Summary

Describe this PR in 2-5 bullets:

• Problem: Fresh /workflow run <name> ... commands could silently resume a prior failed run for the same workflow/conversation/codebase and execute the failed run's stale user_message instead of the new request.
• Why it matters: This caused silent intent loss in a P1 workflow path, where a user-visible fresh command could dispatch old work with no confirmation and no clean abandon path for failed runs.
• What changed: Added explicit dispatch intent for forced fresh runs and explicit resumes, gated failed resume candidates behind a 3-option prompt before hydration, preserved paused approval auto-resume, parsed /workflow run --force anywhere in args, and allowed failed runs to be abandoned to cancelled.
• What did not change (scope boundary): The existing findResumableRunByParentConversation lookup, hydrateResumableRun resume model, and WorkflowNotResumableError CAS guards remain the owner of the failed/paused -> running transition.

UX Journey

Before

User                         Archon                             Workflow engine
----                         ------                             ---------------
/workflow run fix A ----->   creates/dispatches workflow ---->  run fails

/workflow run fix B ----->   finds prior failed run
                             hydrates/resumes old row ------->  executes with old user_message A
User sees fresh command      no prompt shown                    stale intent runs

After

User                         Archon                             Workflow engine
----                         ------                             ---------------
/workflow run fix A ----->   creates/dispatches workflow ---->  run fails

/workflow run fix B ----->   finds prior failed run
                             [shows 3-option prompt]
                             returns without hydrate/execute
User chooses:
  /workflow resume <id> -->  [resumeRunId bypass] ----------->  hydrateResumableRun owns CAS resume
  /workflow abandon <id> ->  failed -> cancelled
  /workflow run fix B --force [skip lookup] ----------------->  starts fresh run with B

Architecture Diagram

Before

command-handler
  | CommandResult.workflow { definition, args }
  v
orchestrator-agent dispatchOrchestratorWorkflow
  | findResumableRunByParentConversation(failed|paused)
  | hydrateResumableRun(any candidate)
  v
workflows executor / dag executor
  | uses persisted workflowRun.user_message
  v
workflow db

workflow-operations abandonWorkflow
  | rejects all terminal statuses, including failed
  v
workflow db

After

command-handler [~]
  | CommandResult.workflow { definition, args, force, resumeRunId }
  v
orchestrator-agent dispatchOrchestratorWorkflow [~]
  | [force skips lookup]
  | findResumableRunByParentConversation(failed|paused)
  | [failed + no matching resumeRunId -> 3-option prompt, return]
  | hydrateResumableRun(paused or explicit resume)
  v
workflows executor / dag executor
  | unchanged CAS-owned resume and persisted run hydration
  v
workflow db

workflow-operations abandonWorkflow [~]
  | rejects completed/cancelled only; failed -> cancelled
  v
workflow db

Connection inventory (list every module-to-module edge, mark changes):

Label Snapshot

• Risk: risk: medium
• Size: size: M
• Scope: core|tests
• Module: core:orchestrator, core:command-handler, core:workflow-operations

Change Metadata

• Change type: bug
• Primary scope: core

Linked Issue

• Closes /workflow run silently auto-resumes failed runs with stale args, hijacking fresh requests #1549
• Related fix(workflow): prompt user on resume of failed run + allow abandoning failed + add --force flag #1551
• Depends on fix(core): concurrency-safe workflow resume/cancel (CAS guards) #1830
• Supersedes fix(workflow): prompt user on resume of failed run + allow abandoning failed + add --force flag #1551

Validation Evidence (required)

Commands and result summary:

bun run type-check
bun run lint
bun run format:check
bun run test
bun run validate

• Evidence provided (test/log/trace/screenshot): Run artifact validation reports type-check passed, lint passed with 0 warnings, format check passed, bun run test passed with 4834 passed / 0 failed, build passed, and bun run validate passed.
• If any command is intentionally skipped, explain why: None skipped. The validation artifact notes root bun test was not used as the authoritative command because this repo documents that root bun test causes Bun mock.module() pollution; bun run test is the supported isolated test entrypoint and passed.

Security Impact (required)

• New permissions/capabilities? (Yes/No) No
• New external network calls? (Yes/No) No
• Secrets/tokens handling changed? (Yes/No) No
• File system access scope changed? (Yes/No) No
• If any Yes, describe risk and mitigation: No security-sensitive behavior changes were introduced.

Compatibility / Migration

• Backward compatible? (Yes/No) Yes
• Config/env changes? (Yes/No) No
• Database migration needed? (Yes/No) No
• If yes, exact upgrade steps: No migration or operator action required.

Human Verification (required)

What was personally validated beyond CI:

• Verified scenarios: Fresh /workflow run with a prior failed run prompts and does not call executeWorkflow; --force bypasses the lookup and starts fresh; /workflow resume <id> dispatches with resumeRunId; natural-language approval resumes without prompting; paused auto-resume remains unchanged; failed abandon transitions to cancelled.
• Edge cases checked: --force can appear anywhere after the workflow name and is stripped from workflow args; completed and cancelled runs still cannot be abandoned; the failed-run prompt escapes backslash, double quote, and backtick in the suggested command and truncates the prior user message preview.
• What was not verified: No manual end-to-end UI screenshot was captured; coverage is through focused command/orchestrator/operation regression tests plus full repository validation.

Side Effects / Blast Radius (required)

• Affected subsystems/workflows: Core workflow command handling, orchestrator workflow dispatch, workflow abandon operation, and related tests.
• Potential unintended effects: Users with a failed run will now see a prompt instead of implicit failed-run resume when issuing a fresh /workflow run; automation that depended on implicit failed auto-resume should switch to /workflow resume <id>.
• Guardrails/monitoring for early detection: Regression tests assert no executeWorkflow call occurs on the prompt path and that explicit resume paths still hydrate through the existing CAS model.

Rollback Plan (required)

• Fast rollback command/path: Revert commit cde8b12b96b98b54d3a99de504898a8f801a2e50.
• Feature flags or config toggles (if any): None.
• Observable failure symptoms: /workflow run prompts unexpectedly for failed candidates, explicit /workflow resume <id> loops back to a prompt, natural-language approval fails to resume, or failed runs cannot be abandoned.

Risks and Mitigations

List real risks in this PR (or write None).

• Risk: Explicit resume and paused approval paths could be mistaken for fresh-run intent and prompt-loop.
  • Mitigation: resumeRunId bypasses the failed-run prompt, and tests cover /workflow resume <id> plus natural-language approval redispatch.
• Risk: The fix could accidentally bypass the existing CAS guard by pre-transitioning runs.
  • Mitigation: No pre-transition is added; hydration remains before execution and owns the CAS transition through the current WorkflowNotResumableError path.
• Risk: The new prompt could make stale failed runs harder to clear.
  • Mitigation: abandonWorkflow now accepts failed runs and transitions them to cancelled so the prompt can be cleared intentionally.