.childRef,
         childStepId: childBlocked.childStepId,
         evidence: input.result.evidence,
-        ...(input.leaseHolder !== undefined ? { leaseHolder: input.leaseHolder } : {}),
     });
     return { kind: "child-blocked", summary };
 }
 /**
- * Perform ONE completion attempt for an executed step:
- *
- *  - a hard unit failure completes the step `failed` (a retryable typed-artifact
- *    mismatch with loops remaining returns `retry` WITHOUT journaling a gate row
- *    — no judge ran, exactly like the engine);
- *  - a route decision is evaluated against params + prior/fresh step outputs; an
- *    unroutable value fails the step; a valid decision is journaled on the
- *    step evidence and applied to the skip bookkeeping;
- *  - the completion gate judges a summary BUILT FROM the promoted artifact (when
- *    the step declares criteria), journaled as a `<stepId>.gate:l<loop>` unit
- *    row; a rejection with loops remaining returns `retry` (feedback threaded
- *    into the next loop), a rejection with none returns `gate-exhausted`, a pass
- *    returns `advanced`;
- *  - a judge INFRASTRUCTURE failure (missing judge, thrown judge call, or a
- *    malformed verdict) is NOT a verdict: it consumes no gate loop and blocks
- *    the step for `akm workflow resume` (`judge-failed`) instead of feeding
- *    the bounded loop's re-dispatch.
- *
- * Every DB advance goes through {@link completeWorkflowStep} — the gate spine is
- * never bypassed. Behavior is byte-identical to the engine's former inline loop
- * body (its tests prove it).
+ * Perform one completion attempt for an executed step:
+ *  - a hard unit failure fails the step (a retryable artifact-schema mismatch
+ *    with loops left returns `retry` without a gate row);
+ *  - a route decision is evaluated, journaled on the evidence, and applied to
+ *    the skip bookkeeping; an unroutable value fails the step;
+ *  - the gate judges a summary built from the promoted artifact: a rejection
+ *    returns `retry` (loops left) or `gate-exhausted`, a pass `advanced`;
+ *  - a judge infrastructure failure is not a verdict: it blocks the step for
+ *    `akm workflow resume` (`judge-failed`) without consuming a loop.
+ * Every advance goes through {@link completeWorkflowStep}.
  */
 export async function finalizeExecutedStep(input) {
     const { runId, workflowRef, stepId, stepPlan, completionCriteria, gateLoop, loopsRemaining, result } = input;
-    const lease = input.leaseHolder !== undefined ? { leaseHolder: input.leaseHolder } : {};
     if (!result.ok) {
-        // P3b §3.4: a composed child workflow that blocked is never fed into the
+        // a composed child workflow that blocked is never fed into the
         // bounded gate loop — a gate is a gate for a child workflow too. Checked
         // FIRST, before the artifactSchemaFailure retry branch below.
         if (result.childBlocked) {
@@ -1365,7 +1078,6 @@ export async function finalizeExecutedStep(input) {
             status: "failed",
             notes: result.summary,
             evidence: result.evidence,
-            ...lease,
         });
         return { kind: "failed", summary: result.summary };
     }
@@ -1391,7 +1103,7 @@ export async function finalizeExecutedStep(input) {
         const decision = evaluateRoute(stepPlan.route, scope);
         if (!decision.ok) {
             const notes = `Step "${stepId}" route failed: ${decision.error}`;
-            await completeWorkflowStep({ runId, stepId, status: "failed", notes, evidence: result.evidence, ...lease });
+            await completeWorkflowStep({ runId, stepId, status: "failed", notes, evidence: result.evidence });
             return { kind: "failed", summary: notes, routeFailure: true };
         }
         applyRouteDecision(stepPlan.route, stepId, decision.selected, input.routeSelected, input.routeUnselected);
@@ -1446,7 +1158,6 @@ export async function finalizeExecutedStep(input) {
                         prompt,
                     }))
                         .digest("hex"),
-                    ...(input.leaseHolder !== undefined ? { claimHolder: input.leaseHolder } : {}),
                 };
                 gateUnit = await journalGateEvaluationStart(gateUnit);
             }
@@ -1486,23 +1197,10 @@ export async function finalizeExecutedStep(input) {
             return raw;
         }
         : null;
-    // Reviewer #6: once the judge is invoked, its gate row is journaled `running`
-    // (journalGateEvaluationStart) and MUST be finished on every exit. The
-    // already-fixed window is the judge itself throwing (caught inside
-    // validateStepSummary — `judgeFailure` records it). The remaining
-    // window is `completeWorkflowStep` throwing AFTER the judge ran — a stolen
-    // lease, a concurrent state change, a DB error — which would otherwise skip the
-    // finish and strand the gate row in `running`. Finish it as an errored row (the
-    // observed outcome: the completion did not succeed), then re-propagate.
-    //
-    // The signal handed down is the DISPATCH signal (the judge call runs under
-    // it), not just the caller's: the interruption guard inside the completion
-    // path rethrows an abort instead of classifying it as a judge outage, and a
-    // lost lease aborting mid-judge is an interruption — recording it as a
-    // verifier failure would blame infrastructure and durably block a step whose
-    // gate simply never finished evaluating.
+    // Once the judge runs, its `running` gate row must be finished on every
+    // exit: if `completeWorkflowStep` throws afterwards, finish it as errored,
+    // then re-propagate.
     let completion;
-    const completionSignal = input.dispatchSignal ?? input.signal;
     try {
         completion = await completeWorkflowStep({
             runId,
@@ -1511,8 +1209,7 @@ export async function finalizeExecutedStep(input) {
             summary,
             evidence: result.evidence,
             summaryJudge,
-            ...(completionSignal ? { signal: completionSignal } : {}),
-            ...lease,
+            ...(input.signal ? { signal: input.signal } : {}),
         });
     }
     catch (err) {