@orkestrel/workflow 0.0.16 → 0.0.18

package/dist/src/core/index.cjs

@@ -5,35 +5,69 @@ let _orkestrel_database = require("@orkestrel/database");
 let _orkestrel_emitter = require("@orkestrel/emitter");
 let _orkestrel_timeout = require("@orkestrel/timeout");
 let _orkestrel_queue = require("@orkestrel/queue");
+//#region src/core/errors.ts
+/**
+* Represents an error the workflow runtime raises for an operation it refuses — a
+* {@link WorkflowErrorCode} (`TRANSITION`, `RESTORE`, `MUTATION`, `SCHEDULE`, or `INVARIANT`)
+* beside an optional `context` naming the node or the parameter at fault.
+*
+* @remarks
+* Raised for an illegal lifecycle transition
+* (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
+* boundary (`RESTORE`), a refused structural/activity edit (`MUTATION`), a host
+* schedule refused before arming because the caller's `signal` is not a native
+* `AbortSignal` (`SCHEDULE`, delivered as a rejected promise), or a broken internal
+* invariant (`INVARIANT`).
+*/
+var WorkflowError = class extends Error {
+	code;
+	context;
+	constructor(code, message, context) {
+		super(message);
+		this.name = "WorkflowError";
+		this.code = code;
+		if (context !== void 0) this.context = context;
+	}
+};
+/**
+* Narrows an unknown caught value to a {@link WorkflowError}.
+*
+* @param value - The value to test (typically a `catch` binding)
+* @returns True if `value` is a {@link WorkflowError}; false otherwise
+*
+* @example
+* ```ts
+* try {
+* 	task.complete('done')
+* } catch (error) {
+* 	if (isWorkflowError(error) && error.code === 'TRANSITION') retry()
+* }
+* ```
+*/
+function isWorkflowError(value) {
+	try {
+		return value instanceof WorkflowError;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/core/constants.ts
-/** The default {@link import('./types.js').WorkflowDefinition.bail} — graceful (continue on a leaf failure). */
+/**
+* Names the default {@link import('./types.js').WorkflowDefinition.bail}, `false` — the graceful
+* policy that records a leaf failure and finishes every phase.
+*/
 var DEFAULT_BAIL = false;
 /**
-* Every {@link TaskStatus} value, frozen — the lifecycle vocabulary of a task.
+* Lists every {@link LifecycleStatus} value, frozen — the vocabulary every tier draws from,
+* in the order `pending`, `running`, `completed`, `failed`, `skipped`, `stopped`.
 *
 * @remarks
 * Ordered pending → running → terminal (`completed` / `failed` / `skipped` /
-* `stopped`). The source of truth for the union; compose guards / shapes from it.
+* `stopped`). The runtime source of truth for the union:
+* {@link import('./validators.js').isLifecycleStatus} reads this array.
 */
-var TASK_STATUSES = Object.freeze([
-	"pending",
-	"running",
-	"completed",
-	"failed",
-	"skipped",
-	"stopped"
-]);
-/** Every {@link PhaseStatus} value, frozen — the lifecycle vocabulary of a phase. */
-var PHASE_STATUSES = Object.freeze([
-	"pending",
-	"running",
-	"completed",
-	"failed",
-	"skipped",
-	"stopped"
-]);
-/** Every {@link WorkflowStatus} value, frozen — the lifecycle vocabulary of a workflow. */
-var WORKFLOW_STATUSES = Object.freeze([
+var LIFECYCLE_STATUSES = Object.freeze([
 	"pending",
 	"running",
 	"completed",
@@ -42,21 +76,21 @@ var WORKFLOW_STATUSES = Object.freeze([
 	"stopped"
 ]);
 /**
-* The {@link TaskStatus} values that are TERMINAL — a task in one of these will
-* not transition further, frozen.
+* Lists the terminal {@link LifecycleStatus} values, frozen — `completed`, `failed`, `skipped`,
+* and `stopped`, each a state a node never transitions out of.
 *
 * @remarks
 * The source of truth behind {@link import('./helpers.js').isTerminalStatus}.
 * `pending` and `running` are the only non-terminal members.
 */
-var TERMINAL_TASK_STATUSES = Object.freeze([
+var TERMINAL_STATUSES = Object.freeze([
 	"completed",
 	"failed",
 	"skipped",
 	"stopped"
 ]);
 /**
-* The legal {@link TaskStatus} transition graph of the live W-b task state machine —
+* Declares the legal {@link LifecycleStatus} transition graph of the live W-b task state machine —
 * each current status mapped to the statuses it may move to directly, frozen.
 *
 * @remarks
@@ -86,94 +120,161 @@ var TASK_TRANSITIONS = Object.freeze({
 	stopped: []
 });
 /**
-* The default per-phase task concurrency the {@link import('./factories.js').createWorkflowRunner}
+* Names the default per-phase task concurrency the {@link import('./factories.js').createWorkflowRunner}
 * runner applies when a {@link import('./types.js').PhaseDefinition} omits its `concurrency`
-* throttle — a cap that is effectively unbounded for any realistic phase.
+* throttle — `1024`, a cap that is effectively unbounded for any realistic phase.
 *
 * @remarks
-* The determinism principle fixes that a phase's tasks run CONCURRENTLY; `concurrency` is
+* The determinism principle fixes that a phase's tasks run concurrently; `concurrency` is
 * only an optional resource throttle (max-in-flight). With none declared, the runner runs
 * all of a phase's tasks at once — modelled as this finite cap so the value flows straight
 * into the substrate {@link import('./types.js').RunnerInterface}'s `concurrency` (which
 * expects a positive integer) without a special unbounded branch. No realistic phase
 * declares enough tasks to reach it, so it behaves as "run them all".
 *
-* WHY `1024` and not a huge sentinel like `1_000_000`: the backing `@orkestrel/queue` Runner
-* EAGERLY spawns one parked worker loop per concurrency unit AT CONSTRUCTION, so this default
+* why `1024` and not a huge sentinel like `1_000_000`: the backing `@orkestrel/queue` Runner
+* eagerly spawns one parked worker loop per concurrency unit at construction, so this default
 * must be a value whose eager allocation cost is negligible for every default-concurrency
 * phase — a million-unit default meant ~1e6 promise/closure allocations per such phase. A
-* phase may still DECLARE a larger explicit `concurrency` and pays that allocation knowingly.
+* phase may still declare a larger explicit `concurrency` and pays that allocation knowingly.
 */
 var DEFAULT_PHASE_CONCURRENCY = 1024;
 /**
-* The largest delay representable by the host timer APIs without overflow or clamping.
+* Names the largest delay representable by the host timer APIs without overflow or clamping,
+* `2_147_483_647` milliseconds.
 */
 var MAX_TIMER_MS = 2147483647;
+/**
+* Lists the {@link WorkflowEventMap} / {@link PhaseEventMap} events that make a durable observer
+* re-persist the live tree, frozen — `start`, `complete`, `fail`, `skip`, `stop`, `move`, and
+* `update`.
+*
+* @remarks
+* The two maps carry the same event names, so one list serves both tiers. It is the source of
+* truth behind {@link import('./WorkflowPersistence.js').WorkflowPersistence}'s attach and detach
+* passes: subscribing and unsubscribing loop over these names, so an added event reaches both
+* passes from one edit. `add` and `remove` are deliberately absent — they carry the new or dropped
+* child, so the persistence layer binds its own attaching handler to them instead.
+*/
+var PERSISTED_NODE_EVENTS = Object.freeze([
+	"start",
+	"complete",
+	"fail",
+	"skip",
+	"stop",
+	"move",
+	"update"
+]);
+/**
+* Lists the {@link TaskEventMap} events that make a durable observer re-persist the live tree,
+* frozen — `start`, `complete`, `fail`, `skip`, `stop`, `report`, and `pulse`.
+*
+* @remarks
+* The leaf counterpart of {@link PERSISTED_NODE_EVENTS}, and the source of truth behind the task
+* attach and detach passes of
+* {@link import('./WorkflowPersistence.js').WorkflowPersistence}. `report` and `pulse` join the
+* lifecycle events because an accepted activity frame changes the persisted snapshot; a leaf has
+* no children, so there is no structural event to bind separately.
+*/
+var PERSISTED_TASK_EVENTS = Object.freeze([
+	"start",
+	"complete",
+	"fail",
+	"skip",
+	"stop",
+	"report",
+	"pulse"
+]);
 //#endregion
-//#region src/core/errors.ts
+//#region src/core/validators.ts
 /**
-* An error raised by the workflow runtime.
+* Checks whether an unknown value belongs to the workflow lifecycle vocabulary.
 *
 * @remarks
-* Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
-* offending node id / status / parameter. Raised for an illegal lifecycle transition
-* (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
-* boundary (`RESTORE`), a refused structural/activity edit (`MUTATION`), or a host
-* schedule refused before arming because the caller's `signal` is not a native
-* `AbortSignal` (`SCHEDULE`, delivered as a rejected promise).
+* Reads {@link import('./constants.js').LIFECYCLE_STATUSES}, the runtime array every tier draws
+* from, so the vocabulary has one definition rather than a hard-coded copy per guard.
+*
+* @param value - The value to test
+* @returns True if `value` is a {@link LifecycleStatus}; false otherwise
+*
+* @example
+* ```ts
+* isLifecycleStatus('running') // true
+* isLifecycleStatus('paused') // false
+* ```
 */
-var WorkflowError = class extends Error {
-	code;
-	context;
-	constructor(code, message, context) {
-		super(message);
-		this.name = "WorkflowError";
-		this.code = code;
-		if (context !== void 0) this.context = context;
-	}
-};
+function isLifecycleStatus(value) {
+	return LIFECYCLE_STATUSES.some((status) => status === value);
+}
 /**
-* Narrow an unknown caught value to a {@link WorkflowError}.
+* Tests a normalized persisted task failure.
 *
-* @param value - The value to test (typically a `catch` binding)
-* @returns `true` when `value` is a {@link WorkflowError}
+* @remarks
+* The exact-record guard behind a persisted {@link TaskFailure}: exactly `origin` and `message`,
+* an `origin` drawn from the {@link import('./types.js').TaskFailureOrigin} vocabulary, and a
+* non-empty `message`. Total — a hostile prototype or accessor answers `false` rather than
+* throwing.
+*
+* @param value - The value to test
+* @returns True if `value` is a persisted {@link TaskFailure}; false otherwise
 *
 * @example
 * ```ts
-* try {
-* 	task.complete('done')
-* } catch (error) {
-* 	if (isWorkflowError(error) && error.code === 'TRANSITION') retry()
-* }
+* isTaskFailure({ origin: 'handler', message: 'boom' }) // true
+* isTaskFailure({ origin: 'handler' }) // false
 * ```
 */
-function isWorkflowError(value) {
+function isTaskFailure(value) {
 	try {
-		return value instanceof WorkflowError;
+		return (0, _orkestrel_contract.isRecord)(value) && Object.keys(value).every((key) => key === "origin" || key === "message") && (value.origin === "handler" || value.origin === "timeout" || value.origin === "recovery") && (0, _orkestrel_contract.isNonEmptyString)(value.message);
 	} catch {
 		return false;
 	}
 }
-//#endregion
-//#region src/core/validators.ts
-/** Test the workflow lifecycle vocabulary. */
-function isLifecycleStatus(value) {
-	return value === "pending" || value === "running" || value === "completed" || value === "failed" || value === "skipped" || value === "stopped";
-}
-/** Test a normalized persisted task failure. */
-function isTaskFailure(value) {
+/**
+* Checks whether an unknown value is a live workflow entity rather than a definition.
+*
+* @remarks
+* The discriminator behind the overloaded
+* {@link import('./types.js').WorkflowRunnerInterface.execute}: a
+* {@link import('./types.js').WorkflowInterface} is the only one of the two carrying `destroyed`
+* (runtime-only, never a field on the pure-JSON
+* {@link import('./types.js').WorkflowDefinition}) and a callable `snapshot`. Requiring both is
+* sturdier than `destroyed` alone — a definition could coincidentally carry a `destroyed` field as
+* arbitrary data, and pairing it with a function-typed `snapshot` narrows to the actual entity
+* shape without an `as`. It reads a live class instance, so it tests object identity rather than a
+* plain-record brand, and it is total: any other value answers `false`.
+*
+* @param value - The value to test
+* @returns True if `value` is a live {@link WorkflowInterface}; false otherwise
+*
+* @example
+* ```ts
+* isWorkflowInterface(createWorkflow(definition)) // true
+* isWorkflowInterface(definition) // false
+* ```
+*/
+function isWorkflowInterface(value) {
 	try {
-		return (0, _orkestrel_contract.isRecord)(value) && Object.keys(value).every((key) => key === "origin" || key === "message") && (value.origin === "handler" || value.origin === "timeout" || value.origin === "recovery") && (0, _orkestrel_contract.isNonEmptyString)(value.message);
+		return (0, _orkestrel_contract.isObject)(value) && "destroyed" in value && "snapshot" in value && (0, _orkestrel_contract.isFunction)(value.snapshot);
 	} catch {
 		return false;
 	}
 }
 /**
-* Validate a safe owned JSON graph as a coherent workflow snapshot.
+* Validates a safe owned JSON graph as a coherent workflow snapshot.
 *
 * @remarks
 * Callers at hostile boundaries use {@link isWorkflowSnapshot}, which owns the
 * graph first so this semantic pass never observes accessors or prototypes.
+*
+* @param value - The already-owned JSON graph to validate
+* @returns True if `value` is a coherent {@link WorkflowSnapshot}; false otherwise
+*
+* @example
+* ```ts
+* isOwnedWorkflowSnapshot(workflow.snapshot()) // true
+* ```
 */
 function isOwnedWorkflowSnapshot(value) {
 	try {
@@ -195,7 +296,7 @@ function isOwnedWorkflowSnapshot(value) {
 			const statuses = [];
 			if (phase.tasks.length > 0) vacuous = false;
 			for (const task of phase.tasks) {
-				if (!(0, _orkestrel_contract.isRecord)(task) || !Object.keys(task).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "result" || key === "metadata" || key === "attempts" || key === "run" || key === "retries" || key === "timeout" || key === "activity") || !(0, _orkestrel_contract.isNonEmptyString)(task.id) || taskIds.has(task.id) || !(0, _orkestrel_contract.isNonEmptyString)(task.name) || task.description !== void 0 && typeof task.description !== "string" || !isLifecycleStatus(task.status) || !(0, _orkestrel_contract.isRecord)(task.metadata) || !(0, _orkestrel_contract.isJSONValue)(task.metadata) || !(0, _orkestrel_contract.isInteger)(task.attempts) || task.attempts < 0 || task.run !== void 0 && !(0, _orkestrel_contract.isNonEmptyString)(task.run) || task.retries !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.timeout) || task.timeout < 0 || task.timeout > 2147483647)) return false;
+				if (!(0, _orkestrel_contract.isRecord)(task) || !Object.keys(task).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "result" || key === "metadata" || key === "attempts" || key === "behavior" || key === "retries" || key === "timeout" || key === "activity") || !(0, _orkestrel_contract.isNonEmptyString)(task.id) || taskIds.has(task.id) || !(0, _orkestrel_contract.isNonEmptyString)(task.name) || task.description !== void 0 && typeof task.description !== "string" || !isLifecycleStatus(task.status) || !(0, _orkestrel_contract.isRecord)(task.metadata) || !(0, _orkestrel_contract.isJSONValue)(task.metadata) || !(0, _orkestrel_contract.isInteger)(task.attempts) || task.attempts < 0 || task.behavior !== void 0 && !(0, _orkestrel_contract.isNonEmptyString)(task.behavior) || task.retries !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.timeout) || task.timeout < 0 || task.timeout > 2147483647)) return false;
 				const budget = (task.retries ?? 0) + 1;
 				if (task.attempts > budget || task.status === "pending" && task.attempts >= budget) return false;
 				if (!(task.activity === void 0 || isTaskActivity(task.activity))) return false;
@@ -223,13 +324,82 @@ function isOwnedWorkflowSnapshot(value) {
 		return false;
 	}
 }
-/** Total hostile-boundary workflow snapshot guard. */
+/**
+* Guards the hostile boundary totally for a workflow snapshot.
+*
+* @remarks
+* Owns the value first through the exact-JSON clone of `@orkestrel/contract`, then runs the
+* semantic pass {@link isOwnedWorkflowSnapshot} over the owned copy — so no accessor, prototype,
+* or cycle in the caller's graph is ever observed by the semantic pass. Total: an unclonable
+* value answers `false` rather than throwing.
+*
+* @param value - The untrusted value to test
+* @returns True if `value` is a coherent {@link WorkflowSnapshot}; false otherwise
+*
+* @example
+* ```ts
+* isWorkflowSnapshot(JSON.parse(payload)) // true only for a coherent snapshot
+* ```
+*/
 function isWorkflowSnapshot(value) {
 	const cloned = (0, _orkestrel_contract.attempt)(() => (0, _orkestrel_contract.cloneJSONValue)(value));
 	return cloned.success && isOwnedWorkflowSnapshot(cloned.value);
 }
 /**
-* Test whether an unknown value is a valid whole-frame activity report.
+* Checks whether an unknown value is a valid list of task activity claims.
+*
+* @remarks
+* The one guard behind both claim lists of a {@link TaskActivityInput} — its `operations` and its
+* `constraints` — because {@link import('./types.js').TaskOperation} and
+* {@link import('./types.js').TaskConstraint} are the same {@link TaskClaim} shape. Every member must be a plain record carrying exactly `id`, `name`, and
+* `started`, with non-empty string `id` and `name`, a finite non-negative `started`, and an `id`
+* unique within the list. Total: a hostile prototype, an accessor, or a cycle returns `false`
+* rather than throwing.
+*
+* @param value - The value to test
+* @returns True if `value` is a list of valid, uniquely identified claims; false otherwise
+*
+* @example
+* ```ts
+* isTaskClaimList([{ id: 'fetch', name: 'Fetch', started: 1 }]) // true
+* isTaskClaimList([{ id: 'fetch', name: 'Fetch' }]) // false
+* ```
+*/
+function isTaskClaimList(value) {
+	try {
+		if (!(0, _orkestrel_contract.isArray)(value)) return false;
+		const ids = /* @__PURE__ */ new Set();
+		for (const claim of value) {
+			if (!(0, _orkestrel_contract.isRecord)(claim)) return false;
+			const prototype = Object.getPrototypeOf(claim);
+			if (prototype !== Object.prototype && prototype !== null || !Object.keys(claim).every((key) => key === "id" || key === "name" || key === "started")) return false;
+			const id = claim.id;
+			const name = claim.name;
+			const started = claim.started;
+			if (!(0, _orkestrel_contract.isNonEmptyString)(id) || !(0, _orkestrel_contract.isNonEmptyString)(name) || !(0, _orkestrel_contract.isFiniteNumber)(started) || started < 0 || ids.has(id)) return false;
+			ids.add(id);
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Tests whether an unknown value is a valid whole-frame activity report.
+*
+* @remarks
+* The guard behind {@link import('./types.js').TaskInterface.report}: exactly the optional `note`,
+* `progress`, `operations`, and `constraints` keys, with the two claim lists checked by
+* {@link isTaskClaimList} and `progress` a finite non-negative value under an optional `total` at
+* least as large. Total — a hostile prototype or accessor answers `false` rather than throwing.
+*
+* @param value - The value to test
+* @returns True if `value` is a valid {@link TaskActivityInput}; false otherwise
+*
+* @example
+* ```ts
+* isTaskActivityInput({ note: 'compiling', progress: { progress: 2, total: 5 } }) // true
+* ```
 */
 function isTaskActivityInput(value) {
 	try {
@@ -250,41 +420,29 @@ function isTaskActivityInput(value) {
 			const message = progress.message;
 			if (!(0, _orkestrel_contract.isFiniteNumber)(reported) || reported < 0 || total !== void 0 && (!(0, _orkestrel_contract.isFiniteNumber)(total) || total < reported) || message !== void 0 && !(0, _orkestrel_contract.isNonEmptyString)(message)) return false;
 		}
-		if (operations !== void 0) {
-			if (!(0, _orkestrel_contract.isArray)(operations)) return false;
-			const ids = /* @__PURE__ */ new Set();
-			for (const operation of operations) {
-				if (!(0, _orkestrel_contract.isRecord)(operation)) return false;
-				const operationPrototype = Object.getPrototypeOf(operation);
-				if (operationPrototype !== Object.prototype && operationPrototype !== null || !Object.keys(operation).every((key) => key === "id" || key === "name" || key === "started")) return false;
-				const id = operation.id;
-				const name = operation.name;
-				const started = operation.started;
-				if (!(0, _orkestrel_contract.isNonEmptyString)(id) || !(0, _orkestrel_contract.isNonEmptyString)(name) || !(0, _orkestrel_contract.isFiniteNumber)(started) || started < 0 || ids.has(id)) return false;
-				ids.add(id);
-			}
-		}
-		if (constraints !== void 0) {
-			if (!(0, _orkestrel_contract.isArray)(constraints)) return false;
-			const ids = /* @__PURE__ */ new Set();
-			for (const constraint of constraints) {
-				if (!(0, _orkestrel_contract.isRecord)(constraint)) return false;
-				const constraintPrototype = Object.getPrototypeOf(constraint);
-				if (constraintPrototype !== Object.prototype && constraintPrototype !== null || !Object.keys(constraint).every((key) => key === "id" || key === "name" || key === "started")) return false;
-				const id = constraint.id;
-				const name = constraint.name;
-				const started = constraint.started;
-				if (!(0, _orkestrel_contract.isNonEmptyString)(id) || !(0, _orkestrel_contract.isNonEmptyString)(name) || !(0, _orkestrel_contract.isFiniteNumber)(started) || started < 0 || ids.has(id)) return false;
-				ids.add(id);
-			}
-		}
+		if (operations !== void 0 && !isTaskClaimList(operations)) return false;
+		if (constraints !== void 0 && !isTaskClaimList(constraints)) return false;
 		return true;
 	} catch {
 		return false;
 	}
 }
 /**
-* Test whether an unknown value is valid persisted task activity.
+* Tests whether an unknown value is valid persisted task activity.
+*
+* @remarks
+* The persisted counterpart of {@link isTaskActivityInput}: the same frame plus the required
+* `operations`, `constraints`, and a finite non-negative `updated` stamp, because a stored frame
+* has already been accepted and normalized. Total — a hostile prototype or accessor answers
+* `false` rather than throwing.
+*
+* @param value - The value to test
+* @returns True if `value` is a persisted {@link TaskActivity}; false otherwise
+*
+* @example
+* ```ts
+* isTaskActivity({ operations: [], constraints: [], updated: 1 }) // true
+* ```
 */
 function isTaskActivity(value) {
 	try {
@@ -310,7 +468,7 @@ function isTaskActivity(value) {
 //#endregion
 //#region src/core/helpers.ts
 /**
-* Capture every top-level {@link WorkflowOptions} value exactly once into an owned plain bag.
+* Captures every top-level {@link WorkflowOptions} value exactly once into an owned plain bag.
 *
 * @remarks
 * Direct property reads preserve inherited and non-enumerable option values while preventing
@@ -345,32 +503,159 @@ function captureWorkflowOptions(options) {
 	});
 }
 /**
-* Test whether a {@link LifecycleStatus} is TERMINAL — a node in this state will not
-* transition further.
+* Tests whether a {@link LifecycleStatus} is terminal — `completed`, `failed`, `skipped`, or
+* `stopped`, the states a node never transitions out of.
 *
 * @remarks
-* The ONE terminal check across all three tiers (AGENTS §4.4 "one concept = one word"):
+* The one terminal check across every tier (AGENTS.md § Design laws, "one concept, one term"):
 * a task, a phase, and a workflow share the same {@link LifecycleStatus} vocabulary, so a
 * single predicate covers them — {@link derivePhaseStatus} and {@link deriveWorkflowStatus}
-* both consult it to tell a settled node from an in-flight one. Terminal: `completed` /
-* `failed` / `skipped` / `stopped`; the only non-terminal states are `pending` and
-* `running`.
+* both consult it to tell a settled node from an in-flight one. It reads the terminal set from
+* {@link import('./constants.js').TERMINAL_STATUSES} (`completed` / `failed` / `skipped` /
+* `stopped`), so that constant is the one definition; the only non-terminal states are `pending`
+* and `running`.
 *
 * @param status - The lifecycle status to test (a task / phase / workflow status)
-* @returns `true` when the status is terminal
+* @returns True if the status is terminal; false otherwise
 */
 function isTerminalStatus(status) {
-	return status === "completed" || status === "failed" || status === "skipped" || status === "stopped";
+	return TERMINAL_STATUSES.includes(status);
 }
 /**
-* Derive a phase's status from its tasks' statuses (tasks are concurrent, so this
-* is an order-insensitive reduction).
+* Tests whether a driving run must stop giving a workflow — or one forced phase of it —
+* more work.
+*
+* @remarks
+* The halt gate a {@link import('./WorkflowRunner.js').WorkflowRunner} consults before starting a
+* phase, before dispatching a task, and after every cooperative gate. A workflow is halted after
+* its derived status is terminal but not `completed` — a `bail: true` failure, a caller's own
+* graceful `stop()`, or a forced `skip`. `completed` is excluded deliberately: a workflow that
+* completed vacuously is settled, not halted, and the distinction is what keeps the run from
+* sweeping a finished tree. When a `phase` is supplied, its own forced `skipped` / `stopped` halts
+* that phase's work too; a `failed` phase does not, because the workflow's own `bail` policy
+* decides whether a failed phase ends the run.
+*
+* @param workflow - The live workflow the run is driving
+* @param phase - The phase whose own forced terminal status also halts its tasks
+* @returns True if the run must stop giving this workflow (or phase) more work; false otherwise
+*
+* @example
+* ```ts
+* isHalted(workflow) // false while pending or running
+* workflow.stop()
+* isHalted(workflow) // true
+* ```
+*/
+function isHalted(workflow, phase) {
+	const status = workflow.status;
+	return isTerminalStatus(status) && status !== "completed" || phase?.status === "skipped" || phase?.status === "stopped";
+}
+/**
+* Tests whether forcing a workflow `stopped` would still record the cancellation.
+*
+* @remarks
+* `stop()` is a no-op after a workflow's status becomes terminal, so a run that must record a
+* cancellation forces it only while this holds. It is not the negation of
+* {@link isTerminalStatus}: `completed` and `skipped` both pass, because a run-level cancel that
+* lands on a vacuously-completed or fully-skipped tree still records `stopped` as the outcome the
+* caller asked for. Only an already-`failed` or already-`stopped` workflow has a terminal state
+* worth keeping.
+*
+* @param workflow - The live workflow a run-level cancel would force
+* @returns True if forcing `stopped` would change the recorded outcome; false otherwise
+*
+* @example
+* ```ts
+* isStoppable(workflow) // true while pending, running, completed, or skipped
+* workflow.stop()
+* isStoppable(workflow) // false
+* ```
+*/
+function isStoppable(workflow) {
+	const status = workflow.status;
+	return status !== "failed" && status !== "stopped";
+}
+/**
+* Tests whether a naturally-finished run may force its workflow `completed`.
+*
+* @remarks
+* A run that walked every phase and still derives `pending` executed nothing — zero phases, or
+* every phase empty — so it is vacuously done and the run settles it `completed`. Gated on
+* exactly `pending` so a real `completed`, a `bail: true` `failed`, a `stopped`, or a derived
+* `skipped` is never overridden. The tree-is-empty half of the rule is
+* {@link WorkflowInterface.complete}'s own guard, which refuses a pending tree that still holds
+* tasks.
+*
+* @param workflow - The live workflow the run has finished walking
+* @returns True if the run may force the vacuous completion; false otherwise
+*
+* @example
+* ```ts
+* isCompletable(createWorkflow({ id: 'w', name: 'W', phases: [] })) // true
+* ```
+*/
+function isCompletable(workflow) {
+	return workflow.status === "pending";
+}
+/**
+* Tests whether a task attempt is being genuinely cancelled rather than merely timed out.
+*
+* @remarks
+* The discriminator that keeps a per-attempt deadline off the skip path. Three causes fire a
+* running task's folded signal, and only two of them mean "skip this task": the task's own
+* `signal` (its `stop` / `skip`), and the unit or run signal (a sibling fail-fast under
+* `bail: true`, or a run-level abort / timeout / budget / `destroy`). A bare per-attempt timeout
+* fires neither — it aborts only the deadline portion of the attempt signal — so it stays a
+* retryable failure of that attempt instead of skipping the leaf and losing the recorded fault.
+* Read fresh at each call so a cancel that lands mid-dispatch is seen.
+*
+* @param task - The live task the attempt is driving
+* @param controller - The substrate unit handle carrying the unit-level abort
+* @param runSignal - The run's folded cancellation signal
+* @returns True if the attempt is being genuinely cancelled; false otherwise
+*
+* @example
+* ```ts
+* isSkipping(task, controller, runSignal) // false until a cancel fires
+* ```
+*/
+function isSkipping(task, controller, runSignal) {
+	return task.signal.aborted || controller.aborted || runSignal.aborted;
+}
+/**
+* Tests whether one attempt still owns the task it launched.
+*
+* @remarks
+* A retried task is re-dispatched while an earlier attempt's handler may still be resolving, so
+* every settlement path re-checks ownership before touching the leaf. Ownership needs both
+* halves: the run-local `owners` ledger must still name this attempt, and the live task's own
+* `attempts` tally must still match it. A superseded attempt reads `false` and returns without
+* recording anything, so a late resolution can never overwrite the newer attempt's outcome.
+*
+* @param owners - The run-local ledger of the attempt owning each task id
+* @param task - The live task the attempt launched
+* @param attempt - The one-based attempt number to test
+* @returns True if `attempt` still owns `task`; false otherwise
+*
+* @example
+* ```ts
+* const owners = new Map([[task.id, 1]])
+* ownsAttempt(owners, task, 1) // true while the task's own `attempts` is 1
+* ownsAttempt(owners, task, 2) // false
+* ```
+*/
+function ownsAttempt(owners, task, attempt) {
+	return owners.get(task.id) === attempt && task.attempts === attempt;
+}
+/**
+* Derives a phase's status from its tasks' statuses, the most severe terminal status winning
+* (tasks are concurrent, so this is an order-insensitive reduction).
 *
 * @remarks
 * The truth table (most-severe terminal wins; `bail`-agnostic — a phase surfaces a
 * task failure as `failed` so the workflow's `bail` policy can decide):
 * - no tasks ⇒ `pending`.
-* - any task `running`, OR a mix of started-and-unsettled tasks (some non-`pending`
+* - any task `running`, or a mix of started-and-unsettled tasks (some non-`pending`
 *   but not all terminal) ⇒ `running`.
 * - every task `pending` ⇒ `pending`.
 * - all terminal: any `failed` ⇒ `failed`; else any `stopped` ⇒ `stopped`; else any
@@ -381,7 +666,7 @@ function isTerminalStatus(status) {
 * task makes the phase `failed`.
 *
 * @param tasks - The phase's task statuses, in any order
-* @returns The derived {@link PhaseStatus}
+* @returns The derived phase {@link LifecycleStatus}
 */
 function derivePhaseStatus(tasks) {
 	if (tasks.length === 0) return "pending";
@@ -393,24 +678,25 @@ function derivePhaseStatus(tasks) {
 	return "skipped";
 }
 /**
-* Derive a workflow's status from its phases' {@link PhaseDerivation}s — each phase's status
-* paired with the EFFECTIVE `bail` it ran under (`phase.bail ?? workflow.bail`) — so the
-* failure outcome is PER-PHASE-bail-aware (phases are sequential, but the derivation is an
-* order-insensitive reduction over the settled set).
+* Derives a workflow's status from its phases' {@link PhaseDerivation}s — each phase's status
+* paired with the effective `bail` it ran under (`phase.bail ?? workflow.bail`) — so the
+* failure outcome is aware of each phase's own policy, and `failed` is reachable only where
+* that policy is `true` (phases are sequential, but the derivation is an order-insensitive
+* reduction over the settled set).
 *
 * @remarks
-* `bail` is now a per-phase override (AGENTS §4.4), so it is carried on each
-* {@link PhaseDerivation} rather than passed as one scalar. It is the ONLY axis that changes
+* `bail` is a per-phase override, so it is carried on each
+* {@link PhaseDerivation} rather than passed as one scalar. It is the only axis that changes
 * the failure outcome, decided per phase:
 * - **A `failed` phase whose effective `bail` is `true` (halt)** propagates ⇒ the workflow is
 *   `failed` (the database-transaction halt) — even when the workflow default is graceful.
-* - **A `failed` phase whose effective `bail` is `false` (graceful)** is DATA, not a workflow
-*   failure — it folds into completion like a settled phase. A graceful failed phase NEVER
+* - **A `failed` phase whose effective `bail` is `false` (graceful)** is data, not a workflow
+*   failure — it folds into completion like a settled phase. A graceful failed phase never
 *   makes the workflow `failed` — even when the workflow default is strict.
 *
 * The rest of the table is shared:
 * - no phases ⇒ `pending`.
-* - any phase `running`, OR a mix of started-and-unsettled phases (some non-`pending`
+* - any phase `running`, or a mix of started-and-unsettled phases (some non-`pending`
 *   but not all terminal) ⇒ `running`.
 * - every phase `pending` ⇒ `pending`.
 * - all terminal (a `failed` phase counts as terminal here): any `stopped` ⇒ `stopped`; else
@@ -418,7 +704,7 @@ function derivePhaseStatus(tasks) {
 *   else (all `skipped`) ⇒ `skipped`.
 *
 * @param phases - The workflow's per-phase {@link PhaseDerivation}s (status + effective bail), in any order
-* @returns The derived {@link WorkflowStatus}
+* @returns The derived workflow {@link LifecycleStatus}
 */
 function deriveWorkflowStatus(phases) {
 	if (phases.length === 0) return "pending";
@@ -430,18 +716,19 @@ function deriveWorkflowStatus(phases) {
 	return "skipped";
 }
 /**
-* Derive the PENDING SUFFIX boundary of a positional list of {@link LifecycleStatus}es —
-* the index of the first entry in the contiguous trailing run of `pending` entries.
+* Derives the pending-suffix boundary of a positional list of {@link LifecycleStatus}es —
+* the index of the first entry in the contiguous trailing run of `pending` entries, or the
+* list's length where it has none.
 *
 * @remarks
-* The native, hook-free replacement for a runner-installed cursor (AGENTS §12): a
+* The native, hook-free replacement for a runner-installed cursor: a
 * {@link import('./types.js').WorkflowInterface}'s `add` / `remove` / `move` / `update`
 * reads this over its live phases' statuses to decide which positions are safe to edit.
-* Because entries run SEQUENTIALLY (phases sequential, AGENTS determinism), every
-* already-started entry forms a contiguous LEADING prefix and every still-`pending`
-* entry forms the trailing suffix — so the boundary is simply the count of leading
+* Because entries run sequentially (phases sequential, AGENTS determinism), every
+* already-started entry forms a contiguous leading prefix and every still-`pending`
+* entry forms the trailing suffix — so the boundary is the count of leading
 * non-`pending` entries: the index of the first `pending` entry, or the full length when
-* none is `pending` (nothing is safely editable). A `pending` container's entries are ALL
+* none is `pending` (nothing is safely editable). A `pending` container's entries are all
 * `pending`, so the boundary is `0` and every position is naturally accepted — callers
 * need no special case for that.
 *
@@ -460,8 +747,8 @@ function deriveBoundary(statuses) {
 	return index === -1 ? statuses.length : index;
 }
 /**
-* Test whether the live W-b task state machine may move directly from one
-* {@link TaskStatus} to another — the legal-transition guard.
+* Tests whether the live W-b task state machine may move directly from one
+* {@link LifecycleStatus} to another — the legal-transition guard.
 *
 * @remarks
 * Reads the {@link import('./constants.js').TASK_TRANSITIONS} graph: `true` only when
@@ -471,13 +758,14 @@ function deriveBoundary(statuses) {
 *
 * @param from - The task's current status
 * @param to - The status the transition would move it to
-* @returns `true` when the move is legal
+* @returns True if the move is legal; false otherwise
 */
 function canTransitionTask(from, to) {
 	return TASK_TRANSITIONS[from].includes(to);
 }
 /**
-* Resolve a task's runtime silence window against its workflow default.
+* Resolves a task's runtime silence window against its workflow default, to a host-safe
+* `1..MAX_TIMER_MS` window or to `undefined` where the task disables it.
 *
 * @param value - The task-level override; any present non-positive or non-finite value disables
 * @param fallback - The workflow-level default
@@ -488,7 +776,7 @@ function resolveTaskSilence(value, fallback) {
 	return fallback !== void 0 && Number.isFinite(fallback) && fallback > 0 && fallback <= 2147483647 ? fallback : void 0;
 }
 /**
-* Box a value as a {@link Success} — the graceful outcome half of a {@link Result}.
+* Boxes a value as a {@link Success} — the graceful outcome half of a {@link Result}.
 *
 * @typeParam T - The boxed value's type
 * @param value - The value to box
@@ -506,7 +794,7 @@ function success(value) {
 	};
 }
 /**
-* Box an error as a {@link Failure} — the graceful outcome half of a {@link Result}.
+* Boxes an error as a {@link Failure} — the graceful outcome half of a {@link Result}.
 *
 * @typeParam E - The boxed error's type
 * @param error - The error to box
@@ -524,7 +812,7 @@ function failure(error) {
 	};
 }
 /**
-* Normalize an unknown thrown value to a non-empty persistence-safe message.
+* Normalizes an unknown thrown value to a non-empty persistence-safe message.
 *
 * @param error - The caught value
 * @returns A non-empty message without stack or cause data
@@ -538,16 +826,16 @@ function errorToMessage(error) {
 	}
 }
 /**
-* Find the first {@link TaskResult} in a positional list whose boxed outcome is a
+* Finds the first {@link TaskResult} in a positional list whose boxed outcome is a
 * `Failure` — the pure scan shared by a phase's and a workflow's derived-`failed`
 * `fail`-event lookup.
 *
 * @remarks
 * The shared leaf behind {@link import('./phases/Phase.js').Phase} and
-* {@link import('./Workflow.js').Workflow}'s own `#failure` — each gathers ITS tier's
+* {@link import('./Workflow.js').Workflow}'s own `#failure` — each gathers its tier's
 * results (a phase's own settled tasks, a workflow's flattened `results()`) and feeds
-* them here; the tier-local method keeps the §12 invariant throw (a derived `failed`
-* status guarantees a failing result exists) since throwing on `undefined` is
+* them here; the tier-local method keeps the invariant throw (a derived `failed`
+* status means a failing result exists) because throwing on `undefined` is
 * orchestration, not a leaf concern.
 *
 * @param results - The results to scan, in any order
@@ -562,7 +850,7 @@ function findFailure(results) {
 	return results.find((result) => result.result?.success === false);
 }
 /**
-* Build a {@link WorkflowContext} — the identity every level inherits — from a node's
+* Builds a {@link WorkflowContext} — the identity every level inherits — from a node's
 * `id` / `name` / optional `description`.
 *
 * @remarks
@@ -581,10 +869,10 @@ function buildWorkflowContext(node) {
 	});
 }
 /**
-* Build a {@link PhaseContext} — a phase's own identity plus a back-reference to its
+* Builds a {@link PhaseContext} — a phase's own identity plus a back-reference to its
 * workflow — from the parent {@link WorkflowContext} and the phase node's identity.
 *
-* @param workflow - The parent workflow context (the lineage pointer UP the tree)
+* @param workflow - The parent workflow context (the lineage pointer up the tree)
 * @param node - The phase's identity (`id` / `name` / optional `description`)
 * @returns The {@link PhaseContext}
 */
@@ -595,11 +883,11 @@ function buildPhaseContext(workflow, node) {
 	});
 }
 /**
-* Build a {@link TaskContext} — a task's own identity plus a back-reference to its phase
+* Builds a {@link TaskContext} — a task's own identity plus a back-reference to its phase
 * (and, transitively, its workflow) — from the parent {@link PhaseContext} and the task
 * node's identity.
 *
-* @param phase - The parent phase context (carrying the full lineage UP the tree)
+* @param phase - The parent phase context (carrying the full lineage up the tree)
 * @param node - The task's identity (`id` / `name` / optional `description`)
 * @returns The {@link TaskContext}
 */
@@ -610,31 +898,31 @@ function buildTaskContext(phase, node) {
 	});
 }
 /**
-* Convert a {@link WorkflowDefinition} into an INITIAL {@link WorkflowSnapshot} — every
-* node `pending`, no results, empty metadata — so the live W-b tree has ONE construction
-* path (snapshot-driven) for both a fresh build and a restore.
+* Converts a {@link WorkflowDefinition} into an initial {@link WorkflowSnapshot} — every
+* node `pending`, no results, empty metadata — so the live W-b tree has one construction
+* path, snapshot-driven, for a fresh build and for a restore alike.
 *
 * @remarks
 * The structural fields (`id` / `name` / `description` + the ordered phases / tasks)
 * carry over verbatim, as does each phase's `concurrency` (persisted on the
-* {@link PhaseSnapshot} so a restore reinstates the same throttle) and each task's `run` /
+* {@link PhaseSnapshot} so a restore reinstates the same throttle) and each task's `behavior` /
 * `retries` / `timeout` (persisted on the {@link TaskSnapshot}, like `bail` / `concurrency`,
 * so a restore + a {@link import('./types.js').WorkflowOptions.functions} registry resumes
 * real work). The `bail` policy carries over — at the
-* workflow tier AND, per phase, the
-* EFFECTIVE policy (`phase.bail ?? workflowBail`) on each {@link PhaseSnapshot} — so the seeded
-* snapshot is self-contained; a fresh seed has no `override`. `created` / `updated` are stamped now.
+* workflow tier and, per phase, the
+* effective policy (`phase.bail ?? workflowBail`) on each {@link PhaseSnapshot} — so the seeded
+* snapshot is self-contained; a fresh seed has no `override`. `created` / `updated` are stamped at that point.
 * {@link import('./factories.js').createWorkflow} builds from this.
 *
-* The optional `bail` override is the EFFECTIVE workflow policy the tree will run under
+* The optional `bail` override is the effective workflow policy the tree will run under
 * (`createWorkflow` / the runner resolve `options.bail ?? definition.bail ?? DEFAULT_BAIL` and
-* pass it here), so an `options.bail` override reaches BOTH the workflow tier AND the
+* pass it here), so an `options.bail` override reaches both the workflow tier and the
 * inheritance default of every phase that declares no `bail` of its own — otherwise the
 * per-phase seeds would silently ignore the override. Omitted ⇒ the definition's own `bail`
 * (defaulting to the graceful {@link import('./constants.js').DEFAULT_BAIL}).
 *
 * @param definition - The workflow definition to seed from
-* @param bail - The EFFECTIVE workflow bail to seed both tiers with (defaults to the definition's)
+* @param bail - The effective workflow bail to seed both tiers with (defaults to the definition's)
 * @returns An initial, all-`pending` {@link WorkflowSnapshot}
 */
 function definitionToSnapshot(definition, bail) {
@@ -652,11 +940,11 @@ function definitionToSnapshot(definition, bail) {
 	};
 }
 /**
-* Convert one {@link import('./types.js').PhaseDefinition} into an initial, all-`pending`
+* Converts one {@link import('./types.js').PhaseDefinition} into an initial, all-`pending`
 * {@link PhaseSnapshot} — the per-phase step of {@link definitionToSnapshot}.
 *
 * @remarks
-* The snapshot persists the EFFECTIVE failure policy this phase runs under: the phase's own
+* The snapshot persists the effective failure policy this phase runs under: the phase's own
 * `bail` when it declares one, else the `workflowBail` it inherits — so a restore reinstates
 * the same per-phase policy without a silent default (`effectiveBail = phase.bail ?? workflowBail`).
 * `concurrency` (the resource throttle) carries over verbatim, omitted when undefined.
@@ -677,14 +965,14 @@ function phaseDefinitionToSnapshot(phase, workflowBail) {
 	};
 }
 /**
-* Convert one {@link import('./types.js').TaskDefinition} into an initial, `pending`
+* Converts one {@link import('./types.js').TaskDefinition} into an initial, `pending`
 * {@link TaskSnapshot} — the per-task leaf step of {@link definitionToSnapshot} (no
 * result yet, empty metadata).
 *
 * @remarks
-* `run` / `retries` / `timeout` carry over verbatim (persisted declarative config, like a
+* `behavior` / `retries` / `timeout` carry over verbatim (persisted declarative config, like a
 * phase's `bail` / `concurrency`) — a restore reinstates the same behavior reference and
-* reliability overrides once paired with a {@link import('./types.js').WorkflowOptions.functions}
+* reliability overrides after pairing with a {@link import('./types.js').WorkflowOptions.functions}
 * registry.
 *
 * @param task - The task definition to seed from
@@ -698,13 +986,13 @@ function taskDefinitionToSnapshot(task) {
 		status: "pending",
 		metadata: {},
 		attempts: 0,
-		...task.run === void 0 ? {} : { run: task.run },
+		...task.behavior === void 0 ? {} : { behavior: task.behavior },
 		...task.retries === void 0 ? {} : { retries: task.retries },
 		...task.timeout === void 0 ? {} : { timeout: task.timeout }
 	};
 }
 /**
-* Convert interrupted running work into a recoverable pending suffix or an
+* Converts interrupted running work into a recoverable pending suffix or an
 * exhausted recovery failure without replenishing attempts.
 *
 * @param snapshot - A fully validated owned snapshot with no terminal overrides
@@ -781,11 +1069,58 @@ function recoverWorkflowSnapshot(snapshot) {
 		updated: now
 	};
 }
-/** Compare two optional description values. */
+/**
+* Compares two optional description values.
+*
+* @remarks
+* The equality rule a lineage check needs: two descriptions match when they are the same value
+* and that value is either a string or genuine absence. Anything else — a number, an object, a
+* `null` — never matches, even against itself, so a lineage stamped with a non-string description
+* is rejected rather than silently accepted.
+*
+* @param left - The first description value
+* @param right - The second description value
+* @returns True if both are the same string or both absent; false otherwise
+*
+* @example
+* ```ts
+* matchesDescription('build', 'build') // true
+* matchesDescription(undefined, undefined) // true
+* matchesDescription('build', undefined) // false
+* ```
+*/
 function matchesDescription(left, right) {
 	return left === right && (left === void 0 || typeof left === "string");
 }
-/** Test a result's lineage against its containing snapshot nodes. */
+/**
+* Tests a result's lineage against its containing snapshot nodes.
+*
+* @remarks
+* The four arguments are the result and the three snapshot nodes it claims to belong to, read
+* from the outside in: a {@link TaskResult} is self-describing, so restoring one is only safe
+* when every identity it carries agrees with the tree it was found in. It checks the exact key
+* set at each level, that `status` equals the owning task's, and that the `task` / `phase` /
+* `workflow` contexts — including the nested `task.phase.workflow` lineage — carry the same `id`,
+* `name`, and `description` as the nodes containing them. It then requires the boxed outcome to
+* match the status: a `Success` holding JSON for `completed`, a `Failure` holding a
+* {@link TaskFailure} for `failed`, and nothing for any other status. Total — a hostile
+* prototype, accessor, or cycle answers `false` rather than throwing.
+*
+* @param value - The candidate {@link TaskResult}
+* @param workflow - The workflow snapshot node containing it
+* @param phase - The phase snapshot node containing it
+* @param task - The task snapshot node the result belongs to
+* @returns True if `value` is a {@link TaskResult} whose lineage and outcome match
+*   those nodes; false otherwise
+*
+* @example
+* ```ts
+* const snapshot = workflow.snapshot()
+* const phase = snapshot.phases[0]
+* const task = phase?.tasks[0]
+* isTaskResult(task?.result, snapshot, phase, task) // true for a settled task
+* ```
+*/
 function isTaskResult(value, workflow, phase, task) {
 	try {
 		if (!(0, _orkestrel_contract.isRecord)(value) || !(0, _orkestrel_contract.isRecord)(workflow) || !(0, _orkestrel_contract.isRecord)(phase) || !(0, _orkestrel_contract.isRecord)(task) || !Object.keys(value).every((key) => key === "task" || key === "phase" || key === "workflow" || key === "status" || key === "result" || key === "timestamp") || !isLifecycleStatus(value.status) || value.status !== task.status || !(0, _orkestrel_contract.isFiniteNumber)(value.timestamp) || value.timestamp < 0 || !(0, _orkestrel_contract.isRecord)(value.task) || !(0, _orkestrel_contract.isRecord)(value.phase) || !(0, _orkestrel_contract.isRecord)(value.workflow) || !Object.keys(value.workflow).every((key) => key === "id" || key === "name" || key === "description") || !Object.keys(value.phase).every((key) => key === "id" || key === "name" || key === "description" || key === "workflow") || !Object.keys(value.task).every((key) => key === "id" || key === "name" || key === "description" || key === "phase")) return false;
@@ -801,19 +1136,30 @@ function isTaskResult(value, workflow, phase, task) {
 }
 function hasWorkflowHandlers(workflow, functions) {
 	if ("destroyed" in workflow) {
-		for (const phase of workflow.phases.phases()) for (const task of phase.tasks.tasks()) if (task.run !== void 0 && !(0, _orkestrel_contract.isFunction)(task.handler)) return false;
+		for (const phase of workflow.phases.phases()) for (const task of phase.tasks.tasks()) if (task.behavior !== void 0 && !(0, _orkestrel_contract.isFunction)(task.handler)) return false;
 		return true;
 	}
-	const runs = /* @__PURE__ */ new Set();
+	const behaviors = /* @__PURE__ */ new Set();
 	for (const phase of workflow.phases) for (const task of phase.tasks) {
-		if (task.run === void 0 || runs.has(task.run)) continue;
-		runs.add(task.run);
-		if (!(0, _orkestrel_contract.isFunction)(functions?.[task.run])) return false;
+		if (task.behavior === void 0 || behaviors.has(task.behavior)) continue;
+		behaviors.add(task.behavior);
+		if (!(0, _orkestrel_contract.isFunction)(functions?.[task.behavior])) return false;
 	}
 	return true;
 }
-/** Locate the nearest identifiable node for an inconsistent owned snapshot. */
-function workflowSnapshotContext(value) {
+/**
+* Locates the nearest identifiable node for an inconsistent owned snapshot.
+*
+* @remarks
+* The walk stops at the first phase or task whose persisted fields are inconsistent and returns
+* the identifiers it could read there, so a diagnostic can name the offending node even when part
+* of its identity is unreadable.
+*
+* @param value - The candidate snapshot, which may be any unknown value
+* @returns The nearest identifying record naming the offending `phase` and `task`, or `undefined`
+* when no inconsistent node is identifiable
+*/
+function scanSnapshotContext(value) {
 	if (!(0, _orkestrel_contract.isRecord)(value) || !(0, _orkestrel_contract.isArray)(value.phases)) return void 0;
 	for (const phase of value.phases) {
 		if (!(0, _orkestrel_contract.isRecord)(phase)) continue;
@@ -821,7 +1167,7 @@ function workflowSnapshotContext(value) {
 		if (!(0, _orkestrel_contract.isBoolean)(phase.bail) || phase.concurrency !== void 0 && (!(0, _orkestrel_contract.isInteger)(phase.concurrency) || phase.concurrency < 1) || !(0, _orkestrel_contract.isArray)(phase.tasks)) return phaseContext;
 		for (const task of phase.tasks) {
 			if (!(0, _orkestrel_contract.isRecord)(task)) continue;
-			if (task.run !== void 0 && !(0, _orkestrel_contract.isNonEmptyString)(task.run) || task.retries !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.timeout) || task.timeout < 0 || task.timeout > 2147483647) || !(0, _orkestrel_contract.isInteger)(task.attempts) || task.attempts < 0) return {
+			if (task.behavior !== void 0 && !(0, _orkestrel_contract.isNonEmptyString)(task.behavior) || task.retries !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!(0, _orkestrel_contract.isInteger)(task.timeout) || task.timeout < 0 || task.timeout > 2147483647) || !(0, _orkestrel_contract.isInteger)(task.attempts) || task.attempts < 0) return {
 				...phaseContext ?? {},
 				...(0, _orkestrel_contract.isNonEmptyString)(task.id) ? { task: task.id } : {}
 			};
@@ -829,7 +1175,7 @@ function workflowSnapshotContext(value) {
 	}
 }
 /**
-* Flatten a nested list of per-phase {@link TaskResult} lists into one positional list
+* Flattens a nested list of per-phase {@link TaskResult} lists into one positional list
 * — the workflow tier of the result tree, built from each phase's `results()`.
 *
 * @remarks
@@ -844,16 +1190,15 @@ function collectResults(phases) {
 	return phases.flat();
 }
 /**
-* Insert one `[key, value]` entry at a positional index into a readonly entries array —
+* Inserts one `[key, value]` entry at a positional index into a readonly entries array —
 * the pure splice-in step behind an insertion-ordered registry's `add`.
 *
 * @remarks
-* Shared by {@link import('./tasks/TaskManager.js').TaskManager} and
-* {@link import('./phases/PhaseManager.js').PhaseManager}: both convert their
-* insertion-ordered `Map` to `[...map.entries()]`, call this to splice the new entry
-* in at the target index, then rebuild the `Map` from the result (a stateful step that
-* stays a `#` private method — this helper does no `Map` construction). Does not
-* mutate `entries`; returns a new array.
+* Used by the shared {@link import('./Collection.js').Collection} store both managers hold: it
+* converts its insertion-ordered `Map` to `[...map.entries()]`, calls this to splice the new entry
+* in at the target index, then rebuilds the `Map` from the result (a stateful step that stays a
+* `#` private method — this helper does no `Map` construction). Does not mutate `entries`;
+* returns a new array.
 *
 * @typeParam T - The entry's value type
 * @param entries - The current positional entries, in order
@@ -873,16 +1218,17 @@ function insertEntry(entries, index, key, value) {
 	return next;
 }
 /**
-* Reposition the entry keyed `key` to a new positional index in a readonly entries
+* Repositions the entry keyed `key` to a new positional index in a readonly entries
 * array — the pure remove-then-reinsert step behind an insertion-ordered registry's
 * `move`.
 *
 * @remarks
 * The move counterpart of {@link insertEntry}: finds the entry by `key`, splices it
 * out, then splices it back in at `index`. An absent `key` is a no-op (returns a copy
-* of `entries` unchanged) — the caller (`TaskManager.move` / `PhaseManager.move`)
-* already gates on the target's existence before calling this, so the no-op branch is
-* defensive, never reached in practice. Does not mutate `entries`; returns a new array.
+* of `entries` unchanged) — the caller, the shared
+* {@link import('./Collection.js').Collection} store's `move`, already gates on the target's
+* existence before calling this, so the no-op branch is defensive, never reached in practice.
+* Does not mutate `entries`; returns a new array.
 *
 * @typeParam T - The entry's value type
 * @param entries - The current positional entries, in order
@@ -904,17 +1250,7 @@ function moveEntry(entries, key, index) {
 	return next;
 }
 /**
-* Create a {@link DeferredInterface} — a promise whose settlement is driven
-* externally, so a caller can resolve/reject it from outside the executor.
-*
-* @typeParam T - The value the deferred promise resolves
-* @returns A deferred `promise` plus its `resolve` / `reject`
-*/
-function createDeferred() {
-	return Promise.withResolvers();
-}
-/**
-* Schedule one cancellable host operation behind an owned settlement signal.
+* Schedules one cancellable host operation behind an owned settlement signal.
 *
 * @remarks
 * A defined `signal` that is not a native `AbortSignal` is refused before anything is armed, as a
@@ -981,17 +1317,46 @@ function scheduleHost(start, signal) {
 	});
 }
 /**
-* Park until `signal` aborts — a promise-parked wait (AGENTS §21), never a timer or
-* busy-loop, that NEVER rejects.
+* Schedules the shared host timer boundary every scheduler backend resumes from.
 *
 * @remarks
-* Resolves IMMEDIATELY when `signal` is already aborted; otherwise attaches a one-shot
+* The one `setTimeout` / `clearTimeout` boundary in the package: the cross-environment
+* {@link import('./Scheduler.js').Scheduler}, both Node primitives, and every browser backend's
+* `delay` and macrotask fallback route here, so the timer is armed and cleared in one place. It
+* composes {@link scheduleHost}, which owns listener safety, the cancellation race, the exact
+* caller reason, and once-only settlement. It does not validate `ms`: the value passes straight to
+* the host `setTimeout`, which clamps a negative value or `NaN` to about zero, so an
+* out-of-domain `ms` resumes on the next host turn rather than throwing. Pass a non-negative
+* finite `ms`.
+*
+* @param ms - The milliseconds to wait before resuming
+* @param signal - Optional caller cancellation signal
+* @returns A promise that resolves after `ms`, or rejects with the caller's exact abort reason
+*
+* @example
+* ```ts
+* const controller = new AbortController()
+* await delayHost(0, controller.signal) // a real macrotask host turn
+* ```
+*/
+function delayHost(ms, signal) {
+	return scheduleHost((complete) => {
+		const handle = setTimeout(complete, ms);
+		return () => clearTimeout(handle);
+	}, signal);
+}
+/**
+* Parks until `signal` aborts — a promise-parked wait, never a timer or
+* busy-loop, that resolves on the abort event and never rejects.
+*
+* @remarks
+* Resolves immediately when `signal` is already aborted; otherwise attaches a one-shot
 * `abort` listener and resolves when it fires, removing the listener either way. The
 * shared leaf behind the duplicate abort-wiring an execution engine otherwise hand-rolls
 * at every fold point.
 *
 * @param signal - The signal to park on
-* @returns A promise that resolves once `signal` has aborted
+* @returns A promise that resolves after `signal` has aborted
 *
 * @example
 * ```ts
@@ -1008,25 +1373,125 @@ function parkSignal(signal) {
 	});
 }
 //#endregion
+//#region src/core/Collection.ts
+/**
+* Implements the insertion-ordered gated store both lean managers hold — entities keyed by `id`,
+* positional order preserved across an interior `skip` or `remove`.
+*
+* @remarks
+* - **One engine, two managers.** {@link import('./tasks/TaskManager.js').TaskManager} and
+*   {@link import('./phases/PhaseManager.js').PhaseManager} differ only in the entity noun and the
+*   patch shape they validate, so both hold one of these and add only their domain accessors
+*   (`task` / `tasks`, `phase` / `phases`). The `Map`'s insertion order is the single source of
+*   positional truth; `add` and `move` rebuild it through the pure
+*   {@link import('./helpers.js').insertEntry} / {@link import('./helpers.js').moveEntry} leaves.
+* - **Gated mutation API.** `append` is the build-time wiring path and throws on a
+*   duplicate id; `add` / `remove` / `move` / `update` return a graceful `MUTATION`
+*   {@link WorkflowError} failure instead. Gating reads only the target's own existence, `pending`
+*   status, id, and bounds — a container's own status is the owning entity's gate, applied before
+*   it delegates here.
+* - **Event-free.** A purely structural container; the entity that owns it emits on success.
+*
+* @typeParam TEntry - The stored entity
+* @typeParam TPatch - The declarative partial update `update` validates and applies
+*
+* @example
+* ```ts
+* import { compileGuard } from '@orkestrel/contract'
+* import { Collection, taskUpdateShape } from '@orkestrel/workflow'
+* import type { TaskInterface, TaskUpdate } from '@orkestrel/workflow'
+*
+* const tasks = new Collection<TaskInterface, TaskUpdate>('task', compileGuard(taskUpdateShape))
+* tasks.append(task) // a live Task
+* tasks.entry(task.id) // the same task
+* tasks.entries() // [task]
+* tasks.count // 1
+* tasks.add(other, 0) // Result — inserted first
+* tasks.move(other.id, 1) // Result — repositioned
+* tasks.update(task.id, { name: 'Renamed task' }) // Result — patched
+* tasks.remove(other.id) // Result — dropped
+* ```
+*/
+var Collection = class {
+	#entries = /* @__PURE__ */ new Map();
+	#noun;
+	#isPatch;
+	constructor(noun, patch) {
+		this.#noun = noun;
+		this.#isPatch = patch;
+	}
+	get count() {
+		return this.#entries.size;
+	}
+	append(entry) {
+		if (this.#entries.has(entry.id)) throw new WorkflowError("MUTATION", `duplicate ${this.#noun} id '${entry.id}'`, { id: entry.id });
+		this.#entries.set(entry.id, entry);
+	}
+	add(entry, index) {
+		if (this.#entries.has(entry.id)) return failure(new WorkflowError("MUTATION", `duplicate ${this.#noun} id '${entry.id}'`, { id: entry.id }));
+		const at = index ?? this.#entries.size;
+		if (at < 0 || at > this.#entries.size) return failure(new WorkflowError("MUTATION", `index '${at}' out of bounds`, { index: at }));
+		this.#reorder(insertEntry([...this.#entries.entries()], at, entry.id, entry));
+		return success(entry);
+	}
+	remove(id) {
+		const target = this.#pending(id);
+		if (target === void 0) return this.#refuse(id);
+		this.#entries.delete(id);
+		return success(target);
+	}
+	move(id, index) {
+		const target = this.#pending(id);
+		if (target === void 0) return this.#refuse(id);
+		if (index < 0 || index >= this.#entries.size) return failure(new WorkflowError("MUTATION", `index '${index}' out of bounds`, { index }));
+		this.#reorder(moveEntry([...this.#entries.entries()], id, index));
+		return success(target);
+	}
+	update(id, patch) {
+		const target = this.#pending(id);
+		if (target === void 0) return this.#refuse(id);
+		if (!this.#isPatch(patch)) return failure(new WorkflowError("MUTATION", `invalid patch for ${this.#noun} '${id}'`, { id }));
+		target.patch(patch);
+		return success(target);
+	}
+	entry(id) {
+		return this.#entries.get(id);
+	}
+	entries() {
+		return [...this.#entries.values()];
+	}
+	#pending(id) {
+		const target = this.#entries.get(id);
+		return target === void 0 || target.status !== "pending" ? void 0 : target;
+	}
+	#refuse(id) {
+		return failure(new WorkflowError("MUTATION", `${this.#noun} '${id}' is not a pending ${this.#noun}`, { id }));
+	}
+	#reorder(entries) {
+		this.#entries.clear();
+		for (const [key, value] of entries) this.#entries.set(key, value);
+	}
+};
+//#endregion
 //#region src/core/Scheduler.ts
 /**
-* The safe cross-environment cooperative-yield default — a {@link SchedulerInterface}
+* Implements the safe cross-environment cooperative-yield default — a {@link SchedulerInterface}
 * built on `setTimeout` / `clearTimeout` alone, so it runs unchanged in both the
 * browser and Node.
 *
 * @remarks
-* - **Cross-environment.** Uses ONLY `setTimeout` / `clearTimeout` — universally
+* - **Cross-environment.** Uses only `setTimeout` / `clearTimeout` — universally
 *   available. It deliberately avoids env-specific fast paths (`setImmediate`,
 *   `scheduler.yield`, `requestAnimationFrame`, `node:timers/promises`,
 *   `MessageChannel`); those belong to the environment backends, built with the
 *   agent loop that consumes them.
 * - **`yield` is a macrotask host-turn, not a microtask.** `yield()` waits on a
-*   `setTimeout(0)`, NOT `queueMicrotask`. A microtask drains before the host
+*   `setTimeout(0)`, not `queueMicrotask`. A microtask drains before the host
 *   regains control, so it would not actually let pending I/O, timers, or
 *   rendering run — it only defers within the current task. A zero-delay timer is
 *   the correct cross-environment "give the host a turn".
 * - **Abort-aware.** A pending `yield` / `delay` rejects with `signal.reason` exactly.
-*   {@link scheduleHost} links an owned settlement composite to the caller before arming
+*   {@link delayHost} links an owned settlement composite to the caller before arming
 *   the timer, so pre-abort schedules nothing, caller signal method mutation is harmless,
 *   cancellation clears the handle, and native first-settlement wins exactly once.
 * - **Priority is accepted but uniform.** `options.priority` is part of the
@@ -1045,36 +1510,30 @@ function parkSignal(signal) {
 */
 var Scheduler = class {
 	/**
-	* Yield control back to the host so other tasks (I/O, timers, rendering) can
-	* run, then resume — a macrotask turn via `setTimeout(0)` (NOT a microtask,
+	* Yields control back to the host so other tasks (I/O, timers, rendering) can
+	* run, then resumes — a macrotask turn through `setTimeout(0)` (not a microtask,
 	* which would resume before the host regains control).
 	*/
 	yield(options) {
-		return this.#sleep(0, options?.signal);
+		return delayHost(0, options?.signal);
 	}
 	/**
-	* Resume after at least `ms` milliseconds; abort rejects with `signal.reason`.
+	* Resumes after at least `ms` milliseconds; abort rejects with `signal.reason`.
 	*
 	* @remarks
-	* `ms` should be a non-negative finite number. The primitive stays minimal and
-	* does no validation: it passes `ms` straight to the host `setTimeout`, which
-	* clamps a negative value or `NaN` to ~0 — so an out-of-domain `ms` resolves on
-	* the next host turn rather than throwing.
+	* Pass a non-negative finite `ms`. The primitive stays minimal and does no
+	* validation: it passes `ms` straight to the host `setTimeout`, which clamps a
+	* negative value or `NaN` to ~0 — so an out-of-domain `ms` resolves on the next
+	* host turn rather than throwing.
 	*/
 	delay(ms, options) {
-		return this.#sleep(ms, options?.signal);
-	}
-	#sleep(ms, signal) {
-		return scheduleHost((complete) => {
-			const handle = setTimeout(complete, ms);
-			return () => clearTimeout(handle);
-		}, signal);
+		return delayHost(ms, options?.signal);
 	}
 };
 //#endregion
 //#region src/core/cloners.ts
 /**
-* Validate and own a workflow snapshot before live construction.
+* Validates and owns a workflow snapshot before live construction.
 *
 * @param input - The hostile snapshot boundary
 * @param id - The optional storage key the owned snapshot must match
@@ -1090,7 +1549,7 @@ function cloneWorkflowSnapshot(input, id) {
 		if ((0, _orkestrel_contract.isContractError)(error)) throw new WorkflowError("RESTORE", `workflow snapshot could not be read safely: ${error.message}`);
 		throw new WorkflowError("RESTORE", "workflow snapshot could not be read safely");
 	}
-	if (!isOwnedWorkflowSnapshot(cloned)) throw new WorkflowError("RESTORE", "workflow snapshot is inconsistent", workflowSnapshotContext(cloned));
+	if (!isOwnedWorkflowSnapshot(cloned)) throw new WorkflowError("RESTORE", "workflow snapshot is inconsistent", scanSnapshotContext(cloned));
 	if (id !== void 0 && cloned.id !== id) throw new WorkflowError("RESTORE", `workflow snapshot '${cloned.id}' does not match storage key '${id}'`, {
 		requested: id,
 		payload: cloned.id
@@ -1098,7 +1557,49 @@ function cloneWorkflowSnapshot(input, id) {
 	return cloned;
 }
 /**
-* Validate and clone one complete task activity frame.
+* Validates and owns one list of task activity claims.
+*
+* @remarks
+* The one cloner behind both claim lists of a task activity frame — its `operations` and its
+* `constraints` — because {@link import('./types.js').TaskOperation} and
+* {@link import('./types.js').TaskConstraint} are the same {@link import('./types.js').TaskClaim}
+* shape. An omitted
+* list is an empty one. Each member is read exactly once inside the caller's protected boundary
+* and returned frozen; the semantic pass over the copied values is
+* {@link import('./validators.js').isTaskClaimList}, so this cloner refuses only what it cannot
+* read: a non-array list, a non-record member, a hostile prototype, or an unexpected key.
+*
+* @param input - The untrusted claim list
+* @param noun - The singular claim noun the refusal message names, pluralized by adding `s`
+* @returns The owned frozen claims, in input order
+* @throws {WorkflowError} With `MUTATION` when the list or one of its members cannot be read
+*
+* @example
+* ```ts
+* cloneTaskClaims([{ id: 'fetch', name: 'Fetch', started: 1 }], 'operation')
+* ```
+*/
+function cloneTaskClaims(input, noun) {
+	const inputs = input === void 0 ? [] : (0, _orkestrel_contract.isArray)(input) ? [...input] : void 0;
+	if (inputs === void 0) throw new WorkflowError("MUTATION", `task activity ${noun}s must be an array`);
+	const claims = [];
+	for (const claim of inputs) {
+		if (!(0, _orkestrel_contract.isRecord)(claim)) throw new WorkflowError("MUTATION", `task activity contains an invalid ${noun}`);
+		const prototype = Object.getPrototypeOf(claim);
+		if (prototype !== Object.prototype && prototype !== null || !Object.keys(claim).every((key) => key === "id" || key === "name" || key === "started")) throw new WorkflowError("MUTATION", `task activity contains an invalid ${noun}`);
+		const id = claim.id;
+		const name = claim.name;
+		const started = claim.started;
+		claims.push(Object.freeze({
+			id,
+			name,
+			started
+		}));
+	}
+	return claims;
+}
+/**
+* Validates and clones one complete task activity frame.
 *
 * @remarks
 * This is the hostile boundary behind task reports and snapshot hydration. Supplying
@@ -1122,22 +1623,7 @@ function cloneTaskActivity(input, updated) {
 		const operationsInput = input.operations;
 		const constraintsInput = input.constraints;
 		const accepted = updated === void 0 ? input.updated : updated;
-		const operationInputs = operationsInput === void 0 ? [] : (0, _orkestrel_contract.isArray)(operationsInput) ? [...operationsInput] : void 0;
-		if (operationInputs === void 0) throw new WorkflowError("MUTATION", "task activity operations must be an array");
-		const operations = [];
-		for (const operation of operationInputs) {
-			if (!(0, _orkestrel_contract.isRecord)(operation)) throw new WorkflowError("MUTATION", "task activity contains an invalid operation");
-			const operationPrototype = Object.getPrototypeOf(operation);
-			if (operationPrototype !== Object.prototype && operationPrototype !== null || !Object.keys(operation).every((key) => key === "id" || key === "name" || key === "started")) throw new WorkflowError("MUTATION", "task activity contains an invalid operation");
-			const id = operation.id;
-			const name = operation.name;
-			const started = operation.started;
-			operations.push(Object.freeze({
-				id,
-				name,
-				started
-			}));
-		}
+		const operations = cloneTaskClaims(operationsInput, "operation");
 		let progress;
 		if (progressInput !== void 0) {
 			if (!(0, _orkestrel_contract.isRecord)(progressInput)) throw new WorkflowError("MUTATION", "task activity contains invalid progress");
@@ -1152,22 +1638,7 @@ function cloneTaskActivity(input, updated) {
 				...message === void 0 ? {} : { message }
 			});
 		}
-		const constraintInputs = constraintsInput === void 0 ? [] : (0, _orkestrel_contract.isArray)(constraintsInput) ? [...constraintsInput] : void 0;
-		if (constraintInputs === void 0) throw new WorkflowError("MUTATION", "task activity constraints must be an array");
-		const constraints = [];
-		for (const constraint of constraintInputs) {
-			if (!(0, _orkestrel_contract.isRecord)(constraint)) throw new WorkflowError("MUTATION", "task activity contains an invalid constraint");
-			const constraintPrototype = Object.getPrototypeOf(constraint);
-			if (constraintPrototype !== Object.prototype && constraintPrototype !== null || !Object.keys(constraint).every((key) => key === "id" || key === "name" || key === "started")) throw new WorkflowError("MUTATION", "task activity contains an invalid constraint");
-			const id = constraint.id;
-			const name = constraint.name;
-			const started = constraint.started;
-			constraints.push(Object.freeze({
-				id,
-				name,
-				started
-			}));
-		}
+		const constraints = cloneTaskClaims(constraintsInput, "constraint");
 		const activity = Object.freeze({
 			...note === void 0 ? {} : { note },
 			...progress === void 0 ? {} : { progress },
@@ -1185,8 +1656,8 @@ function cloneTaskActivity(input, updated) {
 //#endregion
 //#region src/core/shapers.ts
 /**
-* The shape of a {@link import('./types.js').TaskDefinition} — identity plus an optional
-* `run` behavior reference (a plain registry-key string, min length 1). `description` is
+* Describes the shape of a {@link import('./types.js').TaskDefinition} — identity plus an optional
+* `behavior` behavior reference (a plain registry-key string, min length 1). `description` is
 * optional prose.
 */
 var taskShape = (0, _orkestrel_contract.objectShape)({
@@ -1199,7 +1670,7 @@ var taskShape = (0, _orkestrel_contract.objectShape)({
 		description: "Human-readable task name."
 	}),
 	description: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.stringShape)({ description: "Optional task description." })),
-	run: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.stringShape)({
+	behavior: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.stringShape)({
 		min: 1,
 		description: "The registered behavior name to invoke (a registry key, not a label); omitted has no handler."
 	})),
@@ -1214,7 +1685,7 @@ var taskShape = (0, _orkestrel_contract.objectShape)({
 	}))
 });
 /**
-* The shape of a {@link import('./types.js').PhaseDefinition} — identity, its ordered
+* Describes the shape of a {@link import('./types.js').PhaseDefinition} — identity, its ordered
 * {@link taskShape} tasks, and an optional positive-integer `concurrency` throttle
 * (max tasks in flight; omitted ⇒ unbounded).
 */
@@ -1236,7 +1707,7 @@ var phaseShape = (0, _orkestrel_contract.objectShape)({
 	bail: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.literalShape)([true, false], { description: "Per-phase failure-policy override; omitted inherits the workflow bail." }))
 });
 /**
-* The shape of a {@link import('./types.js').WorkflowDefinition} — the contract root:
+* Describes the shape of a {@link import('./types.js').WorkflowDefinition} — the contract root:
 * identity, its ordered {@link phaseShape} phases, and the optional `bail` boolean
 * failure policy (the literal pair `true`/`false`, the runtime mirror of the boolean
 * toggle; omitted ⇒ the graceful default).
@@ -1255,13 +1726,13 @@ var workflowShape = (0, _orkestrel_contract.objectShape)({
 	bail: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.literalShape)([true, false], { description: "Failure policy: false (default) continues gracefully, true halts on the first failure." }))
 });
 /**
-* The shape of a {@link import('./types.js').TaskUpdate} — a partial edit to a
+* Describes the shape of a {@link import('./types.js').TaskUpdate} — a partial edit to a
 * `pending` task's `name` / `description`, both optional.
 *
 * @remarks
 * Mirrors {@link taskShape}'s `name` / `description` constraints exactly (a provided
-* `name` still has `minLength: 1`); never `id` / `run` / `retries` / `timeout` (those
-* are not patchable fields, AGENTS §12).
+* `name` still has `minLength: 1`); never `id` / `behavior` / `retries` / `timeout` (those
+* are not patchable fields).
 */
 var taskUpdateShape = (0, _orkestrel_contract.objectShape)({
 	name: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.stringShape)({
@@ -1271,13 +1742,13 @@ var taskUpdateShape = (0, _orkestrel_contract.objectShape)({
 	description: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.stringShape)({ description: "New task description." }))
 });
 /**
-* The shape of a {@link import('./types.js').PhaseUpdate} — a partial edit to a
+* Describes the shape of a {@link import('./types.js').PhaseUpdate} — a partial edit to a
 * `pending` phase's `name` / `description` / `concurrency` / `bail`, all optional.
 *
 * @remarks
 * Mirrors {@link phaseShape}'s corresponding field constraints exactly; never `id` /
 * `tasks` (structural children change through the phase's own `add` / `remove` /
-* `move`, not a patch, AGENTS §12).
+* `move`, not a patch).
 */
 var phaseUpdateShape = (0, _orkestrel_contract.objectShape)({
 	name: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.stringShape)({
@@ -1294,40 +1765,42 @@ var phaseUpdateShape = (0, _orkestrel_contract.objectShape)({
 //#endregion
 //#region src/core/stores/DatabaseWorkflowStore.ts
 /**
-* A {@link WorkflowStoreInterface} backed by one table of the `databases` layer — a
-* workflow's durable run-state IS a row, so persistence reduces to keyed point-access
+* Implements a {@link WorkflowStoreInterface} backed by one table of the `databases` layer — a
+* workflow's durable run state is a row, so persistence reduces to keyed point-access
 * (`get` / `set` / `delete`) over a `TableInterface`, the driver-pluggable twin of the
 * plain-`Map` {@link import('./MemoryWorkflowStore.js').MemoryWorkflowStore}.
 *
 * @remarks
 * The store is driver-agnostic: it holds a single {@link TableInterface} whose backend
 * (memory, JSON, SQLite, IndexedDB) is chosen by whoever builds it (the factories), so a
-* JSON / SQLite / IndexedDB backend swaps in WITHOUT touching the runner or the entity tree
+* JSON / SQLite / IndexedDB backend swaps in without touching the runner or the entity tree
 * — the same seam as `@orkestrel/queue`'s `DatabaseQueueStore`.
 * The driver defaults to memory ({@link import('../factories.js').createDatabaseWorkflowStore}
-* passes `createMemoryDriver()`), so it ALSO works in memory out of the box; you opt into the
+* passes `createMemoryDriver()`), so it also works in memory out of the box; you opt into the
 * durable plumbing by passing a JSON / SQLite / IndexedDB driver.
 *
-* The {@link WorkflowSnapshot} is stored as ONE OPAQUE JSON COLUMN — the table is a row of
+* The {@link WorkflowSnapshot} is stored as one opaque JSON column — the table is a row of
 * `{ id; snapshot }` ({@link WorkflowSnapshotRow}), the snapshot the whole JSON blob (a `rawShape`
 * column the factory builds) — exactly as `DatabaseQueueStore` stores its `input`. The snapshot is
-* already a COMPLETE, self-contained, pure-JSON payload, so storing it whole is lossless AND
+* already a complete, self-contained, pure-JSON payload, so storing it whole is lossless and
 * sidesteps a TS2589 instantiation-depth blow-up: a structured multi-column table would force the
 * contract to `Infer` the deeply-nested snapshot shape (workflow → phases → tasks → results),
 * tripping the compiler — one JSON column keeps the row type flat (`snapshot` reads back as `unknown`).
 *
-* - **`set(snapshot)` upserts under the snapshot's OWN `id`** (no separate id param) — it writes
+* - **`set(snapshot)` upserts under the snapshot's own `id`** (no separate id param) — it writes
 *   the row `{ id: snapshot.id, snapshot }`.
-* - **`get(id)` resolves the stored snapshot for an id**, narrowing the opaque JSON column back to
-*   a {@link WorkflowSnapshot} ({@link import('../helpers.js').isWorkflowSnapshot} — the AGENTS §14
-*   boundary narrow for an untrusted storage read), or `undefined` if none is stored. A present
-*   snapshot whose own id differs from the requested key rejects with normalized `RESTORE` evidence.
+* - **`get(id)` resolves the stored snapshot for an id**, owning and narrowing the opaque JSON
+*   column back to a {@link WorkflowSnapshot} through
+*   {@link import('../cloners.js').cloneWorkflowSnapshot}, whose semantic pass is
+*   {@link import('../validators.js').isOwnedWorkflowSnapshot} — the boundary narrow for
+*   an untrusted storage read — or `undefined` if none is stored. A present snapshot whose own id
+*   differs from the requested key rejects with normalized `RESTORE` evidence.
 * - **`delete(id)` drops a snapshot by id**; an absent id is a no-op (no throw).
 *
-* UNLIKE the server package's `SessionStoreInterface` there is NO
+* unlike the server package's `SessionStoreInterface` there is no
 * idle-TTL / eviction — a persisted run-state is durable orchestration state that lives until an
-* explicit `delete`. The public surface is EXACTLY `get` / `set` / `delete` — no extra members (the
-* §22 method bijection with {@link WorkflowStoreInterface}). Restore stays a caller concern: read a
+* explicit `delete`. The public surface is exactly `get` / `set` / `delete` — no extra members (the
+* guide's method bijection with {@link WorkflowStoreInterface}). Restore stays a caller concern: read a
 * snapshot back and rebuild the live tree with {@link import('../factories.js').createRestoredWorkflow}.
 *
 * @example
@@ -1346,7 +1819,7 @@ var phaseUpdateShape = (0, _orkestrel_contract.objectShape)({
 var DatabaseWorkflowStore = class {
 	#table;
 	/**
-	* Wrap a table as a workflow store.
+	* Wraps a table as a workflow store.
 	*
 	* @param table - The {@link TableInterface} holding the snapshots — its row is the
 	*   {@link WorkflowSnapshotRow} `{ id; snapshot }` shape (the snapshot one opaque JSON column)
@@ -1354,13 +1827,13 @@ var DatabaseWorkflowStore = class {
 	constructor(table) {
 		this.#table = table;
 	}
-	/** Resolve and key-check the snapshot for `id`, narrowing the opaque column to `WorkflowSnapshot`. */
+	/** Resolves and key-checks the snapshot for `id`, narrowing the opaque column to `WorkflowSnapshot`. */
 	async get(id) {
 		const row = await this.#table.get(id);
 		if (row === void 0) return void 0;
 		return cloneWorkflowSnapshot(row.snapshot, id);
 	}
-	/** Insert or replace under the snapshot's OWN `id` (no separate id param) — the row is `{ id, snapshot }`. */
+	/** Inserts or replaces under the snapshot's own `id` (no separate id param) — the row is `{ id, snapshot }`. */
 	async set(snapshot) {
 		const owned = cloneWorkflowSnapshot(snapshot);
 		await this.#table.set({
@@ -1368,7 +1841,7 @@ var DatabaseWorkflowStore = class {
 			snapshot: owned
 		});
 	}
-	/** Drop a snapshot by id; an absent id is a no-op (no throw). */
+	/** Drops a snapshot by id; an absent id is a no-op (no throw). */
 	async delete(id) {
 		await this.#table.remove(id);
 	}
@@ -1376,28 +1849,25 @@ var DatabaseWorkflowStore = class {
 //#endregion
 //#region src/core/stores/MemoryWorkflowStore.ts
 /**
-* The in-memory {@link WorkflowStoreInterface} — a process-lifetime `Map` of
-* {@link WorkflowSnapshot}s keyed by workflow id, the DEFAULT store
-* {@link import('../factories.js').createMemoryWorkflowStore} builds.
+* Implements the in-memory {@link WorkflowStoreInterface} — a process-lifetime `Map` of
+* {@link WorkflowSnapshot}s keyed by workflow id, the default store
+* {@link import('../factories.js').createMemoryWorkflowStore} builds. It expires nothing: a
+* persisted snapshot lives until an explicit `delete`.
 *
 * @remarks
-* A plain `Map<string, WorkflowSnapshot>` (AGENTS §21 — the snapshot is already pure,
-* self-contained JSON, so no encoding is needed for the memory tier). UNLIKE the server
-* package's `SessionStoreInterface`'s memory store there is
-* NO idle-TTL and NO eviction: a persisted workflow run-state is durable orchestration state
-* that lives until an explicit `delete`, never silently aging out (a run that vanished
-* mid-flight would be a silent data loss, not a freed session). A durable backend (JSON /
-* SQLite / IndexedDB) swaps in through the SAME interface without touching the runner or the
+* A plain `Map<string, WorkflowSnapshot>` (the snapshot is already pure,
+* self-contained JSON, so no encoding is needed for the memory tier). A durable backend (JSON /
+* SQLite / IndexedDB) swaps in through the same interface without touching the runner or the
 * entity tree — its driver-pluggable twin is
 * {@link import('./DatabaseWorkflowStore.js').DatabaseWorkflowStore} (the snapshot as one opaque
 * JSON column), exactly as `@orkestrel/queue`'s `MemoryQueueStore`
 * twins `DatabaseQueueStore`.
 *
 * - **`get` resolves the persisted snapshot for an id**, or `undefined` if none is stored.
-* - **`set` inserts / replaces under the snapshot's OWN `id`** (no separate id param).
+* - **`set` inserts / replaces under the snapshot's own `id`** (no separate id param).
 * - **`delete` drops a snapshot by id**; an absent id is a no-op (no throw).
 *
-* The public surface is EXACTLY `get` / `set` / `delete` — no extra members (the §22 method
+* The public surface is exactly `get` / `set` / `delete` — no extra members (the guide's method
 * bijection with {@link WorkflowStoreInterface}). Restore is a caller concern: read a snapshot
 * back and rebuild the live tree with {@link import('../factories.js').createRestoredWorkflow}.
 *
@@ -1432,35 +1902,35 @@ var MemoryWorkflowStore = class {
 //#endregion
 //#region src/core/tasks/Task.ts
 /**
-* The live leaf state machine (W-b) for one task — an observable (AGENTS §13), guarded
-* synchronous task whose explicit {@link TaskStatus} advances through the AGENTS §10
+* Implements the live leaf state machine (W-b) for one task — an observable, guarded
+* synchronous task whose explicit {@link LifecycleStatus} advances through the declared
 * transitions, recording a {@link TaskResult} on a terminal outcome.
 *
 * @remarks
-* - **Guarded transitions (AGENTS §10).** `start` (→ `running`), then `complete(value)`
+* - **Guarded transitions.** `start` (→ `running`), then `complete(value)`
 *   (→ `completed`, records a {@link import('@orkestrel/contract').Success}), `fail(error)`
 *   (→ `failed`, records a {@link import('@orkestrel/contract').Failure}), `skip` (→ `skipped`),
-*   `stop` (→ `stopped`). Each consults {@link canTransitionTask} FIRST and throws a
-*   `TRANSITION` {@link WorkflowError} on an illegal move (e.g. completing a non-`running`
-*   task) — the legal graph is the single source of truth, so the leaf can never reach an
-*   impossible state.
+*   `stop` (→ `stopped`). Each consults {@link canTransitionTask} first and throws a
+*   `TRANSITION` {@link WorkflowError} on an illegal move (for example, completing a
+*   non-`running` task) — the legal graph is the single source of truth, so the leaf can never
+*   reach an impossible state.
 * - **Snapshot fidelity.** A leaf needs no override: `skipped` / `stopped` are explicit terminal
 *   statuses, and restore reinstates the leaf directly from {@link TaskSnapshot.status}.
 * - **The cascade.** Every status change records its boxed result (when any), fires the leaf's
-*   OWN event, THEN calls the parent phase's `#recompute` (injected at construction) so the
-*   transition propagates UP (Task → Phase → Workflow re-derive). The own-event-before-cascade
-*   order means an observer sees the CAUSE (this leaf changed) before the EFFECT (the parents
+*   own event, then calls the parent phase's `#recompute` (injected at construction) so the
+*   transition propagates up (Task → Phase → Workflow re-derive). The own-event-before-cascade
+*   order means an observer sees the cause (this leaf changed) before the effect (the parents
 *   re-derive) — the project precedent (`Runner.#settle` emits its own `fail` before propagating).
-* - **Observable (AGENTS §13).** The owned {@link emitter} ({@link TaskEventMap}) fires the
-*   matching event strictly AFTER the state change, BEFORE the cascade; the emitter isolates
+* - **Observable.** The owned {@link emitter} ({@link TaskEventMap}) fires the
+*   matching event strictly after the state change, before the cascade; the emitter isolates
 *   a listener throw and routes it to its `error` handler (the `error` option), so a buggy
 *   observer can never corrupt a transition.
-* - **Declarative config (AGENTS §12).** `run` / `retries` / `timeout` PERSIST in a
+* - **Declarative config.** `behavior` / `retries` / `timeout` persist in a
 *   {@link TaskSnapshot} (like a phase's `bail` / `concurrency`), carried verbatim from the
 *   matching {@link import('../types.js').TaskDefinition} / {@link TaskSnapshot} field. `handler`
-*   is the RUNTIME-ONLY counterpart — `run` resolved ONCE at construction against the
+*   is the runtime-only counterpart — `behavior` resolved once at construction against the
 *   workflow-level {@link import('../types.js').WorkflowOptions.functions} registry — and is
-*   NEVER persisted; `undefined` when `run` is omitted or unregistered. Only omission is a
+*   never persisted; `undefined` when `behavior` is omitted or unregistered. Only omission is a
 *   deliberate no-op; unresolved named work is rejected before dispatch.
 */
 var Task = class {
@@ -1473,7 +1943,8 @@ var Task = class {
 	#status;
 	#result;
 	#name;
-	#run;
+	#description;
+	#behavior;
 	#retries;
 	#timeout;
 	#attempts;
@@ -1486,7 +1957,7 @@ var Task = class {
 	#paused;
 	#gate;
 	#timerSignal;
-	constructor(context, phase, workflow, recompute, options, status = "pending", result, run, retries, timeout, metadata = {}, attempts = 0, activity, handler, silence) {
+	constructor(context, phase, workflow, recompute, options, status = "pending", result, behavior, retries, timeout, metadata = {}, attempts = 0, activity, handler, silence) {
 		this.#context = buildTaskContext(context.phase, context);
 		this.#phase = phase;
 		this.#workflow = workflow;
@@ -1508,11 +1979,8 @@ var Task = class {
 		this.#status = status;
 		this.#result = result;
 		this.#name = context.name;
-		if (context.description !== void 0) Object.defineProperty(this, "description", {
-			configurable: true,
-			value: context.description
-		});
-		this.#run = run;
+		this.#description = context.description;
+		this.#behavior = behavior;
 		this.#retries = retries;
 		this.#timeout = timeout;
 		this.#attempts = attempts;
@@ -1538,6 +2006,9 @@ var Task = class {
 	get name() {
 		return this.#name;
 	}
+	get description() {
+		return this.#description;
+	}
 	get context() {
 		return this.#context;
 	}
@@ -1556,8 +2027,8 @@ var Task = class {
 	get attempts() {
 		return this.#attempts;
 	}
-	get run() {
-		return this.#run;
+	get behavior() {
+		return this.#behavior;
 	}
 	get handler() {
 		return this.#handler;
@@ -1596,7 +2067,7 @@ var Task = class {
 		this.#activity = cloneTaskActivity({}, this.#stamp());
 		this.#arm();
 		this.#emitter.emit("start", this.id);
-		this.#escalate();
+		this.#recompute();
 	}
 	complete(value) {
 		let owned;
@@ -1613,7 +2084,7 @@ var Task = class {
 			value: owned
 		}));
 		this.#emitter.emit("complete", result);
-		this.#escalate();
+		this.#recompute();
 	}
 	fail(error) {
 		const origin = error.origin === "handler" || error.origin === "timeout" || error.origin === "recovery" ? error.origin : "handler";
@@ -1628,21 +2099,21 @@ var Task = class {
 			})
 		}));
 		this.#emitter.emit("fail", result);
-		this.#escalate();
+		this.#recompute();
 	}
 	skip() {
 		this.#transition("skipped");
 		this.#finish();
 		this.#abort.abort();
 		this.#emitter.emit("skip");
-		this.#escalate();
+		this.#recompute();
 	}
 	stop() {
 		this.#transition("stopped");
 		this.#finish();
 		this.#abort.abort();
 		this.#emitter.emit("stop");
-		this.#escalate();
+		this.#recompute();
 	}
 	report(input) {
 		if (this.#status !== "running") return failure(new WorkflowError("TRANSITION", `task '${this.id}' cannot report while '${this.#status}'`, {
@@ -1670,7 +2141,7 @@ var Task = class {
 	pause() {
 		if (this.#paused || this.#status !== "pending" && this.#status !== "running") return;
 		this.#paused = true;
-		this.#gate = createDeferred();
+		this.#gate = Promise.withResolvers();
 		this.#emitter.emit("pause");
 	}
 	resume() {
@@ -1683,12 +2154,12 @@ var Task = class {
 		return this.#paused && this.#gate !== void 0 ? this.#gate.promise : Promise.resolve();
 	}
 	/**
-	* Apply a validated declarative patch to SELF (`name` / `description`).
+	* Applies a validated declarative patch to self (`name` / `description`).
 	*
 	* @remarks
-	* Defense-in-depth (AGENTS §12): the owning
-	* {@link import('../types.js').TaskManagerInterface.update} gates FIRST (target
-	* exists + `pending`), so this is the second, redundant check — it THROWS a
+	* Defense-in-depth: the owning
+	* {@link import('../types.js').TaskManagerInterface.update} gates first (target
+	* exists + `pending`), so this is the second, redundant check — it throws a
 	* `MUTATION` {@link WorkflowError} unless this task's own `status` is `pending`.
 	*
 	* @param value - The {@link TaskUpdate} fields to apply
@@ -1703,21 +2174,18 @@ var Task = class {
 			status: this.#status
 		});
 		if (value.name !== void 0) this.#name = value.name;
-		if (value.description !== void 0) Object.defineProperty(this, "description", {
-			configurable: true,
-			value: value.description
-		});
+		if (value.description !== void 0) this.#description = value.description;
 	}
 	snapshot() {
 		return {
 			id: this.id,
 			name: this.name,
-			...this.description === void 0 ? {} : { description: this.description },
+			...this.#description === void 0 ? {} : { description: this.#description },
 			status: this.#status,
 			...this.#result === void 0 ? {} : { result: this.#result },
 			metadata: this.#metadata,
 			attempts: this.#attempts,
-			...this.#run === void 0 ? {} : { run: this.#run },
+			...this.#behavior === void 0 ? {} : { behavior: this.#behavior },
 			...this.#retries === void 0 ? {} : { retries: this.#retries },
 			...this.#timeout === void 0 ? {} : { timeout: this.#timeout },
 			...this.#activity === void 0 ? {} : { activity: this.#activity }
@@ -1744,9 +2212,6 @@ var Task = class {
 		this.#result = frozen;
 		return frozen;
 	}
-	#escalate() {
-		this.#recompute();
-	}
 	#touch() {
 		if (this.#activity === void 0) return;
 		this.#activity = Object.freeze({
@@ -1791,25 +2256,30 @@ var Task = class {
 //#endregion
 //#region src/core/tasks/TaskManager.ts
 /**
-* The lean child manager (AGENTS §9) of a {@link import('../phases/Phase.js').Phase}'s live
-* tasks — an insertion-ordered registry keyed by task `id`, so positional order is
-* preserved across an interior `skip` / `remove`.
+* Implements the lean child manager of a {@link import('../phases/Phase.js').Phase}'s live
+* tasks — the task vocabulary over one insertion-ordered {@link Collection}, so positional order
+* is preserved across an interior `skip` / `remove`.
 *
 * @remarks
-* - **Positional store.** Tasks live in an insertion-ordered `Map` keyed by `id`;
-*   `append` adds one at the end (the build-time wiring path), `task(id)` looks one up,
-*   `tasks()` lists them in positional order, `count` is the size. A `skip` is a STATUS
-*   change on a stored task (never a removal), so order survives it; a snapshot RESTORE
-*   re-`append`s in the snapshot's order, reproducing it exactly.
-* - **Gated mutation API (AGENTS §12).** `add` / `remove` / `move` / `update` are the
-*   graceful `Result` counterparts to `append`, gating ONLY on the target's OWN
-*   existence/status/id/bounds — a duplicate id, an absent/non-`pending` target, an
-*   out-of-bounds `index`, or a patch that fails {@link taskUpdateShape} validation all
-*   fail gracefully with a `MUTATION` {@link WorkflowError} instead of throwing.
-* - **No batch matrix.** A phase's tasks are a fixed positional set, so AGENTS §9.2 (the
-*   bulk verb overloads) is deliberately omitted — there is no `remove` family here.
-* - **Event-free.** A purely structural container — the live {@link TaskInterface}s own
-*   their own emitters; the manager observes nothing.
+* - **One shared store.** The insertion-ordered `Map`, the reorder step, the bounds checks, and
+*   the gated `add` / `remove` / `move` / `update` all live in {@link Collection}, built with the
+*   `task` noun its refusals name and the compiled {@link taskUpdateShape} guard. This class adds
+*   the domain accessors `task` / `tasks` and nothing else, so the task and phase managers cannot
+*   drift apart.
+* - **Positional store.** `append` adds one live {@link TaskInterface} at the end (the build-time
+*   wiring path), `task(id)` looks one up, `tasks()` lists them in positional order, `count` is
+*   the tally. A `skip` is a status change on a stored task (never a removal), so order survives
+*   it; a snapshot RESTORE re-`append`s in the snapshot's order, reproducing it exactly.
+* - **Gated mutation API.** `add` / `remove` / `move` / `update` are the graceful
+*   `Result` counterparts to `append`, gating only on the target's own existence/status/id/bounds
+*   — a duplicate id, an absent/non-`pending` target, an out-of-bounds `index`, or a patch that
+*   fails {@link taskUpdateShape} validation all fail gracefully with a `MUTATION`
+*   {@link WorkflowError} instead of throwing.
+* - **No batch matrix.** A phase's tasks are a fixed positional set, so
+*   `.claude/rules/patterns.md` § Batch operations (the bulk verb
+*   overloads) is deliberately omitted — no `remove` family lives here.
+* - **Event-free.** A purely structural container — the live {@link TaskInterface}s own their own
+*   emitters; the manager observes nothing.
 *
 * @example
 * ```ts
@@ -1820,105 +2290,84 @@ var Task = class {
 * ```
 */
 var TaskManager = class {
-	#tasks = /* @__PURE__ */ new Map();
-	#isUpdate = (0, _orkestrel_contract.compileGuard)(taskUpdateShape);
+	#tasks = new Collection("task", (0, _orkestrel_contract.compileGuard)(taskUpdateShape));
 	get count() {
-		return this.#tasks.size;
+		return this.#tasks.count;
 	}
 	append(task) {
-		if (this.#tasks.has(task.id)) throw new WorkflowError("MUTATION", `duplicate task id '${task.id}'`, { id: task.id });
-		this.#tasks.set(task.id, task);
+		this.#tasks.append(task);
 	}
 	add(task, index) {
-		if (this.#tasks.has(task.id)) return failure(new WorkflowError("MUTATION", `duplicate task id '${task.id}'`, { id: task.id }));
-		const at = index ?? this.#tasks.size;
-		if (at < 0 || at > this.#tasks.size) return failure(new WorkflowError("MUTATION", `index '${at}' out of bounds`, { index: at }));
-		this.#reorder(insertEntry([...this.#tasks.entries()], at, task.id, task));
-		return success(task);
+		return this.#tasks.add(task, index);
 	}
 	remove(id) {
-		const target = this.#tasks.get(id);
-		if (target === void 0 || target.status !== "pending") return failure(new WorkflowError("MUTATION", `task '${id}' is not a pending task`, { id }));
-		this.#tasks.delete(id);
-		return success(target);
+		return this.#tasks.remove(id);
 	}
 	move(id, index) {
-		const target = this.#tasks.get(id);
-		if (target === void 0 || target.status !== "pending") return failure(new WorkflowError("MUTATION", `task '${id}' is not a pending task`, { id }));
-		if (index < 0 || index >= this.#tasks.size) return failure(new WorkflowError("MUTATION", `index '${index}' out of bounds`, { index }));
-		this.#reorder(moveEntry([...this.#tasks.entries()], id, index));
-		return success(target);
+		return this.#tasks.move(id, index);
 	}
 	update(id, patch) {
-		const target = this.#tasks.get(id);
-		if (target === void 0 || target.status !== "pending") return failure(new WorkflowError("MUTATION", `task '${id}' is not a pending task`, { id }));
-		if (!this.#isUpdate(patch)) return failure(new WorkflowError("MUTATION", `invalid patch for task '${id}'`, { id }));
-		target.patch(patch);
-		return success(target);
+		return this.#tasks.update(id, patch);
 	}
 	task(id) {
-		return this.#tasks.get(id);
+		return this.#tasks.entry(id);
 	}
 	tasks() {
-		return [...this.#tasks.values()];
-	}
-	#reorder(entries) {
-		this.#tasks.clear();
-		for (const [key, value] of entries) this.#tasks.set(key, value);
+		return this.#tasks.entries();
 	}
 };
 //#endregion
 //#region src/core/phases/Phase.ts
 /**
-* The live DERIVED state machine (W-b) for one phase — an observable (AGENTS §13) whose
-* {@link PhaseStatus} is computed from its tasks (never set directly) and recomputed
+* Implements the live derived state machine (W-b) for one phase — an observable whose
+* {@link LifecycleStatus} is computed from its tasks (never set directly) and recomputed
 * reactively as a task transitions (the middle tier of the cascade).
 *
 * @remarks
 * - **Derived status.** `status` is `#override` when one is in force, else
 *   {@link derivePhaseStatus} over the live tasks' statuses. `#recompute` (passed to
-*   each child {@link Task}) re-derives on every child transition; a CHANGE emits the matching
-*   event AND escalates to the workflow (`#escalate`, the upward step of the cascade).
-* - **Override (AGENTS §10).** `skip` / `stop` FORCE the phase's status (e.g. skipping a whole
-*   phase), overriding the derived value; the override is PERSISTED in the snapshot's own
-*   `override` field and restored DIRECTLY (no divergence guess), so a forced phase round-trips.
-* - **Children (AGENTS §9).** `tasks` is the lean {@link TaskManager} (an accessor + `count`,
+*   each child {@link Task}) re-derives on every child transition; a change emits the matching
+*   event and escalates to the workflow (`#escalate`, the upward step of the cascade).
+* - **Override.** `skip` / `stop` force the phase's status (for example, skipping a whole
+*   phase), overriding the derived value; the override is persisted in the snapshot's own
+*   `override` field and restored directly (no divergence guess), so a forced phase round-trips.
+* - **Children.** `tasks` is the lean {@link TaskManager} (an accessor + `count`,
 *   no batch matrix); built positionally from the snapshot so order survives an interior `skip`.
 *   `results()` collects the settled tasks' {@link TaskResult}s (the phase tier of the result
-*   tree); `workflow` navigates UP to the live parent.
-* - **Observable (AGENTS §13).** The owned {@link emitter} ({@link PhaseEventMap}) fires
+*   tree); `workflow` navigates up to the live parent.
+* - **Observable.** The owned {@link emitter} ({@link PhaseEventMap}) fires
 *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
 *   corresponding status or runtime-gate change. Status events fire after the phase recomputes
 *   and before it escalates to the workflow, preserving child/phase cause before parent effect.
 *   The emitter isolates a listener throw and routes it to its `error` handler (the `error`
 *   option); `fail` carries the failing task's {@link TaskResult}.
-* - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
+* - **Structural API.** `add` / `remove` / `move` / `update` gate before
 *   delegating to {@link tasks} (the manager gates the target's own existence/status/id/
-*   bounds), then emit the matching {@link PhaseEventMap} event on success only. NATIVE
+*   bounds), then emit the matching {@link PhaseEventMap} event on success only. Native
 *   gating, purely from this phase's own derived `status` (no runner-installed hook): while
-*   `pending`, any valid `index` is accepted; while `running`, `add` accepts ONLY a pure
+*   `pending`, any valid `index` is accepted; while `running`, `add` accepts only a pure
 *   append (a live runner subscribed to the `add` event picks it up), and `remove` / `move` /
 *   `update` always fail gracefully (the tasks are already handed to the execution
 *   substrate); while terminal, everything is refused.
-* - **Patch (AGENTS §12).** `patch` applies a validated {@link PhaseUpdate} to SELF
+* - **Patch.** `patch` applies a validated {@link PhaseUpdate} to self
 *   (`name` / `description` / `concurrency` / `bail`) — defense-in-depth: it throws a
 *   `MUTATION` {@link WorkflowError} unless this phase's own `status` is `pending`, mirroring
 *   the owning {@link WorkflowInterface.update}'s gate.
-* - **Minting (AGENTS §7).** {@link add} MINTS a live {@link Task} from a {@link TaskDefinition}
-*   (converts it to a {@link TaskSnapshot}, builds the task wired to THIS phase) — the same
+* - **Minting.** {@link add} mints a live {@link Task} from a {@link TaskDefinition}
+*   (converts it to a {@link TaskSnapshot}, builds the task wired to this phase) — the same
 *   construction path {@link #append} uses at build time, so a live mint and a restored/built
-*   task are wired IDENTICALLY. At construction, the workflow-level
-*   {@link import('../types.js').WorkflowFunctions} registry (threaded from
-*   {@link import('../types.js').WorkflowOptions.functions}) resolves every unique initial `run`
-*   name ONCE before any task is built; siblings sharing a name receive the exact same captured
+*   task are wired identically. At construction, the workflow-level
+*   {@link import('../types.js').WorkflowRegistry} registry (threaded from
+*   {@link import('../types.js').WorkflowOptions.functions}) resolves every unique initial `behavior`
+*   name once before any task is built; siblings sharing a name receive the exact same captured
 *   runtime {@link import('../types.js').TaskInterface.handler}. A later live {@link add} reads
 *   that name once from the retained registry at its own mint moment. An omitted or unregistered
-*   `run` resolves to no handler; only omission is a no-op, while an unresolved present name makes
+*   `behavior` resolves to no handler; only omission is a no-op, while an unresolved present name makes
 *   the containing tree non-drivable.
-* - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror the workflow's own
+* - **Runtime lifecycle.** `pause` / `resume` / `wait` mirror the workflow's own
 *   quartet, scoped to this phase — a driving
 *   {@link import('../types.js').WorkflowRunnerInterface.execute} gates a task's own
-*   pre-dispatch on the workflow's gate FIRST, then this phase's gate, WITHOUT touching
+*   pre-dispatch on the workflow's gate first, then this phase's gate, without touching
 *   {@link status} — `paused` is runtime-only, never persisted. `skip` / `stop` (this phase's
 *   own terminal forcing) always release a parked {@link wait} waiter, mirroring
 *   {@link import('../Workflow.js').Workflow.destroy}'s cascade — a permanently-ended phase
@@ -1927,6 +2376,7 @@ var TaskManager = class {
 var Phase = class {
 	#id;
 	#name;
+	#description;
 	#workflow;
 	#escalateUp;
 	#tasks = new TaskManager();
@@ -1945,16 +2395,13 @@ var Phase = class {
 		const tasks = options?.tasks;
 		this.#id = snapshot.id;
 		this.#name = snapshot.name;
-		if (snapshot.description !== void 0) Object.defineProperty(this, "description", {
-			configurable: true,
-			value: snapshot.description
-		});
+		this.#description = snapshot.description;
 		this.#workflow = workflow;
 		this.#escalateUp = escalate;
 		this.#functions = functions;
 		this.#silence = silence;
 		const handlers = /* @__PURE__ */ new Map();
-		for (const task of snapshot.tasks) if (task.run !== void 0 && !handlers.has(task.run)) handlers.set(task.run, functions?.[task.run]);
+		for (const task of snapshot.tasks) if (task.behavior !== void 0 && !handlers.has(task.behavior)) handlers.set(task.behavior, functions?.[task.behavior]);
 		this.#bail = bail ?? snapshot.bail;
 		this.#concurrency = snapshot.concurrency;
 		this.#emitter = new _orkestrel_emitter.Emitter({
@@ -1963,7 +2410,7 @@ var Phase = class {
 		});
 		for (const task of snapshot.tasks) {
 			const taskOptions = tasks?.[task.id];
-			const handler = task.run === void 0 ? void 0 : handlers.get(task.run);
+			const handler = task.behavior === void 0 ? void 0 : handlers.get(task.behavior);
 			this.#append(task, taskOptions, handler);
 		}
 		this.#override = snapshot.override;
@@ -1980,11 +2427,14 @@ var Phase = class {
 	get name() {
 		return this.#name;
 	}
+	get description() {
+		return this.#description;
+	}
 	get context() {
 		return buildPhaseContext(this.#workflow.context, {
 			id: this.#id,
 			name: this.#name,
-			...this.description === void 0 ? {} : { description: this.description }
+			...this.#description === void 0 ? {} : { description: this.#description }
 		});
 	}
 	get workflow() {
@@ -2026,7 +2476,7 @@ var Phase = class {
 	pause() {
 		if (this.#paused || isTerminalStatus(this.status)) return;
 		this.#paused = true;
-		this.#gate = createDeferred();
+		this.#gate = Promise.withResolvers();
 		this.#emitter.emit("pause");
 	}
 	resume() {
@@ -2088,10 +2538,7 @@ var Phase = class {
 			status: this.status
 		});
 		if (value.name !== void 0) this.#name = value.name;
-		if (value.description !== void 0) Object.defineProperty(this, "description", {
-			configurable: true,
-			value: value.description
-		});
+		if (value.description !== void 0) this.#description = value.description;
 		if (value.concurrency !== void 0) this.#concurrency = value.concurrency;
 		if (value.bail !== void 0) this.#bail = value.bail;
 	}
@@ -2099,7 +2546,7 @@ var Phase = class {
 		return {
 			id: this.id,
 			name: this.name,
-			...this.description === void 0 ? {} : { description: this.description },
+			...this.#description === void 0 ? {} : { description: this.#description },
 			status: this.status,
 			...this.#override === void 0 ? {} : { override: this.#override },
 			bail: this.#bail,
@@ -2134,7 +2581,7 @@ var Phase = class {
 	}
 	#failure() {
 		const found = findFailure(this.results());
-		if (found === void 0) throw new Error(`phase '${this.id}' derived failed with no failing task result`);
+		if (found === void 0) throw new WorkflowError("INVARIANT", `phase '${this.id}' derived failed with no failing task result`, { phase: this.id });
 		return found;
 	}
 	#release() {
@@ -2152,11 +2599,11 @@ var Phase = class {
 		this.#tasks.append(created);
 	}
 	#create(snapshot, options, handler) {
-		return new Task(buildTaskContext(this.context, snapshot), this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.run, snapshot.retries, snapshot.timeout, snapshot.metadata, snapshot.attempts, snapshot.activity, handler, this.#silence);
+		return new Task(buildTaskContext(this.context, snapshot), this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.behavior, snapshot.retries, snapshot.timeout, snapshot.metadata, snapshot.attempts, snapshot.activity, handler, this.#silence);
 	}
 	#mint(definition) {
 		const snapshot = taskDefinitionToSnapshot(definition);
-		const handler = snapshot.run === void 0 ? void 0 : this.#functions?.[snapshot.run];
+		const handler = snapshot.behavior === void 0 ? void 0 : this.#functions?.[snapshot.behavior];
 		return this.#create(snapshot, void 0, handler);
 	}
 	#statuses() {
@@ -2166,24 +2613,28 @@ var Phase = class {
 //#endregion
 //#region src/core/phases/PhaseManager.ts
 /**
-* The lean child manager (AGENTS §9) of a {@link import('../Workflow.js').Workflow}'s
-* live phases — an insertion-ordered registry keyed by phase `id`, the phase analogue
+* Implements the lean child manager of a {@link import('../Workflow.js').Workflow}'s live
+* phases — the phase vocabulary over one insertion-ordered {@link Collection}, the phase analogue
 * of {@link import('../tasks/TaskManager.js').TaskManager}.
 *
 * @remarks
-* - **Positional store.** Phases live in an insertion-ordered `Map` keyed by `id`;
-*   `append` adds one at the end, `phase(id)` looks one up, `phases()` lists them in
-*   positional order, `count` is the size. A snapshot RESTORE re-`append`s in the
-*   snapshot's order, reproducing it exactly.
-* - **Gated mutation API (AGENTS §12).** `add` / `remove` / `move` / `update` are the
-*   graceful `Result` counterparts to `append`, gating ONLY on the target's OWN
-*   existence/status/id/bounds — a duplicate id, an absent/non-`pending` target, an
-*   out-of-bounds `index`, or a patch that fails {@link phaseUpdateShape} validation
-*   all fail gracefully with a `MUTATION` {@link WorkflowError} instead of throwing.
-* - **No batch matrix.** A workflow's phases are a fixed positional set, so AGENTS §9.2
-*   is deliberately omitted.
-* - **Event-free.** A purely structural container — the live {@link PhaseInterface}s own
-*   their own emitters.
+* - **One shared store.** The insertion-ordered `Map`, the reorder step, the bounds checks, and
+*   the gated `add` / `remove` / `move` / `update` all live in {@link Collection}, built with the
+*   `phase` noun its refusals name and the compiled {@link phaseUpdateShape} guard. This class
+*   adds the domain accessors `phase` / `phases` and nothing else.
+* - **Positional store.** `append` adds one live {@link PhaseInterface} at the end, `phase(id)`
+*   looks one up, `phases()` lists them in positional order, `count` is the tally. A snapshot
+*   RESTORE re-`append`s in the snapshot's order, reproducing it exactly.
+* - **Gated mutation API.** `add` / `remove` / `move` / `update` are the graceful
+*   `Result` counterparts to `append`, gating only on the target's own existence/status/id/bounds
+*   — a duplicate id, an absent/non-`pending` target, an out-of-bounds `index`, or a patch that
+*   fails {@link phaseUpdateShape} validation all fail gracefully with a `MUTATION`
+*   {@link WorkflowError} instead of throwing.
+* - **No batch matrix.** A workflow's phases are a fixed positional set, so the batch verbs of
+*   `.claude/rules/patterns.md` § Batch operations are
+*   deliberately omitted.
+* - **Event-free.** A purely structural container — the live {@link PhaseInterface}s own their own
+*   emitters.
 *
 * @example
 * ```ts
@@ -2194,58 +2645,37 @@ var Phase = class {
 * ```
 */
 var PhaseManager = class {
-	#phases = /* @__PURE__ */ new Map();
-	#isUpdate = (0, _orkestrel_contract.compileGuard)(phaseUpdateShape);
+	#phases = new Collection("phase", (0, _orkestrel_contract.compileGuard)(phaseUpdateShape));
 	get count() {
-		return this.#phases.size;
+		return this.#phases.count;
 	}
 	append(phase) {
-		if (this.#phases.has(phase.id)) throw new WorkflowError("MUTATION", `duplicate phase id '${phase.id}'`, { id: phase.id });
-		this.#phases.set(phase.id, phase);
+		this.#phases.append(phase);
 	}
 	add(phase, index) {
-		if (this.#phases.has(phase.id)) return failure(new WorkflowError("MUTATION", `duplicate phase id '${phase.id}'`, { id: phase.id }));
-		const at = index ?? this.#phases.size;
-		if (at < 0 || at > this.#phases.size) return failure(new WorkflowError("MUTATION", `index '${at}' out of bounds`, { index: at }));
-		this.#reorder(insertEntry([...this.#phases.entries()], at, phase.id, phase));
-		return success(phase);
+		return this.#phases.add(phase, index);
 	}
 	remove(id) {
-		const target = this.#phases.get(id);
-		if (target === void 0 || target.status !== "pending") return failure(new WorkflowError("MUTATION", `phase '${id}' is not a pending phase`, { id }));
-		this.#phases.delete(id);
-		return success(target);
+		return this.#phases.remove(id);
 	}
 	move(id, index) {
-		const target = this.#phases.get(id);
-		if (target === void 0 || target.status !== "pending") return failure(new WorkflowError("MUTATION", `phase '${id}' is not a pending phase`, { id }));
-		if (index < 0 || index >= this.#phases.size) return failure(new WorkflowError("MUTATION", `index '${index}' out of bounds`, { index }));
-		this.#reorder(moveEntry([...this.#phases.entries()], id, index));
-		return success(target);
+		return this.#phases.move(id, index);
 	}
 	update(id, patch) {
-		const target = this.#phases.get(id);
-		if (target === void 0 || target.status !== "pending") return failure(new WorkflowError("MUTATION", `phase '${id}' is not a pending phase`, { id }));
-		if (!this.#isUpdate(patch)) return failure(new WorkflowError("MUTATION", `invalid patch for phase '${id}'`, { id }));
-		target.patch(patch);
-		return success(target);
+		return this.#phases.update(id, patch);
 	}
 	phase(id) {
-		return this.#phases.get(id);
+		return this.#phases.entry(id);
 	}
 	phases() {
-		return [...this.#phases.values()];
-	}
-	#reorder(entries) {
-		this.#phases.clear();
-		for (const [key, value] of entries) this.#phases.set(key, value);
+		return this.#phases.entries();
 	}
 };
 //#endregion
 //#region src/core/Workflow.ts
 /**
-* The live DERIVED state machine (W-b) for a whole workflow — the observable (AGENTS §13)
-* ROOT whose {@link WorkflowStatus} is computed from its phases under the `bail` policy and
+* Implements the live derived state machine (W-b) for a whole workflow — the observable root
+* whose {@link LifecycleStatus} is computed from its phases under the `bail` policy and
 * recomputed reactively as the cascade propagates up from a task transition.
 *
 * @remarks
@@ -2255,38 +2685,53 @@ var PhaseManager = class {
 *   passes a persisted one). Each child {@link Phase} is wired to escalate to `#recompute`.
 * - **Derived status.** `status` is `#override` when forced, else
 *   {@link deriveWorkflowStatus} over the live phases' statuses feeding `bail`. `failed` is
-*   reachable ONLY under `bail: true` (a single failed task halts the workflow); under
+*   reachable only under `bail: true` (a single failed task halts the workflow); under
 *   `bail: false` a failed phase folds into `completed`. `#recompute` diffs on each phase
-*   change; a CHANGE emits.
-* - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; an executed task-free pending tree
-*   may also be force-completed vacuously. The override is PERSISTED in the snapshot's own
-*   `override` field and restored DIRECTLY (no divergence guess). The snapshot also persists
+*   change; a change emits.
+* - **Override.** `skip` / `stop` force the status; an executed task-free pending tree
+*   may also be force-completed vacuously. The override is persisted in the snapshot's own
+*   `override` field and restored directly (no divergence guess). The snapshot also persists
 *   `bail`, so a restore re-derives status identically without a silent policy default.
 * - **Result tree.** `results()` flattens every phase's `results()` ({@link collectResults}) — the
-*   workflow tier; `phase(id)` + each `phase.task(id)` navigate DOWN, a task's `phase` / `workflow`
-*   navigate UP.
+*   workflow tier; `phase(id)` + each `phase.task(id)` navigate down, a task's `phase` / `workflow`
+*   navigate up.
 * - **Snapshot.** `snapshot()` serializes the whole live tree to a {@link WorkflowSnapshot} (pure
 *   JSON); {@link import('./factories.js').createRestoredWorkflow} rebuilds an equivalent live tree.
-* - **Observable (AGENTS §13).** The owned {@link emitter} ({@link WorkflowEventMap}) fires
+* - **Observable.** The owned {@link emitter} ({@link WorkflowEventMap}) fires
 *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
 *   corresponding status or runtime-gate change; the emitter isolates a listener throw and
 *   routes it to its `error` handler (the `error` option); `fail` carries the failing task's
 *   {@link TaskResult}.
-* - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
+* - **Structural API.** `add` / `remove` / `move` / `update` gate before
 *   delegating to {@link phases} (the manager gates the target's own existence/status/id/
-*   bounds), then emit the matching {@link WorkflowEventMap} event on success only. NATIVE,
+*   bounds), then emit the matching {@link WorkflowEventMap} event on success only. Native,
 *   bottom-up gating (no runner-installed hook): refused outright while this workflow's own
-*   `status` is terminal; otherwise a target position must fall within the PENDING SUFFIX —
+*   `status` is terminal; otherwise a target position must fall within the pending suffix —
 *   the contiguous trailing run of `pending` phases — whose boundary is
 *   {@link import('./helpers.js').deriveBoundary} over the live phases' statuses. A `pending`
 *   workflow's phases are all `pending`, so the boundary is `0` and every position is
 *   naturally accepted.
-* - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` gate execution at the runner's
-*   phase/task boundaries WITHOUT touching {@link status} — `paused` is runtime-only, never
+* - **Runtime lifecycle.** `pause` / `resume` / `wait` gate execution at the runner's
+*   phase/task boundaries without touching {@link status} — `paused` is runtime-only, never
 *   persisted. `destroy` is a terminal teardown: it `stop`s every non-terminal task and
 *   phase (releasing their gates and liveness resources), aborts {@link signal}, forces the
 *   workflow `stop` override when needed, releases its parked waiter, and marks
 *   {@link destroyed} — all idempotent.
+*
+* @example
+* ```ts
+* import { definitionToSnapshot, Workflow } from '@orkestrel/workflow'
+*
+* const definition = {
+* 	id: 'release',
+* 	name: 'Release',
+* 	phases: [{ id: 'build', name: 'Build', tasks: [{ id: 'compile', name: 'Compile' }] }],
+* }
+* const workflow = new Workflow(definitionToSnapshot(definition))
+* workflow.status // 'pending'
+* workflow.phase('build')?.task('compile')?.status // 'pending'
+* workflow.snapshot().id // 'release'
+* ```
 */
 var Workflow = class {
 	#context;
@@ -2313,7 +2758,6 @@ var Workflow = class {
 		const functions = captured.functions;
 		const silence = captured.silence;
 		this.#context = buildWorkflowContext(snapshot);
-		if (snapshot.description !== void 0) Object.defineProperty(this, "description", { value: snapshot.description });
 		this.#bail = bail ?? snapshot.bail;
 		this.#bailOverride = bail;
 		this.#functions = functions;
@@ -2344,6 +2788,9 @@ var Workflow = class {
 	get name() {
 		return this.#context.name;
 	}
+	get description() {
+		return this.#context.description;
+	}
 	get context() {
 		return this.#context;
 	}
@@ -2387,7 +2834,7 @@ var Workflow = class {
 	pause() {
 		if (this.#paused || isTerminalStatus(this.status) || this.#destroyed) return;
 		this.#paused = true;
-		this.#gate = createDeferred();
+		this.#gate = Promise.withResolvers();
 		this.#emitter.emit("pause");
 	}
 	resume() {
@@ -2475,7 +2922,7 @@ var Workflow = class {
 		return cloneWorkflowSnapshot({
 			id: this.id,
 			name: this.name,
-			...this.description === void 0 ? {} : { description: this.description },
+			...this.#context.description === void 0 ? {} : { description: this.#context.description },
 			status: this.status,
 			...this.#override === void 0 ? {} : { override: this.#override },
 			bail: this.#bail,
@@ -2519,7 +2966,7 @@ var Workflow = class {
 	}
 	#failure() {
 		const found = findFailure(this.results());
-		if (found === void 0) throw new Error(`workflow '${this.id}' derived failed with no failing task result`);
+		if (found === void 0) throw new WorkflowError("INVARIANT", `workflow '${this.id}' derived failed with no failing task result`, { workflow: this.id });
 		return found;
 	}
 	#append(phase, options) {
@@ -2544,24 +2991,25 @@ var Workflow = class {
 //#endregion
 //#region src/core/WorkflowManager.ts
 /**
-* The store-backed registry of {@link WorkflowInterface}s keyed by `id`, in insertion order —
+* Implements the store-backed registry of {@link WorkflowInterface}s keyed by `id`, in insertion order —
 * the additive manager tier mirroring the `@orkestrel/agent` line's `ConversationManager` /
 * `WorkspaceManager`. Event-free (a registry, like its twins); the observability lives on each
 * {@link WorkflowInterface}.
 *
 * @remarks
 * - **Registry.** Workflows live in an insertion-ordered `Map` keyed by `id`. `add(definition)`
-*   mints a live {@link WorkflowInterface} through {@link createWorkflow} (flowing the manager's
+*   mints a live {@link WorkflowInterface} through the same construction path
+*   {@link import('./factories.js').createWorkflow} takes (flowing the manager's
 *   `functions` registry in) and stores it under `definition.id` — an already-present id
-*   OVERWRITES (last write wins). `count` is the map size, `workflow(id)` looks one up,
+*   overwrites (last write wins). `count` is the map size, `workflow(id)` looks one up,
 *   `workflows()` lists them in insertion order.
 * - **Durable open / save.** `open(id)` returns an already-registered workflow directly; same-id
 *   misses share one hydration. A concurrent `add` wins, while `remove` / `clear` invalidate
 *   earlier reads; wrong-key payloads reject with `RESTORE`. `save(id)` captures a registered
 *   workflow's snapshot at invocation and serializes same-id writes without coupling other ids.
 *   Both remain lenient without a store or registered id.
-* - **Removal.** `remove` drops one by id, or a batch (§9.2, array overload FIRST) — `true` when
-*   any was removed. `clear` empties the registry.
+* - **Removal.** `remove` drops one by id, or a batch (array overload first) — `true` only when
+*   every id was removed. `clear` empties the registry.
 * - **No active pointer.** Unlike its `ConversationManager` / `WorkspaceManager` twins, there is
 *   no `active` / `switch` — nothing in the workflow domain renders "the current workflow".
 *
@@ -2570,7 +3018,7 @@ var Workflow = class {
 * const manager = new WorkflowManager({
 * 	functions: { compile: async (controller) => `built ${controller.task.id}` },
 * })
-* const workflow = manager.add(definition) // minted, registered, RUNNABLE
+* const workflow = manager.add(definition) // minted, registered, runnable
 * manager.workflow(workflow.id) // the same workflow
 * manager.count // 1
 * ```
@@ -2599,7 +3047,7 @@ var WorkflowManager = class {
 		return [...this.#workflows.values()];
 	}
 	add(definition) {
-		const workflow = createWorkflow(definition, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
+		const workflow = this.#build(definition);
 		const mutation = this.#invalidate(workflow.id);
 		if (mutation === void 0) this.#additions.delete(workflow.id);
 		else this.#additions.set(workflow.id, mutation);
@@ -2636,11 +3084,11 @@ var WorkflowManager = class {
 	}
 	remove(ids) {
 		if ((0, _orkestrel_contract.isArray)(ids)) {
-			let removed = false;
+			let removed = true;
 			for (const id of ids) {
 				this.#invalidate(id);
 				this.#additions.delete(id);
-				if (this.#workflows.delete(id)) removed = true;
+				if (!this.#workflows.delete(id)) removed = false;
 			}
 			return removed;
 		}
@@ -2670,7 +3118,7 @@ var WorkflowManager = class {
 			if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
 			let workflow;
 			try {
-				workflow = createRestoredWorkflow(owned, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
+				workflow = this.#restore(owned);
 			} catch (error) {
 				if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
 				throw error;
@@ -2681,6 +3129,15 @@ var WorkflowManager = class {
 			this.#releaseHydration(id, lease);
 		}
 	}
+	#build(definition) {
+		return createWorkflowTree(definition, this.#captured());
+	}
+	#restore(snapshot) {
+		return new Workflow(cloneWorkflowSnapshot(snapshot), this.#captured());
+	}
+	#captured() {
+		return captureWorkflowOptions(this.#functions === void 0 ? {} : { functions: this.#functions });
+	}
 	#owns(id, mutation, generation) {
 		return this.#generation === generation && this.#mutations.get(id) === mutation;
 	}
@@ -2736,9 +3193,50 @@ var WorkflowManager = class {
 	}
 };
 //#endregion
+//#region src/core/RunHolder.ts
+/**
+* Holds the active phase {@link RunnerInterface} for one
+* {@link import('./types.js').WorkflowRunnerInterface.execute} call, for the lifetime of that run.
+*
+* @remarks
+* - **One holder per run.** The engine mints a holder as a run begins and threads that one
+*   instance through every phase of the run, so a nested `execute` reached through application
+*   composition gets its own holder and can never clobber the suspended outer run's.
+* - **`hold` is the only mutation.** A phase takes the substrate runner with `hold(runner)` as it
+*   starts and releases it with `hold()` as it settles; `runner` reads the held value back and is
+*   `undefined` between phases and after the last one.
+* - **A cancel closes over the holder.** The run-level abort listener reads `runner` when it
+*   fires, so it reaches whichever phase runner is live at that moment rather than the one that
+*   was live when the listener was armed.
+* - **Event-free.** A plain cell — no emitter, no lifecycle of its own.
+*/
+var RunHolder = class {
+	#runner;
+	get runner() {
+		return this.#runner;
+	}
+	/**
+	* Takes the phase runner a starting phase hands this run, or releases the held one.
+	*
+	* @param runner - The phase runner to hold; omitted releases the held runner
+	* @example
+	* ```ts
+	* import type { TaskInterface } from '@orkestrel/workflow'
+	* import { createRunner, RunHolder } from '@orkestrel/workflow'
+	*
+	* const holder = new RunHolder()
+	* holder.hold(createRunner<TaskInterface, void>({ handler: () => undefined }))
+	* holder.hold() // released — `runner` reads `undefined` again
+	* ```
+	*/
+	hold(runner) {
+		this.#runner = runner;
+	}
+};
+//#endregion
 //#region src/core/Controller.ts
 /**
-* The per-unit handle a runner handler receives — wraps the unit's identity,
+* Implements the per-unit handle a runner handler receives — wraps the unit's identity,
 * input, cancellation, and the run controls (`wait` / `spawn` / `abort`).
 *
 * @remarks
@@ -2746,14 +3244,14 @@ var WorkflowManager = class {
 *   unit it dispatches, handing it the unit's `id`, `input`, the unit's `Abort`
 *   handle, the queue attempt's `signal`, and a `spawn` callback that launches a
 *   sibling through the same queue.
-* - **Signal.** `signal` is the queue attempt's signal, which ANY-combines the
+* - **Signal.** `signal` is the queue attempt's signal, which any-combines the
 *   unit's own abort, the runner-level abort (the runner aborts every unit), and
 *   the per-attempt timeout — so it fires on any of the three. `aborted` and
 *   `abort(reason)` delegate to the unit's `Abort` (the cancellation source of
-*   truth); since the attempt signal ANY-includes that abort, `abort()` fires
+*   truth); because the attempt signal any-includes that abort, `abort()` fires
 *   `signal` too.
 * - **`wait` promise-parks (never a timer).** It resolves the instant the unit's
-*   `signal` fires (immediately if already aborted) via a one-shot listener — no
+*   `signal` fires (immediately if already aborted) through a one-shot listener — no
 *   `setTimeout`, no polling, no busy-yield — so a parked unit costs no CPU.
 * - **`spawn` is fire-and-track.** It delegates to the runner's launch-a-sibling
 *   callback, which routes the sibling through the queue; the runner's `execute`
@@ -2764,23 +3262,32 @@ var WorkflowManager = class {
 *   {@link RunnerInterface.emitter} instead (`unit` / `spawn` / `settle` / `fail` carry the id).
 */
 var Controller = class {
-	id;
-	input;
-	signal;
+	#id;
+	#input;
+	#signal;
 	#abort;
 	#spawn;
 	constructor(id, input, abort, signal, spawn) {
-		this.id = id;
-		this.input = input;
+		this.#id = id;
+		this.#input = input;
 		this.#abort = abort;
-		this.signal = signal;
+		this.#signal = signal;
 		this.#spawn = spawn;
 	}
+	get id() {
+		return this.#id;
+	}
+	get input() {
+		return this.#input;
+	}
+	get signal() {
+		return this.#signal;
+	}
 	get aborted() {
 		return this.#abort.aborted;
 	}
 	wait() {
-		return parkSignal(this.signal);
+		return parkSignal(this.#signal);
 	}
 	spawn(input) {
 		return this.#spawn(input);
@@ -2792,7 +3299,7 @@ var Controller = class {
 //#endregion
 //#region src/core/Runner.ts
 /**
-* A thin generic orchestrator that drives declared units — and any they `spawn` —
+* Implements a thin generic orchestrator that drives declared units — and any they `spawn` —
 * through a bounded-concurrency {@link createQueue}, collecting ordered results.
 *
 * @remarks
@@ -2801,17 +3308,17 @@ var Controller = class {
 *   bounded concurrency, retries, and the per-attempt timeout are all the Queue's —
 *   the Runner adds only orchestration (launching, ordering, draining, fail-fast).
 * - **Spawns actually run, results stay ordered (the B2 fix).** Declared inputs and
-*   `spawn`ed siblings flow through the SAME `#launch`, which appends the unit's `id`
+*   `spawn`ed siblings flow through the same `#launch`, which appends the unit's `id`
 *   to an ordered `#order` list and records its settled value into `#values` by `id`.
 *   Results are read back as `#order.map(id => #values.get(id))` — declared first (in
 *   input order), then spawns (in spawn order). There is no one-time task snapshot,
 *   so a unit spawned mid-handler is run and ordered like any other.
-* - **`execute` awaits the full spawn closure via a count gate.** `#launch` increments
-*   an outstanding-unit `#count` BEFORE enqueuing and every settle decrements it,
+* - **`execute` awaits the full spawn closure through a count gate.** `#launch` increments
+*   an outstanding-unit `#count` before enqueuing and every settle decrements it,
 *   resolving the `#drained` deferred at zero. Because `spawn` calls `#launch` (so
 *   `#count += 1`) before the parent handler returns, the count never reaches zero
 *   mid-run — `execute` parks on `#drained` and so awaits the entire transitive
-*   closure, not just the declared units.
+*   closure, not only the declared units.
 * - **`spawn` is fire-and-track.** A spawned unit runs through the queue regardless of
 *   whether its promise is awaited; the Runner never awaits a spawned promise from
 *   within a handler's slot (it awaits the count gate instead), so a slot-holding
@@ -2819,26 +3326,26 @@ var Controller = class {
 *   spawn by a bounded handler can still deadlock — that caveat is the caller's.)
 * - **Per-unit Controller + signal.** Each unit gets a `Controller` carrying its `id`,
 *   `input`, the unit's `Abort` (so `aborted` / `abort` delegate to it), and the queue
-*   attempt's `signal` (which ANY-combines the unit abort + runner abort + timeout). A
+*   attempt's `signal` (which any-combines the unit abort + runner abort + timeout). A
 *   `spawn` callback is injected so `controller.spawn(input)` delegates to `#launch`.
 * - **One-shot + fail-fast.** `execute` runs once (a second call throws). The first
 *   unit failure (after its retries) records the error and `abort()`s the run, so every
 *   sibling's signal fires; later failures are ignored and `execute` rejects with the
 *   first error. A user `abort(reason)` likewise rejects a running `execute`.
-* - **`pause` / `resume` / `stop` (§10) ride the backing Queue.** `pause` / `resume`
-*   delegate straight to the Queue's own pause/resume (holding/releasing the NEXT
+* - **`pause` / `resume` / `stop` ride the backing Queue.** `pause` / `resume`
+*   delegate straight to the Queue's own pause/resume (holding/releasing the next
 *   dispatch while an in-flight unit finishes); `paused` mirrors the Queue's. `stop` is a
-*   GRACEFUL permanent end, distinct from `abort`: still-pending (never-dispatched)
-*   units are rejected by the Queue's own stop WITHOUT their handler ever running, and
+*   graceful permanent end, distinct from `abort`: still-pending (never-dispatched)
+*   units are rejected by the Queue's own stop without their handler ever running, and
 *   `#settle` reads that fact (`#dispatched`) to treat the rejection as a stop artifact —
 *   not a failure, never tripping fail-fast — while an in-flight unit still runs to
-*   completion and settles normally. `execute` RESOLVES (never rejects) once every unit
+*   completion and settles normally. `execute` resolves (never rejects) after every unit
 *   has settled, with whatever results actually completed.
-* - **Observable (§13).** The owned {@link emitter} ({@link RunnerEventMap}) carries the run
+* - **Observable.** The owned {@link emitter} ({@link RunnerEventMap}) carries the run
 *   lifecycle — `start` / `unit` / `spawn` / `settle` / `fail` / `finish` / `abort` — for
-*   fire-and-forget observers. Every event is emitted directly, strictly AFTER the relevant
+*   fire-and-forget observers. Every event is emitted directly, strictly after the relevant
 *   launch / settle / drain transition; the emitter isolates a listener throw and routes it
-*   to its `error` handler (the `error` option), so a buggy observer can NEVER reorder, throw
+*   to its `error` handler (the `error` option), so a buggy observer can never reorder, throw
 *   into, or corrupt the one-shot / fail-fast / spawn-tracking engine: the outstanding-unit
 *   count gate stays balanced and fail-fast still fires regardless of what a listener does.
 *   Observation is purely a side-channel.
@@ -2897,20 +3404,20 @@ var Runner = class {
 		return this.#queue.paused;
 	}
 	/**
-	* Inject one more unit into an IN-FLIGHT `execute` run — a LIVE counterpart to a
-	* `Controller.spawn`, called from OUTSIDE any unit's handler.
+	* Injects one more unit into an in-flight `execute` run — a live counterpart to a
+	* `Controller.spawn`, called from outside any unit's handler.
 	*
 	* @remarks
-	* Returns `undefined` synchronously (graceful, non-throwing — AGENTS §12) unless the
-	* runner is currently mid-`execute` and not yet stopped — covering "never started",
+	* Returns `undefined` synchronously (graceful, non-throwing) unless the
+	* runner is mid-`execute` and not yet stopped — covering "never started",
 	* "already drained", "aborted", and "destroyed". Otherwise the unit is routed through
-	* the SAME backing queue as a declared/`spawn`ed unit via `#launch` — the outstanding-
-	* unit count gate increments BEFORE this call returns, so an in-flight `execute`
+	* the same backing queue as a declared/`spawn`ed unit through `#launch` — the outstanding-
+	* unit count gate increments before this call returns, so an in-flight `execute`
 	* keeps awaiting it (the drain race: `#running` flips to `false` as the very first
 	* step after `execute`'s `await drained.promise` settles, so a `spawn` reaching this
 	* method after the run has fully drained is cleanly rejected with `undefined` —
 	* never silently dropped, never hangs `execute`). Emits {@link RunnerEventMap.spawn}
-	* with a `parent` of `undefined` (this call has no spawning unit) once accepted.
+	* with a `parent` of `undefined` (this call has no spawning unit) after acceptance.
 	*
 	* @param input - The unit's work payload
 	* @returns The unit's result promise, or `undefined` when no in-flight run can accept it
@@ -2927,11 +3434,11 @@ var Runner = class {
 		return this.#launch(input, void 0, true);
 	}
 	async execute(inputs) {
-		if (this.#started) throw new Error("runner has already executed");
-		if (this.#stopped) throw new Error("runner is stopped");
+		if (this.#started) throw new WorkflowError("TRANSITION", "runner has already executed", { started: true });
+		if (this.#stopped) throw new WorkflowError("TRANSITION", "runner is stopped", { stopped: true });
 		this.#started = true;
 		this.#running = true;
-		const drained = createDeferred();
+		const drained = Promise.withResolvers();
 		this.#drained = drained;
 		for (const input of inputs) {
 			if (!this.#accepts()) break;
@@ -2952,23 +3459,23 @@ var Runner = class {
 	}
 	abort(reason) {
 		if (this.#abortPromise !== void 0) return this.#abortPromise;
-		const barrier = createDeferred();
+		const barrier = Promise.withResolvers();
 		this.#abortPromise = barrier.promise;
 		barrier.promise.catch(() => {});
-		if (this.#running && this.#failure === void 0) this.#failure = { error: reason === void 0 ? /* @__PURE__ */ new Error("runner aborted") : reason };
+		if (this.#running && this.#failure === void 0) this.#failure = failure(reason === void 0 ? /* @__PURE__ */ new Error("runner aborted") : reason);
 		this.#cancel(reason);
 		this.#stopped = true;
 		const cleanup = this.#queue.abort(reason);
-		this.#settleLifecycle(barrier, cleanup);
+		this.#settleBarrier(barrier, cleanup, false);
 		this.#emitter.emit("abort", reason);
 		return barrier.promise;
 	}
 	/**
-	* Suspend dispatch (AGENTS §10 — resumable): delegates to the backing queue's own
-	* `pause`, which holds the NEXT dispatch while any in-flight unit finishes.
+	* Suspends dispatch (resumable): delegates to the backing queue's own
+	* `pause`, which holds the next dispatch while any in-flight unit finishes.
 	*
 	* @remarks
-	* A no-op once the runner is `stopped` — a stopped runner has no dispatch left to
+	* A no-op after the runner is `stopped` — a stopped runner has no dispatch left to
 	* suspend, mirroring the guard `stop()` itself applies. Also a no-op when already
 	* `paused` (the queue's own `pause` is idempotent), so calling it repeatedly is safe.
 	*/
@@ -2977,11 +3484,11 @@ var Runner = class {
 		this.#queue.pause();
 	}
 	/**
-	* Continue a paused runner (AGENTS §10); delegates to the backing queue's `resume`.
+	* Continues a paused runner; delegates to the backing queue's `resume`.
 	*
 	* @remarks
-	* A no-op once the runner is `stopped` (nothing left to resume) and a no-op when the
-	* runner is not currently `paused`, so calling it repeatedly or on a never-paused
+	* A no-op after the runner is `stopped` (nothing left to resume) and a no-op when the
+	* runner is not `paused`, so calling it repeatedly or on a never-paused
 	* runner is safe.
 	*/
 	resume() {
@@ -2989,10 +3496,10 @@ var Runner = class {
 		this.#queue.resume();
 	}
 	/**
-	* Permanently end the runner (AGENTS §10) — a GRACEFUL stop, distinct from `abort`.
+	* Ends the runner permanently — a graceful stop, distinct from `abort`.
 	* Marks the runner `stopping` + `stopped`, then stops the backing queue: every
-	* still-PENDING (never-dispatched) unit is rejected by the queue with its own
-	* "queue is stopped" error, WITHOUT running its handler; every already-in-flight unit
+	* still-pending (never-dispatched) unit is rejected by the queue with its own
+	* "queue is stopped" error, without running its handler; every already-in-flight unit
 	* keeps running to completion and settles normally. `#settle` reads `#stopping` to
 	* classify a never-dispatched unit's rejection as a stop artifact (decrement the count
 	* gate, no recorded failure, no fail-fast trip) rather than a genuine failure — a
@@ -3002,24 +3509,24 @@ var Runner = class {
 		if (this.#destroyPromise !== void 0) return this.#destroyPromise;
 		if (this.#abortPromise !== void 0) return this.#abortPromise;
 		if (this.#stopPromise !== void 0) return this.#stopPromise;
-		const barrier = createDeferred();
+		const barrier = Promise.withResolvers();
 		this.#stopPromise = barrier.promise;
 		barrier.promise.catch(() => {});
 		this.#stopping = true;
 		this.#stopped = true;
 		const cleanup = this.#queue.stop();
-		this.#settleLifecycle(barrier, cleanup);
+		this.#settleBarrier(barrier, cleanup, false);
 		return barrier.promise;
 	}
 	destroy() {
 		if (this.#destroyPromise !== void 0) return this.#destroyPromise;
-		const barrier = createDeferred();
+		const barrier = Promise.withResolvers();
 		this.#destroyPromise = barrier.promise;
 		barrier.promise.catch(() => {});
 		this.#stopped = true;
 		this.abort();
 		const cleanup = this.#queue.destroy();
-		this.#settleDestroy(barrier, cleanup);
+		this.#settleBarrier(barrier, cleanup, true);
 		return barrier.promise;
 	}
 	#launch(input, parent, announce = parent !== void 0) {
@@ -3047,33 +3554,27 @@ var Runner = class {
 		} catch (error) {
 			promise = Promise.reject(error);
 		}
-		promise.then((value) => this.#settle(id, {
-			ok: true,
-			value
-		}), (error) => this.#settle(id, {
-			ok: false,
-			error
-		}));
+		promise.then((value) => this.#settle(id, success(value)), (error) => this.#settle(id, failure(error)));
 		return promise;
 	}
-	#dispatch(unit, execution) {
+	#dispatch(unit, context) {
 		const abort = this.#aborts.get(unit.id);
-		if (abort === void 0) throw new Error("unit abort missing");
+		if (abort === void 0) throw new WorkflowError("INVARIANT", "unit abort missing", { unit: unit.id });
 		this.#dispatched.add(unit.id);
-		const controller = new Controller(unit.id, unit.input, abort, execution.signal, (input) => this.#spawn(input, unit.id));
+		const controller = new Controller(unit.id, unit.input, abort, context.signal, (input) => this.#spawn(input, unit.id));
 		this.#emitter.emit("unit", unit.id);
 		return this.#handler(controller);
 	}
 	#spawn(input, parent) {
-		if (!this.#accepts()) throw new Error("spawn is unavailable outside an active run");
+		if (!this.#accepts()) throw new WorkflowError("TRANSITION", "spawn is unavailable outside an active run", { parent });
 		return this.#launch(input, parent);
 	}
 	#settle(id, outcome) {
-		if (outcome.ok) {
-			this.#values.set(id, { value: outcome.value });
+		if (outcome.success) {
+			this.#values.set(id, outcome);
 			this.#emitter.emit("settle", id);
 		} else if (this.#stopping && this.#queued.has(id) && !this.#dispatched.has(id)) {} else if (this.#failure === void 0) {
-			this.#failure = { error: outcome.error };
+			this.#failure = failure(outcome.error);
 			this.#emitter.emit("fail", id, outcome.error);
 			this.abort(outcome.error);
 		}
@@ -3098,31 +3599,20 @@ var Runner = class {
 			await cleanup;
 			return;
 		} catch (error) {
-			return { error };
+			return failure(error);
 		}
 	}
-	async #settleLifecycle(barrier, cleanup) {
-		let failure;
+	async #settleBarrier(barrier, cleanup, teardown) {
+		let cleanupFailure;
 		try {
 			await cleanup;
 		} catch (error) {
-			failure = { error };
+			cleanupFailure = failure(error);
 		}
 		await this.#waitDrain();
-		if (failure === void 0) barrier.resolve();
-		else barrier.reject(failure.error);
-	}
-	async #settleDestroy(barrier, cleanup) {
-		let failure;
-		try {
-			await cleanup;
-		} catch (error) {
-			failure = { error };
-		}
-		await this.#waitDrain();
-		this.#emitter.destroy();
-		if (failure === void 0) barrier.resolve();
-		else barrier.reject(failure.error);
+		if (teardown) this.#emitter.destroy();
+		if (cleanupFailure === void 0) barrier.resolve();
+		else barrier.reject(cleanupFailure.error);
 	}
 	async #waitDrain() {
 		if (this.#count === 0) return;
@@ -3135,49 +3625,61 @@ var Runner = class {
 //#endregion
 //#region src/core/tasks/TaskController.ts
 /**
-* The attempt-scoped handle a {@link import('./types.js').WorkflowFunction} receives.
+* Implements the attempt-scoped handle a {@link import('./types.js').WorkflowFunction} receives.
 *
 * @remarks
-* - **A leaf handle, NOT the runner `Controller`.** A workflow task is a leaf of the
+* - **A leaf handle, not the runner `Controller`.** A workflow task is a leaf of the
 *   declarative W-b tree, not a fan-out unit, so it has no `spawn`; its `wait` instead
 *   checkpoints the workflow, phase, and task cooperative gates.
-* - **Folded signal.** `signal` is the cancellation folded for THIS attempt: its per-attempt
+* - **Folded signal.** `signal` is the cancellation folded for this attempt: its per-attempt
 *   deadline, task stop/skip, workflow abort/timeout/budget/destroy, or a sibling fail-fast.
 *   A handler races its work against it; `aborted` reads it.
 * - **Attempt ownership.** `report` / `pulse` are closures supplied by the runner and refuse
 *   after this signal aborts or a retry token supersedes this handle.
 * - **Input + lineage.** `input` is the task's open `metadata` bag (its
 *   {@link import('./types.js').TaskInput} payload, `{}` when none); `task` is the full
-*   {@link TaskContext}, so `task.phase` / `task.phase.workflow` navigate UP the lineage.
+*   {@link TaskContext}, so `task.phase` / `task.phase.workflow` navigate up the lineage.
 * - **Read-up results.** `results()` returns every settled task's {@link TaskResult} across
 *   the phases that have already finished (a closure over the live
 *   {@link import('./types.js').WorkflowInterface}), so a `function` task can read an earlier
-*   phase's output. Read-only — a task records its OWN outcome by returning / throwing, not
+*   phase's output. Read-only — a task records its own outcome by returning / throwing, not
 *   by mutating the tree.
 * - **Event-free.** Like the runner `Controller`, the per-task handle carries no Emitter;
 *   observe the W-b entities' own emitters (`task.emitter` / `phase.emitter`) instead.
 */
 var TaskController = class {
-	signal;
-	input;
-	task;
-	attempt;
+	#signal;
+	#input;
+	#task;
+	#attempt;
 	#entity;
 	#report;
 	#pulse;
 	#results;
 	constructor(signal, input, task, attempt, results, report, pulse) {
-		this.signal = signal;
-		this.input = input;
-		this.task = task.context;
-		this.attempt = attempt;
+		this.#signal = signal;
+		this.#input = input;
+		this.#task = task.context;
+		this.#attempt = attempt;
 		this.#entity = task;
 		this.#results = results;
 		this.#report = report;
 		this.#pulse = pulse;
 	}
+	get signal() {
+		return this.#signal;
+	}
+	get input() {
+		return this.#input;
+	}
+	get task() {
+		return this.#task;
+	}
+	get attempt() {
+		return this.#attempt;
+	}
 	get aborted() {
-		return this.signal.aborted;
+		return this.#signal.aborted;
 	}
 	get paused() {
 		if (this.#ancestorTerminal()) return false;
@@ -3190,7 +3692,7 @@ var TaskController = class {
 		return this.#pulse();
 	}
 	async wait() {
-		while (this.paused && !this.signal.aborted) await this.#race(this.#gates());
+		while (this.paused && !this.#signal.aborted) await this.#race(this.#gates());
 	}
 	results() {
 		return this.#results();
@@ -3204,11 +3706,11 @@ var TaskController = class {
 		return gates;
 	}
 	async #race(gates) {
-		if (this.signal.aborted || gates.length === 0) return;
+		if (this.#signal.aborted || gates.length === 0) return;
 		const deferred = Promise.withResolvers();
 		const onAbort = this.#resolve.bind(this, deferred);
 		const onTerminal = this.#resolve.bind(this, deferred);
-		this.signal.addEventListener("abort", onAbort, { once: true });
+		this.#signal.addEventListener("abort", onAbort, { once: true });
 		this.#entity.workflow.emitter.on("skip", onTerminal);
 		this.#entity.workflow.emitter.on("stop", onTerminal);
 		this.#entity.phase.emitter.on("skip", onTerminal);
@@ -3217,7 +3719,7 @@ var TaskController = class {
 			if (this.#ancestorTerminal()) deferred.resolve();
 			await Promise.race([Promise.all(gates), deferred.promise]);
 		} finally {
-			this.signal.removeEventListener("abort", onAbort);
+			this.#signal.removeEventListener("abort", onAbort);
 			this.#entity.workflow.emitter.off("skip", onTerminal);
 			this.#entity.workflow.emitter.off("stop", onTerminal);
 			this.#entity.phase.emitter.off("skip", onTerminal);
@@ -3234,24 +3736,34 @@ var TaskController = class {
 //#endregion
 //#region src/core/WorkflowPersistence.ts
 /**
-* Advanced run-local snapshot persistence with one writer and one coalesced latest obligation.
+* Coordinates advanced run-local snapshot persistence with one writer and one coalesced most
+* recent obligation, normally composed through `execute({ store })` rather than built directly.
 *
 * @remarks
-* Normally composed by `WorkflowRunner.execute({ store })`; exported for hosts that need to
-* coordinate the same required boundaries around their own runner integration.
+* Exported for hosts that need to coordinate the same required boundaries around their own runner
+* integration.
+*
+* @example
+* ```ts
+* import { WorkflowPersistence, createMemoryWorkflowStore, createWorkflow } from '@orkestrel/workflow'
+*
+* const workflow = createWorkflow({ id: 'durable', name: 'Durable', phases: [] })
+* const persistence = new WorkflowPersistence(workflow, createMemoryWorkflowStore())
+* await persistence.checkpoint('initial')
+* const durable = await persistence.finalize()
+* persistence.detach() // idempotent after finalize
+* ```
 */
 var WorkflowPersistence = class {
 	#workflow;
 	#store;
 	#phases = /* @__PURE__ */ new Set();
 	#tasks = /* @__PURE__ */ new Set();
-	#onWorkflowChange;
+	#onChange;
 	#onWorkflowAdd;
 	#onWorkflowRemove;
-	#onPhaseChange;
 	#onPhaseAdd;
 	#onPhaseRemove;
-	#onTaskChange;
 	#writing;
 	#error;
 	#fault;
@@ -3261,32 +3773,29 @@ var WorkflowPersistence = class {
 	constructor(workflow, store) {
 		this.#workflow = workflow;
 		this.#store = store;
-		this.#onWorkflowChange = this.#change.bind(this);
+		this.#onChange = this.#change.bind(this);
 		this.#onWorkflowAdd = this.#addPhase.bind(this);
 		this.#onWorkflowRemove = this.#removePhase.bind(this);
-		this.#onPhaseChange = this.#change.bind(this);
 		this.#onPhaseAdd = this.#addTask.bind(this);
 		this.#onPhaseRemove = this.#removeTask.bind(this);
-		this.#onTaskChange = this.#change.bind(this);
 		this.#attachWorkflow();
 	}
 	get fault() {
 		return this.#fault;
 	}
 	/**
-	* Persist every change through this required boundary.
+	* Persists every change through this required boundary.
 	*
 	* @param checkpoint - The boundary being made durable
 	* @param task - The task owning an attempt or settlement
 	* @param attempt - The persisted attempt number
-	* @returns Whether the latest state reached the store
+	* @returns True if the most recent state reached the store; false otherwise
 	*/
 	async checkpoint(checkpoint, task, attempt) {
 		const revision = this.#mark();
 		while (this.#stored < revision) await this.#flush();
 		if (this.#error === void 0) return true;
 		if (this.#fault === void 0) this.#fault = Object.freeze({
-			origin: "persistence",
 			checkpoint,
 			message: this.#error,
 			...task === void 0 ? {} : { task: task.id },
@@ -3295,37 +3804,25 @@ var WorkflowPersistence = class {
 		return false;
 	}
 	/**
-	* Stop observing the live tree and persist its final state.
+	* Stops observing the live tree and persists its final state.
 	*
-	* @returns Whether the final snapshot reached the store
+	* @returns True if the final snapshot reached the store; false otherwise
 	*/
 	async finalize() {
 		this.detach();
 		return this.checkpoint("final");
 	}
-	/** Stop observing the live tree. */
+	/** Stops observing the live tree. */
 	detach() {
 		if (!this.#attached) return;
 		this.#attached = false;
-		this.#workflow.emitter.off("start", this.#onWorkflowChange);
-		this.#workflow.emitter.off("complete", this.#onWorkflowChange);
-		this.#workflow.emitter.off("fail", this.#onWorkflowChange);
-		this.#workflow.emitter.off("skip", this.#onWorkflowChange);
-		this.#workflow.emitter.off("stop", this.#onWorkflowChange);
-		this.#workflow.emitter.off("move", this.#onWorkflowChange);
-		this.#workflow.emitter.off("update", this.#onWorkflowChange);
+		for (const event of PERSISTED_NODE_EVENTS) this.#workflow.emitter.off(event, this.#onChange);
 		this.#workflow.emitter.off("add", this.#onWorkflowAdd);
 		this.#workflow.emitter.off("remove", this.#onWorkflowRemove);
 		for (const phase of this.#phases) this.#detachPhase(phase);
 	}
 	#attachWorkflow() {
-		this.#workflow.emitter.on("start", this.#onWorkflowChange);
-		this.#workflow.emitter.on("complete", this.#onWorkflowChange);
-		this.#workflow.emitter.on("fail", this.#onWorkflowChange);
-		this.#workflow.emitter.on("skip", this.#onWorkflowChange);
-		this.#workflow.emitter.on("stop", this.#onWorkflowChange);
-		this.#workflow.emitter.on("move", this.#onWorkflowChange);
-		this.#workflow.emitter.on("update", this.#onWorkflowChange);
+		for (const event of PERSISTED_NODE_EVENTS) this.#workflow.emitter.on(event, this.#onChange);
 		this.#workflow.emitter.on("add", this.#onWorkflowAdd);
 		this.#workflow.emitter.on("remove", this.#onWorkflowRemove);
 		for (const phase of this.#workflow.phases.phases()) this.#attachPhase(phase);
@@ -3333,26 +3830,14 @@ var WorkflowPersistence = class {
 	#attachPhase(phase) {
 		if (this.#phases.has(phase)) return;
 		this.#phases.add(phase);
-		phase.emitter.on("start", this.#onPhaseChange);
-		phase.emitter.on("complete", this.#onPhaseChange);
-		phase.emitter.on("fail", this.#onPhaseChange);
-		phase.emitter.on("skip", this.#onPhaseChange);
-		phase.emitter.on("stop", this.#onPhaseChange);
-		phase.emitter.on("move", this.#onPhaseChange);
-		phase.emitter.on("update", this.#onPhaseChange);
+		for (const event of PERSISTED_NODE_EVENTS) phase.emitter.on(event, this.#onChange);
 		phase.emitter.on("add", this.#onPhaseAdd);
 		phase.emitter.on("remove", this.#onPhaseRemove);
 		for (const task of phase.tasks.tasks()) this.#attachTask(task);
 	}
 	#detachPhase(phase) {
 		if (!this.#phases.delete(phase)) return;
-		phase.emitter.off("start", this.#onPhaseChange);
-		phase.emitter.off("complete", this.#onPhaseChange);
-		phase.emitter.off("fail", this.#onPhaseChange);
-		phase.emitter.off("skip", this.#onPhaseChange);
-		phase.emitter.off("stop", this.#onPhaseChange);
-		phase.emitter.off("move", this.#onPhaseChange);
-		phase.emitter.off("update", this.#onPhaseChange);
+		for (const event of PERSISTED_NODE_EVENTS) phase.emitter.off(event, this.#onChange);
 		phase.emitter.off("add", this.#onPhaseAdd);
 		phase.emitter.off("remove", this.#onPhaseRemove);
 		for (const task of phase.tasks.tasks()) this.#detachTask(task);
@@ -3360,23 +3845,11 @@ var WorkflowPersistence = class {
 	#attachTask(task) {
 		if (this.#tasks.has(task)) return;
 		this.#tasks.add(task);
-		task.emitter.on("start", this.#onTaskChange);
-		task.emitter.on("complete", this.#onTaskChange);
-		task.emitter.on("fail", this.#onTaskChange);
-		task.emitter.on("skip", this.#onTaskChange);
-		task.emitter.on("stop", this.#onTaskChange);
-		task.emitter.on("report", this.#onTaskChange);
-		task.emitter.on("pulse", this.#onTaskChange);
+		for (const event of PERSISTED_TASK_EVENTS) task.emitter.on(event, this.#onChange);
 	}
 	#detachTask(task) {
 		if (!this.#tasks.delete(task)) return;
-		task.emitter.off("start", this.#onTaskChange);
-		task.emitter.off("complete", this.#onTaskChange);
-		task.emitter.off("fail", this.#onTaskChange);
-		task.emitter.off("skip", this.#onTaskChange);
-		task.emitter.off("stop", this.#onTaskChange);
-		task.emitter.off("report", this.#onTaskChange);
-		task.emitter.off("pulse", this.#onTaskChange);
+		for (const event of PERSISTED_TASK_EVENTS) task.emitter.off(event, this.#onChange);
 	}
 	#addPhase(phase) {
 		this.#attachPhase(phase);
@@ -3434,82 +3907,83 @@ var WorkflowPersistence = class {
 //#endregion
 //#region src/core/WorkflowRunner.ts
 /**
-* The thin orchestrator that EXECUTES a live W-b workflow tree by COMPOSING the shipped
-* substrate — phases sequential, tasks concurrent — dispatching each task through its OWN
+* Implements the thin orchestrator that executes a live W-b workflow tree by composing the shipped
+* substrate — phases sequential, tasks concurrent — dispatching each task through its own
 * resolved handler under the `bail` policy.
 *
 * @remarks
 * - **Composes, never re-implements.** Per-phase bounded concurrency is one
-*   {@link createRunner} per phase (the substrate {@link RunnerInterface} over the workers
+*   {@link createRunner} per phase (the substrate {@link import('./types.js').RunnerInterface}
+*   over the workers
 *   `Queue`); `bail` maps onto that Runner's fail-fast vs settle-all; the run-level abort /
 *   timeout / budget / entity `signal` fold through the `@orkestrel/abort` signal contract,
 *   {@link createTimeout}, and `AbortSignal.any` (exactly as the agent runtime folds its bounds);
 *   pacing is the shipped
-*   {@link SchedulerInterface}. The runner writes ZERO concurrency / retry / abort logic of
+*   {@link SchedulerInterface}. The runner writes zero concurrency / retry / abort logic of
 *   its own — it only sequences phases, dispatches a task's own handler, and drives the live
 *   entity. The workflow layer owns per-task deadlines because timeout settlement must
 *   update the live leaf under the phase's `bail` policy before the substrate unit settles.
 * - **Pure engine — no integration registry.** The runner carries no behavior or provider
 *   registry: each live {@link TaskInterface} already
 *   resolved its own {@link import('./types.js').WorkflowFunction} into
-*   {@link import('./types.js').TaskInterface.handler} ONCE at construction (build, restore,
+*   {@link import('./types.js').TaskInterface.handler} once at construction (build, restore,
 *   or a live mint all resolve it identically, from {@link WorkflowOptions.functions}), so
-*   dispatch is simply "invoke the task's own handler". Provider, protocol, and tool
+*   dispatch is "invoke the task's own handler". Provider, protocol, and tool
 *   integrations remain application-owned {@link import('./types.js').WorkflowFunction}s
 *   composed into {@link WorkflowOptions.functions}. This module imports none of them.
-* - **Two `execute` forms, one engine.** `execute(definition, options)` BUILDS the live tree
-*   from a {@link WorkflowDefinition} (single source of truth for the `run` / `concurrency`
-*   metadata); `execute(workflow, options)` DRIVES a caller-owned, ALREADY-BUILT
-*   {@link WorkflowInterface} instead — the entity-native control surface (AGENTS §10:
-*   `pause` / `resume` / `add` / `stop` / `destroy` live on the entity itself). Both forms
-*   converge on the SAME `#execute` engine: neither reads a `WorkflowDefinition` once the tree
-*   exists — `#runTask` reads each task's OWN {@link import('./types.js').TaskInterface.handler}
-*   / `retries` / `timeout`, and `#runPhase` reads each phase's OWN
+* - **Two `execute` forms, one engine.** `execute(definition, options)` builds the live tree
+*   from a {@link WorkflowDefinition} (single source of truth for the `behavior` / `concurrency`
+*   metadata); `execute(workflow, options)` drives a caller-owned, already-built
+*   {@link WorkflowInterface} instead — the entity-native control surface
+*   (`pause` / `resume` / `add` / `stop` / `destroy` live on the entity itself). Both forms
+*   converge on the same `#execute` engine: neither reads a `WorkflowDefinition` after the tree
+*   exists — `#runTask` reads each task's own {@link import('./types.js').TaskInterface.handler}
+*   / `retries` / `timeout`, and `#runPhase` reads each phase's own
 *   {@link PhaseInterface.concurrency} / `bail`, so a live `add`-minted phase or task (V5)
-*   runs under EXACTLY the same rules as one built from the original definition.
-* - **Phases sequential, tasks concurrent — LIVE continuity.** `#execute` drives the phases in
-*   order, RE-READING `workflow.phases.phases()` every iteration (a cursor over the live
+*   runs under exactly the same rules as one built from the original definition.
+* - **Phases sequential, tasks concurrent — live continuity.** `#execute` drives the phases in
+*   order, re-reading `workflow.phases.phases()` every iteration (a cursor over the live
 *   manager, not a one-time snapshot) so a caller's `workflow.add(phaseDefinition)` mid-run is
-*   picked up. Within a phase, `#runPhase` subscribes to that phase's `add` event BEFORE
-*   capturing its task list, then `spawn`s any task added mid-phase onto the SAME substrate
+*   picked up. Within a phase, `#runPhase` subscribes to that phase's `add` event before
+*   capturing its task list, then `spawn`s any task added mid-phase onto the same substrate
 *   Runner (so it is actually dispatched, under the same `concurrency`); a task added too late
 *   for `spawn` to accept (the runner already drained) is swept `skip`ped afterward so the
 *   phase always reaches a coherent terminal state.
 * - **Dispatch by handler.** `#runTask` invokes the live task's own
-*   {@link import('./types.js').TaskInterface.handler} directly. An omitted `run` deliberately
+*   {@link import('./types.js').TaskInterface.handler} directly. An omitted `behavior` deliberately
 *   auto-completes with JSON `null`; a present unresolved name is rejected by the synchronous
 *   execution claim and never false-completes.
 * - **`bail` → substrate.** Under `bail: true` (halt) a genuine task failure `fail`s the leaf
-*   THEN re-throws, so the substrate Runner fail-fasts — it aborts the in-flight siblings
+*   then re-throws, so the substrate Runner fail-fasts — it aborts the in-flight siblings
 *   (their `controller.signal` fires; a mid-flight sibling `skip`s) and rejects the phase run;
 *   `#execute` then `skip`s the remaining tasks / phases (the workflow derives `failed`).
-*   Under `bail: false` (graceful) a failure `fail`s the leaf and RESOLVES (never throws), so
+*   Under `bail: false` (graceful) a failure `fail`s the leaf and resolves (never throws), so
 *   the Runner settles every unit (allSettled) and the run finishes (the workflow derives
 *   `completed`, the failure recorded in the result tree).
 * - **Pause / stop / destroy gates.** Workflow, phase, and task gates are checked before
 *   dispatch, and a running handler can checkpoint their folded state through
 *   {@link import('./types.js').TaskControllerInterface.wait}. Because the substrate acquires
 *   concurrency before this handler gate, a paused task occupies one phase slot until resume;
-*   already-running siblings continue and its per-attempt timeout keeps counting. A GRACEFUL
+*   already-running siblings continue and its per-attempt timeout keeps counting. A graceful
 *   `workflow.stop()` (no signal involved) is caught at
 *   those same gates: not-yet-started work is `skip`ped, in-flight work finishes naturally. A
-*   HARD `workflow.destroy()` aborts {@link WorkflowInterface.signal}, which `#fold` has folded
+*   hard `workflow.destroy()` aborts {@link WorkflowInterface.signal}, which `#fold` has folded
 *   into the run's composed signal — so it cancels the active phase Runner (and every
-*   in-flight task) exactly like an external abort / timeout / budget fire. EVERY park on a
-*   `wait()` gate is RACED against that same run signal (`#raceWait`, S2) — so a cancel firing
-*   WHILE parked unparks the engine promptly instead of hanging until `resume`; the existing
+*   in-flight task) exactly like an external abort / timeout / budget fire. Every park on a
+*   `wait()` gate is raced against that same run signal (`#raceWait`, S2) — so a cancel firing
+*   while parked unparks the engine promptly instead of hanging until `resume`; the existing
 *   halt / abort re-checks after the gate then decide the outcome.
 * - **Abort / Timeout / Budget / entity-signal fold.** `#execute` folds the live workflow's
 *   own {@link WorkflowInterface.signal}, the run's external `signal`, a
 *   {@link TimeoutInterface}, and the `@orkestrel/budget` package's `BudgetInterface`'s
 *   `signal` into one `runSignal` (`AbortSignal.any`); a fire aborts the active phase's Runner
-*   (cancelling every in-flight task) and HALTS the run — the remaining tasks / phases `skip`
+*   (cancelling every in-flight task) and halts the run — the remaining tasks / phases `skip`
 *   and the workflow is force-`stop`ped (settles `stopped`). Each task's
 *   {@link TaskController} signal `AbortSignal.any`-combines the substrate per-unit signal with
 *   `runSignal`, so a handler observes either cause directly.
-* - **Re-entrant-safe.** No shared per-run mutable field: the active-Runner holder is LOCAL to
-*   each `#execute`, so a nested application-level `execute` cannot clobber the outer run's
-*   state.
+* - **Re-entrant-safe.** No shared per-run mutable field: each `#execute` mints its own
+*   {@link import('./RunHolder.js').RunHolder}, so a nested application-level `execute` cannot
+*   clobber the outer run's state.
 */
 var WorkflowRunner = class WorkflowRunner {
 	static #executions = /* @__PURE__ */ new WeakSet();
@@ -3518,7 +3992,7 @@ var WorkflowRunner = class WorkflowRunner {
 		this.#scheduler = scheduler;
 	}
 	execute(target, options) {
-		if (this.#isWorkflow(target)) {
+		if (isWorkflowInterface(target)) {
 			const signal = options?.signal;
 			const timeout = options?.timeout;
 			const budget = options?.budget;
@@ -3531,7 +4005,7 @@ var WorkflowRunner = class WorkflowRunner {
 		const timeout = options?.timeout;
 		const budget = options?.budget;
 		const store = options?.store;
-		const workflow = new Workflow(definitionToSnapshot(target, captured.bail ?? target.bail ?? false), captured);
+		const workflow = createWorkflowTree(target, captured);
 		this.#acquire(workflow);
 		return this.#execute(workflow, signal, timeout, budget, store);
 	}
@@ -3545,7 +4019,7 @@ var WorkflowRunner = class WorkflowRunner {
 		WorkflowRunner.#executions.add(workflow);
 	}
 	async #execute(workflow, signal, ms, budget, store) {
-		const holder = { runner: void 0 };
+		const holder = new RunHolder();
 		let timeout;
 		let persistence;
 		let runSignal;
@@ -3560,7 +4034,7 @@ var WorkflowRunner = class WorkflowRunner {
 			if (runSignal.aborted) onCancel();
 			else runSignal.addEventListener("abort", onCancel, { once: true });
 			if (persistence !== void 0 && !await persistence.checkpoint("initial")) {
-				if (this.#stoppable(workflow)) workflow.stop();
+				if (isStoppable(workflow)) workflow.stop();
 				this.#skipFrom(workflow.phases.phases(), 0);
 			}
 			let index = 0;
@@ -3572,12 +4046,12 @@ var WorkflowRunner = class WorkflowRunner {
 					index += 1;
 					continue;
 				}
-				if (this.#cancelled(runSignal) || this.#halted(workflow)) {
+				if (runSignal.aborted || isHalted(workflow)) {
 					this.#haltFrom(phases, index, workflow, runSignal);
 					break;
 				}
 				if (workflow.paused) await this.#raceWait(workflow.wait(), runSignal, void 0, workflow);
-				if (this.#cancelled(runSignal) || this.#halted(workflow)) {
+				if (runSignal.aborted || isHalted(workflow)) {
 					this.#haltFrom(workflow.phases.phases(), index, workflow, runSignal);
 					break;
 				}
@@ -3592,10 +4066,10 @@ var WorkflowRunner = class WorkflowRunner {
 				}
 				index += 1;
 				const remaining = workflow.phases.phases();
-				if (index < remaining.length && !this.#cancelled(runSignal)) await this.#pace(runSignal);
+				if (index < remaining.length && !runSignal.aborted) await this.#pace(runSignal);
 			}
-			if (this.#cancelled(runSignal)) this.#haltFrom(workflow.phases.phases(), 0, workflow, runSignal);
-			else if (this.#completable(workflow)) workflow.complete();
+			if (runSignal.aborted) this.#haltFrom(workflow.phases.phases(), 0, workflow, runSignal);
+			else if (isCompletable(workflow)) workflow.complete();
 			const durable = await persistence?.finalize();
 			return {
 				workflow,
@@ -3605,7 +4079,7 @@ var WorkflowRunner = class WorkflowRunner {
 				...persistence?.fault === void 0 ? {} : { fault: persistence.fault }
 			};
 		} catch (error) {
-			if (this.#stoppable(workflow)) workflow.stop();
+			if (isStoppable(workflow)) workflow.stop();
 			this.#skipFrom(workflow.phases.phases(), 0);
 			await persistence?.finalize();
 			throw error;
@@ -3640,22 +4114,22 @@ var WorkflowRunner = class WorkflowRunner {
 				entries: this.#entry.bind(this),
 				handler: this.#runUnit.bind(this, workflow, runSignal, bail, attempts, owners, persistence)
 			});
-			holder.runner = created;
+			holder.hold(created);
 			try {
 				await created.execute(tasks);
 				return false;
 			} catch {
-				return !this.#cancelled(runSignal);
+				return !runSignal.aborted;
 			} finally {
 				try {
 					await created.destroy();
 				} finally {
-					holder.runner = void 0;
+					holder.hold();
 				}
 			}
 		} finally {
 			phase.emitter.off("add", onAdd);
-			if (this.#cancelled(runSignal) && this.#stoppable(workflow)) workflow.stop();
+			if (runSignal.aborted && isStoppable(workflow)) workflow.stop();
 			for (const task of phase.tasks.tasks()) this.#skip(task);
 		}
 	}
@@ -3679,7 +4153,7 @@ var WorkflowRunner = class WorkflowRunner {
 		attempts.set(task.id, attempt);
 		const last = attempt > Math.max(0, task.retries ?? 0);
 		if (task.status !== "pending" && task.status !== "running") return;
-		if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+		if (isSkipping(task, controller, runSignal) || isHalted(workflow, task.phase)) {
 			this.#settleCancelled(task, workflow, runSignal);
 			return;
 		}
@@ -3692,15 +4166,15 @@ var WorkflowRunner = class WorkflowRunner {
 			owners.set(task.id, attempt);
 			deadline?.start();
 			const durable = persistence === void 0 ? true : await persistence.checkpoint("attempt", task, attempt);
-			if (!this.#owns(owners, task, attempt)) return;
+			if (!ownsAttempt(owners, task, attempt)) return;
 			if (!durable) {
-				if (this.#stoppable(workflow)) workflow.stop();
+				if (isStoppable(workflow)) workflow.stop();
 				return;
 			}
-			if (task.run !== void 0 && task.handler === void 0) {
-				const error = new WorkflowError("TRANSITION", `task '${task.id}' has an unresolved run '${task.run}'`, {
+			if (task.behavior !== void 0 && task.handler === void 0) {
+				const error = new WorkflowError("TRANSITION", `task '${task.id}' has an unresolved behavior '${task.behavior}'`, {
 					task: task.id,
-					run: task.run
+					behavior: task.behavior
 				});
 				task.fail({
 					origin: "handler",
@@ -3712,21 +4186,21 @@ var WorkflowRunner = class WorkflowRunner {
 			if (await this.#gate(workflow.paused ? workflow.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
 			if (await this.#gate(task.phase.paused ? task.phase.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
 			if (await this.#gate(task.paused ? task.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
-			if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+			if (isSkipping(task, controller, runSignal) || isHalted(workflow, task.phase)) {
 				this.#settleCancelled(task, workflow, runSignal);
 				return;
 			}
 			if (task.status !== "running") return;
-			const handle = new TaskController(signal, task.snapshot().metadata, task, attempt, () => workflow.results(), (input) => this.#owns(owners, task, attempt) && !signal.aborted ? task.report(input) : failure(new WorkflowError("TRANSITION", `task '${task.id}' attempt '${attempt}' no longer owns activity`, {
+			const handle = new TaskController(signal, task.snapshot().metadata, task, attempt, () => workflow.results(), (input) => ownsAttempt(owners, task, attempt) && !signal.aborted ? task.report(input) : failure(new WorkflowError("TRANSITION", `task '${task.id}' attempt '${attempt}' no longer owns activity`, {
 				task: task.id,
 				attempt
-			})), () => this.#owns(owners, task, attempt) && !signal.aborted && task.pulse());
+			})), () => ownsAttempt(owners, task, attempt) && !signal.aborted && task.pulse());
 			let outcome;
 			try {
-				outcome = task.handler === void 0 ? [true, null] : await this.#raceHandler(Promise.resolve(task.handler(handle)), signal, this.#skipping.bind(this, task, controller, runSignal));
+				outcome = task.handler === void 0 ? [true, null] : await this.#raceHandler(Promise.resolve(task.handler(handle)), signal, () => isSkipping(task, controller, runSignal));
 			} catch (error) {
-				if (!this.#owns(owners, task, attempt)) return;
-				if (task.status !== "running" || this.#skipping(task, controller, runSignal)) {
+				if (!ownsAttempt(owners, task, attempt)) return;
+				if (task.status !== "running" || isSkipping(task, controller, runSignal)) {
 					this.#settleCancelled(task, workflow, runSignal);
 					return;
 				}
@@ -3737,13 +4211,13 @@ var WorkflowRunner = class WorkflowRunner {
 				this.#failed(owners, task, attempt, error, last, bail);
 				return;
 			}
-			if (!this.#owns(owners, task, attempt)) return;
+			if (!ownsAttempt(owners, task, attempt)) return;
 			if (!outcome[0]) {
 				this.#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, outcome[2]);
 				return;
 			}
 			if (task.status !== "running") return;
-			if (this.#skipping(task, controller, runSignal)) {
+			if (isSkipping(task, controller, runSignal)) {
 				this.#settleCancelled(task, workflow, runSignal);
 				return;
 			}
@@ -3751,32 +4225,32 @@ var WorkflowRunner = class WorkflowRunner {
 				this.#timedOut(owners, task, attempt, last, bail);
 				return;
 			}
-			if (!this.#owns(owners, task, attempt)) return;
+			if (!ownsAttempt(owners, task, attempt)) return;
 			try {
 				task.complete(outcome[1]);
 			} catch (error) {
-				if (!this.#owns(owners, task, attempt)) return;
+				if (!ownsAttempt(owners, task, attempt)) return;
 				if (task.status !== "running") throw error;
 				this.#failed(owners, task, attempt, error, last, bail);
 			}
 		} finally {
 			deadline?.clear();
-			if (persistence !== void 0 && this.#owns(owners, task, attempt) && isTerminalStatus(task.status) && !await persistence.checkpoint("settlement", task, attempt) && this.#stoppable(workflow)) workflow.stop();
+			if (persistence !== void 0 && ownsAttempt(owners, task, attempt) && isTerminalStatus(task.status) && !await persistence.checkpoint("settlement", task, attempt) && isStoppable(workflow)) workflow.stop();
 			this.#revoke(owners, task.id, attempt);
 		}
 	}
 	async #gate(wait, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail) {
-		const genuine = wait === void 0 ? void 0 : await this.#raceWait(wait, signal, this.#skipping.bind(this, task, controller, runSignal), workflow, task.phase);
+		const genuine = wait === void 0 ? void 0 : await this.#raceWait(wait, signal, () => isSkipping(task, controller, runSignal), workflow, task.phase);
 		return this.#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, genuine);
 	}
 	#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, genuine) {
-		if (attempts.get(task.id) !== attempt || !this.#owns(owners, task, attempt)) return true;
+		if (attempts.get(task.id) !== attempt || !ownsAttempt(owners, task, attempt)) return true;
 		if (signal.aborted) {
-			if (genuine ?? this.#skipping(task, controller, runSignal)) this.#settleCancelled(task, workflow, runSignal);
+			if (genuine ?? isSkipping(task, controller, runSignal)) this.#settleCancelled(task, workflow, runSignal);
 			else this.#timedOut(owners, task, attempt, last, bail);
 			return true;
 		}
-		if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+		if (isSkipping(task, controller, runSignal) || isHalted(workflow, task.phase)) {
 			this.#settleCancelled(task, workflow, runSignal);
 			return true;
 		}
@@ -3805,7 +4279,7 @@ var WorkflowRunner = class WorkflowRunner {
 		]);
 	}
 	#timedOut(owners, task, attempt, last, bail) {
-		if (!this.#owns(owners, task, attempt)) return;
+		if (!ownsAttempt(owners, task, attempt)) return;
 		const error = /* @__PURE__ */ new Error(`task '${task.id}' timed out`);
 		if (last) task.fail({
 			origin: "timeout",
@@ -3814,7 +4288,7 @@ var WorkflowRunner = class WorkflowRunner {
 		if (!last || bail) throw error;
 	}
 	#failed(owners, task, attempt, error, last, bail) {
-		if (!this.#owns(owners, task, attempt)) return;
+		if (!ownsAttempt(owners, task, attempt)) return;
 		if (!last) throw error;
 		task.fail({
 			origin: "handler",
@@ -3822,9 +4296,6 @@ var WorkflowRunner = class WorkflowRunner {
 		});
 		if (bail) throw error;
 	}
-	#owns(owners, task, attempt) {
-		return owners.get(task.id) === attempt && task.attempts === attempt;
-	}
 	#revoke(owners, id, attempt) {
 		if (owners.get(id) === attempt) owners.delete(id);
 	}
@@ -3839,7 +4310,7 @@ var WorkflowRunner = class WorkflowRunner {
 		phase?.emitter.on("skip", onTerminal);
 		phase?.emitter.on("stop", onTerminal);
 		try {
-			if (workflow !== void 0 && this.#halted(workflow, phase)) deferred.resolve(void 0);
+			if (workflow !== void 0 && isHalted(workflow, phase)) deferred.resolve(void 0);
 			const outcome = await Promise.race([wait, deferred.promise]);
 			return typeof outcome === "boolean" ? outcome : void 0;
 		} finally {
@@ -3870,7 +4341,7 @@ var WorkflowRunner = class WorkflowRunner {
 		return signals.length === 1 ? workflow.signal : AbortSignal.any(signals);
 	}
 	#haltFrom(phases, index, workflow, runSignal) {
-		if (this.#cancelled(runSignal) && this.#stoppable(workflow)) workflow.stop();
+		if (runSignal.aborted && isStoppable(workflow)) workflow.stop();
 		this.#skipFrom(phases, index);
 	}
 	#skipFrom(phases, index) {
@@ -3881,37 +4352,17 @@ var WorkflowRunner = class WorkflowRunner {
 		}
 	}
 	#settleCancelled(task, workflow, runSignal) {
-		if (this.#cancelled(runSignal) && this.#stoppable(workflow)) workflow.stop();
+		if (runSignal.aborted && isStoppable(workflow)) workflow.stop();
 		this.#skip(task);
 	}
 	#skip(task) {
 		if (task.status === "pending" || task.status === "running") task.skip();
 	}
-	#skipping(task, controller, runSignal) {
-		return task.signal.aborted || controller.aborted || runSignal.aborted;
-	}
-	#cancelled(runSignal) {
-		return runSignal.aborted;
-	}
-	#halted(workflow, phase) {
-		const status = workflow.status;
-		return status === "failed" || status === "skipped" || status === "stopped" || phase?.status === "skipped" || phase?.status === "stopped";
-	}
-	#stoppable(workflow) {
-		const status = workflow.status;
-		return status !== "failed" && status !== "stopped";
-	}
-	#completable(workflow) {
-		return workflow.status === "pending";
-	}
-	#isWorkflow(target) {
-		return "destroyed" in target && "snapshot" in target && typeof target.snapshot === "function";
-	}
 };
 //#endregion
 //#region src/core/factories.ts
 /**
-* Compile the workflow definition contract — the JSON Schema, guard, parser, and
+* Compiles the workflow definition contract — the JSON Schema, guard, parser, and
 * seeded generator for a {@link WorkflowDefinition}, all derived from one shape and
 * kept in lockstep.
 *
@@ -3941,23 +4392,23 @@ function createWorkflowContract() {
 	return (0, _orkestrel_contract.createContract)(workflowShape);
 }
 /**
-* Build the live W-b entity tree from a {@link WorkflowDefinition} — the whole
+* Builds the live W-b entity tree from a {@link WorkflowDefinition} — the whole
 * {@link WorkflowInterface} → {@link import('./types.js').PhaseInterface} →
 * {@link import('./types.js').TaskInterface} tree, each level wired with its lineage
-* context, its emitter, and the cascade.
+* context, its emitter, and the cascade, and every node born `pending`.
 *
 * @remarks
-* The definition is the DECLARATIVE blueprint; this seeds an initial all-`pending`
+* The definition is the declarative blueprint; this seeds an initial all-`pending`
 * {@link WorkflowSnapshot} from it ({@link definitionToSnapshot}) and constructs the live
 * tree over that one path. The `bail` failure policy resolves to `options.bail`, else the
 * definition's `bail`, else the graceful {@link import('./constants.js').DEFAULT_BAIL}; it
 * feeds {@link import('./helpers.js').deriveWorkflowStatus}. Per-phase / per-task initial
 * listeners + metadata travel through `options.phases[id].on` /
-* `options.phases[id].tasks[id]` (the AGENTS §8 nested-by-id bag). The W-b tree is the
-* state machine ONLY — it does not execute tasks (W-c drives the transitions).
+* `options.phases[id].tasks[id]` (the nested-by-id bag). The W-b tree is the
+* state machine only — it does not execute tasks (W-c drives the transitions).
 *
-* `options.functions` is the {@link import('./types.js').WorkflowFunctions} registry each live
-* task's `run` name resolves against ONCE at construction into its runtime
+* `options.functions` is the {@link import('./types.js').WorkflowRegistry} registry each live
+* task's `behavior` name resolves against once at construction into its runtime
 * {@link import('./types.js').TaskInterface.handler}. An omitted name is the deliberate no-op;
 * an unresolved present name remains inspectable but is rejected if execution is attempted.
 *
@@ -3975,26 +4426,62 @@ function createWorkflowContract() {
 * ```
 */
 function createWorkflow(definition, options) {
-	const captured = captureWorkflowOptions(options);
-	return new Workflow(definitionToSnapshot(definition, captured.bail ?? definition.bail ?? false), captured);
+	return createWorkflowTree(definition, captureWorkflowOptions(options));
+}
+/**
+* Builds the live entity tree one definition and one owned options bag describe — the shared
+* construction path behind every definition-driven mint.
+*
+* @remarks
+* Seeds an initial all-`pending` {@link WorkflowSnapshot} from the definition and constructs the
+* live {@link WorkflowInterface} over it. `bail` is the caller's own override, forwarded to
+* {@link definitionToSnapshot} so it reaches both tiers: the workflow snapshot and the inheritance
+* default of every phase that declares no `bail` of its own, while a phase declaring one still
+* wins. Omitted, the definition's own `bail` governs, defaulting to the graceful
+* {@link import('./constants.js').DEFAULT_BAIL}.
+*
+* `captured` is forwarded to the entity unchanged — its own `bail` is deliberately not replaced
+* with the resolved policy, because the snapshot already carries the resolved value at both tiers
+* and an injected one would make `Workflow` read it as an explicit uniform override and clobber
+* the per-phase overrides. Each task's `behavior` / `retries` / `timeout` travel onto the snapshot
+* too, so `captured.functions` resolves every handler identically whether the tree is built fresh
+* or restored. Pass a bag {@link captureWorkflowOptions} already owns: this constructs over it
+* without re-capturing.
+*
+* @param definition - The workflow definition to bring to life
+* @param captured - The already-owned {@link WorkflowOptions} bag the entity is constructed with,
+* whose `bail` is the caller's failure-policy override, or `undefined` to take the definition's
+* @returns The live {@link WorkflowInterface} root
+*
+* @example
+* ```ts
+* import { captureWorkflowOptions, createWorkflowTree } from '@orkestrel/workflow'
+*
+* const captured = captureWorkflowOptions({ bail: true })
+* const workflow = createWorkflowTree(definition, captured)
+* workflow.bail // true — the override reached the workflow and every inheriting phase
+* ```
+*/
+function createWorkflowTree(definition, captured) {
+	return new Workflow(definitionToSnapshot(definition, captured.bail), captured);
 }
 /**
-* Build an equivalent live W-b entity tree from a {@link WorkflowSnapshot} — the
+* Builds an equivalent live W-b entity tree from a {@link WorkflowSnapshot} — the
 * inverse of {@link WorkflowInterface.snapshot}, restoring structure + each node's status
 * + recorded results + positional order + the persisted `#override`.
 *
 * @remarks
 * Round-trip fidelity is paramount: a `snapshot()` → `createRestoredWorkflow()` reproduces the
-* same status at every node (each `#override` restored DIRECTLY from the snapshot's own
+* same status at every node (each `#override` restored directly from the snapshot's own
 * `override` field, not guessed from a status divergence), the same recorded
 * {@link import('./types.js').TaskResult}s, and the same positional order (an interior
-* `skip` / `remove` survives). The snapshot is SELF-CONTAINED — it persists the `bail`
-* policy it ran under, so the restore re-derives status IDENTICALLY without a silent
+* `skip` / `remove` survives). The snapshot is self-contained — it persists the `bail`
+* policy it ran under, so the restore re-derives status identically without a silent
 * default; the snapshot's `bail` is the source of truth, while an explicit `options.bail`
 * still wins when supplied (to deliberately re-run under a different policy). A structurally
 * invalid snapshot (a status — or override — outside the lifecycle vocabulary, or a
 * non-boolean `bail`) throws a `RESTORE` {@link WorkflowError}.
-* Runtime handlers are optional: without a matching `functions` entry, a persisted `run`
+* Runtime handlers are optional: without a matching `functions` entry, a persisted `behavior`
 * remains visible with an undefined `handler` so the exact state is inspectable. The runner
 * rejects that unresolved tree if execution is attempted.
 *
@@ -4015,10 +4502,11 @@ function createRestoredWorkflow(snapshot, options) {
 	return new Workflow(cloneWorkflowSnapshot(snapshot), captured);
 }
 /**
-* Build an interrupted workflow back to life at its remaining retry budget.
+* Builds an interrupted workflow back to life at its remaining retry budget, normalizing a
+* leaf whose attempts are exhausted into a recovery failure.
 *
 * @remarks
-* Each phase captures every unique initial `run` binding once before constructing tasks. Recovery
+* Each phase captures every unique initial `behavior` binding once before constructing tasks. Recovery
 * validates those live tasks' captured callable handlers without rereading the registry, while the
 * retained registry identity remains available to resolve future live additions at their mint time.
 *
@@ -4039,22 +4527,22 @@ function createRecoveredWorkflow(snapshot, options) {
 	const owned = cloneWorkflowSnapshot(snapshot);
 	if (owned.override !== void 0 || owned.phases.some((phase) => phase.override !== void 0)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has a terminal override`, { workflow: owned.id });
 	const workflow = new Workflow(cloneWorkflowSnapshot(recoverWorkflowSnapshot(owned)), captured);
-	if (!hasWorkflowHandlers(workflow)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has an unresolved run`, { workflow: owned.id });
+	if (!hasWorkflowHandlers(workflow)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has an unresolved behavior`, { workflow: owned.id });
 	return workflow;
 }
 /**
-* Create the in-memory durable {@link WorkflowStoreInterface} — a process-lifetime
-* {@link MemoryWorkflowStore} persisting {@link WorkflowSnapshot}s by workflow id, the DEFAULT
-* backend behind the W-d persistence seam.
+* Creates the in-memory durable {@link WorkflowStoreInterface} — a process-lifetime
+* {@link MemoryWorkflowStore} persisting {@link WorkflowSnapshot}s by workflow id, the default
+* backend behind the W-d persistence seam. It takes no options and expires nothing: a
+* persisted run state lives until an explicit `delete`.
 *
 * @remarks
 * The snapshot analogue of the server package's `createMemorySessionStore`
-* (and the `createMemoryQueueStore` family), but LEANER — there is no idle-TTL, so no
-* options bag (AGENTS §21 minimal): a persisted run-state lives until an explicit `delete`. This is
-* the zero-plumbing DEFAULT (a plain `Map`); its driver-pluggable twin is
+* (and the `createMemoryQueueStore` family) is the zero-plumbing default (a plain `Map`); its
+* driver-pluggable twin is
 * {@link createDatabaseWorkflowStore} (the snapshot as one opaque JSON column over a `databases`
-* table) — for a DURABLE store (run-state surviving a restart) pass it a JSON / SQLite / IndexedDB
-* driver, and it swaps in WITHOUT touching the runner or the entity tree. Restore stays a caller
+* table) — for a durable store (run-state surviving a restart) pass it a JSON / SQLite / IndexedDB
+* driver, and it swaps in without touching the runner or the entity tree. Restore stays a caller
 * concern: read a snapshot back and rebuild the live tree with {@link createRestoredWorkflow}.
 *
 * @returns A memory-backed {@link WorkflowStoreInterface}
@@ -4074,23 +4562,24 @@ function createMemoryWorkflowStore() {
 	return new MemoryWorkflowStore();
 }
 /**
-* Create a {@link DatabaseWorkflowStore} over any {@link DriverInterface} — the durable,
+* Creates a {@link DatabaseWorkflowStore} over any {@link DriverInterface} — the durable,
 * driver-pluggable backing for the W-d persistence seam, the opt-in twin of
-* {@link createMemoryWorkflowStore}.
+* {@link createMemoryWorkflowStore}. It holds the snapshot as one opaque JSON column, and its
+* `driver` defaults to memory, so it works before any durable driver is passed.
 *
 * @remarks
-* Builds a one-table database (`snapshots`, keyed by `id`) over the supplied driver, the snapshot
-* held as ONE OPAQUE JSON COLUMN — the column map is `{ id; snapshot }` where `snapshot` is a
+* Builds a one-table database (`snapshots`, keyed by `id`) over the supplied driver. The column map
+* is `{ id; snapshot }` where `snapshot` is a
 * `rawShape` (a JSON blob), exactly as `createDatabaseQueueStore` stores its `input`. The
-* snapshot is already a COMPLETE, self-contained, pure-JSON payload, so storing it whole is lossless
-* AND keeps the row type FLAT — a structured multi-column snapshot table would force the contract to
+* snapshot is already a complete, self-contained, pure-JSON payload, so storing it whole is lossless
+* and keeps the row type flat — a structured multi-column snapshot table would force the contract to
 * `Infer` the deeply-nested snapshot shape (workflow → phases → tasks → results) and trip TS2589;
-* the opaque column sidesteps it (the column reads back as `unknown`, narrowed on `get` by
-* {@link import('./helpers.js').isWorkflowSnapshot}). The `driver` DEFAULTS to
-* {@link createMemoryDriver}, so the store ALSO works in memory out of the box; pass a server
-* `createJSONDriver` / `createSQLiteDriver` (or a browser IndexedDB driver) for a persistent one —
+* the opaque column sidesteps it (the column reads back as `unknown`, owned and narrowed on `get` by
+* {@link cloneWorkflowSnapshot}, whose semantic pass is
+* {@link import('./validators.js').isOwnedWorkflowSnapshot}). Pass a server `createJSONDriver` /
+* `createSQLiteDriver` (or a browser IndexedDB driver) for a persistent one —
 * the durability is the driver's job, the store engine is shared. It swaps in behind
-* {@link WorkflowStoreInterface} WITHOUT touching the runner or the entity tree.
+* {@link WorkflowStoreInterface} without touching the runner or the entity tree.
 *
 * @param driver - The storage backend the snapshots persist to (defaults to {@link createMemoryDriver})
 * @returns A {@link WorkflowStoreInterface} over the driver
@@ -4118,65 +4607,91 @@ function createDatabaseWorkflowStore(driver = (0, _orkestrel_database.createMemo
 	}).table("snapshots"));
 }
 /**
-* Create a workflow runner — a {@link WorkflowRunnerInterface} that EXECUTES a live W-b
-* workflow tree by COMPOSING the shipped substrate: phases sequential, tasks concurrent,
-* each task dispatched through its OWN resolved handler under the workflow's `bail` policy.
+* Creates the thin orchestrator — a {@link WorkflowRunnerInterface} — that executes a live W-b
+* workflow tree by composing the shipped substrate: phases sequential, tasks concurrent, each
+* task dispatched through its own resolved handler under the workflow's `bail` policy. The
+* engine is pure — it carries no behavior or provider registry, and its only option is the
+* scheduler it paces phase boundaries with.
 *
 * @remarks
-* The runner is a PURE engine — it re-implements no concurrency / retry / abort logic, AND it
-* carries no behavior or provider registry of its own: each live task already
-* resolved its own {@link import('./types.js').WorkflowFunction} into
-* {@link import('./types.js').TaskInterface.handler} ONCE at construction, from the
+* Each live task already resolved its own {@link import('./types.js').WorkflowFunction} into
+* {@link import('./types.js').TaskInterface.handler} once at construction, from the
 * {@link WorkflowOptions.functions} registry supplied to `execute` / {@link createWorkflow}.
 * Per-phase bounded concurrency is one {@link createRunner} per phase; `bail` maps onto that
 * Runner's fail-fast (`true` — the first failure aborts the in-flight siblings + skips the
 * rest) vs settle-all (`false` — failures are recorded, the run finishes); the run-level abort
 * / timeout / budget ({@link import('./types.js').WorkflowRunOptions}) fold through
 * `AbortSignal.any` (the agent runtime's pattern); pacing is the shipped scheduler.
-* `execute(definition, options?)` BUILDS the live tree from the definition itself (via
+* `execute(definition, options?)` builds the live tree from the definition itself (through
 * {@link createWorkflow} — one source of truth, returned in `WorkflowResult.workflow`), drives
 * the live entity (`start` → `complete` / `fail`), and resolves a
 * {@link import('./types.js').WorkflowResult}.
 *
 * External integrations remain application-owned: a caller wires an ordinary
 * {@link import('./types.js').WorkflowFunction} into its own {@link WorkflowOptions.functions}
-* registry. Only a task that omits `run` auto-completes; unresolved named work is rejected
+* registry. Only a task that omits `behavior` auto-completes; unresolved named work is rejected
 * before dispatch.
 *
 * @param options - An optional pacing `scheduler` (default the shipped cross-environment one).
 *   See {@link WorkflowRunnerOptions}.
 * @returns A working {@link WorkflowRunnerInterface}
 *
-* @example
+* @example Author a definition and run it
 * ```ts
 * import { createWorkflowRunner } from '@orkestrel/workflow'
+* import type { WorkflowDefinition } from '@orkestrel/workflow'
+*
+* const definition: WorkflowDefinition = {
+* 	id: 'release',
+* 	name: 'Release',
+* 	phases: [
+* 		{
+* 			id: 'build',
+* 			name: 'Build',
+* 			tasks: [
+* 				{ id: 'compile', name: 'Compile', behavior: 'compile' },
+* 				{ id: 'lint', name: 'Lint', behavior: 'lint' },
+* 			],
+* 		},
+* 		{
+* 			id: 'ship',
+* 			name: 'Ship',
+* 			tasks: [{ id: 'publish', name: 'Publish', behavior: 'publish' }],
+* 		},
+* 	],
+* }
+*
+* const runner = createWorkflowRunner() // a pure engine — no registries
 *
-* const runner = createWorkflowRunner()
-* const definition = { id: 'w', name: 'W', phases: [{ id: 'p', name: 'P', tasks: [
-* 	{ id: 't', name: 'T', run: 'compile' },
-* ] }] }
 * const result = await runner.execute(definition, {
-* 	functions: { compile: async (controller) => `built ${controller.task.id}` },
+* 	functions: {
+* 		compile: async (controller) => `built ${controller.task.id}`,
+* 		lint: async () => 'clean',
+* 		publish: async () => 'published',
+* 	},
 * })
 * result.status // 'completed'
-* result.workflow.phase('p')?.task('t')?.status // 'completed'
+* result.workflow.phase('build')?.task('compile')?.status // 'completed'
+* result.results // every settled task's TaskResult, in positional order
 * ```
 */
 function createWorkflowRunner(options) {
 	return new WorkflowRunner(options?.scheduler ?? createScheduler());
 }
 /**
-* Create a {@link WorkflowManagerInterface} — the store-backed registry of
+* Creates a {@link WorkflowManagerInterface} — the store-backed registry of
 * {@link WorkflowInterface}s, the additive manager tier mirroring the `@orkestrel/agent`
-* line's `createConversationManager` / `createWorkspaceManager`.
+* line's `createConversationManager` / `createWorkspaceManager`. The returned registry makes
+* hydrated named work runnable when `options.functions` is supplied, and leaves it
+* inspectable when it is not.
 *
 * @remarks
-* `options.functions` flows into every workflow the manager mints (`add`, via
-* {@link createWorkflow}) or hydrates (`open`'s registry-miss path, via
-* {@link createRestoredWorkflow}), so a hydrated workflow is RUNNABLE rather than a dead snapshot
-* mirror. `options.store` is the EXACT analogue of the twins' `store` seam — omitted ⇒ the
+* `options.functions` flows into every workflow the manager mints (`add`, through
+* {@link createWorkflow}) or hydrates (`open`'s registry-miss path, through
+* {@link createRestoredWorkflow}), so a hydrated workflow is runnable rather than a dead snapshot
+* mirror. `options.store` is the exact analogue of the twins' `store` seam — omitted ⇒ the
 * manager is registry-only (`open` resolves only what is registered, `save` is a no-op). This
-* is PURELY ADDITIVE: direct {@link WorkflowStoreInterface} use and
+* is purely additive: direct {@link WorkflowStoreInterface} use and
 * {@link createRestoredWorkflow} remain valid — the manager is one more caller-driven persistence
 * seam, not a replacement.
 *
@@ -4191,7 +4706,7 @@ function createWorkflowRunner(options) {
 * 	store: createMemoryWorkflowStore(),
 * 	functions: { compile: async (controller) => `built ${controller.task.id}` },
 * })
-* const workflow = manager.add(definition) // minted, registered, RUNNABLE
+* const workflow = manager.add(definition) // minted, registered, runnable
 * await manager.save(workflow.id)          // persisted to the store
 * const reopened = await manager.open(workflow.id) // already registered — no store hit
 * ```
@@ -4200,12 +4715,12 @@ function createWorkflowManager(options) {
 	return new WorkflowManager(options);
 }
 /**
-* Create the safe cross-environment cooperative-yield default — a
+* Creates the safe cross-environment cooperative-yield default — a
 * {@link SchedulerInterface} built on `setTimeout` / `clearTimeout` alone, so it
 * runs unchanged in both the browser and Node.
 *
 * @remarks
-* `yield()` gives the host a turn via a zero-delay macrotask (so pending I/O,
+* `yield()` gives the host a turn through a zero-delay macrotask (so pending I/O,
 * timers, and rendering actually run — a microtask would not); `delay(ms)` resumes
 * after at least `ms`. Pass `options.signal` to make a pending yield/delay reject
 * with the signal's exact `reason`; the shared owned-signal lifecycle clears the timer
@@ -4246,25 +4761,26 @@ function createScheduler() {
 	return new Scheduler();
 }
 /**
-* Create a thin generic orchestrator that drives declared units — and any they
-* `spawn` — through a bounded-concurrency queue, collecting their results in order.
+* Creates a thin generic orchestrator that drives declared units — and any they
+* `spawn` — through a bounded-concurrency queue, collecting their results in order and
+* failing the run fast on the first genuine unit failure.
 *
 * @remarks
 * The Runner composes the workers `Queue` for backpressure, FIFO ordering, bounded
 * concurrency, retries, and the per-attempt timeout — it adds only orchestration, not
-* a second concurrency engine. `execute(inputs)` runs the unit set ONCE (a second call
+* a second concurrency engine. `execute(inputs)` runs the unit set once (a second call
 * throws) and resolves the units' results in order: the declared inputs first, then
 * any `spawn`ed siblings in spawn order. Each unit's handler gets a `Controller` — its
 * `id` / `input`, a `signal` that fires on the unit's `abort`, a runner-level `abort`,
 * or the attempt's timeout, a promise-parked `wait()`, and `spawn(input)` to fan out
 * sibling units. The run is **fail-fast**: the first unit failure (after retries)
-* aborts every other unit and rejects `execute` with that error. **Observable (§13):** a
+* aborts every other unit and rejects `execute` with that error. **Observable:** a
 * typed `emitter` surfaces `start` / `unit` / `spawn` / `settle` / `fail` / `finish` / `abort`.
 *
-* Because `spawn` is fire-and-track (the runner awaits the whole spawn closure via an
-* outstanding-unit count, not a one-time snapshot), a handler need NOT await its spawns
-* for them to run — and on a bounded runner it should NOT `await` a spawn inline (a
-* slot-holding handler awaiting its own spawn can deadlock); fan out and return instead.
+* Because `spawn` is fire-and-track (the runner awaits the whole spawn closure through an
+* outstanding-unit count, not a one-time snapshot), a handler need not await its spawns
+* for them to run — and on a bounded runner do not `await` a spawn inline (a slot-holding
+* handler awaiting its own spawn can deadlock); fan out and return instead.
 *
 * @typeParam TInput - The work input each unit carries
 * @typeParam TResult - The value a unit's handler resolves
@@ -4293,24 +4809,22 @@ function createRunner(options) {
 	return new Runner(options);
 }
 //#endregion
-exports.Controller = Controller;
+exports.Collection = Collection;
 exports.DEFAULT_BAIL = DEFAULT_BAIL;
 exports.DEFAULT_PHASE_CONCURRENCY = DEFAULT_PHASE_CONCURRENCY;
 exports.DatabaseWorkflowStore = DatabaseWorkflowStore;
+exports.LIFECYCLE_STATUSES = LIFECYCLE_STATUSES;
 exports.MAX_TIMER_MS = MAX_TIMER_MS;
 exports.MemoryWorkflowStore = MemoryWorkflowStore;
-exports.PHASE_STATUSES = PHASE_STATUSES;
-exports.Phase = Phase;
+exports.PERSISTED_NODE_EVENTS = PERSISTED_NODE_EVENTS;
+exports.PERSISTED_TASK_EVENTS = PERSISTED_TASK_EVENTS;
 exports.PhaseManager = PhaseManager;
+exports.RunHolder = RunHolder;
 exports.Runner = Runner;
 exports.Scheduler = Scheduler;
-exports.TASK_STATUSES = TASK_STATUSES;
 exports.TASK_TRANSITIONS = TASK_TRANSITIONS;
-exports.TERMINAL_TASK_STATUSES = TERMINAL_TASK_STATUSES;
-exports.Task = Task;
-exports.TaskController = TaskController;
+exports.TERMINAL_STATUSES = TERMINAL_STATUSES;
 exports.TaskManager = TaskManager;
-exports.WORKFLOW_STATUSES = WORKFLOW_STATUSES;
 exports.Workflow = Workflow;
 exports.WorkflowError = WorkflowError;
 exports.WorkflowManager = WorkflowManager;
@@ -4322,10 +4836,10 @@ exports.buildWorkflowContext = buildWorkflowContext;
 exports.canTransitionTask = canTransitionTask;
 exports.captureWorkflowOptions = captureWorkflowOptions;
 exports.cloneTaskActivity = cloneTaskActivity;
+exports.cloneTaskClaims = cloneTaskClaims;
 exports.cloneWorkflowSnapshot = cloneWorkflowSnapshot;
 exports.collectResults = collectResults;
 exports.createDatabaseWorkflowStore = createDatabaseWorkflowStore;
-exports.createDeferred = createDeferred;
 exports.createMemoryWorkflowStore = createMemoryWorkflowStore;
 exports.createRecoveredWorkflow = createRecoveredWorkflow;
 exports.createRestoredWorkflow = createRestoredWorkflow;
@@ -4335,7 +4849,9 @@ exports.createWorkflow = createWorkflow;
 exports.createWorkflowContract = createWorkflowContract;
 exports.createWorkflowManager = createWorkflowManager;
 exports.createWorkflowRunner = createWorkflowRunner;
+exports.createWorkflowTree = createWorkflowTree;
 exports.definitionToSnapshot = definitionToSnapshot;
+exports.delayHost = delayHost;
 exports.deriveBoundary = deriveBoundary;
 exports.derivePhaseStatus = derivePhaseStatus;
 exports.deriveWorkflowStatus = deriveWorkflowStatus;
@@ -4344,29 +4860,36 @@ exports.failure = failure;
 exports.findFailure = findFailure;
 exports.hasWorkflowHandlers = hasWorkflowHandlers;
 exports.insertEntry = insertEntry;
+exports.isCompletable = isCompletable;
+exports.isHalted = isHalted;
 exports.isLifecycleStatus = isLifecycleStatus;
 exports.isOwnedWorkflowSnapshot = isOwnedWorkflowSnapshot;
+exports.isSkipping = isSkipping;
+exports.isStoppable = isStoppable;
 exports.isTaskActivity = isTaskActivity;
 exports.isTaskActivityInput = isTaskActivityInput;
+exports.isTaskClaimList = isTaskClaimList;
 exports.isTaskFailure = isTaskFailure;
 exports.isTaskResult = isTaskResult;
 exports.isTerminalStatus = isTerminalStatus;
 exports.isWorkflowError = isWorkflowError;
+exports.isWorkflowInterface = isWorkflowInterface;
 exports.isWorkflowSnapshot = isWorkflowSnapshot;
 exports.matchesDescription = matchesDescription;
 exports.moveEntry = moveEntry;
+exports.ownsAttempt = ownsAttempt;
 exports.parkSignal = parkSignal;
 exports.phaseDefinitionToSnapshot = phaseDefinitionToSnapshot;
 exports.phaseShape = phaseShape;
 exports.phaseUpdateShape = phaseUpdateShape;
 exports.recoverWorkflowSnapshot = recoverWorkflowSnapshot;
 exports.resolveTaskSilence = resolveTaskSilence;
+exports.scanSnapshotContext = scanSnapshotContext;
 exports.scheduleHost = scheduleHost;
 exports.success = success;
 exports.taskDefinitionToSnapshot = taskDefinitionToSnapshot;
 exports.taskShape = taskShape;
 exports.taskUpdateShape = taskUpdateShape;
 exports.workflowShape = workflowShape;
-exports.workflowSnapshotContext = workflowSnapshotContext;
 
 //# sourceMappingURL=index.cjs.map