cool-workflow 0.1.79 → 0.1.81

package/dist/run-registry/derive.js

@@ -0,0 +1,172 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LIFECYCLE_STATES = void 0;
+exports.compareRecords = compareRecords;
+exports.compareHistory = compareHistory;
+exports.compareQueue = compareQueue;
+exports.matchesQuery = matchesQuery;
+exports.distinctBackends = distinctBackends;
+exports.digestInputs = digestInputs;
+exports.countRecords = countRecords;
+exports.optionalLower = optionalLower;
+exports.clampInt = clampInt;
+exports.queueId = queueId;
+exports.isRunLifecycleState = isRunLifecycleState;
+exports.loadReclaimedFromDir = loadReclaimedFromDir;
+// Pure, stateless helpers for the run registry — comparison, query matching,
+// input digesting, counting, and small utilities. Carved out of run-registry.ts
+// (FreeBSD-audit R2) so the stateful RunRegistry class no longer bundles the pure
+// derivation layer. Nothing here touches `this`; everything is a pure function of
+// its arguments (queueId is the lone exception — a process-local counter, kept as
+// it was; making ID minting deterministic is a separate tracked item).
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const compare_1 = require("../compare");
+exports.LIFECYCLE_STATES = [
+    "queued",
+    "running",
+    "blocked",
+    "completed",
+    "failed",
+    "archived",
+    "reclaimed"
+];
+function compareRecords(a, b) {
+    if (a.createdAt !== b.createdAt)
+        return a.createdAt < b.createdAt ? -1 : 1;
+    return (0, compare_1.compareBytes)(a.runId, b.runId);
+}
+function compareHistory(a, b) {
+    // Newest first.
+    if (a.createdAt !== b.createdAt)
+        return a.createdAt < b.createdAt ? 1 : -1;
+    return (0, compare_1.compareBytes)(a.runId, b.runId);
+}
+function compareQueue(a, b) {
+    if (a.priority !== b.priority)
+        return a.priority - b.priority;
+    if (a.enqueuedAt !== b.enqueuedAt)
+        return a.enqueuedAt < b.enqueuedAt ? -1 : 1;
+    return (0, compare_1.compareBytes)(a.id, b.id);
+}
+function matchesQuery(record, query) {
+    if (query.app && !(record.appId || record.workflowId || "").toLowerCase().includes(query.app))
+        return false;
+    if (query.status && record.lifecycle !== query.status && record.derivedLifecycle !== query.status)
+        return false;
+    if (query.repo && node_path_1.default.resolve(record.repo) !== query.repo)
+        return false;
+    if (query.since && record.createdAt < query.since)
+        return false;
+    if (query.until && record.createdAt > query.until)
+        return false;
+    if (query.text) {
+        const haystack = [
+            record.runId,
+            record.appId,
+            record.workflowId,
+            record.title,
+            record.repo,
+            record.lifecycle,
+            record.loopStage,
+            record.inputsDigest
+        ]
+            .filter(Boolean)
+            .join(" ")
+            .toLowerCase();
+        if (!haystack.includes(query.text))
+            return false;
+    }
+    return true;
+}
+/** Bounded, deterministic stringification of run inputs for free-text search.
+ *  Descriptive intent keys (question, prompt, ...) come first so they survive
+ *  truncation; the rest follow alphabetically. Deterministic and compact. */
+const DIGEST_PRIORITY_KEYS = ["question", "prompt", "task", "summary", "title", "objective", "focus", "topic"];
+/** Distinct execution backends used by a run's dispatches/tasks, recomputed from
+ *  source state. Sorted; empty for pre-v0.1.29 / default-only runs that never
+ *  recorded a backend. The registry stays backend-agnostic — this is metadata. */
+function distinctBackends(run) {
+    const backends = new Set();
+    for (const dispatch of run.dispatches || []) {
+        if (dispatch.backendId)
+            backends.add(dispatch.backendId);
+    }
+    for (const task of run.tasks || []) {
+        if (task.backendId)
+            backends.add(task.backendId);
+    }
+    return [...backends].sort();
+}
+function digestInputs(inputs) {
+    if (!inputs || typeof inputs !== "object")
+        return undefined;
+    const keys = Object.keys(inputs);
+    const ordered = [
+        ...DIGEST_PRIORITY_KEYS.filter((k) => keys.includes(k)),
+        ...keys.filter((k) => !DIGEST_PRIORITY_KEYS.includes(k)).sort()
+    ];
+    const parts = [];
+    for (const key of ordered) {
+        const value = inputs[key];
+        if (value === undefined || value === null)
+            continue;
+        const rendered = Array.isArray(value) ? value.join(",") : typeof value === "object" ? JSON.stringify(value) : String(value);
+        parts.push(`${key}=${rendered}`);
+    }
+    const joined = parts.join(" ").replace(/\s+/g, " ").trim();
+    return joined.length > 360 ? `${joined.slice(0, 357)}...` : joined;
+}
+function countRecords(records) {
+    const counts = {
+        total: records.length,
+        queued: 0,
+        running: 0,
+        blocked: 0,
+        completed: 0,
+        failed: 0,
+        archived: 0,
+        reclaimed: 0
+    };
+    for (const record of records) {
+        counts[record.lifecycle] = (counts[record.lifecycle] || 0) + 1;
+    }
+    return counts;
+}
+function optionalLower(value) {
+    if (value === undefined || value === null || value === "")
+        return undefined;
+    return String(value).toLowerCase();
+}
+function clampInt(value, fallback, min) {
+    const n = Number(value);
+    if (!Number.isFinite(n))
+        return fallback;
+    return Math.max(min, Math.floor(n));
+}
+let queueCounter = 0;
+function queueId() {
+    queueCounter += 1;
+    const stamp = new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 14);
+    return `q-${stamp}-${String(queueCounter).padStart(3, "0")}`;
+}
+function isRunLifecycleState(value) {
+    return typeof value === "string" && exports.LIFECYCLE_STATES.includes(value);
+}
+/** Read a run dir's `reclaimed.json` overlay (v0.1.39). Fail-closed to an empty
+ *  chain on absence/corruption — a malformed overlay must never brick the run. */
+function loadReclaimedFromDir(runDir) {
+    const file = node_path_1.default.join(runDir, "reclaimed.json");
+    if (!node_fs_1.default.existsSync(file))
+        return { schemaVersion: 1, runId: "", tombstones: [] };
+    try {
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
+        return { schemaVersion: 1, runId: parsed.runId || "", tombstones: Array.isArray(parsed.tombstones) ? parsed.tombstones : [] };
+    }
+    catch {
+        return { schemaVersion: 1, runId: "", tombstones: [] };
+    }
+}

package/dist/run-registry/format.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatRegistryReport = formatRegistryReport;
+exports.formatRunSearch = formatRunSearch;
+exports.formatRunShow = formatRunShow;
+exports.formatGcPlan = formatGcPlan;
+exports.formatGcRun = formatGcRun;
+exports.formatGcVerify = formatGcVerify;
+exports.formatResume = formatResume;
+exports.formatHistory = formatHistory;
+exports.formatQueueList = formatQueueList;
+function countsLine(counts) {
+    return `total=${counts.total} queued=${counts.queued} running=${counts.running} blocked=${counts.blocked} completed=${counts.completed} failed=${counts.failed} archived=${counts.archived} reclaimed=${counts.reclaimed}`;
+}
+function recordLine(record) {
+    const flags = [record.archived ? "archived" : "", record.provenance?.rerunOf ? `rerunOf=${record.provenance.rerunOf}` : ""].filter(Boolean).join(" ");
+    return `  [${record.lifecycle}] ${record.runId} (${record.appId || record.workflowId}) ${record.loopStage}${flags ? ` {${flags}}` : ""}`;
+}
+function formatRegistryReport(report) {
+    const lines = [];
+    lines.push(`Run Registry (${report.scope}): ${report.root}`);
+    lines.push(`Freshness: ${report.freshness.status}${report.freshness.staleRuns.length ? ` (stale: ${report.freshness.staleRuns.join(", ")})` : ""}${report.freshness.missingRuns.length ? ` (missing: ${report.freshness.missingRuns.join(", ")})` : ""}`);
+    lines.push(`Repos: ${report.index.repos.length}`);
+    lines.push(countsLine(report.counts));
+    if (report.freshness.status !== "valid")
+        lines.push(`Next Action: ${report.nextAction}`);
+    return lines.join("\n");
+}
+function formatRunSearch(result) {
+    const lines = [];
+    lines.push(`Run Search (${result.scope}): ${result.total} match(es), showing ${result.records.length} [offset ${result.offset}] freshness=${result.freshness}`);
+    for (const record of result.records)
+        lines.push(recordLine(record));
+    if (!result.records.length)
+        lines.push("  (no matching runs)");
+    return lines.join("\n");
+}
+function formatRunShow(result) {
+    if (!result.found) {
+        return `Run ${result.runId}: MISSING (source state.json absent — fail closed). Next: ${result.nextAction}`;
+    }
+    const r = result.record;
+    const lines = [
+        `Run ${r.runId} [${r.lifecycle}] (derived: ${r.derivedLifecycle})`,
+        `  app=${r.appId || r.workflowId} loopStage=${r.loopStage} repo=${r.repo}`,
+        `  tasks: total=${r.tasks.total} pending=${r.tasks.pending} running=${r.tasks.running} failed=${r.tasks.failed} completed=${r.tasks.completed}`,
+        `  commits=${r.commitCount} (verifier-gated=${r.verifierGatedCommitCount}) openFeedback=${r.openFeedbackCount}`
+    ];
+    if (r.provenance?.rerunOf)
+        lines.push(`  provenance: rerunOf=${r.provenance.rerunOf} gen=${r.provenance.generation} origin=${r.provenance.originRunId}`);
+    if (r.tier && r.tier !== "live") {
+        lines.push(`  tier=${r.tier} capability=${r.capability} reason=${r.capabilityReason}${r.reclaimedBytes ? ` bytesFreed=${r.reclaimedBytes}` : ""}${r.tombstoneHash ? ` tombstone=${r.tombstoneHash.slice(0, 19)}` : ""}`);
+    }
+    return lines.join("\n");
+}
+function formatGcPlan(result) {
+    const lines = [
+        `GC Plan (${result.scope}): ${result.eligibleCount}/${result.total} eligible, ${result.bytesToFree} byte(s) would be freed [DRY-RUN, frees nothing]`,
+        `  policy: reclaimAfterArchiveDays=${result.policy.reclaimAfterArchiveDays} keepScratch=${result.policy.keepScratch} keepSnapshots=${result.policy.keepSnapshots}`
+    ];
+    for (const entry of result.entries) {
+        if (entry.eligible) {
+            const kinds = Object.entries(entry.byKind).map(([k, v]) => `${k}=${v}`).join(" ");
+            lines.push(`  [eligible] ${entry.runId} -> ${entry.capability} (${entry.capabilityReason}) ${entry.bytesToFree}B {${kinds}}`);
+        }
+        else {
+            lines.push(`  [skip:${entry.reason}] ${entry.runId} (tier=${entry.tier})`);
+        }
+    }
+    if (!result.entries.length)
+        lines.push("  (no runs in scope)");
+    return lines.join("\n");
+}
+function formatGcRun(result) {
+    const lines = [`GC Run (${result.scope}): reclaimed ${result.reclaimed.length} run(s), freed ${result.totalBytesFreed} byte(s)`];
+    for (const r of result.reclaimed)
+        lines.push(`  [reclaimed] ${r.runId} -> ${r.capability} (${r.capabilityReason}) ${r.bytesFreed}B tombstone=${r.tombstoneHash.slice(0, 19)}`);
+    for (const r of result.refused)
+        lines.push(`  [refused:${r.code}] ${r.runId}`);
+    if (!result.reclaimed.length && !result.refused.length)
+        lines.push("  (nothing eligible)");
+    return lines.join("\n");
+}
+function formatGcVerify(result) {
+    const lines = [
+        `GC Verify ${result.runId}: reclaimed=${result.reclaimed} verified=${result.verified} tier=${result.tier} capability=${result.capability}${result.tombstoneHash ? ` tombstone=${result.tombstoneHash.slice(0, 19)}` : ""}`
+    ];
+    for (const check of result.checks)
+        lines.push(`  ${check.pass ? "PASS" : "FAIL"} ${check.name}${check.code ? ` [${check.code}]` : ""}${check.detail ? ` (${check.detail})` : ""}`);
+    return lines.join("\n");
+}
+function formatResume(result) {
+    const lines = [
+        `Resume ${result.runId} [${result.lifecycle}] loopStage=${result.loopStage} (resolved from ${result.resolvedFrom}, ${result.freshness})`,
+        `  resumable=${result.resumable} nextTasks=${result.nextTasks.length}`
+    ];
+    for (const action of result.nextActions)
+        lines.push(`  -> ${action.command}\n     ${action.reason}`);
+    // Only when --drive/--once continued the run; the default read-only resume text is unchanged.
+    if (result.drive) {
+        const d = result.drive;
+        lines.push(`  drive: ${d.status} (${d.completedWorkers}/${d.plannedWorkers} workers${d.commitId ? `, committed ${d.commitId}` : ""})`);
+    }
+    return lines.join("\n");
+}
+function formatHistory(result) {
+    const lines = [];
+    lines.push(`Run History (${result.scope}): ${result.total} run(s) across ${result.repos.length} repo(s), freshness=${result.freshness}`);
+    for (const entry of result.entries) {
+        lines.push(`  ${entry.createdAt} [${entry.lifecycle}] ${entry.runId} (${entry.appId || entry.workflowId})${entry.provenance?.rerunOf ? ` rerunOf=${entry.provenance.rerunOf}` : ""}`);
+    }
+    if (!result.entries.length)
+        lines.push("  (no runs)");
+    return lines.join("\n");
+}
+function formatQueueList(result) {
+    const lines = [`Run Queue: ${result.total} entry(ies) [priority asc]`];
+    for (const entry of result.entries) {
+        lines.push(`  #${entry.priority} ${entry.id} [${entry.status}] ${entry.appId || entry.workflowId || entry.runId || "?"} repo=${entry.repo}${entry.note ? ` note=${entry.note}` : ""}`);
+    }
+    if (!result.entries.length)
+        lines.push("  (queue empty)");
+    return lines.join("\n");
+}

package/dist/run-registry/gc.js

@@ -0,0 +1,251 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reclamationPolicy = reclamationPolicy;
+exports.reclaimEligibility = reclaimEligibility;
+exports.gcPlan = gcPlan;
+exports.gcRun = gcRun;
+exports.gcVerify = gcVerify;
+const reclamation_1 = require("../reclamation");
+const trust_audit_1 = require("../trust-audit");
+const policy_1 = require("./policy");
+/** Resolve the effective reclamation policy (defaults reclaim NOTHING). */
+function reclamationPolicy(overrides = {}) {
+    return { ...policy_1.DEFAULT_RUN_REGISTRY_POLICY, ...overrides };
+}
+/** Fail-closed eligibility: terminal AND archived AND no open feedback AND past
+ *  retention. Returns the matching refusal code, or null when eligible. Reads
+ *  the live-source-derived record; order yields distinct, stable codes. */
+function reclaimEligibility(record, policy, nowMs) {
+    if (record.tier === "reclaimed")
+        return "already-reclaimed";
+    const terminalStates = policy.reclaimStates && policy.reclaimStates.length ? policy.reclaimStates : ["completed", "failed"];
+    if (record.derivedLifecycle !== "completed" && record.derivedLifecycle !== "failed")
+        return "non-terminal";
+    if (!terminalStates.includes(record.derivedLifecycle))
+        return "non-terminal";
+    if (record.openFeedbackCount > 0)
+        return "open-feedback";
+    if (!record.archived)
+        return "not-archived";
+    const days = policy.reclaimAfterArchiveDays ?? 0;
+    if (days > 0) {
+        const archivedAtMs = record.archivedAt ? Date.parse(record.archivedAt) : NaN;
+        if (!Number.isFinite(archivedAtMs))
+            return "within-retention";
+        if (archivedAtMs > nowMs - days * 24 * 60 * 60 * 1000)
+            return "within-retention";
+    }
+    return null;
+}
+/** Resolve a single run to a one-element record list via locate() (repo-first),
+ *  avoiding a full-registry scan for single-run gc plan/run. */
+function recordsForRunId(host, runId, scope) {
+    const located = host.locate(runId, scope);
+    return located ? [located.record] : [];
+}
+/** Dry-run: compute eligible runs, per-kind bytes that WOULD be freed, and the
+ *  capability downgrade. Frees NOTHING. */
+function gcPlan(host, options = {}) {
+    const scope = options.scope || "home";
+    const policy = reclamationPolicy(options.policy);
+    const nowIso = options.now || new Date().toISOString();
+    const nowMs = Date.parse(nowIso);
+    // Fast, deterministic single-run path: resolve just that run via locate()
+    // (repo-first) so a home-scope plan never re-scans the whole registry.
+    const records = options.runId ? recordsForRunId(host, options.runId, scope) : host.buildIndex(scope).records;
+    const entries = [];
+    let bytesToFree = 0;
+    let eligibleCount = 0;
+    for (const record of records) {
+        const refusal = reclaimEligibility(record, policy, nowMs);
+        let plan;
+        try {
+            const run = host.loadRun(record.repo, record.runId);
+            plan = (0, reclamation_1.planReclamation)(run, { keepScratch: policy.keepScratch, keepSnapshots: policy.keepSnapshots });
+        }
+        catch {
+            entries.push({
+                runId: record.runId,
+                repo: record.repo,
+                eligible: false,
+                reason: "unreadable",
+                tier: record.tier || "live",
+                capability: record.capability || "re-runnable",
+                capabilityReason: record.capabilityReason || "live-full",
+                bytesToFree: 0,
+                byKind: {},
+                freeable: []
+            });
+            continue;
+        }
+        const eligible = refusal === null;
+        const entry = {
+            runId: record.runId,
+            repo: record.repo,
+            eligible,
+            reason: eligible ? "eligible" : refusal,
+            tier: record.tier || "live",
+            capability: plan.capability,
+            capabilityReason: plan.capabilityReason,
+            bytesToFree: eligible ? plan.bytesToFree : 0,
+            byKind: eligible ? plan.byKind : {},
+            freeable: eligible ? plan.freeable.map((f) => ({ path: f.path, kind: f.kind, bytes: f.bytes })) : []
+        };
+        entries.push(entry);
+        if (eligible) {
+            eligibleCount += 1;
+            bytesToFree += plan.bytesToFree;
+        }
+    }
+    return {
+        schemaVersion: 1,
+        scope,
+        generatedAt: nowIso,
+        policy: {
+            reclaimAfterArchiveDays: policy.reclaimAfterArchiveDays ?? 0,
+            keepSnapshots: Boolean(policy.keepSnapshots),
+            keepScratch: Boolean(policy.keepScratch),
+            reclaimStates: policy.reclaimStates && policy.reclaimStates.length ? policy.reclaimStates : ["completed", "failed"]
+        },
+        total: entries.length,
+        eligibleCount,
+        bytesToFree,
+        entries,
+        nextAction: eligibleCount ? "node scripts/cw.js gc run" : "node scripts/cw.js run search"
+    };
+}
+/** Execute the write-ahead reclamation transaction for eligible runs. Bounded
+ *  (`maxReclaimRuns` / `maxReclaimBytes`), fail-closed on any incomplete
+ *  skeleton. Produces a tombstone and frees the bulk. */
+function gcRun(host, options = {}) {
+    const scope = options.scope || "home";
+    const policy = reclamationPolicy(options.policy);
+    const nowIso = options.now || new Date().toISOString();
+    const nowMs = Date.parse(nowIso);
+    const records = options.runId ? recordsForRunId(host, options.runId, scope) : host.buildIndex(scope).records;
+    const maxRuns = options.limit ?? (policy.maxReclaimRuns || 0);
+    const maxBytes = policy.maxReclaimBytes || 0;
+    const reclaimed = [];
+    const refused = [];
+    let totalBytesFreed = 0;
+    for (const record of records) {
+        const refusal = reclaimEligibility(record, policy, nowMs);
+        if (refusal) {
+            refused.push({ runId: record.runId, code: refusal });
+            continue;
+        }
+        if (maxRuns > 0 && reclaimed.length >= maxRuns)
+            break;
+        let run;
+        try {
+            run = host.loadRun(record.repo, record.runId);
+        }
+        catch {
+            refused.push({ runId: record.runId, code: "unreadable" });
+            continue;
+        }
+        try {
+            const result = (0, reclamation_1.runReclamation)(run, {
+                now: nowIso,
+                actor: options.actor,
+                policy: { reclaimAfterArchiveDays: policy.reclaimAfterArchiveDays, keepScratch: policy.keepScratch, keepSnapshots: policy.keepSnapshots },
+                reclaimPolicy: { keepScratch: policy.keepScratch, keepSnapshots: policy.keepSnapshots }
+            });
+            // No post-free saveCheckpoint: runReclamation now DURABLY persists the
+            // result-node re-point inside the transaction (before any byte is freed),
+            // so state.json can never reference a freed path even on a crash here.
+            reclaimed.push({
+                runId: record.runId,
+                bytesFreed: result.bytesFreed,
+                tombstoneHash: result.tombstone.tombstoneHash,
+                capability: result.tombstone.capability,
+                capabilityReason: result.tombstone.capabilityReason
+            });
+            // Independent reclamation WITNESS in the tamper-evident trust-audit chain:
+            // proves this run WAS reclaimed even if reclaimed.json is later deleted — so
+            // `gc verify` can tell proof-deletion apart from never-reclaimed.
+            (0, trust_audit_1.recordTrustAuditEvent)(run, {
+                kind: "run.reclaimed",
+                decision: "recorded",
+                source: "cw-validated",
+                metadata: { tombstoneHash: result.tombstone.tombstoneHash, bytesFreed: result.bytesFreed, capability: result.tombstone.capability }
+            });
+            totalBytesFreed += result.bytesFreed;
+            if (maxBytes > 0 && totalBytesFreed >= maxBytes)
+                break;
+        }
+        catch (error) {
+            if (error instanceof reclamation_1.ReclamationError)
+                refused.push({ runId: record.runId, code: error.code });
+            else
+                throw error;
+        }
+    }
+    return {
+        schemaVersion: 1,
+        scope,
+        generatedAt: nowIso,
+        dryRun: false,
+        reclaimed,
+        refused,
+        totalBytesFreed,
+        nextAction: reclaimed.length ? "node scripts/cw.js gc verify <run-id>" : "node scripts/cw.js gc plan"
+    };
+}
+/** Re-prove a reclaimed run: skeleton schema-complete, tombstone chain
+ *  recomputed-and-untampered, each reconstructable artifact re-derived from its
+ *  RETAINED inputs to its expectDigest, and eligible-when-reclaimed. */
+function gcVerify(host, runId, options = {}) {
+    const scope = options.scope || "home";
+    const located = host.locate(runId, scope);
+    if (!located) {
+        return {
+            schemaVersion: 1,
+            runId,
+            reclaimed: false,
+            verified: false,
+            tier: "live",
+            capability: "re-runnable",
+            chainLength: 0,
+            checks: [{ name: "located", pass: false, code: "not-reclaimed", detail: "run source not found" }],
+            nextAction: "node scripts/cw.js registry refresh" + (scope === "home" ? " --scope home" : "")
+        };
+    }
+    const run = host.loadRun(located.record.repo, runId);
+    const result = (0, reclamation_1.verifyReclamation)(run);
+    const checks = result.checks.map((c) => ({ name: c.name, pass: c.pass, code: c.code, detail: c.detail }));
+    // Eligible-when-reclaimed: each tombstone must have sealed a terminal verdict.
+    let eligibleWhenReclaimed = result.reclaimed;
+    for (const tombstone of result.tombstones) {
+        const terminal = tombstone.skeleton.finalVerdict?.terminal === true;
+        if (!terminal) {
+            eligibleWhenReclaimed = false;
+            checks.push({ name: `eligible-when-reclaimed:${tombstone.tombstoneId}`, pass: false, code: "ineligible-when-reclaimed", detail: "non-terminal verdict sealed" });
+        }
+    }
+    const last = result.tombstones[result.tombstones.length - 1];
+    // Independent witness: a trust-audit "run.reclaimed" event proves this run was
+    // reclaimed even if reclaimed.json was deleted. A present witness + missing proof
+    // = the proof was deleted/tampered (NOT "never reclaimed") — fail closed so
+    // `gc verify <run> && deploy` cannot pass on a wiped reclamation record.
+    const witnessed = (0, trust_audit_1.listTrustAuditEvents)(run).some((event) => event.kind === "run.reclaimed");
+    const proofDeleted = witnessed && !result.reclaimed;
+    if (proofDeleted) {
+        checks.push({ name: "reclaim-witness", pass: false, code: "reclaim-proof-deleted", detail: "trust-audit attests reclamation but reclaimed.json is missing/empty" });
+    }
+    const reclaimed = result.reclaimed || proofDeleted;
+    const verified = result.verified && eligibleWhenReclaimed && !proofDeleted;
+    return {
+        schemaVersion: 1,
+        runId,
+        reclaimed,
+        verified,
+        tier: located.record.tier || (reclaimed ? "reclaimed" : "live"),
+        capability: located.record.capability || "re-runnable",
+        capabilityReason: located.record.capabilityReason,
+        tombstoneHash: last?.tombstoneHash,
+        chainLength: result.tombstones.length,
+        checks,
+        nextAction: verified ? "node scripts/cw.js run show " + runId : "node scripts/cw.js gc plan"
+    };
+}

package/dist/run-registry/policy.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RUN_REGISTRY_POLICY = exports.RUN_REGISTRY_SCHEMA_VERSION = void 0;
+exports.RUN_REGISTRY_SCHEMA_VERSION = 1;
+exports.DEFAULT_RUN_REGISTRY_POLICY = {
+    schemaVersion: 1,
+    archiveOlderThanDays: 0,
+    archiveStates: ["completed", "failed"],
+    defaultQueuePriority: 100,
+    reclaimAfterArchiveDays: 0,
+    reclaimStates: ["completed", "failed"],
+    keepSnapshots: false,
+    keepScratch: false,
+    maxReclaimRuns: 0,
+    maxReclaimBytes: 0
+};

package/dist/run-registry/queue.js

@@ -0,0 +1,116 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queueFilePath = queueFilePath;
+exports.loadQueue = loadQueue;
+exports.saveQueue = saveQueue;
+exports.queueAdd = queueAdd;
+exports.queueList = queueList;
+exports.queueShow = queueShow;
+exports.queueDrain = queueDrain;
+// Durable run-queue operations for the run registry (FreeBSD-audit R2 deep).
+// Carved out of run-registry.ts so the RunRegistry class no longer bundles the
+// stateful queue cluster; the class keeps the public methods as thin delegators.
+//
+// BEHAVIOR-PRESERVING — pure code movement, zero logic change. Each function
+// takes a `QueueHost` (the registry, narrowed to exactly the file-access +
+// repo-registration helpers the queue needs) so it stays a function of its
+// inputs, matching the existing router pattern (orchestrator/*-operations.ts,
+// run-registry/derive.ts + format.ts).
+//
+// The queue file lives beside the other home-registry plain files (EXPLICIT,
+// INSPECTABLE STATE): readable, diffable, no hidden database. Cross-process
+// read-modify-write is locked (v0.1.40, P1-D) so a concurrent add/drain can
+// never drop or double-drain an entry.
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const state_1 = require("../state");
+const derive_1 = require("./derive");
+function queueFilePath(host) {
+    return node_path_1.default.join(host.homeRegistryDir(), "queue.json");
+}
+function loadQueue(host) {
+    const file = queueFilePath(host);
+    if (!node_fs_1.default.existsSync(file))
+        return [];
+    try {
+        const parsed = (0, state_1.readJson)(file);
+        return Array.isArray(parsed.entries) ? parsed.entries : [];
+    }
+    catch {
+        return [];
+    }
+}
+function saveQueue(host, entries) {
+    (0, state_1.writeJson)(queueFilePath(host), { schemaVersion: 1, entries }, { durable: true });
+}
+function queueAdd(host, options = {}) {
+    const repo = options.repo ? node_path_1.default.resolve(options.repo) : host.repoRoot;
+    // Cross-process read-modify-write on the home queue: lock so a concurrently
+    // added task can never vanish (v0.1.40, P1-D).
+    return (0, state_1.withFileLock)(queueFilePath(host), () => {
+        const entries = loadQueue(host);
+        const entry = {
+            schemaVersion: 1,
+            id: options.id || (0, derive_1.queueId)(),
+            runId: options.runId,
+            appId: options.appId,
+            workflowId: options.workflowId,
+            repo,
+            priority: Number.isFinite(options.priority) ? Number(options.priority) : host.defaultQueuePriority,
+            enqueuedAt: new Date().toISOString(),
+            status: "pending",
+            inputs: options.inputs,
+            note: options.note
+        };
+        entries.push(entry);
+        host.registerRepo(repo);
+        saveQueue(host, entries);
+        return entry;
+    });
+}
+function queueList(host, options = {}) {
+    let entries = loadQueue(host);
+    if (options.status)
+        entries = entries.filter((e) => e.status === options.status);
+    if (options.repo) {
+        const repo = node_path_1.default.resolve(options.repo);
+        entries = entries.filter((e) => node_path_1.default.resolve(e.repo) === repo);
+    }
+    entries = [...entries].sort(derive_1.compareQueue);
+    return { schemaVersion: 1, total: entries.length, entries };
+}
+function queueShow(host, id) {
+    const entry = loadQueue(host).find((e) => e.id === id);
+    if (!entry)
+        throw new Error(`Queue entry not found: ${id}`);
+    return entry;
+}
+/** Drain the next N ready/pending entries in policy order, marking them drained.
+ *  CW records readiness/order; the HOST still executes the workers. */
+function queueDrain(host, options = {}) {
+    const limit = (0, derive_1.clampInt)(options.limit, 1, 1);
+    const repoFilter = options.repo ? node_path_1.default.resolve(options.repo) : undefined;
+    // Lock the drain RMW so two hosts can never double-drain the same entry
+    // (v0.1.40, P1-D — the scheduling kernel's concurrency ceiling now holds
+    // across processes, not just within one).
+    return (0, state_1.withFileLock)(queueFilePath(host), () => {
+        const entries = loadQueue(host);
+        const drainable = entries
+            .filter((e) => e.status === "pending" || e.status === "ready")
+            .filter((e) => !repoFilter || node_path_1.default.resolve(e.repo) === repoFilter)
+            .sort(derive_1.compareQueue);
+        const drained = [];
+        const drainedAt = new Date().toISOString();
+        for (const entry of drainable.slice(0, limit)) {
+            entry.status = "drained";
+            entry.drainedAt = drainedAt;
+            drained.push(entry);
+        }
+        saveQueue(host, entries);
+        const remaining = entries.filter((e) => e.status === "pending" || e.status === "ready").length;
+        return { schemaVersion: 1, drained, remaining };
+    });
+}