okengine 0.10.2 → 0.11.0

package/src/drivers/vault-builtin.ts

@@ -0,0 +1,184 @@
+/**
+ * `vault` driver — okengine's own encrypted-at-rest secret store.
+ *
+ * The built-in Vault is asynchronous and path-addressed
+ * ({@link BuiltinVaultAdapter}), while the boot resolution chain wants a
+ * synchronous name→value {@link VaultBag}. This driver bridges the two: at
+ * `open` it unseals with `OKE_VAULT_MASTER_KEY`, snapshots every live secret
+ * into a bag, and keeps the adapter around for write-through.
+ *
+ * Boot must never die because the operator has not run `oke vault init` yet,
+ * so an uninitialized, sealed, or unreachable backend degrades to the seed
+ * bag — the Vault runtime then reports the missing contracts as ordinary
+ * gaps, with the same message every other driver produces.
+ */
+
+import {
+  createBuiltinVaultAdapter,
+  sqlConnectionAsExec,
+  type BuiltinVaultAdapter,
+} from "../elements/vault/builtin-adapter.ts";
+import type { SqlConnection } from "./types.ts";
+import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
+
+/** Environment variable holding the base64 master key. */
+export const VAULT_MASTER_KEY_ENV = "OKE_VAULT_MASTER_KEY";
+
+/** Test-only handle to the adapter a bag is sealing on {@link VaultBag.close}. */
+export const VAULT_BAG_ADAPTER = Symbol.for("oke.vault.bagAdapter");
+
+/** Options for {@link openBuiltinVaultAdapter}. */
+export interface OpenBuiltinVaultOptions {
+  /** Postgres URL. Falls back to `DATABASE_URL` / `OKE_STORE_SQL_URL`, then PGlite. */
+  readonly url?: string;
+  /** Pre-opened SQL connection — wins over `url`. */
+  readonly connection?: SqlConnection;
+  /** Base64 master key to unseal with. Defaults to `OKE_VAULT_MASTER_KEY`. */
+  readonly masterKey?: string;
+  /** Injected env map for tests. */
+  readonly env?: Readonly<Record<string, string | undefined>>;
+  /** DEKs re-wrapped per master-rotation batch. */
+  readonly kekRewrapBatchSize?: number;
+}
+
+/** An adapter plus the connection this module opened for it, if any. */
+export interface OpenedBuiltinVault {
+  /** The built-in adapter, unsealed when a valid master key was available. */
+  readonly adapter: BuiltinVaultAdapter;
+  /** Close the underlying connection when this module opened it. */
+  close(): Promise<void>;
+}
+
+/**
+ * Open the built-in Vault adapter over SQL, unsealing when a master key is
+ * available.
+ *
+ * Used by the CLI (`oke vault …`) and Console, which need the full
+ * path-addressed surface rather than a flat bag.
+ *
+ * @param options - URL / connection / master key / batch size
+ */
+export async function openBuiltinVaultAdapter(
+  options: OpenBuiltinVaultOptions = {},
+): Promise<OpenedBuiltinVault> {
+  const env = options.env ?? process.env;
+  const url = options.url ?? env.DATABASE_URL ?? env.OKE_STORE_SQL_URL;
+
+  let owned: SqlConnection | undefined;
+  let connection = options.connection;
+  if (!connection) {
+    owned = await connectVaultSql(url);
+    connection = owned;
+  }
+
+  const adapter = createBuiltinVaultAdapter({
+    db: sqlConnectionAsExec(connection),
+    ...(options.kekRewrapBatchSize === undefined
+      ? {}
+      : { kekRewrapBatchSize: options.kekRewrapBatchSize }),
+  });
+
+  const masterKey = options.masterKey ?? env[VAULT_MASTER_KEY_ENV];
+  if (masterKey !== undefined && masterKey.trim().length > 0) {
+    await adapter.unseal(masterKey);
+  }
+
+  return {
+    adapter,
+    async close() {
+      await owned?.close();
+    },
+  };
+}
+
+/**
+ * Built-in Vault driver. Reads resolve from a snapshot taken at `open`.
+ */
+export const builtinVaultDriver: VaultDriver = {
+  id: "vault",
+  async open(options: VaultOpenOptions = {}): Promise<VaultBag> {
+    const map = new Map<string, string>(
+      Object.entries(options.secrets ?? {}).filter(
+        (e): e is [string, string] => typeof e[1] === "string",
+      ),
+    );
+
+    const env = options.env ?? process.env;
+    const url = options.url ?? env.DATABASE_URL ?? env.OKE_STORE_SQL_URL;
+
+    let opened: OpenedBuiltinVault | undefined;
+    // With no SQL configured there is nothing to snapshot, and spinning up a
+    // throwaway PGlite instance would cost every boot ~1s for an empty bag.
+    if (options.connection !== undefined || url !== undefined) {
+      try {
+        opened = await openBuiltinVaultAdapter({
+          env,
+          ...(options.connection !== undefined ? { connection: options.connection } : { url }),
+        });
+        if (opened.adapter.getUnsealer() !== null) {
+          for (const entry of await opened.adapter.list()) {
+            const secret = await opened.adapter.get(entry.path);
+            if (secret) map.set(entry.path, secret.value);
+          }
+        }
+      } catch {
+        // Uninitialized / sealed / unreachable: fall back to the seed bag so
+        // boot reports missing contracts instead of a driver stack trace.
+        await opened?.close().catch(() => undefined);
+        opened = undefined;
+      }
+    }
+
+    const adapter = opened?.adapter;
+    return {
+      driverId: "vault",
+      ...(adapter === undefined ? {} : { [VAULT_BAG_ADAPTER]: adapter }),
+      get(name) {
+        return map.get(name);
+      },
+      names() {
+        return [...map.keys()];
+      },
+      set(name, value) {
+        map.set(name, value);
+        if (adapter && adapter.getUnsealer() !== null) {
+          void adapter.set(name, value).catch(() => undefined);
+        }
+      },
+      delete(name) {
+        const had = map.delete(name);
+        if (adapter && adapter.getUnsealer() !== null) {
+          void adapter.delete(name).catch(() => undefined);
+        }
+        return had;
+      },
+      async close() {
+        // Auto-seal on bag close (app stop / SIGTERM → bootResult.close → vault.close).
+        // Clears the in-memory master key before the SQL connection drops.
+        try {
+          await adapter?.seal();
+        } catch {
+          // Already sealed / never unsealed — ignore.
+        }
+        await opened?.close();
+      },
+    } as VaultBag;
+  },
+};
+
+/**
+ * Open the SQL connection backing the built-in Vault.
+ *
+ * A real Postgres URL uses the `postgres` driver; anything else (including
+ * no URL at all) uses PGlite so local dev and tests work with no services.
+ *
+ * @param url - Resolved SQL URL, when configured
+ */
+async function connectVaultSql(url: string | undefined): Promise<SqlConnection> {
+  if (url !== undefined && /^postgres(ql)?:\/\//.test(url)) {
+    const { connectPostgres } = await import("./postgres.ts");
+    return connectPostgres({ url });
+  }
+  const { connectPglite } = await import("./pglite.ts");
+  return connectPglite(url === undefined ? {} : { url });
+}

package/src/drivers/vault-driver-removal.test.ts

@@ -16,6 +16,10 @@ const FORBIDDEN_DRIVER = ["so", "ps"].join("");
 const FORBIDDEN_SECRETS_SAAS = ["infi", "sical"].join("");
 /** Forbidden optional peer, split so this file does not match itself. */
 const FORBIDDEN_AGE = ["age", "-", "encryption"].join("");
+/** Forbidden external vault driver id, split so this file does not match itself. */
+const FORBIDDEN_EXT_VAULT = ["open", "bao"].join("");
+/** Forbidden vault-provider alias, split so this file does not match itself. */
+const FORBIDDEN_VAULT_ALIAS = ["hashi", "corp"].join("");
 
 /** Lockfiles regenerated by `bun install` — not source residue. */
 const LOCKFILE_PREFIXES = [
@@ -62,4 +66,13 @@ describe("removed vault driver gate", () => {
   test("tracked tree has zero matches for the removed age peer outside lockfiles", () => {
     assertZeroGitGrep(FORBIDDEN_AGE, LOCKFILE_PREFIXES);
   });
+
+  test("tracked tree has zero matches for the removed external vault driver", () => {
+    // Community-plugin notes in changelog / site docs may mention the name.
+    assertZeroGitGrep(FORBIDDEN_EXT_VAULT, ["changelog.md:", "site/content/docs/"]);
+  });
+
+  test("tracked tree has zero matches for the removed vault alias outside docs notes", () => {
+    assertZeroGitGrep(FORBIDDEN_VAULT_ALIAS, ["changelog.md:", "site/content/docs/"]);
+  });
 });

package/src/drivers/vault-managed.test.ts

@@ -0,0 +1,95 @@
+/**
+ * Managed vault driver — provider selection, deferred providers, delegation.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { isVaultError } from "../elements/vault/errors.ts";
+import { createManagedVaultBag, managedVaultDriver } from "./vault-managed.ts";
+import type { AwsSecretsManagerClient } from "./vault-aws-secrets-manager.ts";
+
+/** In-memory stand-in for the AWS Secrets Manager API. */
+function fakeAwsClient(seed: Record<string, string>): AwsSecretsManagerClient {
+  const store = new Map(Object.entries(seed));
+  return {
+    async list() {
+      return [...store.keys()];
+    },
+    async get(name) {
+      return store.get(name);
+    },
+    async put(name, value) {
+      store.set(name, value);
+    },
+    async remove(name) {
+      store.delete(name);
+    },
+  };
+}
+
+describe("managed vault driver", () => {
+  test("no provider keeps the platform-injected map", async () => {
+    const bag = await managedVaultDriver.open({
+      env: { INJECTED: "from-platform" },
+      secrets: { SEEDED: "from-seed" },
+    });
+    expect(bag.driverId).toBe("managed");
+    expect(bag.get("INJECTED")).toBe("from-platform");
+    expect(bag.get("SEEDED")).toBe("from-seed");
+  });
+
+  test("aws-secrets-manager provider reads through the injected client", async () => {
+    const bag = await createManagedVaultBag({
+      provider: "aws-secrets-manager",
+      client: fakeAwsClient({ STRIPE_KEY: "sk_live" }),
+    });
+    expect(bag.driverId).toBe("managed");
+    expect(bag.get("STRIPE_KEY")).toBe("sk_live");
+  });
+
+  test("provider id is case- and space-insensitive", async () => {
+    const bag = await createManagedVaultBag({
+      provider: "  AWS-Secrets-Manager ",
+      client: fakeAwsClient({ A: "1" }),
+    });
+    expect(bag.get("A")).toBe("1");
+  });
+
+  test("rejects removed external vault providers", async () => {
+    // Split tokens so the removal gate never matches this file.
+    const removed = [["open", "bao"].join(""), ["hashi", "corp"].join("")];
+    for (const provider of removed) {
+      let failed: unknown;
+      try {
+        await createManagedVaultBag({ provider });
+      } catch (error) {
+        failed = error;
+      }
+      expect(isVaultError(failed, "UNSUPPORTED")).toBe(true);
+      expect((failed as Error).message).toContain(provider);
+    }
+  });
+
+  test("deferred providers fail UNSUPPORTED, never silently empty", async () => {
+    for (const provider of ["azure-key-vault", "gcp-secret-manager", "doppler", "1password"]) {
+      let failed: unknown;
+      try {
+        await createManagedVaultBag({ provider });
+      } catch (error) {
+        failed = error;
+      }
+      expect(isVaultError(failed, "UNSUPPORTED")).toBe(true);
+      expect((failed as Error).message).toContain(provider);
+    }
+  });
+
+  test("unknown provider fails UNSUPPORTED with the supported list", async () => {
+    let failed: unknown;
+    try {
+      await createManagedVaultBag({ provider: "acme-secrets" });
+    } catch (error) {
+      failed = error;
+    }
+    expect(isVaultError(failed, "UNSUPPORTED")).toBe(true);
+    expect((failed as Error).message).toContain("aws-secrets-manager");
+  });
+});

package/src/drivers/vault-managed.ts

@@ -1,38 +1,114 @@
 /**
- * `managed` vault driver — platform-injected secrets (Fly / Railway / K8s).
+ * `managed` vault driver — one selector over the supported secret backends.
  *
- * Values arrive as an injected map (or env); OKE never invents a vendor client.
+ * With no `provider` the driver keeps its original shape: values arrive as an
+ * injected map (or env), the way Fly / Railway / K8s hand them over, and OKE
+ * never invents a vendor client.
+ *
+ * With a `provider` the driver delegates, and the bag reports the backend's
+ * own protocol id — `managed` is a selector, not a protocol. Backends load
+ * dynamically so a project on one provider never pays for the others.
+ *
+ * Official provider: `aws-secrets-manager`. Community plugins can implement
+ * additional adapters; unknown ids fail loud with {@link VaultError} `UNSUPPORTED`.
  */
 
+import { VaultError } from "../elements/vault/errors.ts";
+import type { AwsSecretsManagerClient } from "./vault-aws-secrets-manager.ts";
 import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
 
+/** Official backends `managed` ships today. */
+export type ManagedVaultProviderId = "aws-secrets-manager";
+
+/** Providers named in config but not implemented in core — reported, not guessed. */
+const DEFERRED_PROVIDERS: readonly string[] = [
+  "azure-key-vault",
+  "gcp-secret-manager",
+  "doppler",
+  "1password",
+];
+
+/** Supported provider ids, for error messages. */
+const SUPPORTED_PROVIDERS = "aws-secrets-manager";
+
+/** Options for {@link createManagedVaultBag}. */
+export interface ManagedVaultOptions extends VaultOpenOptions {
+  /** Injected AWS Secrets Manager client for tests. */
+  readonly client?: AwsSecretsManagerClient;
+}
+
+/**
+ * Open the bag for the selected managed provider.
+ *
+ * @param options - Provider id plus that provider's connection options
+ * @throws VaultError `UNSUPPORTED` for a deferred or unknown provider
+ */
+export async function createManagedVaultBag(options: ManagedVaultOptions = {}): Promise<VaultBag> {
+  const provider = options.provider?.trim().toLowerCase();
+
+  if (provider === undefined || provider === "") return injectedBag(options);
+
+  if (provider === "aws-secrets-manager") {
+    const { openAwsSecretsManagerBag } = await import("./vault-aws-secrets-manager.ts");
+    return openAwsSecretsManagerBag({
+      ...(options.region === undefined ? {} : { region: options.region }),
+      ...(options.mount === undefined ? {} : { prefix: options.mount }),
+      ...(options.client === undefined ? {} : { client: options.client }),
+      ...(options.secrets === undefined ? {} : { secrets: options.secrets }),
+    });
+  }
+
+  if (DEFERRED_PROVIDERS.includes(provider)) {
+    throw new VaultError(
+      "UNSUPPORTED",
+      `vault: managed provider "${provider}" is not implemented yet — official: ${SUPPORTED_PROVIDERS}. ` +
+        "Community adapters can implement ManagedAdapter / open via a plugin.",
+    );
+  }
+
+  throw new VaultError(
+    "UNSUPPORTED",
+    `vault: unknown managed provider "${provider}" (expected ${SUPPORTED_PROVIDERS}). ` +
+      'Official backends: aws-secrets-manager or built-in vault (drivers.vault: "vault").',
+  );
+}
+
+/**
+ * Platform-injected bag — env vars plus an explicit seed map.
+ *
+ * @param options - Seed / env overrides
+ */
+function injectedBag(options: VaultOpenOptions): VaultBag {
+  const fromSecrets = Object.entries(options.secrets ?? {}).filter(
+    (e): e is [string, string] => typeof e[1] === "string",
+  );
+  const fromEnv = Object.entries(options.env ?? process.env).filter(
+    (e): e is [string, string] => typeof e[1] === "string" && e[1].length > 0,
+  );
+  const map = new Map<string, string>([...fromEnv, ...fromSecrets]);
+  return {
+    driverId: "managed",
+    get(name) {
+      return map.get(name);
+    },
+    names() {
+      return [...map.keys()];
+    },
+    set(name, value) {
+      map.set(name, value);
+    },
+    delete(name) {
+      return map.delete(name);
+    },
+  };
+}
+
 /**
  * Managed / platform vault driver.
  */
 export const managedVaultDriver: VaultDriver = {
   id: "managed",
-  async open(options: VaultOpenOptions = {}): Promise<VaultBag> {
-    const fromSecrets = Object.entries(options.secrets ?? {}).filter(
-      (e): e is [string, string] => typeof e[1] === "string",
-    );
-    const fromEnv = Object.entries(options.env ?? process.env).filter(
-      (e): e is [string, string] => typeof e[1] === "string" && e[1].length > 0,
-    );
-    const map = new Map<string, string>([...fromEnv, ...fromSecrets]);
-    return {
-      driverId: "managed",
-      get(name) {
-        return map.get(name);
-      },
-      names() {
-        return [...map.keys()];
-      },
-      set(name, value) {
-        map.set(name, value);
-      },
-      delete(name) {
-        return map.delete(name);
-      },
-    };
+  open(options: ManagedVaultOptions = {}): Promise<VaultBag> {
+    return createManagedVaultBag(options);
   },
 };

package/src/drivers/vault-types.ts

@@ -1,27 +1,47 @@
 /**
  * Protocol-named vault driver contracts.
  *
- * Driver ids: `env` · `openbao` · `managed` · `memory`.
+ * Driver ids: `env` · `vault` · `managed` · `memory`.
  * Never vendor names (`neon`, …) — vendor choice lives in `images`.
  */
 
-/** Protocol ids for vault drivers. */
-export type VaultDriverId = "env" | "openbao" | "managed" | "memory";
+/**
+ * Protocol ids for vault drivers.
+ *
+ * `vault` is okengine's own encrypted-at-rest store; `managed` selects a
+ * remote provider (official: `aws-secrets-manager`) or a platform-injected bag.
+ */
+export type VaultDriverId = "env" | "vault" | "managed" | "memory";
 
 /** Options when opening a vault backend. */
 export interface VaultOpenOptions {
+  /**
+   * Pre-opened SQL connection for the built-in `vault` driver (tests / CLI).
+   * Wins over {@link url} when set.
+   */
+  readonly connection?: import("./types.ts").SqlConnection;
   /** Path to a dotenv file (`env` driver). */
   readonly path?: string;
   /** Env prefix filter for the `env` driver (default: none — whole `process.env`). */
   readonly envPrefix?: string;
   /** Injected env map for tests (defaults to `process.env`). */
   readonly env?: Readonly<Record<string, string | undefined>>;
-  /** OpenBao / managed base URL. */
+  /**
+   * Backend behind the `managed` driver — official: `aws-secrets-manager`.
+   * Omit for platform-injected secrets. Community adapters may accept other ids.
+   */
+  readonly provider?: string;
+  /** Base URL for remote managed providers (community adapters). */
   readonly url?: string;
   /** Token / API key for remote vaults. */
   readonly token?: string;
-  /** Mount / project path for remote vaults. */
+  /**
+   * Mount / project path for remote vaults. Doubles as the secret-name prefix
+   * for `aws-secrets-manager` (`oke/prod/` → `oke/prod/STRIPE_KEY`).
+   */
   readonly mount?: string;
+  /** Cloud region for regional managed providers. */
+  readonly region?: string;
   /** Seed map for `memory` / `managed` drivers. */
   readonly secrets?: Readonly<Record<string, string>>;
   /** HTTP fetch override for remote drivers (tests). */

package/src/elements/ai/runtime.ts

@@ -717,7 +717,7 @@ export function createAiRuntime(options: CreateAiRuntimeOptions = {}): AiRuntime
       }
       if (index.driverId === "meilisearch") {
         throw new Error(
-          `ai: embed into "${decl.into}" needs a vector index (memory/pgvector/libsql) — ` +
+          `ai: embed into "${decl.into}" needs a vector index (memory/pgvector) — ` +
             `"${index.driverId}" is full-text; embeddings don't apply`,
         );
       }

package/src/elements/clock/chaos.test.ts

@@ -87,7 +87,10 @@ describe("chaos — multi-process leader election", () => {
     const markerPath = join(dir, "held.json");
     const fireLogPath = join(dir, "fires.jsonl");
     const leaseMs = 120;
-    const tickSlackMs = 250;
+    // Shared-runner / loaded laptops routinely miss a 50ms tick; keep this a
+    // loose upper bound (not a product SLA) so SIGKILL takeover still proves
+    // lease physics without flaking on scheduling noise.
+    const tickSlackMs = 500;
     try {
       const leader = Bun.spawn({
         cmd: ["bun", childPath, "hold-lease", storePath, "leader", markerPath, String(leaseMs)],

package/src/elements/clock/durable.ts

@@ -7,8 +7,10 @@
  */
 
 import { fxRetry } from "../../kernel/concurrency.ts";
+import { failureCodeOf, rebindUndosFromDo, runCompensationPhase } from "../../kernel/compensate.ts";
 import type { AnyFlowDef } from "../../kernel/flow.ts";
 import { createFxContext, type CreateFxOptions, type Fx } from "../../kernel/fx.ts";
+import { isFlowFailure } from "../../kernel/hooks.ts";
 import {
   createJournal,
   isJournalSuspend,
@@ -17,6 +19,7 @@ import {
   type JournalSession,
   type JournalStore,
 } from "../../kernel/journal.ts";
+
 /** Outcome of one durable attempt. */
 export type DurableResult<O = unknown> =
   | {
@@ -74,7 +77,21 @@ export async function runDurable<O = unknown>(
 
   if (options.runId) {
     const existing = await options.journalStore.get(options.runId);
-    if (existing?.wakeAt !== undefined && now() < existing.wakeAt) {
+    if (!existing) {
+      return {
+        status: "failed",
+        runId: options.runId,
+        error: `journal: run "${options.runId}" not found`,
+      };
+    }
+    if (existing.status === "failed" || existing.status === "completed") {
+      return {
+        status: "failed",
+        runId: existing.id,
+        error: existing.error ?? `journal: run is already ${existing.status}`,
+      };
+    }
+    if (existing.wakeAt !== undefined && now() < existing.wakeAt) {
       const sleepEntry = [...existing.entries].reverse().find((e) => e.kind === "sleep");
       return {
         status: "sleeping",
@@ -102,6 +119,23 @@ export async function runDurable<O = unknown>(
     durable: true,
   });
 
+  if (session.run.status === "compensating") {
+    await rebindUndosFromDo(options.flow, options.input, fx, session);
+    const priorError = session.run.error ?? "Error";
+    await runCompensationPhase({
+      flow: options.flow,
+      input: options.input,
+      session,
+      fx,
+      error: new Error(priorError),
+    });
+    return {
+      status: "failed",
+      runId: session.runId,
+      error: session.run.error ?? priorError,
+    };
+  }
+
   try {
     const run = () => {
       // Same journal session across attempts — rewind so completed steps replay.
@@ -109,6 +143,20 @@ export async function runDurable<O = unknown>(
       return options.flow.do(options.input as never, fx);
     };
     const output = await (options.flow.retry ? fxRetry(run, options.flow.retry) : run());
+    if (isFlowFailure(output)) {
+      await runCompensationPhase({
+        flow: options.flow,
+        input: options.input,
+        session,
+        fx,
+        error: output,
+      });
+      return {
+        status: "failed",
+        runId: session.runId,
+        error: session.run.error ?? failureCodeOf(output),
+      };
+    }
     await session.commit("completed", { output });
     return {
       status: "completed",
@@ -124,12 +172,17 @@ export async function runDurable<O = unknown>(
         label: err.label,
       };
     }
-    const message = err instanceof Error ? err.message : String(err);
-    await session.commit("failed", { error: message });
+    await runCompensationPhase({
+      flow: options.flow,
+      input: options.input,
+      session,
+      fx,
+      error: err,
+    });
     return {
       status: "failed",
       runId: session.runId,
-      error: message,
+      error: session.run.error ?? failureCodeOf(err),
     };
   }
 }

package/src/elements/clock.test.ts

@@ -17,7 +17,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { flow } from "../kernel/flow.ts";
-import { createFileJournalStore, createMemoryJournalStore } from "../kernel/journal.ts";
+import {
+  createFileJournalStore,
+  createJournal,
+  createMemoryJournalStore,
+} from "../kernel/journal.ts";
 import {
   clock,
   createClockRuntime,
@@ -65,7 +69,6 @@ describe("durable journal", () => {
     const calls: string[] = [];
     const journalStore = createMemoryJournalStore();
     const tt = createTimeTravel(0);
-    let crashAfterFirstStep = true;
 
     const charge = flow("payments.charge", {
       durable: true,
@@ -74,9 +77,6 @@ describe("durable journal", () => {
           calls.push("create-intent");
           return { id: "pi_1" };
         });
-        if (crashAfterFirstStep) {
-          throw new Error("KILLED");
-        }
         return fx.step("confirm", () => {
           calls.push("confirm");
           return intent.id === "pi_1";
@@ -84,17 +84,16 @@ describe("durable journal", () => {
       },
     });
 
-    const first = await runDurable({
-      flow: charge,
-      input: { orderId: "o1" },
-      journalStore,
-      now: tt.now,
+    // Simulate crash after the first step: leave status `running` (orphans,
+    // not terminal `failed` — failed runs refuse resume).
+    const journal = createJournal({ store: journalStore, now: tt.now });
+    const crashed = await journal.start("payments.charge", { orderId: "o1" });
+    await crashed.step("create-intent", () => {
+      calls.push("create-intent");
+      return { id: "pi_1" };
     });
-    expect(first.status).toBe("failed");
-    expect(calls).toEqual(["create-intent"]);
+    const runId = crashed.runId;
 
-    crashAfterFirstStep = false;
-    const runId = first.status === "failed" ? first.runId : "";
     const second = await runDurable({
       flow: charge,
       input: { orderId: "o1" },