harnery 0.43.0 → 0.45.0

package/dist/core/workflow/engine.js

@@ -37,7 +37,8 @@ import { freezeWorkflowAttemptContext } from "./attempt-context.js";
 import { probeBilling } from "./billing.js";
 import { stableDigest } from "./durable-record.js";
 import { evidencePreflightError } from "./evidence-preflight.js";
-import { endWorkflowChildSessionV3, startWorkflowChildSessionV3 } from "./live-session-v3.js";
+import { canRetryFailedSpawn, observeSpawnFailure, resolveFailureEvidence, } from "./failure-evidence.js";
+import { endWorkflowChildSessionV3, recordWorkflowChildTerminalFailureV3, startWorkflowChildSessionV3, } from "./live-session-v3.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
 import { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 import { assertProjectionWithinWorkspace, resolveGitGrantRoots } from "./sandbox-projection.js";
@@ -310,7 +311,12 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 durationMs,
                 transcriptPath,
                 before: resumeState.manifest.repository_before,
-                after: resumeState.manifest.repository_before,
+                after: {
+                    cwd: frozenBinding.active_root,
+                    observation: "unavailable",
+                    observation_detail: "Workspace reattachment failed; no trusted after-run snapshot was observed.",
+                    dirty_paths: [],
+                },
                 agents: [],
                 evidence: [],
                 diagnosticAdmission: initialDiagnosticAdmissionProof(diagnosticAdmissionConfig),
@@ -476,6 +482,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
     let policySeq = 0;
     const billingProbed = new Map();
     const agentProofs = new Map();
+    let terminalRecordingError;
     const evidenceRecords = [];
     const policyDecisions = new Map(history?.policyDecisions.map((decision) => [decision.id, decision]));
     const acceptanceIds = new Set(meta.acceptance.map((criterion) => criterion.id));
@@ -858,6 +865,51 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             },
         });
         agentProof.access = access;
+        let childGenerationId;
+        let recordAgentEnd;
+        const finalizeChild = () => {
+            try {
+                if (childGenerationId)
+                    endWorkflowChildSessionV3({
+                        coordRoot: opts.coordRoot,
+                        instanceId: childInstanceId(runId, id),
+                        runId,
+                        agentId: id,
+                        adapter,
+                        cleanExit: agentProof.status === "succeeded",
+                        expectedGenerationId: childGenerationId,
+                    });
+                // Result publication is the resume-cache boundary, after canonical custody.
+                recordAgentEnd?.();
+            }
+            catch (error) {
+                let reason = `V3 terminal recording failed: ${error.message}`;
+                try {
+                    if (childGenerationId)
+                        recordWorkflowChildTerminalFailureV3({
+                            coordRoot: opts.coordRoot,
+                            instanceId: childInstanceId(runId, id),
+                            runId,
+                            agentId: id,
+                            adapter,
+                            expectedGenerationId: childGenerationId,
+                            reason,
+                        });
+                }
+                catch (visibilityError) {
+                    reason += `; blocked lifecycle recording failed: ${visibilityError.message}`;
+                }
+                const failure = new Error(agentProof.error ? `${agentProof.error}; ${reason}` : reason, {
+                    cause: error,
+                });
+                terminalRecordingError ??= failure;
+                agentProof.status = "failed";
+                agentProof.error = failure.message;
+                transcript("agent.failed", { id, key, error: failure.message });
+                log(`[${name}] ${failure.message}`);
+                throw failure;
+            }
+        };
         await acquire();
         try {
             await ensureDiagnosticAdmissionObserved();
@@ -878,7 +930,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             // Headless children do not reliably fire adapter hooks. The engine owns
             // their canonical V3 start so every dispatched child has an auditable
             // generation before it begins work.
-            startWorkflowChildSessionV3({
+            const child = startWorkflowChildSessionV3({
                 coordRoot: opts.coordRoot,
                 instanceId: childInstanceId(runId, id),
                 runId,
@@ -887,9 +939,13 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 label,
                 model: agentOpts.model,
             });
+            if (!child.v3_generation_id)
+                throw new Error("workflow_child_v3_generation_missing");
+            childGenerationId = child.v3_generation_id;
             let attemptPrompt = dispatchPrompt;
             let last = null;
             let agentCostUsd = 0;
+            let informativeAttempt;
             for (let attempt = 1; attempt <= maxAttempts; attempt++) {
                 last = await spawner({
                     prompt: attemptPrompt,
@@ -911,30 +967,45 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 agentCostUsd += last.costUsd ?? 0;
                 costUsd += last.costUsd ?? 0;
                 if (!last.ok) {
-                    transcript("agent.attempt_failed", { id, attempt, error: last.error });
-                    // ADR 0046: an environment failure (the binary was absent) cannot be
-                    // helped by retrying an unchanged environment, so stop the in-agent
-                    // retry too — not just the outer attempt/replan budget. An upstream
-                    // refusal keeps retrying here: the vendor may recover mid-loop.
-                    if (last.class === "environment")
+                    const observed = last.failureEvidence === undefined
+                        ? observeSpawnFailure({}, last.text, "final_message")
+                        : resolveFailureEvidence(last.failureEvidence);
+                    agentProof.failure_evidence = informativeAttempt
+                        ? {
+                            ...observed,
+                            effect: { state: "unknown" },
+                            partial_output: informativeAttempt.partial_output,
+                        }
+                        : observed;
+                    transcript("agent.attempt_failed", {
+                        id,
+                        attempt,
+                        error: last.error,
+                        failure_evidence: observed,
+                        result_digest: digestResult(last.text, "text"),
+                        text: last.text,
+                    });
+                    if (!canRetryFailedSpawn({ ...last, failureEvidence: agentProof.failure_evidence }))
                         break;
-                    continue; // spawn-level failure: retry with the original prompt
+                    continue;
                 }
+                informativeAttempt = observeSpawnFailure({}, last.text, "final_message");
                 if (!agentOpts.schema) {
                     agentProof.status = "succeeded";
                     agentProof.cost_usd =
                         agentCostUsd > 0 || last.costUsd !== undefined ? agentCostUsd : undefined;
                     agentProof.session_id = last.sessionId;
                     agentProof.result = digestResult(last.text, "text");
-                    transcriptAgentEnd({
+                    const completed = last;
+                    recordAgentEnd = () => transcriptAgentEnd({
                         id,
                         key,
                         attempts: attempt,
-                        cost_usd: last.costUsd,
+                        cost_usd: completed.costUsd,
                         total_cost_usd: agentCostUsd,
-                        duration_ms: last.durationMs,
-                        session_id: last.sessionId,
-                    }, "text", last.text);
+                        duration_ms: completed.durationMs,
+                        session_id: completed.sessionId,
+                    }, "text", completed.text);
                     return last.text;
                 }
                 const parsed = parseStageOutput(last.text);
@@ -947,18 +1018,26 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                         agentCostUsd > 0 || last.costUsd !== undefined ? agentCostUsd : undefined;
                     agentProof.session_id = last.sessionId;
                     agentProof.result = digestResult(parsed.value, "json");
-                    transcriptAgentEnd({
+                    const completed = last;
+                    recordAgentEnd = () => transcriptAgentEnd({
                         id,
                         key,
                         attempts: attempt,
-                        cost_usd: last.costUsd,
+                        cost_usd: completed.costUsd,
                         total_cost_usd: agentCostUsd,
-                        duration_ms: last.durationMs,
-                        session_id: last.sessionId,
+                        duration_ms: completed.durationMs,
+                        session_id: completed.sessionId,
                     }, "json", parsed.value);
                     return parsed.value;
                 }
-                transcript("agent.schema_retry", { id, attempt, problems });
+                agentProof.failure_evidence = informativeAttempt;
+                transcript("agent.schema_retry", {
+                    id,
+                    attempt,
+                    problems,
+                    rejected_text: last.text,
+                    result_digest: digestResult(last.text, "text"),
+                });
                 // Keep the original cache identity while making the actual output
                 // contract explicit. A full bounded copy of the rejected value lets the
                 // child repair omissions instead of reconstructing an unseen object.
@@ -993,21 +1072,13 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
         }
         finally {
             reservedCostUsd = Math.max(0, reservedCostUsd - reservedForDispatch);
-            // Record the canonical terminal before removing the disposable cache.
             try {
-                endWorkflowChildSessionV3({
-                    coordRoot: opts.coordRoot,
-                    instanceId: childInstanceId(runId, id),
-                    runId,
-                    agentId: id,
-                    adapter,
-                    cleanExit: agentProof.status === "succeeded",
-                });
+                finalizeChild();
             }
-            catch (error) {
-                log(`[${name}] V3 terminal recording failed: ${error.message}`);
+            finally {
+                // A slot is disposable; unresolved custody remains visible and failed.
+                release();
             }
-            release();
         }
     };
     const parallel = async (thunks) => {
@@ -1105,6 +1176,8 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
         if (!workflow)
             throw new Error("workflow module initialization did not produce an executable");
         const result = await workflow(ctx);
+        if (terminalRecordingError)
+            throw terminalRecordingError;
         const endedAt = new Date().toISOString();
         const durationMs = Date.now() - t0;
         const workspaceAttestation = workspaceBinding

package/dist/core/workflow/failure-evidence.d.ts

@@ -0,0 +1,16 @@
+import type { AdapterRawResult } from "../adapters/types.js";
+import type { SpawnFailureEvidence, SpawnOutputSource, SpawnResult } from "./types.js";
+export declare function unknownFailureEvidence(): SpawnFailureEvidence;
+/** Built-in subprocess adapters observe output and process-start failures.
+ * Their current vendor envelopes do not prove effects or native refusal.
+ * In particular, blank output and 429/5xx statuses leave both unknown. */
+export declare function observeSpawnFailure(raw: Pick<AdapterRawResult, "spawnErrno" | "timedOut"> & Partial<Pick<AdapterRawResult, "stdout" | "resultFileText">>, text: string, source: SpawnOutputSource): SpawnFailureEvidence;
+export declare function isSpawnFailureEvidence(value: unknown): value is SpawnFailureEvidence;
+/** Missing observations are unknown; malformed positive claims are rejected.
+ * This is also used when reading persisted workflow proof. */
+export declare function resolveFailureEvidence(value: unknown): SpawnFailureEvidence;
+export declare function failureEvidenceAllowsUncharged(value: unknown): boolean;
+/** A provider retry requires positive no-effect evidence. A missing binary is
+ * known not to have started, but retrying that unchanged environment cannot help. */
+export declare function canRetryFailedSpawn(result: SpawnResult): boolean;
+//# sourceMappingURL=failure-evidence.d.ts.map

package/dist/core/workflow/failure-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-evidence.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/failure-evidence.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEvF,wBAAgB,sBAAsB,IAAI,oBAAoB,CAM7D;AAED;;0EAE0E;AAC1E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,GACpD,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,gBAAgB,CAAC,CAAC,EAC9D,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,iBAAiB,GACxB,oBAAoB,CAsBtB;AA+DD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAQpF;AAED;8DAC8D;AAC9D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAI3E;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOtE;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAMhE"}

package/dist/core/workflow/failure-evidence.js

@@ -0,0 +1,114 @@
+import { createHash } from "node:crypto";
+export function unknownFailureEvidence() {
+    return {
+        effect: { state: "unknown" },
+        refusal: { state: "unknown" },
+        partial_output: { state: "unknown" },
+    };
+}
+/** Built-in subprocess adapters observe output and process-start failures.
+ * Their current vendor envelopes do not prove effects or native refusal.
+ * In particular, blank output and 429/5xx statuses leave both unknown. */
+export function observeSpawnFailure(raw, text, source) {
+    const bytes = Buffer.byteLength(text);
+    return {
+        effect: raw.spawnErrno === "ENOENT" &&
+            !raw.timedOut &&
+            bytes === 0 &&
+            !raw.stdout?.trim() &&
+            !raw.resultFileText?.trim()
+            ? { state: "none", source: "spawn_errno", reference: "ENOENT" }
+            : { state: "unknown" },
+        refusal: { state: "unknown" },
+        partial_output: bytes > 0
+            ? {
+                state: "present",
+                source,
+                bytes,
+                sha256: createHash("sha256").update(text).digest("hex"),
+            }
+            : { state: "absent", source },
+    };
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function keys(value, expected) {
+    return (Object.keys(value).length === expected.length &&
+        expected.every((key) => Object.hasOwn(value, key)));
+}
+function reference(value) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= 512;
+}
+function validEffect(value) {
+    if (!record(value))
+        return false;
+    if (value.state === "unknown")
+        return keys(value, ["state"]);
+    if (!keys(value, ["state", "source", "reference"]))
+        return false;
+    if (value.state === "none" && value.source === "spawn_errno") {
+        return value.reference === "ENOENT";
+    }
+    return ((value.state === "none" || value.state === "observed") &&
+        value.source === "adapter_evidence" &&
+        reference(value.reference));
+}
+function validRefusal(value) {
+    if (!record(value))
+        return false;
+    if (value.state === "unknown")
+        return keys(value, ["state"]);
+    return (keys(value, ["state", "source", "reference"]) &&
+        value.state === "refused" &&
+        value.source === "vendor_envelope" &&
+        reference(value.reference));
+}
+function validOutput(value) {
+    if (!record(value))
+        return false;
+    if (value.state === "unknown")
+        return keys(value, ["state"]);
+    if (value.source !== "final_message" &&
+        value.source !== "vendor_envelope" &&
+        value.source !== "stdout") {
+        return false;
+    }
+    if (value.state === "absent")
+        return keys(value, ["state", "source"]);
+    return (value.state === "present" &&
+        keys(value, ["state", "source", "bytes", "sha256"]) &&
+        Number.isSafeInteger(value.bytes) &&
+        value.bytes > 0 &&
+        typeof value.sha256 === "string" &&
+        /^[a-f0-9]{64}$/.test(value.sha256));
+}
+export function isSpawnFailureEvidence(value) {
+    return (record(value) &&
+        keys(value, ["effect", "refusal", "partial_output"]) &&
+        validEffect(value.effect) &&
+        validRefusal(value.refusal) &&
+        validOutput(value.partial_output));
+}
+/** Missing observations are unknown; malformed positive claims are rejected.
+ * This is also used when reading persisted workflow proof. */
+export function resolveFailureEvidence(value) {
+    if (value === undefined)
+        return unknownFailureEvidence();
+    if (!isSpawnFailureEvidence(value))
+        throw new Error("invalid spawn failure evidence");
+    return value;
+}
+export function failureEvidenceAllowsUncharged(value) {
+    const evidence = resolveFailureEvidence(value);
+    return (evidence.effect.state === "none" &&
+        evidence.refusal.state !== "refused" &&
+        evidence.partial_output.state === "absent");
+}
+/** A provider retry requires positive no-effect evidence. A missing binary is
+ * known not to have started, but retrying that unchanged environment cannot help. */
+export function canRetryFailedSpawn(result) {
+    return (!result.ok &&
+        result.class !== "environment" &&
+        failureEvidenceAllowsUncharged(result.failureEvidence));
+}

package/dist/core/workflow/index.d.ts

@@ -4,11 +4,13 @@ export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, rea
 export { freezeWorkflowAttemptContext, isCanonicalWorkflowAttemptContext, normalizeWorkflowAttemptContext, } from "./attempt-context.js";
 export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
 export { buildWorkflowProof, createEvidenceRecord, deriveRunFailureClass, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
-export type { WorkflowRunManifest } from "./run-state.js";
-export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
+export type { WorkflowRecoveryAuthorization, WorkflowRecoveryIntent, WorkflowRecoveryRecord, } from "./recovery-audit.js";
+export { beginWorkflowRecovery, readWorkflowRecoveryLedger } from "./recovery-audit.js";
+export type { WorkflowResumeRecoveryOptions, WorkflowResumeRecoveryResult, WorkflowRunManifest, } from "./run-state.js";
+export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, recoverWorkflowResumeLease, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AdapterEvidenceCapability, AdapterEvidenceCoverage, AdapterName, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, ResultDigest, RunReport, Spawner, SpawnFailureClass, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowAttemptContext, WorkflowAttemptFailureCause, WorkflowAttemptPriorContext, WorkflowAttemptUnresolvedCriterion, WorkflowContext, WorkflowDiagnosticAdmissionConfig, WorkflowDiagnosticAdmissionObservation, WorkflowDiagnosticAdmissionProof, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, WorkflowSpecialistProfile, WorkflowWorkContext, } from "./types.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
 export type { ApplyIntegrationInput, AuthorizedIntegrationPlan, AuthorizedProviderIntegrationInput, CancelWorkspaceInput, CleanupWorkspaceInput, FilesystemIdentity, IntegrationApplyAttempt, IntegrationApplyReceipt, IntegrationAuthorization, IntegrationPlan, IntegrationReviewRecord, IntegrationTarget, LocalGitWorktreeProviderOptions, PrepareIntegrationInput, ProviderIntegrationInput, ProviderIntegrationPreview, ProviderIntegrationResult, ProviderUnknown, ProviderUnsupportedReason, RepositoryBinding, ValidatedFilesystemPath, WorkflowWorkspaceInspection, WorkflowWorkspaceSelection, WorkflowWorkspaceStatus, WorkflowWorkspaceVerification, WorkspaceAllocationRequest, WorkspaceAttestation, WorkspaceBinding, WorkspaceBoundExecutionEvidence, WorkspaceCancellationReceipt, WorkspaceCancellationResult, WorkspaceCleanupAttempt, WorkspaceCleanupIntent, WorkspaceCleanupMode, WorkspaceCleanupReceipt, WorkspaceCleanupResult, WorkspaceCompatibilityExecutionEvidence, WorkspaceExecutionEvidence, WorkspaceIntegrationState, WorkspaceIsolation, WorkspaceLifecycleProjection, WorkspaceLifecycleProjectionInput, WorkspaceLifecycleState, WorkspaceObservation, WorkspaceOwner, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProofOutcome, WorkspaceProvider, WorkspaceProviderCapabilities, WorkspaceProviderRef, WorkspaceResourceState, } from "./workspaces/index.js";
-export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, prepareReclaim, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,KAAK,uCAAuC,EAC5C,kCAAkC,EAClC,KAAK,kCAAkC,GACxC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,YAAY,EACZ,SAAS,EACT,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,iCAAiC,EACjC,sCAAsC,EACtC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,4CAA4C,EAC5C,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,cAAc,EACd,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,KAAK,uCAAuC,EAC5C,kCAAkC,EAClC,KAAK,kCAAkC,GACxC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACxF,YAAY,EACV,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,0BAA0B,EAC1B,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,YAAY,EACZ,SAAS,EACT,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,iCAAiC,EACjC,sCAAsC,EACtC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,4CAA4C,EAC5C,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}

package/dist/core/workflow/index.js

@@ -3,7 +3,8 @@ export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, rea
 export { freezeWorkflowAttemptContext, isCanonicalWorkflowAttemptContext, normalizeWorkflowAttemptContext, } from "./attempt-context.js";
 export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
 export { buildWorkflowProof, createEvidenceRecord, deriveRunFailureClass, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
-export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
+export { beginWorkflowRecovery, readWorkflowRecoveryLedger } from "./recovery-audit.js";
+export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, recoverWorkflowResumeLease, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
-export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, prepareReclaim, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";

package/dist/core/workflow/live-session-v3.d.ts

@@ -14,6 +14,12 @@ export declare function startWorkflowChildSessionV3(input: WorkflowChildSessionV
 /** Record the authoritative terminal before removing the disposable coordination cache. */
 export declare function endWorkflowChildSessionV3(input: WorkflowChildSessionV3Input & {
     cleanExit: boolean;
+    expectedGenerationId: string;
+}): void;
+/** Persist unresolved terminal custody only for the generation this dispatch owns. */
+export declare function recordWorkflowChildTerminalFailureV3(input: WorkflowChildSessionV3Input & {
+    expectedGenerationId: string;
+    reason: string;
 }): void;
 export { stableScopeId } from "./scope-id.js";
 //# sourceMappingURL=live-session-v3.d.ts.map

package/dist/core/workflow/live-session-v3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-session-v3.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/live-session-v3.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,qCAAqC,CAAC;AAY7C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,CAiDzF;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,2BAA2B,GAAG;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAC1D,IAAI,CAmBN;AAgBD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"live-session-v3.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/live-session-v3.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,SAAS,EAGf,MAAM,qCAAqC,CAAC;AAoB7C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,CAqDzF;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,2BAA2B,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GACxF,IAAI,CAIN;AA0CD,sFAAsF;AACtF,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,2BAA2B,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpF,IAAI,CAcN;AA8FD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/core/workflow/live-session-v3.js

@@ -1,13 +1,21 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, linkSync, readdirSync, readFileSync, renameSync, unlinkSync } from "node:fs";
+import { basename, dirname } from "node:path";
 import { adapterFromPlatform } from "../adapter.js";
-import { recordLiveTaskChangeV3 } from "../agents/live-authority-v3.js";
+import { recordLiveLifecycleChangeV3, recordLiveTaskChangeV3, } from "../agents/live-authority-v3.js";
 import { endSessionExplicitV3 } from "../agents/session-finalizer-v3.js";
-import { clearCoordinationCache, setIdentityCache, } from "../agents/state/heartbeat-writer.js";
+import { heartbeatPath } from "../agents/state/heartbeat-reader.js";
+import { readHeartbeat, setIdentityCache, } from "../agents/state/heartbeat-writer.js";
 import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.js";
 import { ensureLiveCoordinationHeartbeat } from "../agents/state/live-coordination-writer.js";
 import { assignName } from "../agents/state/names.js";
 import { coordFreshnessSeconds } from "../config.js";
 import { ensureEventLedgerV3 } from "../events/v3/bootstrap.js";
-import { recordLiveHookSignalV3, resolveLiveEventLedgerRouteV3, } from "../events/v3/live-routing.js";
+import { readCoordinationViewV3, requireAuthoritySafeCoordinationViewV3, } from "../events/v3/coordination-view.js";
+import { withGenerationCustodyV3 } from "../events/v3/generation-custody.js";
+import { liveInstanceIdV3, recordLiveHookSignalV3, resolveLiveEventLedgerRouteV3, } from "../events/v3/live-routing.js";
+import { readHookProducerStateV3 } from "../events/v3/producers/recorder.js";
+import { fsyncParentDirectory } from "./durable-record.js";
 import { stableScopeId } from "./scope-id.js";
 /** Start a headless workflow child through the same canonical V3 producer as native hooks. */
 export function startWorkflowChildSessionV3(input) {
@@ -54,13 +62,38 @@ export function startWorkflowChildSessionV3(input) {
     const projected = readLiveCoordinationRow(input.coordRoot, input.instanceId);
     if (!projected)
         throw new Error("workflow_child_v3_projection_missing");
+    const own = readHookProducerStateV3(input.coordRoot, adapter, sessionId);
+    if (!own || own.terminal || own.generation_id !== projected.v3_generation_id) {
+        throw new Error("workflow_child_v3_start_generation_changed");
+    }
     return projected;
 }
 /** Record the authoritative terminal before removing the disposable coordination cache. */
 export function endWorkflowChildSessionV3(input) {
+    withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.instanceId)], () => endExpectedChild(input));
+}
+function endExpectedChild(input) {
     requireV3Route(input.coordRoot);
+    const view = requireAuthoritySafeCoordinationViewV3(readCoordinationViewV3(input.coordRoot));
+    const instanceId = liveInstanceIdV3(input.instanceId);
+    const current = view.instances[instanceId];
+    const terminal = view.terminal_generations[input.expectedGenerationId];
+    if (terminal?.instance_id === instanceId)
+        recoverHeldCaches(input);
+    if (current && current.generation_id !== input.expectedGenerationId) {
+        throw new Error("workflow_child_v3_generation_changed");
+    }
+    if (!current) {
+        if (!terminal || terminal.instance_id !== instanceId)
+            throw new Error("workflow_child_v3_generation_missing");
+        if (terminal.terminal?.outcome !== (input.cleanExit ? "succeeded" : "failed")) {
+            throw new Error("workflow_child_v3_terminal_outcome_changed");
+        }
+        clearExpectedCache(input);
+        return;
+    }
     const row = readLiveCoordinationRow(input.coordRoot, input.instanceId);
-    if (!row?.v3_instance_id || !row.v3_generation_id) {
+    if (!row?.v3_instance_id || row.v3_generation_id !== input.expectedGenerationId) {
         throw new Error("workflow_child_v3_generation_missing");
     }
     const result = endSessionExplicitV3({
@@ -73,7 +106,95 @@ export function endWorkflowChildSessionV3(input) {
     if (result.state !== "recorded" && result.state !== "already_ended") {
         throw new Error(`workflow_child_v3_end_failed:${result.state}${"reason" in result ? `:${result.reason}` : ""}`);
     }
-    clearCoordinationCache(input.coordRoot, input.instanceId);
+    clearExpectedCache(input);
+}
+/** Persist unresolved terminal custody only for the generation this dispatch owns. */
+export function recordWorkflowChildTerminalFailureV3(input) {
+    withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.instanceId)], () => {
+        const row = readLiveCoordinationRow(input.coordRoot, input.instanceId);
+        if (!row || row.v3_generation_id !== input.expectedGenerationId)
+            return;
+        recordLiveLifecycleChangeV3({
+            coordRoot: input.coordRoot,
+            owner: input.instanceId,
+            nativeSessionId: input.sessionId ?? input.instanceId,
+            adapter: workflowAdapter(input.adapter),
+            expectedGenerationId: input.expectedGenerationId,
+            state: "blocked",
+            reason: input.reason,
+        });
+    });
+}
+function heldPrefix(input) {
+    if (!/^gen_[a-zA-Z0-9._-]{1,128}$/.test(input.expectedGenerationId))
+        throw new Error("workflow_child_v3_generation_invalid");
+    return `${basename(heartbeatPath(input.coordRoot, input.instanceId))}.terminal-${input.expectedGenerationId}-`;
+}
+function recoverHeldCaches(input) {
+    const path = heartbeatPath(input.coordRoot, input.instanceId);
+    if (!existsSync(dirname(path)))
+        return;
+    const prefix = heldPrefix(input);
+    for (const name of readdirSync(dirname(path)).filter((value) => value.startsWith(prefix))) {
+        finishHeldCache(`${dirname(path)}/${name}`, path, input.expectedGenerationId);
+    }
+}
+function clearExpectedCache(input) {
+    recoverHeldCaches(input);
+    if (readHeartbeat(input.coordRoot, input.instanceId)?.v3_generation_id !==
+        input.expectedGenerationId)
+        return;
+    const path = heartbeatPath(input.coordRoot, input.instanceId);
+    const held = `${dirname(path)}/${heldPrefix(input)}${randomUUID()}`;
+    try {
+        // A unique held name pins the actual bytes atomically. Checking before
+        // unlink alone could consume a replacement published at this boundary.
+        renameSync(path, held);
+        fsyncParentDirectory(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    finishHeldCache(held, path, input.expectedGenerationId);
+}
+function finishHeldCache(held, path, expectedGenerationId) {
+    let removed = false;
+    let cleanupFailed = false;
+    let cleanupError;
+    try {
+        const cache = JSON.parse(readFileSync(held, "utf8"));
+        if (cache.v3_generation_id === expectedGenerationId) {
+            unlinkSync(held);
+            fsyncParentDirectory(held);
+            removed = true;
+        }
+    }
+    catch (error) {
+        cleanupFailed = true;
+        cleanupError = error;
+    }
+    if (!removed) {
+        try {
+            // Never overwrite a later publication. Keep the held evidence when
+            // another cache already owns the live name.
+            linkSync(held, path);
+            fsyncParentDirectory(path);
+            unlinkSync(held);
+            fsyncParentDirectory(held);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST") {
+                if (cleanupFailed) {
+                    throw new AggregateError([cleanupError, error], `workflow_child_v3_cache_cleanup_and_restore_failed: ${String(cleanupError)}; restoration: ${String(error)}`);
+                }
+                throw error;
+            }
+        }
+    }
+    if (cleanupFailed)
+        throw cleanupError;
 }
 function requireV3Route(coordRoot) {
     let route = resolveLiveEventLedgerRouteV3(coordRoot);

package/dist/core/workflow/proof.d.ts

@@ -1,4 +1,4 @@
-import type { RepoSnapshot } from "../context/index.js";
+import { type RepoSnapshot } from "../context/observation.js";
 import type { NormalizedPolicy, PolicyDecision, PolicyIsolation, PolicyNetworkAccess } from "../policy/index.js";
 import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, AdapterAttestationCitation, AdapterEvidenceCapability, ResultDigest, SpawnFailureClass, WorkflowAgentProof, WorkflowAttemptContext, WorkflowDiagnosticAdmissionProof, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowSandboxProjectionEvidence, WorkflowWorkContext } from "./types.js";
 import type { WorkspaceAttestation, WorkspaceBinding, WorkspaceCompatibilityExecutionEvidence } from "./workspaces/index.js";
@@ -72,12 +72,12 @@ export declare function digestResult(value: unknown, kind?: "text" | "json"): Re
  *    attempt was informative about the work — charge it. This also keeps a
  *    resumed run whose earlier segment did real work from being written off by
  *    a later environment failure.
- * 3. Otherwise, among the failed agents, environment wins over upstream: a
- *    missing binary means nothing ran at all, and it is the operator-chosen
- *    hard stop.
+ * 3. Every participant must have failed with positive no-effect evidence,
+ *    observed absent output and no refusal. A class alone is insufficient.
+ *    Among those eligible failures, environment is the hard stop.
  * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
  */
-export declare function deriveRunFailureClass(status: "succeeded" | "failed", agents: readonly Pick<WorkflowAgentProof, "status" | "class">[]): SpawnFailureClass | undefined;
+export declare function deriveRunFailureClass(status: "succeeded" | "failed", agents: readonly Pick<WorkflowAgentProof, "status" | "class" | "failure_evidence">[]): SpawnFailureClass | undefined;
 export declare function buildWorkflowProof(input: BuildWorkflowProofInput): WorkflowProof;
 export declare function writeWorkflowProof(path: string, proof: WorkflowProof): void;
 export declare function readWorkflowProof(coordRoot: string, runId: string): WorkflowProof;