- delete_work_item descendant cascade now goes through transition_work_item
(audit reason, attempt-ledger settlement, phase hooks) instead of raw
store phase writes plus manual task.status mutation; task-owned audit
stamps and execution-lock release only happen when a cancellation
actually occurred, removing a desync path (task=CANCELLED under
work_item=APPROVED) in drift scenarios.
- transition_work_item gains blocked_reason/handoff_status passthrough so
callers no longer need a second store write for the same transition.
- new build_company_resume_identity_restore helper in metadata_ownership
replaces the ad-hoc delegation_seat_id/role/session literals in
engine._restore_and_pin_company_resume_execution_identity, keeping seat
identity writes inside the ownership contract module.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Work items whose execution kept dying without a durable verdict (crash
mid-dispatch, kill -9, cancel-before-harvest) were re-dispatched forever:
every exit path was responsible for remembering to write a terminal
phase, and any path that forgot left the card RUNNING and eligible again.
Replace that with structural accounting:
- claim CAS opens an attempt in the same UPDATE (attempt_seq+1,
attempt_settled=false) so no dispatch can start unaccounted (store.py)
- transition_work_item becomes the settlement authority: every
non-RUNNING transition settles the open attempt in the same write;
crashed/interrupted outcomes accumulate streaks, clean outcomes reset
them; claim release folds into the same write; settlement still lands
when the phase write loses a race (work_item_transition.py)
- dispatcher refuses cards over the streak limits (crash>=3,
interrupted>=5) in both is_dispatchable and _work_item_is_runnable,
and a per-tick reconcile pass back-fills dead attempts as interrupted
and terminalizes over-limit cards to FAILED with a visible
blocked_reason (dispatch_hold quarantine if even that write fails)
(phase.py, company_mode.py)
- crash exits now settle: cancellation unwind harvests coroutines that
died on a real exception before discarding them, the crashed-item
handler releases the claim and settles as crashed with a quarantine
fallback, and the timeout path settles as crashed (company_mode.py)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
LZH-YS1998