@hasna/workflows 0.1.3 → 0.2.0

package/dist/index.js

@@ -17,22 +17,42 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // src/lanes/types.ts
-import { statSync } from "fs";
+import { statSync as statSync2 } from "fs";
 function binaryOnPath(binary) {
   const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
   for (const entry of pathEntries) {
     try {
-      const stat = statSync(`${entry}/${binary}`);
+      const stat = statSync2(`${entry}/${binary}`);
       if (stat.isFile())
         return true;
     } catch {}
   }
   return false;
 }
-function withTimeout(promise, timeoutMs, what) {
+function subscriptionEnvironment(overrides = {}) {
+  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
+  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
+      env[name] = value;
+  }
+  for (const [name, value] of Object.entries(overrides)) {
+    if (paid.test(name) || sensitive.test(name))
+      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
+    env[name] = value;
+  }
+  return env;
+}
+function subscriptionSdkEnvironment(overrides = {}) {
+  const safe = subscriptionEnvironment(overrides);
+  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
+}
+function withTimeout(promise, timeoutMs, what, cancel) {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
-      reject(new Error(`${what} exceeded the ${timeoutMs}ms budget`));
+      cancel?.();
+      reject(new LaneTimeoutError(what, timeoutMs));
     }, timeoutMs);
     promise.then((value) => {
       clearTimeout(timer);
@@ -43,15 +63,16 @@ function withTimeout(promise, timeoutMs, what) {
     });
   });
 }
-function spawnCli(cmd, opts) {
+async function spawnCli(cmd, opts) {
   const started = Date.now();
   const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
   let proc;
   try {
-    proc = Bun.spawnSync({
+    proc = Bun.spawn({
       cmd,
       cwd: opts.cwd,
-      env: { ...process.env, ...opts.env ?? {} },
+      env: subscriptionEnvironment(opts.env),
+      stdin: "ignore",
       stdout: "pipe",
       stderr: "pipe",
       timeout: timeoutMs
@@ -63,15 +84,16 @@ function spawnCli(cmd, opts) {
     }
     return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
   }
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
   const output = stderr ? `${stdout}
 ${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? 1;
-  return { ok: exitCode === 0, exitCode, output, durationMs };
+  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
 }
-var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000;
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
 var init_types = __esm(() => {
   LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
   LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
@@ -86,6 +108,12 @@ var init_types = __esm(() => {
       this.name = "LaneAdapterShapeError";
     }
   };
+  LaneTimeoutError = class LaneTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+      super(`${what} exceeded the ${timeoutMs}ms budget`);
+      this.name = "LaneTimeoutError";
+    }
+  };
 });
 
 // src/lanes/claude.ts
@@ -127,11 +155,12 @@ function createClaudeAdapter(deps = {}) {
         throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
       }
       const prompt = job.prompt;
+      const abortController = new AbortController;
       try {
         const { output, isError } = await withTimeout((async () => {
           const generator = await query({
             prompt,
-            options: { model: job.model, maxTurns: 32, abortSignal: undefined }
+            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
           });
           let output2 = "";
           let isError2 = false;
@@ -150,19 +179,19 @@ function createClaudeAdapter(deps = {}) {
               isError2 = true;
           }
           return { output: output2, isError: isError2 };
-        })(), timeoutMs, `claude lane (${job.prompt.slice(0, 60)})`);
+        })(), timeoutMs, "claude lane", () => abortController.abort());
         const durationMs = Date.now() - started;
         return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
       } catch (err) {
         const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
   };
 }
-function runClaudeCli(job, cliPath, started, timeoutMs) {
+async function runClaudeCli(job, cliPath, started, timeoutMs) {
   try {
-    const result = spawnCli([cliPath, "-p", job.prompt], {
+    const result = await spawnCli([cliPath, "-p", job.prompt], {
       binaryName: cliPath,
       packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
       timeoutMs,
@@ -219,29 +248,30 @@ function createCodexAdapter(deps = {}) {
       if (typeof CodexClass !== "function") {
         throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
       }
+      const abortController = new AbortController;
       try {
         const client = await withTimeout(Promise.resolve(new CodexClass({
           config: { model: job.model },
-          env: job.env
-        })), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const thread = client.startThread?.();
+          env: subscriptionEnvironment(job.env)
+        })), timeoutMs, "codex lane");
+        const thread = client.startThread?.({ model: job.model, workingDirectory: job.cwd });
         if (!thread || typeof thread.run !== "function") {
           throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
         }
-        const turn = await withTimeout(thread.run(job.prompt), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
+        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
         const output = turn?.finalResponse ?? "";
         const durationMs = Date.now() - started;
         return { ok: true, exitCode: 0, output, durationMs };
       } catch (err) {
         const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
   };
 }
-function runCodexCli(job, cliPath, started, timeoutMs) {
+async function runCodexCli(job, cliPath, started, timeoutMs) {
   try {
-    const result = spawnCli([cliPath, "exec", "--", job.prompt], {
+    const result = await spawnCli([cliPath, "exec", "--", job.prompt], {
       binaryName: cliPath,
       packageHint: "@openai/codex-sdk or the codex CLI",
       timeoutMs,
@@ -285,6 +315,8 @@ function createCursorAdapter(deps = {}) {
       if (!job.prompt) {
         return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
       }
+      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
       const started = Date.now();
       const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
       const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
@@ -294,38 +326,63 @@ function createCursorAdapter(deps = {}) {
       } catch {
         return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
       }
+      let cancel;
       try {
-        const run = await withTimeout(runLocalAgent(sdk, job), timeoutMs, `cursor lane (${job.prompt.slice(0, 60)})`);
+        subscriptionEnvironment(job.env);
+        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
+          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
+        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
+          cancel = callback;
+        }), timeoutMs, "cursor lane", () => cancel?.());
         const durationMs = Date.now() - started;
-        const status = run?.status ?? "finished";
+        const status = run2.status;
         const ok = status === "finished";
-        return { ok, exitCode: ok ? 0 : 1, output: run?.result ?? "", durationMs };
+        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
       } catch (err) {
+        if (err instanceof LaneAdapterShapeError)
+          throw err;
         const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
   };
 }
-async function runLocalAgent(sdk, job) {
+async function runLocalAgent(sdk, job, onCancel) {
   const AgentClass = sdk.Agent;
   const CursorClass = sdk.Cursor;
   if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
     throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
   }
-  const agent = typeof AgentClass === "function" ? new AgentClass : undefined;
+  const create = AgentClass.create;
+  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
   if (!agent || typeof agent.send !== "function") {
     throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
   }
-  const run = await agent.send(job.prompt, { model: job.model });
-  if (!run || typeof run !== "object") {
+  let run2 = await agent.send(job.prompt, { model: job.model });
+  if (run2 && typeof run2 === "object") {
+    const handle = run2;
+    if (typeof handle.cancel === "function")
+      onCancel(() => {
+        handle.cancel().catch(() => {});
+      });
+    if (typeof handle.wait === "function")
+      run2 = await handle.wait();
+  }
+  if (!run2 || typeof run2 !== "object") {
     throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
   }
-  return run;
+  const candidate = run2;
+  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
+    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
+  }
+  if (typeof candidate.result !== "string") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
+  }
+  return { status: candidate.status, result: candidate.result };
 }
-function runCursorCli(job, cliPath, started, timeoutMs) {
+async function runCursorCli(job, cliPath, started, timeoutMs) {
   try {
-    const result = spawnCli([cliPath, "run", job.prompt], {
+    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
       binaryName: cliPath,
       packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
       timeoutMs,
@@ -368,7 +425,7 @@ function createGrokAdapter(deps = {}) {
       const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
       const cliPath = deps.cliPath ?? "grok";
       try {
-        const result = spawnCli([cliPath, job.prompt], {
+        const result = await spawnCli([cliPath, job.prompt], {
           binaryName: cliPath,
           packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
           timeoutMs,
@@ -439,10 +496,13 @@ var init_lanes = __esm(() => {
     ["grok", createGrokAdapter()]
   ]);
 });
+
+// src/service.ts
+import { createHash as createHash3 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/workflows",
-  version: "0.1.3",
+  version: "0.2.0",
   description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
   type: "module",
   main: "./dist/index.js",
@@ -458,8 +518,8 @@ var package_default = {
       import: "./dist/index.js"
     },
     "./sdk": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
+      types: "./types/sdk.d.ts",
+      import: "./dist/sdk.js"
     },
     "./cli": {
       types: "./types/cli/index.d.ts",
@@ -474,14 +534,17 @@ var package_default = {
     "hasna.contract.json"
   ],
   scripts: {
-    build: "bun run build:runtime && bun run build:types",
-    "build:runtime": "rm -rf dist && bun build src/cli/index.ts --outdir dist/cli --target bun --packages external && bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external && bun build src/serve/index.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external",
-    "build:types": "rm -rf types && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
+    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
+    "generate:sdk": "bun scripts/generate-sdk.ts --write",
+    "check:sdk": "bun scripts/generate-sdk.ts",
+    "test:artifacts": "bun scripts/artifact-acceptance.ts",
+    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
     "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
     "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
     typecheck: "tsc --noEmit",
     test: "bun test",
-    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a throwaway Postgres; the live-PG gate must not pass without one}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/pg-live.test.ts',
+    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
     prepack: "bun run build && bun run artifact-scan",
     prepublishOnly: "bun run test && bun run build"
   },
@@ -500,7 +563,8 @@ var package_default = {
   },
   repository: {
     type: "git",
-    url: "git+https://github.com/hasna/apps.git"
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/workflows"
   },
   homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
   bugs: {
@@ -514,21 +578,25 @@ var package_default = {
   dependencies: {
     "@anthropic-ai/claude-agent-sdk": "0.3.234",
     "@cursor/sdk": "^1.0.28",
-    "@hasna/paths": "0.1.0",
     "@openai/codex-sdk": "0.147.0",
-    commander: "^13.1.0"
+    commander: "^13.1.0",
+    "@hasna/contracts": "1.3.3",
+    pg: "^8.16.3"
   },
   devDependencies: {
-    "@hasna/contracts": "0.14.1",
-    "@types/bun": "latest",
+    "@types/bun": "1.3.14",
     "@types/pg": "^8.15.6",
-    pg: "^8.16.3",
     typescript: "^5.7.3"
   }
 };
 
+// src/version.ts
+function packageVersion() {
+  return package_default.version;
+}
+
 // src/daemon.ts
-import { createHash as createHash2 } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // src/expr.ts
 class ExprSyntaxError extends Error {
@@ -897,16 +965,49 @@ function findCycles(graph) {
 }
 function validateGraph(graph) {
   const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+  }
   if (typeof graph.name !== "string" || graph.name.trim() === "") {
     issue(issues, "name", "graph requires a non-empty name");
   }
   if (typeof graph.version !== "string" || graph.version.trim() === "") {
     issue(issues, "version", "graph requires a version string");
   }
+  if (graph.memoWatch !== undefined) {
+    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
+      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
+    } else {
+      for (const entry of graph.memoWatch) {
+        if (typeof entry !== "string" || entry.trim() === "") {
+          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
+          break;
+        }
+      }
+    }
+  }
   if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
     issue(issues, "nodes", "graph requires at least one node");
     return { ok: false, issues };
   }
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
+      continue;
+    }
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+    }
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  }
+  if (issues.length)
+    return { ok: false, issues };
   const starts = graph.nodes.filter((n) => n.type === "start");
   if (starts.length === 0)
     issue(issues, "nodes", "graph requires exactly one start node (found none)");
@@ -968,6 +1069,8 @@ function nodeEdges(node) {
       return node.next ? [{ kind: "next", target: node.next }] : [];
     case "end":
       return [];
+    default:
+      return [];
   }
 }
 function validateNode(graph, node, issues) {
@@ -1137,36 +1240,53 @@ function assertNoSecrets(value, what) {
 
 // src/session.ts
 import { createHash } from "crypto";
+import { readFileSync, statSync } from "fs";
+import { isAbsolute, join } from "path";
 var DEFAULT_MAX_ATTEMPTS = 3;
 function repairTornRuns(store, wal, opts = {}) {
+  const sequence = repairSteps(store, wal, opts);
+  let step = sequence.next();
+  while (!step.done) {
+    if (step.value instanceof Promise) {
+      return (async () => {
+        while (!step.done)
+          step = sequence.next(await step.value);
+        return step.value;
+      })();
+    }
+    step = sequence.next(step.value);
+  }
+  return step.value;
+}
+function* repairSteps(store, wal, opts) {
   const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
   const replay = wal.replay();
   const liveClaims = replay.liveClaims(opts.now);
   const report = { interrupted: 0, requeued: 0, failed: 0 };
-  const running = store.listRuns({ status: "running", limit: 1000 });
+  const running = yield store.listRuns({ status: "running", limit: 1000 });
   for (const run of running) {
     if (liveClaims.has(run.id))
       continue;
     report.interrupted++;
-    const nodes = store.listRunNodes(run.id);
+    const nodes = yield store.listRunNodes(run.id);
     if (run.attempts < maxAttempts) {
-      store.bumpAttempts(run.id);
-      store.setRunStatus(run.id, "interrupted", {
+      yield store.bumpAttempts(run.id);
+      yield store.setRunStatus(run.id, "interrupted", {
         error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
       });
       for (const node of nodes) {
         if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "pending", { error: undefined });
+          yield store.setRunNodeStatus(node.id, "pending", { error: undefined });
         }
       }
       report.requeued++;
     } else {
-      store.setRunStatus(run.id, "failed", {
+      yield store.setRunStatus(run.id, "failed", {
         error: `torn run failed after ${maxAttempts} interrupted attempts`
       });
       for (const node of nodes) {
         if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
+          yield store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
         }
       }
       report.failed++;
@@ -1182,30 +1302,429 @@ function memoKey(graphName, nodeId, input) {
 }
 function tryMemoHit(store, graphName, nodeId, input) {
   const key = memoKey(graphName, nodeId, input);
-  const memo = store.memoGet(key);
-  if (!memo)
+  const value = store.memoGet(key);
+  if (value instanceof Promise) {
+    return value.then(async (row) => {
+      if (row)
+        await store.memoHit(key);
+      return row;
+    });
+  }
+  if (value)
+    store.memoHit(key);
+  return value;
+}
+function memoWatchFingerprint(graph, dataDir) {
+  if (!graph.memoWatch || graph.memoWatch.length === 0)
     return;
-  store.memoHit(key);
-  return memo;
+  const entries = [];
+  for (const pattern of graph.memoWatch) {
+    if (hasGlobMagic(pattern)) {
+      const matches = [...new Bun.Glob(pattern).scanSync({ cwd: dataDir, onlyFiles: true })].sort();
+      for (const match of matches) {
+        const path2 = isAbsolute(match) ? match : join(dataDir, match);
+        entries.push(fingerprintFile(pattern, path2));
+      }
+      continue;
+    }
+    const path = isAbsolute(pattern) ? pattern : join(dataDir, pattern);
+    entries.push(fingerprintFile(pattern, path));
+  }
+  return entries;
 }
-function recordMemo(store, graphName, nodeId, input, output) {
-  const key = memoKey(graphName, nodeId, input);
-  store.memoPut(key, graphName, nodeId, inputHash(input), JSON.stringify(output));
+function hasGlobMagic(pattern) {
+  return /[*?[\]{}]/.test(pattern);
+}
+function fingerprintFile(pattern, path) {
+  try {
+    const stat = statSync(path);
+    if (!stat.isFile()) {
+      return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
+    }
+    const content = readFileSync(path);
+    return {
+      pattern,
+      path,
+      missing: false,
+      mtimeMs: stat.mtimeMs,
+      size: content.byteLength,
+      sha256: createHash("sha256").update(content).digest("hex")
+    };
+  } catch {
+    return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
+  }
+}
+
+// src/db/postgres-store.ts
+import { randomUUID } from "crypto";
+import { Pool } from "pg";
+var run = (r) => ({
+  id: String(r.id),
+  graphName: String(r.graph_name),
+  graphVersion: String(r.graph_version),
+  status: r.status,
+  attempts: Number(r.attempts),
+  contextJson: String(r.context_json),
+  resultJson: r.result_json == null ? null : String(r.result_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at),
+  createdAt: String(r.created_at),
+  updatedAt: String(r.updated_at)
+});
+var node = (r) => ({
+  id: String(r.id),
+  runId: String(r.run_id),
+  nodeId: String(r.node_id),
+  status: r.status,
+  attempts: Number(r.attempts),
+  lane: r.lane == null ? null : String(r.lane),
+  exitCode: r.exit_code == null ? null : Number(r.exit_code),
+  outputJson: r.output_json == null ? null : String(r.output_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at)
+});
+var memo = (r) => ({
+  key: String(r.key),
+  graphName: String(r.graph_name),
+  nodeId: String(r.node_id),
+  inputHash: String(r.input_hash),
+  outputJson: String(r.output_json),
+  hitCount: Number(r.hit_count),
+  createdAt: String(r.created_at)
+});
+
+class WorkflowStorageError extends Error {
+  constructor() {
+    super("PostgreSQL workflow storage is unavailable or its schema is invalid");
+    this.name = "WorkflowStorageError";
+  }
 }
-function findRunByIdempotencyKey(store, key) {
-  const runs = store.listRuns({ limit: 1000 });
-  for (const run of runs) {
+
+class PostgresWorkflowsStore {
+  pool;
+  prefix;
+  dataDir;
+  execution;
+  constructor(options) {
+    const schema = options.schema ?? "workflows";
+    if (!/^[a-z][a-z0-9_]{0,62}$/.test(schema))
+      throw new Error("PostgreSQL schema must be a lowercase SQL identifier");
+    this.prefix = `"${schema}"`;
+    this.dataDir = options.dataDir;
+    this.pool = new Pool({
+      connectionString: options.databaseUrl,
+      max: 4,
+      connectionTimeoutMillis: 5000,
+      idleTimeoutMillis: 1e4,
+      statement_timeout: 1e4,
+      application_name: "workflows"
+    });
+  }
+  async rows(sql, values = []) {
     try {
-      const context = JSON.parse(run.contextJson);
-      if (context?.__wf?.idempotencyKey === key)
-        return run;
-    } catch {}
+      if (this.execution?.lost)
+        throw new WorkflowStorageError;
+      return (await (this.execution?.client ?? this.pool).query(sql, values)).rows;
+    } catch (error) {
+      if (error?.code === "23505")
+        throw Object.assign(new Error("workflow uniqueness conflict"), { code: "23505" });
+      throw new WorkflowStorageError;
+    }
+  }
+  async close() {
+    await this.releaseExecution();
+    await this.pool.end();
+  }
+  async acquireExecution(runId) {
+    if (this.execution)
+      return this.execution.runId === runId && !this.execution.lost;
+    const client = await this.pool.connect();
+    let lost = false;
+    client.on("error", () => {
+      lost = true;
+      if (this.execution?.client === client)
+        this.execution.lost = true;
+    });
+    try {
+      const acquired = await client.query("SELECT pg_try_advisory_lock(hashtextextended($1,0)) AS owned", [`${this.prefix}:${runId}`]);
+      if (!acquired.rows[0]?.owned) {
+        client.release();
+        return false;
+      }
+      this.execution = { runId, client, lost };
+      return !lost;
+    } catch {
+      client.release(true);
+      throw new WorkflowStorageError;
+    }
+  }
+  async releaseExecution() {
+    const owned = this.execution;
+    if (!owned)
+      return;
+    this.execution = undefined;
+    try {
+      if (!owned.lost)
+        await owned.client.query("SELECT pg_advisory_unlock(hashtextextended($1,0))", [`${this.prefix}:${owned.runId}`]);
+    } finally {
+      owned.client.release(owned.lost);
+    }
+  }
+  async transaction(action) {
+    if (this.execution?.lost)
+      throw new WorkflowStorageError;
+    const client = this.execution?.client ?? await this.pool.connect();
+    const retained = client === this.execution?.client;
+    try {
+      await client.query("BEGIN");
+      const result = await action(client);
+      await client.query("COMMIT");
+      return result;
+    } catch {
+      try {
+        await client.query("ROLLBACK");
+      } catch {}
+      throw new WorkflowStorageError;
+    } finally {
+      if (!retained)
+        client.release();
+    }
+  }
+  async listTables() {
+    return (await this.rows("SELECT table_name FROM information_schema.tables WHERE table_schema=$1 AND table_type='BASE TABLE' ORDER BY table_name", [this.prefix.slice(1, -1)])).map((row) => String(row.table_name));
+  }
+  async checkSchema() {
+    if ((await this.listTables()).join(",") !== "memos,run_nodes,runs")
+      return false;
+    await this.rows(`SELECT id,graph_name,graph_version,status,attempts,context_json,result_json,error,started_at,finished_at,created_at,updated_at FROM ${this.prefix}.runs LIMIT 0`);
+    await this.rows(`SELECT id,sequence,run_id,node_id,status,attempts,lane,exit_code,output_json,error,started_at,finished_at FROM ${this.prefix}.run_nodes LIMIT 0`);
+    await this.rows(`SELECT key,graph_name,node_id,input_hash,output_json,hit_count,created_at FROM ${this.prefix}.memos LIMIT 0`);
+    const schema = this.prefix.slice(1, -1);
+    const indices = await this.rows(`SELECT i.indisunique,i.indisvalid,i.indisready,i.indnkeyatts,i.indnatts,i.indpred IS NULL AS unfiltered,pg_get_expr(i.indexprs,i.indrelid) AS expression FROM pg_index i JOIN pg_class c ON c.oid=i.indexrelid JOIN pg_class t ON t.oid=i.indrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1 AND c.relname='runs_idempotency' AND t.relname='runs'`, [schema]);
+    const index = indices[0];
+    if (indices.length !== 1 || !index?.indisunique || !index.indisvalid || !index.indisready || !index.unfiltered || Number(index.indnkeyatts) !== 1 || Number(index.indnatts) !== 1 || String(index.expression).replace(/[()\s]/g, "") !== "context_json::jsonb#>>'{__wf,idempotencyKey}'::text[]")
+      return false;
+    const columns = await this.rows("SELECT table_name,column_name,data_type,is_nullable,is_identity,identity_generation FROM information_schema.columns WHERE table_schema=$1", [schema]);
+    const required = {
+      runs: ["id:text", "graph_name:text", "graph_version:text", "status:text", "attempts:integer", "context_json:text", "created_at:text", "updated_at:text"],
+      run_nodes: ["id:text", "sequence:bigint", "run_id:text", "node_id:text", "status:text", "attempts:integer"],
+      memos: ["key:text", "graph_name:text", "node_id:text", "input_hash:text", "output_json:text", "hit_count:integer", "created_at:text"]
+    };
+    for (const [table, fields] of Object.entries(required))
+      for (const field of fields) {
+        const [name, type] = field.split(":");
+        const c = columns.find((row) => row.table_name === table && row.column_name === name);
+        if (!c || c.data_type !== type || c.is_nullable !== "NO")
+          return false;
+        if (name === "sequence" && (c.is_identity !== "YES" || c.identity_generation !== "ALWAYS"))
+          return false;
+      }
+    const constraints = await this.rows(`SELECT c.relname AS table_name,co.contype,pg_get_constraintdef(co.oid) AS definition FROM pg_constraint co JOIN pg_class c ON c.oid=co.conrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1`, [schema]);
+    for (const [table, key] of [["runs", "id"], ["run_nodes", "id"], ["memos", "key"]])
+      if (!constraints.some((row) => row.table_name === table && row.contype === "p" && row.definition === `PRIMARY KEY (${key})`))
+        return false;
+    return constraints.some((row) => row.table_name === "run_nodes" && row.contype === "f" && String(row.definition).replaceAll('"', "") === `FOREIGN KEY (run_id) REFERENCES ${schema}.runs(id)`);
+  }
+  async initialize() {
+    const tables = await this.listTables();
+    if (tables.length) {
+      if (await this.checkSchema())
+        return;
+      throw new WorkflowStorageError;
+    }
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(`CREATE SCHEMA IF NOT EXISTS ${this.prefix};
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.runs (
+        id TEXT PRIMARY KEY, graph_name TEXT NOT NULL, graph_version TEXT NOT NULL, status TEXT NOT NULL,
+        attempts INTEGER NOT NULL DEFAULT 0, context_json TEXT NOT NULL, result_json TEXT, error TEXT,
+        started_at TEXT, finished_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.run_nodes (
+        id TEXT PRIMARY KEY, sequence BIGINT GENERATED ALWAYS AS IDENTITY, run_id TEXT NOT NULL REFERENCES ${this.prefix}.runs(id), node_id TEXT NOT NULL,
+        status TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, lane TEXT, exit_code INTEGER,
+        output_json TEXT, error TEXT, started_at TEXT, finished_at TEXT);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.memos (
+        key TEXT PRIMARY KEY, graph_name TEXT NOT NULL, node_id TEXT NOT NULL, input_hash TEXT NOT NULL,
+        output_json TEXT NOT NULL, hit_count INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL);
+      CREATE UNIQUE INDEX IF NOT EXISTS runs_idempotency ON ${this.prefix}.runs ((context_json::jsonb #>> '{__wf,idempotencyKey}'));
+      CREATE INDEX IF NOT EXISTS runs_status ON ${this.prefix}.runs(status);
+      CREATE INDEX IF NOT EXISTS nodes_run ON ${this.prefix}.run_nodes(run_id);`);
+      await client.query("COMMIT");
+    } catch {
+      await client.query("ROLLBACK");
+      throw new WorkflowStorageError;
+    } finally {
+      client.release();
+    }
+    if (!await this.checkSchema())
+      throw new WorkflowStorageError;
+  }
+  async createRun(input) {
+    const at = new Date().toISOString();
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.runs(id,graph_name,graph_version,status,context_json,created_at,updated_at)
+      VALUES($1,$2,$3,'pending',$4,$5,$5) RETURNING *`, [randomUUID(), input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), at]);
+    return run(rows[0]);
+  }
+  async getRun(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE id=$1`, [id]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async getRunByIdempotencyKey(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE context_json::jsonb #>> '{__wf,idempotencyKey}'=$1`, [key]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async listRuns(options = {}) {
+    const limit = Math.max(1, Math.min(1000, options.limit ?? 100));
+    return (await this.rows(`SELECT * FROM ${this.prefix}.runs ${options.status ? "WHERE status=$2" : ""} ORDER BY created_at DESC,id DESC LIMIT $1`, options.status ? [limit, options.status] : [limit])).map(run);
+  }
+  async setRunStatus(id, status, patch = {}) {
+    const values = [id, status, new Date().toISOString()];
+    const sets = ["status=$2", "updated_at=$3"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt"))
+      sets.push("started_at=COALESCE(started_at,$3)");
+    await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async compareRunStatus(id, expected, status, patch = {}) {
+    const values = [id, expected, status, new Date().toISOString()];
+    const sets = ["status=$3", "updated_at=$4"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (patch && Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1 AND status=ANY($2::text[]) RETURNING id`, values)).length === 1;
+  }
+  async setRunContext(id, context) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [id, JSON.stringify(context), new Date().toISOString()]);
+  }
+  async setRunningContext(id, context) {
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1 AND status='running' RETURNING id`, [id, JSON.stringify(context), new Date().toISOString()])).length === 1;
+  }
+  async blockRunResume(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,resumeBlocked}',to_jsonb($2::text))::text,updated_at=$3 WHERE id=$1`, [id, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async dispatchIfRunning(id, action) {
+    const marked = await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,executionMayBeActive}','true'::jsonb)::text WHERE id=$1 AND status='running' RETURNING id`, [id]);
+    if (!marked.length)
+      return { started: false };
+    return this.transaction(async (client) => {
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [id]);
+      if (run2.rows[0]?.status !== "running")
+        return { started: false };
+      return { started: true, result: action() };
+    });
+  }
+  async finishDispatch(id, unconfirmed) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=(CASE WHEN $2 THEN jsonb_set(context_json::jsonb #- '{__wf,executionMayBeActive}','{__wf,resumeBlocked}',to_jsonb($3::text)) ELSE context_json::jsonb #- '{__wf,executionMayBeActive}' END)::text,updated_at=$4 WHERE id=$1`, [id, unconfirmed, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async commitStep(input) {
+    return this.transaction(async (client) => {
+      const nodes = await client.query(`SELECT run_id FROM ${this.prefix}.run_nodes WHERE id=$1 FOR UPDATE`, [input.nodeRowId]);
+      if (nodes.rows[0]?.run_id !== input.runId)
+        return false;
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [input.runId]);
+      if (run2.rows[0]?.status !== "running")
+        return false;
+      const patch = input.patch ?? {}, values = [input.nodeRowId, input.status];
+      const sets = ["status=$2"];
+      for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+        if (Object.hasOwn(patch, key)) {
+          values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+          sets.push(`${field}=$${values.length}`);
+        }
+      }
+      if (input.status === "running") {
+        values.push(new Date().toISOString());
+        sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+      }
+      if (["completed", "failed", "skipped"].includes(input.status)) {
+        values.push(new Date().toISOString());
+        sets.push(`finished_at=$${values.length}`);
+      }
+      if (input.incrementAttempts)
+        sets.push("attempts=attempts+1");
+      await client.query(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+      if (input.context !== undefined)
+        await client.query(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [input.runId, JSON.stringify(input.context), new Date().toISOString()]);
+      if (input.memo) {
+        const m = input.memo;
+        await client.query(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [m.key, m.graphName, m.nodeId, m.inputHash, m.outputJson, new Date().toISOString()]);
+      }
+      return true;
+    });
+  }
+  async bumpAttempts(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET attempts=attempts+1,updated_at=$2 WHERE id=$1`, [id, new Date().toISOString()]);
+  }
+  async createRunNode(input) {
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.run_nodes(id,run_id,node_id,lane,status) VALUES($1,$2,$3,$4,'pending') RETURNING *`, [randomUUID(), input.runId, input.nodeId, input.lane ?? null]);
+    return node(rows[0]);
+  }
+  async getRunNode(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE id=$1`, [id]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async listRunNodes(runId) {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 ORDER BY sequence`, [runId])).map(node);
+  }
+  async getLatestRunNode(runId, nodeId) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 AND node_id=$2 ORDER BY sequence DESC LIMIT 1`, [runId, nodeId]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async setRunNodeStatus(id, status, patch = {}) {
+    const values = [id, status];
+    const sets = ["status=$2"];
+    for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+    }
+    if (["completed", "failed", "skipped"].includes(status) && !Object.hasOwn(patch, "finishedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`finished_at=$${values.length}`);
+    }
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async bumpAttemptsNode(id) {
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET attempts=attempts+1 WHERE id=$1`, [id]);
+  }
+  async memoPut(key, graphName, nodeId, inputHash2, outputJson) {
+    await this.rows(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6)
+      ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [key, graphName, nodeId, inputHash2, outputJson, new Date().toISOString()]);
+  }
+  async memoGet(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.memos WHERE key=$1`, [key]);
+    return rows[0] ? memo(rows[0]) : undefined;
+  }
+  async memoHit(key) {
+    await this.rows(`UPDATE ${this.prefix}.memos SET hit_count=hit_count+1 WHERE key=$1`, [key]);
+  }
+  async memoList() {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.memos ORDER BY created_at DESC,key LIMIT 1000`)).map(memo);
+  }
+  async memoClear() {
+    throw new Error("PostgreSQL memo removal requires the reviewed server-operator preservation procedure");
   }
-  return;
 }
 
 // src/daemon.ts
 init_types();
+init_types();
 var DEFAULT_LEASE_TTL_MS = 120000;
 var DEFAULT_MAX_ATTEMPTS2 = 3;
 var DEFAULT_MAX_DISPATCH = 4;
@@ -1218,27 +1737,28 @@ function stripRunState(context) {
   const { __wf: _wf, steps: _steps, ...user } = context;
   return user;
 }
-function runCommand(job) {
+async function runCommand(job) {
   if (!job.command) {
     return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
   }
   const started = Date.now();
   const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const proc = Bun.spawnSync({
+  const proc = Bun.spawn({
     cmd: ["/bin/sh", "-c", job.command],
     cwd: job.cwd,
-    env: { ...process.env, ...job.env ?? {} },
+    env: subscriptionEnvironment(job.env),
     stdout: "pipe",
     stderr: "pipe",
     timeout: timeoutMs
   });
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
   const output = stderr ? `${stdout}
 ${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? (proc.signalCode ? 1 : 1);
-  return { ok: exitCode === 0, exitCode, output, durationMs };
+  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
 }
 
 class WorkflowsDaemon {
@@ -1259,7 +1779,7 @@ class WorkflowsDaemon {
   constructor(store, wal, options = {}) {
     this.store = store;
     this.wal = wal;
-    this.worker = options.worker ?? "local";
+    this.worker = options.worker ?? `worker-${randomUUID2()}`;
     this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
     this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
     this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
@@ -1291,17 +1811,22 @@ class WorkflowsDaemon {
     return this.leases;
   }
   claim(runId) {
+    return this.wal.exclusive(() => this.claimLocked(runId));
+  }
+  claimLocked(runId) {
     const now = this.time();
     const existing = this.leases.get(runId);
     if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
       return null;
     }
-    const liveClaims = this.wal.replay().liveClaims(now);
+    const replay = this.wal.replay();
+    const liveClaims = replay.liveClaims(now);
     const foreign = liveClaims.get(runId);
     if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
       return null;
     }
-    const fencing = (this.fencingCounter.get(runId) ?? 0) + 1;
+    const lastFencing = replay.entries.reduce((max, entry) => entry.op.op === "claim_acquired" && entry.op.runId === runId ? Math.max(max, entry.op.fencing) : max, 0);
+    const fencing = Math.max(lastFencing, this.fencingCounter.get(runId) ?? 0) + 1;
     this.fencingCounter.set(runId, fencing);
     const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
     this.leases.set(runId, lease);
@@ -1316,16 +1841,36 @@ class WorkflowsDaemon {
     return lease;
   }
   heartbeat(runId, fencing) {
+    return this.wal.exclusive(() => this.heartbeatLocked(runId, fencing));
+  }
+  heartbeatLocked(runId, fencing) {
     const lease = this.leases.get(runId);
     if (!lease || lease.fencing !== fencing)
       return false;
+    const current = this.wal.replay({ repair: false }).liveClaims(this.time()).get(runId);
+    if (!current || current.worker !== lease.worker || current.fencing !== fencing)
+      return false;
     lease.expiresAtMs = this.time() + this.leaseTtlMs;
+    this.wal.append({
+      op: "claim_acquired",
+      runId,
+      worker: lease.worker,
+      fencing,
+      expiresAt: new Date(lease.expiresAtMs).toISOString(),
+      at: nowIso()
+    });
     return true;
   }
   release(runId, fencing) {
+    return this.wal.exclusive(() => this.releaseLocked(runId, fencing));
+  }
+  releaseLocked(runId, fencing) {
     const lease = this.leases.get(runId);
     if (!lease || lease.fencing !== fencing)
       return false;
+    const current = this.wal.replay().liveClaims(this.time()).get(runId);
+    if (current && (current.worker !== lease.worker || current.fencing !== fencing))
+      return false;
     this.leases.delete(runId);
     this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
     return true;
@@ -1340,30 +1885,30 @@ class WorkflowsDaemon {
       }
     }
     if (this.isolatedRunId === null) {
-      const repair = repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
+      const repair = await repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
       report.interrupted += repair.interrupted;
       report.requeued += repair.requeued;
       report.failed += repair.failed;
     }
-    const pending = this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle }).concat(this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
-    for (const run of pending) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+    const pending = (await this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle })).concat(await this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
+    for (const run2 of pending) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
         continue;
-      const lease = this.claim(run.id);
+      const lease = this.claim(run2.id);
       if (!lease)
         continue;
-      this.store.setRunStatus(run.id, "running");
-      this.wal.append({ op: "run_started", runId: run.id, at: nowIso() });
+      await this.store.setRunStatus(run2.id, "running");
+      this.wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
       report.dispatched++;
     }
-    const running = this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
+    const running = await this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
     let steps = 0;
-    for (const run of running) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+    for (const run2 of running) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
         continue;
       if (steps >= this.maxStepsPerCycle)
         break;
-      const outcome = await this.advanceRun(run.id);
+      const outcome = await this.advanceRun(run2.id);
       steps++;
       if (outcome.kind === "completed")
         report.completed++;
@@ -1389,66 +1934,78 @@ class WorkflowsDaemon {
     } else {
       this.graphCache.set(graph.name, existing);
     }
-    return this.store.createRun({ graphName: graph.name, graphVersion: graph.version, context: context ?? {} });
+    const initial = context !== null && typeof context === "object" ? context : {};
+    return this.store.createRun({
+      graphName: graph.name,
+      graphVersion: graph.version,
+      context: { ...initial, __wf: { ...initial.__wf ?? {}, graph } }
+    });
   }
   async advanceRun(runId) {
-    const run = this.store.getRun(runId);
-    if (!run || run.status !== "running")
+    const run2 = await this.store.getRun(runId);
+    if (!run2 || run2.status !== "running")
       return { kind: "noop" };
     const lease = this.leases.get(runId);
     if (!lease || lease.expiresAtMs <= this.time())
       return { kind: "blocked" };
-    const graph = this.loadGraph(run.graphName);
+    const storedContext = JSON.parse(run2.contextJson);
+    const pinned = storedContext.__wf?.graph;
+    const graph = pinned ?? this.loadGraph(run2.graphName);
     if (!graph) {
-      this.failRun(run, `graph ${run.graphName} not found in daemon graph cache`);
+      await this.failRun(run2, `graph ${run2.graphName} not found in daemon graph cache`);
       return { kind: "failed", error: "graph not found" };
     }
-    const context = JSON.parse(run.contextJson);
+    const context = storedContext;
     const rawWf = context.__wf ?? {};
     const wf = {
       ...rawWf,
       cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
-      loops: rawWf.loops ?? {},
-      completedLoops: rawWf.completedLoops ?? {}
+      loops: Object.assign(Object.create(null), rawWf.loops ?? {}),
+      completedLoops: Object.assign(Object.create(null), rawWf.completedLoops ?? {})
     };
     try {
+      if (rawWf.stepTerminal === true) {
+        context.__wf = wf;
+        await this.completeRun(run2, context);
+        return { kind: "completed" };
+      }
       const cursor = wf.cursor;
-      const node = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
-      if (!node) {
-        this.failRun(run, `cursor ${cursor ?? "<start>"} resolves to no node`);
+      const node2 = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
+      if (!node2) {
+        await this.failRun(run2, `cursor ${cursor ?? "<start>"} resolves to no node`);
         return { kind: "failed", error: "no node at cursor" };
       }
-      switch (node.type) {
+      switch (node2.type) {
         case "start": {
-          wf.cursor = node.next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
+          wf.cursor = node2.next;
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
         }
         case "step": {
-          return await this.executeStep(run, graph, context, wf, node);
+          return await this.executeStep(run2, graph, context, wf, node2);
         }
         case "decision": {
-          const value = evaluateExpr(node.condition, this.conditionScope(context));
-          const next = value ? node.then : node.else;
+          const value = evaluateExpr(node2.condition, this.conditionScope(context));
+          const next = value ? node2.then : node2.else;
           if (!next) {
-            this.failRun(run, `decision ${node.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
+            await this.failRun(run2, `decision ${node2.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
             return { kind: "failed", error: "missing decision edge" };
           }
           wf.cursor = next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
         }
         case "while": {
-          return this.executeWhile(run, graph, context, wf, node);
+          return await this.executeWhile(run2, graph, context, wf, node2);
         }
         case "end": {
-          this.completeRun(run, context);
+          await this.completeRun(run2, context);
           return { kind: "completed" };
         }
       }
     } catch (err) {
       if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
-        this.failRun(run, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
+        await this.failRun(run2, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
         return { kind: "failed", error: err.message };
       }
       throw err;
@@ -1460,124 +2017,180 @@ class WorkflowsDaemon {
   conditionScope(context) {
     return { ...context, steps: context.steps ?? {} };
   }
-  persistContext(run, context, wf) {
+  async persistContext(run2, context, wf) {
     context.__wf = wf;
-    this.store.setRunContext(run.id, context);
-  }
-  async executeStep(run, graph, context, wf, node) {
-    const nodeId = node.id;
-    const existing = this.store.listRunNodes(run.id).find((n) => n.nodeId === nodeId);
-    const nodeRow = existing ?? this.store.createRunNode({ runId: run.id, nodeId, lane: node.lane ?? "claude" });
-    if (node.memo) {
-      const memoInput = { command: node.command, prompt: node.prompt, context: stripRunState(context) };
-      const hit = tryMemoHit(this.store, run.graphName, nodeId, memoInput);
+    await this.store.setRunningContext(run2.id, context);
+  }
+  async discardStep(run2, nodeRowId) {
+    const current = await this.store.getRun(run2.id);
+    const node2 = await this.store.getRunNode(nodeRowId);
+    if (current?.status === "cancelled" && node2 && ["pending", "running"].includes(node2.status))
+      await this.store.setRunNodeStatus(nodeRowId, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+    return { kind: "noop" };
+  }
+  async executeStep(run2, graph, context, wf, node2) {
+    const nodeId = node2.id;
+    const latest = await this.store.getLatestRunNode(run2.id, nodeId);
+    const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
+    const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? await this.store.createRunNode({ runId: run2.id, nodeId, lane: node2.lane ?? "claude" }) : latest;
+    const memoWatch = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+    const memoSource = { command: node2.command, prompt: node2.prompt, context: stripRunState(context) };
+    const memoInput = node2.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
+    if (memoInput !== undefined) {
+      const hit = await tryMemoHit(this.store, run2.graphName, nodeId, memoInput);
       if (hit) {
         const cached = JSON.parse(hit.outputJson);
-        this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } });
-        this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
         this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
-        return this.afterNode(run, context, wf, node.next);
+        const continuation2 = this.advanceAfterStep(graph, context, wf, node2.next);
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } }, context }))
+          return this.discardStep(run2, nodeRow.id);
+        this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+        if (continuation2.kind === "completed")
+          await this.completeRun(run2, context);
+        return continuation2;
       }
     }
     if (nodeRow.status !== "running") {
-      this.store.setRunNodeStatus(nodeRow.id, "running");
-      this.wal.append({ op: "node_started", runId: run.id, nodeId, at: nowIso() });
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "running" }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_started", runId: run2.id, nodeId, at: nowIso() });
     }
     const job = {
-      lane: node.lane ?? "claude",
-      prompt: node.prompt,
-      command: node.command,
-      timeoutMs: node.timeoutMs,
+      lane: node2.lane ?? "claude",
+      prompt: node2.prompt,
+      command: node2.command,
+      timeoutMs: node2.timeoutMs,
       env: this.env
     };
     let result;
+    const activeLease = this.leases.get(run2.id);
+    const pulse = setInterval(() => {
+      this.heartbeat(run2.id, activeLease.fencing);
+    }, Math.max(1, Math.floor(this.leaseTtlMs / 3)));
     try {
-      result = await this.laneRunner(job);
-    } catch (err) {
-      result = { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+      const dispatched = await this.store.dispatchIfRunning(run2.id, async () => {
+        try {
+          return await this.laneRunner(job);
+        } catch (err) {
+          return { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+        }
+      });
+      if (!dispatched.started) {
+        await this.store.finishDispatch(run2.id, false);
+        return this.discardStep(run2, nodeRow.id);
+      }
+      result = await dispatched.result;
+    } finally {
+      clearInterval(pulse);
+    }
+    const unconfirmed = result.retryable === false && /exceeded.*budget/.test(result.error ?? "");
+    await this.store.finishDispatch(run2.id, unconfirmed);
+    if (unconfirmed)
+      Object.assign(wf, { resumeBlocked: "execution cancellation has not been confirmed" });
+    const current = await this.store.getRun(run2.id);
+    const currentClaim = this.wal.replay({ repair: false }).liveClaims(this.time()).get(run2.id);
+    const lease = this.leases.get(run2.id);
+    if (!current || current.status !== "running" || !currentClaim || !lease || currentClaim.worker !== lease.worker || currentClaim.fencing !== lease.fencing) {
+      if (current?.status === "cancelled")
+        await this.store.setRunNodeStatus(nodeRow.id, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+      return { kind: "noop" };
+    }
+    try {
+      assertNoSecrets({ output: result.output, error: result.error }, `node ${nodeId} execution`);
+    } catch {
+      result = { ok: false, exitCode: 1, output: "", durationMs: result.durationMs, error: "execution result refused by secrets write-gate", retryable: false };
     }
     const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
     if (!result.ok) {
-      const shouldRetry = nodeRow.attempts < (node.maxRetries ?? 0);
-      this.store.bumpAttemptsNode(nodeRow.id);
+      const shouldRetry = result.retryable !== false && nodeRow.attempts < (node2.maxRetries ?? 0);
       if (shouldRetry) {
-        this.store.setRunNodeStatus(nodeRow.id, "pending", { error: result.error ?? `exit ${result.exitCode}` });
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "pending", patch: { error: result.error ?? `exit ${result.exitCode}` }, incrementAttempts: true }))
+          return this.discardStep(run2, nodeRow.id);
         return { kind: "advanced", nodeId };
       }
       const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { exitCode: result.exitCode, error });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, error);
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { exitCode: result.exitCode, error }, incrementAttempts: true }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, error);
       return { kind: "failed", error };
     }
     try {
       assertNoSecrets(output, `node ${nodeId} output`);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { error: message });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, message);
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { error: message } }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, message);
       return { kind: "failed", error: message };
     }
-    this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: result.exitCode, output });
-    this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
-    if (node.memo) {
-      recordMemo(this.store, run.graphName, nodeId, { command: node.command, prompt: node.prompt, context: stripRunState(context) }, output);
-      this.wal.append({ op: "memo_set", key: `${run.graphName}:${nodeId}:${createHash2("sha256").update(JSON.stringify({ command: node.command, prompt: node.prompt, context: stripRunState(context) })).digest("hex")}`, at: nowIso() });
+    let memo2;
+    if (memoInput !== undefined) {
+      const memoInputAfter = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+      const stable = memoWatch === undefined && memoInputAfter === undefined || memoWatch !== undefined && memoInputAfter !== undefined && JSON.stringify(memoWatch) === JSON.stringify(memoInputAfter);
+      if (stable) {
+        memo2 = { key: memoKey(run2.graphName, nodeId, memoInput), graphName: run2.graphName, nodeId, inputHash: inputHash(memoInput), outputJson: JSON.stringify(output) };
+      }
     }
     this.recordStepResult(context, nodeId, output);
-    return this.afterNode(run, context, wf, node.next);
-  }
-  afterNode(run, context, wf, next) {
+    const continuation = this.advanceAfterStep(graph, context, wf, node2.next);
+    if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: result.exitCode, output }, context, memo: memo2 }))
+      return this.discardStep(run2, nodeRow.id);
+    this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+    if (memo2)
+      this.wal.append({ op: "memo_set", key: memo2.key, at: nowIso() });
+    if (continuation.kind === "completed")
+      await this.completeRun(run2, context);
+    return continuation;
+  }
+  advanceAfterStep(graph, context, wf, next) {
+    context.__wf = wf;
     if (next) {
       wf.cursor = next;
-      this.persistContext(run, context, wf);
       return { kind: "advanced", nodeId: wf.cursor };
     }
     const cursor = wf.cursor;
-    const graph = this.loadGraph(run.graphName);
     const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
     if (whileNode) {
       const index = whileNode.body.indexOf(cursor ?? "");
       if (index >= 0 && index < whileNode.body.length - 1) {
         wf.cursor = whileNode.body[index + 1];
-        this.persistContext(run, context, wf);
         return { kind: "advanced", nodeId: wf.cursor };
       }
       wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
       wf.cursor = whileNode.id;
-      this.persistContext(run, context, wf);
       return { kind: "advanced", nodeId: whileNode.id };
     }
-    this.completeRun(run, context);
+    wf.stepTerminal = true;
     return { kind: "completed" };
   }
-  executeWhile(run, graph, context, wf, node) {
-    const iteration = wf.loops[node.id] ?? 0;
-    if (iteration >= node.maxIterations) {
-      const error = `while node ${node.id} exceeded maxIterations (${node.maxIterations})`;
-      this.failRun(run, error);
+  async executeWhile(run2, graph, context, wf, node2) {
+    const iteration = wf.loops[node2.id] ?? 0;
+    if (iteration >= node2.maxIterations) {
+      const error = `while node ${node2.id} exceeded maxIterations (${node2.maxIterations})`;
+      await this.failRun(run2, error);
       return { kind: "failed", error };
     }
     const scope = { ...this.conditionScope(context), i: iteration };
-    const keepGoing = evaluateExpr(node.condition, scope);
+    const keepGoing = evaluateExpr(node2.condition, scope);
     if (!keepGoing) {
-      wf.completedLoops[node.id] = iteration;
-      delete wf.loops[node.id];
-      wf.cursor = node.next;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: node.id };
+      wf.completedLoops[node2.id] = iteration;
+      delete wf.loops[node2.id];
+      wf.cursor = node2.next;
+      await this.persistContext(run2, context, wf);
+      return { kind: "advanced", nodeId: node2.id };
     }
-    wf.cursor = node.body[0];
-    this.persistContext(run, context, wf);
-    return { kind: "advanced", nodeId: node.id };
+    wf.cursor = node2.body[0];
+    await this.persistContext(run2, context, wf);
+    return { kind: "advanced", nodeId: node2.id };
   }
   recordStepResult(context, nodeId, output) {
-    const steps = context.steps ?? {};
+    const steps = Object.assign(Object.create(null), context.steps ?? {});
     steps[nodeId] = output;
     context.steps = steps;
   }
-  completeRun(run, context) {
+  async completeRun(run2, context) {
     const result = {
       steps: context.steps ?? {},
       iterations: context.__wf?.completedLoops ?? {}
@@ -1586,21 +2199,23 @@ class WorkflowsDaemon {
       assertNoSecrets(result, "run result");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      this.failRun(run, message);
+      await this.failRun(run2, message);
       return;
     }
-    this.store.setRunStatus(run.id, "completed", { result, finishedAt: nowIso(), error: null });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "completed", at: nowIso() });
-    const lease = this.leases.get(run.id);
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "completed", { result, finishedAt: nowIso(), error: null }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "completed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
     if (lease)
-      this.release(run.id, lease.fencing);
+      this.release(run2.id, lease.fencing);
   }
-  failRun(run, error) {
-    this.store.setRunStatus(run.id, "failed", { error, finishedAt: nowIso() });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "failed", at: nowIso() });
-    const lease = this.leases.get(run.id);
+  async failRun(run2, error) {
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "failed", { error, finishedAt: nowIso() }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "failed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
     if (lease)
-      this.release(run.id, lease.fencing);
+      this.release(run2.id, lease.fencing);
   }
 }
 var defaultLaneRunner = async (job) => {
@@ -1611,48 +2226,125 @@ var defaultLaneRunner = async (job) => {
 };
 async function runGraphToCompletion(store, wal, graph, context, options = {}) {
   const daemon = new WorkflowsDaemon(store, wal, {
-    worker: "local",
+    worker: `foreground-${randomUUID2()}`,
     laneRunner: options.laneRunner,
     time: options.time,
     env: options.env,
     isolatedRunId: options.isolatedRunId
   });
-  const run = daemon.startRun(graph, context);
-  daemon.isolateRun(run.id);
+  const run2 = options.existingRunId ? await store.getRun(options.existingRunId) : await daemon.startRun(graph, context);
+  if (!run2)
+    throw new Error("run not found");
+  options.onRunCreated?.(run2);
+  daemon.isolateRun(run2.id);
   const maxCycles = options.maxCycles ?? 500;
-  for (let cycle = 0;cycle < maxCycles; cycle++) {
-    const report = await daemon.reap();
-    const current = store.getRun(run.id);
-    if (current.status !== "running")
-      return current;
-    if (report.advanced === 0 && report.dispatched === 0) {
-      return store.getRun(run.id);
-    }
+  const hosted = store instanceof PostgresWorkflowsStore ? store : undefined;
+  if (hosted && !await hosted.acquireExecution(run2.id))
+    return await store.getRun(run2.id);
+  const lease = daemon.claim(run2.id);
+  if (!lease) {
+    await hosted?.releaseExecution();
+    return await store.getRun(run2.id);
+  }
+  try {
+    if (!await store.compareRunStatus(run2.id, ["pending"], "running", { startedAt: nowIso() }))
+      return await store.getRun(run2.id);
+    wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
+    for (let cycle = 0;cycle < maxCycles; cycle++) {
+      daemon.heartbeat(run2.id, lease.fencing);
+      const outcome = await daemon.advanceRun(run2.id);
+      const current = await store.getRun(run2.id);
+      if (current.status !== "running" || outcome.kind === "blocked" || outcome.kind === "noop")
+        return current;
+    }
+    await store.compareRunStatus(run2.id, ["running"], "interrupted", { error: "run reached maxCycles; resume to continue" });
+    return await store.getRun(run2.id);
+  } finally {
+    daemon.release(run2.id, lease.fencing);
+    await hosted?.releaseExecution();
   }
-  return store.getRun(run.id);
 }
 
 // src/paths.ts
 import { existsSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-import { dataDir } from "@hasna/paths";
+import { join as join2 } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
 var APP = "workflows";
 var STORE_DB_FILE = "workflows.db";
 function getHomeDir(env = process.env) {
   return env["HOME"] || env["USERPROFILE"] || homedir();
 }
 function getLegacyDataDir(env = process.env) {
-  return join(getHomeDir(env), ".hasna", APP);
+  return join2(getHomeDir(env), ".hasna", APP);
 }
-function getResolverDataDir(env = process.env) {
-  return dataDir({ app: APP, home: getHomeDir(env), env });
+function getResolverDataDir(env = process.env, platform = process.platform) {
+  return dataDir({ app: APP, home: getHomeDir(env), env, platform });
 }
 function adoptResolverDataDir(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync(join(resolved, STORE_DB_FILE));
+  return existsSync(join2(resolved, STORE_DB_FILE));
 }
 function getEffectiveDataDir(env = process.env) {
   const resolved = getResolverDataDir(env);
@@ -1662,17 +2354,42 @@ function getEffectiveDataDir(env = process.env) {
 // src/store.ts
 import { Database } from "bun:sqlite";
 import { mkdirSync } from "fs";
-import { join as join2 } from "path";
-import { randomUUID } from "crypto";
+import { join as join3 } from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+var RUN_STATUSES = ["pending", "running", "completed", "failed", "cancelled", "interrupted"];
 function nowIso2() {
   return new Date().toISOString();
 }
+var BUSY_TIMEOUT_MS = 3000;
+var BUSY_RETRIES = 2;
+var BUSY_RETRY_SLEEP_MS = 50;
+function isBusyError(err) {
+  if (!(err instanceof Error))
+    return false;
+  const code = String(err.code ?? "");
+  return code.includes("BUSY") || /\bdatabase is locked\b/i.test(err.message);
+}
+function retryBusy(fn) {
+  let last;
+  for (let attempt = 0;attempt <= BUSY_RETRIES; attempt++) {
+    try {
+      return fn();
+    } catch (err) {
+      if (!isBusyError(err))
+        throw err;
+      last = err;
+      Bun.sleepSync(BUSY_RETRY_SLEEP_MS);
+    }
+  }
+  throw last;
+}
 function openStore(dataDir2) {
   mkdirSync(dataDir2, { recursive: true });
-  const db = new Database(join2(dataDir2, "workflows.db"));
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA foreign_keys = ON");
-  db.exec(`
+  const db = new Database(join3(dataDir2, "workflows.db"));
+  retryBusy(() => db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`));
+  retryBusy(() => db.exec("PRAGMA journal_mode = WAL"));
+  retryBusy(() => db.exec("PRAGMA foreign_keys = ON"));
+  retryBusy(() => db.exec(`
     CREATE TABLE IF NOT EXISTS runs (
       id            TEXT PRIMARY KEY,
       graph_name    TEXT NOT NULL,
@@ -1709,10 +2426,12 @@ function openStore(dataDir2) {
       hit_count   INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_runs_idempotency ON runs(json_extract(context_json, '$.__wf.idempotencyKey'))
+      WHERE json_type(context_json, '$.__wf.idempotencyKey') = 'text';
     CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
     CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
     CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
-  `);
+  `));
   const rowToRun = (r) => ({
     id: String(r.id),
     graphName: String(r.graph_name),
@@ -1750,31 +2469,37 @@ function openStore(dataDir2) {
     createdAt: String(r.created_at)
   });
   return {
+    dataDir: dataDir2,
     close() {
       db.close();
     },
     listTables() {
-      const rows = db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all();
+      const rows = retryBusy(() => db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all());
       return rows.map((r) => r.name);
     },
     createRun(input) {
-      const id = randomUUID();
+      const id = randomUUID3();
       const now = nowIso2();
-      db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
-         VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now);
+      retryBusy(() => db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
+             VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now));
       return this.getRun(id);
     },
     getRun(id) {
-      const row = db.query(`SELECT * FROM runs WHERE id = ?`).get(id);
+      const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE id = ?`).get(id));
+      return row ? rowToRun(row) : undefined;
+    },
+    getRunByIdempotencyKey(key) {
+      const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE json_valid(context_json) AND json_extract(context_json, '$.__wf.idempotencyKey') = ? ORDER BY created_at DESC LIMIT 1`).get(key));
       return row ? rowToRun(row) : undefined;
     },
     listRuns(opts = {}) {
       const limit = Math.min(opts.limit ?? 100, 1000);
       if (opts.status) {
-        const rows2 = db.query(`SELECT * FROM runs WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(opts.status, limit);
+        const status = opts.status;
+        const rows2 = retryBusy(() => db.query(`SELECT * FROM runs WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(status, limit));
         return rows2.map((r) => rowToRun(r));
       }
-      const rows = db.query(`SELECT * FROM runs ORDER BY created_at DESC, id DESC LIMIT ?`).all(limit);
+      const rows = retryBusy(() => db.query(`SELECT * FROM runs ORDER BY created_at DESC, id DESC LIMIT ?`).all(limit));
       return rows.map((r) => rowToRun(r));
     },
     setRunStatus(id, status, patch = {}) {
@@ -1785,28 +2510,99 @@ function openStore(dataDir2) {
       const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing?.startedAt === null ? now : existing?.startedAt ?? null;
       const terminal = status === "completed" || status === "failed" || status === "cancelled" || status === "interrupted";
       const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
-      db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id);
+      retryBusy(() => db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id));
+    },
+    compareRunStatus(id, expected, status, patch = {}) {
+      return retryBusy(() => db.transaction(() => {
+        const current = this.getRun(id);
+        if (!current || !expected.includes(current.status))
+          return false;
+        this.setRunStatus(id, status, patch);
+        return true;
+      }).immediate());
     },
     bumpAttempts(id) {
-      db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id);
+      retryBusy(() => db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id));
     },
     setRunContext(id, context) {
-      db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id);
+      retryBusy(() => db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id));
+    },
+    setRunningContext(id, context) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(id)?.status !== "running")
+          return false;
+        this.setRunContext(id, context);
+        return true;
+      }).immediate());
+    },
+    blockRunResume(id) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    dispatchIfRunning(id, action) {
+      return retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (run2?.status !== "running")
+          return { started: false };
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, executionMayBeActive: true };
+        this.setRunContext(id, context);
+        return { started: true, result: action() };
+      }).immediate());
+    },
+    finishDispatch(id, unconfirmed) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        delete context.__wf?.executionMayBeActive;
+        if (unconfirmed)
+          context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    commitStep(input) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(input.runId)?.status !== "running")
+          return false;
+        const node2 = this.getRunNode(input.nodeRowId);
+        if (!node2 || node2.runId !== input.runId)
+          return false;
+        this.setRunNodeStatus(input.nodeRowId, input.status, input.patch);
+        if (input.incrementAttempts)
+          this.bumpAttemptsNode(input.nodeRowId);
+        if (input.context !== undefined)
+          this.setRunContext(input.runId, input.context);
+        if (input.memo)
+          this.memoPut(input.memo.key, input.memo.graphName, input.memo.nodeId, input.memo.inputHash, input.memo.outputJson);
+        return true;
+      }).immediate());
     },
     createRunNode(input) {
-      const id = randomUUID();
-      db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
-         VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null);
+      const id = randomUUID3();
+      retryBusy(() => db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
+             VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null));
       return this.getRunNode(id);
     },
     getRunNode(id) {
-      const row = db.query(`SELECT * FROM run_nodes WHERE id = ?`).get(id);
+      const row = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE id = ?`).get(id));
       return row ? rowToNode(row) : undefined;
     },
     listRunNodes(runId) {
-      const rows = db.query(`SELECT * FROM run_nodes WHERE run_id = ? ORDER BY rowid ASC`).all(runId);
+      const rows = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE run_id = ? ORDER BY rowid ASC`).all(runId));
       return rows.map((r) => rowToNode(r));
     },
+    getLatestRunNode(runId, nodeId) {
+      const row = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE run_id = ? AND node_id = ? ORDER BY rowid DESC LIMIT 1`).get(runId, nodeId));
+      return row ? rowToNode(row) : undefined;
+    },
     setRunNodeStatus(id, status, patch = {}) {
       const now = nowIso2();
       const existing = this.getRunNode(id);
@@ -1818,57 +2614,60 @@ function openStore(dataDir2) {
       const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing.startedAt === null ? now : existing.startedAt;
       const terminal = status === "completed" || status === "failed" || status === "skipped";
       const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing.finishedAt === null ? now : existing.finishedAt;
-      db.query(`UPDATE run_nodes SET status = ?, exit_code = ?, output_json = ?, error = ?, started_at = ?, finished_at = ? WHERE id = ?`).run(status, exitCode, outputJson, error, startedAt, finishedAt, id);
+      retryBusy(() => db.query(`UPDATE run_nodes SET status = ?, exit_code = ?, output_json = ?, error = ?, started_at = ?, finished_at = ? WHERE id = ?`).run(status, exitCode, outputJson, error, startedAt, finishedAt, id));
     },
     bumpAttemptsNode(id) {
-      db.query(`UPDATE run_nodes SET attempts = attempts + 1 WHERE id = ?`).run(id);
+      retryBusy(() => db.query(`UPDATE run_nodes SET attempts = attempts + 1 WHERE id = ?`).run(id));
     },
     memoPut(key, graphName, nodeId, inputHash2, outputJson) {
-      db.query(`INSERT INTO memos (key, graph_name, node_id, input_hash, output_json, hit_count, created_at)
-         VALUES (?, ?, ?, ?, ?, 0, ?)
-         ON CONFLICT(key) DO UPDATE SET output_json = excluded.output_json`).run(key, graphName, nodeId, inputHash2, outputJson, nowIso2());
+      retryBusy(() => db.query(`INSERT INTO memos (key, graph_name, node_id, input_hash, output_json, hit_count, created_at)
+             VALUES (?, ?, ?, ?, ?, 0, ?)
+             ON CONFLICT(key) DO UPDATE SET output_json = excluded.output_json`).run(key, graphName, nodeId, inputHash2, outputJson, nowIso2()));
     },
     memoGet(key) {
-      const row = db.query(`SELECT * FROM memos WHERE key = ?`).get(key);
+      const row = retryBusy(() => db.query(`SELECT * FROM memos WHERE key = ?`).get(key));
       return row ? rowToMemo(row) : undefined;
     },
     memoHit(key) {
-      db.query(`UPDATE memos SET hit_count = hit_count + 1 WHERE key = ?`).run(key);
+      retryBusy(() => db.query(`UPDATE memos SET hit_count = hit_count + 1 WHERE key = ?`).run(key));
     },
     memoList() {
-      const rows = db.query(`SELECT * FROM memos ORDER BY created_at DESC LIMIT 1000`).all();
+      const rows = retryBusy(() => db.query(`SELECT * FROM memos ORDER BY created_at DESC LIMIT 1000`).all());
       return rows.map((r) => rowToMemo(r));
     },
     memoClear() {
-      db.exec(`DELETE FROM memos`);
+      retryBusy(() => db.exec(`DELETE FROM memos`));
     }
   };
 }
 
 // src/wal.ts
-import { createHash as createHash3 } from "crypto";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, renameSync, truncateSync, writeFileSync } from "fs";
-import { join as join3 } from "path";
+import { Database as Database2 } from "bun:sqlite";
+import { createHash as createHash2 } from "crypto";
+import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { basename, dirname, join as join4 } from "path";
 var WAL_FILE_NAME = "session.wal";
 var SESSIONS_DIR_NAME = "sessions";
 var MAX_WAL_BYTES = 256 * 1024 * 1024;
 function checksumOf(op) {
   if (op === undefined || op === null)
     return "";
-  return createHash3("sha256").update(JSON.stringify(op)).digest("hex");
+  return createHash2("sha256").update(JSON.stringify(op)).digest("hex");
 }
 
 class SessionWAL {
   filePath;
+  journalLocked = false;
   constructor(filePath) {
     this.filePath = filePath;
   }
   static open(dataDir2) {
-    mkdirSync2(join3(dataDir2, SESSIONS_DIR_NAME), { recursive: true });
-    const canonical = join3(dataDir2, SESSIONS_DIR_NAME, WAL_FILE_NAME);
-    const legacy = join3(dataDir2, WAL_FILE_NAME);
+    mkdirSync2(join4(dataDir2, SESSIONS_DIR_NAME), { recursive: true, mode: 448 });
+    const canonical = join4(dataDir2, SESSIONS_DIR_NAME, WAL_FILE_NAME);
+    const legacy = join4(dataDir2, WAL_FILE_NAME);
     if (existsSync2(legacy) && !existsSync2(canonical)) {
       try {
+        preserveOriginal(legacy);
         renameSync(legacy, canonical);
       } catch {
         return new SessionWAL(legacy);
@@ -1880,25 +2679,59 @@ class SessionWAL {
     return new SessionWAL(filePath);
   }
   append(op) {
+    return this.withJournalLock(() => this.appendLocked(op));
+  }
+  withJournalLock(operation) {
+    if (this.journalLocked)
+      return operation();
+    const parent = dirname(this.filePath);
+    const dataDir2 = basename(parent) === SESSIONS_DIR_NAME ? dirname(parent) : parent;
+    mkdirSync2(dataDir2, { recursive: true, mode: 448 });
+    const mutex = new Database2(join4(dataDir2, "workflows.db"));
+    try {
+      mutex.exec("PRAGMA busy_timeout = 5000");
+      mutex.exec("BEGIN IMMEDIATE");
+      this.journalLocked = true;
+      try {
+        const result = operation();
+        mutex.exec("COMMIT");
+        return result;
+      } catch (error) {
+        mutex.exec("ROLLBACK");
+        throw error;
+      } finally {
+        this.journalLocked = false;
+      }
+    } finally {
+      mutex.close();
+    }
+  }
+  exclusive(operation) {
+    return this.withJournalLock(operation);
+  }
+  appendLocked(op) {
     const at = op.at ?? new Date().toISOString();
     const full = { ...op, at };
     const nextSeq = this.nextSeq();
     const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
     appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, "utf8");
+`, { encoding: "utf8", mode: 384 });
     return entry;
   }
   nextSeq() {
     const replay = this.replay();
     return replay.entries.length + 1;
   }
-  replay() {
+  replay(options = {}) {
+    return this.withJournalLock(() => this.replayLocked(options));
+  }
+  replayLocked(options) {
     const entries = [];
     let torn = false;
     let repaired = false;
     let content;
     try {
-      content = readFileSync(this.filePath, "utf8");
+      content = readFileSync2(this.filePath, "utf8");
     } catch {
       return { entries, torn, repaired, liveClaims: () => new Map };
     }
@@ -1936,6 +2769,9 @@ class SessionWAL {
     if (badOffset !== null) {
       torn = true;
       try {
+        if (options.repair === false)
+          return { entries, torn, repaired, liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs) };
+        preserveOriginal(this.filePath);
         truncateSync(this.filePath, badOffset);
         repaired = true;
       } catch {}
@@ -1975,13 +2811,22 @@ function reconstructLiveClaims(entries, nowMs = Date.now()) {
   }
   return claims;
 }
+function preserveOriginal(filePath) {
+  const original = readFileSync2(filePath);
+  const digest = createHash2("sha256").update(original).digest("hex");
+  const backup = `${filePath}.preserved-${digest}`;
+  if (!existsSync2(backup))
+    copyFileSync(filePath, backup, constants.COPYFILE_EXCL);
+  if (!readFileSync2(backup).equals(original))
+    throw new Error("session WAL preservation readback failed; source retained");
+  return backup;
+}
 
 // src/service.ts
+import { hostname } from "os";
+import { resolveDatabaseUrl } from "@hasna/contracts";
 var DEFAULT_PORT = 8790;
 var DEFAULT_HOST = "127.0.0.1";
-function packageVersion() {
-  return package_default.version;
-}
 function envString(names) {
   for (const name of names) {
     const value = process.env[name];
@@ -1998,69 +2843,218 @@ function envInt(names, fallback) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 function resolveWorkflowsConfig(overrides = {}) {
+  const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
+  if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
+    throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
   return {
     port: overrides.port ?? envInt(["HASNA_WORKFLOWS_PORT", "WORKFLOWS_PORT"], DEFAULT_PORT),
     host: overrides.host ?? envString(["HASNA_WORKFLOWS_HOST", "WORKFLOWS_HOST"]) ?? DEFAULT_HOST,
     dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? getEffectiveDataDir(),
-    apiUrl: overrides.apiUrl ?? envString(["WORKFLOWS_API_URL"]),
-    apiKey: overrides.apiKey ?? envString(["WORKFLOWS_API_KEY"])
+    apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
+    apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
+    originAuth,
+    storageBackend: overrides.storageBackend ?? "postgresql",
+    databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
   };
 }
 
 class WorkflowsService {
+  execution;
   name = "workflows";
   version;
   config;
   startedAt = Date.now();
-  constructor(config = {}) {
+  databaseEnv;
+  constructor(config = {}, execution = {}) {
+    this.execution = execution;
     this.config = resolveWorkflowsConfig(config);
+    this.databaseEnv = config.databaseUrl !== undefined ? { HASNA_WORKFLOWS_DATABASE_URL: config.databaseUrl } : {
+      HASNA_WORKFLOWS_DATABASE_URL: process.env.HASNA_WORKFLOWS_DATABASE_URL,
+      WORKFLOWS_DATABASE_URL: process.env.WORKFLOWS_DATABASE_URL
+    };
     this.version = packageVersion();
   }
   health() {
     return {
       ok: true,
+      status: "ok",
+      backend: this.config.storageBackend,
       service: this.name,
       version: this.version,
       pid: process.pid,
       uptimeMs: Date.now() - this.startedAt
     };
   }
-  ready() {
+  async ready() {
+    const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
+    if (this.config.apiKey) {
+      try {
+        checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
+      } catch (error) {
+        checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
+      }
+    }
+    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+  }
+  async openEngineStore(verifySchema = true) {
+    if (this.config.storageBackend === "sqlite")
+      return openStore(this.config.dataDir);
+    if (this.config.storageBackend !== "postgresql")
+      throw new WorkflowRequestError("invalid_storage_backend", "storage backend must be postgresql or explicit embedded sqlite", 503);
+    let databaseUrl;
+    try {
+      databaseUrl = resolveDatabaseUrl("workflows", this.databaseEnv);
+    } catch (error) {
+      throw new WorkflowRequestError("invalid_database_configuration", error instanceof Error ? error.message : "HASNA_WORKFLOWS_DATABASE_URL must configure PostgreSQL", 503);
+    }
+    let store;
+    try {
+      store = new PostgresWorkflowsStore({ databaseUrl, dataDir: this.config.dataDir, schema: this.config.databaseSchema });
+    } catch {
+      throw new WorkflowRequestError("invalid_database_schema", "HASNA_WORKFLOWS_DATABASE_SCHEMA must be a lowercase SQL identifier", 503);
+    }
+    try {
+      if (verifySchema && !await store.checkSchema())
+        throw new WorkflowRequestError("invalid_schema", "PostgreSQL workflow schema requires explicit initialization or a reviewed migration", 503);
+      return store;
+    } catch (error) {
+      await store.close();
+      throw error;
+    }
+  }
+  async withStore(operation) {
+    const store = await this.openEngineStore();
+    try {
+      return await operation(store);
+    } finally {
+      await store.close();
+    }
+  }
+  async initializeStorage() {
+    const store = await this.openEngineStore(false);
+    try {
+      if (!(store instanceof PostgresWorkflowsStore))
+        throw new WorkflowRequestError("invalid_storage_backend", "init-db requires PostgreSQL", 503);
+      await store.initialize();
+    } finally {
+      await store.close();
+    }
+  }
+  listRuns(options = {}) {
+    return this.withStore((store) => store.listRuns(options));
+  }
+  getRun(id) {
+    return this.withStore((store) => store.getRun(id));
+  }
+  listNodes(id) {
+    return this.withStore((store) => store.listRunNodes(id));
+  }
+  events(id) {
+    return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
+  }
+  cancelRun(id) {
+    return this.withStore(async (store) => {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        return;
+      if (["completed", "failed", "cancelled"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "cancellation requires a pending, running, or interrupted run", 409);
+      if (!await store.compareRunStatus(id, ["pending", "running", "interrupted"], "cancelled", { finishedAt: new Date().toISOString() }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before cancellation", 409);
+      return store.getRun(id);
+    });
+  }
+  async resumeRun(id) {
+    const store = await this.openEngineStore();
+    const wal = SessionWAL.open(this.config.dataDir);
+    try {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        throw new WorkflowRequestError("run_not_found", "run id does not exist", 404);
+      if (!["failed", "cancelled", "interrupted"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
+      const context = JSON.parse(run2.contextJson);
+      if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
+        throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
+      if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
+        throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
+      for (const node2 of await store.listRunNodes(id)) {
+        if (node2.status !== "completed")
+          await store.setRunNodeStatus(node2.id, "pending", { error: null });
+      }
+      const final = await runGraphToCompletion(store, wal, graph, context, { ...this.execution, existingRunId: id });
+      return runSummary(final, false);
+    } finally {
+      await store.close();
+    }
+  }
+  sessions(action) {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    if (action === "list")
+      return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
     return {
-      ok: true,
-      service: this.name,
-      version: this.version,
-      checks: { version: "ok" }
+      entries: replay.entries.length,
+      torn: replay.torn,
+      repaired: false,
+      liveClaims: [...replay.liveClaims().entries()].map(([runId, claim]) => ({ runId, worker: claim.worker, fencing: claim.fencing, expiresAt: new Date(claim.expiresAtMs).toISOString() }))
     };
   }
+  machines(action) {
+    const local = { name: hostname(), role: "server", version: this.version };
+    if (action === "list")
+      return [local];
+    return { ...local, health: this.health(), sessions: this.sessions("pull") };
+  }
+  daemonStatus() {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
+  }
+  listMemos() {
+    return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
+  }
   async triggerRun(graph, context = {}, opts = {}) {
-    const store = openStore(this.config.dataDir);
+    const store = await this.openEngineStore();
     const wal = SessionWAL.open(this.config.dataDir);
     try {
-      if (opts.idempotencyKey) {
-        const existing = findRunByIdempotencyKey(store, opts.idempotencyKey);
-        if (existing) {
-          return {
-            runId: existing.id,
-            status: existing.status,
-            error: existing.error ?? null,
-            result: existing.resultJson ? JSON.parse(existing.resultJson) : null,
-            reused: true
-          };
+      if (context === null || typeof context !== "object" || Array.isArray(context))
+        throw new WorkflowRequestError("invalid_context", "context must be an object");
+      if (Object.hasOwn(context, "__wf") || Object.hasOwn(context, "steps"))
+        throw new WorkflowRequestError("reserved_context", "context.__wf and context.steps are reserved for the workflow engine");
+      const maxCycles = opts.maxCycles ?? 500;
+      if (!Number.isSafeInteger(maxCycles) || maxCycles < 1 || maxCycles > 2000)
+        throw new WorkflowRequestError("invalid_max_cycles", "maxCycles must be an integer from 1 to 2000");
+      if (opts.idempotencyKey !== undefined && !/^[A-Za-z0-9_.:-]{1,128}$/.test(opts.idempotencyKey))
+        throw new WorkflowRequestError("invalid_idempotency_key", "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-");
+      const requestHash = createHash3("sha256").update(canonicalJson({ graph, context, maxCycles })).digest("hex");
+      const reuse = async () => {
+        const existing2 = opts.idempotencyKey ? await store.getRunByIdempotencyKey(opts.idempotencyKey) : undefined;
+        if (!existing2)
+          return;
+        if (JSON.parse(existing2.contextJson).__wf?.requestHash !== requestHash)
+          throw new WorkflowRequestError("idempotency_conflict", "idempotencyKey is already bound to a different request", 409);
+        return runSummary(existing2, true);
+      };
+      const existing = await reuse();
+      if (existing)
+        return existing;
+      const contextWithKey = { ...context, __wf: { requestHash, ...opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {} } };
+      let final;
+      try {
+        final = await runGraphToCompletion(store, wal, graph, contextWithKey, { ...this.execution, maxCycles });
+      } catch (err) {
+        if (err instanceof Error && (/UNIQUE constraint failed/.test(err.message) || err.code === "23505")) {
+          const winner = await reuse();
+          if (winner)
+            return winner;
         }
+        throw err;
       }
-      const contextWithKey = opts.idempotencyKey ? {
-        ...context,
-        __wf: {
-          cursor: undefined,
-          loops: {},
-          completedLoops: {},
-          ...context?.__wf ?? {},
-          idempotencyKey: opts.idempotencyKey
-        }
-      } : context;
-      const maxCycles = Math.min(Math.max(opts.maxCycles ?? 500, 1), 2000);
-      const final = await runGraphToCompletion(store, wal, graph, contextWithKey, { maxCycles });
       return {
         runId: final.id,
         status: final.status,
@@ -2069,16 +3063,110 @@ class WorkflowsService {
         reused: false
       };
     } finally {
-      store.close();
+      await store.close();
     }
   }
 }
-function createWorkflowsService(config = {}) {
-  return new WorkflowsService(config);
+function createWorkflowsService(config = {}, execution = {}) {
+  return new WorkflowsService(config, execution);
+}
+
+class WorkflowRequestError extends Error {
+  code;
+  status;
+  constructor(code, message, status = 400) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "WorkflowRequestError";
+  }
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().filter((k) => value[k] !== undefined).map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(",")}}`;
+  return JSON.stringify(value) ?? "null";
+}
+function runSummary(run2, reused) {
+  return { runId: run2.id, status: run2.status, error: run2.error ?? null, result: run2.resultJson ? JSON.parse(run2.resultJson) : null, reused };
 }
 
 // src/handlers.ts
 import { createHash as createHash4, timingSafeEqual } from "crypto";
+
+// src/openapi.ts
+function buildOpenApi(version) {
+  const string = { type: "string" }, integer = { type: "integer" }, nullableString = { type: "string", nullable: true };
+  const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+  const object = (properties, required = Object.keys(properties)) => ({ type: "object", properties, required });
+  const response = (schema, description = "Success") => ({ description, content: { "application/json": { schema } } });
+  const id = [{ name: "id", in: "path", required: true, schema: { type: "string", pattern: "^[a-zA-Z0-9_-]{1,128}$" } }];
+  const body = (schema) => ({ required: true, description: "JSON object, at most 1 MiB", content: { "application/json": { schema } } });
+  const statuses = ["pending", "running", "completed", "failed", "interrupted", "cancelled"];
+  const operation = (operationId, summary, schema, extra = {}, publicRoute = false) => ({
+    operationId,
+    summary,
+    ...publicRoute ? {} : { security: [{ bearerAuth: [] }] },
+    ...extra,
+    responses: { "200": response(schema), ...publicRoute ? {} : {
+      "400": response(ref("ApiError"), "Invalid field or request shape"),
+      "401": response(ref("ApiError"), "Bearer credential missing or refused"),
+      "404": response(ref("ApiError"), "Run or route absent"),
+      "409": response(ref("ApiError"), "Conflicting key, run state or execution ownership"),
+      "503": response(ref("ApiError"), "Authentication or PostgreSQL storage unavailable")
+    } }
+  });
+  const doc = {
+    openapi: "3.0.3",
+    info: { title: "workflows", version },
+    servers: [{ url: "./" }],
+    paths: {
+      "/health": { get: operation("getHealth", "Service health", ref("HealthReport"), {}, true) },
+      "/ready": { get: { ...operation("getReadiness", "Authentication and actual schema readiness", ref("ReadinessReport"), {}, true), responses: { "200": response(ref("ReadinessReport")), "503": response(ref("ReadinessReport"), "Not ready") } } },
+      "/version": { get: operation("getVersion", "Package version", object({ service: string, version: string }), {}, true) },
+      "/validate": { post: operation("validateWorkflow", "Validate a workflow graph", ref("GraphValidation"), { requestBody: body(object({ graph: ref("WorkflowGraph") })) }) },
+      "/trigger": { post: operation("triggerWorkflow", "Execute a bounded workflow; identical keyed retries reuse the original run", ref("RunSummary"), { requestBody: body(object({ graph: ref("WorkflowGraph"), context: { type: "object", description: "__wf and steps are reserved", additionalProperties: true }, idempotencyKey: { type: "string", pattern: "^[A-Za-z0-9_.:-]{1,128}$" }, maxCycles: { type: "integer", minimum: 1, maximum: 2000, default: 500 } }, ["graph"])) }) },
+      "/runs": { get: operation("listRunRecords", "List recent runs", { type: "array", items: ref("RunRow") }, { parameters: [{ name: "status", in: "query", schema: { type: "string", enum: statuses } }, { name: "limit", in: "query", schema: { type: "integer", minimum: 1, maximum: 1000, default: 100 } }] }) },
+      "/runs/{id}": { get: operation("getRunRecord", "Read a durable run", ref("RunRow"), { parameters: id }) },
+      "/runs/{id}/nodes": { get: operation("getRunNodes", "Ordered node execution history", { type: "array", items: ref("RunNodeRow") }, { parameters: id }) },
+      "/runs/{id}/events": { get: operation("getRunEvents", "Preserved execution journal events", { type: "array", items: { type: "object" } }, { parameters: id }) },
+      "/runs/{id}/cancel": { post: operation("cancelWorkflow", "Cancel a pending, running or interrupted run and fence late results", ref("RunRow"), { parameters: id }) },
+      "/runs/{id}/resume": { post: operation("resumeWorkflow", "Continue a failed, cancelled or interrupted run using its pinned graph; active or unconfirmed execution refuses resume", ref("RunSummary"), { parameters: id }) },
+      "/lanes": { get: operation("listLanes", "Inspect lane substrates; this does not prove sign-in or model capacity", { type: "array", items: { type: "object" } }) },
+      "/lanes/{lane}": { get: operation("probeLane", "Inspect one lane substrate", { type: "object" }, { parameters: [{ name: "lane", in: "path", required: true, schema: { type: "string", enum: ["claude", "codex", "cursor", "grok"] } }] }) },
+      "/sessions/list": { get: operation("listSessionEvents", "Recent journal event metadata", { type: "array", items: { type: "object" } }) },
+      "/sessions/pull": { get: operation("inspectSession", "Read journal and claim state without repair", { type: "object" }) },
+      "/machines/list": { get: operation("listServerMachines", "This executor, not a fleet census", { type: "array", items: { type: "object" } }) },
+      "/machines/status": { get: operation("inspectServerMachine", "This executor's health and claims", { type: "object" }) },
+      "/daemon/status": { get: operation("inspectDaemon", "Bounded-trigger executor status", { type: "object" }) },
+      "/memos/list": { get: operation("listMemoRecords", "Recent memo results", { type: "array", items: { type: "object" } }) }
+    },
+    components: {
+      securitySchemes: { bearerAuth: { type: "http", scheme: "bearer" } },
+      schemas: {
+        ApiError: object({ error: string, message: string }, ["error"]),
+        HealthReport: object({ ok: { type: "boolean" }, status: { type: "string", enum: ["ok"] }, backend: { type: "string", enum: ["postgresql", "sqlite"] }, service: string, version: string, pid: integer, uptimeMs: integer }),
+        ReadinessReport: object({ ok: { type: "boolean" }, service: string, version: string, checks: { type: "object", additionalProperties: string } }),
+        GraphValidation: object({ ok: { type: "boolean" }, issues: { type: "array", items: object({ path: string, message: string }) } }),
+        StartNode: object({ id: string, type: { type: "string", enum: ["start"] }, next: string }, ["id", "type"]),
+        StepNode: object({ id: string, type: { type: "string", enum: ["step"] }, next: string, lane: { type: "string", enum: ["claude", "codex", "cursor", "grok"] }, prompt: string, command: string, maxRetries: { type: "integer", minimum: 0 }, memo: { type: "boolean" }, timeoutMs: { type: "integer", minimum: 1 } }, ["id", "type"]),
+        DecisionNode: object({ id: string, type: { type: "string", enum: ["decision"] }, condition: string, then: string, else: string }, ["id", "type", "condition"]),
+        WhileNode: object({ id: string, type: { type: "string", enum: ["while"] }, condition: string, body: { type: "array", items: string }, maxIterations: { type: "integer", minimum: 1 }, next: string }, ["id", "type", "condition", "body", "maxIterations"]),
+        EndNode: object({ id: string, type: { type: "string", enum: ["end"] } }),
+        GraphNode: { oneOf: ["StartNode", "StepNode", "DecisionNode", "WhileNode", "EndNode"].map(ref) },
+        WorkflowGraph: object({ name: string, version: string, nodes: { type: "array", items: ref("GraphNode") }, memoWatch: { type: "array", items: string } }, ["name", "version", "nodes"]),
+        RunSummary: object({ runId: string, status: { type: "string", enum: statuses }, error: nullableString, result: {}, reused: { type: "boolean" } }),
+        RunRow: object({ id: string, graphName: string, graphVersion: string, status: { type: "string", enum: statuses }, attempts: integer, contextJson: string, resultJson: nullableString, error: nullableString, startedAt: nullableString, finishedAt: nullableString, createdAt: string, updatedAt: string }),
+        RunNodeRow: object({ id: string, runId: string, nodeId: string, status: { type: "string", enum: ["pending", "running", "completed", "failed", "skipped"] }, attempts: integer, lane: nullableString, exitCode: { type: "integer", nullable: true }, outputJson: nullableString, error: nullableString, startedAt: nullableString, finishedAt: nullableString })
+      }
+    }
+  };
+  return doc;
+}
+
+// src/handlers.ts
+init_lanes();
 function jsonResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -2086,47 +3174,41 @@ function jsonResponse(body, status = 200) {
   });
 }
 function openApiDoc(service) {
-  return {
-    openapi: "3.0.3",
-    info: { title: "workflows", version: service.version },
-    paths: {
-      "/health": { get: { summary: "Service health", responses: { "200": { description: "ok" } } } },
-      "/ready": { get: { summary: "Service readiness", responses: { "200": { description: "ok" } } } },
-      "/version": { get: { summary: "Service version", responses: { "200": { description: "ok" } } } },
-      "/trigger": {
-        post: {
-          summary: "Authenticated trigger: run a workflow graph to a terminal state",
-          security: [{ bearerAuth: [] }],
-          requestBody: {
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  required: ["graph"],
-                  properties: {
-                    graph: { type: "object", description: "the workflow graph" },
-                    context: { type: "object", description: "optional run context" },
-                    idempotencyKey: { type: "string", description: "re-run with the same key returns the same run" },
-                    maxCycles: { type: "number", description: "bound on reap cycles (default 500, max 2000)" }
-                  }
-                }
-              }
-            }
-          },
-          responses: {
-            "200": { description: "run summary" },
-            "401": { description: "missing or invalid Bearer token" },
-            "503": { description: "trigger not configured (WORKFLOWS_API_KEY unset)" }
-          }
-        }
-      }
-    },
-    components: {
-      securitySchemes: {
-        bearerAuth: { type: "http", scheme: "bearer" }
+  return buildOpenApi(service.version);
+}
+function authenticate(service, req) {
+  if (!service.config.apiKey)
+    return jsonResponse({ error: "auth_not_configured" }, 503);
+  if (!bearerMatches(req.headers.get("authorization") ?? "", service.config.apiKey)) {
+    return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
+  }
+}
+async function readObject(req) {
+  const limit = 1048576;
+  const reader = req.body?.getReader();
+  if (!reader)
+    throw new Error("invalid_json");
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > limit) {
+        await reader.cancel();
+        throw new Error("body_too_large");
       }
+      chunks.push(value);
     }
-  };
+  } finally {
+    reader.releaseLock();
+  }
+  const body = JSON.parse(await new Blob(chunks).text());
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    throw new Error("invalid_body");
+  return body;
 }
 function bearerMatches(authHeader, expected) {
   if (!authHeader.startsWith("Bearer "))
@@ -2147,57 +3229,147 @@ async function handleTrigger(service, req) {
   if (!bearerMatches(auth, expected)) {
     return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
   }
-  let body;
+  let record;
   try {
-    body = await req.json();
+    record = await readObject(req);
   } catch {
-    return jsonResponse({ error: "invalid_json", message: "request body must be JSON" }, 400);
+    return jsonResponse({ error: "invalid_json", message: "request body must be a JSON object within 1 MiB" }, 400);
   }
-  const record = body;
   if (record.graph === null || typeof record.graph !== "object" || Array.isArray(record.graph)) {
     return jsonResponse({ error: "graph_required", message: "body.graph must be a workflow graph object" }, 400);
   }
   const context = record.context ?? {};
-  if (typeof context !== "object" || Array.isArray(context)) {
+  if (context === null || typeof context !== "object" || Array.isArray(context)) {
     return jsonResponse({ error: "invalid_context", message: "body.context must be an object" }, 400);
   }
+  if (record.maxCycles !== undefined && (typeof record.maxCycles !== "number" || !Number.isSafeInteger(record.maxCycles) || record.maxCycles < 1 || record.maxCycles > 2000)) {
+    return jsonResponse({ error: "invalid_max_cycles", message: "maxCycles must be an integer from 1 to 2000" }, 400);
+  }
+  if (record.idempotencyKey !== undefined && (typeof record.idempotencyKey !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(record.idempotencyKey))) {
+    return jsonResponse({ error: "invalid_idempotency_key", message: "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-" }, 400);
+  }
+  const validation = validateGraph(record.graph);
+  if (!validation.ok)
+    return jsonResponse({ error: "invalid_graph", issues: validation.issues }, 400);
   const maxCycles = typeof record.maxCycles === "number" ? record.maxCycles : undefined;
   const idempotencyKey = typeof record.idempotencyKey === "string" ? record.idempotencyKey : undefined;
   try {
     const summary = await service.triggerRun(record.graph, context, { maxCycles, idempotencyKey });
     return jsonResponse(summary);
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return jsonResponse({ error: "trigger_failed", message }, 400);
+    if (err instanceof WorkflowStorageError)
+      return jsonResponse({ error: "storage_unavailable", message: err.message }, 503);
+    if (err instanceof WorkflowRequestError)
+      return jsonResponse({ error: err.code, message: err.message }, err.status);
+    return jsonResponse({ error: "trigger_failed", message: "workflow execution was refused" }, 400);
   }
 }
 function createRequestHandler(service) {
-  return (req) => {
+  return async (req) => {
     const url = new URL(req.url);
-    switch (url.pathname) {
+    if (service.config.originAuth !== undefined && !["/health", "/ready"].includes(url.pathname)) {
+      if (!bearerMatches(`Bearer ${req.headers.get("x-hasna-origin-auth") ?? ""}`, service.config.originAuth)) {
+        return jsonResponse({ error: "WORKFLOWS_ORIGIN_DENIED" }, 403);
+      }
+    }
+    const path = url.pathname.replace(/^\/v1(?=\/|$)/, "") || "/";
+    const method = req.method;
+    const allowed = path === "/trigger" || path === "/validate" || /^\/runs\/[^/]+\/(cancel|resume)$/.test(path) ? "POST" : "GET";
+    if (method !== allowed)
+      return new Response(JSON.stringify({ error: "method_not_allowed" }), { status: 405, headers: { "content-type": "application/json", allow: allowed } });
+    switch (path) {
       case "/health":
         return jsonResponse(service.health());
-      case "/ready":
-        return jsonResponse(service.ready());
+      case "/ready": {
+        const ready = await service.ready();
+        return jsonResponse(ready, ready.ok ? 200 : 503);
+      }
       case "/version":
         return jsonResponse({ service: service.name, version: service.version });
       case "/trigger":
         return handleTrigger(service, req);
       case "/openapi.json":
         return jsonResponse(openApiDoc(service));
-      default:
-        return jsonResponse({ error: "not_found", path: url.pathname }, 404);
+    }
+    if (path !== "/validate" && path !== "/runs" && path !== "/lanes" && !/^\/lanes\/[^/]+$/.test(path) && !/^\/runs\/[^/]+(?:\/(nodes|events|cancel|resume))?$/.test(path) && !/^\/(sessions|machines|daemon|memos)\/(list|pull|status)$/.test(path)) {
+      return jsonResponse({ error: "not_found" }, 404);
+    }
+    const refused = authenticate(service, req);
+    if (refused)
+      return refused;
+    try {
+      if (path === "/validate") {
+        const body = await readObject(req);
+        return jsonResponse(validateGraph(body.graph));
+      }
+      if (path === "/runs") {
+        const limit = Number(url.searchParams.get("limit") ?? 100);
+        const status = url.searchParams.get("status") ?? undefined;
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000 || status !== undefined && !RUN_STATUSES.includes(status))
+          return jsonResponse({ error: "invalid_query" }, 400);
+        return jsonResponse(await service.listRuns({ limit, status }));
+      }
+      if (path === "/lanes")
+        return jsonResponse(await laneInventory());
+      if (path.startsWith("/lanes/")) {
+        const lane = path.slice("/lanes/".length);
+        if (!LANE_KINDS2.includes(lane))
+          return jsonResponse({ error: "invalid_lane" }, 400);
+        return jsonResponse(await probeLane(lane));
+      }
+      if (path === "/sessions/list")
+        return jsonResponse(service.sessions("list"));
+      if (path === "/sessions/pull")
+        return jsonResponse(service.sessions("pull"));
+      if (path === "/machines/list")
+        return jsonResponse(service.machines("list"));
+      if (path === "/machines/status")
+        return jsonResponse(service.machines("status"));
+      if (path === "/daemon/status")
+        return jsonResponse(service.daemonStatus());
+      if (path === "/memos/list")
+        return jsonResponse(await service.listMemos());
+      const match = /^\/runs\/([^/]+)(?:\/(nodes|events|cancel|resume))?$/.exec(path);
+      if (match) {
+        const id = decodeURIComponent(match[1]);
+        if (!/^[a-zA-Z0-9_-]{1,128}$/.test(id))
+          return jsonResponse({ error: "invalid_run_id" }, 400);
+        const run2 = await service.getRun(id);
+        if (!run2)
+          return jsonResponse({ error: "run_not_found" }, 404);
+        switch (match[2]) {
+          case "nodes":
+            return jsonResponse(await service.listNodes(id));
+          case "events":
+            return jsonResponse(service.events(id));
+          case "cancel":
+            return jsonResponse(await service.cancelRun(id));
+          case "resume":
+            return jsonResponse(await service.resumeRun(id));
+          default:
+            return jsonResponse(run2);
+        }
+      }
+      return jsonResponse({ error: "not_found" }, 404);
+    } catch (err) {
+      if (err instanceof WorkflowStorageError)
+        return jsonResponse({ error: "storage_unavailable", message: err.message }, 503);
+      if (err instanceof WorkflowRequestError)
+        return jsonResponse({ error: err.code, message: err.message }, err.status);
+      return jsonResponse({ error: "invalid_request", message: "request was refused" }, 400);
     }
   };
 }
 
 // src/agent-tools.ts
 init_lanes();
+
+// src/tool-definitions.ts
 function textResult(payload) {
   return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: false };
 }
 function workflowsTools(_service) {
-  return [
+  const tools = [
     {
       name: "workflows_version",
       description: "Report the installed @hasna/workflows version.",
@@ -2210,7 +3382,7 @@ function workflowsTools(_service) {
     },
     {
       name: "workflows_ready",
-      description: "Report the workflows service readiness (version check).",
+      description: "Report the hosted workflows service readiness.",
       inputSchema: { type: "object", properties: {} }
     },
     {
@@ -2229,14 +3401,16 @@ function workflowsTools(_service) {
         type: "object",
         properties: {
           graph: { type: "object", description: "the workflow graph" },
-          context: { type: "object", description: "optional run context" }
+          context: { type: "object", description: "optional run context" },
+          idempotencyKey: { type: "string", description: "stable request key" },
+          maxCycles: { type: "integer", minimum: 1, maximum: 2000 }
         },
-        required: ["graph"]
+        required: ["graph", "idempotencyKey"]
       }
     },
     {
       name: "workflows_runs_list",
-      description: "List recent runs from the local store.",
+      description: "List recent runs from the configured hosted service.",
       inputSchema: {
         type: "object",
         properties: {
@@ -2251,7 +3425,13 @@ function workflowsTools(_service) {
       inputSchema: { type: "object", properties: {} }
     }
   ];
+  return tools.map((tool) => ({ ...tool, inputSchema: { ...tool.inputSchema, properties: {
+    ...tool.inputSchema.properties,
+    agent: { type: "string", description: "calling agent identity" }
+  } } }));
 }
+
+// src/agent-tools.ts
 async function callWorkflowTool(service, name, args) {
   switch (name) {
     case "workflows_version":
@@ -2259,42 +3439,26 @@ async function callWorkflowTool(service, name, args) {
     case "workflows_health":
       return textResult(service.health());
     case "workflows_ready":
-      return textResult(service.ready());
+      return textResult(await service.ready());
     case "workflows_validate": {
       const graph = args.graph;
       const result = validateGraph(graph);
       return textResult(result);
     }
-    case "workflows_run": {
-      const graph = args.graph;
-      const store = openStore(service.config.dataDir);
-      const wal = SessionWAL.open(service.config.dataDir);
-      try {
-        const final = await runGraphToCompletion(store, wal, graph, args.context ?? {});
-        return textResult({
-          runId: final.id,
-          status: final.status,
-          error: final.error ?? null,
-          result: final.resultJson ? JSON.parse(final.resultJson) : null
-        });
-      } finally {
-        store.close();
-      }
-    }
-    case "workflows_runs_list": {
-      const store = openStore(service.config.dataDir);
-      try {
-        const status = typeof args.status === "string" ? args.status : undefined;
-        const limit = typeof args.limit === "number" ? args.limit : 100;
-        return textResult(store.listRuns({ status, limit }));
-      } finally {
-        store.close();
-      }
-    }
+    case "workflows_run":
+      return textResult(await service.triggerRun(args.graph, args.context ?? {}, {
+        idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : undefined,
+        maxCycles: typeof args.maxCycles === "number" ? args.maxCycles : undefined
+      }));
+    case "workflows_runs_list":
+      return textResult(await service.listRuns({
+        status: typeof args.status === "string" ? args.status : undefined,
+        limit: typeof args.limit === "number" ? args.limit : 100
+      }));
     case "workflows_lanes_list":
       return textResult(await laneInventory());
     default:
-      throw new Error(`Unknown tool: ${name}`);
+      throw new Error("Unknown workflows tool");
   }
 }
 export {