fix(workflows): publish dynamic nested descendants from isolated fan-out items

An isolated (concurrent, or nested-in-isolated) fan-out item published
back to the shared steps dict only the ids in its static id_map. Ids
generated at runtime by a nested while/do-while body or fan-out (e.g.
fan:inner:0:leaf:0) reached state.step_results but not the live
context.steps, so a later `steps.<id>` reference resolved to nothing on
a fresh concurrent run.

Publish every key the item added to or replaced in its private view,
excluding its bare-id aliases (still folded in item order by the
caller). The resume-path skip and run-lock behavior are unchanged.

Adds a container x concurrency x fresh/resume regression matrix.

Assisted-by: Claude Code (model: Claude Opus 5.5, autonomous)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Noor-ul-ain001

src/specify_cli/workflows/engine.py

@@ -1858,10 +1858,9 @@ def run_item(
             # the shared dict made after this item started, but fan-out
             # items were never entitled to see those anyway.
             original_steps = item_ctx.steps
+            snapshot_src = original_steps if base_steps is None else base_steps
             if local_only:
-                item_steps = dict(
-                    original_steps if base_steps is None else base_steps
-                )
+                item_steps = dict(snapshot_src)
             else:
                 item_steps = original_steps
             item_ctx.steps = item_steps
@@ -1914,18 +1913,27 @@ def run_item(
                             original_steps[orig] = val
             steps_view = item_steps if local_only else item_ctx.steps
             if local_only and original_steps is not state.step_results:
-                for new_id in id_map:
-                    if new_id in steps_view:
-                        # Publish the namespaced (disjoint, per-item) result
-                        # into the truly-shared steps dict explicitly — safe
-                        # even under concurrency since each item only ever
-                        # writes its own namespaced keys here. Skipped when
-                        # that dict IS ``state.step_results`` (a resume run —
-                        # see ``_record_result``): _record_result already
-                        # wrote every namespaced key there under the run
-                        # lock, and an unlocked write here could race another
-                        # worker's ``state.save()`` iterating it.
-                        original_steps[new_id] = steps_view[new_id]
+                # Publish every namespaced (disjoint, per-item) result this
+                # item recorded into the truly-shared steps dict explicitly —
+                # safe even under concurrency since each item only ever
+                # writes its own namespaced keys here. That is every key the
+                # item added to or replaced in its private view, minus its
+                # bare-id aliases (``alias_records``), which the caller
+                # publishes in item order instead. Diffing the view rather
+                # than walking ``id_map`` also catches ids a nested
+                # while/do-while body or fan-out generated dynamically at
+                # runtime, which the static ``id_map`` never contains.
+                # Skipped when that dict IS ``state.step_results`` (a resume
+                # run — see ``_record_result``): _record_result already wrote
+                # every namespaced key there under the run lock, and an
+                # unlocked write here could race another worker's
+                # ``state.save()`` iterating it.
+                for key, val in steps_view.items():
+                    if key in alias_records:
+                        continue
+                    if snapshot_src.get(key, _MISSING_STEP) is val:
+                        continue
+                    original_steps[key] = val
             # Read back through the local view, not the outer closure —
             # clearer and robust if StepContext copying ever stops sharing
             # the steps dict by reference.

tests/test_workflows.py

@@ -7948,6 +7948,117 @@ def test_fan_out_reserved_id_collision_end_to_end_on_resume(
             )
         assert state.step_results["after"]["output"]["stdout"].strip() == "outside"
 
+    @pytest.mark.parametrize("resume", [False, True], ids=["fresh", "resume"])
+    @pytest.mark.parametrize("max_concurrency", [1, 2])
+    @pytest.mark.parametrize("container", ["fan-out", "while", "do-while"])
+    def test_nested_dynamic_descendants_visible_downstream(
+        self, project_dir, container, max_concurrency, resume
+    ):
+        """Every namespaced result an outer fan-out item produces must reach
+        the live `context.steps`, including ids a nested while/do-while
+        body or fan-out generates dynamically at runtime.
+
+        A concurrent item publishes its private steps view back to the
+        shared dict after it finishes. That publish used to walk only the
+        item's static `id_map`, which never contains a nested container's
+        runtime-generated ids (`fan:inner:<i>:leaf:0`). Those results
+        still reached `state.step_results`, but a later `steps.<id>`
+        reference resolved to nothing on a fresh concurrent run.
+        """
+        from unittest.mock import patch
+
+        from specify_cli.workflows.base import RunStatus, StepResult
+        from specify_cli.workflows.engine import WorkflowDefinition, WorkflowEngine
+
+        inner = {
+            "fan-out": """\
+      id: inner
+      type: fan-out
+      items: "{{ ['x'] }}"
+      max_concurrency: 1
+      step:
+        id: leaf
+        type: shell
+        run: "echo {{ item }}-{{ item }}"
+""",
+            "while": """\
+      id: inner
+      type: while
+      condition: "true"
+      max_iterations: 1
+      steps:
+        - id: leaf
+          type: shell
+          run: "echo x-x"
+""",
+            "do-while": """\
+      id: inner
+      type: do-while
+      condition: "false"
+      steps:
+        - id: leaf
+          type: shell
+          run: "echo x-x"
+""",
+        }[container]
+        gate = (
+            """\
+  - id: approve
+    type: gate
+    message: "Approve?"
+"""
+            if resume
+            else ""
+        )
+        yaml_str = (
+            """
+schema_version: "1.0"
+workflow:
+  id: "fan-out-nested-dynamic-visibility"
+  name: "Fan Out Nested Dynamic Visibility"
+  version: "1.0.0"
+steps:
+"""
+            + gate
+            + f"""\
+  - id: fan
+    type: fan-out
+    items: "{{{{ ['a', 'b'] }}}}"
+    max_concurrency: {max_concurrency}
+    step:
+"""
+            + inner
+            + "".join(
+                f"""\
+  - id: after{idx}
+    type: shell
+    run: "echo {{{{ steps.fan:inner:{idx}:leaf:0.output.stdout | default('MISSING') }}}}"
+"""
+                for idx in range(2)
+            )
+        )
+        definition = WorkflowDefinition.from_string(yaml_str)
+        engine = WorkflowEngine(project_dir)
+        state = engine.execute(definition)
+        if resume:
+            assert state.status == RunStatus.PAUSED
+            with patch(
+                "specify_cli.workflows.step.gate.GateStep.execute",
+                return_value=StepResult(output={"approved": True}),
+            ):
+                state = engine.resume(state.run_id)
+
+        assert state.status == RunStatus.COMPLETED
+        for idx in range(2):
+            assert (
+                state.step_results[f"fan:inner:{idx}:leaf:0"]["output"]["stdout"]
+                == "x-x\n"
+            )
+            assert (
+                state.step_results[f"after{idx}"]["output"]["stdout"].strip()
+                == "x-x"
+            )
+
     def test_concurrent_fan_out_items_copy_fixed_pre_fan_out_snapshot(
         self, tmp_path
     ):