harnery 0.43.0 → 0.44.0

package/src/core/workflow/proof.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
-import type { RepoSnapshot } from "../context/index.ts";
+import { isAbsolute, join } from "node:path";
+import { observationsComparable, type RepoSnapshot } from "../context/observation.ts";
 import { DIAGNOSTIC_ADVICE_SCHEMA_VERSION } from "../diagnostics/contract.ts";
 import type {
   NormalizedPolicy,
@@ -12,6 +12,7 @@ import type {
 import { policyDigest } from "../policy/index.ts";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.ts";
 import { stableDigest, writeImmutableJson } from "./durable-record.ts";
+import { failureEvidenceAllowsUncharged, isSpawnFailureEvidence } from "./failure-evidence.ts";
 import { readWorkflowRunManifest } from "./run-state.ts";
 import type {
   AcceptanceCriterion,
@@ -242,17 +243,25 @@ export function digestResult(value: unknown, kind?: "text" | "json"): ResultDige
  *    attempt was informative about the work — charge it. This also keeps a
  *    resumed run whose earlier segment did real work from being written off by
  *    a later environment failure.
- * 3. Otherwise, among the failed agents, environment wins over upstream: a
- *    missing binary means nothing ran at all, and it is the operator-chosen
- *    hard stop.
+ * 3. Every participant must have failed with positive no-effect evidence,
+ *    observed absent output and no refusal. A class alone is insufficient.
+ *    Among those eligible failures, environment is the hard stop.
  * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
  */
 export function deriveRunFailureClass(
   status: "succeeded" | "failed",
-  agents: readonly Pick<WorkflowAgentProof, "status" | "class">[],
+  agents: readonly Pick<WorkflowAgentProof, "status" | "class" | "failure_evidence">[],
 ): SpawnFailureClass | undefined {
   if (status !== "failed") return undefined;
-  if (agents.some((agent) => agent.status === "succeeded" || agent.status === "cached")) {
+  if (
+    agents.length === 0 ||
+    agents.some(
+      (agent) =>
+        agent.status !== "failed" ||
+        (agent.class !== "environment" && agent.class !== "upstream") ||
+        !failureEvidenceAllowsUncharged(agent.failure_evidence),
+    )
+  ) {
     return undefined;
   }
   const failed = agents.filter((agent) => agent.status === "failed");
@@ -385,6 +394,13 @@ export function readWorkflowProof(coordRoot: string, runId: string): WorkflowPro
       proof.run.class !== "environment" &&
       proof.run.class !== "upstream" &&
       proof.run.class !== "decision") ||
+    !Array.isArray(proof.agents) ||
+    proof.agents.some(
+      (agent) =>
+        !agent ||
+        typeof agent !== "object" ||
+        (agent.failure_evidence !== undefined && !isSpawnFailureEvidence(agent.failure_evidence)),
+    ) ||
     (proof.run.work_context !== undefined &&
       (!proof.run.work_item_id ||
         proof.run.work_context.id !== proof.run.work_item_id ||
@@ -399,6 +415,22 @@ export function readWorkflowProof(coordRoot: string, runId: string): WorkflowPro
   ) {
     throw new Error(`workflow proof at ${path} has an unsupported or mismatched schema`);
   }
+  if (
+    repoComparisonProblem(proof.repository.before, proof.repository.after) !== undefined ||
+    proof.repository.before.dirty_paths_truncated ||
+    proof.repository.after.dirty_paths_truncated ||
+    !proof.repository.before.branch?.trim() ||
+    !proof.repository.after.branch?.trim() ||
+    !proof.repository.before.head?.trim() ||
+    !proof.repository.after.head?.trim()
+  ) {
+    proof.repository = buildRepoEvidence(proof.repository.before, proof.repository.after);
+    proof.unknowns = proof.unknowns.filter((item) => item.code !== "repository_drift_incomplete");
+    proof.unknowns.push({
+      code: "repository_drift_incomplete",
+      message: proof.repository.drift.note!,
+    });
+  }
   const manifestPath = join(coordRoot, ".harnery", "workflows", runId, "run.json");
   if (proof.execution === undefined && !existsSync(manifestPath)) return proof;
   const manifest = readWorkflowRunManifest(coordRoot, runId);
@@ -512,13 +544,31 @@ export function renderWorkflowProof(proof: WorkflowProof): string {
         : "admission: shadow not needed; no real child dispatch",
     );
   }
-  const repo = proof.repository;
+  const comparable =
+    repoComparisonProblem(proof.repository.before, proof.repository.after) === undefined;
+  const repo =
+    comparable &&
+    !proof.repository.before.dirty_paths_truncated &&
+    !proof.repository.after.dirty_paths_truncated &&
+    proof.repository.before.branch?.trim() &&
+    proof.repository.after.branch?.trim() &&
+    proof.repository.before.head?.trim() &&
+    proof.repository.after.head?.trim()
+      ? proof.repository
+      : buildRepoEvidence(proof.repository.before, proof.repository.after);
   const drift = repo.drift;
-  lines.push(
-    `repository: branch ${repo.before.branch ?? "unknown"} -> ${repo.after.branch ?? "unknown"}; ` +
-      `HEAD ${short(repo.before.head)} -> ${short(repo.after.head)}; ` +
-      `${drift.dirty_paths_added.length} dirty added, ${drift.dirty_paths_cleared.length} cleared`,
-  );
+  if (!comparable) {
+    lines.push(`repository: drift unknown. ${drift.note}`);
+  } else {
+    const paths =
+      drift.dirty_paths_added === null || drift.dirty_paths_cleared === null
+        ? "dirty-path drift unknown"
+        : `${drift.dirty_paths_added.length} dirty added, ${drift.dirty_paths_cleared.length} cleared`;
+    lines.push(
+      `repository: branch ${repo.before.branch ?? "unknown"} -> ${repo.after.branch ?? "unknown"}; ` +
+        `HEAD ${short(repo.before.head)} -> ${short(repo.after.head)}; ${paths}`,
+    );
+  }
   if (proof.unknowns.length > 0) {
     lines.push(`unknowns: ${proof.unknowns.length}`);
     for (const unknown of proof.unknowns) lines.push(`  - ${unknown.message}`);
@@ -530,26 +580,56 @@ export function renderWorkflowProof(proof: WorkflowProof): string {
 function buildRepoEvidence(beforeRaw: RepoSnapshot, afterRaw: RepoSnapshot): WorkflowRepoEvidence {
   const before = normalizeRepoSnapshot(beforeRaw);
   const after = normalizeRepoSnapshot(afterRaw);
+  const problem = repoComparisonProblem(before, after);
+  if (problem !== undefined) {
+    return {
+      source: "engine",
+      before,
+      after,
+      drift: {
+        branch_changed: null,
+        head_changed: null,
+        dirty_paths_added: null,
+        dirty_paths_cleared: null,
+        dirty_paths_retained: null,
+        incomplete: true,
+        note: `Repository drift could not be verified: ${problem}. Re-check before editing.`,
+      },
+    };
+  }
+  const pathsComparable = !before.dirty_paths_truncated && !after.dirty_paths_truncated;
+  const branchKnown = Boolean(before.branch && after.branch);
+  const headKnown = Boolean(before.head && after.head);
   const beforeDirty = new Set(before.dirty_paths);
   const afterDirty = new Set(after.dirty_paths);
   const retained = after.dirty_paths.filter((path) => beforeDirty.has(path));
-  const incomplete = Boolean(
-    before.dirty_paths_truncated || after.dirty_paths_truncated || retained.length > 0,
-  );
+  const notes = [
+    ...(!pathsComparable
+      ? ["Dirty-path drift is unknown because a snapshot list was truncated."]
+      : []),
+    ...(!branchKnown ? ["Branch drift is unknown because a snapshot has no branch."] : []),
+    ...(!headKnown ? ["HEAD drift is unknown because a snapshot has no HEAD."] : []),
+    ...(pathsComparable && retained.length > 0
+      ? ["Snapshots cannot prove whether retained dirty paths changed during the run."]
+      : []),
+  ];
+  const incomplete = notes.length > 0;
   return {
     source: "engine",
     before,
     after,
     drift: {
-      branch_changed: before.branch !== after.branch,
-      head_changed: before.head !== after.head,
-      dirty_paths_added: after.dirty_paths.filter((path) => !beforeDirty.has(path)),
-      dirty_paths_cleared: before.dirty_paths.filter((path) => !afterDirty.has(path)),
-      dirty_paths_retained: retained,
+      branch_changed: branchKnown ? before.branch !== after.branch : null,
+      head_changed: headKnown ? before.head !== after.head : null,
+      dirty_paths_added: pathsComparable
+        ? after.dirty_paths.filter((path) => !beforeDirty.has(path))
+        : null,
+      dirty_paths_cleared: pathsComparable
+        ? before.dirty_paths.filter((path) => !afterDirty.has(path))
+        : null,
+      dirty_paths_retained: pathsComparable ? retained : null,
       incomplete,
-      note: incomplete
-        ? "Snapshots cannot prove whether retained dirty paths changed during the run, and truncated lists may omit paths."
-        : undefined,
+      note: incomplete ? notes.join(" ") : undefined,
     },
   };
 }
@@ -557,14 +637,42 @@ function buildRepoEvidence(beforeRaw: RepoSnapshot, afterRaw: RepoSnapshot): Wor
 function normalizeRepoSnapshot(snapshot: RepoSnapshot): WorkflowRepoSnapshot {
   return {
     cwd: snapshot.cwd,
+    observation: snapshot.observation ?? "unavailable",
+    observation_detail: snapshot.observation
+      ? clippedOptional(snapshot.observation_detail, 500)
+      : "No repository observation was recorded.",
     root: snapshot.root,
-    branch: snapshot.branch,
-    head: snapshot.head,
+    branch: snapshot.branch?.trim() || undefined,
+    head: snapshot.head?.trim() || undefined,
     dirty_paths: snapshot.dirty_paths,
     dirty_paths_truncated: snapshot.dirty_paths_truncated,
   };
 }
 
+function snapshotFailure(label: string, snapshot: WorkflowRepoSnapshot): string {
+  return `${label} snapshot is ${snapshot.observation}${snapshot.observation_detail ? ` (${snapshot.observation_detail})` : ""}`;
+}
+
+function repoComparisonProblem(
+  before: WorkflowRepoSnapshot,
+  after: WorkflowRepoSnapshot,
+): string | undefined {
+  if (!observationsComparable(before, after)) {
+    return [
+      ...(before.observation !== "ok" ? [snapshotFailure("before", before)] : []),
+      ...(after.observation !== "ok" ? [snapshotFailure("after", after)] : []),
+    ].join("; ");
+  }
+  const unknownRoots = [
+    ...(!before.root || !isAbsolute(before.root) ? ["before"] : []),
+    ...(!after.root || !isAbsolute(after.root) ? ["after"] : []),
+  ];
+  if (unknownRoots.length > 0)
+    return `${unknownRoots.join(" and ")} snapshot repository root is unknown`;
+  if (before.root !== after.root) return "snapshots name different repository roots";
+  return undefined;
+}
+
 function buildAdapterCoverage(
   agents: WorkflowAgentProof[],
   claims: Readonly<Record<string, AdapterEvidenceCapability | undefined>> | undefined,

package/src/core/workflow/run-state.ts

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import {
   chmodSync,
   closeSync,
@@ -47,7 +47,6 @@ import {
 export const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION = 2 as const;
 
 const MANIFEST_LIMIT_BYTES = 256 * 1024;
-const FOREIGN_LEASE_STALE_MS = 24 * 60 * 60 * 1_000;
 
 export interface WorkflowRunManifest {
   schema_version: typeof WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION;
@@ -144,6 +143,13 @@ export function readWorkflowRunManifest(coordRoot: string, runId: string): Workf
   ) {
     throw new Error(`workflow run manifest at ${path} has an unsupported or mismatched schema`);
   }
+  if (manifest.repository_before.observation === undefined) {
+    manifest.repository_before = {
+      ...manifest.repository_before,
+      observation: "unavailable",
+      observation_detail: "No repository observation was recorded.",
+    };
+  }
   assertWorkspaceManifestAuthority(manifest, readManifestWorkspaceRequest(coordRoot, runId));
   return manifest;
 }
@@ -197,18 +203,26 @@ export function workflowRunManifestPath(coordRoot: string, runId: string): strin
   return join(coordRoot, ".harnery", "workflows", runId, "run.json");
 }
 
-/** Acquire an exclusive, crash-recoverable lease for one resume segment. */
+/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
+ * always refuse: a stale observation cannot authorize unlinking a new owner.
+ * Crash recovery requires an audited ownership check outside this operation. */
 export function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void {
   assertWorkflowRunId(runId);
   const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
-  const owner = { pid: process.pid, host: hostname(), created_at: new Date().toISOString() };
+  const owner = {
+    owner_id: randomUUID(),
+    pid: process.pid,
+    host: hostname(),
+    created_at: new Date().toISOString(),
+  };
+  const ownerBytes = `${JSON.stringify(owner)}\n`;
   mkdirSync(dirname(path), { recursive: true });
 
   const acquire = (): boolean => {
     try {
       const fd = openSync(path, "wx", stateFileMode());
       try {
-        writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
+        writeFileSync(fd, ownerBytes, "utf8");
       } finally {
         closeSync(fd);
       }
@@ -222,22 +236,17 @@ export function acquireWorkflowResumeLease(coordRoot: string, runId: string): ()
 
   if (!acquire()) {
     const existing = readResumeLease(path);
-    if (existing && resumeLeaseIsLive(existing)) {
-      throw new Error(
-        `workflow run ${runId} is already being resumed by pid ${existing.pid} on ${existing.host}`,
-      );
-    }
-    unlinkSync(path);
-    if (!acquire())
-      throw new Error(`workflow run ${runId} resume lease raced with another process`);
+    const holder = existing
+      ? ` by pid ${existing.pid} on ${existing.host}; its liveness has not been verified`
+      : "; its owner could not be verified";
+    throw new Error(`workflow run ${runId} resume lease is already held${holder}`);
   }
 
   return () => {
     try {
-      const existing = readResumeLease(path);
-      if (existing?.pid === owner.pid && existing.host === owner.host) unlinkSync(path);
+      if (readFileSync(path, "utf8") === ownerBytes) unlinkSync(path);
     } catch {
-      // Best effort. A stale lease is recoverable on the next resume attempt.
+      // Leave an unreadable or replaced lock untouched.
     }
   };
 }
@@ -257,19 +266,6 @@ function readResumeLease(path: string): { pid: number; host: string; created_at:
   }
 }
 
-function resumeLeaseIsLive(lease: { pid: number; host: string; created_at: string }): boolean {
-  if (lease.host !== hostname()) {
-    const age = Date.now() - Date.parse(lease.created_at);
-    return Number.isFinite(age) && age < FOREIGN_LEASE_STALE_MS;
-  }
-  try {
-    process.kill(lease.pid, 0);
-    return true;
-  } catch (error) {
-    return (error as NodeJS.ErrnoException).code === "EPERM";
-  }
-}
-
 function validExecution(value: WorkflowRunManifest["execution"]): boolean {
   if (!value || typeof value !== "object") return false;
   return (
@@ -352,6 +348,12 @@ function validRepoSnapshot(value: RepoSnapshot): boolean {
   return (
     Boolean(value) &&
     typeof value === "object" &&
+    (value.observation === undefined ||
+      value.observation === "ok" ||
+      value.observation === "partial" ||
+      value.observation === "unavailable") &&
+    (value.observation_detail === undefined ||
+      (typeof value.observation_detail === "string" && value.observation_detail.length <= 500)) &&
     isAbsolute(value.cwd) &&
     (value.root === undefined || isAbsolute(value.root)) &&
     (value.branch === undefined || typeof value.branch === "string") &&

package/src/core/workflow/spawn-claude.ts

@@ -23,6 +23,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -66,6 +67,23 @@ export function buildClaudeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeClaudeResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeClaudeTransportResult(raw);
+  if (result.ok) return result;
+  let text = raw.stdout.trim();
+  let source: "stdout" | "vendor_envelope" = "stdout";
+  try {
+    const envelope = JSON.parse(raw.stdout) as ClaudeEnvelope;
+    if (typeof envelope.result === "string" && envelope.result.length > 0) {
+      text = envelope.result;
+      source = "vendor_envelope";
+    }
+  } catch {
+    // Retain unstructured output without treating it as native authority.
+  }
+  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
+}
+
+function normalizeClaudeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-codex.ts

@@ -26,6 +26,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -78,6 +79,18 @@ export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): Ad
 }
 
 export function normalizeCodexResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeCodexTransportResult(raw);
+  if (result.ok) return result;
+  const finalText = raw.resultFileText?.trim();
+  const text = finalText || raw.stdout.trim();
+  return {
+    ...result,
+    text,
+    failureEvidence: observeSpawnFailure(raw, text, finalText ? "final_message" : "stdout"),
+  };
+}
+
+function normalizeCodexTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-cursor.ts

@@ -24,6 +24,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -78,6 +79,23 @@ export function buildCursorInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeCursorResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeCursorTransportResult(raw);
+  if (result.ok) return result;
+  let text = raw.stdout;
+  let source: "stdout" | "vendor_envelope" = "stdout";
+  try {
+    const envelope = JSON.parse(raw.stdout) as CursorEnvelope;
+    if (typeof envelope.result === "string" && envelope.result.length > 0) {
+      text = envelope.result;
+      source = "vendor_envelope";
+    }
+  } catch {
+    // Raw output remains evidence, not an inferred refusal or effect result.
+  }
+  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
+}
+
+function normalizeCursorTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-opencode.ts

@@ -22,6 +22,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -88,6 +89,19 @@ export function buildOpenCodeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeOpenCodeResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeOpenCodeTransportResult(raw);
+  if (result.ok) return result;
+  const parsed = parseOpenCodeStream(raw.stdout);
+  const text = parsed.text || raw.stdout.trim();
+  return {
+    ...result,
+    text,
+    sessionId: parsed.sessionId,
+    failureEvidence: observeSpawnFailure(raw, text, parsed.text ? "vendor_envelope" : "stdout"),
+  };
+}
+
+function normalizeOpenCodeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/types.ts

@@ -137,11 +137,12 @@ export interface WorkflowAgentProof {
   session_id?: string;
   result?: ResultDigest;
   error?: string;
-  /** Set on a failed agent whose spawn was classified uninformative about the
-   * work (ADR 0046): environment (binary absent) or upstream (vendor refused).
-   * Absent ⇒ a work failure. Recorded even when a script's parallel() swallows
-   * the rejection, so the run-level class can still be derived from proof. */
+  /** Failed-spawn transport class. It is retained even when a script swallows
+   * the rejection; charging additionally requires validated failure evidence. */
   class?: SpawnFailureClass;
+  /** Failure observations carried from the adapter. Missing observations are
+   * unknown and cannot authorize an uncharged attempt. */
+  failure_evidence?: SpawnFailureEvidence;
   /** Which vendor sandbox mode this agent launched with and why (ADR 0192).
    * Absent on a cached agent, which launched nothing. */
   access?: WorkerAccessDecision;
@@ -149,6 +150,9 @@ export interface WorkflowAgentProof {
 
 export interface WorkflowRepoSnapshot {
   cwd: string;
+  observation: "ok" | "unavailable" | "partial";
+  /** Bounded explanation of an unavailable or incomplete observation. */
+  observation_detail?: string;
   root?: string;
   branch?: string;
   head?: string;
@@ -161,12 +165,13 @@ export interface WorkflowRepoEvidence {
   before: WorkflowRepoSnapshot;
   after: WorkflowRepoSnapshot;
   drift: {
-    branch_changed: boolean;
-    head_changed: boolean;
-    dirty_paths_added: string[];
-    dirty_paths_cleared: string[];
-    dirty_paths_retained: string[];
-    /** True when snapshots cannot prove whether every retained dirty path changed. */
+    /** Null means the snapshots do not establish this comparison. */
+    branch_changed: boolean | null;
+    head_changed: boolean | null;
+    dirty_paths_added: string[] | null;
+    dirty_paths_cleared: string[] | null;
+    dirty_paths_retained: string[] | null;
+    /** True when an observation, comparison, or retained-path change is unknown. */
     incomplete: boolean;
     note?: string;
   };
@@ -358,15 +363,16 @@ export interface WorkflowSpecialistProfile {
 }
 
 /**
- * Why a failed run was uninformative about the work (ADR 0046). Absent means
- * the attempt produced information about the work (or succeeded), which is the
- * default and is charged against the attempt budget exactly as before.
+ * The positively identified transport cause of a failed spawn (ADR 0046).
+ * This class alone proves neither absence of effects nor retry eligibility.
  *
  * - `environment`: the run never started — a precondition was missing (the
- *   vendor binary was absent). Uncharged AND not retried: retrying an unchanged
+ *   vendor binary was absent). With positive no-effect/output evidence it is
+ *   uncharged and not retried: retrying an unchanged
  *   environment cannot help, so the work item stops and names the precondition.
  * - `upstream`: the vendor was reached and refused (5xx, 429, circuit open).
- *   Uncharged, but retry stays available (bounded by max_uncharged_attempts).
+ *   Retry/free-attempt eligibility also requires positive no-effect evidence,
+ *   observed absent output, and no refusal. Unsupported evidence stays unknown.
  */
 export type SpawnFailureClass = "environment" | "upstream";
 
@@ -388,6 +394,30 @@ export type SpawnFailureClass = "environment" | "upstream";
  */
 export type RunFailureClass = SpawnFailureClass | "decision";
 
+/** Positive claims name the observation that supports them. A transport error
+ * or an empty reply is never evidence that no effects occurred. */
+export type SpawnEffectEvidence =
+  | { state: "unknown" }
+  | { state: "none"; source: "spawn_errno"; reference: "ENOENT" }
+  | { state: "none" | "observed"; source: "adapter_evidence"; reference: string };
+
+export type SpawnRefusalEvidence =
+  | { state: "unknown" }
+  | { state: "refused"; source: "vendor_envelope"; reference: string };
+
+export type SpawnOutputSource = "final_message" | "vendor_envelope" | "stdout";
+
+export type SpawnPartialOutputEvidence =
+  | { state: "unknown" }
+  | { state: "absent"; source: SpawnOutputSource }
+  | { state: "present"; source: SpawnOutputSource; bytes: number; sha256: string };
+
+export interface SpawnFailureEvidence {
+  effect: SpawnEffectEvidence;
+  refusal: SpawnRefusalEvidence;
+  partial_output: SpawnPartialOutputEvidence;
+}
+
 /** What a spawn adapter returns for one subagent run. */
 export interface SpawnResult {
   ok: boolean;
@@ -399,9 +429,13 @@ export interface SpawnResult {
   durationMs: number;
   /** Populated when ok=false. */
   error?: string;
-  /** Set when ok=false and the failure was positively identified as
-   * uninformative about the work. Absent ⇒ a work failure (charged). */
+  /** Transport classification when ok=false; never sufficient by itself to
+   * grant free work or automatic redispatch. */
   class?: SpawnFailureClass;
+  /** Transport classification alone grants neither a retry nor free work.
+   * Absent evidence is explicitly unknown. Positive adapter_evidence claims
+   * require a documented producer observation, never an HTTP/text heuristic. */
+  failureEvidence?: SpawnFailureEvidence;
 }
 
 export interface SpawnRequest {

package/src/core/workflow/workspaces/index.ts

@@ -36,7 +36,6 @@ export {
   probe as probeLocalGitWorktreeProvider,
 } from "./local-git.ts";
 export type { PrepareReclaimInput, ReclaimMode, ReclaimPreparation } from "./reclaim.ts";
-export { prepareReclaim } from "./reclaim.ts";
 export type {
   AuthorizedIntegrationPlan,
   AuthorizedProviderIntegrationInput,