pi-daddy 0.17.0 → 0.18.0

package/extensions/delegate-chain.ts

@@ -20,23 +20,21 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import type { InheritableApproval } from "../src/approval.ts";
 import { DELEGATE_SUBJECT, shouldSeekApproval } from "../src/approval.ts";
-import { chainStepSpec, PLACEHOLDER } from "../src/chain.ts";
+import { chainStepSpec, PLACEHOLDER, type ChainStep } from "../src/chain.ts";
 import { planDelegation } from "../src/delegate.ts";
 import { MAX_CHAIN_STEPS, childSpawnId, splitBudget } from "../src/fanout.ts";
 import { PAINT_INTERVAL_MS, appendTail, emptyTail, renderProgress, replaceTail, throttle, type ChildProgress } from "../src/progress.ts";
 import type { Capability } from "../src/resolve.ts";
-import { appendRecord, buildRecord } from "../src/ledger.ts";
+import { recordChainRefusal } from "./chain-ledger.ts";
 import { obtainApprovals, snapshotOf } from "./approvals.ts";
 import { runOneDelegation } from "./run-delegation.ts";
+import { isCriticalAssuranceBlock } from "./execute-child.ts";
 import type { GrantsSession } from "./session.ts";
+import { GovernanceRefusal, refusal, type StructuredRefusal } from "../src/refusals.ts";
+import { chainApprovalFacts, newChainApprovalAudit, rememberChainApproval } from "./chain-approval-facts.ts";
 
 /** One step of a chain, as the model describes it. */
-interface StepSpec {
-  task: string;
-  agent?: string;
-  tools?: string[];
-  model?: string;
-}
+type StepSpec = ChainStep;
 
 /**
  * One dialog's worth of gate: a single capability, for a single subject, described by the step that needs it.
@@ -53,13 +51,17 @@ interface GateRequest {
   capability: Capability;
   /** The task of the step that needs this capability. */
   task: string;
+  stepIndex: number;
+  plan: ReturnType<typeof planDelegation>;
 }
 
 /** Either every gate the chain will hit, or the first step that can never run and why. */
 interface ChainPlan {
   requests: GateRequest[];
+  /** Exact approval keys each step would spend, including duplicate subjects across steps. */
+  uses: Map<number, Set<string>>;
   /** Set when a step is refused for a reason no approval can fix. The chain must refuse before asking anyone. */
-  doomed?: { step: number; reason: string };
+  doomed?: { step: number; reason: string; plan: ReturnType<typeof planDelegation>; agent?: string; refusal?: StructuredRefusal };
 }
 
 /**
@@ -85,6 +87,7 @@ interface ChainPlan {
  */
 async function planChain(session: GrantsSession, steps: StepSpec[], perStepBudget: number): Promise<ChainPlan> {
   const requests: GateRequest[] = [];
+  const uses = new Map<number, Set<string>>();
   const seen = new Set<string>();
   const context = await session.delegationContext();
 
@@ -93,25 +96,49 @@ async function planChain(session: GrantsSession, steps: StepSpec[], perStepBudge
     // or a step with a whitespace task raises a dialog and is refused afterwards. The handoff is absent at planning
     // time and cannot change which capabilities are gated.
     const plan = planDelegation(
-      { task: step.task, agent: step.agent, tools: step.tools, model: step.model },
+      {
+        task: step.task,
+        agent: step.agent,
+        tools: step.tools,
+        model: step.model,
+        correlation: step.workspace
+          ? { ...(step.correlation ?? {}), workspace_id: step.workspace.workspace_id }
+          : step.correlation,
+        // Routing spec, not the model's correlation claim — see R-110 in `src/correlation.ts`.
+        boundWorkspaceId: step.workspace?.workspace_id,
+        boundContextId: step.correlation?.context_id,
+      },
       { ...context, spawnId: session.ownSpawnId, childSpawnId: childSpawnId(session.ownSpawnId, index) },
     );
 
     // A gate is the ONLY refusal an approval can lift. Anything else is doomed, and asking about it banks authority
     // for a spawn that will never happen.
     if (!plan.ok && !shouldSeekApproval(plan.result)) {
-      return { requests: [], doomed: { step: index + 1, reason: plan.reason ?? "this step cannot run" } };
+      return {
+        requests: [], uses, doomed: {
+          step: index + 1, reason: plan.reason ?? "this step cannot run", plan, agent: step.agent,
+          ...(plan.refusal ? { refusal: plan.refusal } : {}),
+        },
+      };
     }
 
+    // A correlated approval is bound to the exact task. Step N's final task does not exist until step N-1
+    // finishes, so asking upfront would bind the template and then spend it on different instructions.
+    // Legacy chains keep their upfront dialogs; correlated steps gate when their composed task exists.
+    if (plan.approvalBinding) continue;
+
     const subject = step.agent ?? DELEGATE_SUBJECT;
+    uses.set(index, new Set(plan.result.gatedBlocked.map((capability) => `${capability}@${subject}`)));
     for (const capability of plan.result.gatedBlocked) {
       const key = `${capability}@${subject}`;
       if (seen.has(key)) continue;
       seen.add(key);
-      requests.push({ subject, path: step.agent ? "definition" : "delegate", capability, task: step.task });
+      requests.push({
+        subject, path: step.agent ? "definition" : "delegate", capability, task: step.task, stepIndex: index, plan,
+      });
     }
   }
-  return { requests };
+  return { requests, uses };
 }
 
 export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): void {
@@ -127,6 +154,23 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
     agent: Type.Optional(Type.String({ description: "Definition to spawn for this step." })),
     tools: Type.Optional(Type.Array(Type.String(), { description: "Capabilities, when no 'agent' fits." })),
     model: Type.Optional(Type.String({ description: "Model as provider/id. Defaults to this session's." })),
+    correlation: Type.Optional(Type.Object({
+      schema_version: Type.Optional(Type.String()), run_id: Type.Optional(Type.String()),
+      task_id: Type.Optional(Type.String()), workspace_id: Type.Optional(Type.String()),
+      context_id: Type.Optional(Type.String()), phase: Type.Optional(Type.String()),
+      assurance: Type.Optional(Type.String()), assurance_effective: Type.Optional(Type.String()),
+      policy_label: Type.Optional(Type.String()), assurance_source: Type.Optional(Type.String()),
+      assurance_scope: Type.Optional(Type.Any()), activated_at: Type.Optional(Type.String()),
+      plan_digest: Type.Optional(Type.String()), definition_digest: Type.Optional(Type.String()),
+      task_digest: Type.Optional(Type.String()), base_sha: Type.Optional(Type.String()),
+      head_sha: Type.Optional(Type.String()), tree_sha: Type.Optional(Type.String()),
+      event_seq: Type.Optional(Type.Number()), last_change_seq: Type.Optional(Type.Number()),
+      last_authority_seq: Type.Optional(Type.Number()), check_receipt_id: Type.Optional(Type.String()),
+    })),
+    workspace: Type.Optional(Type.Object({
+      workspace_id: Type.String(),
+      access: Type.Union([Type.Literal("read"), Type.Literal("write")]),
+    })),
   });
 
   const params = Type.Object({
@@ -156,37 +200,41 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
       // written, and the delegation was then refused anyway. `runOneDelegation` checks the executor before its own
       // gate; a chain hoists its gate above `runOneDelegation`, so the check has to be repeated here or that
       // ordering is simply bypassed.
-      if (session.executor.refusal) throw new Error(`chain refused: ${session.executor.refusal}`);
+      if (session.executor.refusal) throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", `chain refused: ${session.executor.refusal}`));
 
       // Cardinality next, still before the gate. `splitBudget` is reused rather than re-derived, so a chain and a
       // fan-out cannot disagree about what the budget means.
       const split = splitBudget(session.fanoutBudget, steps.length);
-      if (!split.ok) throw new Error(`chain refused: ${split.reason}`);
+      if (!split.ok) throw new GovernanceRefusal(refusal("FANOUT_EXCEEDED", `chain refused: ${split.reason}`));
 
       // Plan every step first. A step that can never run refuses the chain HERE, before anyone is asked — see
       // `planChain`.
       const chainPlan = await planChain(session, steps, split.perChild);
       if (chainPlan.doomed) {
-        throw new Error(
-          `chain refused at step ${chainPlan.doomed.step}: ${chainPlan.doomed.reason} No step ran, and nobody was ` +
-            `asked to approve anything — a step that cannot run must not bank authority for a spawn that will ` +
-            `never happen.`,
-        );
+        const message = `chain refused at step ${chainPlan.doomed.step}: ${chainPlan.doomed.reason} No step ran, and nobody was ` +
+          `asked to approve anything — a step that cannot run must not bank authority for a spawn that will never happen.`;
+        await recordChainRefusal({
+          session, plan: chainPlan.doomed.plan, stepIndex: chainPlan.doomed.step - 1,
+          agent: chainPlan.doomed.agent, reason: message, refusal: chainPlan.doomed.refusal,
+        });
+        if (chainPlan.doomed.refusal) throw new GovernanceRefusal({ ...chainPlan.doomed.refusal, message });
+        throw new Error(message);
       }
 
       // One dialog per `capability@subject`, each naming the step that needs it, all before the first step runs.
       const preApproved: InheritableApproval[] = [];
-      let declined: { capability: Capability; subject: string } | undefined;
-      let humanDenied = false;
+      const approvalAudit = newChainApprovalAudit();
+      const approvalStep = new Map<string, number>();
+      const approvedDecisions: Array<{ request: GateRequest; outcome: Awaited<ReturnType<typeof obtainApprovals>> }> = [];
+      let declined: { request: GateRequest; outcome: Awaited<ReturnType<typeof obtainApprovals>> } | undefined;
 
       for (const request of chainPlan.requests) {
         const outcome = await obtainApprovals(session, [request.capability], request.subject, request.path, ctx, request.task, signal);
-        humanDenied = humanDenied || outcome.humanDenied;
         if (!outcome.approved.includes(request.capability)) {
           // **Stop asking.** The chain's outcome is already fixed, and every further dialog banks authority — a
           // `session` yes into `sessionApprovals` and an `always` yes onto disk for 30 days — for a chain that will
           // not run. The single-delegate path breaks on the first no for the same reason.
-          declined = { capability: request.capability, subject: request.subject };
+          declined = { request, outcome };
           break;
         }
         preApproved.push({
@@ -197,47 +245,28 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
           // against one definition's instructions while the capability was spent on another's.
           bodySha256: snapshotOf(session, request.subject)?.bodySha256,
         });
+        rememberChainApproval(approvalAudit, request.capability, request.subject, outcome);
+        approvalStep.set(`${request.capability}@${request.subject}`, request.stepIndex);
+        approvedDecisions.push({ request, outcome });
       }
 
       if (declined) {
-        // Recorded before it is thrown, and recorded against the subject that was actually refused. The first version
-        // hardcoded step 1's identity, so the trail asserted a human had denied a capability for `digger` when they
-        // had *approved* it for `digger` and denied it for `shaper` — the ledger and the approval store asserting
-        // opposite facts about the same key, which is R-28's shape.
-        if (session.ledgerPath) {
-          const at = steps.findIndex((step) => (step.agent ?? DELEGATE_SUBJECT) === declined.subject);
-          await appendRecord(
-            { path: session.ledgerPath, strict: true },
-            buildRecord({
-              parentId: session.ownSpawnId,
-              childId: childSpawnId(session.ownSpawnId, Math.max(0, at)),
-              depth: session.depth + 1,
-              agentType: declined.subject === DELEGATE_SUBJECT ? "delegate" : declined.subject,
-              requested: [declined.capability],
-              parentGrant: session.ownGrant,
-              result: { effective: [], denied: [], clipped: [], gatedBlocked: [declined.capability], universal: [], subsumedBy: [] },
-              blocked: true,
-              humanDenied,
-              reason: `chain refused: ${declined.capability} not approved for ${declined.subject}; no step ran`,
-              executor: session.executor.kind,
-              now: new Date(),
-            }),
-          ).catch((error) => {
-            // Not swallowed. Everywhere else a `strict` ledger failure fails closed, and losing the one line that
-            // records a human's refusal is the direction rule 8 forbids — the chain refuses either way, so saying so
-            // costs nothing.
-            ctx.ui?.notify?.(
-              `grants: the chain was refused AND its ledger line could not be written (${String(error)}) — the ` +
-                `refusal happened, but this audit trail does not show it.`,
-              "error",
-            );
+        const { request, outcome } = declined;
+        const message = `chain refused: ${request.capability} was not approved for ${request.subject}, so no step ran. A chain ` +
+          `is gated as a unit — running only its approved steps would return a partial result that reads like a complete one.`;
+        const structured = outcome.refusalCode ? refusal(outcome.refusalCode, message) : undefined;
+        for (const approved of approvedDecisions) {
+          await recordChainRefusal({
+            session, plan: approved.request.plan, stepIndex: approved.request.stepIndex,
+            agent: steps[approved.request.stepIndex]?.agent, reason: message, approval: approved.outcome,
           });
         }
-        throw new Error(
-          `chain refused: ${declined.capability} was not approved for ${declined.subject}, so no step ran. A chain ` +
-            `is gated as a unit — running only its approved steps would return a partial result that reads like a ` +
-            `complete one.`,
-        );
+        await recordChainRefusal({
+          session, plan: request.plan, stepIndex: request.stepIndex, agent: steps[request.stepIndex]?.agent,
+          reason: message, refusal: structured, approval: outcome,
+        });
+        if (structured) throw new GovernanceRefusal(structured);
+        throw new Error(message);
       }
 
       const children: ChildProgress[] = steps.map((step) => ({
@@ -252,7 +281,9 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
         });
       }, PAINT_INTERVAL_MS);
 
-      const outcomes: Array<{ ok: boolean; text: string; reason?: string; step: number; agent?: string }> = [];
+      const outcomes: Array<{
+        ok: boolean; text: string; reason?: string; refusal?: StructuredRefusal; step: number; agent?: string;
+      }> = [];
       let previous: string | undefined;
       let aborted = false;
       /**
@@ -271,6 +302,11 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
 
       for (const [index, step] of steps.entries()) {
         const childId = childSpawnId(session.ownSpawnId, index);
+        const availableForStep = available.filter((approval) => {
+          const key = `${approval.capability}@${approval.subject}`;
+          return chainPlan.uses.get(index)?.has(key) &&
+            (approval.scope !== "once" || approvalStep.get(key) === index);
+        });
         const outcome = await runOneDelegation(
           session,
           chainStepSpec(step, previous),
@@ -279,21 +315,9 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
           ctx,
           signal,
           {
-            preApproved: available,
-            approvalFacts: {
-              // Only this step's subject, so the record says what was authorised for THIS child rather than for the
-              // chain as a whole.
-              approved: available.filter((a) => a.subject === (step.agent ?? DELEGATE_SUBJECT)).map((a) => a.capability),
-              sources: Object.fromEntries(
-                available
-                  .filter((a) => a.subject === (step.agent ?? DELEGATE_SUBJECT))
-                  .map((a) => [a.capability, "prompt" as const]),
-              ),
-              scopes: Object.fromEntries(
-                available.filter((a) => a.subject === (step.agent ?? DELEGATE_SUBJECT)).map((a) => [a.capability, a.scope]),
-              ),
-              humanDenied: false,
-            },
+            preApproved: availableForStep,
+            // Only approvals actually offered to this step are attributed or consumed here.
+            approvalFacts: chainApprovalFacts(approvalAudit, availableForStep, step.agent ?? DELEGATE_SUBJECT),
             onProgress: (update) => {
               const child = children[index];
               if (!child) return;
@@ -312,11 +336,16 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
 
         children[index].state = outcome.ok ? "completed" : "failed";
         children[index].settledAt = Date.now();
-        outcomes.push({ ok: outcome.ok, text: outcome.text, reason: outcome.reason, step: index + 1, agent: step.agent });
+        outcomes.push({
+          ok: outcome.ok, text: outcome.text, reason: outcome.reason, refusal: outcome.refusal,
+          step: index + 1, agent: step.agent,
+        });
+        if (isCriticalAssuranceBlock(outcome)) throw new Error(outcome.text);
 
         // Spend any `once` this step was handed, before the next step sees the list.
-        const spentSubject = step.agent ?? DELEGATE_SUBJECT;
-        available = available.filter((a) => !(a.scope === "once" && a.subject === spentSubject));
+        available = available.filter((approval) =>
+          approval.scope !== "once" || approvalStep.get(`${approval.capability}@${approval.subject}`) !== index,
+        );
 
         if (!outcome.ok) {
           // **Abort, and mark the rest.** Continuing would make the next step's task an error message, which is
@@ -345,12 +374,17 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
       if (outcomes.length === 1 && !outcomes[0].ok) {
         // Nothing completed at all, so there is no partial result to hand back — and a tool that returns text when
         // nothing ran is how a wrong summary gets written.
-        throw new Error(`chain failed at its first step.\n\n${report}`);
+        const message = `chain failed at its first step.\n\n${report}`;
+        if (outcomes[0].refusal) throw new GovernanceRefusal({ ...outcomes[0].refusal, message });
+        throw new Error(message);
       }
 
       return {
         content: [{ type: "text", text: `${report}${tail}` }],
-        details: { steps: steps.length, completed: outcomes.filter((o) => o.ok).length, aborted, budgetPerStep: split.perChild },
+        details: {
+          steps: steps.length, completed: outcomes.filter((o) => o.ok).length, aborted,
+          budgetPerStep: split.perChild, refusals: outcomes.map((outcome) => outcome.refusal ?? null),
+        },
       };
     },
   });

package/extensions/delegation.ts

@@ -23,7 +23,15 @@ import {
   type ChildProgress,
 } from "../src/progress.ts";
 import { registerChainTool } from "./delegate-chain.ts";
+import { GovernanceRefusal, refusal } from "../src/refusals.ts";
 import { runOneDelegation } from "./run-delegation.ts";
+import {
+  buildFanoutReport,
+  childFailureOutcome,
+  throwFanoutInfrastructure,
+  totalFanoutFailure,
+} from "./fanout-outcome.ts";
+import { isCriticalAssuranceBlock, type DelegationOutcome } from "./execute-child.ts";
 import { type GrantsSession } from "./session.ts";
 
 /**
@@ -150,11 +158,42 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
     `Name of a definition to spawn — its allowed-tools become the grant and its instructions ` +
     `become the sub-agent's system prompt. Available: ${names.join(", ") || "none"}.`;
 
+  const correlationShape = Type.Object({
+    schema_version: Type.Optional(Type.String()),
+    run_id: Type.Optional(Type.String()),
+    task_id: Type.Optional(Type.String()),
+    workspace_id: Type.Optional(Type.String()),
+    context_id: Type.Optional(Type.String()),
+    phase: Type.Optional(Type.String()),
+    assurance: Type.Optional(Type.String()),
+    assurance_effective: Type.Optional(Type.String()),
+    policy_label: Type.Optional(Type.String()),
+    assurance_source: Type.Optional(Type.String()),
+    assurance_scope: Type.Optional(Type.Any()),
+    activated_at: Type.Optional(Type.String()),
+    plan_digest: Type.Optional(Type.String()),
+    definition_digest: Type.Optional(Type.String()),
+    task_digest: Type.Optional(Type.String()),
+    base_sha: Type.Optional(Type.String()),
+    head_sha: Type.Optional(Type.String()),
+    tree_sha: Type.Optional(Type.String()),
+    event_seq: Type.Optional(Type.Number()),
+    last_change_seq: Type.Optional(Type.Number()),
+    last_authority_seq: Type.Optional(Type.Number()),
+    check_receipt_id: Type.Optional(Type.String()),
+  });
+  const workspaceShape = Type.Object({
+    workspace_id: Type.String({ description: "ID from the operator-owned workspace registry." }),
+    access: Type.Union([Type.Literal("read"), Type.Literal("write")]),
+  });
+
   const childShape = Type.Object({
     task: Type.String({ description: "The task for this sub-agent. It receives only this." }),
     agent: Type.Optional(Type.String({ description: describeAgent(spawnable()) })),
     tools: Type.Optional(Type.Array(Type.String(), { description: "Capabilities, when no 'agent' fits." })),
     model: Type.Optional(Type.String({ description: "Model as provider/id. Defaults to this session's." })),
+    correlation: Type.Optional(correlationShape),
+    workspace: Type.Optional(workspaceShape),
   });
 
   const delegateAllParams = Type.Object({
@@ -184,6 +223,8 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
             "Defaults to this session's model, already provider-qualified.",
         }),
       ),
+      correlation: Type.Optional(correlationShape),
+      workspace: Type.Optional(workspaceShape),
   });
 
   pi.registerTool({
@@ -201,7 +242,14 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       const progress = progressReporter(session, [params.agent ?? "delegate"], onUpdate as never);
       const outcome = await runOneDelegation(
         session,
-        { task: params.task, agent: params.agent, tools: params.tools, model: params.model },
+        {
+          task: params.task,
+          agent: params.agent,
+          tools: params.tools,
+          model: params.model,
+          correlation: params.correlation,
+          workspace: params.workspace,
+        },
         { parentId: session.ownSpawnId, childId: childSpawnId(session.ownSpawnId, 0) },
         // A single blocking delegation spends nothing from the subtree budget: cardinality is already
         // bounded to one by the call being blocking, which is the accident fan-out removes. Passing the
@@ -214,12 +262,15 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       progress.settle([outcome]);
 
       if (!outcome.ok) {
+        if (isCriticalAssuranceBlock(outcome)) throw new Error(outcome.text);
         // THROW, do not return. `AgentToolResult` has no `isError` field: pi sets it only when `execute`
         // throws (`pi-agent-core/dist/agent-loop.js` — a normal return is hardcoded `isError: false`).
         // Returning `isError: true` was silently discarded, so every refusal this package made was
         // recorded by pi as a SUCCESSFUL tool call. Found by the integration suite on its first run.
         const detail = outcome.text ? `\n\n${outcome.text}` : "";
-        throw new Error(`delegation refused: ${outcome.reason}${detail}`);
+        const message = `delegation refused: ${outcome.reason}${detail}`;
+        if (outcome.refusal) throw new GovernanceRefusal({ ...outcome.refusal, message });
+        throw new Error(message);
       }
 
       return {
@@ -261,7 +312,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       if (!split.ok) {
         // Thrown, not returned: a returned `isError` is discarded by pi, so a refusal that came back as a
         // normal result would read to the orchestrator as a successful fan-out of zero children.
-        throw new Error(`fan-out refused: ${split.reason}`);
+        throw new GovernanceRefusal(refusal("FANOUT_EXCEEDED", `fan-out refused: ${split.reason}`));
       }
 
       // ADR-0032: ONE status block covering every child. `onUpdate` replaces the tool's rendered result, so a
@@ -270,38 +321,44 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
 
       // Concurrent by construction. Each child gets its own budget share and its own ledger id, so the
       // records form a tree and two siblings can never be confused for one another.
+      // EVERY sibling's error, not just the first. `??=` discarded the rest with no log anywhere, and one
+      // of the discardable ones is `HerdrWriterCloseError`, whose entire meaning is "a pane may still be
+      // live and its writer lease is deliberately retained" — a resource-retention notice, not a per-child
+      // failure. Losing it meant nobody was told a lease is held with no owner until the process exits
+      // (R-116).
+      const infrastructureErrors: unknown[] = [];
       const outcomes = await Promise.all(
-        children.map((child, index) =>
-          runOneDelegation(
-            session,
-            child,
-            { parentId: session.ownSpawnId, childId: childSpawnId(session.ownSpawnId, index) },
-            split.perChild,
-            ctx,
-            signal,
-            { onProgress: progress.sink(index) },
-          ),
-        ),
+        children.map(async (child, index): Promise<DelegationOutcome> => {
+          try {
+            return await runOneDelegation(
+              session, child,
+              { parentId: session.ownSpawnId, childId: childSpawnId(session.ownSpawnId, index) },
+              split.perChild, ctx, signal, { onProgress: progress.sink(index) },
+            );
+          } catch (error) {
+            infrastructureErrors.push(error);
+            return childFailureOutcome(error, session.depth + 1);
+          }
+        }),
       );
       progress.settle(outcomes);
+      // The upstream controller's verdict outranks our own infrastructure noise — it is the answer the
+      // caller is waiting for, and ADR-0034 requires it to pass through unchanged. But an infrastructure
+      // failure must not VANISH behind it, which is what happened when a retained-lease error and a
+      // critical block landed in the same fan-out (R-117).
+      throwFanoutInfrastructure(outcomes, infrastructureErrors);
 
       const failed = outcomes.filter((o) => !o.ok);
       // Every child is reported, including the ones that failed. R-03's rule: a missing result must never
       // be indistinguishable from an empty one, and a fan-out that hid its refusals would let an
       // orchestrator summarise four reviews when only three happened.
-      const report = outcomes
-        .map((outcome, index) => {
-          const label = `### child ${index + 1}${children[index].agent ? ` (${children[index].agent})` : ""}`;
-          return outcome.ok
-            ? `${label} — completed\n\n${outcome.text || "(no output)"}`
-            : `${label} — FAILED: ${outcome.reason}${outcome.text ? `\n\n${outcome.text}` : ""}`;
-        })
-        .join("\n\n---\n\n");
+      const report = buildFanoutReport(outcomes, children);
 
       if (failed.length === children.length) {
         // All of them failed, so there is no partial result to hand back — and a tool that returns text
         // when nothing ran is exactly how a wrong summary gets written.
-        throw new Error(`fan-out failed: every child was refused or failed.\n\n${report}`);
+        const message = `fan-out failed: every child was refused or failed.\n\n${report}`;
+        throw totalFanoutFailure(failed, message);
       }
 
       return {
@@ -311,6 +368,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
           failed: failed.length,
           budgetPerChild: split.perChild,
           granted: outcomes.map((o) => o.granted),
+          refusals: outcomes.map((o) => o.refusal ?? null),
         },
       };
     },