@abelxiaoxing/cadence 1.8.3 → 2.0.0

package/src/workflow-state-machine.ts

@@ -1,4355 +0,0 @@
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { DatabaseSync } from "node:sqlite";
-import type { WorkflowActivityUpdate } from "./activity-contracts.ts";
-import {
-  assertPlanWithinChangeContract,
-  normalizeChangeContract,
-  retainedChangeContract,
-} from "./change-contract.ts";
-import { LIMITS, verificationInputPaths } from "./contracts.ts";
-import {
-  assertControlCommand,
-  type ControlCommand,
-  type ControlStage,
-} from "./control-contracts.ts";
-import {
-  compileImplementPlan,
-  DeliveryValidationError,
-  type ImplementPlan,
-  type PlanTaskDraft,
-} from "./delivery-compiler.ts";
-import { compareDeliveryRevision } from "./delivery-revision.ts";
-import { snapshotFiles } from "./file-snapshot.ts";
-import type { RoutePolicy } from "./route-policy.ts";
-import {
-  canonicalJson,
-  type RunProjection,
-  type RunState,
-} from "./run-state.ts";
-import { type OperationLease, RunStore } from "./run-store.ts";
-import { isSafeRegularFile } from "./safe-path.ts";
-import { configureSqlite, ensureSqliteSchema } from "./sqlite-schema.ts";
-import type { ResolvedStateRoot } from "./state-root.ts";
-import {
-  AMENDMENT_SCHEMA,
-  ENGINE_ADDITIONS,
-  ENGINE_SCHEMA,
-  RECOVERY_ADDITIONS,
-  RECOVERY_GRANT_SCHEMA,
-  RECOVERY_SCHEMA,
-  REJECTED_DELIVERY_SCHEMA,
-} from "./storage-schema.ts";
-import { permitsContextRead } from "./submit-tool.ts";
-import {
-  type ActiveOperation,
-  assertDelivery,
-  type BootstrapRow,
-  baselineRecoveryKey,
-  bootstrapAcceptanceHash,
-  CHANGE_NAME,
-  cancellableRead,
-  classifyPersistedContextRequest,
-  decideRecoveryAction,
-  type EngineOperationRow,
-  type EngineRunRow,
-  type EngineTaskRow,
-  emitWorkflowActivity,
-  expectedClassification,
-  type HeldOperationLease,
-  hash,
-  IDENTIFIER,
-  isCancellationException,
-  isRecord,
-  isWorkflowApprovalCode,
-  normalizeBootstrapAcceptanceFacts,
-  normalizeVerificationPrerequisite,
-  normalizeWorkflowContextRequest,
-  normalizeWorkflowVerificationStatus,
-  parseJsonRecord,
-  parsePlan,
-  phases,
-  recoveryKey,
-  type SafeAttemptDiagnostic,
-  SHA256,
-  type WorkflowApplication,
-  type WorkflowApplicationContext,
-  type WorkflowAttemptOutcome,
-  type WorkflowAvailableDelivery,
-  type WorkflowChangeVerifier,
-  type WorkflowContextRequest,
-  type WorkflowDelivery,
-  type WorkflowDeliverySource,
-  type WorkflowEngineOptions,
-  type WorkflowRecoveryFact,
-  type WorkflowRunLifecycle,
-  type WorkflowVerificationStatus,
-  type WorkflowWorker,
-} from "./workflow-policy.ts";
-import {
-  assessRecoveryGrant,
-  recoveryExhausted,
-} from "./workflow-recovery-policy.ts";
-import { selectRunnableTasks } from "./workflow-scheduling.ts";
-import {
-  firstPausedTask,
-  projectWorkflowStatus,
-  type WorkflowResourceBudget,
-} from "./workflow-status.ts";
-export class WorkflowEngine {
-  readonly #consumerRoot: string;
-  readonly #stateRoot: ResolvedStateRoot;
-  readonly #runStore: RunStore;
-  readonly #database: DatabaseSync;
-  readonly #deliverySource: WorkflowDeliverySource;
-  readonly #worker: WorkflowWorker;
-  readonly #changeVerifier: WorkflowChangeVerifier;
-  readonly #application?: WorkflowApplication;
-  readonly #lifecycle?: WorkflowRunLifecycle;
-  readonly #now: () => number;
-  readonly #leaseTtlMs: number;
-  readonly #workHardLimit: number;
-  #activeTasks = 0;
-  readonly #capacityWaiters = new Set<() => void>();
-  readonly #active = new Map<string, ActiveOperation>();
-  readonly #operationLeases = new Map<string, HeldOperationLease>();
-  #orphanRecoveryTimer?: ReturnType<typeof setTimeout>;
-  readonly #commands = new Map<
-    AbortController,
-    { command: ControlCommand; settled: Promise<Record<string, unknown>> }
-  >();
-  #closing?: Promise<void>;
-  readonly #amendments = new Map<string, Promise<Record<string, unknown>>>();
-  #closed = false;
-
-  private constructor(options: WorkflowEngineOptions) {
-    this.#consumerRoot = path.resolve(options.consumerRoot);
-    this.#stateRoot = options.stateRoot;
-    this.#deliverySource = options.deliverySource;
-    this.#worker = options.worker;
-    this.#changeVerifier = options.changeVerifier;
-    this.#application = options.application;
-    this.#lifecycle = options.lifecycle;
-    this.#now = options.now ?? Date.now;
-    this.#leaseTtlMs = options.leaseTtlMs ?? 60_000;
-    this.#workHardLimit = options.workHardLimit ?? 512;
-    if (!Number.isSafeInteger(this.#workHardLimit) || this.#workHardLimit < 1)
-      throw new Error("workflow-work-limit-invalid");
-    this.#runStore = RunStore.open(options.stateRoot, { now: this.#now });
-    this.#database = new DatabaseSync(options.stateRoot.databasePath);
-    try {
-      configureSqlite(this.#database);
-      ensureSqliteSchema(this.#database, ENGINE_SCHEMA, ENGINE_ADDITIONS);
-      ensureSqliteSchema(this.#database, RECOVERY_SCHEMA, RECOVERY_ADDITIONS);
-      ensureSqliteSchema(this.#database, RECOVERY_GRANT_SCHEMA);
-      ensureSqliteSchema(this.#database, AMENDMENT_SCHEMA);
-      ensureSqliteSchema(this.#database, REJECTED_DELIVERY_SCHEMA);
-    } catch (error) {
-      this.#database.close();
-      this.#runStore.close();
-      throw error;
-    }
-    this.#transaction(() => {
-      const budgets = this.#database
-        .prepare(
-          "SELECT run_id FROM workflow_work_budget WHERE recovery_policy = 0",
-        )
-        .all() as { run_id: string }[];
-      for (const { run_id } of budgets) {
-        const plans = this.#database
-          .prepare(
-            "SELECT plan_json FROM workflow_engine_deliveries WHERE run_id = ?",
-          )
-          .all(run_id) as { plan_json: string }[];
-        const high = Math.max(
-          0,
-          ...plans.map((row) => this.#phaseCount(JSON.parse(row.plan_json))),
-        );
-        this.#database
-          .prepare(
-            "UPDATE workflow_work_budget SET phase_high_water = ?, hard_limit = MAX(hard_limit, max_work, used), recovery_policy = 1 WHERE run_id = ?",
-          )
-          .run(high, run_id);
-      }
-    });
-    this.#recoverInterruptedOperations();
-    this.#recoverTerminalCleanup();
-  }
-
-  static open(options: WorkflowEngineOptions): WorkflowEngine {
-    if (
-      path.resolve(options.consumerRoot) !== options.stateRoot.consumerRoot ||
-      options.stateRoot.consumerRootHash.length !== 64
-    ) {
-      throw new Error("workflow-engine-root-mismatch");
-    }
-    if (
-      !options.deliverySource ||
-      typeof options.deliverySource.load !== "function" ||
-      !options.worker ||
-      typeof options.worker.runAttempt !== "function" ||
-      typeof options.worker.rebind !== "function" ||
-      !options.changeVerifier ||
-      typeof options.changeVerifier.verify !== "function" ||
-      (options.application !== undefined &&
-        (typeof options.application.prepare === "function") !==
-          (typeof options.application.applyPrepared === "function"))
-    ) {
-      throw new Error("workflow-engine-service-invalid");
-    }
-    if (
-      options.leaseTtlMs !== undefined &&
-      (!Number.isSafeInteger(options.leaseTtlMs) || options.leaseTtlMs < 1)
-    ) {
-      throw new Error("workflow-engine-lease-invalid");
-    }
-    return new WorkflowEngine(options);
-  }
-
-  updateRoutePolicy(policy: RoutePolicy): void {
-    this.#assertOpen();
-    if (!this.#worker.updateRoutePolicy) {
-      throw new Error("route-policy-update-unavailable");
-    }
-    this.#worker.updateRoutePolicy(policy);
-  }
-
-  routePolicyStatus(): Record<string, unknown> | undefined {
-    this.#assertOpen();
-    return this.#worker.routePolicyStatus?.();
-  }
-
-  #assertOpen(): void {
-    if (this.#closed) throw new Error("workflow-engine-closed");
-  }
-
-  #transaction<T>(work: () => T): T {
-    this.#database.exec("BEGIN IMMEDIATE");
-    try {
-      const result = work();
-      this.#database.exec("COMMIT");
-      return result;
-    } catch (error) {
-      this.#database.exec("ROLLBACK");
-      throw error;
-    }
-  }
-
-  #operationKey(runId: string, operationId: string): string {
-    return `${runId}\0${operationId}`;
-  }
-
-  #leaseOperationId(runId: string, _operationId: string): string {
-    return `engine-run-${hash(runId).slice(0, 40)}`;
-  }
-
-  #holdOperationLease(lease: OperationLease, commandOperationId: string): void {
-    const key = this.#operationKey(lease.runId, commandOperationId);
-    const existing = this.#operationLeases.get(key);
-    if (existing) clearInterval(existing.timer);
-    const intervalMs = Math.max(1, Math.floor(this.#leaseTtlMs / 3));
-    const held: HeldOperationLease = {
-      lease,
-      timer: setInterval(() => {
-        if (this.#operationLeases.get(key) !== held) return;
-        try {
-          held.lease = this.#runStore.renewLease(held.lease, this.#leaseTtlMs);
-          this.#database
-            .prepare(
-              `UPDATE workflow_engine_operations
-               SET lease_expires_at = ?
-               WHERE run_id = ? AND operation_id = ? AND state = 'running'
-                 AND lease_token = ?`,
-            )
-            .run(
-              held.lease.expiresAt,
-              lease.runId,
-              commandOperationId,
-              lease.token,
-            );
-        } catch {
-          held.error = new Error("lease-fenced");
-          clearInterval(held.timer);
-          const active = this.#active.get(lease.runId);
-          if (active?.operationId === commandOperationId) {
-            active.controller.abort(held.error);
-          }
-        }
-      }, intervalMs),
-    };
-    held.timer.unref?.();
-    this.#operationLeases.set(key, held);
-  }
-
-  #operationLease(runId: string, operationId: string): OperationLease {
-    const held = this.#operationLeases.get(
-      this.#operationKey(runId, operationId),
-    );
-    if (!held || held.error) throw held?.error ?? new Error("lease-fenced");
-    this.#runStore.assertLease(held.lease);
-    return held.lease;
-  }
-
-  #releaseOperationLease(runId: string, operationId: string): void {
-    const key = this.#operationKey(runId, operationId);
-    const held = this.#operationLeases.get(key);
-    if (!held) return;
-    clearInterval(held.timer);
-    this.#operationLeases.delete(key);
-  }
-
-  #assertLeaseInTransaction(lease: OperationLease): void {
-    const row = this.#database
-      .prepare(
-        `SELECT state, lease_token, lease_expires_at
-         FROM operations WHERE run_id = ? AND operation_id = ?`,
-      )
-      .get(lease.runId, lease.operationId) as
-      | {
-          state: string;
-          lease_token: string | null;
-          lease_expires_at: number | null;
-        }
-      | undefined;
-    if (
-      row?.state !== "running" ||
-      row.lease_token !== lease.token ||
-      row.lease_expires_at === null ||
-      row.lease_expires_at < this.#now()
-    ) {
-      throw new Error("lease-fenced");
-    }
-  }
-
-  #leasedTransaction<T>(lease: OperationLease, work: () => T): T {
-    return this.#transaction(() => {
-      this.#assertLeaseInTransaction(lease);
-      return work();
-    });
-  }
-
-  amend(
-    change: string,
-    batchId: string,
-    request: unknown,
-    execute: (assertAuthority: () => void) => Promise<Record<string, unknown>>,
-  ): Promise<Record<string, unknown>> {
-    this.#assertOpen();
-    if (this.#closing) throw new Error("workflow-engine-closed");
-    const runId = this.#lookupRun("abel-implement", change);
-    if (!runId) throw new Error("run-not-found");
-    if (this.#amendments.has(runId)) throw new Error("amendment-busy");
-    const operationId = `amend-${hash(batchId, canonicalJson(request)).slice(0, 48)}`;
-    const pending = Promise.resolve()
-      .then(async () => {
-        const replay = this.#beginOperation(runId, operationId, "amend");
-        if (replay) return replay;
-        const lease = this.#operationLease(runId, operationId);
-        const assertAuthority = () => {
-          this.#assertOpen();
-          if (this.#closing) throw new Error("workflow-engine-closed");
-          this.#runStore.assertLease(lease);
-          const status = this.#statusByRun(runId);
-          if (
-            !["approval-needed", "paused"].includes(String(status.state)) ||
-            (status.decisionBatch as { id?: string } | undefined)?.id !==
-              batchId
-          )
-            throw new Error("amendment-batch-stale");
-        };
-        try {
-          assertAuthority();
-          if (
-            !isRecord(request) ||
-            !["status", "validate-plan-draft"].includes(
-              String(request.operation),
-            )
-          ) {
-            this.#leasedTransaction(lease, () => {
-              this.#database
-                .prepare(
-                  "INSERT INTO workflow_amendment_budget(run_id, used) VALUES (?, 0) ON CONFLICT DO NOTHING",
-                )
-                .run(runId);
-              const reserved = this.#database
-                .prepare(
-                  "UPDATE workflow_amendment_budget SET used = used + 1 WHERE run_id = ? AND used < 64",
-                )
-                .run(runId);
-              if (reserved.changes !== 1)
-                throw new Error("amendment-budget-exhausted");
-            });
-          }
-          this.#assertAmendmentContract(runId, change, request);
-          const outcome = await execute(assertAuthority);
-          assertAuthority();
-          return this.#commitOperation(runId, operationId, outcome);
-        } catch (error) {
-          this.#interruptOperation(runId, operationId);
-          throw error;
-        }
-      })
-      .finally(() => {
-        if (this.#amendments.get(runId) === pending)
-          this.#amendments.delete(runId);
-      });
-    this.#amendments.set(runId, pending);
-    return pending;
-  }
-
-  #assertAmendmentContract(
-    runId: string,
-    change: string,
-    request: unknown,
-  ): void {
-    if (!isRecord(request)) throw new Error("amendment-contract-invalid");
-    if (
-      (request.operation === "approve-gate" && request.gate === "gate-a") ||
-      (request.operation === "record-decision" &&
-        request.category === "behavior")
-    )
-      throw new Error("amendment-changes-accepted-behavior");
-    if (
-      ![
-        "write-artifact",
-        "delete-artifact",
-        "compile-plan",
-        "validate-plan-draft",
-        "finalize-delivery",
-      ].includes(String(request.operation))
-    )
-      return;
-    const relative = String(request.path);
-    if (relative === "proposal.md" || relative.startsWith("specs/")) {
-      const file = `openspec/changes/${change}/${relative}`;
-      if (
-        request.operation !== "write-artifact" ||
-        !isSafeRegularFile(this.#consumerRoot, file) ||
-        readFileSync(path.join(this.#consumerRoot, file), "utf8") !==
-          request.content
-      )
-        throw new Error("amendment-changes-accepted-behavior");
-    }
-    const compile = [
-      "compile-plan",
-      "validate-plan-draft",
-      "finalize-delivery",
-    ].includes(String(request.operation));
-    if (!compile) return;
-    const draftPath = `openspec/changes/${change}/plan-draft.json`;
-    if (!isSafeRegularFile(this.#consumerRoot, draftPath)) return;
-    const run = this.#engineRun(runId);
-    if (run.current_revision === null) return;
-    const prior = this.#planForRevision(runId, run.current_revision);
-    const contract = retainedChangeContract(prior);
-    const draft = JSON.parse(
-      readFileSync(path.join(this.#consumerRoot, draftPath), "utf8"),
-    );
-    if (
-      draft.changeContract !== undefined &&
-      canonicalJson(normalizeChangeContract(draft.changeContract)) !==
-        canonicalJson(contract)
-    )
-      throw new Error("change-contract-mismatch");
-    // Match DesignController's inheritance before validating authorized modes.
-    if (draft.changeContract === undefined && prior.changeContract)
-      draft.changeContract = contract;
-    const next = compileImplementPlan(draft, {
-      consumerRoot: this.#consumerRoot,
-      bindExecutionInputs: true,
-    }).plan;
-    assertPlanWithinChangeContract(contract, next.tasks, [
-      next.verification.change.fullSuite,
-      next.verification.change.postApply,
-    ]);
-  }
-
-  #lookupRun(stage: ControlStage, change: string): string | undefined {
-    return (
-      this.#database
-        .prepare(
-          `SELECT run_id FROM runs
-           WHERE root_hash = ? AND stage = ? AND lookup_key = ?`,
-        )
-        .get(this.#stateRoot.consumerRootHash, stage, `change:${change}`) as
-        | { run_id: string }
-        | undefined
-    )?.run_id;
-  }
-
-  #ensureEngineRun(runId: string): void {
-    this.#database
-      .prepare(
-        `INSERT INTO workflow_engine_runs(
-           run_id, current_revision, baseline_workspace_revision,
-           current_workspace_revision, cleanup_state, next_queue_position
-         ) VALUES (?, NULL, NULL, NULL, 'none', 1)
-         ON CONFLICT(run_id) DO NOTHING`,
-      )
-      .run(runId);
-  }
-
-  #engineRun(runId: string): EngineRunRow {
-    const row = this.#database
-      .prepare(
-        `SELECT current_revision, baseline_workspace_revision,
-                current_workspace_revision, cleanup_state, route_id,
-                route_fingerprint,
-                transaction_id, verification_json, delivery_diagnostics_json,
-                next_queue_position
-         FROM workflow_engine_runs WHERE run_id = ?`,
-      )
-      .get(runId) as EngineRunRow | undefined;
-    if (!row) throw new Error("workflow-engine-run-unavailable");
-    return row;
-  }
-
-  #operation(
-    runId: string,
-    operationId: string,
-  ): EngineOperationRow | undefined {
-    return this.#database
-      .prepare(
-        `SELECT command, state, outcome_json FROM workflow_engine_operations
-         WHERE run_id = ? AND operation_id = ?`,
-      )
-      .get(runId, operationId) as EngineOperationRow | undefined;
-  }
-
-  #operationReplay(
-    runId: string,
-    operationId: string,
-    command: string,
-  ): Record<string, unknown> | undefined {
-    const row = this.#operation(runId, operationId);
-    if (row && row.command !== command) {
-      throw new Error("operation-command-mismatch");
-    }
-    return row?.state === "committed" && row.outcome_json
-      ? parseJsonRecord(row.outcome_json)
-      : undefined;
-  }
-
-  #beginOperation(
-    runId: string,
-    operationId: string,
-    command: string,
-  ): Record<string, unknown> | undefined {
-    if (!IDENTIFIER.test(operationId)) throw new Error("invalid-operation-id");
-    const replay = this.#operationReplay(runId, operationId, command);
-    if (replay) return replay;
-    const existing = this.#operation(runId, operationId);
-    if (existing?.state === "running") {
-      const leaseStatus = this.#runStore.inspectOperation(
-        runId,
-        this.#leaseOperationId(runId, operationId),
-      );
-      if (leaseStatus?.state === "committed" && leaseStatus.outcome) {
-        this.#database
-          .prepare(
-            `UPDATE workflow_engine_operations
-             SET state = 'committed', lease_token = NULL,
-                 lease_expires_at = NULL, outcome_json = ?
-             WHERE run_id = ? AND operation_id = ?`,
-          )
-          .run(JSON.stringify(leaseStatus.outcome), runId, operationId);
-        return structuredClone(leaseStatus.outcome);
-      }
-      if (leaseStatus?.state === "running") {
-        throw new Error("operation-already-running");
-      }
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_operations
-           SET state = 'interrupted', lease_token = NULL,
-               lease_expires_at = NULL
-           WHERE run_id = ? AND operation_id = ? AND state = 'running'`,
-        )
-        .run(runId, operationId);
-    }
-    const leaseOperationId = this.#leaseOperationId(runId, operationId);
-    const priorLease = this.#runStore.inspectOperation(runId, leaseOperationId);
-    const preempt = command === "cancel" || command === "discard";
-    if (priorLease?.state === "running" && !preempt) {
-      throw new Error("operation-already-running");
-    }
-    const lease = this.#runStore.acquireLease({
-      runId,
-      operationId: leaseOperationId,
-      ttlMs: this.#leaseTtlMs,
-      exclusive: true,
-      ...(preempt ? { preempt: true } : {}),
-    });
-    if (preempt) {
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_operations
-           SET state = 'interrupted', lease_token = NULL,
-               lease_expires_at = NULL
-           WHERE run_id = ? AND operation_id <> ? AND state = 'running'`,
-        )
-        .run(runId, operationId);
-    }
-    this.#database
-      .prepare(
-        `INSERT INTO workflow_engine_operations(
-           run_id, operation_id, command, state, lease_token,
-           lease_expires_at, outcome_json
-         ) VALUES (?, ?, ?, 'running', ?, ?, NULL)
-         ON CONFLICT(run_id, operation_id) DO UPDATE SET
-           command = excluded.command, state = 'running',
-           lease_token = excluded.lease_token,
-           lease_expires_at = excluded.lease_expires_at,
-           outcome_json = NULL`,
-      )
-      .run(runId, operationId, command, lease.token, lease.expiresAt);
-    this.#holdOperationLease(lease, operationId);
-    return undefined;
-  }
-
-  #commitOperation(
-    runId: string,
-    operationId: string,
-    outcome: Record<string, unknown>,
-  ): Record<string, unknown> {
-    const lease = this.#operationLease(runId, operationId);
-    try {
-      const committed = this.#runStore.commitLease(lease, outcome);
-      const result = this.#database
-        .prepare(
-          `UPDATE workflow_engine_operations
-           SET state = 'committed', lease_token = NULL,
-               lease_expires_at = NULL, outcome_json = ?
-           WHERE run_id = ? AND operation_id = ? AND state = 'running'
-             AND lease_token = ?`,
-        )
-        .run(JSON.stringify(committed), runId, operationId, lease.token);
-      if (Number(result.changes) !== 1) {
-        throw new Error("operation-journal-fenced");
-      }
-      return structuredClone(committed);
-    } finally {
-      this.#releaseOperationLease(runId, operationId);
-    }
-  }
-
-  #interruptOperation(runId: string, operationId: string): void {
-    let lease: OperationLease;
-    try {
-      lease = this.#operationLease(runId, operationId);
-      if (this.#operation(runId, operationId)?.command !== "amend")
-        this.#pauseInterruptedRun(runId, operationId, lease);
-      this.#runStore.interruptLease(lease);
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_operations
-           SET state = 'interrupted', lease_token = NULL,
-               lease_expires_at = NULL
-           WHERE run_id = ? AND operation_id = ? AND state = 'running'
-             AND lease_token = ?`,
-        )
-        .run(runId, operationId, lease.token);
-    } catch (error) {
-      if (!(error instanceof Error) || error.message !== "lease-fenced") {
-        throw error;
-      }
-    } finally {
-      this.#releaseOperationLease(runId, operationId);
-    }
-  }
-
-  #transition(
-    runId: string,
-    to: RunState,
-    identity: string,
-    code?: string,
-    lease?: OperationLease,
-  ): RunProjection {
-    if (lease) this.#runStore.assertLease(lease);
-    const current = this.#runStore.status(runId);
-    if (
-      current.state === to &&
-      (to !== "paused" || code === undefined || current.pauseCode === code)
-    ) {
-      return current;
-    }
-    return this.#runStore.transition({
-      runId,
-      to,
-      operationId: `eng-${hash(runId, identity, String(current.sequence), to).slice(0, 40)}`,
-      ...(code ? { code } : {}),
-      ...(lease ? { lease } : {}),
-    });
-  }
-
-  #pauseInterruptedRun(
-    runId: string,
-    operationId: string,
-    lease: OperationLease,
-  ): void {
-    const projection = this.#runStore.status(runId);
-    if (["completed", "discarded", "rejected"].includes(projection.state))
-      return;
-    const write = (database: DatabaseSync) => {
-      database
-        .prepare(`UPDATE workflow_engine_tasks
-        SET state = 'paused',
-            pause_code = CASE WHEN pause_code = 'red-artifact-constraint'
-              THEN pause_code ELSE 'operation-interrupted' END,
-            context_request_json = CASE WHEN pause_code = 'red-artifact-constraint'
-              THEN context_request_json ELSE NULL END,
-            queue_position = NULL
-        WHERE run_id = ? AND state IN ('phase-running', 'validating')`)
-        .run(runId);
-    };
-    const active = [
-      "created",
-      "validating-delivery",
-      "ready",
-      "queued",
-      "connecting",
-      "running",
-      "validating",
-      "verifying",
-      "retryable",
-      "approval-needed",
-      "change-verifying",
-      "ready-to-apply",
-    ];
-    const to =
-      projection.state === "applying"
-        ? "recovering"
-        : active.includes(projection.state)
-          ? "paused"
-          : undefined;
-    if (to) {
-      // Keep task and run projections atomic; retained evidence and budgets are
-      // deliberately untouched. The original exception still reaches the caller.
-      this.#runStore.transitionAtomically(
-        {
-          runId,
-          to,
-          lease,
-          code: "operation-interrupted",
-          operationId: `eng-${hash(runId, operationId, String(projection.sequence), "interrupted").slice(0, 40)}`,
-        },
-        write,
-      );
-    } else {
-      this.#leasedTransaction(lease, () => write(this.#database));
-    }
-  }
-
-  #recoverInterruptedOperations(): void {
-    if (this.#orphanRecoveryTimer) {
-      clearTimeout(this.#orphanRecoveryTimer);
-      this.#orphanRecoveryTimer = undefined;
-    }
-    let nextExpiry: number | undefined;
-    const interrupted = this.#database
-      .prepare(
-        `SELECT run_id, operation_id FROM workflow_engine_operations
-         WHERE state = 'running' OR (state = 'interrupted' AND command <> 'amend'
-           AND (run_id IN (SELECT run_id FROM workflow_engine_tasks
-             WHERE state IN ('phase-running', 'validating'))
-             OR run_id IN (SELECT run_id FROM runs WHERE state IN
-               ('running', 'validating', 'verifying', 'change-verifying', 'applying'))))`,
-      )
-      .all() as unknown as Array<{ run_id: string; operation_id: string }>;
-    for (const row of interrupted) {
-      const leaseStatus = this.#runStore.inspectOperation(
-        row.run_id,
-        this.#leaseOperationId(row.run_id, row.operation_id),
-      );
-      if (leaseStatus?.state === "committed" && leaseStatus.outcome) {
-        this.#database
-          .prepare(
-            `UPDATE workflow_engine_operations
-             SET state = 'committed', lease_token = NULL,
-                 lease_expires_at = NULL, outcome_json = ?
-             WHERE run_id = ? AND operation_id = ? AND state = 'running'`,
-          )
-          .run(
-            JSON.stringify(leaseStatus.outcome),
-            row.run_id,
-            row.operation_id,
-          );
-        continue;
-      }
-      if (leaseStatus?.state === "running") {
-        if (leaseStatus.expiresAt !== undefined) {
-          nextExpiry = Math.min(nextExpiry ?? Infinity, leaseStatus.expiresAt);
-        }
-        continue;
-      }
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_operations
-           SET state = 'interrupted', lease_token = NULL,
-               lease_expires_at = NULL
-           WHERE run_id = ? AND operation_id = ? AND state = 'running'`,
-        )
-        .run(row.run_id, row.operation_id);
-      // Claim the same run-exclusive lease before repairing projections. A live
-      // owner (including a different host) must never be mistaken for an orphan.
-      let recoveryLease: OperationLease;
-      try {
-        recoveryLease = this.#runStore.acquireLease({
-          runId: row.run_id,
-          operationId: this.#leaseOperationId(row.run_id, row.operation_id),
-          ttlMs: this.#leaseTtlMs,
-          exclusive: true,
-        });
-      } catch (error) {
-        if (
-          error instanceof Error &&
-          error.message === "operation-already-running"
-        )
-          continue;
-        throw error;
-      }
-      try {
-        this.#pauseInterruptedRun(row.run_id, row.operation_id, recoveryLease);
-      } finally {
-        this.#runStore.interruptLease(recoveryLease);
-      }
-    }
-    if (nextExpiry !== undefined && !this.#closed) {
-      const delay = Math.max(1, nextExpiry - this.#now() + 1);
-      this.#orphanRecoveryTimer = setTimeout(() => {
-        this.#orphanRecoveryTimer = undefined;
-        if (this.#closed) return;
-        try {
-          this.#recoverInterruptedOperations();
-        } catch {
-          // A later status/restart will surface durable journal corruption.
-        }
-      }, delay);
-      this.#orphanRecoveryTimer.unref?.();
-    }
-  }
-
-  #recoverTerminalCleanup(): void {
-    const rows = this.#database
-      .prepare(
-        `SELECT workflow_engine_runs.run_id
-         FROM workflow_engine_runs
-         JOIN runs ON runs.run_id = workflow_engine_runs.run_id
-         WHERE runs.state IN ('completed', 'discarded')
-           AND workflow_engine_runs.cleanup_state = 'retained'`,
-      )
-      .all() as unknown as Array<{ run_id: string }>;
-    for (const row of rows) {
-      try {
-        this.#cleanupTerminal(row.run_id, "restart-cleanup");
-      } catch {
-        // Terminal status remains truthful and a later reload retries cleanup.
-      }
-    }
-  }
-
-  #tasks(runId: string): EngineTaskRow[] {
-    return this.#database
-      .prepare(
-        `SELECT task_id, task_order, delivery_revision, plan_json, state,
-                phase, pause_code, context_request_json, attempt_diagnostic_json,
-                route_id, route_fingerprint, queue_position
-         FROM workflow_engine_tasks WHERE run_id = ? ORDER BY task_order`,
-      )
-      .all(runId) as unknown as EngineTaskRow[];
-  }
-
-  #taskPlan(row: EngineTaskRow): PlanTaskDraft {
-    return JSON.parse(row.plan_json) as PlanTaskDraft;
-  }
-
-  #currentPlan(runId: string): ImplementPlan {
-    const revision = this.#engineRun(runId).current_revision;
-    if (revision === null) throw new Error("delivery-not-bound");
-    return this.#planForRevision(runId, revision);
-  }
-
-  #planForRevision(runId: string, revision: number): ImplementPlan {
-    const row = this.#database
-      .prepare(
-        `SELECT plan_json FROM workflow_engine_deliveries
-         WHERE run_id = ? AND revision = ?`,
-      )
-      .get(runId, revision) as { plan_json: string } | undefined;
-    if (!row) throw new Error("delivery-not-bound");
-    return parsePlan(row.plan_json);
-  }
-
-  async #loadDelivery(
-    runId: string,
-    lease: OperationLease,
-    stage: ControlStage,
-    change: string,
-    deliveryRevision?: number,
-    receiptHash?: string,
-    signal?: AbortSignal,
-  ): Promise<WorkflowDelivery> {
-    if (deliveryRevision === undefined && this.#deliverySource.discoverLatest) {
-      try {
-        const discover = this.#deliverySource.discoverLatest;
-        const available = await cancellableRead(
-          () => discover.call(this.#deliverySource, { stage, change, signal }),
-          signal,
-        );
-        if (
-          available &&
-          Number.isSafeInteger(available.deliveryRevision) &&
-          available.deliveryRevision > 0 &&
-          SHA256.test(available.receiptHash)
-        ) {
-          deliveryRevision = available.deliveryRevision;
-          receiptHash = available.receiptHash;
-        }
-      } catch {
-        // Discovery is optional; authoritative loading still reports diagnostics.
-        signal?.throwIfAborted();
-      }
-    }
-    try {
-      const delivery = await cancellableRead(
-        () =>
-          this.#deliverySource.load({
-            stage,
-            change,
-            ...(deliveryRevision === undefined ? {} : { deliveryRevision }),
-            ...(receiptHash === undefined ? {} : { receiptHash }),
-            ...(signal ? { signal } : {}),
-          }),
-        signal,
-      );
-      signal?.throwIfAborted();
-      assertDelivery(delivery, stage, change, deliveryRevision, receiptHash);
-      return structuredClone(delivery);
-    } catch (error) {
-      if (
-        error instanceof DeliveryValidationError &&
-        deliveryRevision !== undefined &&
-        receiptHash !== undefined
-      ) {
-        this.#leasedTransaction(lease, () => {
-          this.#database
-            .prepare(
-              "INSERT INTO workflow_rejected_deliveries(run_id, delivery_revision, receipt_hash) VALUES (?, ?, ?) ON CONFLICT DO NOTHING",
-            )
-            .run(runId, deliveryRevision, receiptHash);
-        });
-      }
-      throw error;
-    }
-  }
-
-  #admitDelivery(
-    runId: string,
-    delivery: WorkflowDelivery,
-    lease: OperationLease,
-  ): void {
-    this.#runStore.assertLease(lease);
-    const existing = this.#database
-      .prepare(
-        `SELECT receipt_hash, plan_json FROM workflow_engine_deliveries
-         WHERE run_id = ? AND revision = ?`,
-      )
-      .get(runId, delivery.revision) as
-      | { receipt_hash: string; plan_json: string }
-      | undefined;
-    const capturedBudget = this.#database
-      .prepare("SELECT hard_limit FROM workflow_work_budget WHERE run_id = ?")
-      .get(runId) as { hard_limit: number } | undefined;
-    if (
-      this.#phaseCount(delivery.plan) >
-        (capturedBudget?.hard_limit ?? this.#workHardLimit) &&
-      !existing
-    )
-      throw new DeliveryValidationError([
-        "verification-work-budget-insufficient",
-      ]);
-    const serializedPlan = JSON.stringify(delivery.plan);
-    if (
-      existing &&
-      (existing.receipt_hash !== delivery.receiptHash ||
-        existing.plan_json !== serializedPlan)
-    ) {
-      throw new Error("delivery-revision-conflict");
-    }
-    const engineRun = this.#engineRun(runId);
-    if (
-      engineRun.current_revision !== null &&
-      delivery.revision < engineRun.current_revision
-    ) {
-      throw new Error("delivery-revision-stale");
-    }
-    const priorRows = this.#tasks(runId);
-    const priorById = new Map(priorRows.map((row) => [row.task_id, row]));
-    const priorPlan =
-      engineRun.current_revision === null
-        ? undefined
-        : this.#planForRevision(runId, engineRun.current_revision);
-    const comparison = compareDeliveryRevision(
-      priorPlan,
-      delivery.plan,
-      priorRows,
-    );
-    const { compatible, boundaryExpanded } = comparison;
-    let invalidated = comparison.invalidated;
-    let revalidatedWorkspace:
-      | {
-          baselineRevisionId: string;
-          currentWorkspaceRevisionId: string;
-        }
-      | undefined;
-    if (
-      priorPlan &&
-      (invalidated.size > 0 || boundaryExpanded) &&
-      engineRun.baseline_workspace_revision &&
-      engineRun.current_workspace_revision
-    ) {
-      if (!this.#worker.revalidateDelivery) {
-        if (boundaryExpanded) {
-          throw new Error("workflow-delivery-revalidation-unavailable");
-        }
-        if (
-          engineRun.current_workspace_revision !==
-          engineRun.baseline_workspace_revision
-        ) {
-          throw new Error("workflow-delivery-revalidation-unavailable");
-        }
-      } else {
-        const result = this.#worker.revalidateDelivery({
-          runId,
-          deliveryRevision: delivery.revision,
-          plan: structuredClone(delivery.plan),
-          tasks: priorRows
-            .filter((row) => compatible.has(row.task_id))
-            .map((row) => ({
-              taskId: row.task_id,
-              deliveryRevision: row.delivery_revision,
-              state: row.state,
-              phase: row.phase,
-              contextReadPaths: this.#contextReads(runId, row.task_id),
-            })),
-          invalidatedTaskIds: [...invalidated].sort(),
-          baselineRevisionId: engineRun.baseline_workspace_revision,
-          currentWorkspaceRevisionId: engineRun.current_workspace_revision,
-        });
-        const resultIds = new Set(result.invalidatedTaskIds);
-        if (
-          !Array.isArray(result.invalidatedTaskIds) ||
-          resultIds.size !== result.invalidatedTaskIds.length ||
-          [...invalidated].some((taskId) => !resultIds.has(taskId)) ||
-          [...resultIds].some((taskId) => !priorById.has(taskId)) ||
-          !SHA256.test(result.baselineRevisionId) ||
-          !SHA256.test(result.currentWorkspaceRevisionId)
-        ) {
-          throw new Error("workflow-delivery-revalidation-invalid");
-        }
-        invalidated = resultIds;
-        revalidatedWorkspace = {
-          baselineRevisionId: result.baselineRevisionId,
-          currentWorkspaceRevisionId: result.currentWorkspaceRevisionId,
-        };
-      }
-    }
-    const deliveryBindings = delivery.approvalProofs
-      ? ([
-          {
-            runId,
-            gate: "gate-a" as const,
-            revision: delivery.revision,
-            receiptHash: delivery.receiptHash,
-            approvalProof: structuredClone(delivery.approvalProofs.gateA),
-            operationId: `bind-a-${hash(
-              runId,
-              String(delivery.revision),
-              delivery.approvalProofs.gateA.recordHash,
-            ).slice(0, 40)}`,
-            lease,
-          },
-          {
-            runId,
-            gate: "gate-b" as const,
-            revision: delivery.revision,
-            receiptHash: delivery.receiptHash,
-            approvalProof: structuredClone(delivery.approvalProofs.gateB),
-            operationId: `bind-b-${hash(
-              runId,
-              String(delivery.revision),
-              delivery.approvalProofs.gateB.recordHash,
-            ).slice(0, 40)}`,
-            lease,
-          },
-        ] as const)
-      : ([
-          {
-            runId,
-            gate: delivery.gate,
-            revision: delivery.revision,
-            receiptHash: delivery.receiptHash,
-            operationId: `bind-${hash(
-              runId,
-              String(delivery.revision),
-              delivery.receiptHash,
-            ).slice(0, 40)}`,
-            lease,
-          },
-        ] as const);
-    this.#runStore.bindDeliveriesAtomically(deliveryBindings, (database) => {
-      const engineLease = database
-        .prepare(
-          `SELECT state, lease_expires_at
-             FROM workflow_engine_operations
-             WHERE run_id = ? AND lease_token = ?`,
-        )
-        .get(runId, lease.token) as
-        | { state: string; lease_expires_at: number | null }
-        | undefined;
-      if (
-        engineLease?.state !== "running" ||
-        engineLease.lease_expires_at === null ||
-        engineLease.lease_expires_at < this.#now()
-      ) {
-        throw new Error("lease-fenced");
-      }
-      database
-        .prepare(
-          `INSERT INTO workflow_engine_runs(
-             run_id, current_revision, delivery_diagnostics_json,
-             next_queue_position
-           ) VALUES (?, ?, NULL, 1)
-           ON CONFLICT(run_id) DO UPDATE SET
-             current_revision = excluded.current_revision,
-             verification_json = NULL,
-             delivery_diagnostics_json = NULL`,
-        )
-        .run(runId, delivery.revision);
-      if (revalidatedWorkspace) {
-        database
-          .prepare(
-            `UPDATE workflow_engine_runs
-             SET baseline_workspace_revision = ?,
-                 current_workspace_revision = ?, cleanup_state = 'retained'
-             WHERE run_id = ?`,
-          )
-          .run(
-            revalidatedWorkspace.baselineRevisionId,
-            revalidatedWorkspace.currentWorkspaceRevisionId,
-            runId,
-          );
-      }
-      database
-        .prepare(
-          `INSERT INTO workflow_engine_deliveries(
-             run_id, revision, gate, receipt_hash, plan_json
-           ) VALUES (?, ?, ?, ?, ?)
-           ON CONFLICT(run_id, revision) DO NOTHING`,
-        )
-        .run(
-          runId,
-          delivery.revision,
-          delivery.gate,
-          delivery.receiptHash,
-          serializedPlan,
-        );
-
-      this.#growWorkBudget(database, runId, delivery.plan);
-      const admitted = new Set<string>();
-      delivery.plan.tasks.forEach((task, taskOrder) => {
-        admitted.add(task.taskId);
-        const taskJson = JSON.stringify(task);
-        const prior = priorById.get(task.taskId);
-        if (!prior) {
-          database
-            .prepare(
-              `INSERT INTO workflow_engine_tasks(
-                 run_id, task_id, task_order, delivery_revision, plan_json,
-                 state, phase
-               ) VALUES (?, ?, ?, ?, ?, 'pending', ?)`,
-            )
-            .run(
-              runId,
-              task.taskId,
-              taskOrder,
-              delivery.revision,
-              taskJson,
-              phases(task)[0],
-            );
-          return;
-        }
-        if (compatible.has(task.taskId) && !invalidated.has(task.taskId)) {
-          database
-            .prepare(
-              `UPDATE workflow_engine_tasks
-               SET task_order = ?, plan_json = ?
-               WHERE run_id = ? AND task_id = ?`,
-            )
-            .run(taskOrder, taskJson, runId, task.taskId);
-          return;
-        }
-        database
-          .prepare(
-            "DELETE FROM workflow_context_reads WHERE run_id = ? AND task_id = ?",
-          )
-          .run(runId, task.taskId);
-        database
-          .prepare(
-            `UPDATE workflow_engine_tasks
-             SET task_order = ?, delivery_revision = ?, plan_json = ?,
-                 state = 'pending', phase = ?, pause_code = NULL,
-                 context_request_json = NULL, attempt_diagnostic_json = NULL,
-                 queue_position = NULL
-             WHERE run_id = ? AND task_id = ?`,
-          )
-          .run(
-            taskOrder,
-            delivery.revision,
-            taskJson,
-            phases(task)[0],
-            runId,
-            task.taskId,
-          );
-      });
-      for (const row of priorRows) {
-        if (!admitted.has(row.task_id)) {
-          database
-            .prepare(
-              "DELETE FROM workflow_context_reads WHERE run_id = ? AND task_id = ?",
-            )
-            .run(runId, row.task_id);
-          database
-            .prepare(
-              `DELETE FROM workflow_engine_tasks
-               WHERE run_id = ? AND task_id = ?`,
-            )
-            .run(runId, row.task_id);
-        }
-      }
-    });
-  }
-
-  #cancelledDelivery(
-    runId: string,
-    operationId: string,
-    error: unknown,
-    signal: AbortSignal | undefined,
-    lease: OperationLease,
-  ): Record<string, unknown> | undefined {
-    if (!signal || !isCancellationException(error, signal)) return undefined;
-    try {
-      this.#runStore.assertLease(lease);
-      if (
-        ["validating-delivery", "ready"].includes(
-          this.#runStore.status(runId).state,
-        )
-      ) {
-        this.#transition(
-          runId,
-          "paused",
-          `${operationId}:delivery-cancelled`,
-          "operation-cancelled",
-          lease,
-        );
-      }
-    } catch (failure) {
-      if (!(failure instanceof Error) || failure.message !== "lease-fenced")
-        throw failure;
-    } finally {
-      this.#interruptOperation(runId, operationId);
-    }
-    return this.#statusByRun(runId);
-  }
-
-  #deliveryFailure(
-    runId: string,
-    operationId: string,
-    error: unknown,
-    lease: OperationLease,
-  ): Record<string, unknown> | undefined {
-    if (!(error instanceof DeliveryValidationError)) return undefined;
-    this.#leasedTransaction(lease, () => {
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs
-           SET delivery_diagnostics_json = ? WHERE run_id = ?`,
-        )
-        .run(JSON.stringify(error.diagnostics), runId);
-    });
-    this.#transition(
-      runId,
-      "paused",
-      `${operationId}:delivery-invalid`,
-      "delivery-invalid",
-      lease,
-    );
-    return {
-      ...this.#statusByRun(runId),
-      delivery: {
-        code: "delivery-invalid",
-        diagnostics: [...error.diagnostics],
-      },
-    };
-  }
-
-  #setTask(
-    runId: string,
-    taskId: string,
-    values: {
-      state?: string;
-      phase?: "red" | "green" | "refactor";
-      pauseCode?: string | null;
-      contextRequest?: WorkflowContextRequest | null;
-      attemptDiagnostic?: SafeAttemptDiagnostic | null;
-      routeId?: string | null;
-      routeFingerprint?: string | null;
-      queuePosition?: number | null;
-    },
-    lease?: OperationLease,
-  ): void {
-    if (values.attemptDiagnostic?.recovery && lease) {
-      const fact = values.attemptDiagnostic.recovery;
-      const prior = this.#recovery(runId, fact.key);
-      if (
-        !prior ||
-        fact.failures > prior.failures ||
-        fact.feedback.maxAttempts < prior.feedback.maxAttempts
-      )
-        this.#recordRecovery(runId, fact, lease);
-    }
-    const assignments: string[] = [];
-    const parameters: Array<string | number | null> = [];
-    if (values.state !== undefined) {
-      assignments.push("state = ?");
-      parameters.push(values.state);
-    }
-    if (values.phase !== undefined) {
-      assignments.push("phase = ?");
-      parameters.push(values.phase);
-    }
-    if (values.pauseCode !== undefined) {
-      assignments.push("pause_code = ?");
-      parameters.push(values.pauseCode);
-    }
-    if (values.contextRequest !== undefined) {
-      assignments.push("context_request_json = ?");
-      parameters.push(
-        values.contextRequest === null
-          ? null
-          : JSON.stringify(
-              normalizeWorkflowContextRequest(values.contextRequest),
-            ),
-      );
-    }
-    if (values.attemptDiagnostic !== undefined) {
-      assignments.push("attempt_diagnostic_json = ?");
-      parameters.push(
-        values.attemptDiagnostic === null
-          ? null
-          : JSON.stringify(
-              Object.fromEntries(
-                Object.entries(values.attemptDiagnostic).filter(
-                  ([key]) => key !== "recovery",
-                ),
-              ),
-            ),
-      );
-    }
-    if (values.routeId !== undefined) {
-      assignments.push("route_id = ?");
-      parameters.push(values.routeId);
-    }
-    if (values.routeFingerprint !== undefined) {
-      assignments.push("route_fingerprint = ?");
-      parameters.push(values.routeFingerprint);
-    }
-    if (values.queuePosition !== undefined) {
-      assignments.push("queue_position = ?");
-      parameters.push(values.queuePosition);
-    }
-    if (assignments.length === 0) return;
-    const write = () => {
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_tasks SET ${assignments.join(", ")}
-           WHERE run_id = ? AND task_id = ?`,
-        )
-        .run(...parameters, runId, taskId);
-    };
-    if (lease) this.#leasedTransaction(lease, write);
-    else write();
-  }
-
-  #setVerificationStatus(
-    runId: string,
-    status: WorkflowVerificationStatus | null,
-    lease: OperationLease,
-  ): void {
-    const serialized =
-      status === null
-        ? null
-        : JSON.stringify(normalizeWorkflowVerificationStatus(status));
-    this.#leasedTransaction(lease, () => {
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs SET verification_json = ?
-           WHERE run_id = ?`,
-        )
-        .run(serialized, runId);
-    });
-  }
-
-  #queueTask(
-    runId: string,
-    row: EngineTaskRow,
-    lease: OperationLease,
-    reason: "conflict" | "capacity" = "conflict",
-  ): void {
-    const pauseCode = reason === "capacity" ? "worker-capacity" : null;
-    if (row.state === "queued" && row.queue_position !== null) {
-      if (row.pause_code !== pauseCode)
-        this.#setTask(runId, row.task_id, { pauseCode }, lease);
-      return;
-    }
-    const engineRun = this.#engineRun(runId);
-    this.#leasedTransaction(lease, () => {
-      this.#setTask(runId, row.task_id, {
-        state: "queued",
-        pauseCode,
-        queuePosition: engineRun.next_queue_position,
-      });
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs
-           SET next_queue_position = next_queue_position + 1
-           WHERE run_id = ?`,
-        )
-        .run(runId);
-    });
-  }
-
-  #recordWorkspaceFacts(
-    runId: string,
-    outcome: WorkflowAttemptOutcome,
-    lease: OperationLease,
-  ): void {
-    const baselineRevisionId = outcome.baselineRevisionId;
-    const currentWorkspaceRevisionId =
-      outcome.kind === "phase-committed"
-        ? outcome.isolatedRevisionId
-        : outcome.currentWorkspaceRevisionId;
-    if (
-      (baselineRevisionId !== undefined && !SHA256.test(baselineRevisionId)) ||
-      (currentWorkspaceRevisionId !== undefined &&
-        !SHA256.test(currentWorkspaceRevisionId)) ||
-      (outcome.kind !== "phase-committed" &&
-        (baselineRevisionId === undefined) !==
-          (currentWorkspaceRevisionId === undefined))
-    ) {
-      throw new Error("workflow-attempt-workspace-fact-invalid");
-    }
-    if (currentWorkspaceRevisionId === undefined) return;
-    this.#leasedTransaction(lease, () => {
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs
-           SET baseline_workspace_revision = COALESCE(
-                 baseline_workspace_revision, ?
-               ),
-               current_workspace_revision = ?,
-               cleanup_state = CASE
-                 WHEN ? IS NULL THEN cleanup_state ELSE 'retained'
-               END
-           WHERE run_id = ?`,
-        )
-        .run(
-          baselineRevisionId ?? null,
-          currentWorkspaceRevisionId,
-          baselineRevisionId ?? null,
-          runId,
-        );
-    });
-  }
-
-  #recordRouteFacts(
-    runId: string,
-    taskId: string,
-    outcome: WorkflowAttemptOutcome,
-    lease: OperationLease,
-  ): void {
-    if (
-      (outcome.routeId === undefined) !==
-        (outcome.routeFingerprint === undefined) ||
-      (outcome.routeId !== undefined && !IDENTIFIER.test(outcome.routeId)) ||
-      (outcome.routeFingerprint !== undefined &&
-        !SHA256.test(outcome.routeFingerprint))
-    ) {
-      throw new Error("workflow-attempt-route-fact-invalid");
-    }
-    if (!outcome.routeId || !outcome.routeFingerprint) return;
-    const routeId = outcome.routeId;
-    const routeFingerprint = outcome.routeFingerprint;
-    this.#leasedTransaction(lease, () => {
-      this.#setTask(runId, taskId, {
-        routeId,
-        routeFingerprint,
-      });
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs
-           SET route_id = ?, route_fingerprint = ? WHERE run_id = ?`,
-        )
-        .run(routeId, routeFingerprint, runId);
-    });
-  }
-
-  async #runTask(
-    runId: string,
-    row: EngineTaskRow,
-    operationId: string,
-    signal: AbortSignal,
-    lease: OperationLease,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Promise<void> {
-    const task = this.#taskPlan(row);
-    const orderedPhases = phases(task);
-    let phaseIndex = orderedPhases.indexOf(row.phase);
-    let artifactAttempts = 0;
-    const persistedContextRequest = row.context_request_json
-      ? normalizeWorkflowContextRequest(
-          JSON.parse(row.context_request_json) as unknown,
-        )
-      : undefined;
-    const persistedRedArtifactCorrection =
-      row.phase === "green" &&
-      persistedContextRequest !== undefined &&
-      classifyPersistedContextRequest(persistedContextRequest, task, "green")
-        .code === "red-artifact-constraint";
-    let redArtifactCorrection =
-      row.phase === "green" &&
-      (row.pause_code === "red-artifact-constraint" ||
-        persistedRedArtifactCorrection);
-    let requestedContext = persistedContextRequest;
-    let correctionContextRequest = redArtifactCorrection
-      ? persistedContextRequest
-      : undefined;
-    if (phaseIndex < 0) throw new Error("workflow-task-phase-invalid");
-    while (phaseIndex < orderedPhases.length) {
-      const phase = orderedPhases[phaseIndex];
-      row.phase = phase;
-      if (signal.aborted) {
-        this.#setTask(
-          runId,
-          row.task_id,
-          {
-            state: "paused",
-            phase,
-            pauseCode: "operation-cancelled",
-            contextRequest: null,
-            queuePosition: null,
-          },
-          lease,
-        );
-        return;
-      }
-      const current = this.#engineRun(runId);
-      if (current.current_revision === null)
-        throw new Error("delivery-not-bound");
-      const deliveryRevision = current.current_revision;
-      const plan = this.#planForRevision(runId, deliveryRevision);
-      this.#leasedTransaction(lease, () => {
-        for (const ref of requestedContext?.refs ?? []) {
-          if (
-            ref.kind === "requested-path" &&
-            ref.access === "read" &&
-            permitsContextRead(ref.path, task.roots) &&
-            (current.current_workspace_revision
-              ? current.baseline_workspace_revision &&
-                this.#worker.isContextReadAvailable?.({
-                  runId,
-                  deliveryRevision,
-                  plan,
-                  baselineRevisionId: current.baseline_workspace_revision,
-                  currentWorkspaceRevisionId:
-                    current.current_workspace_revision,
-                  path: ref.path,
-                })
-              : isSafeRegularFile(this.#consumerRoot, ref.path))
-          ) {
-            this.#database
-              .prepare(
-                "INSERT INTO workflow_context_reads(run_id, task_id, path) VALUES (?, ?, ?) ON CONFLICT DO NOTHING",
-              )
-              .run(runId, row.task_id, ref.path);
-          }
-        }
-      });
-      const verificationStatus = current.verification_json
-        ? normalizeWorkflowVerificationStatus(
-            JSON.parse(current.verification_json) as unknown,
-          )
-        : undefined;
-      const priorDiagnostic = this.#safeAttemptDiagnostic(runId, row);
-      const priorRecovery = priorDiagnostic?.recovery;
-      const preparationKey = baselineRecoveryKey(task, phase);
-      const activeRecovery =
-        priorRecovery &&
-        [recoveryKey(task, phase, row, current), preparationKey].includes(
-          priorRecovery.key,
-        )
-          ? priorRecovery
-          : undefined;
-      const maxRecoveryAttempts = Math.min(
-        plan.verification.artifactCorrection.maxAttempts,
-        activeRecovery?.feedback.maxAttempts ?? Infinity,
-      );
-      if (
-        activeRecovery &&
-        activeRecovery.feedback.maxAttempts !== maxRecoveryAttempts
-      ) {
-        this.#leasedTransaction(lease, () => {
-          this.#database
-            .prepare(
-              "UPDATE workflow_recovery_incidents SET max_attempts = MIN(max_attempts, ?) WHERE run_id = ? AND incident_key = ?",
-            )
-            .run(maxRecoveryAttempts, runId, activeRecovery.key);
-        });
-        activeRecovery.feedback.maxAttempts = maxRecoveryAttempts;
-      }
-      const granted = this.#hasRecoveryGrant(
-        runId,
-        operationId,
-        activeRecovery?.key ?? recoveryKey(task, phase, row, current),
-      );
-      const verificationOnly =
-        activeRecovery?.key !== preparationKey &&
-        recoveryExhausted(activeRecovery, maxRecoveryAttempts, granted) &&
-        (await this.#worker.hasPendingVerification?.({
-          runId,
-          operationId,
-          deliveryRevision: row.delivery_revision,
-          taskId: row.task_id,
-          phase,
-          task,
-          plan,
-          signal,
-          ...(current.baseline_workspace_revision
-            ? { baselineRevisionId: current.baseline_workspace_revision }
-            : {}),
-          ...(current.current_workspace_revision
-            ? { currentWorkspaceRevisionId: current.current_workspace_revision }
-            : {}),
-        })) === true;
-      if (
-        !verificationOnly &&
-        activeRecovery &&
-        recoveryExhausted(activeRecovery, maxRecoveryAttempts, granted)
-      ) {
-        this.#setTask(
-          runId,
-          row.task_id,
-          {
-            state: "paused",
-            phase,
-            pauseCode: activeRecovery.feedback.code,
-            attemptDiagnostic: priorDiagnostic ?? null,
-            queuePosition: null,
-          },
-          lease,
-        );
-        return;
-      }
-      if (activeRecovery && activeRecovery.key !== preparationKey)
-        artifactAttempts = Math.max(artifactAttempts, activeRecovery.failures);
-      const repair =
-        verificationStatus?.scope === "change-task-affected" &&
-        verificationStatus.attribution === "introduced" &&
-        verificationStatus.taskId === row.task_id &&
-        verificationStatus.failureIdentities &&
-        verificationStatus.failureIdentities.length > 0
-          ? {
-              attribution: "introduced" as const,
-              failureIdentities: [...verificationStatus.failureIdentities],
-            }
-          : undefined;
-      const artifactCorrection =
-        redArtifactCorrection && phase === "green"
-          ? {
-              code: "red-artifact-constraint" as const,
-              attempt: artifactAttempts + 1,
-              maxAttempts: maxRecoveryAttempts,
-              ...(correctionContextRequest
-                ? {
-                    contextRequest: structuredClone(correctionContextRequest),
-                  }
-                : {}),
-            }
-          : undefined;
-      if (this.#worker.prepareTask) {
-        // Reserve this selected task's conflicts while asynchronous baseline
-        // preparation runs, without reserving a Worker attempt.
-        this.#setTask(
-          runId,
-          row.task_id,
-          { state: "phase-ready", phase, queuePosition: null },
-          lease,
-        );
-        if (granted && activeRecovery?.key === preparationKey) {
-          this.#leasedTransaction(lease, () => {
-            const consumed = this.#database
-              .prepare(
-                "UPDATE workflow_recovery_grants SET consumed = 1 WHERE run_id = ? AND operation_id = ? AND incident_key = ? AND consumed = 0",
-              )
-              .run(runId, operationId, preparationKey);
-            if (consumed.changes !== 1)
-              throw new Error("recovery-request-stale");
-            this.#database
-              .prepare(`INSERT INTO workflow_recovery_events(run_id, sequence, incident_key, kind)
-                SELECT ?, COALESCE(MAX(sequence), 0) + 1, ?, 'launch' FROM workflow_recovery_events WHERE run_id = ?`)
-              .run(runId, preparationKey, runId);
-          });
-        }
-        const prepared = await this.#worker.prepareTask({
-          runId,
-          operationId,
-          deliveryRevision: row.delivery_revision,
-          taskId: row.task_id,
-          phase,
-          task: structuredClone(task),
-          plan: structuredClone(plan),
-          ...(current.baseline_workspace_revision
-            ? { baselineRevisionId: current.baseline_workspace_revision }
-            : {}),
-          ...(current.current_workspace_revision
-            ? { currentWorkspaceRevisionId: current.current_workspace_revision }
-            : {}),
-          signal,
-        });
-        this.#runStore.assertLease(lease);
-        if (prepared.kind === "phase-committed")
-          throw new Error("workflow-preparation-outcome-invalid");
-        this.#recordWorkspaceFacts(
-          runId,
-          {
-            ...prepared,
-            kind: "paused",
-            code: "task-prepared",
-            // Preparation has no merge authority over a sibling's newer commit.
-            ...(prepared.currentWorkspaceRevisionId
-              ? {
-                  currentWorkspaceRevisionId:
-                    this.#engineRun(runId).current_workspace_revision ??
-                    prepared.currentWorkspaceRevisionId,
-                }
-              : {}),
-          },
-          lease,
-        );
-        // Preparation may finish successfully while close is settling it.
-        // Re-enter the cancellation guard before granting any Worker work.
-        if (signal.aborted) continue;
-        if (prepared.kind !== "prepared") {
-          const prerequisite =
-            prepared.kind !== "operation-cancelled"
-              ? normalizeVerificationPrerequisite(prepared.prerequisite)
-              : undefined;
-          if (prerequisite) {
-            const verification =
-              prerequisite.scope === "baseline-full-suite"
-                ? plan.verification.baseline?.fullSuite
-                : (task.baselineVerification ?? task.affectedVerification);
-            if (
-              !verification ||
-              verification.id !== prerequisite.verificationId ||
-              (prerequisite.scope === "baseline-task-affected" &&
-                prerequisite.taskId !== row.task_id) ||
-              (prerequisite.input &&
-                !verificationInputPaths(verification).includes(
-                  prerequisite.input.path,
-                )) ||
-              (prerequisite.producer &&
-                !plan.outputs.some(
-                  (output) =>
-                    output.path === prerequisite.input?.path &&
-                    output.producer.taskId === prerequisite.producer?.taskId &&
-                    output.producer.phase === prerequisite.producer?.phase,
-                ))
-            )
-              throw new Error("workflow-prerequisite-evidence-invalid");
-          }
-          if (prerequisite && prepared.kind === "paused") {
-            const identity = hash(
-              canonicalJson({
-                ...prerequisite,
-                verificationId: undefined,
-                taskId: undefined,
-                producer: prerequisite.producer
-                  ? { phase: prerequisite.producer.phase }
-                  : undefined,
-              }),
-            );
-            const priorPreparation = this.#recovery(runId, preparationKey);
-            if (priorPreparation?.feedback.prerequisiteIdentity !== identity) {
-              const failures = (priorPreparation?.failures ?? 0) + 1;
-              this.#recordRecovery(
-                runId,
-                {
-                  key: preparationKey,
-                  failures,
-                  feedback: {
-                    code: prepared.code,
-                    attempt: failures + 1,
-                    maxAttempts: maxRecoveryAttempts,
-                    strategy: "repair-verification",
-                    prerequisiteIdentity: identity,
-                  },
-                },
-                lease,
-              );
-            }
-          }
-          if (prepared.kind !== "operation-cancelled" && prepared.verification)
-            this.#setVerificationStatus(runId, prepared.verification, lease);
-          this.#setTask(
-            runId,
-            row.task_id,
-            {
-              state:
-                prepared.kind === "approval-needed"
-                  ? "approval-needed"
-                  : "paused",
-              phase,
-              pauseCode:
-                prepared.kind === "operation-cancelled"
-                  ? "operation-cancelled"
-                  : prepared.code,
-              attemptDiagnostic: {
-                ...priorDiagnostic,
-                prerequisite,
-              },
-              queuePosition: null,
-            },
-            lease,
-          );
-          return;
-        }
-        if (priorDiagnostic) delete priorDiagnostic.prerequisite;
-        if (activeRecovery?.key === preparationKey) {
-          // A successful original-baseline observation resolves this incident.
-          // Keep its events and immutable failure evidence, then re-enter the
-          // ordinary phase recovery checks before reserving Worker work.
-          this.#leasedTransaction(lease, () => {
-            this.#database
-              .prepare(`INSERT INTO workflow_recovery_events(run_id, sequence, incident_key, kind)
-              SELECT ?, COALESCE(MAX(sequence), 0) + 1, ?, 'resolved' FROM workflow_recovery_events WHERE run_id = ?`)
-              .run(runId, preparationKey, runId);
-            this.#database
-              .prepare(
-                "DELETE FROM workflow_recovery_incidents WHERE run_id = ? AND incident_key = ?",
-              )
-              .run(runId, preparationKey);
-          });
-          if (priorDiagnostic) delete priorDiagnostic.recovery;
-          const retainedDiagnostic =
-            priorDiagnostic && Object.keys(priorDiagnostic).length
-              ? priorDiagnostic
-              : null;
-          this.#setTask(
-            runId,
-            row.task_id,
-            { attemptDiagnostic: retainedDiagnostic },
-            lease,
-          );
-          row.attempt_diagnostic_json = retainedDiagnostic
-            ? JSON.stringify(retainedDiagnostic)
-            : null;
-          continue;
-        }
-      }
-      this.#setTask(
-        runId,
-        row.task_id,
-        {
-          state: "phase-running",
-          phase,
-          pauseCode: artifactCorrection?.code ?? null,
-          contextRequest: requestedContext ?? null,
-          attemptDiagnostic: priorDiagnostic ?? null,
-          queuePosition: null,
-        },
-        lease,
-      );
-      if (
-        !this.#reserveWork(
-          runId,
-          plan,
-          recoveryKey(task, phase, row, current),
-          lease,
-          granted ? operationId : undefined,
-        )
-      ) {
-        this.#setTask(
-          runId,
-          row.task_id,
-          {
-            state: "paused",
-            phase,
-            pauseCode: "change-work-budget-exhausted",
-            queuePosition: null,
-          },
-          lease,
-        );
-        return;
-      }
-      let initialReservation = true;
-      let outcome: WorkflowAttemptOutcome;
-      try {
-        outcome = await this.#worker.runAttempt({
-          runId,
-          operationId,
-          deliveryRevision: row.delivery_revision,
-          taskId: row.task_id,
-          phase,
-          task: structuredClone(task),
-          contextReadPaths: this.#contextReads(runId, row.task_id),
-          plan: structuredClone(plan),
-          ...(current.baseline_workspace_revision
-            ? { baselineRevisionId: current.baseline_workspace_revision }
-            : {}),
-          ...(current.current_workspace_revision
-            ? {
-                currentWorkspaceRevisionId: current.current_workspace_revision,
-              }
-            : {}),
-          ...(row.route_id || current.route_id
-            ? { routeId: row.route_id ?? current.route_id ?? undefined }
-            : {}),
-          ...(row.route_fingerprint || current.route_fingerprint
-            ? {
-                routeFingerprint:
-                  row.route_fingerprint ??
-                  current.route_fingerprint ??
-                  undefined,
-              }
-            : {}),
-          ...(repair ? { repair } : {}),
-          ...(artifactCorrection ? { artifactCorrection } : {}),
-          ...(requestedContext ? { contextRequest: requestedContext } : {}),
-          ...(granted ? { additionalAttempt: true } : {}),
-          ...(verificationOnly ? { verificationOnly: true } : {}),
-          ...(activeRecovery
-            ? { recoveryFeedback: activeRecovery.feedback }
-            : {}),
-          signal,
-          recoveryDecision: (request) => {
-            signal.throwIfAborted();
-            this.#runStore.assertLease(lease);
-            return decideRecoveryAction(plan, request, {
-              additionalAttempt: granted,
-              verificationOnly,
-            });
-          },
-          reserveCandidate: () => {
-            signal.throwIfAborted();
-            if (verificationOnly) return false;
-            if (initialReservation) {
-              initialReservation = false;
-              return true;
-            }
-            if (granted) return false;
-            return this.#reserveWork(
-              runId,
-              plan,
-              recoveryKey(task, phase, row, current),
-              lease,
-            );
-          },
-          onActivity: (event) => {
-            const projection = this.#runStore.status(runId);
-            emitWorkflowActivity(onActivity, {
-              ...event,
-              stage: projection.stage,
-              runId,
-              ...(projection.change ? { change: projection.change } : {}),
-              taskId: row.task_id,
-              phase,
-              objective: task.objective,
-              legalCommands: ["status", "cancel", "discard"],
-            });
-          },
-        });
-      } catch (error) {
-        if (isCancellationException(error, signal)) {
-          outcome = { kind: "operation-cancelled", code: "cancelled" };
-        } else {
-          throw error;
-        }
-      }
-      if (!isRecord(outcome) || typeof outcome.kind !== "string") {
-        throw new Error("workflow-attempt-outcome-invalid");
-      }
-      this.#recordWorkspaceFacts(runId, outcome, lease);
-      this.#recordRouteFacts(runId, row.task_id, outcome, lease);
-      if (outcome.routeId && outcome.routeFingerprint) {
-        row.route_id = outcome.routeId;
-        row.route_fingerprint = outcome.routeFingerprint;
-      }
-      if (
-        outcome.kind !== "phase-committed" &&
-        outcome.kind !== "operation-cancelled" &&
-        outcome.verification
-      ) {
-        this.#setVerificationStatus(runId, outcome.verification, lease);
-      }
-      if (
-        outcome.kind !== "phase-committed" &&
-        outcome.kind !== "operation-cancelled" &&
-        outcome.contextRequest
-      ) {
-        requestedContext = normalizeWorkflowContextRequest(
-          outcome.contextRequest,
-        );
-      }
-      if (
-        outcome.kind !== "phase-committed" &&
-        outcome.kind !== "operation-cancelled" &&
-        outcome.attemptDiagnostic
-      ) {
-        const previous = row.attempt_diagnostic_json
-          ? (JSON.parse(row.attempt_diagnostic_json) as SafeAttemptDiagnostic)
-          : undefined;
-        const fingerprint = hash(
-          outcome.code,
-          outcome.attemptDiagnostic.finalCategory ?? "unknown",
-          outcome.attemptDiagnostic.schema ?? "unknown",
-          JSON.stringify(outcome.attemptDiagnostic.identityMismatch ?? []),
-        ).slice(0, 16);
-        const sameFailure = previous?.fingerprint === fingerprint;
-        const sameFailureCount = sameFailure
-          ? (previous?.sameFailureCount ?? 1) + 1
-          : 1;
-        const attemptDiagnostic = {
-          ...outcome.attemptDiagnostic,
-          ...(priorDiagnostic?.recovery
-            ? { recovery: priorDiagnostic.recovery }
-            : {}),
-          fingerprint,
-          sameFailureCount,
-          ...(sameFailureCount > 1
-            ? { action: "rebind-or-revise-delivery" as const }
-            : {}),
-        };
-        // Only parent preparation can contribute original-baseline authority.
-        delete attemptDiagnostic.prerequisite;
-        this.#setTask(runId, row.task_id, { attemptDiagnostic }, lease);
-        row.attempt_diagnostic_json = JSON.stringify(attemptDiagnostic);
-      }
-      if (
-        outcome.kind === "paused" &&
-        outcome.code === "repair-attempts-exhausted"
-      ) {
-        const maxAttempts = plan.verification.repair.maxAttempts;
-        const failures = Math.max(
-          maxAttempts,
-          (activeRecovery?.failures ?? 0) +
-            (granted || verificationOnly ? 1 : 0),
-        );
-        const diagnostic: SafeAttemptDiagnostic = {
-          recovery: {
-            key: recoveryKey(task, phase, row, this.#engineRun(runId)),
-            failures,
-            feedback: {
-              code: outcome.code,
-              attempt: failures + 1,
-              maxAttempts,
-              strategy: "repair-verification",
-            },
-          },
-        };
-        this.#setTask(
-          runId,
-          row.task_id,
-          { attemptDiagnostic: diagnostic },
-          lease,
-        );
-        row.attempt_diagnostic_json = JSON.stringify(diagnostic);
-      }
-      if (
-        outcome.kind === "retryable" &&
-        ["artifact", "stale", "verification"].includes(
-          outcome.retryPolicy ?? "",
-        )
-      ) {
-        const key = recoveryKey(task, phase, row, this.#engineRun(runId));
-        const failures =
-          (activeRecovery?.key === key ? activeRecovery.failures : 0) + 1;
-        const strategy =
-          outcome.code === "needs-task-split" ||
-          outcome.code === "task-split-needed"
-            ? ("compact-patch" as const)
-            : outcome.retryPolicy === "stale"
-              ? ("refresh-candidate" as const)
-              : outcome.retryPolicy === "verification"
-                ? ("repair-verification" as const)
-                : ("revise-candidate" as const);
-        const diagnostic: SafeAttemptDiagnostic = {
-          ...this.#safeAttemptDiagnostic(runId, row),
-          recovery: {
-            key,
-            failures,
-            feedback: {
-              code: outcome.code,
-              attempt: failures + 1,
-              maxAttempts: maxRecoveryAttempts,
-              strategy,
-              ...(outcome.verification?.failureIdentities
-                ? { failureIdentities: outcome.verification.failureIdentities }
-                : {}),
-            },
-          },
-        };
-        this.#setTask(
-          runId,
-          row.task_id,
-          { attemptDiagnostic: diagnostic },
-          lease,
-        );
-        row.attempt_diagnostic_json = JSON.stringify(diagnostic);
-        if (outcome.code === "red-artifact-constraint") {
-          redArtifactCorrection = true;
-          correctionContextRequest = outcome.contextRequest
-            ? normalizeWorkflowContextRequest(outcome.contextRequest)
-            : correctionContextRequest;
-          requestedContext = correctionContextRequest ?? requestedContext;
-        }
-        artifactAttempts = Math.max(artifactAttempts + 1, failures);
-        const maxAttempts = maxRecoveryAttempts;
-        if (artifactAttempts < maxAttempts) {
-          this.#setTask(
-            runId,
-            row.task_id,
-            {
-              state: "retryable",
-              phase,
-              pauseCode: redArtifactCorrection
-                ? "red-artifact-constraint"
-                : outcome.code,
-              contextRequest: requestedContext ?? null,
-              queuePosition: null,
-            },
-            lease,
-          );
-          emitWorkflowActivity(onActivity, {
-            state: "retrying",
-            stage: this.#runStore.status(runId).stage,
-            runId,
-            taskId: row.task_id,
-            phase,
-            objective: task.objective,
-            legalCommands: ["status", "cancel", "discard"],
-            code: outcome.code,
-            attempt: artifactAttempts,
-            maxAttempts,
-            wait: "artifact-correction",
-          });
-          continue;
-        }
-      }
-      if (outcome.kind === "phase-committed") {
-        if (
-          !SHA256.test(outcome.artifactHash) ||
-          !SHA256.test(outcome.isolatedRevisionId) ||
-          (outcome.baselineRevisionId !== undefined &&
-            !SHA256.test(outcome.baselineRevisionId)) ||
-          outcome.classification !== expectedClassification(phase)
-        ) {
-          throw new Error("workflow-attempt-fact-invalid");
-        }
-        this.#leasedTransaction(lease, () => {
-          const resolvedKey = recoveryKey(task, phase, row, current);
-          if (this.#recovery(runId, resolvedKey)) {
-            this.#database
-              .prepare(`INSERT INTO workflow_recovery_events(run_id, sequence, incident_key, kind)
-              SELECT ?, COALESCE(MAX(sequence), 0) + 1, ?, 'resolved' FROM workflow_recovery_events WHERE run_id = ?`)
-              .run(runId, resolvedKey, runId);
-          }
-          this.#database
-            .prepare(
-              "DELETE FROM workflow_recovery_incidents WHERE run_id = ? AND incident_key = ?",
-            )
-            .run(runId, recoveryKey(task, phase, row, current));
-        });
-        if (repair) {
-          this.#setVerificationStatus(runId, null, lease);
-          this.#setTask(
-            runId,
-            row.task_id,
-            {
-              state: "verified",
-              phase,
-              pauseCode: null,
-              contextRequest: null,
-              attemptDiagnostic: null,
-              queuePosition: null,
-            },
-            lease,
-          );
-          return;
-        }
-        artifactAttempts = 0;
-        row.attempt_diagnostic_json = null;
-        redArtifactCorrection = false;
-        requestedContext = undefined;
-        correctionContextRequest = undefined;
-        phaseIndex += 1;
-        if (phaseIndex >= orderedPhases.length) {
-          this.#setTask(
-            runId,
-            row.task_id,
-            {
-              state: "verified",
-              phase,
-              pauseCode: null,
-              contextRequest: null,
-              attemptDiagnostic: null,
-              queuePosition: null,
-            },
-            lease,
-          );
-          return;
-        }
-        this.#setTask(
-          runId,
-          row.task_id,
-          {
-            state: "phase-ready",
-            phase: orderedPhases[phaseIndex],
-            pauseCode: null,
-            contextRequest: null,
-            attemptDiagnostic: null,
-            queuePosition: null,
-          },
-          lease,
-        );
-        continue;
-      }
-      if (outcome.kind === "operation-cancelled") {
-        this.#setTask(
-          runId,
-          row.task_id,
-          {
-            state: "paused",
-            phase,
-            pauseCode: "operation-cancelled",
-            contextRequest: null,
-            queuePosition: null,
-          },
-          lease,
-        );
-        return;
-      }
-      if (
-        outcome.kind === "paused" ||
-        outcome.kind === "retryable" ||
-        outcome.kind === "approval-needed"
-      ) {
-        if (typeof outcome.code !== "string" || outcome.code.length === 0) {
-          throw new Error("workflow-attempt-outcome-invalid");
-        }
-        const approvalCodeInvalid =
-          outcome.kind === "approval-needed" &&
-          !isWorkflowApprovalCode(outcome.code);
-        this.#setTask(
-          runId,
-          row.task_id,
-          {
-            state: approvalCodeInvalid ? "paused" : outcome.kind,
-            phase,
-            pauseCode: approvalCodeInvalid
-              ? "approval-code-invalid"
-              : outcome.code,
-            contextRequest: approvalCodeInvalid
-              ? null
-              : (requestedContext ?? null),
-            queuePosition: null,
-          },
-          lease,
-        );
-        return;
-      }
-      throw new Error("workflow-attempt-outcome-invalid");
-    }
-  }
-
-  #firstPaused(rows: EngineTaskRow[]): EngineTaskRow | undefined {
-    return firstPausedTask(rows);
-  }
-
-  #recoverLegacyContextApproval(runId: string): boolean {
-    const projection = this.#runStore.status(runId);
-    if (!["approval-needed", "paused"].includes(projection.state)) return false;
-    const rows = this.#tasks(runId);
-    const approvalRows = rows.filter((row) => row.state === "approval-needed");
-    if (approvalRows.length === 0) return false;
-    const reclassified = rows.flatMap((row) => {
-      if (
-        row.state !== "approval-needed" ||
-        row.pause_code !== "boundary-review-needed" ||
-        row.context_request_json === null
-      ) {
-        return [];
-      }
-      try {
-        const request = normalizeWorkflowContextRequest(
-          JSON.parse(row.context_request_json) as unknown,
-        );
-        const classified = classifyPersistedContextRequest(
-          request,
-          this.#taskPlan(row),
-          row.phase,
-        );
-        if (classified.kind === "approval-needed") return [];
-        return [
-          {
-            row,
-            state: classified.kind === "retryable" ? "retryable" : "paused",
-            code: classified.code,
-            contextRequest: JSON.stringify(
-              normalizeWorkflowContextRequest(classified.contextRequest),
-            ),
-          },
-        ];
-      } catch {
-        return [];
-      }
-    });
-    const reclassifiedTaskIds = new Set(
-      reclassified.map((entry) => entry.row.task_id),
-    );
-    const retainedApprovals = approvalRows.filter(
-      (row) => !reclassifiedTaskIds.has(row.task_id),
-    );
-    const updateTasks = (database: DatabaseSync) => {
-      for (const entry of reclassified) {
-        const updated = database
-          .prepare(
-            `UPDATE workflow_engine_tasks
-             SET state = ?, phase = ?, pause_code = ?, context_request_json = ?,
-                 queue_position = NULL
-             WHERE run_id = ? AND task_id = ?
-               AND state = 'approval-needed'
-               AND pause_code = 'boundary-review-needed'`,
-          )
-          .run(
-            entry.state,
-            entry.row.phase,
-            entry.code,
-            entry.contextRequest,
-            runId,
-            entry.row.task_id,
-          );
-        if (Number(updated.changes) !== 1) {
-          throw new Error("workflow-legacy-context-race");
-        }
-      }
-    };
-    const transitionWithUpdates = (
-      to: "paused" | "approval-needed",
-      code: string,
-    ) =>
-      this.#runStore.transitionAtomically(
-        {
-          runId,
-          to,
-          operationId: `legacy-context-${hash(
-            runId,
-            String(projection.sequence),
-            to,
-            code,
-            JSON.stringify(
-              reclassified.map((entry) => [entry.row.task_id, entry.code]),
-            ),
-          ).slice(0, 40)}`,
-          code,
-        },
-        updateTasks,
-      );
-    if (retainedApprovals.length > 0) {
-      if (projection.state === "approval-needed") {
-        if (reclassified.length === 0) return false;
-        this.#transaction(() => updateTasks(this.#database));
-      } else {
-        transitionWithUpdates(
-          "approval-needed",
-          retainedApprovals[0].pause_code ?? "approval-code-invalid",
-        );
-      }
-      return true;
-    }
-    const first = reclassified[0];
-    if (!first) return false;
-    transitionWithUpdates("paused", first.code);
-    return true;
-  }
-
-  async #finishChange(
-    runId: string,
-    operationId: string,
-    signal: AbortSignal,
-    lease: OperationLease,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Promise<Record<string, unknown>> {
-    const plan = this.#currentPlan(runId);
-    let engineRun = this.#engineRun(runId);
-    if (engineRun.current_revision === null)
-      throw new Error("delivery-not-bound");
-    const deliveryRevision = engineRun.current_revision;
-    this.#transition(
-      runId,
-      "change-verifying",
-      `${operationId}:change-verifying`,
-      undefined,
-      lease,
-    );
-    const projection = this.#runStore.status(runId);
-    emitWorkflowActivity(onActivity, {
-      state: "verifying",
-      stage: projection.stage,
-      runId,
-      ...(projection.change ? { change: projection.change } : {}),
-      objective: projection.change
-        ? `verify change ${projection.change}`
-        : "verify workflow change",
-      legalCommands: ["status", "cancel", "discard"],
-    });
-    const verification = await this.#changeVerifier.verify({
-      taskEvidence: this.#tasks(runId).map((row) => ({
-        taskId: row.task_id,
-        deliveryRevision: row.delivery_revision,
-      })),
-      runId,
-      deliveryRevision,
-      plan: structuredClone(plan),
-      ...(engineRun.baseline_workspace_revision
-        ? { baselineRevisionId: engineRun.baseline_workspace_revision }
-        : {}),
-      ...(engineRun.current_workspace_revision
-        ? {
-            currentWorkspaceRevisionId: engineRun.current_workspace_revision,
-          }
-        : {}),
-      signal,
-    });
-    this.#runStore.assertLease(lease);
-    if (verification.kind !== "verified") {
-      if (verification.verification) {
-        this.#setVerificationStatus(runId, verification.verification, lease);
-      }
-      if (
-        verification.code === "verification-repair-required" &&
-        verification.verification?.scope === "change-task-affected" &&
-        verification.verification.attribution === "introduced" &&
-        verification.verification.taskId
-      ) {
-        const task = this.#tasks(runId).find(
-          (candidate) =>
-            candidate.task_id === verification.verification?.taskId,
-        );
-        if (task) {
-          const repairKey = recoveryKey(
-            this.#taskPlan(task),
-            task.phase,
-            task,
-            this.#engineRun(runId),
-          );
-          const used = (
-            this.#database
-              .prepare(
-                "SELECT COUNT(*) AS count FROM workflow_recovery_events WHERE run_id = ? AND incident_key = ? AND kind = 'repair'",
-              )
-              .get(runId, repairKey) as { count: number }
-          ).count;
-          if (used >= plan.verification.repair.maxAttempts) {
-            this.#setTask(
-              runId,
-              task.task_id,
-              {
-                state: "paused",
-                phase: task.phase,
-                pauseCode: "repair-attempts-exhausted",
-                attemptDiagnostic: {
-                  recovery: {
-                    key: recoveryKey(
-                      this.#taskPlan(task),
-                      task.phase,
-                      task,
-                      this.#engineRun(runId),
-                    ),
-                    failures: used,
-                    feedback: {
-                      code: "repair-attempts-exhausted",
-                      attempt: used + 1,
-                      maxAttempts: plan.verification.repair.maxAttempts,
-                      strategy: "repair-verification",
-                      failureIdentities:
-                        verification.verification.failureIdentities,
-                    },
-                  },
-                },
-                queuePosition: null,
-              },
-              lease,
-            );
-            this.#transition(
-              runId,
-              "paused",
-              `${operationId}:repair-attempts-exhausted:${task.task_id}`,
-              "repair-attempts-exhausted",
-              lease,
-            );
-            return this.#statusByRun(runId);
-          }
-          this.#leasedTransaction(lease, () => {
-            this.#database
-              .prepare(`INSERT INTO workflow_recovery_events(run_id, sequence, incident_key, kind)
-              SELECT ?, COALESCE(MAX(sequence), 0) + 1, ?, 'repair' FROM workflow_recovery_events WHERE run_id = ?`)
-              .run(runId, repairKey, runId);
-          });
-          const taskPlan = this.#taskPlan(task);
-          this.#setTask(
-            runId,
-            task.task_id,
-            {
-              state: "repairable",
-              phase: taskPlan.phases.refactor ? "refactor" : "green",
-              pauseCode: verification.code,
-              queuePosition: null,
-            },
-            lease,
-          );
-          this.#transition(
-            runId,
-            "running",
-            `${operationId}:repairable:${task.task_id}`,
-            undefined,
-            lease,
-          );
-          return this.#advance(runId, operationId, signal, lease, onActivity);
-        }
-      }
-      const approvalCodeInvalid =
-        verification.kind === "approval-needed" &&
-        !isWorkflowApprovalCode(verification.code);
-      const state =
-        verification.kind === "approval-needed" && !approvalCodeInvalid
-          ? "approval-needed"
-          : "paused";
-      const code = approvalCodeInvalid
-        ? "approval-code-invalid"
-        : verification.code;
-      this.#transition(
-        runId,
-        state,
-        `${operationId}:change-verification-${state}`,
-        code,
-        lease,
-      );
-      return this.#statusByRun(runId);
-    }
-    if (verification.currentWorkspaceRevisionId !== undefined) {
-      const currentWorkspaceRevisionId =
-        verification.currentWorkspaceRevisionId;
-      if (!SHA256.test(currentWorkspaceRevisionId)) {
-        throw new Error("workflow-verification-workspace-fact-invalid");
-      }
-      this.#leasedTransaction(lease, () => {
-        this.#database
-          .prepare(
-            `UPDATE workflow_engine_runs
-             SET current_workspace_revision = ?, cleanup_state = 'retained'
-             WHERE run_id = ?`,
-          )
-          .run(currentWorkspaceRevisionId, runId);
-      });
-      engineRun = this.#engineRun(runId);
-    }
-    this.#transition(
-      runId,
-      "ready-to-apply",
-      `${operationId}:ready-to-apply`,
-      undefined,
-      lease,
-    );
-    if (!this.#application) {
-      this.#transition(
-        runId,
-        "paused",
-        `${operationId}:application-unavailable`,
-        "application-unavailable",
-        lease,
-      );
-      return this.#statusByRun(runId);
-    }
-    const transactionId = `apply-${hash(
-      runId,
-      String(deliveryRevision),
-      operationId,
-    ).slice(0, 40)}`;
-    this.#leasedTransaction(lease, () => {
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs SET transaction_id = ? WHERE run_id = ?`,
-        )
-        .run(transactionId, runId);
-    });
-    const applicationInput = {
-      transactionId,
-      runId,
-      consumerRoot: this.#consumerRoot,
-      deliveryRevision,
-      plan: structuredClone(plan),
-      contextReadPaths: this.#contextReads(runId),
-      ...(engineRun.baseline_workspace_revision
-        ? { baselineRevisionId: engineRun.baseline_workspace_revision }
-        : {}),
-      ...(engineRun.current_workspace_revision
-        ? {
-            currentWorkspaceRevisionId: engineRun.current_workspace_revision,
-          }
-        : {}),
-      signal,
-    };
-    let application: Record<string, unknown>;
-    if (this.#application.prepare && this.#application.applyPrepared) {
-      const prepared = await this.#application.prepare(applicationInput);
-      this.#runStore.assertLease(lease);
-      if (prepared.state !== "prepared") {
-        return this.#settleApplication(
-          runId,
-          operationId,
-          prepared,
-          lease,
-          onActivity,
-        );
-      }
-      this.#transition(
-        runId,
-        "applying",
-        `${operationId}:applying`,
-        undefined,
-        lease,
-      );
-      emitWorkflowActivity(onActivity, {
-        state: "applying",
-        stage: projection.stage,
-        runId,
-        ...(projection.change ? { change: projection.change } : {}),
-        objective: projection.change
-          ? `apply change ${projection.change}`
-          : "apply workflow change",
-        legalCommands: ["status", "cancel", "discard"],
-      });
-      const active = this.#active.get(runId);
-      if (active) active.kind = "applying";
-      try {
-        application = await this.#application.applyPrepared(applicationInput);
-      } catch (error) {
-        this.#runStore.assertLease(lease);
-        if (this.#runStore.status(runId).state === "applying")
-          this.#transition(
-            runId,
-            "recovering",
-            `${operationId}:application-interrupted`,
-            "operation-interrupted",
-            lease,
-          );
-        throw error;
-      }
-    } else {
-      this.#transition(
-        runId,
-        "applying",
-        `${operationId}:applying`,
-        undefined,
-        lease,
-      );
-      emitWorkflowActivity(onActivity, {
-        state: "applying",
-        stage: projection.stage,
-        runId,
-        ...(projection.change ? { change: projection.change } : {}),
-        objective: projection.change
-          ? `apply change ${projection.change}`
-          : "apply workflow change",
-        legalCommands: ["status", "cancel", "discard"],
-      });
-      const active = this.#active.get(runId);
-      if (active) active.kind = "applying";
-      application = await this.#application.begin(applicationInput);
-    }
-    this.#runStore.assertLease(lease);
-    return this.#settleApplication(
-      runId,
-      operationId,
-      application,
-      lease,
-      onActivity,
-    );
-  }
-
-  #settleApplication(
-    runId: string,
-    operationId: string,
-    outcome: Record<string, unknown>,
-    lease: OperationLease,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Record<string, unknown> {
-    const state = outcome.state;
-    if (state === "completed") {
-      const current = this.#runStore.status(runId);
-      if (current.state === "recovering") {
-        this.#transition(
-          runId,
-          "completed",
-          `${operationId}:recovered-complete`,
-          undefined,
-          lease,
-        );
-      } else if (
-        current.state === "applying" ||
-        current.state === "ready-to-apply"
-      ) {
-        this.#transition(
-          runId,
-          "completed",
-          `${operationId}:apply-complete`,
-          undefined,
-          lease,
-        );
-      }
-      this.#cleanupTerminal(runId, operationId, lease);
-    } else if (state === "paused") {
-      if (this.#runStore.status(runId).state === "applying") {
-        this.#transition(
-          runId,
-          "recovering",
-          `${operationId}:apply-recovering`,
-          typeof outcome.code === "string" ? outcome.code : "recovery-required",
-          lease,
-        );
-        const recovering = this.#runStore.status(runId);
-        emitWorkflowActivity(onActivity, {
-          state: "recovering",
-          stage: recovering.stage,
-          runId,
-          ...(recovering.change ? { change: recovering.change } : {}),
-          objective: recovering.change
-            ? `recover change ${recovering.change}`
-            : "recover workflow application",
-          code:
-            typeof outcome.code === "string"
-              ? outcome.code
-              : "recovery-required",
-          legalCommands: ["status", "cancel", "discard"],
-        });
-      }
-      this.#transition(
-        runId,
-        "paused",
-        `${operationId}:apply-paused`,
-        typeof outcome.code === "string" ? outcome.code : "recovery-required",
-        lease,
-      );
-    } else if (state === "discarded") {
-      if (this.#runStore.status(runId).state === "applying") {
-        this.#transition(
-          runId,
-          "recovering",
-          `${operationId}:discard-recovering`,
-          "run-discarded",
-          lease,
-        );
-        const recovering = this.#runStore.status(runId);
-        emitWorkflowActivity(onActivity, {
-          state: "recovering",
-          stage: recovering.stage,
-          runId,
-          ...(recovering.change ? { change: recovering.change } : {}),
-          objective: recovering.change
-            ? `recover change ${recovering.change}`
-            : "recover workflow application",
-          code: "run-discarded",
-          legalCommands: ["status"],
-        });
-      }
-      this.#transition(
-        runId,
-        "discarded",
-        `${operationId}:apply-discarded`,
-        undefined,
-        lease,
-      );
-      this.#cleanupTerminal(runId, operationId, lease);
-    } else if (state === "recovering") {
-      this.#transition(
-        runId,
-        "recovering",
-        `${operationId}:application-recovering`,
-        typeof outcome.code === "string" ? outcome.code : "recovery-required",
-        lease,
-      );
-      const recovering = this.#runStore.status(runId);
-      emitWorkflowActivity(onActivity, {
-        state: "recovering",
-        stage: recovering.stage,
-        runId,
-        ...(recovering.change ? { change: recovering.change } : {}),
-        objective: recovering.change
-          ? `recover change ${recovering.change}`
-          : "recover workflow application",
-        code:
-          typeof outcome.code === "string" ? outcome.code : "recovery-required",
-        legalCommands: ["status", "cancel", "discard"],
-      });
-    } else {
-      throw new Error("workflow-application-outcome-invalid");
-    }
-    return this.#statusByRun(runId);
-  }
-
-  #applicationContext(runId: string): WorkflowApplicationContext {
-    const current = this.#engineRun(runId);
-    if (current.current_revision === null)
-      throw new Error("delivery-not-bound");
-    return {
-      runId,
-      deliveryRevision: current.current_revision,
-      plan: structuredClone(this.#currentPlan(runId)),
-      contextReadPaths: this.#contextReads(runId),
-      ...(current.baseline_workspace_revision
-        ? { baselineRevisionId: current.baseline_workspace_revision }
-        : {}),
-      ...(current.current_workspace_revision
-        ? { currentWorkspaceRevisionId: current.current_workspace_revision }
-        : {}),
-    };
-  }
-
-  #cleanupTerminal(
-    runId: string,
-    _currentOperationId: string,
-    lease?: OperationLease,
-  ): void {
-    if (lease) this.#runStore.assertLease(lease);
-    this.#lifecycle?.cleanup(runId);
-    const cleanup = () => {
-      this.#database
-        .prepare("DELETE FROM workflow_engine_tasks WHERE run_id = ?")
-        .run(runId);
-      this.#database
-        .prepare("DELETE FROM workflow_engine_deliveries WHERE run_id = ?")
-        .run(runId);
-      this.#database
-        .prepare(`DELETE FROM workspace_revisions WHERE owner_run_id = ?`)
-        .run(runId);
-      this.#database
-        .prepare(`DELETE FROM apply_transactions WHERE owner_run_id = ?`)
-        .run(runId);
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs
-           SET baseline_workspace_revision = NULL,
-               current_workspace_revision = NULL,
-               transaction_id = NULL, verification_json = NULL,
-               cleanup_state = 'complete'
-           WHERE run_id = ?`,
-        )
-        .run(runId);
-    };
-    if (lease) this.#leasedTransaction(lease, cleanup);
-    else this.#transaction(cleanup);
-  }
-
-  #waitForCapacity(signal: AbortSignal): Promise<void> {
-    if (signal.aborted || this.#activeTasks < LIMITS.maxActiveChildSessions)
-      return Promise.resolve();
-    return new Promise((resolve) => {
-      const wake = () => {
-        this.#capacityWaiters.delete(wake);
-        signal.removeEventListener("abort", wake);
-        resolve();
-      };
-      this.#capacityWaiters.add(wake);
-      signal.addEventListener("abort", wake, { once: true });
-    });
-  }
-
-  async #advance(
-    runId: string,
-    operationId: string,
-    signal: AbortSignal,
-    lease: OperationLease,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Promise<Record<string, unknown>> {
-    this.#transition(
-      runId,
-      "running",
-      `${operationId}:running`,
-      undefined,
-      lease,
-    );
-    const run = this.#runStore.status(runId);
-    emitWorkflowActivity(onActivity, {
-      state: "running",
-      stage: run.stage,
-      runId,
-      ...(run.change ? { change: run.change } : {}),
-      objective: run.change ? `change ${run.change}` : "workflow run",
-      legalCommands: ["status", "cancel", "discard"],
-    });
-    const existingVerification = this.#engineRun(runId).verification_json;
-    const repairStatus = existingVerification
-      ? normalizeWorkflowVerificationStatus(
-          JSON.parse(existingVerification) as unknown,
-        )
-      : undefined;
-    const retainsRepairContext =
-      repairStatus?.scope === "change-task-affected" &&
-      repairStatus.attribution === "introduced" &&
-      repairStatus.taskId !== undefined &&
-      this.#tasks(runId).some(
-        (task) =>
-          task.task_id === repairStatus.taskId && task.state !== "verified",
-      );
-    if (!retainsRepairContext) {
-      this.#setVerificationStatus(runId, null, lease);
-    }
-    const attempted = new Set<string>();
-    // Keep every launched operation owned until it settles, including failures.
-    // A fulfilled envelope avoids unhandled rejections while another task wins
-    // the race; the finally barrier also protects cancellation and storage close.
-    type Settlement =
-      | { taskId: string; status: "fulfilled" }
-      | { taskId: string; status: "rejected"; reason: unknown };
-    const pending = new Map<string, Promise<Settlement>>();
-    let firstFailure: { reason: unknown } | undefined;
-    try {
-      while (!signal.aborted) {
-        if (firstFailure) throw firstFailure.reason;
-        const rows = this.#tasks(runId);
-        const selected = selectRunnableTasks({
-          rows,
-          attempted,
-          activeTasks: this.#activeTasks,
-          capacity: LIMITS.maxActiveChildSessions,
-          nextQueuePosition: this.#engineRun(runId).next_queue_position,
-        });
-        const runnable = selected.runnable.map((taskId) => {
-          const row = rows.find((candidate) => candidate.task_id === taskId);
-          if (!row) throw new Error("scheduler-task-unavailable");
-          attempted.add(taskId);
-          return row;
-        });
-        for (const update of selected.updates) {
-          const row = rows.find(
-            (candidate) => candidate.task_id === update.taskId,
-          );
-          if (!row) throw new Error("scheduler-task-unavailable");
-          if (update.kind === "pending")
-            this.#setTask(
-              runId,
-              row.task_id,
-              { state: "pending", pauseCode: null, queuePosition: null },
-              lease,
-            );
-          else this.#queueTask(runId, row, lease, update.reason);
-        }
-        this.#activeTasks += runnable.length;
-        for (const row of runnable) {
-          const operation = this.#runTask(
-            runId,
-            row,
-            operationId,
-            signal,
-            lease,
-            onActivity,
-          )
-            .then<Settlement, Settlement>(
-              () => ({ taskId: row.task_id, status: "fulfilled" }),
-              (reason: unknown) => {
-                firstFailure ??= { reason };
-                return { taskId: row.task_id, status: "rejected", reason };
-              },
-            )
-            .finally(() => {
-              this.#activeTasks--;
-              for (const wake of this.#capacityWaiters) wake();
-            });
-          pending.set(row.task_id, operation);
-        }
-        if (pending.size > 0) {
-          const settled = await Promise.race([
-            ...pending.values(),
-            ...(selected.capacityBlocked
-              ? [this.#waitForCapacity(signal).then(() => null)]
-              : []),
-          ]);
-          if (settled === null) continue;
-          pending.delete(settled.taskId);
-          if (settled.status === "rejected") throw settled.reason;
-          continue;
-        }
-        if (selected.capacityBlocked) {
-          await this.#waitForCapacity(signal);
-          continue;
-        }
-        break;
-      }
-    } finally {
-      await Promise.all(pending.values());
-    }
-    if (firstFailure) throw firstFailure.reason;
-
-    if (signal.aborted) {
-      const current = this.#runStore.status(runId);
-      if (!["paused", "discarded", "completed"].includes(current.state)) {
-        this.#transition(
-          runId,
-          "paused",
-          `${operationId}:cancelled`,
-          "operation-cancelled",
-          lease,
-        );
-      }
-      return this.#statusByRun(runId);
-    }
-    const rows = this.#tasks(runId);
-    const paused = this.#firstPaused(rows);
-    if (paused) {
-      this.#transition(
-        runId,
-        paused.state === "approval-needed" ? "approval-needed" : "paused",
-        `${operationId}:task-paused:${paused.task_id}`,
-        paused.pause_code ?? "task-paused",
-        lease,
-      );
-      return this.#statusByRun(runId);
-    }
-    if (rows.every((row) => row.state === "verified")) {
-      return this.#finishChange(runId, operationId, signal, lease, onActivity);
-    }
-    this.#transition(
-      runId,
-      "paused",
-      `${operationId}:scheduler-stalled`,
-      "scheduler-integrity-paused",
-      lease,
-    );
-    return this.#statusByRun(runId);
-  }
-
-  #contextReads(runId: string, taskId?: string): string[] {
-    const rows =
-      taskId === undefined
-        ? this.#database
-            .prepare(
-              "SELECT DISTINCT path FROM workflow_context_reads WHERE run_id = ? ORDER BY path",
-            )
-            .all(runId)
-        : this.#database
-            .prepare(
-              "SELECT path FROM workflow_context_reads WHERE run_id = ? AND task_id = ? ORDER BY path",
-            )
-            .all(runId, taskId);
-    return rows.map((row) => String(row.path));
-  }
-
-  #phaseCount(plan: ImplementPlan): number {
-    return plan.tasks.reduce((sum, task) => sum + phases(task).length, 0);
-  }
-
-  #growWorkBudget(
-    database: DatabaseSync,
-    runId: string,
-    plan: ImplementPlan,
-  ): void {
-    const count = this.#phaseCount(plan);
-    database
-      .prepare(`INSERT INTO workflow_work_budget(run_id, used, max_work, phase_high_water, hard_limit, recovery_policy)
-      VALUES (?, 0, ?, ?, ?, 1) ON CONFLICT(run_id) DO UPDATE SET
-      phase_high_water = MAX(phase_high_water, excluded.phase_high_water),
-      max_work = MIN(hard_limit, MAX(max_work, 24 + 3 * MAX(phase_high_water, excluded.phase_high_water)))`)
-      .run(
-        runId,
-        Math.min(this.#workHardLimit, 24 + 3 * count),
-        count,
-        this.#workHardLimit,
-      );
-  }
-
-  #hasRecoveryGrant(runId: string, operationId: string, key: string): boolean {
-    return Boolean(
-      this.#database
-        .prepare(
-          "SELECT 1 FROM workflow_recovery_grants WHERE run_id = ? AND operation_id = ? AND incident_key = ? AND consumed = 0",
-        )
-        .get(runId, operationId, key),
-    );
-  }
-
-  #recoveryConditions(runId: string, key: string) {
-    const run = this.#engineRun(runId);
-    const task = this.#tasks(runId).find((row) =>
-      [
-        recoveryKey(this.#taskPlan(row), row.phase, row, run),
-        baselineRecoveryKey(this.#taskPlan(row), row.phase),
-      ].includes(key),
-    );
-    return {
-      route: task?.route_fingerprint ?? run.route_fingerprint,
-      context: task
-        ? hash(
-            canonicalJson(
-              snapshotFiles(
-                this.#consumerRoot,
-                this.#contextReads(runId, task.task_id),
-              ),
-            ),
-          )
-        : null,
-    };
-  }
-
-  #failureSequence(runId: string, key: string): number {
-    return (
-      this.#database
-        .prepare(
-          "SELECT COALESCE(MAX(sequence), 0) AS sequence FROM workflow_recovery_events WHERE run_id = ? AND incident_key = ?",
-        )
-        .get(runId, key) as { sequence: number }
-    ).sequence;
-  }
-
-  #grantRecovery(
-    runId: string,
-    operationId: string,
-    request: NonNullable<
-      Extract<ControlCommand, { command: "resume" }>["recovery"]
-    >,
-    lease: OperationLease,
-  ): void {
-    this.#leasedTransaction(lease, () => {
-      const incident = this.#recovery(runId, request.incidentKey);
-      const current = this.#tasks(runId).some(
-        (row) =>
-          ["paused", "retryable"].includes(row.state) &&
-          [
-            recoveryKey(
-              this.#taskPlan(row),
-              row.phase,
-              row,
-              this.#engineRun(runId),
-            ),
-            baselineRecoveryKey(this.#taskPlan(row), row.phase),
-          ].includes(request.incidentKey),
-      );
-      if (
-        !current ||
-        !incident ||
-        incident.failures < incident.feedback.maxAttempts ||
-        this.#failureSequence(runId, request.incidentKey) !==
-          request.failureSequence
-      )
-        throw new Error("recovery-request-stale");
-      const conditions = this.#database
-        .prepare(
-          "SELECT conditions_json FROM workflow_recovery_incidents WHERE run_id = ? AND incident_key = ?",
-        )
-        .get(runId, request.incidentKey) as { conditions_json: string };
-      const previous = JSON.parse(conditions.conditions_json);
-      const observed = this.#recoveryConditions(runId, request.incidentKey);
-      const budget = this.#database
-        .prepare(
-          "SELECT used, max_work FROM workflow_work_budget WHERE run_id = ?",
-        )
-        .get(runId) as { used: number; max_work: number };
-      const rejected = assessRecoveryGrant({
-        current,
-        incident,
-        failureSequence: this.#failureSequence(runId, request.incidentKey),
-        requestedSequence: request.failureSequence,
-        reason: request.reason,
-        previous,
-        observed,
-        budget,
-      });
-      if (rejected) throw new Error(rejected);
-      this.#database
-        .prepare(
-          "INSERT INTO workflow_recovery_grants(run_id, operation_id, incident_key, failure_sequence, reason) VALUES (?, ?, ?, ?, ?)",
-        )
-        .run(
-          runId,
-          operationId,
-          request.incidentKey,
-          request.failureSequence,
-          request.reason,
-        );
-    });
-  }
-
-  #reserveWork(
-    runId: string,
-    plan: ImplementPlan,
-    key: string,
-    lease: OperationLease,
-    grantOperationId?: string,
-  ): boolean {
-    return this.#leasedTransaction(lease, () => {
-      this.#growWorkBudget(this.#database, runId, plan);
-      const reserved = this.#database
-        .prepare(`UPDATE workflow_work_budget SET used = used + 1
-        WHERE run_id = ? AND used < max_work`)
-        .run(runId);
-      if (reserved.changes !== 1) return false;
-      if (grantOperationId) {
-        const consumed = this.#database
-          .prepare(
-            "UPDATE workflow_recovery_grants SET consumed = 1 WHERE run_id = ? AND operation_id = ? AND incident_key = ? AND consumed = 0",
-          )
-          .run(runId, grantOperationId, key);
-        if (consumed.changes !== 1) throw new Error("recovery-request-stale");
-      }
-      this.#database
-        .prepare(`INSERT INTO workflow_recovery_events(run_id, sequence, incident_key, kind)
-        SELECT ?, COALESCE(MAX(sequence), 0) + 1, ?, 'launch' FROM workflow_recovery_events WHERE run_id = ?`)
-        .run(runId, key, runId);
-      return true;
-    });
-  }
-
-  #recovery(runId: string, key: string): WorkflowRecoveryFact | undefined {
-    const row = this.#database
-      .prepare(
-        `SELECT failures, max_attempts, feedback_json FROM workflow_recovery_incidents
-       WHERE run_id = ? AND incident_key = ?`,
-      )
-      .get(runId, key) as
-      | { failures: number; max_attempts: number; feedback_json: string }
-      | undefined;
-    return row
-      ? {
-          key,
-          failures: row.failures,
-          feedback: {
-            ...JSON.parse(row.feedback_json),
-            maxAttempts: row.max_attempts,
-          },
-        }
-      : undefined;
-  }
-
-  #recordRecovery(
-    runId: string,
-    fact: WorkflowRecoveryFact,
-    lease: OperationLease,
-  ): void {
-    this.#leasedTransaction(lease, () => {
-      this.#database
-        .prepare(
-          `INSERT INTO workflow_recovery_incidents(run_id, incident_key, failures, max_attempts, feedback_json, conditions_json)
-         VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT(run_id, incident_key) DO UPDATE SET
-         failures = MAX(failures, excluded.failures), max_attempts = MIN(max_attempts, excluded.max_attempts), feedback_json = excluded.feedback_json, conditions_json = excluded.conditions_json`,
-        )
-        .run(
-          runId,
-          fact.key,
-          fact.failures,
-          fact.feedback.maxAttempts,
-          JSON.stringify(fact.feedback),
-          JSON.stringify(this.#recoveryConditions(runId, fact.key)),
-        );
-      this.#database
-        .prepare(
-          `INSERT INTO workflow_recovery_events(run_id, sequence, incident_key, kind)
-         SELECT ?, COALESCE(MAX(sequence), 0) + 1, ?, 'failure' FROM workflow_recovery_events WHERE run_id = ?`,
-        )
-        .run(runId, fact.key, runId);
-    });
-  }
-
-  #safeAttemptDiagnostic(
-    runId: string,
-    row: EngineTaskRow | undefined,
-  ): SafeAttemptDiagnostic | undefined {
-    if (!row) return undefined;
-    const diagnostic: SafeAttemptDiagnostic = row.attempt_diagnostic_json
-      ? (JSON.parse(row.attempt_diagnostic_json) as SafeAttemptDiagnostic)
-      : {};
-    delete diagnostic.recovery;
-    const recovery =
-      this.#recovery(
-        runId,
-        baselineRecoveryKey(this.#taskPlan(row), row.phase),
-      ) ??
-      this.#recovery(
-        runId,
-        recoveryKey(
-          this.#taskPlan(row),
-          row.phase,
-          row,
-          this.#engineRun(runId),
-        ),
-      );
-    if (recovery) diagnostic.recovery = recovery;
-    return Object.keys(diagnostic).length ? diagnostic : undefined;
-  }
-
-  #statusByRun(runId: string): Record<string, unknown> {
-    const projection = this.#runStore.status(runId);
-    const rows = this.#tasks(runId);
-    let engineRun: EngineRunRow | undefined;
-    try {
-      engineRun = this.#engineRun(runId);
-    } catch {
-      engineRun = undefined;
-    }
-    const attemptDiagnostics = new Map<string, SafeAttemptDiagnostic>();
-    const failureSequences = new Map<string, number>();
-    for (const row of rows) {
-      const diagnostic = this.#safeAttemptDiagnostic(runId, row);
-      if (!diagnostic) continue;
-      attemptDiagnostics.set(row.task_id, diagnostic);
-      if (diagnostic.recovery) {
-        const key = diagnostic.recovery.key;
-        failureSequences.set(key, this.#failureSequence(runId, key));
-      }
-    }
-    const amendmentUsed =
-      (
-        this.#database
-          .prepare(
-            "SELECT used FROM workflow_amendment_budget WHERE run_id = ?",
-          )
-          .get(runId) as { used: number } | undefined
-      )?.used ?? 0;
-    const resourceBudget = this.#database
-      .prepare(
-        "SELECT used, max_work AS maximum, phase_high_water AS phaseHighWater, hard_limit AS hardLimit FROM workflow_work_budget WHERE run_id = ?",
-      )
-      .get(runId) as WorkflowResourceBudget | undefined;
-    return projectWorkflowStatus({
-      projection,
-      rows,
-      engineRun,
-      attemptDiagnostics,
-      failureSequences,
-      amendmentUsed,
-      resourceBudget,
-    });
-  }
-
-  async #withAvailableDelivery(
-    outcome: Record<string, unknown>,
-    signal?: AbortSignal,
-  ): Promise<Record<string, unknown>> {
-    if (
-      outcome.stage !== "abel-implement" ||
-      (isRecord(outcome.pause) &&
-        outcome.pause.code === "operation-cancelled") ||
-      (outcome.state !== "approval-needed" &&
-        !(
-          outcome.state === "paused" &&
-          (isRecord(outcome.decisionBatch) ||
-            (isRecord(outcome.recovery) && outcome.recovery.exhausted === true))
-        )) ||
-      typeof outcome.change !== "string" ||
-      !this.#deliverySource.discoverLatest
-    ) {
-      return outcome;
-    }
-    let available: WorkflowAvailableDelivery | undefined;
-    try {
-      const discover = this.#deliverySource.discoverLatest;
-      const change = outcome.change;
-      available = await cancellableRead(
-        () =>
-          discover.call(this.#deliverySource, {
-            stage: "abel-implement",
-            change,
-            ...(signal ? { signal } : {}),
-          }),
-        signal,
-      );
-    } catch {
-      return outcome;
-    }
-    const currentRevision =
-      typeof outcome.deliveryRevision === "number"
-        ? outcome.deliveryRevision
-        : 0;
-    if (
-      !available ||
-      !Number.isSafeInteger(available.deliveryRevision) ||
-      available.deliveryRevision <= currentRevision ||
-      !SHA256.test(available.receiptHash)
-    ) {
-      return outcome;
-    }
-    if (
-      this.#database
-        .prepare(
-          "SELECT 1 FROM workflow_rejected_deliveries WHERE run_id = ? AND delivery_revision = ? AND receipt_hash = ?",
-        )
-        .get(
-          String(outcome.runId),
-          available.deliveryRevision,
-          available.receiptHash,
-        )
-    ) {
-      return outcome;
-    }
-    const conditionalCommands = (
-      Array.isArray(outcome.conditionalCommands)
-        ? outcome.conditionalCommands
-        : [{ command: "resume", stage: outcome.stage, change: outcome.change }]
-    ).map((entry) =>
-      isRecord(entry) && entry.command === "resume"
-        ? {
-            ...entry,
-            satisfiedBy: {
-              deliveryRevision: available.deliveryRevision,
-              receiptHash: available.receiptHash,
-            },
-          }
-        : entry,
-    );
-    return {
-      ...outcome,
-      legalCommands:
-        outcome.state === "approval-needed"
-          ? ["status", "resume", "discard"]
-          : ["status", "resume", "rebind", "discard"],
-      availableDelivery: structuredClone(available),
-      continuation:
-        (isRecord(outcome.resourceBudget) &&
-          outcome.resourceBudget.remaining === 0) ||
-        (isRecord(outcome.recovery) &&
-          outcome.recovery.code === "change-recovery-budget-exhausted")
-          ? undefined
-          : {
-              owner: "parent",
-              automatic: true,
-              command: "resume",
-              stage: "abel-implement",
-              change: outcome.change,
-            },
-      ...(conditionalCommands === undefined ? {} : { conditionalCommands }),
-    };
-  }
-
-  #launchAdvance(
-    runId: string,
-    operationId: string,
-    externalSignal?: AbortSignal,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Promise<Record<string, unknown>> {
-    const lease = this.#operationLease(runId, operationId);
-    const controller = new AbortController();
-    const abortFromExternal = () => {
-      controller.abort(
-        externalSignal?.reason ?? new Error("operation-cancelled"),
-      );
-    };
-    if (externalSignal?.aborted) abortFromExternal();
-    else
-      externalSignal?.addEventListener("abort", abortFromExternal, {
-        once: true,
-      });
-    const active: ActiveOperation = {
-      operationId,
-      kind: "work",
-      controller,
-      settled: Promise.resolve({}),
-    };
-    this.#active.set(runId, active);
-    const settled = (async () => {
-      try {
-        const outcome = await this.#advance(
-          runId,
-          operationId,
-          controller.signal,
-          lease,
-          onActivity,
-        );
-        return this.#commitOperation(runId, operationId, outcome);
-      } catch (error) {
-        this.#interruptOperation(runId, operationId);
-        const controlSettled =
-          controller.signal.aborted &&
-          controller.signal.reason instanceof Error &&
-          ["operation-cancelled", "run-discarded"].includes(
-            controller.signal.reason.message,
-          ) &&
-          (isCancellationException(error, controller.signal) ||
-            (error instanceof Error &&
-              ["lease-fenced", "operation-journal-fenced"].includes(
-                error.message,
-              )));
-        if (controlSettled) return this.#statusByRun(runId);
-        throw error;
-      } finally {
-        externalSignal?.removeEventListener("abort", abortFromExternal);
-        if (this.#active.get(runId) === active) this.#active.delete(runId);
-      }
-    })();
-    active.settled = settled;
-    return settled;
-  }
-
-  async #start(
-    command: Extract<ControlCommand, { command: "start" }>,
-    signal?: AbortSignal,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ) {
-    const existingRun = this.#lookupRun(command.stage, command.change);
-    if (existingRun) {
-      this.#ensureEngineRun(existingRun);
-      const replay = this.#operationReplay(
-        existingRun,
-        command.operationId,
-        command.command,
-      );
-      if (replay) return replay;
-      const restarted = this.#runStore.startRun({
-        stage: command.stage,
-        change: command.change,
-        operationId: command.operationId,
-      });
-      if (restarted.state !== "created") {
-        const begun = this.#beginOperation(
-          existingRun,
-          command.operationId,
-          command.command,
-        );
-        if (begun) return begun;
-        return this.#commitOperation(
-          existingRun,
-          command.operationId,
-          this.#statusByRun(existingRun),
-        );
-      }
-    }
-
-    const runId =
-      existingRun ??
-      this.#runStore.startRun({
-        stage: command.stage,
-        change: command.change,
-        operationId: command.operationId,
-      }).runId;
-    this.#ensureEngineRun(runId);
-    const begun = this.#beginOperation(
-      runId,
-      command.operationId,
-      command.command,
-    );
-    if (begun) return begun;
-    const lease = this.#operationLease(runId, command.operationId);
-    this.#transition(
-      runId,
-      "validating-delivery",
-      `${command.operationId}:validating-delivery`,
-      undefined,
-      lease,
-    );
-    emitWorkflowActivity(onActivity, {
-      state: "validating",
-      stage: command.stage,
-      runId,
-      change: command.change,
-      objective: `validate delivery ${command.change}`,
-      legalCommands: ["status", "cancel", "discard"],
-    });
-    try {
-      const delivery = await this.#loadDelivery(
-        runId,
-        lease,
-        command.stage,
-        command.change,
-        undefined,
-        undefined,
-        signal,
-      );
-      this.#admitDelivery(runId, delivery, lease);
-      this.#transition(
-        runId,
-        "ready",
-        `${command.operationId}:delivery-ready`,
-        undefined,
-        lease,
-      );
-      return this.#launchAdvance(
-        runId,
-        command.operationId,
-        signal,
-        onActivity,
-      );
-    } catch (error) {
-      const cancelled = this.#cancelledDelivery(
-        runId,
-        command.operationId,
-        error,
-        signal,
-        lease,
-      );
-      if (cancelled) return cancelled;
-      const failure = this.#deliveryFailure(
-        runId,
-        command.operationId,
-        error,
-        lease,
-      );
-      if (failure) {
-        return this.#commitOperation(runId, command.operationId, failure);
-      }
-      this.#interruptOperation(runId, command.operationId);
-      throw error;
-    }
-  }
-
-  async #resume(
-    command: Extract<ControlCommand, { command: "resume" }>,
-    signal?: AbortSignal,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ) {
-    const runId = this.#lookupRun(command.stage, command.change);
-    if (!runId) throw new Error("run-not-found");
-    this.#recoverLegacyContextApproval(runId);
-    const replay = this.#beginOperation(
-      runId,
-      command.operationId,
-      command.command,
-    );
-    if (replay) return replay;
-    const lease = this.#operationLease(runId, command.operationId);
-    const current = this.#runStore.status(runId);
-    if (current.state === "recovering") {
-      emitWorkflowActivity(onActivity, {
-        state: "recovering",
-        stage: current.stage,
-        runId,
-        ...(current.change ? { change: current.change } : {}),
-        objective: current.change
-          ? `recover change ${current.change}`
-          : "recover workflow application",
-        legalCommands: ["status", "cancel", "discard"],
-      });
-      const transactionId = this.#engineRun(runId).transaction_id;
-      if (!transactionId || !this.#application) {
-        this.#interruptOperation(runId, command.operationId);
-        throw new Error("apply-recovery-unavailable");
-      }
-      const recovered = await this.#application.recover(
-        transactionId,
-        this.#applicationContext(runId),
-      );
-      this.#runStore.assertLease(lease);
-      const outcome = this.#settleApplication(
-        runId,
-        command.operationId,
-        recovered,
-        lease,
-        onActivity,
-      );
-      return this.#commitOperation(runId, command.operationId, outcome);
-    }
-    if (
-      !["paused", "retryable", "approval-needed", "ready"].includes(
-        current.state,
-      )
-    ) {
-      this.#interruptOperation(runId, command.operationId);
-      throw new Error("resume-not-allowed");
-    }
-    try {
-      const engineRevision = this.#engineRun(runId).current_revision;
-      const projectedRevision = current.deliveryRevision;
-      if (
-        command.deliveryRevision === undefined &&
-        (current.state === "approval-needed" ||
-          this.#statusByRun(runId).decisionBatch !== undefined ||
-          this.#statusByRun(runId).recovery !== undefined) &&
-        this.#deliverySource.discoverLatest
-      ) {
-        const available = await this.#deliverySource.discoverLatest({
-          stage: command.stage,
-          change: command.change,
-          signal,
-        });
-        this.#runStore.assertLease(lease);
-        if (available && available.deliveryRevision > (engineRevision ?? 0)) {
-          command = {
-            ...command,
-            deliveryRevision: available.deliveryRevision,
-            receiptHash: available.receiptHash,
-          };
-        }
-      }
-      const deliveryOutOfSync =
-        projectedRevision !== undefined && projectedRevision !== engineRevision;
-      if (
-        current.state === "approval-needed" &&
-        (command.deliveryRevision === undefined ||
-          command.receiptHash === undefined ||
-          command.deliveryRevision <=
-            (engineRevision ?? projectedRevision ?? 0))
-      ) {
-        this.#interruptOperation(runId, command.operationId);
-        throw new Error("approval-receipt-required");
-      }
-      if (
-        command.deliveryRevision !== undefined ||
-        engineRevision === null ||
-        deliveryOutOfSync
-      ) {
-        this.#transition(
-          runId,
-          "validating-delivery",
-          `${command.operationId}:validating-delivery`,
-          undefined,
-          lease,
-        );
-        emitWorkflowActivity(onActivity, {
-          state: "validating",
-          stage: command.stage,
-          runId,
-          change: command.change,
-          objective: `validate delivery ${command.change}`,
-          legalCommands: ["status", "cancel", "discard"],
-        });
-        const requestedRevision =
-          command.deliveryRevision ??
-          (deliveryOutOfSync ? projectedRevision : undefined);
-        const projectedBinding = current.deliveryBindings.find(
-          (binding) =>
-            binding.gate === "gate-b" && binding.revision === requestedRevision,
-        );
-        const delivery = await this.#loadDelivery(
-          runId,
-          lease,
-          command.stage,
-          command.change,
-          requestedRevision,
-          command.receiptHash ?? projectedBinding?.receiptHash,
-          signal,
-        );
-        this.#admitDelivery(runId, delivery, lease);
-      }
-      if (command.recovery)
-        this.#grantRecovery(
-          runId,
-          command.operationId,
-          command.recovery,
-          lease,
-        );
-      this.#transition(
-        runId,
-        "ready",
-        `${command.operationId}:resume-ready`,
-        undefined,
-        lease,
-      );
-      return this.#launchAdvance(
-        runId,
-        command.operationId,
-        signal,
-        onActivity,
-      );
-    } catch (error) {
-      const cancelled = this.#cancelledDelivery(
-        runId,
-        command.operationId,
-        error,
-        signal,
-        lease,
-      );
-      if (cancelled) return cancelled;
-      const failure = this.#deliveryFailure(
-        runId,
-        command.operationId,
-        error,
-        lease,
-      );
-      if (failure) {
-        return this.#commitOperation(runId, command.operationId, failure);
-      }
-      // A revised delivery may invalidate a grant. Retain its admitted facts,
-      // but never leave a rejected resume looking ready or still validating.
-      if (
-        error instanceof Error &&
-        [
-          "recovery-request-stale",
-          "recovery-evidence-unavailable",
-          "change-work-budget-exhausted",
-        ].includes(error.message) &&
-        this.#runStore.status(runId).state === "validating-delivery"
-      ) {
-        this.#transition(
-          runId,
-          "paused",
-          `${command.operationId}:recovery-rejected`,
-          error.message,
-          lease,
-        );
-      }
-      this.#interruptOperation(runId, command.operationId);
-      throw error;
-    }
-  }
-
-  #rebind(command: Extract<ControlCommand, { command: "rebind" }>) {
-    const runId = this.#lookupRun(command.stage, command.change);
-    if (!runId) throw new Error("run-not-found");
-    const replay = this.#beginOperation(
-      runId,
-      command.operationId,
-      command.command,
-    );
-    if (replay) return replay;
-    const lease = this.#operationLease(runId, command.operationId);
-    const state = this.#runStore.status(runId).state;
-    if (!["paused", "retryable"].includes(state)) {
-      this.#interruptOperation(runId, command.operationId);
-      throw new Error("rebind-not-allowed");
-    }
-    const task = this.#tasks(runId).find((row) =>
-      ["paused", "retryable"].includes(row.state),
-    );
-    if (!task) {
-      this.#interruptOperation(runId, command.operationId);
-      throw new Error("rebind-task-unavailable");
-    }
-    const rebound = this.#worker.rebind({
-      runId,
-      taskId: task.task_id,
-      task: structuredClone(this.#taskPlan(task)),
-      role: "implementation-worker",
-      routeId: command.routeId,
-    });
-    if (!rebound.ok) {
-      this.#interruptOperation(runId, command.operationId);
-      throw new Error(rebound.code);
-    }
-    const routeId = rebound.routeId ?? rebound.route?.id ?? command.routeId;
-    const routeFingerprint =
-      rebound.routeFingerprint ?? rebound.route?.fingerprint;
-    if (
-      !IDENTIFIER.test(routeId) ||
-      (routeFingerprint !== undefined && !SHA256.test(routeFingerprint))
-    ) {
-      this.#interruptOperation(runId, command.operationId);
-      throw new Error("route-rebind-result-invalid");
-    }
-    const priorRouteId = task.route_id ?? this.#engineRun(runId).route_id;
-    const priorRouteFingerprint =
-      task.route_fingerprint ?? this.#engineRun(runId).route_fingerprint;
-    this.#leasedTransaction(lease, () => {
-      this.#setTask(runId, task.task_id, {
-        routeId,
-        routeFingerprint: routeFingerprint ?? null,
-      });
-      this.#database
-        .prepare(
-          `UPDATE workflow_engine_runs
-           SET route_id = ?, route_fingerprint = ? WHERE run_id = ?`,
-        )
-        .run(routeId, routeFingerprint ?? null, runId);
-    });
-    const outcome = {
-      ...this.#statusByRun(runId),
-      routeBinding: {
-        routeId,
-        ...(routeFingerprint ? { routeFingerprint } : {}),
-      },
-      operation: {
-        kind: "route-rebound",
-        ...(priorRouteId ? { priorRouteId } : {}),
-        ...(priorRouteFingerprint ? { priorRouteFingerprint } : {}),
-        routeId,
-        ...(routeFingerprint ? { routeFingerprint } : {}),
-      },
-    };
-    return this.#commitOperation(runId, command.operationId, outcome);
-  }
-
-  async #controlApply(
-    runId: string,
-    operationId: string,
-    intent: "cancel" | "discard",
-    lease: OperationLease,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Promise<Record<string, unknown>> {
-    const transactionId = this.#engineRun(runId).transaction_id;
-    if (!transactionId || !this.#application) {
-      throw new Error("apply-recovery-unavailable");
-    }
-    const context = this.#applicationContext(runId);
-    this.#application.requestControl(transactionId, intent, context);
-    const active = this.#active.get(runId);
-    if (active && active.operationId !== operationId) {
-      active.controller.abort(
-        new Error(
-          intent === "cancel" ? "operation-cancelled" : "run-discarded",
-        ),
-      );
-    }
-    if (this.#runStore.status(runId).state === "applying") {
-      this.#transition(
-        runId,
-        "recovering",
-        `${operationId}:${intent}-recovering`,
-        intent === "cancel" ? "operation-cancelled" : "run-discarded",
-        lease,
-      );
-      const recovering = this.#runStore.status(runId);
-      emitWorkflowActivity(onActivity, {
-        state: "recovering",
-        stage: recovering.stage,
-        runId,
-        ...(recovering.change ? { change: recovering.change } : {}),
-        objective: recovering.change
-          ? `recover change ${recovering.change}`
-          : "recover workflow application",
-        code: intent === "cancel" ? "operation-cancelled" : "run-discarded",
-        legalCommands: ["status"],
-      });
-    }
-    const recovered = await this.#application.recover(transactionId, context);
-    this.#runStore.assertLease(lease);
-    return this.#settleApplication(
-      runId,
-      operationId,
-      recovered,
-      lease,
-      onActivity,
-    );
-  }
-
-  async #abortActiveOperation(runId: string, reason: Error): Promise<void> {
-    const pending: Promise<unknown>[] = [];
-    const amendment = this.#amendments.get(runId);
-    if (amendment) pending.push(amendment);
-    for (const [controller, entry] of this.#commands) {
-      if (
-        !["start", "resume"].includes(entry.command.command) ||
-        this.#lookupRun(entry.command.stage, entry.command.change) !== runId
-      )
-        continue;
-      controller.abort(reason);
-      pending.push(entry.settled);
-    }
-    const active = this.#active.get(runId);
-    if (active) {
-      active.controller.abort(reason);
-      pending.push(active.settled);
-    }
-    const results = await Promise.allSettled(pending);
-    for (const result of results) {
-      if (result.status !== "rejected") continue;
-      const error = result.reason;
-      if (
-        error !== reason &&
-        !(
-          error instanceof Error &&
-          ["lease-fenced", "operation-journal-fenced"].includes(error.message)
-        )
-      )
-        throw error;
-    }
-  }
-
-  async #cancel(
-    command: Extract<ControlCommand, { command: "cancel" }>,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ) {
-    const runId = this.#lookupRun(command.stage, command.change);
-    if (!runId) throw new Error("run-not-found");
-    const replay = this.#beginOperation(
-      runId,
-      command.operationId,
-      command.command,
-    );
-    if (replay) return replay;
-    const lease = this.#operationLease(runId, command.operationId);
-    const state = this.#runStore.status(runId).state;
-    let outcome: Record<string, unknown>;
-    if (state === "applying" || state === "recovering") {
-      outcome = await this.#controlApply(
-        runId,
-        command.operationId,
-        "cancel",
-        lease,
-        onActivity,
-      );
-    } else {
-      const activeSettlement = this.#abortActiveOperation(
-        runId,
-        new Error("operation-cancelled"),
-      );
-      const current = this.#runStore.status(runId);
-      if (
-        !["paused", "discarded", "completed", "rejected"].includes(
-          current.state,
-        )
-      ) {
-        this.#transition(
-          runId,
-          "paused",
-          `${command.operationId}:cancelled`,
-          "operation-cancelled",
-          lease,
-        );
-      }
-      await activeSettlement;
-      for (const task of this.#tasks(runId)) {
-        if (
-          ["phase-ready", "phase-running", "validating"].includes(task.state)
-        ) {
-          this.#setTask(
-            runId,
-            task.task_id,
-            {
-              state: "paused",
-              pauseCode: "operation-cancelled",
-              queuePosition: null,
-            },
-            lease,
-          );
-        }
-      }
-      outcome = this.#statusByRun(runId);
-    }
-    outcome = {
-      ...outcome,
-      operation: { kind: "operation-cancelled" },
-    };
-    return this.#commitOperation(runId, command.operationId, outcome);
-  }
-
-  async #discard(
-    command: Extract<ControlCommand, { command: "discard" }>,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ) {
-    const runId = this.#lookupRun(command.stage, command.change);
-    if (!runId) throw new Error("run-not-found");
-    const replay = this.#beginOperation(
-      runId,
-      command.operationId,
-      command.command,
-    );
-    if (replay) return replay;
-    const lease = this.#operationLease(runId, command.operationId);
-    const state = this.#runStore.status(runId).state;
-    let outcome: Record<string, unknown>;
-    if (state === "applying" || state === "recovering") {
-      outcome = await this.#controlApply(
-        runId,
-        command.operationId,
-        "discard",
-        lease,
-        onActivity,
-      );
-    } else {
-      const activeSettlement = this.#abortActiveOperation(
-        runId,
-        new Error("run-discarded"),
-      );
-      const current = this.#runStore.status(runId);
-      if (current.state !== "discarded") {
-        if (["completed", "rejected"].includes(current.state)) {
-          this.#interruptOperation(runId, command.operationId);
-          throw new Error("discard-not-allowed");
-        }
-        this.#transition(
-          runId,
-          "discarded",
-          `${command.operationId}:discarded`,
-          undefined,
-          lease,
-        );
-        await activeSettlement;
-        this.#cleanupTerminal(runId, command.operationId, lease);
-      } else {
-        await activeSettlement;
-      }
-      outcome = this.#statusByRun(runId);
-    }
-    return this.#commitOperation(runId, command.operationId, outcome);
-  }
-
-  execute(
-    value: unknown,
-    signal?: AbortSignal,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Promise<Record<string, unknown>> {
-    let command: ControlCommand;
-    try {
-      this.#assertOpen();
-      if (this.#closing) throw new Error("workflow-engine-closed");
-      command = assertControlCommand(value);
-    } catch (error) {
-      return Promise.reject(error);
-    }
-    const controller = new AbortController();
-    const onAbort = () => controller.abort(signal?.reason);
-    if (signal?.aborted) onAbort();
-    else signal?.addEventListener("abort", onAbort, { once: true });
-    // Register before execution can yield or invoke external callbacks.
-    const settled = Promise.resolve()
-      .then(() => this.#executeCommand(command, controller.signal, onActivity))
-      .finally(() => {
-        signal?.removeEventListener("abort", onAbort);
-        this.#commands.delete(controller);
-      });
-    this.#commands.set(controller, { command, settled });
-    return settled;
-  }
-
-  async #executeCommand(
-    command: ControlCommand,
-    signal?: AbortSignal,
-    onActivity?: (event: WorkflowActivityUpdate) => void,
-  ): Promise<Record<string, unknown>> {
-    switch (command.command) {
-      case "start":
-        return this.#withAvailableDelivery(
-          await this.#start(command, signal, onActivity),
-          signal,
-        );
-      case "status": {
-        const runId = this.#lookupRun(command.stage, command.change);
-        if (!runId) {
-          return {
-            stage: command.stage,
-            change: command.change,
-            state: "not-started",
-            durable: true,
-            completed: false,
-            legalCommands: ["start"],
-            tasks: [],
-            queue: [],
-          };
-        }
-        this.#recoverLegacyContextApproval(runId);
-        return this.#withAvailableDelivery(this.#statusByRun(runId), signal);
-      }
-      case "resume":
-        return this.#withAvailableDelivery(
-          await this.#resume(command, signal, onActivity),
-          signal,
-        );
-      case "rebind":
-        return this.#rebind(command);
-      case "cancel":
-        return this.#cancel(command, onActivity);
-      case "discard":
-        return this.#discard(command, onActivity);
-    }
-  }
-
-  prepareBootstrapHandoff(
-    input: Record<string, unknown>,
-  ): Record<string, unknown> {
-    this.#assertOpen();
-    const acceptanceFacts = normalizeBootstrapAcceptanceFacts(
-      input.acceptanceFacts,
-    );
-    const workspaceManifestHash =
-      typeof input.workspaceManifestHash === "string" &&
-      SHA256.test(input.workspaceManifestHash)
-        ? input.workspaceManifestHash
-        : undefined;
-    if (
-      typeof input.operationId !== "string" ||
-      !IDENTIFIER.test(input.operationId) ||
-      typeof input.runId !== "string" ||
-      typeof input.change !== "string" ||
-      !CHANGE_NAME.test(input.change) ||
-      typeof input.receiptHash !== "string" ||
-      !SHA256.test(input.receiptHash) ||
-      typeof input.graphHash !== "string" ||
-      !SHA256.test(input.graphHash) ||
-      typeof input.acceptanceHash !== "string" ||
-      !SHA256.test(input.acceptanceHash) ||
-      (acceptanceFacts !== undefined) !==
-        (workspaceManifestHash !== undefined) ||
-      (acceptanceFacts !== undefined &&
-        workspaceManifestHash !== undefined &&
-        bootstrapAcceptanceHash(acceptanceFacts, workspaceManifestHash) !==
-          input.acceptanceHash)
-    ) {
-      throw new Error("bootstrap-handoff-invalid");
-    }
-    this.#runStore.status(input.runId);
-    const existing = this.#database
-      .prepare(
-        `SELECT handoff_id, owner_run_id, receipt_hash, state, facts_json
-         FROM bootstrap_handoffs WHERE receipt_hash = ?`,
-      )
-      .get(input.receiptHash) as BootstrapRow | undefined;
-    if (existing) {
-      const outcome = parseJsonRecord(existing.facts_json);
-      const existingAcceptanceFacts = normalizeBootstrapAcceptanceFacts(
-        outcome.acceptanceFacts,
-      );
-      const storedBindingValid =
-        outcome.handoffId === existing.handoff_id &&
-        outcome.runId === existing.owner_run_id &&
-        outcome.receiptHash === existing.receipt_hash &&
-        outcome.selectorBeforeCutover === "bootstrap" &&
-        existing.state === "prepared" &&
-        outcome.state === "prepared" &&
-        outcome.selectorCasPending === true;
-      if (!storedBindingValid) throw new Error("bootstrap-handoff-invalid");
-      const stableBindingMatches =
-        existing.owner_run_id === input.runId &&
-        outcome.change === input.change &&
-        outcome.graphHash === input.graphHash;
-      if (!stableBindingMatches) {
-        throw new Error("bootstrap-handoff-conflict");
-      }
-      const acceptanceMatches =
-        outcome.acceptanceHash === input.acceptanceHash &&
-        canonicalJson(existingAcceptanceFacts ?? null) ===
-          canonicalJson(acceptanceFacts ?? null) &&
-        outcome.workspaceManifestHash === workspaceManifestHash;
-      if (acceptanceMatches) return structuredClone(outcome);
-      if (
-        existing.state !== "prepared" ||
-        outcome.state !== "prepared" ||
-        outcome.selectorBeforeCutover !== "bootstrap" ||
-        outcome.selectorCasPending !== true ||
-        acceptanceFacts === undefined ||
-        workspaceManifestHash === undefined
-      ) {
-        throw new Error("bootstrap-handoff-conflict");
-      }
-      const refreshedHandoffId = `handoff-${hash(
-        input.runId,
-        input.receiptHash,
-        input.graphHash,
-        input.acceptanceHash,
-        workspaceManifestHash,
-      ).slice(0, 40)}`;
-      const refreshed = {
-        ...outcome,
-        handoffId: refreshedHandoffId,
-        acceptanceHash: input.acceptanceHash,
-        acceptanceFacts,
-        workspaceManifestHash,
-      };
-      this.#transaction(() => {
-        const result = this.#database
-          .prepare(
-            `UPDATE bootstrap_handoffs
-             SET handoff_id = ?, facts_json = ?
-             WHERE handoff_id = ? AND state = 'prepared' AND facts_json = ?`,
-          )
-          .run(
-            refreshedHandoffId,
-            JSON.stringify(refreshed),
-            existing.handoff_id,
-            existing.facts_json,
-          );
-        if (Number(result.changes) !== 1) {
-          throw new Error("bootstrap-handoff-conflict");
-        }
-      });
-      return structuredClone(refreshed);
-    }
-    const handoffId = `handoff-${hash(
-      input.runId,
-      input.receiptHash,
-      input.graphHash,
-      input.acceptanceHash,
-      workspaceManifestHash ?? "acceptance-pending",
-    ).slice(0, 40)}`;
-    const outcome = {
-      handoffId,
-      state: "prepared",
-      runId: input.runId,
-      change: input.change,
-      receiptHash: input.receiptHash,
-      graphHash: input.graphHash,
-      acceptanceHash: input.acceptanceHash,
-      ...(acceptanceFacts ? { acceptanceFacts } : {}),
-      ...(workspaceManifestHash ? { workspaceManifestHash } : {}),
-      selectorBeforeCutover: "bootstrap",
-      selectorCasPending: true,
-    };
-    const preparedRows = this.#database
-      .prepare(
-        `SELECT handoff_id, owner_run_id, receipt_hash, state, facts_json
-         FROM bootstrap_handoffs WHERE state = 'prepared'
-         ORDER BY handoff_id`,
-      )
-      .all() as unknown as BootstrapRow[];
-    if (preparedRows.length > 0) throw new Error("bootstrap-handoff-conflict");
-    this.#transaction(() => {
-      this.#database
-        .prepare(
-          `INSERT INTO bootstrap_handoffs(
-             handoff_id, owner_run_id, receipt_hash, state, facts_json
-           ) VALUES (?, ?, ?, 'prepared', ?)`,
-        )
-        .run(
-          handoffId,
-          String(input.runId),
-          String(input.receiptHash),
-          JSON.stringify(outcome),
-        );
-    });
-    return structuredClone(outcome);
-  }
-
-  inspectBootstrapHandoff(receiptHash: string): Record<string, unknown> {
-    this.#assertOpen();
-    if (!SHA256.test(receiptHash)) throw new Error("bootstrap-handoff-invalid");
-    const row = this.#database
-      .prepare(
-        `SELECT facts_json FROM bootstrap_handoffs WHERE receipt_hash = ?`,
-      )
-      .get(receiptHash) as { facts_json: string } | undefined;
-    if (!row) throw new Error("bootstrap-handoff-not-found");
-    return parseJsonRecord(row.facts_json);
-  }
-
-  close(): Promise<void> {
-    if (this.#closing) return this.#closing;
-    if (this.#closed) return Promise.resolve();
-    this.#closing = Promise.resolve().then(async () => {
-      if (this.#orphanRecoveryTimer) {
-        clearTimeout(this.#orphanRecoveryTimer);
-        this.#orphanRecoveryTimer = undefined;
-      }
-      const reason = new Error("workflow-engine-closed");
-      const commands = [...this.#commands];
-      for (const [controller] of commands) controller.abort(reason);
-      const active = [...this.#active.values()];
-      for (const operation of active) operation.controller.abort(reason);
-      await Promise.allSettled(commands.map(([, entry]) => entry.settled));
-      await Promise.allSettled(active.map((operation) => operation.settled));
-      await Promise.allSettled([...this.#amendments.values()]);
-      for (const held of this.#operationLeases.values())
-        clearInterval(held.timer);
-      this.#operationLeases.clear();
-      this.#lifecycle?.close?.();
-      this.#database.close();
-      this.#runStore.close();
-      this.#closed = true;
-    });
-    return this.#closing;
-  }
-}