harnery 0.45.0 → 0.45.2

package/src/core/workflow/resume-lock.ts

@@ -0,0 +1,179 @@
+// Kept apart from run-state.ts: the resume lock reads process identity, and
+// run-state.ts is also reached from read-only dashboard modules.
+import { randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { processStartToken, verifyProcessGeneration } from "../agents/state/proc-start.ts";
+import { stateFileMode } from "../storage/modes.ts";
+import { assertWorkflowRunId } from "./approvals.ts";
+
+export type WorkflowResumeOwnerState = "dead" | "live" | "unknown";
+
+export interface WorkflowResumeLockOwner {
+  pid: number;
+  host: string;
+  created_at: string;
+  start_token?: string | null;
+}
+
+/** Acquire the exclusive lease shared by resume and reclaim. A lock whose
+ * same-host owner has exited, or whose PID now names a different process, is
+ * retired automatically. Every other existing lock refuses. */
+export function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void {
+  const path = workflowResumeLockPath(coordRoot, runId);
+  const owner = {
+    owner_id: randomUUID(),
+    pid: process.pid,
+    host: hostname(),
+    created_at: new Date().toISOString(),
+    start_token: processStartToken(process.pid),
+  };
+  const ownerBytes = `${JSON.stringify(owner)}\n`;
+  mkdirSync(dirname(path), { recursive: true });
+
+  const acquire = (): { device: number; inode: number } | false => {
+    try {
+      const fd = openSync(path, "wx", stateFileMode());
+      try {
+        writeFileSync(fd, ownerBytes, "utf8");
+      } finally {
+        closeSync(fd);
+      }
+      chmodSync(path, stateFileMode());
+      const identity = lstatSync(path);
+      return { device: identity.dev, inode: identity.ino };
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      return false;
+    }
+  };
+
+  const acquired = acquire() || (retireDeadResumeLock(path) && acquire());
+  if (!acquired) {
+    const existing = readWorkflowResumeLock(coordRoot, runId);
+    const holder = existing
+      ? ` by pid ${existing.pid} on ${existing.host} (owner ${workflowResumeOwnerState(existing)})`
+      : "; its owner could not be read";
+    throw new Error(`workflow run ${runId} resume lease is already held${holder}`);
+  }
+
+  return () => {
+    try {
+      // Pin identity and bytes, so a stale closure never removes a replacement.
+      const identity = lstatSync(path);
+      if (
+        identity.isFile() &&
+        identity.dev === acquired.device &&
+        identity.ino === acquired.inode &&
+        readFileSync(path, "utf8") === ownerBytes
+      ) {
+        unlinkSync(path);
+      }
+    } catch {
+      // Leave an unreadable or replaced lock untouched.
+    }
+  };
+}
+
+export function workflowResumeLockPath(coordRoot: string, runId: string): string {
+  assertWorkflowRunId(runId);
+  return join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
+}
+
+/** Only a same-host owner can be proven gone: by ESRCH, or by a recorded start
+ * token that no longer matches its PID. Foreign and unreadable owners stay live. */
+export function workflowResumeOwnerState(owner: WorkflowResumeLockOwner): WorkflowResumeOwnerState {
+  if (owner.host !== hostname()) return "unknown";
+  try {
+    process.kill(owner.pid, 0);
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === "ESRCH") return "dead";
+    if (code !== "EPERM") return "unknown";
+  }
+  return verifyProcessGeneration(owner.pid, owner.start_token) === "different" ? "dead" : "live";
+}
+
+/** Move a dead owner's exact lock aside before deleting it. If a contender
+ * replaced it in between, the moved bytes (a fresh owner_id) differ, and that
+ * live lock is linked back. */
+function retireDeadResumeLock(path: string): boolean {
+  let bytes: string;
+  try {
+    bytes = readFileSync(path, "utf8");
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ENOENT";
+  }
+  const owner = parseResumeLock(bytes);
+  if (!owner || workflowResumeOwnerState(owner) !== "dead") return false;
+  const aside = `${path}.dead-${randomUUID()}`;
+  try {
+    renameSync(path, aside);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return true;
+    throw error;
+  }
+  const exact = readFileSync(aside, "utf8") === bytes;
+  if (!exact) {
+    try {
+      linkSync(aside, path);
+    } catch {
+      // A third contender already holds the path; the moved owner's release
+      // finds a different inode and leaves that lock alone.
+    }
+  }
+  unlinkSync(aside);
+  return exact;
+}
+
+export function readWorkflowResumeLock(
+  coordRoot: string,
+  runId: string,
+): WorkflowResumeLockOwner | null {
+  return readResumeLease(workflowResumeLockPath(coordRoot, runId));
+}
+
+function readResumeLease(path: string): WorkflowResumeLockOwner | null {
+  try {
+    return parseResumeLock(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function parseResumeLock(bytes: string): WorkflowResumeLockOwner | null {
+  try {
+    const value = JSON.parse(bytes) as Record<string, unknown>;
+    return typeof value.pid === "number" &&
+      Number.isSafeInteger(value.pid) &&
+      value.pid > 0 &&
+      typeof value.host === "string" &&
+      value.host.length > 0 &&
+      validTimestamp(value.created_at)
+      ? {
+          pid: value.pid,
+          host: value.host,
+          created_at: value.created_at,
+          start_token: typeof value.start_token === "string" ? value.start_token : null,
+        }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function validTimestamp(value: unknown): value is string {
+  return typeof value === "string" && value.length <= 40 && Number.isFinite(Date.parse(value));
+}

package/src/core/workflow/run-state.ts

@@ -1,18 +1,5 @@
-import { createHash, randomUUID } from "node:crypto";
-import {
-  chmodSync,
-  closeSync,
-  existsSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  statSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
-import { hostname } from "node:os";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import type { RepoSnapshot } from "../context/index.ts";
 import {
@@ -22,16 +9,9 @@ import {
   type PolicyNetworkAccess,
   policyDigest,
 } from "../policy/index.ts";
-import { stateFileMode } from "../storage/modes.ts";
 import { assertWorkflowRunId, readWorkflowApproval } from "./approvals.ts";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.ts";
-import {
-  fsyncParentDirectory,
-  readJsonRecord,
-  stableDigest,
-  writeImmutableJson,
-} from "./durable-record.ts";
-import { beginWorkflowRecovery, type WorkflowRecoveryAuthorization } from "./recovery-audit.ts";
+import { readJsonRecord, writeImmutableJson } from "./durable-record.ts";
 import { normalizeWorkflowSpecialists } from "./specialists.ts";
 import type {
   WorkflowAttemptContext,
@@ -46,7 +26,6 @@ import type {
   WorkspaceBinding,
   WorkspaceCompatibilityExecutionEvidence,
 } from "./workspaces/index.ts";
-import { acquireNoClobberLease } from "./workspaces/leases.ts";
 import {
   assertWorkspaceManifestAuthority,
   isWorkspaceBinding,
@@ -212,189 +191,6 @@ export function workflowRunManifestPath(coordRoot: string, runId: string): strin
   return join(coordRoot, ".harnery", "workflows", runId, "run.json");
 }
 
-/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
- * always refuse; explicit audited recovery is a separate operation. */
-export function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void {
-  assertWorkflowRunId(runId);
-  const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
-  const owner = {
-    owner_id: randomUUID(),
-    pid: process.pid,
-    host: hostname(),
-    created_at: new Date().toISOString(),
-  };
-  const ownerBytes = `${JSON.stringify(owner)}\n`;
-  mkdirSync(dirname(path), { recursive: true });
-
-  const acquire = (): { device: number; inode: number } | false => {
-    try {
-      const fd = openSync(path, "wx", stateFileMode());
-      try {
-        writeFileSync(fd, ownerBytes, "utf8");
-        fsyncSync(fd);
-      } finally {
-        closeSync(fd);
-      }
-      chmodSync(path, stateFileMode());
-      fsyncParentDirectory(path);
-      const identity = lstatSync(path);
-      return { device: identity.dev, inode: identity.ino };
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
-      return false;
-    }
-  };
-
-  const acquired = withResumeLeaseMutation(coordRoot, runId, acquire);
-  if (!acquired) {
-    const existing = readResumeLease(path);
-    const holder = existing
-      ? ` by pid ${existing.pid} on ${existing.host}; its liveness has not been verified`
-      : "; its owner could not be verified";
-    throw new Error(`workflow run ${runId} resume lease is already held${holder}`);
-  }
-
-  return () => {
-    try {
-      // Only this live process can release this nonce. Acquisition never
-      // replaces a present lock, and unlock requires ESRCH for its owner, so
-      // neither supported writer can replace this lock during synchronous
-      // release. Taking their mutation gate would strand a live owner's lock
-      // on ordinary contention. Pin both identity and bytes for stale closures.
-      const identity = lstatSync(path);
-      if (
-        identity.isFile() &&
-        identity.dev === acquired.device &&
-        identity.ino === acquired.inode &&
-        readFileSync(path, "utf8") === ownerBytes
-      ) {
-        unlinkSync(path);
-        fsyncParentDirectory(path);
-      }
-    } catch {
-      // Leave an unreadable or replaced lock untouched.
-    }
-  };
-}
-
-export interface WorkflowResumeRecoveryOptions extends Partial<WorkflowRecoveryAuthorization> {
-  yes?: boolean;
-  lockSha256?: string;
-}
-
-export interface WorkflowResumeRecoveryResult {
-  action: "preview" | "unlocked";
-  run_id: string;
-  lock_sha256: string | null;
-  owner_state: "dead" | "live" | "unknown" | "absent";
-  owner: { pid: number; host: string; created_at: string } | null;
-  recovery_id?: string;
-}
-
-export function recoverWorkflowResumeLease(
-  coordRoot: string,
-  runId: string,
-  options: WorkflowResumeRecoveryOptions,
-): WorkflowResumeRecoveryResult {
-  assertWorkflowRunId(runId);
-  const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
-  const inspect = (): WorkflowResumeRecoveryResult => {
-    let lockSha256: string;
-    try {
-      const stat = lstatSync(path);
-      if (!stat.isFile() || stat.size > 8 * 1024)
-        throw new Error("resume lock is not a bounded regular file");
-      lockSha256 = stableDigest({
-        bytes: readFileSync(path, "utf8"),
-        device: stat.dev,
-        inode: stat.ino,
-      });
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-      return {
-        action: "preview",
-        run_id: runId,
-        lock_sha256: null,
-        owner_state: "absent",
-        owner: null,
-      };
-    }
-    const owner = readResumeLease(path);
-    let ownerState: WorkflowResumeRecoveryResult["owner_state"] = "unknown";
-    if (owner?.host === hostname()) {
-      try {
-        process.kill(owner.pid, 0);
-        ownerState = "live";
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "ESRCH") ownerState = "dead";
-      }
-    }
-    return {
-      action: "preview",
-      run_id: runId,
-      lock_sha256: lockSha256,
-      owner_state: ownerState,
-      owner,
-    };
-  };
-  if (!options.yes) return inspect();
-  return withResumeLeaseMutation(coordRoot, runId, () => {
-    const observed = inspect();
-    if (observed.owner_state !== "dead")
-      throw new Error(`workflow resume unlock refused: owner is ${observed.owner_state}`);
-    if (!options.lockSha256 || options.lockSha256 !== observed.lock_sha256)
-      throw new Error("workflow resume unlock requires the exact current preview digest");
-    const audit = beginWorkflowRecovery(coordRoot, {
-      run_id: runId,
-      action: "unlock_resume",
-      target_sha256: options.lockSha256,
-      target: { lock: "resume.lock", owner: observed.owner },
-      actor: options.actor!,
-      reason: options.reason!,
-    });
-    const current = inspect();
-    if (current.lock_sha256 !== observed.lock_sha256 || current.owner_state !== "dead")
-      throw new Error("workflow resume lock authority changed before unlock");
-    audit.assertCurrent();
-    unlinkSync(path);
-    fsyncParentDirectory(path);
-    audit.complete();
-    return { ...observed, action: "unlocked", recovery_id: audit.intent.operation_id };
-  });
-}
-
-function withResumeLeaseMutation<T>(coordRoot: string, runId: string, action: () => T): T {
-  const authority = stableDigest({ run_id: runId, lock: "resume.lock" });
-  const lease = acquireNoClobberLease({
-    path: join(coordRoot, ".harnery", "workflows", runId, "resume-mutation.lease"),
-    scope: "workflow-resume-mutation",
-    authoritySha256: authority,
-    staleAfterMs: 300_000,
-    validateStaleOwner: (owner) => owner.authority_sha256 === authority,
-  });
-  try {
-    return action();
-  } finally {
-    lease.release();
-  }
-}
-
-function readResumeLease(path: string): { pid: number; host: string; created_at: string } | null {
-  try {
-    const value = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
-    return typeof value.pid === "number" &&
-      Number.isSafeInteger(value.pid) &&
-      value.pid > 0 &&
-      typeof value.host === "string" &&
-      value.host.length > 0 &&
-      validTimestamp(value.created_at)
-      ? { pid: value.pid, host: value.host, created_at: value.created_at }
-      : null;
-  } catch {
-    return null;
-  }
-}
-
 function validExecution(value: WorkflowRunManifest["execution"]): boolean {
   if (!value || typeof value !== "object") return false;
   return (

package/src/core/workflow/spawn-claude.ts

@@ -23,7 +23,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -67,23 +66,6 @@ export function buildClaudeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeClaudeResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeClaudeTransportResult(raw);
-  if (result.ok) return result;
-  let text = raw.stdout.trim();
-  let source: "stdout" | "vendor_envelope" = "stdout";
-  try {
-    const envelope = JSON.parse(raw.stdout) as ClaudeEnvelope;
-    if (typeof envelope.result === "string" && envelope.result.length > 0) {
-      text = envelope.result;
-      source = "vendor_envelope";
-    }
-  } catch {
-    // Retain unstructured output without treating it as native authority.
-  }
-  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
-}
-
-function normalizeClaudeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-codex.ts

@@ -26,7 +26,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -79,18 +78,6 @@ export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): Ad
 }
 
 export function normalizeCodexResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeCodexTransportResult(raw);
-  if (result.ok) return result;
-  const finalText = raw.resultFileText?.trim();
-  const text = finalText || raw.stdout.trim();
-  return {
-    ...result,
-    text,
-    failureEvidence: observeSpawnFailure(raw, text, finalText ? "final_message" : "stdout"),
-  };
-}
-
-function normalizeCodexTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-cursor.ts

@@ -24,7 +24,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -79,23 +78,6 @@ export function buildCursorInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeCursorResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeCursorTransportResult(raw);
-  if (result.ok) return result;
-  let text = raw.stdout;
-  let source: "stdout" | "vendor_envelope" = "stdout";
-  try {
-    const envelope = JSON.parse(raw.stdout) as CursorEnvelope;
-    if (typeof envelope.result === "string" && envelope.result.length > 0) {
-      text = envelope.result;
-      source = "vendor_envelope";
-    }
-  } catch {
-    // Raw output remains evidence, not an inferred refusal or effect result.
-  }
-  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
-}
-
-function normalizeCursorTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-opencode.ts

@@ -22,7 +22,6 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -89,19 +88,6 @@ export function buildOpenCodeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeOpenCodeResult(raw: AdapterRawResult): SpawnResult {
-  const result = normalizeOpenCodeTransportResult(raw);
-  if (result.ok) return result;
-  const parsed = parseOpenCodeStream(raw.stdout);
-  const text = parsed.text || raw.stdout.trim();
-  return {
-    ...result,
-    text,
-    sessionId: parsed.sessionId,
-    failureEvidence: observeSpawnFailure(raw, text, parsed.text ? "vendor_envelope" : "stdout"),
-  };
-}
-
-function normalizeOpenCodeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/types.ts

@@ -137,12 +137,11 @@ export interface WorkflowAgentProof {
   session_id?: string;
   result?: ResultDigest;
   error?: string;
-  /** Failed-spawn transport class. It is retained even when a script swallows
-   * the rejection; charging additionally requires validated failure evidence. */
+  /** Set on a failed agent whose spawn was classified uninformative about the
+   * work (ADR 0046): environment (binary absent) or upstream (vendor refused).
+   * Absent ⇒ a work failure. Recorded even when a script's parallel() swallows
+   * the rejection, so the run-level class can still be derived from proof. */
   class?: SpawnFailureClass;
-  /** Failure observations carried from the adapter. Missing observations are
-   * unknown and cannot authorize an uncharged attempt. */
-  failure_evidence?: SpawnFailureEvidence;
   /** Which vendor sandbox mode this agent launched with and why (ADR 0192).
    * Absent on a cached agent, which launched nothing. */
   access?: WorkerAccessDecision;
@@ -363,16 +362,15 @@ export interface WorkflowSpecialistProfile {
 }
 
 /**
- * The positively identified transport cause of a failed spawn (ADR 0046).
- * This class alone proves neither absence of effects nor retry eligibility.
+ * Why a failed run was uninformative about the work (ADR 0046). Absent means
+ * the attempt produced information about the work (or succeeded), which is the
+ * default and is charged against the attempt budget exactly as before.
  *
  * - `environment`: the run never started — a precondition was missing (the
- *   vendor binary was absent). With positive no-effect/output evidence it is
- *   uncharged and not retried: retrying an unchanged
+ *   vendor binary was absent). Uncharged AND not retried: retrying an unchanged
  *   environment cannot help, so the work item stops and names the precondition.
  * - `upstream`: the vendor was reached and refused (5xx, 429, circuit open).
- *   Retry/free-attempt eligibility also requires positive no-effect evidence,
- *   observed absent output, and no refusal. Unsupported evidence stays unknown.
+ *   Uncharged, but retry stays available (bounded by max_uncharged_attempts).
  */
 export type SpawnFailureClass = "environment" | "upstream";
 
@@ -394,30 +392,6 @@ export type SpawnFailureClass = "environment" | "upstream";
  */
 export type RunFailureClass = SpawnFailureClass | "decision";
 
-/** Positive claims name the observation that supports them. A transport error
- * or an empty reply is never evidence that no effects occurred. */
-export type SpawnEffectEvidence =
-  | { state: "unknown" }
-  | { state: "none"; source: "spawn_errno"; reference: "ENOENT" }
-  | { state: "none" | "observed"; source: "adapter_evidence"; reference: string };
-
-export type SpawnRefusalEvidence =
-  | { state: "unknown" }
-  | { state: "refused"; source: "vendor_envelope"; reference: string };
-
-export type SpawnOutputSource = "final_message" | "vendor_envelope" | "stdout";
-
-export type SpawnPartialOutputEvidence =
-  | { state: "unknown" }
-  | { state: "absent"; source: SpawnOutputSource }
-  | { state: "present"; source: SpawnOutputSource; bytes: number; sha256: string };
-
-export interface SpawnFailureEvidence {
-  effect: SpawnEffectEvidence;
-  refusal: SpawnRefusalEvidence;
-  partial_output: SpawnPartialOutputEvidence;
-}
-
 /** What a spawn adapter returns for one subagent run. */
 export interface SpawnResult {
   ok: boolean;
@@ -429,13 +403,9 @@ export interface SpawnResult {
   durationMs: number;
   /** Populated when ok=false. */
   error?: string;
-  /** Transport classification when ok=false; never sufficient by itself to
-   * grant free work or automatic redispatch. */
+  /** Set when ok=false and the failure was positively identified as
+   * uninformative about the work. Absent ⇒ a work failure (charged). */
   class?: SpawnFailureClass;
-  /** Transport classification alone grants neither a retry nor free work.
-   * Absent evidence is explicitly unknown. Positive adapter_evidence claims
-   * require a documented producer observation, never an HTTP/text heuristic. */
-  failureEvidence?: SpawnFailureEvidence;
 }
 
 export interface SpawnRequest {

package/src/core/workflow/workspaces/leases.ts

@@ -417,7 +417,7 @@ function writeExclusive(path: string, bytes: string): void {
   }
 }
 
-function readOwner(path: string): { owner: NoClobberLeaseOwner; bytes: string } {
+export function readOwner(path: string): { owner: NoClobberLeaseOwner; bytes: string } {
   let size: number;
   try {
     const stat = lstatSync(path);