@open-mercato/core 0.10.1-develop.7736.1.88e07906bf → 0.10.1-develop.7748.1.d745ba61aa

package/src/modules/payment_gateways/lib/status-machine.ts

@@ -42,3 +42,22 @@ export function canApplyManualAction(action: ManualGatewayAction, from: UnifiedP
   if (targets.includes(from)) return true
   return targets.some((target) => isValidTransition(from, target))
 }
+
+const REFUND_STATUSES: Set<UnifiedPaymentStatus> = new Set(['refunded', 'partially_refunded'])
+
+/**
+ * A provider-confirmed refund proves the payment was captured. When a refund status reaches a
+ * transaction whose capture was not recorded yet (the capture webhook is late, or was never
+ * delivered), the transaction passes through `captured` on its way to the refund status instead
+ * of dropping the refund. Returns that intermediate status, or `null` when no bridge applies.
+ */
+export function resolveImpliedCaptureStatus(
+  from: UnifiedPaymentStatus,
+  to: UnifiedPaymentStatus,
+): UnifiedPaymentStatus | null {
+  if (!REFUND_STATUSES.has(to)) return null
+  if (isValidTransition(from, to)) return null
+  if (!isValidTransition(from, 'captured')) return null
+  if (!isValidTransition('captured', to)) return null
+  return 'captured'
+}

package/src/modules/payment_gateways/lib/webhook-processor.ts

@@ -103,7 +103,7 @@ export async function processPaymentGatewayWebhookJob(
     }
 
     const providerStatus = typeof event.data.status === 'string' ? event.data.status : ''
-    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType)
+    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType, { ...event, timestamp: new Date(event.timestamp) })
     await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Payment gateway webhook received', {
       eventType: event.eventType,
       providerStatus,

package/src/modules/staff/notifications.ts

@@ -17,6 +17,7 @@ export const notificationTypes: NotificationTypeDefinition[] = [
         variant: 'default',
         icon: 'check',
         commandId: 'staff.leave-requests.accept',
+        requiredFeatures: ['staff.leave_requests.manage'],
       },
       {
         id: 'reject',
@@ -24,6 +25,7 @@ export const notificationTypes: NotificationTypeDefinition[] = [
         variant: 'destructive',
         icon: 'x',
         commandId: 'staff.leave-requests.reject',
+        requiredFeatures: ['staff.leave_requests.manage'],
       },
     ],
     primaryActionId: 'approve',

package/src/modules/workflows/AGENTS.md

@@ -100,7 +100,7 @@ Definition → startWorkflow() → Instance → executeWorkflow() loop
 | `UPDATE_ENTITY` | Mutate an entity via the command bus. `CommandBus.execute` does not declare a signal; a write that has already begun cannot be cancelled on timeout. |
 | `EMIT_EVENT` | Emit a domain event to the event bus. `eventBus.emitEvent` does not declare a signal; an emit that has already begun cannot be cancelled on timeout. |
 | `EXECUTE_FUNCTION` | Run a registered custom function. Functions receive `(args, context, signal?: AbortSignal)` — the third arg is additive; existing two-arg functions are unaffected. |
-| `WAIT` | Delay execution for a configured duration |
+| `WAIT` | Delay execution for a configured duration. A sync WAIT over `MAX_INLINE_WAIT_MS` (60 s) that ENDS its transition is queued like an async one (`executeActivities` `queueLongInlineWaits`, opted into by the transition handler only — the AUTOMATED-step caller does not park on a queued result). An in-process WAIT never hands `setTimeout` more than `MAX_TIMER_DELAY_MS` (2^31−1 ms): Node would fire it after 1 ms. |
 | `SET_VARIABLE` | Write values into workflow context at dot paths (assignments land at top-level context, not namespaced under the activity) |
 
 ## Context Backbone (contextSchema · ledger · picker · samples · test step)
@@ -934,7 +934,7 @@ Treat a regression here as a broken feature, not a nit.
 | Variable | Effect | Default |
 |----------|--------|---------|
 | `OM_WORKFLOWS_ALLOW_PRIVATE_URLS` | When `1`/`true`/`yes`, bypasses the SSRF guard in `CALL_WEBHOOK` so workflow authors can hit `localhost`, RFC1918, and `.internal` targets. For dev only — MUST remain unset in production. | unset (guard enforced) |
-| `OM_WORKFLOWS_MAX_CONDITION_ATTEMPTS` | Hard cap on WAIT_FOR_CONDITION poll re-enqueues; reaching it forces `CONDITION_TIMED_OUT` so a never-satisfiable predicate cannot saturate the queue. | `1000` |
+| `OM_WORKFLOWS_MAX_CONDITION_ATTEMPTS` | Floor of the cap on WAIT_FOR_CONDITION poll re-enqueues; reaching the cap forces `CONDITION_TIMED_OUT` so a never-satisfiable predicate cannot saturate the queue. Each waiter's cap is raised to the polls its own timeout needs (`resolveConditionAttemptCap`: `timeoutMs / pollIntervalMs + 1`), so a long timeout is never cut short by the floor. | `1000` |
 | `OM_WORKFLOWS_ENV_INTERPOLATION_ALLOWLIST` | Comma-separated non-secret process env keys allowed for `{{env.*}}` interpolation in workflow activity config. `APP_URL` is always allowed. Never include secrets. | unset (`APP_URL` only) |
 
 ## DI Services

package/src/modules/workflows/api/portal/tasks/[id]/complete/route.ts

@@ -128,7 +128,11 @@ export async function POST(request: NextRequest, { params }: { params: { id: str
     // Anything the handler refuses on ownership or status grounds collapses into
     // the same 404 the predicate would have produced, so the act path discloses
     // no more than the read path.
-    if (code === 'TASK_NOT_FOUND' || code === 'TASK_ASSIGNED_TO_ANOTHER_USER') {
+    if (
+      code === 'TASK_NOT_FOUND' ||
+      code === 'TASK_ASSIGNED_TO_ANOTHER_USER' ||
+      code === 'WORKFLOW_NOT_ACTIVE'
+    ) {
       return NextResponse.json(PORTAL_TASK_REFUSAL.body, { status: PORTAL_TASK_REFUSAL.status })
     }
     logger.error('Error completing portal task', { err: error })

package/src/modules/workflows/api/tasks/[id]/complete/route.ts

@@ -164,6 +164,12 @@ export async function POST(
           { status: 409 }
         )
       }
+      if ((error as { code?: unknown }).code === 'WORKFLOW_NOT_ACTIVE') {
+        return NextResponse.json(
+          { error: error.message, code: 'WORKFLOW_NOT_ACTIVE' },
+          { status: 409 }
+        )
+      }
       if (error.message.includes('not found')) {
         return NextResponse.json(
           { error: error.message },
@@ -213,7 +219,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },
         { status: 403, description: 'The task is visible to the caller but is not theirs to act on — it has no assignee and no role queue, so it must be reassigned first (§6.4: administration widens seeing, never acting).', schema: workflowErrorSchema },
         { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },
-        { status: 409, description: 'Task already completed', schema: workflowErrorSchema },
+        { status: 409, description: 'Task already completed, assigned to another user, or its workflow run is no longer active (`code: WORKFLOW_NOT_ACTIVE` — the run is completed, failed, cancelled, compensating or compensated)', schema: workflowErrorSchema },
         { status: 500, description: 'Internal server error', schema: workflowErrorSchema },
       ],
     },

package/src/modules/workflows/backend/tasks/[id]/page.tsx

@@ -222,8 +222,12 @@ export default function UserTaskDetailPage({ params }: { params: { id: string }
           flash(t('workflows.tasks.messages.completed'), 'success')
           refreshTask()
         } else {
-          const failure = result.result as { error?: string } | null
-          flash(failure?.error || t('workflows.tasks.messages.completeFailed'), 'error')
+          const failure = result.result as { error?: string; code?: string } | null
+          const failureMessage =
+            failure?.code === 'WORKFLOW_NOT_ACTIVE'
+              ? t('workflows.tasks.messages.workflowNotActive')
+              : failure?.error || t('workflows.tasks.messages.completeFailed')
+          flash(failureMessage, 'error')
         }
       } catch (err) {
         logger.error('Error completing task', { err })

package/src/modules/workflows/data/entities.ts

@@ -675,6 +675,12 @@ export class StepInstance {
   @Property({ name: 'exited_at', type: Date, nullable: true })
   exitedAt?: Date | null
 
+  /**
+   * @deprecated Written on the COMPLETED path only and `null` for any step that
+   * lasted 2^31 ms (~24.86 days) or longer, which a Postgres `integer` cannot
+   * hold. Derive the duration from `exitedAt - enteredAt` instead; the column
+   * is scheduled for removal no earlier than 0.11.0 (see UPGRADE_NOTES.md).
+   */
   @Property({ name: 'execution_time_ms', type: 'integer', nullable: true })
   executionTimeMs?: number | null
 

package/src/modules/workflows/i18n/de.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Übergang ausgelöst",
   "workflows.events.types.TransitionPausedForActivities": "Übergang für Aktivitäten pausiert",
   "workflows.events.types.USER_TASK_ASSIGNED": "Benutzeraufgabe zugewiesen",
+  "workflows.events.types.USER_TASK_CANCELLED": "Benutzeraufgabe abgebrochen",
   "workflows.events.types.USER_TASK_CLAIMED": "Benutzeraufgabe übernommen",
   "workflows.events.types.USER_TASK_COMPLETED": "Benutzeraufgabe abgeschlossen",
   "workflows.events.types.USER_TASK_CREATED": "Benutzeraufgabe erstellt",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "Benutzeraufgaben konnten nicht geladen werden",
   "workflows.tasks.messages.reassignFailed": "Aufgabe konnte nicht neu zugewiesen werden",
   "workflows.tasks.messages.reassigned": "Aufgabe erfolgreich neu zugewiesen",
+  "workflows.tasks.messages.workflowNotActive": "Der Workflow ist nicht mehr aktiv",
   "workflows.tasks.myTasks": "Meine Aufgaben",
   "workflows.tasks.overdue": "Überfällig",
   "workflows.tasks.plural": "Benutzeraufgaben",

package/src/modules/workflows/i18n/en.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Transition Fired",
   "workflows.events.types.TransitionPausedForActivities": "Transition Paused for Activities",
   "workflows.events.types.USER_TASK_ASSIGNED": "User Task Assigned",
+  "workflows.events.types.USER_TASK_CANCELLED": "User Task Cancelled",
   "workflows.events.types.USER_TASK_CLAIMED": "User Task Claimed",
   "workflows.events.types.USER_TASK_COMPLETED": "User Task Completed",
   "workflows.events.types.USER_TASK_CREATED": "User Task Created",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "Failed to load user tasks",
   "workflows.tasks.messages.reassignFailed": "Failed to reassign task",
   "workflows.tasks.messages.reassigned": "Task reassigned successfully",
+  "workflows.tasks.messages.workflowNotActive": "Workflow is no longer active",
   "workflows.tasks.myTasks": "My Tasks",
   "workflows.tasks.overdue": "Overdue",
   "workflows.tasks.plural": "User Tasks",

package/src/modules/workflows/i18n/es.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Transicion activada",
   "workflows.events.types.TransitionPausedForActivities": "Transicion pausada por actividades",
   "workflows.events.types.USER_TASK_ASSIGNED": "Tarea de usuario asignada",
+  "workflows.events.types.USER_TASK_CANCELLED": "Tarea de usuario cancelada",
   "workflows.events.types.USER_TASK_CLAIMED": "Tarea de usuario reclamada",
   "workflows.events.types.USER_TASK_COMPLETED": "Tarea de usuario completada",
   "workflows.events.types.USER_TASK_CREATED": "Tarea de usuario creada",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "No se pudieron cargar las tareas de usuario",
   "workflows.tasks.messages.reassignFailed": "No se pudo reasignar la tarea",
   "workflows.tasks.messages.reassigned": "Tarea reasignada correctamente",
+  "workflows.tasks.messages.workflowNotActive": "El flujo de trabajo ya no está activo",
   "workflows.tasks.myTasks": "Mis tareas",
   "workflows.tasks.overdue": "Vencida",
   "workflows.tasks.plural": "Tareas de usuario",

package/src/modules/workflows/i18n/ko.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "전환 발동됨",
   "workflows.events.types.TransitionPausedForActivities": "활동 대기로 전환 일시 중지",
   "workflows.events.types.USER_TASK_ASSIGNED": "사용자 작업 할당됨",
+  "workflows.events.types.USER_TASK_CANCELLED": "사용자 작업 취소됨",
   "workflows.events.types.USER_TASK_CLAIMED": "사용자 작업 수령됨",
   "workflows.events.types.USER_TASK_COMPLETED": "사용자 작업 완료",
   "workflows.events.types.USER_TASK_CREATED": "사용자 작업 생성됨",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "사용자 작업을 불러오지 못했습니다",
   "workflows.tasks.messages.reassignFailed": "Failed to reassign task",
   "workflows.tasks.messages.reassigned": "Task reassigned successfully",
+  "workflows.tasks.messages.workflowNotActive": "워크플로가 더 이상 활성 상태가 아닙니다",
   "workflows.tasks.myTasks": "내 작업",
   "workflows.tasks.overdue": "기한 초과",
   "workflows.tasks.plural": "사용자 작업",

package/src/modules/workflows/i18n/pl.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Przejście Wykonane",
   "workflows.events.types.TransitionPausedForActivities": "Przejście Wstrzymane dla Działań",
   "workflows.events.types.USER_TASK_ASSIGNED": "Zadanie Użytkownika Przypisane",
+  "workflows.events.types.USER_TASK_CANCELLED": "Zadanie Użytkownika Anulowane",
   "workflows.events.types.USER_TASK_CLAIMED": "Zadanie Użytkownika Przejęte",
   "workflows.events.types.USER_TASK_COMPLETED": "Zadanie Użytkownika Ukończone",
   "workflows.events.types.USER_TASK_CREATED": "Zadanie Użytkownika Utworzone",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "Nie udało się załadować zadań użytkowników",
   "workflows.tasks.messages.reassignFailed": "Nie udało się ponownie przypisać zadania",
   "workflows.tasks.messages.reassigned": "Zadanie zostało ponownie przypisane",
+  "workflows.tasks.messages.workflowNotActive": "Przepływ pracy nie jest już aktywny",
   "workflows.tasks.myTasks": "Moje Zadania",
   "workflows.tasks.overdue": "Po Terminie",
   "workflows.tasks.plural": "Zadania Użytkownika",

package/src/modules/workflows/lib/activity-executor.ts

@@ -62,7 +62,7 @@ import './activity-registry-bootstrap'
 import { bindActivityExecutor } from './activity-types'
 import { getActivityType } from './activity-registry'
 import { logWorkflowEvent } from './event-logger'
-import { calculateWaitDelayMs, parseDuration } from './duration'
+import { MAX_INLINE_WAIT_MS, assertInProcessWaitDelay, calculateWaitDelayMs, parseDuration } from './duration'
 
 export { calculateWaitDelayMs } from './duration'
 import { resolveActivityTimeoutMs } from './activityTimeoutFields'
@@ -683,6 +683,31 @@ export async function executeActivity(
   }
 }
 
+export interface ExecuteActivitiesOptions {
+  /**
+   * Hand a synchronous activity with a long `enqueueDelayMs` (a WAIT over
+   * `MAX_INLINE_WAIT_MS`) to the activity queue instead of sleeping in-process.
+   * Only the transition's LAST activity qualifies, so nothing authored after the
+   * wait can run before it elapses. Only callers that park on an `async` result
+   * (the transition handler) may opt in — a caller that does not would let the
+   * run move on without waiting at all.
+   */
+  queueLongInlineWaits?: boolean
+}
+
+function isLongInlineWait(activity: ActivityDefinition, context: ActivityContext): boolean {
+  const entry = getActivityType(activity.activityType)
+  if (!entry?.enqueueDelayMs || entry.async.capable === false) return false
+  try {
+    const delayMs = entry.enqueueDelayMs(
+      interpolateActivityConfig(activity.config, context, activity.activityType, activity.activityName)
+    )
+    return delayMs !== null && delayMs > MAX_INLINE_WAIT_MS
+  } catch {
+    return false
+  }
+}
+
 /**
  * Execute multiple activities in sequence
  * Supports both synchronous and asynchronous (queued) execution
@@ -697,7 +722,8 @@ export async function executeActivities(
   em: EntityManager,
   container: AwilixContainer,
   activities: ActivityDefinition[],
-  context: ActivityContext
+  context: ActivityContext,
+  options: ExecuteActivitiesOptions = {}
 ): Promise<ActivityExecutionResult[]> {
   const results: ActivityExecutionResult[] = []
 
@@ -709,9 +735,15 @@ export async function executeActivities(
 
   for (let i = 0; i < activities.length; i++) {
     const activity = activities[i]
+    const isLastActivity = i === activities.length - 1
+    const queueAsLongWait =
+      !activity.async &&
+      options.queueLongInlineWaits === true &&
+      isLastActivity &&
+      isLongInlineWait(activity, context)
 
     // Check if activity should run async
-    if (activity.async && !forceSynchronous) {
+    if ((activity.async || queueAsLongWait) && !forceSynchronous) {
       // Enqueue for background execution
       const jobId = await enqueueActivity(em, activity, context)
 
@@ -1389,7 +1421,7 @@ export async function executeFunction(
  *   this handler returns immediately when called from the worker
  */
 export async function executeWait(config: any): Promise<any> {
-  const durationMs = calculateWaitDelayMs(config)
+  const durationMs = assertInProcessWaitDelay(calculateWaitDelayMs(config))
 
   // In sync mode, actually sleep for the duration
   // In async mode (called from worker), the delay already happened via queue scheduling

package/src/modules/workflows/lib/activity-types.ts

@@ -23,7 +23,7 @@
 import { z, type ZodTypeAny } from 'zod'
 import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
 import { getActivityType, registerActivityType } from './activity-registry'
-import { calculateWaitDelayMs } from './duration'
+import { assertInProcessWaitDelay, calculateWaitDelayMs } from './duration'
 import {
   callApiConfigSchema,
   callWebhookConfigSchema,
@@ -342,7 +342,7 @@ export function registerBuiltinActivityTypes(): void {
       { id: 'until', component: 'datetime' },
     ],
     execute: (config) => {
-      const durationMs = calculateWaitDelayMs(config)
+      const durationMs = assertInProcessWaitDelay(calculateWaitDelayMs(config))
       return new Promise((resolve) => {
         setTimeout(() => resolve({ waited: true, durationMs }), durationMs)
       })

package/src/modules/workflows/lib/condition-handler.ts

@@ -106,6 +106,21 @@ export function resolveMaxConditionAttempts(): number {
   return parsed
 }
 
+/**
+ * The attempt cap one waiter actually gets: the configured floor, raised to the
+ * number of polls its own timeout needs (`timeoutMs / pollIntervalMs`, plus
+ * the entry poll). A fixed 1000 would force a 90-day wait polled hourly to
+ * time out after ~42 days. The deadline still ends the wait first; this only
+ * bounds a loop whose deadline arithmetic went wrong.
+ */
+export function resolveConditionAttemptCap(
+  config: Pick<WaitForConditionConfig, 'timeoutMs' | 'pollIntervalMs'>
+): number {
+  const floor = resolveMaxConditionAttempts()
+  if (!(config.timeoutMs > 0) || !(config.pollIntervalMs > 0)) return floor
+  return Math.max(floor, Math.ceil(config.timeoutMs / config.pollIntervalMs) + 1)
+}
+
 /**
  * Read and normalise a WAIT_FOR_CONDITION step's config. Fails closed: the
  * predicate and the timeout are both mandatory, and the poll interval is
@@ -499,7 +514,7 @@ export async function evaluateWaitCondition(
 
   const deadlineMs = Date.parse(options.deadlineAt)
   const deadlinePassed = Number.isFinite(deadlineMs) ? nowMs >= deadlineMs : true
-  const attemptCapReached = attempts >= resolveMaxConditionAttempts()
+  const attemptCapReached = attempts >= resolveConditionAttemptCap(waiter.config)
 
   if (deadlinePassed || attemptCapReached) {
     const eventLogger = container.resolve<typeof eventLoggerModule>('eventLogger')

package/src/modules/workflows/lib/duration.ts

@@ -147,6 +147,31 @@ export function calculateDueDate(duration: string, from: Date = new Date()): Dat
   return new Date(from.getTime() + parseDuration(duration))
 }
 
+/**
+ * Largest delay Node's `setTimeout` honours (a signed 32-bit millisecond count,
+ * ~24.86 days). A longer delay is not rejected — it fires after 1 ms with only a
+ * `TimeoutOverflowWarning` — so an in-process wait must refuse it explicitly.
+ */
+export const MAX_TIMER_DELAY_MS = 2_147_483_647
+
+/**
+ * A WAIT longer than this is not slept inside the executing request: when it is
+ * the last activity of its transition it is handed to the activity queue (the
+ * path an `async: true` WAIT already takes). One minute keeps the short pauses
+ * people use for pacing inline while anything that would hold a request or a
+ * worker slot open for minutes becomes durable.
+ */
+export const MAX_INLINE_WAIT_MS = 60_000
+
+export function assertInProcessWaitDelay(delayMs: number): number {
+  if (delayMs > MAX_TIMER_DELAY_MS) {
+    throw new Error(
+      `WAIT activity: a ${delayMs}ms delay cannot be slept in-process (limit ${MAX_TIMER_DELAY_MS}ms); make it the last activity of its transition, mark it async, or use a WAIT_FOR_TIMER step`
+    )
+  }
+  return delayMs
+}
+
 export function calculateWaitDelayMs(config: { duration?: string; until?: string }): number {
   if (config.until) {
     const targetDate = new Date(config.until)

package/src/modules/workflows/lib/instance-status.ts

@@ -0,0 +1,29 @@
+/**
+ * Workflow instance statuses a user-task completion or a user-task SLA job must
+ * not touch.
+ *
+ * PURE: a type-only import, so the engine does not depend on the metrics
+ * module's `WORKFLOW_TERMINAL_STATUSES` for a runtime decision.
+ *
+ * The name means "a completion must not touch this run", NOT "its tasks are
+ * closed": a FAILED run keeps its open task so a retry can pick it up.
+ * `COMPENSATING` is included although it is not terminal — `compensateWorkflow`
+ * holds it while rollback activities run and then overwrites it with
+ * `COMPENSATED` or `FAILED`, and a completion in that window would advance a
+ * run that is being rolled back.
+ */
+
+import type { WorkflowInstanceStatus } from '../data/entities'
+
+export const RUN_STATUSES_CLOSED_TO_USER_TASKS: readonly WorkflowInstanceStatus[] = [
+  'COMPLETED',
+  'FAILED',
+  'CANCELLED',
+  'COMPENSATING',
+  'COMPENSATED',
+]
+
+export function isRunClosedToUserTasks(status: string | null | undefined): boolean {
+  if (!status) return false
+  return (RUN_STATUSES_CLOSED_TO_USER_TASKS as readonly string[]).includes(status)
+}

package/src/modules/workflows/lib/step-handler.ts

@@ -222,6 +222,21 @@ async function emitStepMilestone(em: EntityManager, stepInstance: StepInstance):
   }
 }
 
+/**
+ * `step_instances.execution_time_ms` is a Postgres `integer`, so a step that
+ * lasted 2^31 ms (~24.86 days) or longer cannot be stored there — the flush
+ * that completes the step would throw after its task already committed,
+ * stranding the run. Such a duration persists as `null` (every reader already
+ * falls back to `exitedAt - enteredAt`); the exact value still travels on the
+ * `STEP_EXITED` event, whose payload is jsonb.
+ */
+export const MAX_PERSISTED_EXECUTION_TIME_MS = 2_147_483_647
+
+export function toPersistableExecutionTimeMs(executionTimeMs: number | null): number | null {
+  if (executionTimeMs === null || !Number.isFinite(executionTimeMs)) return null
+  return Math.abs(executionTimeMs) > MAX_PERSISTED_EXECUTION_TIME_MS ? null : executionTimeMs
+}
+
 export async function exitStep(
   em: EntityManager,
   stepInstance: StepInstance,
@@ -239,7 +254,7 @@ export async function exitStep(
   stepInstance.status = 'COMPLETED'
   stepInstance.outputData = outputData || null
   stepInstance.exitedAt = now
-  stepInstance.executionTimeMs = executionTimeMs
+  stepInstance.executionTimeMs = toPersistableExecutionTimeMs(executionTimeMs)
   stepInstance.updatedAt = now
 
   await em.flush()

package/src/modules/workflows/lib/task-handler.ts

@@ -27,6 +27,7 @@ import {
 } from './task-decisions'
 import { loadTaskDecisionContext } from './task-decision-context'
 import { readRequiredFormFields } from './task-form-schema'
+import { isRunClosedToUserTasks } from './instance-status'
 import * as stepHandler from './step-handler'
 import * as transitionHandler from './transition-handler'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -174,6 +175,23 @@ export async function completeUserTask(
     )
   }
 
+  const instance = await em.findOne(WorkflowInstance, task.workflowInstanceId)
+  if (!instance) {
+    throw new UserTaskError(
+      'Workflow instance not found',
+      'INSTANCE_NOT_FOUND',
+      { workflowInstanceId: task.workflowInstanceId }
+    )
+  }
+
+  if (isRunClosedToUserTasks(instance.status)) {
+    throw new UserTaskError(
+      'Workflow is no longer active',
+      'WORKFLOW_NOT_ACTIVE',
+      { taskId, workflowInstanceId: instance.id, status: instance.status }
+    )
+  }
+
   // The chosen decision rides along inside the completion payload the task
   // already persists — no new column, and downstream route conditions can read
   // it once the payload is merged into the run context.
@@ -190,16 +208,6 @@ export async function completeUserTask(
 
   await em.flush()
 
-  // Fetch workflow instance
-  const instance = await em.findOne(WorkflowInstance, task.workflowInstanceId)
-  if (!instance) {
-    throw new UserTaskError(
-      'Workflow instance not found',
-      'INSTANCE_NOT_FOUND',
-      { workflowInstanceId: task.workflowInstanceId }
-    )
-  }
-
   // Branch-scoped completion: when the task belongs to a parallel branch,
   // merge form data into the branch namespace and resume just that branch.
   //

package/src/modules/workflows/lib/task-quick-action.ts

@@ -43,6 +43,24 @@ export const TASK_QUICK_ACTION_VIEW_ID = 'view'
 
 export const TASK_DEEP_LINK_HREF = '/backend/tasks/{sourceEntityId}'
 
+/** Feature the clicking user must hold to complete a task from its notification. */
+export const TASK_COMPLETE_REQUIRED_FEATURE = 'workflows.tasks.complete'
+
+/**
+ * The one-click completion button. Shared by {@link buildTaskQuickActions} and the
+ * `workflows.task.assigned` type declaration, so the stored action id and command id always
+ * match what the notifications module allows to dispatch.
+ */
+export function buildTaskQuickCompleteAction(): NotificationTypeAction {
+  return {
+    id: TASK_QUICK_ACTION_COMPLETE_ID,
+    labelKey: 'workflows.notifications.task.actions.complete',
+    variant: 'default',
+    icon: 'check',
+    commandId: TASK_COMPLETE_COMMAND_ID,
+  }
+}
+
 export interface TaskQuickActionInput {
   /** Decision buttons resolved for this task. */
   decisions?: { id: string }[] | null
@@ -90,16 +108,7 @@ export function buildTaskQuickActions(input: TaskQuickActionInput): Notification
 
   if (!isOneClickTask(input)) return [viewAction]
 
-  return [
-    viewAction,
-    {
-      id: TASK_QUICK_ACTION_COMPLETE_ID,
-      labelKey: 'workflows.notifications.task.actions.complete',
-      variant: 'default',
-      icon: 'check',
-      commandId: TASK_COMPLETE_COMMAND_ID,
-    },
-  ]
+  return [viewAction, buildTaskQuickCompleteAction()]
 }
 
 /**

package/src/modules/workflows/lib/task-sla.ts

@@ -32,6 +32,7 @@ import {
   type AgentReviewStepLike,
 } from './agent-review'
 import { findDefinitionForInstance } from './find-definition'
+import { isRunClosedToUserTasks } from './instance-status'
 import { emitWorkflowsEvent } from '../events'
 import type * as stepHandlerModule from './step-handler'
 import type * as transitionHandlerModule from './transition-handler'
@@ -300,7 +301,9 @@ type BreachOutcome =
   | 'reassigned'
   | 'routed'
   | 'route_skipped_branch'
+  | 'route_skipped_closed_run'
   | 'attention'
+  | 'attention_skipped_closed_run'
 
 interface AppliedBreachHandling {
   outcome: BreachOutcome
@@ -393,6 +396,9 @@ async function applyBreachHandling(
 
   if (resolution.kind === 'attention') {
     if (!instance) return { outcome: 'none' }
+    if (isRunClosedToUserTasks(instance.status)) {
+      return { outcome: 'attention_skipped_closed_run', detail: { stepId, status: instance.status } }
+    }
     await markInstanceForAttention(em, instance, stepId, task, now)
     return { outcome: 'attention', detail: { stepId } }
   }
@@ -430,6 +436,13 @@ async function applyBreachHandling(
       return { outcome: 'route_skipped_branch', detail: { transitionId: resolution.transition.transitionId } }
     }
 
+    if (isRunClosedToUserTasks(instance?.status)) {
+      return {
+        outcome: 'route_skipped_closed_run',
+        detail: { transitionId: resolution.transition.transitionId, status: instance?.status },
+      }
+    }
+
     // The task is superseded by the route, not abandoned: `ESCALATED` is an
     // existing `UserTaskStatus`, so no state machine changes.
     task.status = 'ESCALATED'

package/src/modules/workflows/lib/transition-handler.ts

@@ -522,7 +522,8 @@ export async function executeTransitionForToken(
         em,
         container,
         transition.activities as ActivityDefinition[],
-        activityContext
+        activityContext,
+        { queueLongInlineWaits: true }
       )
 
       activityResults.push(...results)