Reconcile the approvals of a run at a boundary the object reached on its
own, with no host request to reconcile them (docs/do-runner-design.md,
"Approvals the run object files"). Called under the object's operation
lock with an authoritative summary: from its alarm, and from the resume
route when the runtime refuses a resume because its step moved to
another suspension. Steps listed in
summary.suspensionTimers are timers the object resumes itself and must
get no approval; reconcileApprovalsForSummary skips them.
After a suspension-deadline resume it is called whatever the run did next,
so summary need not be suspended, and ended names the suspension that
resume ended, which nothing can decide any more. An implementation
honours ended by superseding each open record whose step, suspendedAt
and resumeCount equal it exactly, counting a record's absent
resumeCount as 0, and by leaving every other record alone while the run
is suspended. createFlowsafeRunnerLifecycle() does, and once summary
is terminal it supersedes every open record of the run. An implementation
that ignores ended leaves such a record open.
Best effort, one attempt: a failure is logged and never retried, and a
host read with approval reconciliation files what it missed, so it must be
idempotent beside that read. A failed read or hook, an eviction between the
resume and this call, a resume that throws after its result was saved (the
later wake names no ended suspension), or a host status read that files
from a summary taken before the resume leaves the ended suspension's
record open, and the SLA sweep escalates it.
Reconcile the approvals of a run at a boundary the object reached on its own, with no host request to reconcile them (docs/do-runner-design.md, "Approvals the run object files"). Called under the object's operation lock with an authoritative summary: from its alarm, and from the resume route when the runtime refuses a resume because its step moved to another suspension. Steps listed in
summary.suspensionTimersare timers the object resumes itself and must get no approval;reconcileApprovalsForSummaryskips them.After a suspension-deadline resume it is called whatever the run did next, so
summaryneed not be suspended, andendednames the suspension that resume ended, which nothing can decide any more. An implementation honoursendedby superseding each open record whose step,suspendedAtandresumeCountequal it exactly, counting a record's absentresumeCountas 0, and by leaving every other record alone while the run is suspended.createFlowsafeRunnerLifecycle()does, and oncesummaryis terminal it supersedes every open record of the run. An implementation that ignoresendedleaves such a record open.Best effort, one attempt: a failure is logged and never retried, and a host read with approval reconciliation files what it missed, so it must be idempotent beside that read. A failed read or hook, an eviction between the resume and this call, a resume that throws after its result was saved (the later wake names no ended suspension), or a host status read that files from a summary taken before the resume leaves the ended suspension's record open, and the SLA sweep escalates it.