harnery 0.44.0 → 0.45.1

package/src/core/workflow/proof.ts

@@ -12,7 +12,6 @@ import type {
 import { policyDigest } from "../policy/index.ts";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.ts";
 import { stableDigest, writeImmutableJson } from "./durable-record.ts";
-import { failureEvidenceAllowsUncharged, isSpawnFailureEvidence } from "./failure-evidence.ts";
 import { readWorkflowRunManifest } from "./run-state.ts";
 import type {
   AcceptanceCriterion,
@@ -243,25 +242,17 @@ export function digestResult(value: unknown, kind?: "text" | "json"): ResultDige
  *    attempt was informative about the work — charge it. This also keeps a
  *    resumed run whose earlier segment did real work from being written off by
  *    a later environment failure.
- * 3. Every participant must have failed with positive no-effect evidence,
- *    observed absent output and no refusal. A class alone is insufficient.
- *    Among those eligible failures, environment is the hard stop.
+ * 3. Otherwise, among the failed agents, environment wins over upstream: a
+ *    missing binary means nothing ran at all, and it is the operator-chosen
+ *    hard stop.
  * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
  */
 export function deriveRunFailureClass(
   status: "succeeded" | "failed",
-  agents: readonly Pick<WorkflowAgentProof, "status" | "class" | "failure_evidence">[],
+  agents: readonly Pick<WorkflowAgentProof, "status" | "class">[],
 ): SpawnFailureClass | undefined {
   if (status !== "failed") return undefined;
-  if (
-    agents.length === 0 ||
-    agents.some(
-      (agent) =>
-        agent.status !== "failed" ||
-        (agent.class !== "environment" && agent.class !== "upstream") ||
-        !failureEvidenceAllowsUncharged(agent.failure_evidence),
-    )
-  ) {
+  if (agents.some((agent) => agent.status === "succeeded" || agent.status === "cached")) {
     return undefined;
   }
   const failed = agents.filter((agent) => agent.status === "failed");
@@ -394,13 +385,6 @@ export function readWorkflowProof(coordRoot: string, runId: string): WorkflowPro
       proof.run.class !== "environment" &&
       proof.run.class !== "upstream" &&
       proof.run.class !== "decision") ||
-    !Array.isArray(proof.agents) ||
-    proof.agents.some(
-      (agent) =>
-        !agent ||
-        typeof agent !== "object" ||
-        (agent.failure_evidence !== undefined && !isSpawnFailureEvidence(agent.failure_evidence)),
-    ) ||
     (proof.run.work_context !== undefined &&
       (!proof.run.work_item_id ||
         proof.run.work_context.id !== proof.run.work_item_id ||

package/src/core/workflow/recovery-audit.ts

@@ -0,0 +1,181 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readdirSync } from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { stateDirMode } from "../storage/modes.ts";
+import { assertWorkflowRunId } from "./approvals.ts";
+import {
+  fsyncParentDirectory,
+  readJsonRecord,
+  stableDigest,
+  writeImmutableJson,
+} from "./durable-record.ts";
+
+export interface WorkflowRecoveryAuthorization {
+  actor: string;
+  reason: string;
+}
+
+export interface WorkflowRecoveryIntent extends WorkflowRecoveryAuthorization {
+  schema_version: 1;
+  operation_id: string;
+  run_id: string;
+  action: "reclaim_unknown_liveness" | "unlock_resume";
+  target_sha256: string;
+  target: Record<string, unknown>;
+  recorded_at: string;
+  pid: number;
+  host: string;
+  outcome: "unknown";
+}
+
+export interface WorkflowRecoveryRecord {
+  intent: WorkflowRecoveryIntent;
+  outcome: "unknown" | "completed";
+}
+
+export function validateWorkflowRecoveryAuthorization(
+  authorization: WorkflowRecoveryAuthorization,
+): void {
+  for (const [field, limit] of [
+    ["actor", 200],
+    ["reason", 2_000],
+  ] as const) {
+    const value = authorization[field];
+    if (
+      typeof value !== "string" ||
+      !value.trim() ||
+      value.length > limit ||
+      Array.from(value).some(
+        (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127,
+      )
+    ) {
+      throw new Error(
+        `workflow recovery requires a nonempty ${field} of at most ${limit} characters without control characters`,
+      );
+    }
+  }
+}
+
+/** Canonical recovery ledger: immutable intent is durable before effects.
+ * Completion cites that exact intent; absence always means unknown. */
+export function beginWorkflowRecovery(
+  coordRoot: string,
+  input: Omit<
+    WorkflowRecoveryIntent,
+    "schema_version" | "operation_id" | "recorded_at" | "pid" | "host" | "outcome"
+  >,
+): { intent: WorkflowRecoveryIntent; assertCurrent(): void; complete(): void } {
+  assertWorkflowRunId(input.run_id);
+  validateWorkflowRecoveryAuthorization(input);
+  if (!/^[a-f0-9]{64}$/.test(input.target_sha256))
+    throw new Error("workflow recovery requires an exact preview digest");
+  const intent: WorkflowRecoveryIntent = {
+    ...input,
+    schema_version: 1,
+    operation_id: `recovery-${randomUUID()}`,
+    recorded_at: new Date().toISOString(),
+    pid: process.pid,
+    host: hostname(),
+    outcome: "unknown",
+  };
+  const directory = join(
+    coordRoot,
+    ".harnery",
+    "workflows",
+    input.run_id,
+    "recovery",
+    intent.operation_id,
+  );
+  // Sync each newly published directory name too. Syncing only the intent's
+  // immediate parent cannot make a newly created ancestor durable.
+  const runDirectory = join(coordRoot, ".harnery", "workflows", input.run_id);
+  ensureDurableDirectory(runDirectory);
+  const ledgerDirectory = join(runDirectory, "recovery");
+  ensureDurableDirectory(ledgerDirectory);
+  fsyncParentDirectory(ledgerDirectory);
+  mkdirSync(directory, { mode: stateDirMode() });
+  fsyncParentDirectory(directory);
+  const intentPath = join(directory, "intent.json");
+  writeImmutableJson(intentPath, intent);
+  const assertCurrent = () => {
+    if (stableDigest(readJsonRecord(intentPath, "recovery intent")) !== stableDigest(intent))
+      throw new Error("workflow recovery audit authority changed");
+  };
+  return {
+    intent,
+    assertCurrent,
+    complete: () => {
+      assertCurrent();
+      writeImmutableJson(join(directory, "completion.json"), {
+        schema_version: 1,
+        operation_id: intent.operation_id,
+        intent_sha256: stableDigest(intent),
+        outcome: "completed",
+        recorded_at: new Date().toISOString(),
+      });
+    },
+  };
+}
+
+function ensureDurableDirectory(path: string): void {
+  if (existsSync(path)) {
+    if (!lstatSync(path).isDirectory())
+      throw new Error("workflow recovery ledger is not a directory");
+    return;
+  }
+  ensureDurableDirectory(dirname(path));
+  try {
+    mkdirSync(path, { mode: stateDirMode() });
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "EEXIST" || !lstatSync(path).isDirectory())
+      throw error;
+  }
+  fsyncParentDirectory(path);
+}
+
+export function readWorkflowRecoveryLedger(
+  coordRoot: string,
+  runId: string,
+): WorkflowRecoveryRecord[] {
+  assertWorkflowRunId(runId);
+  const directory = join(coordRoot, ".harnery", "workflows", runId, "recovery");
+  if (!existsSync(directory)) return [];
+  return readdirSync(directory)
+    .sort()
+    .map((entry) => {
+      if (!/^recovery-[a-f0-9-]{36}$/.test(entry))
+        throw new Error("invalid workflow recovery ledger entry");
+      const intent = readJsonRecord<WorkflowRecoveryIntent>(
+        join(directory, entry, "intent.json"),
+        "recovery intent",
+      );
+      if (
+        intent.schema_version !== 1 ||
+        intent.operation_id !== entry ||
+        intent.run_id !== runId ||
+        intent.outcome !== "unknown" ||
+        !["reclaim_unknown_liveness", "unlock_resume"].includes(intent.action) ||
+        !/^[a-f0-9]{64}$/.test(intent.target_sha256)
+      ) {
+        throw new Error("invalid workflow recovery intent authority");
+      }
+      validateWorkflowRecoveryAuthorization(intent);
+      const completionPath = join(directory, entry, "completion.json");
+      if (!existsSync(completionPath)) return { intent, outcome: "unknown" };
+      const completion = readJsonRecord<{
+        schema_version: number;
+        operation_id: string;
+        intent_sha256: string;
+        outcome: string;
+      }>(completionPath, "recovery completion");
+      if (
+        completion.schema_version !== 1 ||
+        completion.operation_id !== entry ||
+        completion.intent_sha256 !== stableDigest(intent) ||
+        completion.outcome !== "completed"
+      )
+        throw new Error("invalid workflow recovery completion authority");
+      return { intent, outcome: "completed" };
+    });
+}

package/src/core/workflow/run-state.ts

@@ -3,6 +3,8 @@ import {
   chmodSync,
   closeSync,
   existsSync,
+  fsyncSync,
+  lstatSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -23,7 +25,13 @@ import {
 import { stateFileMode } from "../storage/modes.ts";
 import { assertWorkflowRunId, readWorkflowApproval } from "./approvals.ts";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.ts";
-import { readJsonRecord, writeImmutableJson } from "./durable-record.ts";
+import {
+  fsyncParentDirectory,
+  readJsonRecord,
+  stableDigest,
+  writeImmutableJson,
+} from "./durable-record.ts";
+import { beginWorkflowRecovery, type WorkflowRecoveryAuthorization } from "./recovery-audit.ts";
 import { normalizeWorkflowSpecialists } from "./specialists.ts";
 import type {
   WorkflowAttemptContext,
@@ -38,6 +46,7 @@ import type {
   WorkspaceBinding,
   WorkspaceCompatibilityExecutionEvidence,
 } from "./workspaces/index.ts";
+import { acquireNoClobberLease } from "./workspaces/leases.ts";
 import {
   assertWorkspaceManifestAuthority,
   isWorkspaceBinding,
@@ -204,8 +213,7 @@ export function workflowRunManifestPath(coordRoot: string, runId: string): strin
 }
 
 /** Acquire an exclusive lease shared by resume and reclaim. Existing locks
- * always refuse: a stale observation cannot authorize unlinking a new owner.
- * Crash recovery requires an audited ownership check outside this operation. */
+ * always refuse; explicit audited recovery is a separate operation. */
 export function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void {
   assertWorkflowRunId(runId);
   const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
@@ -218,23 +226,27 @@ export function acquireWorkflowResumeLease(coordRoot: string, runId: string): ()
   const ownerBytes = `${JSON.stringify(owner)}\n`;
   mkdirSync(dirname(path), { recursive: true });
 
-  const acquire = (): boolean => {
+  const acquire = (): { device: number; inode: number } | false => {
     try {
       const fd = openSync(path, "wx", stateFileMode());
       try {
         writeFileSync(fd, ownerBytes, "utf8");
+        fsyncSync(fd);
       } finally {
         closeSync(fd);
       }
       chmodSync(path, stateFileMode());
-      return true;
+      fsyncParentDirectory(path);
+      const identity = lstatSync(path);
+      return { device: identity.dev, inode: identity.ino };
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
       return false;
     }
   };
 
-  if (!acquire()) {
+  const acquired = withResumeLeaseMutation(coordRoot, runId, acquire);
+  if (!acquired) {
     const existing = readResumeLease(path);
     const holder = existing
       ? ` by pid ${existing.pid} on ${existing.host}; its liveness has not been verified`
@@ -244,13 +256,129 @@ export function acquireWorkflowResumeLease(coordRoot: string, runId: string): ()
 
   return () => {
     try {
-      if (readFileSync(path, "utf8") === ownerBytes) unlinkSync(path);
+      // Only this live process can release this nonce. Acquisition never
+      // replaces a present lock, and unlock requires ESRCH for its owner, so
+      // neither supported writer can replace this lock during synchronous
+      // release. Taking their mutation gate would strand a live owner's lock
+      // on ordinary contention. Pin both identity and bytes for stale closures.
+      const identity = lstatSync(path);
+      if (
+        identity.isFile() &&
+        identity.dev === acquired.device &&
+        identity.ino === acquired.inode &&
+        readFileSync(path, "utf8") === ownerBytes
+      ) {
+        unlinkSync(path);
+        fsyncParentDirectory(path);
+      }
     } catch {
       // Leave an unreadable or replaced lock untouched.
     }
   };
 }
 
+export interface WorkflowResumeRecoveryOptions extends Partial<WorkflowRecoveryAuthorization> {
+  yes?: boolean;
+  lockSha256?: string;
+}
+
+export interface WorkflowResumeRecoveryResult {
+  action: "preview" | "unlocked";
+  run_id: string;
+  lock_sha256: string | null;
+  owner_state: "dead" | "live" | "unknown" | "absent";
+  owner: { pid: number; host: string; created_at: string } | null;
+  recovery_id?: string;
+}
+
+export function recoverWorkflowResumeLease(
+  coordRoot: string,
+  runId: string,
+  options: WorkflowResumeRecoveryOptions,
+): WorkflowResumeRecoveryResult {
+  assertWorkflowRunId(runId);
+  const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
+  const inspect = (): WorkflowResumeRecoveryResult => {
+    let lockSha256: string;
+    try {
+      const stat = lstatSync(path);
+      if (!stat.isFile() || stat.size > 8 * 1024)
+        throw new Error("resume lock is not a bounded regular file");
+      lockSha256 = stableDigest({
+        bytes: readFileSync(path, "utf8"),
+        device: stat.dev,
+        inode: stat.ino,
+      });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      return {
+        action: "preview",
+        run_id: runId,
+        lock_sha256: null,
+        owner_state: "absent",
+        owner: null,
+      };
+    }
+    const owner = readResumeLease(path);
+    let ownerState: WorkflowResumeRecoveryResult["owner_state"] = "unknown";
+    if (owner?.host === hostname()) {
+      try {
+        process.kill(owner.pid, 0);
+        ownerState = "live";
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === "ESRCH") ownerState = "dead";
+      }
+    }
+    return {
+      action: "preview",
+      run_id: runId,
+      lock_sha256: lockSha256,
+      owner_state: ownerState,
+      owner,
+    };
+  };
+  if (!options.yes) return inspect();
+  return withResumeLeaseMutation(coordRoot, runId, () => {
+    const observed = inspect();
+    if (observed.owner_state !== "dead")
+      throw new Error(`workflow resume unlock refused: owner is ${observed.owner_state}`);
+    if (!options.lockSha256 || options.lockSha256 !== observed.lock_sha256)
+      throw new Error("workflow resume unlock requires the exact current preview digest");
+    const audit = beginWorkflowRecovery(coordRoot, {
+      run_id: runId,
+      action: "unlock_resume",
+      target_sha256: options.lockSha256,
+      target: { lock: "resume.lock", owner: observed.owner },
+      actor: options.actor!,
+      reason: options.reason!,
+    });
+    const current = inspect();
+    if (current.lock_sha256 !== observed.lock_sha256 || current.owner_state !== "dead")
+      throw new Error("workflow resume lock authority changed before unlock");
+    audit.assertCurrent();
+    unlinkSync(path);
+    fsyncParentDirectory(path);
+    audit.complete();
+    return { ...observed, action: "unlocked", recovery_id: audit.intent.operation_id };
+  });
+}
+
+function withResumeLeaseMutation<T>(coordRoot: string, runId: string, action: () => T): T {
+  const authority = stableDigest({ run_id: runId, lock: "resume.lock" });
+  const lease = acquireNoClobberLease({
+    path: join(coordRoot, ".harnery", "workflows", runId, "resume-mutation.lease"),
+    scope: "workflow-resume-mutation",
+    authoritySha256: authority,
+    staleAfterMs: 300_000,
+    validateStaleOwner: (owner) => owner.authority_sha256 === authority,
+  });
+  try {
+    return action();
+  } finally {
+    lease.release();
+  }
+}
+
 function readResumeLease(path: string): { pid: number; host: string; created_at: string } | null {
   try {
     const value = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
@@ -258,7 +386,8 @@ function readResumeLease(path: string): { pid: number; host: string; created_at:
       Number.isSafeInteger(value.pid) &&
       value.pid > 0 &&
       typeof value.host === "string" &&
-      typeof value.created_at === "string"
+      value.host.length > 0 &&
+      validTimestamp(value.created_at)
       ? { pid: value.pid, host: value.host, created_at: value.created_at }
       : null;
   } catch {

package/src/core/workflow/spawn-claude.ts

@@ -23,7 +23,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -67,23 +66,6 @@ export function buildClaudeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeClaudeResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeClaudeTransportResult(raw);
-  if (result.ok) return result;
-  let text = raw.stdout.trim();
-  let source: "stdout" | "vendor_envelope" = "stdout";
-  try {
-    const envelope = JSON.parse(raw.stdout) as ClaudeEnvelope;
-    if (typeof envelope.result === "string" && envelope.result.length > 0) {
-      text = envelope.result;
-      source = "vendor_envelope";
-    }
-  } catch {
-    // Retain unstructured output without treating it as native authority.
-  }
-  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
-}
-
-function normalizeClaudeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-codex.ts

@@ -26,7 +26,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -79,18 +78,6 @@ export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): Ad
 }
 
 export function normalizeCodexResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeCodexTransportResult(raw);
-  if (result.ok) return result;
-  const finalText = raw.resultFileText?.trim();
-  const text = finalText || raw.stdout.trim();
-  return {
-    ...result,
-    text,
-    failureEvidence: observeSpawnFailure(raw, text, finalText ? "final_message" : "stdout"),
-  };
-}
-
-function normalizeCodexTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-cursor.ts

@@ -24,7 +24,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -79,23 +78,6 @@ export function buildCursorInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeCursorResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeCursorTransportResult(raw);
-  if (result.ok) return result;
-  let text = raw.stdout;
-  let source: "stdout" | "vendor_envelope" = "stdout";
-  try {
-    const envelope = JSON.parse(raw.stdout) as CursorEnvelope;
-    if (typeof envelope.result === "string" && envelope.result.length > 0) {
-      text = envelope.result;
-      source = "vendor_envelope";
-    }
-  } catch {
-    // Raw output remains evidence, not an inferred refusal or effect result.
-  }
-  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
-}
-
-function normalizeCursorTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-opencode.ts

@@ -22,7 +22,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -89,19 +88,6 @@ export function buildOpenCodeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeOpenCodeResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeOpenCodeTransportResult(raw);
-  if (result.ok) return result;
-  const parsed = parseOpenCodeStream(raw.stdout);
-  const text = parsed.text || raw.stdout.trim();
-  return {
-    ...result,
-    text,
-    sessionId: parsed.sessionId,
-    failureEvidence: observeSpawnFailure(raw, text, parsed.text ? "vendor_envelope" : "stdout"),
-  };
-}
-
-function normalizeOpenCodeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/types.ts

@@ -137,12 +137,11 @@ export interface WorkflowAgentProof {
   session_id?: string;
   result?: ResultDigest;
   error?: string;
-  /** Failed-spawn transport class. It is retained even when a script swallows
-   * the rejection; charging additionally requires validated failure evidence. */
+  /** Set on a failed agent whose spawn was classified uninformative about the
+   * work (ADR 0046): environment (binary absent) or upstream (vendor refused).
+   * Absent ⇒ a work failure. Recorded even when a script's parallel() swallows
+   * the rejection, so the run-level class can still be derived from proof. */
   class?: SpawnFailureClass;
-  /** Failure observations carried from the adapter. Missing observations are
-   * unknown and cannot authorize an uncharged attempt. */
-  failure_evidence?: SpawnFailureEvidence;
   /** Which vendor sandbox mode this agent launched with and why (ADR 0192).
    * Absent on a cached agent, which launched nothing. */
   access?: WorkerAccessDecision;
@@ -363,16 +362,15 @@ export interface WorkflowSpecialistProfile {
 }
 
 /**
- * The positively identified transport cause of a failed spawn (ADR 0046).
- * This class alone proves neither absence of effects nor retry eligibility.
+ * Why a failed run was uninformative about the work (ADR 0046). Absent means
+ * the attempt produced information about the work (or succeeded), which is the
+ * default and is charged against the attempt budget exactly as before.
  *
  * - `environment`: the run never started — a precondition was missing (the
- *   vendor binary was absent). With positive no-effect/output evidence it is
- *   uncharged and not retried: retrying an unchanged
+ *   vendor binary was absent). Uncharged AND not retried: retrying an unchanged
  *   environment cannot help, so the work item stops and names the precondition.
  * - `upstream`: the vendor was reached and refused (5xx, 429, circuit open).
- *   Retry/free-attempt eligibility also requires positive no-effect evidence,
- *   observed absent output, and no refusal. Unsupported evidence stays unknown.
+ *   Uncharged, but retry stays available (bounded by max_uncharged_attempts).
  */
 export type SpawnFailureClass = "environment" | "upstream";
 
@@ -394,30 +392,6 @@ export type SpawnFailureClass = "environment" | "upstream";
  */
 export type RunFailureClass = SpawnFailureClass | "decision";
 
-/** Positive claims name the observation that supports them. A transport error
- * or an empty reply is never evidence that no effects occurred. */
-export type SpawnEffectEvidence =
-  | { state: "unknown" }
-  | { state: "none"; source: "spawn_errno"; reference: "ENOENT" }
-  | { state: "none" | "observed"; source: "adapter_evidence"; reference: string };
-
-export type SpawnRefusalEvidence =
-  | { state: "unknown" }
-  | { state: "refused"; source: "vendor_envelope"; reference: string };
-
-export type SpawnOutputSource = "final_message" | "vendor_envelope" | "stdout";
-
-export type SpawnPartialOutputEvidence =
-  | { state: "unknown" }
-  | { state: "absent"; source: SpawnOutputSource }
-  | { state: "present"; source: SpawnOutputSource; bytes: number; sha256: string };
-
-export interface SpawnFailureEvidence {
-  effect: SpawnEffectEvidence;
-  refusal: SpawnRefusalEvidence;
-  partial_output: SpawnPartialOutputEvidence;
-}
-
 /** What a spawn adapter returns for one subagent run. */
 export interface SpawnResult {
   ok: boolean;
@@ -429,13 +403,9 @@ export interface SpawnResult {
   durationMs: number;
   /** Populated when ok=false. */
   error?: string;
-  /** Transport classification when ok=false; never sufficient by itself to
-   * grant free work or automatic redispatch. */
+  /** Set when ok=false and the failure was positively identified as
+   * uninformative about the work. Absent ⇒ a work failure (charged). */
   class?: SpawnFailureClass;
-  /** Transport classification alone grants neither a retry nor free work.
-   * Absent evidence is explicitly unknown. Positive adapter_evidence claims
-   * require a documented producer observation, never an HTTP/text heuristic. */
-  failureEvidence?: SpawnFailureEvidence;
 }
 
 export interface SpawnRequest {