@hasna/workflows 0.1.4 → 0.2.0

package/dist/service.js

@@ -29,10 +29,30 @@ function binaryOnPath(binary) {
   }
   return false;
 }
-function withTimeout(promise, timeoutMs, what) {
+function subscriptionEnvironment(overrides = {}) {
+  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
+  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
+      env[name] = value;
+  }
+  for (const [name, value] of Object.entries(overrides)) {
+    if (paid.test(name) || sensitive.test(name))
+      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
+    env[name] = value;
+  }
+  return env;
+}
+function subscriptionSdkEnvironment(overrides = {}) {
+  const safe = subscriptionEnvironment(overrides);
+  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
+}
+function withTimeout(promise, timeoutMs, what, cancel) {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
-      reject(new Error(`${what} exceeded the ${timeoutMs}ms budget`));
+      cancel?.();
+      reject(new LaneTimeoutError(what, timeoutMs));
     }, timeoutMs);
     promise.then((value) => {
       clearTimeout(timer);
@@ -43,15 +63,16 @@ function withTimeout(promise, timeoutMs, what) {
     });
   });
 }
-function spawnCli(cmd, opts) {
+async function spawnCli(cmd, opts) {
   const started = Date.now();
   const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
   let proc;
   try {
-    proc = Bun.spawnSync({
+    proc = Bun.spawn({
       cmd,
       cwd: opts.cwd,
-      env: { ...process.env, ...opts.env ?? {} },
+      env: subscriptionEnvironment(opts.env),
+      stdin: "ignore",
       stdout: "pipe",
       stderr: "pipe",
       timeout: timeoutMs
@@ -63,15 +84,16 @@ function spawnCli(cmd, opts) {
     }
     return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
   }
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
   const output = stderr ? `${stdout}
 ${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? 1;
-  return { ok: exitCode === 0, exitCode, output, durationMs };
+  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
 }
-var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000;
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
 var init_types = __esm(() => {
   LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
   LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
@@ -86,6 +108,12 @@ var init_types = __esm(() => {
       this.name = "LaneAdapterShapeError";
     }
   };
+  LaneTimeoutError = class LaneTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+      super(`${what} exceeded the ${timeoutMs}ms budget`);
+      this.name = "LaneTimeoutError";
+    }
+  };
 });
 
 // src/lanes/claude.ts
@@ -127,11 +155,12 @@ function createClaudeAdapter(deps = {}) {
         throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
       }
       const prompt = job.prompt;
+      const abortController = new AbortController;
       try {
         const { output, isError } = await withTimeout((async () => {
           const generator = await query({
             prompt,
-            options: { model: job.model, maxTurns: 32, abortSignal: undefined }
+            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
           });
           let output2 = "";
           let isError2 = false;
@@ -150,19 +179,19 @@ function createClaudeAdapter(deps = {}) {
               isError2 = true;
           }
           return { output: output2, isError: isError2 };
-        })(), timeoutMs, `claude lane (${job.prompt.slice(0, 60)})`);
+        })(), timeoutMs, "claude lane", () => abortController.abort());
         const durationMs = Date.now() - started;
         return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
       } catch (err) {
         const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
   };
 }
-function runClaudeCli(job, cliPath, started, timeoutMs) {
+async function runClaudeCli(job, cliPath, started, timeoutMs) {
   try {
-    const result = spawnCli([cliPath, "-p", job.prompt], {
+    const result = await spawnCli([cliPath, "-p", job.prompt], {
       binaryName: cliPath,
       packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
       timeoutMs,
@@ -219,29 +248,30 @@ function createCodexAdapter(deps = {}) {
       if (typeof CodexClass !== "function") {
         throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
       }
+      const abortController = new AbortController;
       try {
         const client = await withTimeout(Promise.resolve(new CodexClass({
           config: { model: job.model },
-          env: job.env
-        })), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const thread = client.startThread?.();
+          env: subscriptionEnvironment(job.env)
+        })), timeoutMs, "codex lane");
+        const thread = client.startThread?.({ model: job.model, workingDirectory: job.cwd });
         if (!thread || typeof thread.run !== "function") {
           throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
         }
-        const turn = await withTimeout(thread.run(job.prompt), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
+        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
         const output = turn?.finalResponse ?? "";
         const durationMs = Date.now() - started;
         return { ok: true, exitCode: 0, output, durationMs };
       } catch (err) {
         const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
   };
 }
-function runCodexCli(job, cliPath, started, timeoutMs) {
+async function runCodexCli(job, cliPath, started, timeoutMs) {
   try {
-    const result = spawnCli([cliPath, "exec", "--", job.prompt], {
+    const result = await spawnCli([cliPath, "exec", "--", job.prompt], {
       binaryName: cliPath,
       packageHint: "@openai/codex-sdk or the codex CLI",
       timeoutMs,
@@ -285,6 +315,8 @@ function createCursorAdapter(deps = {}) {
       if (!job.prompt) {
         return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
       }
+      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
       const started = Date.now();
       const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
       const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
@@ -294,36 +326,52 @@ function createCursorAdapter(deps = {}) {
       } catch {
         return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
       }
+      let cancel;
       try {
-        const run = await withTimeout(runLocalAgent(sdk, job), timeoutMs, `cursor lane (${job.prompt.slice(0, 60)})`);
+        subscriptionEnvironment(job.env);
+        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
+          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
+        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
+          cancel = callback;
+        }), timeoutMs, "cursor lane", () => cancel?.());
         const durationMs = Date.now() - started;
-        const status = run.status;
+        const status = run2.status;
         const ok = status === "finished";
-        return { ok, exitCode: ok ? 0 : 1, output: run.result, durationMs };
+        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
       } catch (err) {
         if (err instanceof LaneAdapterShapeError)
           throw err;
         const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
   };
 }
-async function runLocalAgent(sdk, job) {
+async function runLocalAgent(sdk, job, onCancel) {
   const AgentClass = sdk.Agent;
   const CursorClass = sdk.Cursor;
   if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
     throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
   }
-  const agent = typeof AgentClass === "function" ? new AgentClass : undefined;
+  const create = AgentClass.create;
+  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
   if (!agent || typeof agent.send !== "function") {
     throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
   }
-  const run = await agent.send(job.prompt, { model: job.model });
-  if (!run || typeof run !== "object") {
+  let run2 = await agent.send(job.prompt, { model: job.model });
+  if (run2 && typeof run2 === "object") {
+    const handle = run2;
+    if (typeof handle.cancel === "function")
+      onCancel(() => {
+        handle.cancel().catch(() => {});
+      });
+    if (typeof handle.wait === "function")
+      run2 = await handle.wait();
+  }
+  if (!run2 || typeof run2 !== "object") {
     throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
   }
-  const candidate = run;
+  const candidate = run2;
   if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
     throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
   }
@@ -332,9 +380,9 @@ async function runLocalAgent(sdk, job) {
   }
   return { status: candidate.status, result: candidate.result };
 }
-function runCursorCli(job, cliPath, started, timeoutMs) {
+async function runCursorCli(job, cliPath, started, timeoutMs) {
   try {
-    const result = spawnCli([cliPath, "run", job.prompt], {
+    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
       binaryName: cliPath,
       packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
       timeoutMs,
@@ -377,7 +425,7 @@ function createGrokAdapter(deps = {}) {
       const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
       const cliPath = deps.cliPath ?? "grok";
       try {
-        const result = spawnCli([cliPath, job.prompt], {
+        const result = await spawnCli([cliPath, job.prompt], {
           binaryName: cliPath,
           packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
           timeoutMs,
@@ -448,10 +496,13 @@ var init_lanes = __esm(() => {
     ["grok", createGrokAdapter()]
   ]);
 });
+
+// src/service.ts
+import { createHash as createHash3 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/workflows",
-  version: "0.1.4",
+  version: "0.2.0",
   description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
   type: "module",
   main: "./dist/index.js",
@@ -467,8 +518,8 @@ var package_default = {
       import: "./dist/index.js"
     },
     "./sdk": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
+      types: "./types/sdk.d.ts",
+      import: "./dist/sdk.js"
     },
     "./cli": {
       types: "./types/cli/index.d.ts",
@@ -483,14 +534,17 @@ var package_default = {
     "hasna.contract.json"
   ],
   scripts: {
-    build: "bun run build:runtime && bun run build:types",
-    "build:runtime": "rm -rf dist && bun build src/cli/index.ts --outdir dist/cli --target bun --packages external && bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external && bun build src/serve/index.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external",
-    "build:types": "rm -rf types && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
+    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
+    "generate:sdk": "bun scripts/generate-sdk.ts --write",
+    "check:sdk": "bun scripts/generate-sdk.ts",
+    "test:artifacts": "bun scripts/artifact-acceptance.ts",
+    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
     "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
     "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
     typecheck: "tsc --noEmit",
     test: "bun test",
-    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a throwaway Postgres; the live-PG gate must not pass without one}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/pg-live.test.ts',
+    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
     prepack: "bun run build && bun run artifact-scan",
     prepublishOnly: "bun run test && bun run build"
   },
@@ -509,7 +563,8 @@ var package_default = {
   },
   repository: {
     type: "git",
-    url: "git+https://github.com/hasna/apps.git"
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/workflows"
   },
   homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
   bugs: {
@@ -523,19 +578,26 @@ var package_default = {
   dependencies: {
     "@anthropic-ai/claude-agent-sdk": "0.3.234",
     "@cursor/sdk": "^1.0.28",
-    "@hasna/paths": "0.1.0",
     "@openai/codex-sdk": "0.147.0",
-    commander: "^13.1.0"
+    commander: "^13.1.0",
+    "@hasna/contracts": "1.3.3",
+    pg: "^8.16.3"
   },
   devDependencies: {
-    "@hasna/contracts": "0.14.2",
     "@types/bun": "1.3.14",
     "@types/pg": "^8.15.6",
-    pg: "^8.16.3",
     typescript: "^5.7.3"
   }
 };
 
+// src/version.ts
+function packageVersion() {
+  return package_default.version;
+}
+
+// src/daemon.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/expr.ts
 class ExprSyntaxError extends Error {
   constructor(message) {
@@ -903,6 +965,9 @@ function findCycles(graph) {
 }
 function validateGraph(graph) {
   const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+  }
   if (typeof graph.name !== "string" || graph.name.trim() === "") {
     issue(issues, "name", "graph requires a non-empty name");
   }
@@ -925,6 +990,24 @@ function validateGraph(graph) {
     issue(issues, "nodes", "graph requires at least one node");
     return { ok: false, issues };
   }
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
+      continue;
+    }
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+    }
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  }
+  if (issues.length)
+    return { ok: false, issues };
   const starts = graph.nodes.filter((n) => n.type === "start");
   if (starts.length === 0)
     issue(issues, "nodes", "graph requires exactly one start node (found none)");
@@ -986,6 +1069,8 @@ function nodeEdges(node) {
       return node.next ? [{ kind: "next", target: node.next }] : [];
     case "end":
       return [];
+    default:
+      return [];
   }
 }
 function validateNode(graph, node, issues) {
@@ -1159,34 +1244,49 @@ import { readFileSync, statSync } from "fs";
 import { isAbsolute, join } from "path";
 var DEFAULT_MAX_ATTEMPTS = 3;
 function repairTornRuns(store, wal, opts = {}) {
+  const sequence = repairSteps(store, wal, opts);
+  let step = sequence.next();
+  while (!step.done) {
+    if (step.value instanceof Promise) {
+      return (async () => {
+        while (!step.done)
+          step = sequence.next(await step.value);
+        return step.value;
+      })();
+    }
+    step = sequence.next(step.value);
+  }
+  return step.value;
+}
+function* repairSteps(store, wal, opts) {
   const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
   const replay = wal.replay();
   const liveClaims = replay.liveClaims(opts.now);
   const report = { interrupted: 0, requeued: 0, failed: 0 };
-  const running = store.listRuns({ status: "running", limit: 1000 });
+  const running = yield store.listRuns({ status: "running", limit: 1000 });
   for (const run of running) {
     if (liveClaims.has(run.id))
       continue;
     report.interrupted++;
-    const nodes = store.listRunNodes(run.id);
+    const nodes = yield store.listRunNodes(run.id);
     if (run.attempts < maxAttempts) {
-      store.bumpAttempts(run.id);
-      store.setRunStatus(run.id, "interrupted", {
+      yield store.bumpAttempts(run.id);
+      yield store.setRunStatus(run.id, "interrupted", {
         error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
       });
       for (const node of nodes) {
         if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "pending", { error: undefined });
+          yield store.setRunNodeStatus(node.id, "pending", { error: undefined });
         }
       }
       report.requeued++;
     } else {
-      store.setRunStatus(run.id, "failed", {
+      yield store.setRunStatus(run.id, "failed", {
         error: `torn run failed after ${maxAttempts} interrupted attempts`
       });
       for (const node of nodes) {
         if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
+          yield store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
         }
       }
       report.failed++;
@@ -1202,15 +1302,17 @@ function memoKey(graphName, nodeId, input) {
 }
 function tryMemoHit(store, graphName, nodeId, input) {
   const key = memoKey(graphName, nodeId, input);
-  const memo = store.memoGet(key);
-  if (!memo)
-    return;
-  store.memoHit(key);
-  return memo;
-}
-function recordMemo(store, graphName, nodeId, input, output) {
-  const key = memoKey(graphName, nodeId, input);
-  store.memoPut(key, graphName, nodeId, inputHash(input), JSON.stringify(output));
+  const value = store.memoGet(key);
+  if (value instanceof Promise) {
+    return value.then(async (row) => {
+      if (row)
+        await store.memoHit(key);
+      return row;
+    });
+  }
+  if (value)
+    store.memoHit(key);
+  return value;
 }
 function memoWatchFingerprint(graph, dataDir) {
   if (!graph.memoWatch || graph.memoWatch.length === 0)
@@ -1252,20 +1354,377 @@ function fingerprintFile(pattern, path) {
     return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
   }
 }
-function findRunByIdempotencyKey(store, key) {
-  const runs = store.listRuns({ limit: 1000 });
-  for (const run of runs) {
+
+// src/db/postgres-store.ts
+import { randomUUID } from "crypto";
+import { Pool } from "pg";
+var run = (r) => ({
+  id: String(r.id),
+  graphName: String(r.graph_name),
+  graphVersion: String(r.graph_version),
+  status: r.status,
+  attempts: Number(r.attempts),
+  contextJson: String(r.context_json),
+  resultJson: r.result_json == null ? null : String(r.result_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at),
+  createdAt: String(r.created_at),
+  updatedAt: String(r.updated_at)
+});
+var node = (r) => ({
+  id: String(r.id),
+  runId: String(r.run_id),
+  nodeId: String(r.node_id),
+  status: r.status,
+  attempts: Number(r.attempts),
+  lane: r.lane == null ? null : String(r.lane),
+  exitCode: r.exit_code == null ? null : Number(r.exit_code),
+  outputJson: r.output_json == null ? null : String(r.output_json),
+  error: r.error == null ? null : String(r.error),
+  startedAt: r.started_at == null ? null : String(r.started_at),
+  finishedAt: r.finished_at == null ? null : String(r.finished_at)
+});
+var memo = (r) => ({
+  key: String(r.key),
+  graphName: String(r.graph_name),
+  nodeId: String(r.node_id),
+  inputHash: String(r.input_hash),
+  outputJson: String(r.output_json),
+  hitCount: Number(r.hit_count),
+  createdAt: String(r.created_at)
+});
+
+class WorkflowStorageError extends Error {
+  constructor() {
+    super("PostgreSQL workflow storage is unavailable or its schema is invalid");
+    this.name = "WorkflowStorageError";
+  }
+}
+
+class PostgresWorkflowsStore {
+  pool;
+  prefix;
+  dataDir;
+  execution;
+  constructor(options) {
+    const schema = options.schema ?? "workflows";
+    if (!/^[a-z][a-z0-9_]{0,62}$/.test(schema))
+      throw new Error("PostgreSQL schema must be a lowercase SQL identifier");
+    this.prefix = `"${schema}"`;
+    this.dataDir = options.dataDir;
+    this.pool = new Pool({
+      connectionString: options.databaseUrl,
+      max: 4,
+      connectionTimeoutMillis: 5000,
+      idleTimeoutMillis: 1e4,
+      statement_timeout: 1e4,
+      application_name: "workflows"
+    });
+  }
+  async rows(sql, values = []) {
     try {
-      const context = JSON.parse(run.contextJson);
-      if (context?.__wf?.idempotencyKey === key)
-        return run;
-    } catch {}
+      if (this.execution?.lost)
+        throw new WorkflowStorageError;
+      return (await (this.execution?.client ?? this.pool).query(sql, values)).rows;
+    } catch (error) {
+      if (error?.code === "23505")
+        throw Object.assign(new Error("workflow uniqueness conflict"), { code: "23505" });
+      throw new WorkflowStorageError;
+    }
+  }
+  async close() {
+    await this.releaseExecution();
+    await this.pool.end();
+  }
+  async acquireExecution(runId) {
+    if (this.execution)
+      return this.execution.runId === runId && !this.execution.lost;
+    const client = await this.pool.connect();
+    let lost = false;
+    client.on("error", () => {
+      lost = true;
+      if (this.execution?.client === client)
+        this.execution.lost = true;
+    });
+    try {
+      const acquired = await client.query("SELECT pg_try_advisory_lock(hashtextextended($1,0)) AS owned", [`${this.prefix}:${runId}`]);
+      if (!acquired.rows[0]?.owned) {
+        client.release();
+        return false;
+      }
+      this.execution = { runId, client, lost };
+      return !lost;
+    } catch {
+      client.release(true);
+      throw new WorkflowStorageError;
+    }
+  }
+  async releaseExecution() {
+    const owned = this.execution;
+    if (!owned)
+      return;
+    this.execution = undefined;
+    try {
+      if (!owned.lost)
+        await owned.client.query("SELECT pg_advisory_unlock(hashtextextended($1,0))", [`${this.prefix}:${owned.runId}`]);
+    } finally {
+      owned.client.release(owned.lost);
+    }
+  }
+  async transaction(action) {
+    if (this.execution?.lost)
+      throw new WorkflowStorageError;
+    const client = this.execution?.client ?? await this.pool.connect();
+    const retained = client === this.execution?.client;
+    try {
+      await client.query("BEGIN");
+      const result = await action(client);
+      await client.query("COMMIT");
+      return result;
+    } catch {
+      try {
+        await client.query("ROLLBACK");
+      } catch {}
+      throw new WorkflowStorageError;
+    } finally {
+      if (!retained)
+        client.release();
+    }
+  }
+  async listTables() {
+    return (await this.rows("SELECT table_name FROM information_schema.tables WHERE table_schema=$1 AND table_type='BASE TABLE' ORDER BY table_name", [this.prefix.slice(1, -1)])).map((row) => String(row.table_name));
+  }
+  async checkSchema() {
+    if ((await this.listTables()).join(",") !== "memos,run_nodes,runs")
+      return false;
+    await this.rows(`SELECT id,graph_name,graph_version,status,attempts,context_json,result_json,error,started_at,finished_at,created_at,updated_at FROM ${this.prefix}.runs LIMIT 0`);
+    await this.rows(`SELECT id,sequence,run_id,node_id,status,attempts,lane,exit_code,output_json,error,started_at,finished_at FROM ${this.prefix}.run_nodes LIMIT 0`);
+    await this.rows(`SELECT key,graph_name,node_id,input_hash,output_json,hit_count,created_at FROM ${this.prefix}.memos LIMIT 0`);
+    const schema = this.prefix.slice(1, -1);
+    const indices = await this.rows(`SELECT i.indisunique,i.indisvalid,i.indisready,i.indnkeyatts,i.indnatts,i.indpred IS NULL AS unfiltered,pg_get_expr(i.indexprs,i.indrelid) AS expression FROM pg_index i JOIN pg_class c ON c.oid=i.indexrelid JOIN pg_class t ON t.oid=i.indrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1 AND c.relname='runs_idempotency' AND t.relname='runs'`, [schema]);
+    const index = indices[0];
+    if (indices.length !== 1 || !index?.indisunique || !index.indisvalid || !index.indisready || !index.unfiltered || Number(index.indnkeyatts) !== 1 || Number(index.indnatts) !== 1 || String(index.expression).replace(/[()\s]/g, "") !== "context_json::jsonb#>>'{__wf,idempotencyKey}'::text[]")
+      return false;
+    const columns = await this.rows("SELECT table_name,column_name,data_type,is_nullable,is_identity,identity_generation FROM information_schema.columns WHERE table_schema=$1", [schema]);
+    const required = {
+      runs: ["id:text", "graph_name:text", "graph_version:text", "status:text", "attempts:integer", "context_json:text", "created_at:text", "updated_at:text"],
+      run_nodes: ["id:text", "sequence:bigint", "run_id:text", "node_id:text", "status:text", "attempts:integer"],
+      memos: ["key:text", "graph_name:text", "node_id:text", "input_hash:text", "output_json:text", "hit_count:integer", "created_at:text"]
+    };
+    for (const [table, fields] of Object.entries(required))
+      for (const field of fields) {
+        const [name, type] = field.split(":");
+        const c = columns.find((row) => row.table_name === table && row.column_name === name);
+        if (!c || c.data_type !== type || c.is_nullable !== "NO")
+          return false;
+        if (name === "sequence" && (c.is_identity !== "YES" || c.identity_generation !== "ALWAYS"))
+          return false;
+      }
+    const constraints = await this.rows(`SELECT c.relname AS table_name,co.contype,pg_get_constraintdef(co.oid) AS definition FROM pg_constraint co JOIN pg_class c ON c.oid=co.conrelid JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname=$1`, [schema]);
+    for (const [table, key] of [["runs", "id"], ["run_nodes", "id"], ["memos", "key"]])
+      if (!constraints.some((row) => row.table_name === table && row.contype === "p" && row.definition === `PRIMARY KEY (${key})`))
+        return false;
+    return constraints.some((row) => row.table_name === "run_nodes" && row.contype === "f" && String(row.definition).replaceAll('"', "") === `FOREIGN KEY (run_id) REFERENCES ${schema}.runs(id)`);
+  }
+  async initialize() {
+    const tables = await this.listTables();
+    if (tables.length) {
+      if (await this.checkSchema())
+        return;
+      throw new WorkflowStorageError;
+    }
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(`CREATE SCHEMA IF NOT EXISTS ${this.prefix};
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.runs (
+        id TEXT PRIMARY KEY, graph_name TEXT NOT NULL, graph_version TEXT NOT NULL, status TEXT NOT NULL,
+        attempts INTEGER NOT NULL DEFAULT 0, context_json TEXT NOT NULL, result_json TEXT, error TEXT,
+        started_at TEXT, finished_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.run_nodes (
+        id TEXT PRIMARY KEY, sequence BIGINT GENERATED ALWAYS AS IDENTITY, run_id TEXT NOT NULL REFERENCES ${this.prefix}.runs(id), node_id TEXT NOT NULL,
+        status TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, lane TEXT, exit_code INTEGER,
+        output_json TEXT, error TEXT, started_at TEXT, finished_at TEXT);
+      CREATE TABLE IF NOT EXISTS ${this.prefix}.memos (
+        key TEXT PRIMARY KEY, graph_name TEXT NOT NULL, node_id TEXT NOT NULL, input_hash TEXT NOT NULL,
+        output_json TEXT NOT NULL, hit_count INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL);
+      CREATE UNIQUE INDEX IF NOT EXISTS runs_idempotency ON ${this.prefix}.runs ((context_json::jsonb #>> '{__wf,idempotencyKey}'));
+      CREATE INDEX IF NOT EXISTS runs_status ON ${this.prefix}.runs(status);
+      CREATE INDEX IF NOT EXISTS nodes_run ON ${this.prefix}.run_nodes(run_id);`);
+      await client.query("COMMIT");
+    } catch {
+      await client.query("ROLLBACK");
+      throw new WorkflowStorageError;
+    } finally {
+      client.release();
+    }
+    if (!await this.checkSchema())
+      throw new WorkflowStorageError;
+  }
+  async createRun(input) {
+    const at = new Date().toISOString();
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.runs(id,graph_name,graph_version,status,context_json,created_at,updated_at)
+      VALUES($1,$2,$3,'pending',$4,$5,$5) RETURNING *`, [randomUUID(), input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), at]);
+    return run(rows[0]);
+  }
+  async getRun(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE id=$1`, [id]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async getRunByIdempotencyKey(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.runs WHERE context_json::jsonb #>> '{__wf,idempotencyKey}'=$1`, [key]);
+    return rows[0] ? run(rows[0]) : undefined;
+  }
+  async listRuns(options = {}) {
+    const limit = Math.max(1, Math.min(1000, options.limit ?? 100));
+    return (await this.rows(`SELECT * FROM ${this.prefix}.runs ${options.status ? "WHERE status=$2" : ""} ORDER BY created_at DESC,id DESC LIMIT $1`, options.status ? [limit, options.status] : [limit])).map(run);
+  }
+  async setRunStatus(id, status, patch = {}) {
+    const values = [id, status, new Date().toISOString()];
+    const sets = ["status=$2", "updated_at=$3"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt"))
+      sets.push("started_at=COALESCE(started_at,$3)");
+    await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async compareRunStatus(id, expected, status, patch = {}) {
+    const values = [id, expected, status, new Date().toISOString()];
+    const sets = ["status=$3", "updated_at=$4"];
+    for (const [field, key] of [["result_json", "result"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (patch && Object.hasOwn(patch, key)) {
+        values.push(key === "result" ? JSON.stringify(patch.result) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET ${sets.join(",")} WHERE id=$1 AND status=ANY($2::text[]) RETURNING id`, values)).length === 1;
+  }
+  async setRunContext(id, context) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [id, JSON.stringify(context), new Date().toISOString()]);
+  }
+  async setRunningContext(id, context) {
+    return (await this.rows(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1 AND status='running' RETURNING id`, [id, JSON.stringify(context), new Date().toISOString()])).length === 1;
+  }
+  async blockRunResume(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,resumeBlocked}',to_jsonb($2::text))::text,updated_at=$3 WHERE id=$1`, [id, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async dispatchIfRunning(id, action) {
+    const marked = await this.rows(`UPDATE ${this.prefix}.runs SET context_json=jsonb_set(context_json::jsonb,'{__wf,executionMayBeActive}','true'::jsonb)::text WHERE id=$1 AND status='running' RETURNING id`, [id]);
+    if (!marked.length)
+      return { started: false };
+    return this.transaction(async (client) => {
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [id]);
+      if (run2.rows[0]?.status !== "running")
+        return { started: false };
+      return { started: true, result: action() };
+    });
+  }
+  async finishDispatch(id, unconfirmed) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET context_json=(CASE WHEN $2 THEN jsonb_set(context_json::jsonb #- '{__wf,executionMayBeActive}','{__wf,resumeBlocked}',to_jsonb($3::text)) ELSE context_json::jsonb #- '{__wf,executionMayBeActive}' END)::text,updated_at=$4 WHERE id=$1`, [id, unconfirmed, "execution cancellation has not been confirmed", new Date().toISOString()]);
+  }
+  async commitStep(input) {
+    return this.transaction(async (client) => {
+      const nodes = await client.query(`SELECT run_id FROM ${this.prefix}.run_nodes WHERE id=$1 FOR UPDATE`, [input.nodeRowId]);
+      if (nodes.rows[0]?.run_id !== input.runId)
+        return false;
+      const run2 = await client.query(`SELECT status FROM ${this.prefix}.runs WHERE id=$1 FOR UPDATE`, [input.runId]);
+      if (run2.rows[0]?.status !== "running")
+        return false;
+      const patch = input.patch ?? {}, values = [input.nodeRowId, input.status];
+      const sets = ["status=$2"];
+      for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+        if (Object.hasOwn(patch, key)) {
+          values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+          sets.push(`${field}=$${values.length}`);
+        }
+      }
+      if (input.status === "running") {
+        values.push(new Date().toISOString());
+        sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+      }
+      if (["completed", "failed", "skipped"].includes(input.status)) {
+        values.push(new Date().toISOString());
+        sets.push(`finished_at=$${values.length}`);
+      }
+      if (input.incrementAttempts)
+        sets.push("attempts=attempts+1");
+      await client.query(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+      if (input.context !== undefined)
+        await client.query(`UPDATE ${this.prefix}.runs SET context_json=$2,updated_at=$3 WHERE id=$1`, [input.runId, JSON.stringify(input.context), new Date().toISOString()]);
+      if (input.memo) {
+        const m = input.memo;
+        await client.query(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [m.key, m.graphName, m.nodeId, m.inputHash, m.outputJson, new Date().toISOString()]);
+      }
+      return true;
+    });
+  }
+  async bumpAttempts(id) {
+    await this.rows(`UPDATE ${this.prefix}.runs SET attempts=attempts+1,updated_at=$2 WHERE id=$1`, [id, new Date().toISOString()]);
+  }
+  async createRunNode(input) {
+    const rows = await this.rows(`INSERT INTO ${this.prefix}.run_nodes(id,run_id,node_id,lane,status) VALUES($1,$2,$3,$4,'pending') RETURNING *`, [randomUUID(), input.runId, input.nodeId, input.lane ?? null]);
+    return node(rows[0]);
+  }
+  async getRunNode(id) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE id=$1`, [id]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async listRunNodes(runId) {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 ORDER BY sequence`, [runId])).map(node);
+  }
+  async getLatestRunNode(runId, nodeId) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.run_nodes WHERE run_id=$1 AND node_id=$2 ORDER BY sequence DESC LIMIT 1`, [runId, nodeId]);
+    return rows[0] ? node(rows[0]) : undefined;
+  }
+  async setRunNodeStatus(id, status, patch = {}) {
+    const values = [id, status];
+    const sets = ["status=$2"];
+    for (const [field, key] of [["exit_code", "exitCode"], ["output_json", "output"], ["error", "error"], ["started_at", "startedAt"], ["finished_at", "finishedAt"]]) {
+      if (Object.hasOwn(patch, key)) {
+        values.push(key === "output" ? JSON.stringify(patch.output) : patch[key]);
+        sets.push(`${field}=$${values.length}`);
+      }
+    }
+    if (status === "running" && !Object.hasOwn(patch, "startedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`started_at=COALESCE(started_at,$${values.length})`);
+    }
+    if (["completed", "failed", "skipped"].includes(status) && !Object.hasOwn(patch, "finishedAt")) {
+      values.push(new Date().toISOString());
+      sets.push(`finished_at=$${values.length}`);
+    }
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET ${sets.join(",")} WHERE id=$1`, values);
+  }
+  async bumpAttemptsNode(id) {
+    await this.rows(`UPDATE ${this.prefix}.run_nodes SET attempts=attempts+1 WHERE id=$1`, [id]);
+  }
+  async memoPut(key, graphName, nodeId, inputHash2, outputJson) {
+    await this.rows(`INSERT INTO ${this.prefix}.memos(key,graph_name,node_id,input_hash,output_json,created_at) VALUES($1,$2,$3,$4,$5,$6)
+      ON CONFLICT(key) DO UPDATE SET output_json=EXCLUDED.output_json`, [key, graphName, nodeId, inputHash2, outputJson, new Date().toISOString()]);
+  }
+  async memoGet(key) {
+    const rows = await this.rows(`SELECT * FROM ${this.prefix}.memos WHERE key=$1`, [key]);
+    return rows[0] ? memo(rows[0]) : undefined;
+  }
+  async memoHit(key) {
+    await this.rows(`UPDATE ${this.prefix}.memos SET hit_count=hit_count+1 WHERE key=$1`, [key]);
+  }
+  async memoList() {
+    return (await this.rows(`SELECT * FROM ${this.prefix}.memos ORDER BY created_at DESC,key LIMIT 1000`)).map(memo);
+  }
+  async memoClear() {
+    throw new Error("PostgreSQL memo removal requires the reviewed server-operator preservation procedure");
   }
-  return;
 }
 
 // src/daemon.ts
 init_types();
+init_types();
 var DEFAULT_LEASE_TTL_MS = 120000;
 var DEFAULT_MAX_ATTEMPTS2 = 3;
 var DEFAULT_MAX_DISPATCH = 4;
@@ -1278,27 +1737,28 @@ function stripRunState(context) {
   const { __wf: _wf, steps: _steps, ...user } = context;
   return user;
 }
-function runCommand(job) {
+async function runCommand(job) {
   if (!job.command) {
     return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
   }
   const started = Date.now();
   const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const proc = Bun.spawnSync({
+  const proc = Bun.spawn({
     cmd: ["/bin/sh", "-c", job.command],
     cwd: job.cwd,
-    env: { ...process.env, ...job.env ?? {} },
+    env: subscriptionEnvironment(job.env),
     stdout: "pipe",
     stderr: "pipe",
     timeout: timeoutMs
   });
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
   const output = stderr ? `${stdout}
 ${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? (proc.signalCode ? 1 : 1);
-  return { ok: exitCode === 0, exitCode, output, durationMs };
+  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
 }
 
 class WorkflowsDaemon {
@@ -1319,7 +1779,7 @@ class WorkflowsDaemon {
   constructor(store, wal, options = {}) {
     this.store = store;
     this.wal = wal;
-    this.worker = options.worker ?? "local";
+    this.worker = options.worker ?? `worker-${randomUUID2()}`;
     this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
     this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
     this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
@@ -1351,17 +1811,22 @@ class WorkflowsDaemon {
     return this.leases;
   }
   claim(runId) {
+    return this.wal.exclusive(() => this.claimLocked(runId));
+  }
+  claimLocked(runId) {
     const now = this.time();
     const existing = this.leases.get(runId);
     if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
       return null;
     }
-    const liveClaims = this.wal.replay().liveClaims(now);
+    const replay = this.wal.replay();
+    const liveClaims = replay.liveClaims(now);
     const foreign = liveClaims.get(runId);
     if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
       return null;
     }
-    const fencing = (this.fencingCounter.get(runId) ?? 0) + 1;
+    const lastFencing = replay.entries.reduce((max, entry) => entry.op.op === "claim_acquired" && entry.op.runId === runId ? Math.max(max, entry.op.fencing) : max, 0);
+    const fencing = Math.max(lastFencing, this.fencingCounter.get(runId) ?? 0) + 1;
     this.fencingCounter.set(runId, fencing);
     const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
     this.leases.set(runId, lease);
@@ -1376,16 +1841,36 @@ class WorkflowsDaemon {
     return lease;
   }
   heartbeat(runId, fencing) {
+    return this.wal.exclusive(() => this.heartbeatLocked(runId, fencing));
+  }
+  heartbeatLocked(runId, fencing) {
     const lease = this.leases.get(runId);
     if (!lease || lease.fencing !== fencing)
       return false;
+    const current = this.wal.replay({ repair: false }).liveClaims(this.time()).get(runId);
+    if (!current || current.worker !== lease.worker || current.fencing !== fencing)
+      return false;
     lease.expiresAtMs = this.time() + this.leaseTtlMs;
+    this.wal.append({
+      op: "claim_acquired",
+      runId,
+      worker: lease.worker,
+      fencing,
+      expiresAt: new Date(lease.expiresAtMs).toISOString(),
+      at: nowIso()
+    });
     return true;
   }
   release(runId, fencing) {
+    return this.wal.exclusive(() => this.releaseLocked(runId, fencing));
+  }
+  releaseLocked(runId, fencing) {
     const lease = this.leases.get(runId);
     if (!lease || lease.fencing !== fencing)
       return false;
+    const current = this.wal.replay().liveClaims(this.time()).get(runId);
+    if (current && (current.worker !== lease.worker || current.fencing !== fencing))
+      return false;
     this.leases.delete(runId);
     this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
     return true;
@@ -1400,30 +1885,30 @@ class WorkflowsDaemon {
       }
     }
     if (this.isolatedRunId === null) {
-      const repair = repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
+      const repair = await repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
       report.interrupted += repair.interrupted;
       report.requeued += repair.requeued;
       report.failed += repair.failed;
     }
-    const pending = this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle }).concat(this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
-    for (const run of pending) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+    const pending = (await this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle })).concat(await this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
+    for (const run2 of pending) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
         continue;
-      const lease = this.claim(run.id);
+      const lease = this.claim(run2.id);
       if (!lease)
         continue;
-      this.store.setRunStatus(run.id, "running");
-      this.wal.append({ op: "run_started", runId: run.id, at: nowIso() });
+      await this.store.setRunStatus(run2.id, "running");
+      this.wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
       report.dispatched++;
     }
-    const running = this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
+    const running = await this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
     let steps = 0;
-    for (const run of running) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+    for (const run2 of running) {
+      if (this.isolatedRunId !== null && run2.id !== this.isolatedRunId)
         continue;
       if (steps >= this.maxStepsPerCycle)
         break;
-      const outcome = await this.advanceRun(run.id);
+      const outcome = await this.advanceRun(run2.id);
       steps++;
       if (outcome.kind === "completed")
         report.completed++;
@@ -1449,66 +1934,78 @@ class WorkflowsDaemon {
     } else {
       this.graphCache.set(graph.name, existing);
     }
-    return this.store.createRun({ graphName: graph.name, graphVersion: graph.version, context: context ?? {} });
+    const initial = context !== null && typeof context === "object" ? context : {};
+    return this.store.createRun({
+      graphName: graph.name,
+      graphVersion: graph.version,
+      context: { ...initial, __wf: { ...initial.__wf ?? {}, graph } }
+    });
   }
   async advanceRun(runId) {
-    const run = this.store.getRun(runId);
-    if (!run || run.status !== "running")
+    const run2 = await this.store.getRun(runId);
+    if (!run2 || run2.status !== "running")
       return { kind: "noop" };
     const lease = this.leases.get(runId);
     if (!lease || lease.expiresAtMs <= this.time())
       return { kind: "blocked" };
-    const graph = this.loadGraph(run.graphName);
+    const storedContext = JSON.parse(run2.contextJson);
+    const pinned = storedContext.__wf?.graph;
+    const graph = pinned ?? this.loadGraph(run2.graphName);
     if (!graph) {
-      this.failRun(run, `graph ${run.graphName} not found in daemon graph cache`);
+      await this.failRun(run2, `graph ${run2.graphName} not found in daemon graph cache`);
       return { kind: "failed", error: "graph not found" };
     }
-    const context = JSON.parse(run.contextJson);
+    const context = storedContext;
     const rawWf = context.__wf ?? {};
     const wf = {
       ...rawWf,
       cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
-      loops: rawWf.loops ?? {},
-      completedLoops: rawWf.completedLoops ?? {}
+      loops: Object.assign(Object.create(null), rawWf.loops ?? {}),
+      completedLoops: Object.assign(Object.create(null), rawWf.completedLoops ?? {})
     };
     try {
+      if (rawWf.stepTerminal === true) {
+        context.__wf = wf;
+        await this.completeRun(run2, context);
+        return { kind: "completed" };
+      }
       const cursor = wf.cursor;
-      const node = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
-      if (!node) {
-        this.failRun(run, `cursor ${cursor ?? "<start>"} resolves to no node`);
+      const node2 = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
+      if (!node2) {
+        await this.failRun(run2, `cursor ${cursor ?? "<start>"} resolves to no node`);
         return { kind: "failed", error: "no node at cursor" };
       }
-      switch (node.type) {
+      switch (node2.type) {
         case "start": {
-          wf.cursor = node.next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
+          wf.cursor = node2.next;
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
         }
         case "step": {
-          return await this.executeStep(run, graph, context, wf, node);
+          return await this.executeStep(run2, graph, context, wf, node2);
         }
         case "decision": {
-          const value = evaluateExpr(node.condition, this.conditionScope(context));
-          const next = value ? node.then : node.else;
+          const value = evaluateExpr(node2.condition, this.conditionScope(context));
+          const next = value ? node2.then : node2.else;
           if (!next) {
-            this.failRun(run, `decision ${node.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
+            await this.failRun(run2, `decision ${node2.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
             return { kind: "failed", error: "missing decision edge" };
           }
           wf.cursor = next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
+          await this.persistContext(run2, context, wf);
+          return { kind: "advanced", nodeId: node2.id };
         }
         case "while": {
-          return this.executeWhile(run, graph, context, wf, node);
+          return await this.executeWhile(run2, graph, context, wf, node2);
         }
         case "end": {
-          this.completeRun(run, context);
+          await this.completeRun(run2, context);
           return { kind: "completed" };
         }
       }
     } catch (err) {
       if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
-        this.failRun(run, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
+        await this.failRun(run2, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
         return { kind: "failed", error: err.message };
       }
       throw err;
@@ -1520,131 +2017,180 @@ class WorkflowsDaemon {
   conditionScope(context) {
     return { ...context, steps: context.steps ?? {} };
   }
-  persistContext(run, context, wf) {
+  async persistContext(run2, context, wf) {
     context.__wf = wf;
-    this.store.setRunContext(run.id, context);
-  }
-  async executeStep(run, graph, context, wf, node) {
-    const nodeId = node.id;
-    const latest = this.store.getLatestRunNode(run.id, nodeId);
+    await this.store.setRunningContext(run2.id, context);
+  }
+  async discardStep(run2, nodeRowId) {
+    const current = await this.store.getRun(run2.id);
+    const node2 = await this.store.getRunNode(nodeRowId);
+    if (current?.status === "cancelled" && node2 && ["pending", "running"].includes(node2.status))
+      await this.store.setRunNodeStatus(nodeRowId, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+    return { kind: "noop" };
+  }
+  async executeStep(run2, graph, context, wf, node2) {
+    const nodeId = node2.id;
+    const latest = await this.store.getLatestRunNode(run2.id, nodeId);
     const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
-    const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? this.store.createRunNode({ runId: run.id, nodeId, lane: node.lane ?? "claude" }) : latest;
-    const memoWatch = node.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
-    const memoSource = { command: node.command, prompt: node.prompt, context: stripRunState(context) };
-    const memoInput = node.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
+    const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? await this.store.createRunNode({ runId: run2.id, nodeId, lane: node2.lane ?? "claude" }) : latest;
+    const memoWatch = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+    const memoSource = { command: node2.command, prompt: node2.prompt, context: stripRunState(context) };
+    const memoInput = node2.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
     if (memoInput !== undefined) {
-      const hit = tryMemoHit(this.store, run.graphName, nodeId, memoInput);
+      const hit = await tryMemoHit(this.store, run2.graphName, nodeId, memoInput);
       if (hit) {
         const cached = JSON.parse(hit.outputJson);
-        this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } });
-        this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
         this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
-        return this.afterNode(run, context, wf, node.next);
+        const continuation2 = this.advanceAfterStep(graph, context, wf, node2.next);
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } }, context }))
+          return this.discardStep(run2, nodeRow.id);
+        this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+        if (continuation2.kind === "completed")
+          await this.completeRun(run2, context);
+        return continuation2;
       }
     }
     if (nodeRow.status !== "running") {
-      this.store.setRunNodeStatus(nodeRow.id, "running");
-      this.wal.append({ op: "node_started", runId: run.id, nodeId, at: nowIso() });
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "running" }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_started", runId: run2.id, nodeId, at: nowIso() });
     }
     const job = {
-      lane: node.lane ?? "claude",
-      prompt: node.prompt,
-      command: node.command,
-      timeoutMs: node.timeoutMs,
+      lane: node2.lane ?? "claude",
+      prompt: node2.prompt,
+      command: node2.command,
+      timeoutMs: node2.timeoutMs,
       env: this.env
     };
     let result;
+    const activeLease = this.leases.get(run2.id);
+    const pulse = setInterval(() => {
+      this.heartbeat(run2.id, activeLease.fencing);
+    }, Math.max(1, Math.floor(this.leaseTtlMs / 3)));
     try {
-      result = await this.laneRunner(job);
-    } catch (err) {
-      result = { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+      const dispatched = await this.store.dispatchIfRunning(run2.id, async () => {
+        try {
+          return await this.laneRunner(job);
+        } catch (err) {
+          return { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+        }
+      });
+      if (!dispatched.started) {
+        await this.store.finishDispatch(run2.id, false);
+        return this.discardStep(run2, nodeRow.id);
+      }
+      result = await dispatched.result;
+    } finally {
+      clearInterval(pulse);
+    }
+    const unconfirmed = result.retryable === false && /exceeded.*budget/.test(result.error ?? "");
+    await this.store.finishDispatch(run2.id, unconfirmed);
+    if (unconfirmed)
+      Object.assign(wf, { resumeBlocked: "execution cancellation has not been confirmed" });
+    const current = await this.store.getRun(run2.id);
+    const currentClaim = this.wal.replay({ repair: false }).liveClaims(this.time()).get(run2.id);
+    const lease = this.leases.get(run2.id);
+    if (!current || current.status !== "running" || !currentClaim || !lease || currentClaim.worker !== lease.worker || currentClaim.fencing !== lease.fencing) {
+      if (current?.status === "cancelled")
+        await this.store.setRunNodeStatus(nodeRow.id, "skipped", { error: "run cancelled", finishedAt: nowIso() });
+      return { kind: "noop" };
+    }
+    try {
+      assertNoSecrets({ output: result.output, error: result.error }, `node ${nodeId} execution`);
+    } catch {
+      result = { ok: false, exitCode: 1, output: "", durationMs: result.durationMs, error: "execution result refused by secrets write-gate", retryable: false };
     }
     const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
     if (!result.ok) {
-      const shouldRetry = nodeRow.attempts < (node.maxRetries ?? 0);
-      this.store.bumpAttemptsNode(nodeRow.id);
+      const shouldRetry = result.retryable !== false && nodeRow.attempts < (node2.maxRetries ?? 0);
       if (shouldRetry) {
-        this.store.setRunNodeStatus(nodeRow.id, "pending", { error: result.error ?? `exit ${result.exitCode}` });
+        if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "pending", patch: { error: result.error ?? `exit ${result.exitCode}` }, incrementAttempts: true }))
+          return this.discardStep(run2, nodeRow.id);
         return { kind: "advanced", nodeId };
       }
       const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { exitCode: result.exitCode, error });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, error);
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { exitCode: result.exitCode, error }, incrementAttempts: true }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, error);
       return { kind: "failed", error };
     }
     try {
       assertNoSecrets(output, `node ${nodeId} output`);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { error: message });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, message);
+      if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "failed", patch: { error: message } }))
+        return this.discardStep(run2, nodeRow.id);
+      this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "failed", at: nowIso() });
+      await this.failRun(run2, message);
       return { kind: "failed", error: message };
     }
-    this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: result.exitCode, output });
-    this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
+    let memo2;
     if (memoInput !== undefined) {
-      const memoInputAfter = node.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
+      const memoInputAfter = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
       const stable = memoWatch === undefined && memoInputAfter === undefined || memoWatch !== undefined && memoInputAfter !== undefined && JSON.stringify(memoWatch) === JSON.stringify(memoInputAfter);
       if (stable) {
-        recordMemo(this.store, run.graphName, nodeId, memoInput, output);
-        this.wal.append({ op: "memo_set", key: memoKey(run.graphName, nodeId, memoInput), at: nowIso() });
+        memo2 = { key: memoKey(run2.graphName, nodeId, memoInput), graphName: run2.graphName, nodeId, inputHash: inputHash(memoInput), outputJson: JSON.stringify(output) };
       }
     }
     this.recordStepResult(context, nodeId, output);
-    return this.afterNode(run, context, wf, node.next);
-  }
-  afterNode(run, context, wf, next) {
+    const continuation = this.advanceAfterStep(graph, context, wf, node2.next);
+    if (!await this.store.commitStep({ runId: run2.id, nodeRowId: nodeRow.id, status: "completed", patch: { exitCode: result.exitCode, output }, context, memo: memo2 }))
+      return this.discardStep(run2, nodeRow.id);
+    this.wal.append({ op: "node_finished", runId: run2.id, nodeId, status: "completed", at: nowIso() });
+    if (memo2)
+      this.wal.append({ op: "memo_set", key: memo2.key, at: nowIso() });
+    if (continuation.kind === "completed")
+      await this.completeRun(run2, context);
+    return continuation;
+  }
+  advanceAfterStep(graph, context, wf, next) {
+    context.__wf = wf;
     if (next) {
       wf.cursor = next;
-      this.persistContext(run, context, wf);
       return { kind: "advanced", nodeId: wf.cursor };
     }
     const cursor = wf.cursor;
-    const graph = this.loadGraph(run.graphName);
     const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
     if (whileNode) {
       const index = whileNode.body.indexOf(cursor ?? "");
       if (index >= 0 && index < whileNode.body.length - 1) {
         wf.cursor = whileNode.body[index + 1];
-        this.persistContext(run, context, wf);
         return { kind: "advanced", nodeId: wf.cursor };
       }
       wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
       wf.cursor = whileNode.id;
-      this.persistContext(run, context, wf);
       return { kind: "advanced", nodeId: whileNode.id };
     }
-    this.completeRun(run, context);
+    wf.stepTerminal = true;
     return { kind: "completed" };
   }
-  executeWhile(run, graph, context, wf, node) {
-    const iteration = wf.loops[node.id] ?? 0;
-    if (iteration >= node.maxIterations) {
-      const error = `while node ${node.id} exceeded maxIterations (${node.maxIterations})`;
-      this.failRun(run, error);
+  async executeWhile(run2, graph, context, wf, node2) {
+    const iteration = wf.loops[node2.id] ?? 0;
+    if (iteration >= node2.maxIterations) {
+      const error = `while node ${node2.id} exceeded maxIterations (${node2.maxIterations})`;
+      await this.failRun(run2, error);
       return { kind: "failed", error };
     }
     const scope = { ...this.conditionScope(context), i: iteration };
-    const keepGoing = evaluateExpr(node.condition, scope);
+    const keepGoing = evaluateExpr(node2.condition, scope);
     if (!keepGoing) {
-      wf.completedLoops[node.id] = iteration;
-      delete wf.loops[node.id];
-      wf.cursor = node.next;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: node.id };
+      wf.completedLoops[node2.id] = iteration;
+      delete wf.loops[node2.id];
+      wf.cursor = node2.next;
+      await this.persistContext(run2, context, wf);
+      return { kind: "advanced", nodeId: node2.id };
     }
-    wf.cursor = node.body[0];
-    this.persistContext(run, context, wf);
-    return { kind: "advanced", nodeId: node.id };
+    wf.cursor = node2.body[0];
+    await this.persistContext(run2, context, wf);
+    return { kind: "advanced", nodeId: node2.id };
   }
   recordStepResult(context, nodeId, output) {
-    const steps = context.steps ?? {};
+    const steps = Object.assign(Object.create(null), context.steps ?? {});
     steps[nodeId] = output;
     context.steps = steps;
   }
-  completeRun(run, context) {
+  async completeRun(run2, context) {
     const result = {
       steps: context.steps ?? {},
       iterations: context.__wf?.completedLoops ?? {}
@@ -1653,21 +2199,23 @@ class WorkflowsDaemon {
       assertNoSecrets(result, "run result");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      this.failRun(run, message);
+      await this.failRun(run2, message);
       return;
     }
-    this.store.setRunStatus(run.id, "completed", { result, finishedAt: nowIso(), error: null });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "completed", at: nowIso() });
-    const lease = this.leases.get(run.id);
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "completed", { result, finishedAt: nowIso(), error: null }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "completed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
     if (lease)
-      this.release(run.id, lease.fencing);
+      this.release(run2.id, lease.fencing);
   }
-  failRun(run, error) {
-    this.store.setRunStatus(run.id, "failed", { error, finishedAt: nowIso() });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "failed", at: nowIso() });
-    const lease = this.leases.get(run.id);
+  async failRun(run2, error) {
+    if (!await this.store.compareRunStatus(run2.id, ["running"], "failed", { error, finishedAt: nowIso() }))
+      return;
+    this.wal.append({ op: "run_finished", runId: run2.id, status: "failed", at: nowIso() });
+    const lease = this.leases.get(run2.id);
     if (lease)
-      this.release(run.id, lease.fencing);
+      this.release(run2.id, lease.fencing);
   }
 }
 var defaultLaneRunner = async (job) => {
@@ -1678,33 +2226,109 @@ var defaultLaneRunner = async (job) => {
 };
 async function runGraphToCompletion(store, wal, graph, context, options = {}) {
   const daemon = new WorkflowsDaemon(store, wal, {
-    worker: "local",
+    worker: `foreground-${randomUUID2()}`,
     laneRunner: options.laneRunner,
     time: options.time,
     env: options.env,
     isolatedRunId: options.isolatedRunId
   });
-  const run = daemon.startRun(graph, context);
-  options.onRunCreated?.(run);
-  daemon.isolateRun(run.id);
+  const run2 = options.existingRunId ? await store.getRun(options.existingRunId) : await daemon.startRun(graph, context);
+  if (!run2)
+    throw new Error("run not found");
+  options.onRunCreated?.(run2);
+  daemon.isolateRun(run2.id);
   const maxCycles = options.maxCycles ?? 500;
-  for (let cycle = 0;cycle < maxCycles; cycle++) {
-    const report = await daemon.reap();
-    const current = store.getRun(run.id);
-    if (current.status !== "running")
-      return current;
-    if (report.advanced === 0 && report.dispatched === 0) {
-      return store.getRun(run.id);
-    }
+  const hosted = store instanceof PostgresWorkflowsStore ? store : undefined;
+  if (hosted && !await hosted.acquireExecution(run2.id))
+    return await store.getRun(run2.id);
+  const lease = daemon.claim(run2.id);
+  if (!lease) {
+    await hosted?.releaseExecution();
+    return await store.getRun(run2.id);
+  }
+  try {
+    if (!await store.compareRunStatus(run2.id, ["pending"], "running", { startedAt: nowIso() }))
+      return await store.getRun(run2.id);
+    wal.append({ op: "run_started", runId: run2.id, at: nowIso() });
+    for (let cycle = 0;cycle < maxCycles; cycle++) {
+      daemon.heartbeat(run2.id, lease.fencing);
+      const outcome = await daemon.advanceRun(run2.id);
+      const current = await store.getRun(run2.id);
+      if (current.status !== "running" || outcome.kind === "blocked" || outcome.kind === "noop")
+        return current;
+    }
+    await store.compareRunStatus(run2.id, ["running"], "interrupted", { error: "run reached maxCycles; resume to continue" });
+    return await store.getRun(run2.id);
+  } finally {
+    daemon.release(run2.id, lease.fencing);
+    await hosted?.releaseExecution();
   }
-  return store.getRun(run.id);
 }
 
 // src/paths.ts
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join as join2 } from "path";
-import { dataDir } from "@hasna/paths";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
 var APP = "workflows";
 var STORE_DB_FILE = "workflows.db";
 function getHomeDir(env = process.env) {
@@ -1713,8 +2337,8 @@ function getHomeDir(env = process.env) {
 function getLegacyDataDir(env = process.env) {
   return join2(getHomeDir(env), ".hasna", APP);
 }
-function getResolverDataDir(env = process.env) {
-  return dataDir({ app: APP, home: getHomeDir(env), env });
+function getResolverDataDir(env = process.env, platform = process.platform) {
+  return dataDir({ app: APP, home: getHomeDir(env), env, platform });
 }
 function adoptResolverDataDir(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
@@ -1731,7 +2355,8 @@ function getEffectiveDataDir(env = process.env) {
 import { Database } from "bun:sqlite";
 import { mkdirSync } from "fs";
 import { join as join3 } from "path";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
+var RUN_STATUSES = ["pending", "running", "completed", "failed", "cancelled", "interrupted"];
 function nowIso2() {
   return new Date().toISOString();
 }
@@ -1801,6 +2426,8 @@ function openStore(dataDir2) {
       hit_count   INTEGER NOT NULL DEFAULT 0,
       created_at  TEXT NOT NULL
     );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_runs_idempotency ON runs(json_extract(context_json, '$.__wf.idempotencyKey'))
+      WHERE json_type(context_json, '$.__wf.idempotencyKey') = 'text';
     CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
     CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
     CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
@@ -1851,7 +2478,7 @@ function openStore(dataDir2) {
       return rows.map((r) => r.name);
     },
     createRun(input) {
-      const id = randomUUID();
+      const id = randomUUID3();
       const now = nowIso2();
       retryBusy(() => db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
              VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now));
@@ -1861,6 +2488,10 @@ function openStore(dataDir2) {
       const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE id = ?`).get(id));
       return row ? rowToRun(row) : undefined;
     },
+    getRunByIdempotencyKey(key) {
+      const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE json_valid(context_json) AND json_extract(context_json, '$.__wf.idempotencyKey') = ? ORDER BY created_at DESC LIMIT 1`).get(key));
+      return row ? rowToRun(row) : undefined;
+    },
     listRuns(opts = {}) {
       const limit = Math.min(opts.limit ?? 100, 1000);
       if (opts.status) {
@@ -1881,14 +2512,81 @@ function openStore(dataDir2) {
       const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
       retryBusy(() => db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id));
     },
+    compareRunStatus(id, expected, status, patch = {}) {
+      return retryBusy(() => db.transaction(() => {
+        const current = this.getRun(id);
+        if (!current || !expected.includes(current.status))
+          return false;
+        this.setRunStatus(id, status, patch);
+        return true;
+      }).immediate());
+    },
     bumpAttempts(id) {
       retryBusy(() => db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id));
     },
     setRunContext(id, context) {
       retryBusy(() => db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id));
     },
+    setRunningContext(id, context) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(id)?.status !== "running")
+          return false;
+        this.setRunContext(id, context);
+        return true;
+      }).immediate());
+    },
+    blockRunResume(id) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    dispatchIfRunning(id, action) {
+      return retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (run2?.status !== "running")
+          return { started: false };
+        const context = JSON.parse(run2.contextJson);
+        context.__wf = { ...context.__wf, executionMayBeActive: true };
+        this.setRunContext(id, context);
+        return { started: true, result: action() };
+      }).immediate());
+    },
+    finishDispatch(id, unconfirmed) {
+      retryBusy(() => db.transaction(() => {
+        const run2 = this.getRun(id);
+        if (!run2)
+          return;
+        const context = JSON.parse(run2.contextJson);
+        delete context.__wf?.executionMayBeActive;
+        if (unconfirmed)
+          context.__wf = { ...context.__wf, resumeBlocked: "execution cancellation has not been confirmed" };
+        this.setRunContext(id, context);
+      }).immediate());
+    },
+    commitStep(input) {
+      return retryBusy(() => db.transaction(() => {
+        if (this.getRun(input.runId)?.status !== "running")
+          return false;
+        const node2 = this.getRunNode(input.nodeRowId);
+        if (!node2 || node2.runId !== input.runId)
+          return false;
+        this.setRunNodeStatus(input.nodeRowId, input.status, input.patch);
+        if (input.incrementAttempts)
+          this.bumpAttemptsNode(input.nodeRowId);
+        if (input.context !== undefined)
+          this.setRunContext(input.runId, input.context);
+        if (input.memo)
+          this.memoPut(input.memo.key, input.memo.graphName, input.memo.nodeId, input.memo.inputHash, input.memo.outputJson);
+        return true;
+      }).immediate());
+    },
     createRunNode(input) {
-      const id = randomUUID();
+      const id = randomUUID3();
       retryBusy(() => db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
              VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null));
       return this.getRunNode(id);
@@ -1944,9 +2642,10 @@ function openStore(dataDir2) {
 }
 
 // src/wal.ts
+import { Database as Database2 } from "bun:sqlite";
 import { createHash as createHash2 } from "crypto";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync } from "fs";
-import { join as join4 } from "path";
+import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { basename, dirname, join as join4 } from "path";
 var WAL_FILE_NAME = "session.wal";
 var SESSIONS_DIR_NAME = "sessions";
 var MAX_WAL_BYTES = 256 * 1024 * 1024;
@@ -1958,15 +2657,17 @@ function checksumOf(op) {
 
 class SessionWAL {
   filePath;
+  journalLocked = false;
   constructor(filePath) {
     this.filePath = filePath;
   }
   static open(dataDir2) {
-    mkdirSync2(join4(dataDir2, SESSIONS_DIR_NAME), { recursive: true });
+    mkdirSync2(join4(dataDir2, SESSIONS_DIR_NAME), { recursive: true, mode: 448 });
     const canonical = join4(dataDir2, SESSIONS_DIR_NAME, WAL_FILE_NAME);
     const legacy = join4(dataDir2, WAL_FILE_NAME);
     if (existsSync2(legacy) && !existsSync2(canonical)) {
       try {
+        preserveOriginal(legacy);
         renameSync(legacy, canonical);
       } catch {
         return new SessionWAL(legacy);
@@ -1978,19 +2679,53 @@ class SessionWAL {
     return new SessionWAL(filePath);
   }
   append(op) {
+    return this.withJournalLock(() => this.appendLocked(op));
+  }
+  withJournalLock(operation) {
+    if (this.journalLocked)
+      return operation();
+    const parent = dirname(this.filePath);
+    const dataDir2 = basename(parent) === SESSIONS_DIR_NAME ? dirname(parent) : parent;
+    mkdirSync2(dataDir2, { recursive: true, mode: 448 });
+    const mutex = new Database2(join4(dataDir2, "workflows.db"));
+    try {
+      mutex.exec("PRAGMA busy_timeout = 5000");
+      mutex.exec("BEGIN IMMEDIATE");
+      this.journalLocked = true;
+      try {
+        const result = operation();
+        mutex.exec("COMMIT");
+        return result;
+      } catch (error) {
+        mutex.exec("ROLLBACK");
+        throw error;
+      } finally {
+        this.journalLocked = false;
+      }
+    } finally {
+      mutex.close();
+    }
+  }
+  exclusive(operation) {
+    return this.withJournalLock(operation);
+  }
+  appendLocked(op) {
     const at = op.at ?? new Date().toISOString();
     const full = { ...op, at };
     const nextSeq = this.nextSeq();
     const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
     appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, "utf8");
+`, { encoding: "utf8", mode: 384 });
     return entry;
   }
   nextSeq() {
     const replay = this.replay();
     return replay.entries.length + 1;
   }
-  replay() {
+  replay(options = {}) {
+    return this.withJournalLock(() => this.replayLocked(options));
+  }
+  replayLocked(options) {
     const entries = [];
     let torn = false;
     let repaired = false;
@@ -2034,6 +2769,9 @@ class SessionWAL {
     if (badOffset !== null) {
       torn = true;
       try {
+        if (options.repair === false)
+          return { entries, torn, repaired, liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs) };
+        preserveOriginal(this.filePath);
         truncateSync(this.filePath, badOffset);
         repaired = true;
       } catch {}
@@ -2073,13 +2811,22 @@ function reconstructLiveClaims(entries, nowMs = Date.now()) {
   }
   return claims;
 }
+function preserveOriginal(filePath) {
+  const original = readFileSync2(filePath);
+  const digest = createHash2("sha256").update(original).digest("hex");
+  const backup = `${filePath}.preserved-${digest}`;
+  if (!existsSync2(backup))
+    copyFileSync(filePath, backup, constants.COPYFILE_EXCL);
+  if (!readFileSync2(backup).equals(original))
+    throw new Error("session WAL preservation readback failed; source retained");
+  return backup;
+}
 
 // src/service.ts
+import { hostname } from "os";
+import { resolveDatabaseUrl } from "@hasna/contracts";
 var DEFAULT_PORT = 8790;
 var DEFAULT_HOST = "127.0.0.1";
-function packageVersion() {
-  return package_default.version;
-}
 function envString(names) {
   for (const name of names) {
     const value = process.env[name];
@@ -2096,69 +2843,218 @@ function envInt(names, fallback) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 function resolveWorkflowsConfig(overrides = {}) {
+  const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
+  if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
+    throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
   return {
     port: overrides.port ?? envInt(["HASNA_WORKFLOWS_PORT", "WORKFLOWS_PORT"], DEFAULT_PORT),
     host: overrides.host ?? envString(["HASNA_WORKFLOWS_HOST", "WORKFLOWS_HOST"]) ?? DEFAULT_HOST,
     dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? getEffectiveDataDir(),
-    apiUrl: overrides.apiUrl ?? envString(["WORKFLOWS_API_URL"]),
-    apiKey: overrides.apiKey ?? envString(["WORKFLOWS_API_KEY"])
+    apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
+    apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
+    originAuth,
+    storageBackend: overrides.storageBackend ?? "postgresql",
+    databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
   };
 }
 
 class WorkflowsService {
+  execution;
   name = "workflows";
   version;
   config;
   startedAt = Date.now();
-  constructor(config = {}) {
+  databaseEnv;
+  constructor(config = {}, execution = {}) {
+    this.execution = execution;
     this.config = resolveWorkflowsConfig(config);
+    this.databaseEnv = config.databaseUrl !== undefined ? { HASNA_WORKFLOWS_DATABASE_URL: config.databaseUrl } : {
+      HASNA_WORKFLOWS_DATABASE_URL: process.env.HASNA_WORKFLOWS_DATABASE_URL,
+      WORKFLOWS_DATABASE_URL: process.env.WORKFLOWS_DATABASE_URL
+    };
     this.version = packageVersion();
   }
   health() {
     return {
       ok: true,
+      status: "ok",
+      backend: this.config.storageBackend,
       service: this.name,
       version: this.version,
       pid: process.pid,
       uptimeMs: Date.now() - this.startedAt
     };
   }
-  ready() {
+  async ready() {
+    const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
+    if (this.config.apiKey) {
+      try {
+        checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
+      } catch (error) {
+        checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
+      }
+    }
+    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+  }
+  async openEngineStore(verifySchema = true) {
+    if (this.config.storageBackend === "sqlite")
+      return openStore(this.config.dataDir);
+    if (this.config.storageBackend !== "postgresql")
+      throw new WorkflowRequestError("invalid_storage_backend", "storage backend must be postgresql or explicit embedded sqlite", 503);
+    let databaseUrl;
+    try {
+      databaseUrl = resolveDatabaseUrl("workflows", this.databaseEnv);
+    } catch (error) {
+      throw new WorkflowRequestError("invalid_database_configuration", error instanceof Error ? error.message : "HASNA_WORKFLOWS_DATABASE_URL must configure PostgreSQL", 503);
+    }
+    let store;
+    try {
+      store = new PostgresWorkflowsStore({ databaseUrl, dataDir: this.config.dataDir, schema: this.config.databaseSchema });
+    } catch {
+      throw new WorkflowRequestError("invalid_database_schema", "HASNA_WORKFLOWS_DATABASE_SCHEMA must be a lowercase SQL identifier", 503);
+    }
+    try {
+      if (verifySchema && !await store.checkSchema())
+        throw new WorkflowRequestError("invalid_schema", "PostgreSQL workflow schema requires explicit initialization or a reviewed migration", 503);
+      return store;
+    } catch (error) {
+      await store.close();
+      throw error;
+    }
+  }
+  async withStore(operation) {
+    const store = await this.openEngineStore();
+    try {
+      return await operation(store);
+    } finally {
+      await store.close();
+    }
+  }
+  async initializeStorage() {
+    const store = await this.openEngineStore(false);
+    try {
+      if (!(store instanceof PostgresWorkflowsStore))
+        throw new WorkflowRequestError("invalid_storage_backend", "init-db requires PostgreSQL", 503);
+      await store.initialize();
+    } finally {
+      await store.close();
+    }
+  }
+  listRuns(options = {}) {
+    return this.withStore((store) => store.listRuns(options));
+  }
+  getRun(id) {
+    return this.withStore((store) => store.getRun(id));
+  }
+  listNodes(id) {
+    return this.withStore((store) => store.listRunNodes(id));
+  }
+  events(id) {
+    return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
+  }
+  cancelRun(id) {
+    return this.withStore(async (store) => {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        return;
+      if (["completed", "failed", "cancelled"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "cancellation requires a pending, running, or interrupted run", 409);
+      if (!await store.compareRunStatus(id, ["pending", "running", "interrupted"], "cancelled", { finishedAt: new Date().toISOString() }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before cancellation", 409);
+      return store.getRun(id);
+    });
+  }
+  async resumeRun(id) {
+    const store = await this.openEngineStore();
+    const wal = SessionWAL.open(this.config.dataDir);
+    try {
+      const run2 = await store.getRun(id);
+      if (!run2)
+        throw new WorkflowRequestError("run_not_found", "run id does not exist", 404);
+      if (!["failed", "cancelled", "interrupted"].includes(run2.status))
+        throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
+      const context = JSON.parse(run2.contextJson);
+      if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
+        throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
+      if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
+        throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
+        throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
+      for (const node2 of await store.listRunNodes(id)) {
+        if (node2.status !== "completed")
+          await store.setRunNodeStatus(node2.id, "pending", { error: null });
+      }
+      const final = await runGraphToCompletion(store, wal, graph, context, { ...this.execution, existingRunId: id });
+      return runSummary(final, false);
+    } finally {
+      await store.close();
+    }
+  }
+  sessions(action) {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    if (action === "list")
+      return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
     return {
-      ok: true,
-      service: this.name,
-      version: this.version,
-      checks: { version: "ok" }
+      entries: replay.entries.length,
+      torn: replay.torn,
+      repaired: false,
+      liveClaims: [...replay.liveClaims().entries()].map(([runId, claim]) => ({ runId, worker: claim.worker, fencing: claim.fencing, expiresAt: new Date(claim.expiresAtMs).toISOString() }))
     };
   }
+  machines(action) {
+    const local = { name: hostname(), role: "server", version: this.version };
+    if (action === "list")
+      return [local];
+    return { ...local, health: this.health(), sessions: this.sessions("pull") };
+  }
+  daemonStatus() {
+    const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
+    return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
+  }
+  listMemos() {
+    return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
+  }
   async triggerRun(graph, context = {}, opts = {}) {
-    const store = openStore(this.config.dataDir);
+    const store = await this.openEngineStore();
     const wal = SessionWAL.open(this.config.dataDir);
     try {
-      if (opts.idempotencyKey) {
-        const existing = findRunByIdempotencyKey(store, opts.idempotencyKey);
-        if (existing) {
-          return {
-            runId: existing.id,
-            status: existing.status,
-            error: existing.error ?? null,
-            result: existing.resultJson ? JSON.parse(existing.resultJson) : null,
-            reused: true
-          };
+      if (context === null || typeof context !== "object" || Array.isArray(context))
+        throw new WorkflowRequestError("invalid_context", "context must be an object");
+      if (Object.hasOwn(context, "__wf") || Object.hasOwn(context, "steps"))
+        throw new WorkflowRequestError("reserved_context", "context.__wf and context.steps are reserved for the workflow engine");
+      const maxCycles = opts.maxCycles ?? 500;
+      if (!Number.isSafeInteger(maxCycles) || maxCycles < 1 || maxCycles > 2000)
+        throw new WorkflowRequestError("invalid_max_cycles", "maxCycles must be an integer from 1 to 2000");
+      if (opts.idempotencyKey !== undefined && !/^[A-Za-z0-9_.:-]{1,128}$/.test(opts.idempotencyKey))
+        throw new WorkflowRequestError("invalid_idempotency_key", "idempotencyKey must contain 1 to 128 ASCII letters, digits, or _.:-");
+      const requestHash = createHash3("sha256").update(canonicalJson({ graph, context, maxCycles })).digest("hex");
+      const reuse = async () => {
+        const existing2 = opts.idempotencyKey ? await store.getRunByIdempotencyKey(opts.idempotencyKey) : undefined;
+        if (!existing2)
+          return;
+        if (JSON.parse(existing2.contextJson).__wf?.requestHash !== requestHash)
+          throw new WorkflowRequestError("idempotency_conflict", "idempotencyKey is already bound to a different request", 409);
+        return runSummary(existing2, true);
+      };
+      const existing = await reuse();
+      if (existing)
+        return existing;
+      const contextWithKey = { ...context, __wf: { requestHash, ...opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {} } };
+      let final;
+      try {
+        final = await runGraphToCompletion(store, wal, graph, contextWithKey, { ...this.execution, maxCycles });
+      } catch (err) {
+        if (err instanceof Error && (/UNIQUE constraint failed/.test(err.message) || err.code === "23505")) {
+          const winner = await reuse();
+          if (winner)
+            return winner;
         }
+        throw err;
       }
-      const contextWithKey = opts.idempotencyKey ? {
-        ...context,
-        __wf: {
-          cursor: undefined,
-          loops: {},
-          completedLoops: {},
-          ...context?.__wf ?? {},
-          idempotencyKey: opts.idempotencyKey
-        }
-      } : context;
-      const maxCycles = Math.min(Math.max(opts.maxCycles ?? 500, 1), 2000);
-      const final = await runGraphToCompletion(store, wal, graph, contextWithKey, { maxCycles });
       return {
         runId: final.id,
         status: final.status,
@@ -2167,16 +3063,38 @@ class WorkflowsService {
         reused: false
       };
     } finally {
-      store.close();
+      await store.close();
     }
   }
 }
-function createWorkflowsService(config = {}) {
-  return new WorkflowsService(config);
+function createWorkflowsService(config = {}, execution = {}) {
+  return new WorkflowsService(config, execution);
+}
+
+class WorkflowRequestError extends Error {
+  code;
+  status;
+  constructor(code, message, status = 400) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "WorkflowRequestError";
+  }
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().filter((k) => value[k] !== undefined).map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(",")}}`;
+  return JSON.stringify(value) ?? "null";
+}
+function runSummary(run2, reused) {
+  return { runId: run2.id, status: run2.status, error: run2.error ?? null, result: run2.resultJson ? JSON.parse(run2.resultJson) : null, reused };
 }
 export {
   resolveWorkflowsConfig,
   packageVersion,
   createWorkflowsService,
-  WorkflowsService
+  WorkflowsService,
+  WorkflowRequestError
 };