@orkestrel/workflow 0.0.7 → 0.0.8

package/dist/src/core/index.d.ts

@@ -7,6 +7,8 @@ import { EmitterErrorHandler } from '@orkestrel/emitter';
 import { EmitterHooks } from '@orkestrel/emitter';
 import { EmitterInterface } from '@orkestrel/emitter';
 import { Failure } from '@orkestrel/contract';
+import { JSONRecord } from '@orkestrel/contract';
+import { JSONValue } from '@orkestrel/contract';
 import { LiteralShape } from '@orkestrel/contract';
 import { NumberShape } from '@orkestrel/contract';
 import { ObjectShape } from '@orkestrel/contract';
@@ -37,7 +39,7 @@ import { TokenUsage } from '@orkestrel/budget';
  *
  * @param snapshot - The snapshot to validate
  */
-export declare function assertSnapshot(snapshot: WorkflowSnapshot): void;
+export declare function assertSnapshot(snapshot: unknown): void;
 
 /**
  * Build a {@link PhaseContext} — a phase's own identity plus a back-reference to its
@@ -90,6 +92,31 @@ export declare function buildWorkflowContext(node: WorkflowContext): WorkflowCon
  */
 export declare function canTransitionTask(from: TaskStatus, to: TaskStatus): boolean;
 
+/**
+ * Validate and clone one complete task activity frame.
+ *
+ * @remarks
+ * This is the hostile boundary behind task reports and snapshot hydration. Supplying
+ * `updated` stamps an input frame without reading an `updated` property from it; omitting
+ * `updated` restores a stored frame and reads its persisted timestamp exactly once. Every
+ * untrusted property is captured once inside one protected boundary. The returned frame,
+ * collections, progress, operations, and constraints are copied and frozen.
+ *
+ * @param input - The untrusted complete activity frame
+ * @param updated - An optional accepted timestamp used instead of a persisted `updated`
+ * @returns An immutable cloned {@link TaskActivity}
+ * @throws {WorkflowError} With `MUTATION` when the frame cannot be read or validated
+ */
+export declare function cloneTaskActivity(input: unknown, updated?: number): TaskActivity;
+
+/**
+ * Validate and own a workflow snapshot before live construction.
+ *
+ * @param input - The hostile snapshot boundary
+ * @returns A deeply owned frozen snapshot
+ */
+export declare function cloneWorkflowSnapshot(input: unknown): WorkflowSnapshot;
+
 /**
  * Flatten a nested list of per-phase {@link TaskResult} lists into one positional list
  * — the workflow tier of the result tree, built from each phase's `results()`.
@@ -388,8 +415,8 @@ export declare function createScheduler(): SchedulerInterface;
  *
  * `options.functions` is the {@link import('./types.js').WorkflowFunctions} registry each live
  * task's `run` name resolves against ONCE at construction into its runtime
- * {@link import('./types.js').TaskInterface.handler} — a name omitted or absent from the
- * registry resolves to no handler (the no-handler rule).
+ * {@link import('./types.js').TaskInterface.handler}. An omitted name is the deliberate no-op;
+ * an unresolved present name remains inspectable but is rejected if execution is attempted.
  *
  * @param definition - The workflow definition to bring to life
  * @param options - Runtime options (initial listeners, `bail` override, per-node options)
@@ -475,7 +502,7 @@ export declare function createWorkflowManager(options?: WorkflowManagerOptions):
  *
  * @remarks
  * The runner is a PURE engine — it re-implements no concurrency / retry / abort logic, AND it
- * carries no `functions` / `tools` / `agents` registry of its own: each live task already
+ * carries no behavior or provider registry of its own: each live task already
  * resolved its own {@link import('./types.js').WorkflowFunction} into
  * {@link import('./types.js').TaskInterface.handler} ONCE at construction, from the
  * {@link WorkflowOptions.functions} registry supplied to `execute` / {@link createWorkflow}.
@@ -489,11 +516,10 @@ export declare function createWorkflowManager(options?: WorkflowManagerOptions):
  * the live entity (`start` → `complete` / `fail`), and resolves a
  * {@link import('./types.js').WorkflowResult}.
  *
- * Static tool / agent calling is OPT-IN: a caller wires a plain
- * {@link import('./types.js').WorkflowFunction} into its OWN {@link WorkflowOptions.functions}
- * registry, same as any other behavior — the `@orkestrel/tool` package ships the
- * tool/agent adapter factories for that. A task with no resolved handler AUTO-COMPLETES
- * (the ROADMAP no-handler rule).
+ * External integrations remain application-owned: a caller wires an ordinary
+ * {@link import('./types.js').WorkflowFunction} into its own {@link WorkflowOptions.functions}
+ * registry. Only a task that omits `run` auto-completes; unresolved named work is rejected
+ * before dispatch.
  *
  * @param options - An optional pacing `scheduler` (default the shipped cross-environment one).
  *   See {@link WorkflowRunnerOptions}.
@@ -728,6 +754,14 @@ export declare function derivePhaseStatus(tasks: readonly TaskStatus[]): PhaseSt
  */
 export declare function deriveWorkflowStatus(phases: readonly PhaseDerivation[]): WorkflowStatus;
 
+/**
+ * Normalize an unknown thrown value to a non-empty persistence-safe message.
+ *
+ * @param error - The caught value
+ * @returns A non-empty message without stack or cause data
+ */
+export declare function errorToMessage(error: unknown): string;
+
 /**
  * Box an error as a {@link Failure} — the graceful outcome half of a {@link Result}.
  *
@@ -765,6 +799,9 @@ export declare function failure<E>(error: E): Failure<E>;
  */
 export declare function findFailure(results: readonly TaskResult[]): TaskResult | undefined;
 
+/** Test that every present behavior reference resolves before dispatch. */
+export declare function hasWorkflowHandlers(snapshot: WorkflowSnapshot, functions: WorkflowFunctions | undefined): boolean;
+
 /**
  * Insert one `[key, value]` entry at a positional index into a readonly entries array —
  * the pure splice-in step behind an insertion-ordered registry's `add`.
@@ -791,6 +828,34 @@ export declare function findFailure(results: readonly TaskResult[]): TaskResult
  */
 export declare function insertEntry<T>(entries: readonly (readonly [string, T])[], index: number, key: string, value: T): readonly (readonly [string, T])[];
 
+/** Test the workflow lifecycle vocabulary. */
+export declare function isLifecycleStatus(value: unknown): value is LifecycleStatus;
+
+/**
+ * Validate a safe owned JSON graph as a coherent workflow snapshot.
+ *
+ * @remarks
+ * Callers at hostile boundaries use {@link isWorkflowSnapshot}, which owns the
+ * graph first so this semantic pass never observes accessors or prototypes.
+ */
+export declare function isOwnedWorkflowSnapshot(value: unknown): value is WorkflowSnapshot;
+
+/**
+ * Test whether an unknown value is valid persisted task activity.
+ */
+export declare function isTaskActivity(value: unknown): value is TaskActivity;
+
+/**
+ * Test whether an unknown value is a valid whole-frame activity report.
+ */
+export declare function isTaskActivityInput(value: unknown): value is TaskActivityInput;
+
+/** Test a normalized persisted task failure. */
+export declare function isTaskFailure(value: unknown): value is TaskFailure;
+
+/** Test a result's lineage against its containing snapshot nodes. */
+export declare function isTaskResult(value: unknown, workflow: unknown, phase: unknown, task: unknown): value is TaskResult;
+
 /**
  * Test whether a {@link LifecycleStatus} is TERMINAL — a node in this state will not
  * transition further.
@@ -825,24 +890,7 @@ export declare function isTerminalStatus(status: LifecycleStatus): boolean;
  */
 export declare function isWorkflowError(value: unknown): value is WorkflowError;
 
-/**
- * Narrow an `unknown` to a {@link WorkflowSnapshot} — the AGENTS §14 boundary guard for an
- * UNTRUSTED snapshot read (a storage row a {@link import('./stores/DatabaseWorkflowStore.js').DatabaseWorkflowStore}
- * reads back from its opaque JSON column, a snapshot loaded from disk).
- *
- * @remarks
- * A total guard (it NEVER throws — adversarial input returns `false`, AGENTS §14). It checks the
- * snapshot's SHAPE — `id` / `name` / `status` strings, a `boolean` `bail`, an array of `phases`,
- * `created` / `updated` numbers — enough to safely impose the {@link WorkflowSnapshot} type at a
- * storage boundary WITHOUT a cast. It is complementary to
- * {@link import('./factories.js').assertSnapshot}, which validates the DEEPER invariant (every
- * node's status / override drawn from the lifecycle vocabulary) and THROWS a `RESTORE`
- * {@link import('./errors.js').WorkflowError} — the deep gate a {@link import('./factories.js').restoreWorkflow}
- * applies. A boundary read narrows shape with this guard; a restore validates vocabulary with `assertSnapshot`.
- *
- * @param value - The value to test (an opaque storage read)
- * @returns `true` when `value` has the structural shape of a {@link WorkflowSnapshot}
- */
+/** Total hostile-boundary workflow snapshot guard. */
 export declare function isWorkflowSnapshot(value: unknown): value is WorkflowSnapshot;
 
 /**
@@ -861,6 +909,14 @@ export declare function isWorkflowSnapshot(value: unknown): value is WorkflowSna
  */
 export declare type LifecycleStatus = 'pending' | 'running' | 'completed' | 'failed' | 'skipped' | 'stopped';
 
+/** Compare two optional description values. */
+export declare function matchesDescription(left: unknown, right: unknown): boolean;
+
+/**
+ * The largest delay representable by the host timer APIs without overflow or clamping.
+ */
+export declare const MAX_TIMER_MS = 2147483647;
+
 /**
  * The in-memory {@link WorkflowStoreInterface} — a process-lifetime `Map` of
  * {@link WorkflowSnapshot}s keyed by workflow id, the DEFAULT store
@@ -972,9 +1028,11 @@ export declare function parkSignal(signal: AbortSignal): Promise<void>;
  *   `results()` collects the settled tasks' {@link TaskResult}s (the phase tier of the result
  *   tree); `workflow` navigates UP to the live parent.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link PhaseEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE, strictly AFTER the
- *   recompute + escalate; the emitter isolates a listener throw and routes it to its `error`
- *   handler (the `error` option); `fail` carries the failing task's {@link TaskResult}.
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+ *   corresponding status or runtime-gate change. Status events fire after the phase recomputes
+ *   and before it escalates to the workflow, preserving child/phase cause before parent effect.
+ *   The emitter isolates a listener throw and routes it to its `error` handler (the `error`
+ *   option); `fail` carries the failing task's {@link TaskResult}.
  * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
  *   delegating to {@link tasks} (the manager gates the target's own existence/status/id/
  *   bounds), then emit the matching {@link PhaseEventMap} event on success only. NATIVE
@@ -994,7 +1052,8 @@ export declare function parkSignal(signal: AbortSignal): Promise<void>;
  *   {@link import('../types.js').WorkflowFunctions} registry (threaded from
  *   {@link import('../types.js').WorkflowOptions.functions}) resolves each task's `run` name into
  *   its runtime {@link import('../types.js').TaskInterface.handler} ONCE; a `run` that is omitted
- *   or unregistered resolves to no handler (the no-handler rule).
+ *   or unregistered resolves to no handler; only an omitted `run` is a no-op, while an
+ *   unresolved present name makes the containing tree non-drivable.
  * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror the workflow's own
  *   quartet, scoped to this phase — a driving
  *   {@link import('../types.js').WorkflowRunnerInterface.execute} gates a task's own
@@ -1007,7 +1066,7 @@ export declare function parkSignal(signal: AbortSignal): Promise<void>;
 export declare class Phase implements PhaseInterface {
     #private;
     readonly description?: string;
-    constructor(snapshot: PhaseSnapshot, workflow: WorkflowInterface, escalate: () => void, options?: PhaseOptions, bail?: boolean, functions?: WorkflowFunctions);
+    constructor(snapshot: PhaseSnapshot, workflow: WorkflowInterface, escalate: () => void, options?: PhaseOptions, bail?: boolean, functions?: WorkflowFunctions, silence?: number);
     get emitter(): EmitterInterface<PhaseEventMap>;
     get id(): string;
     get name(): string;
@@ -1116,8 +1175,10 @@ export declare interface PhaseDerivation {
  * @remarks
  * `start` fires when the phase begins; `complete` when all its tasks settled
  * successfully; `fail` when a task failed under `bail` (carrying the
- * {@link TaskResult}); `stop` when the phase was ended. `add` / `remove` / `move` /
- * `update` fire on a successful structural or patch edit through
+ * {@link TaskResult}); `pause` / `resume` when its runtime gate closes / opens;
+ * `skip` when the phase was intentionally skipped; `stop` when the phase was ended.
+ * `add` / `remove` / `move` / `update` fire on a successful
+ * structural or patch edit through
  * {@link PhaseInterface.add} / `remove` / `move` / `update` (AGENTS §7) — never on a
  * refused/gated one. A throwing listener is isolated by the emitter and routed to its
  * `error` handler, not the domain surface (AGENTS §13). A `type` alias (AGENTS §4.5)
@@ -1130,6 +1191,12 @@ export declare type PhaseEventMap = {
     readonly complete: readonly [];
     /** A task failed under `bail` — the failing task's result. */
     readonly fail: readonly [result: TaskResult];
+    /** The phase's runtime gate closed. */
+    readonly pause: readonly [];
+    /** The phase's runtime gate opened. */
+    readonly resume: readonly [];
+    /** The phase was intentionally skipped. */
+    readonly skip: readonly [];
     /** The phase was permanently stopped. */
     readonly stop: readonly [];
     /** A task was inserted — the inserted task + its final index. */
@@ -1165,8 +1232,9 @@ export declare type PhaseInput = Partial<PhaseContext>;
  * - **Override.** `skip` / `stop` (AGENTS §10) FORCE the phase's status, overriding the
  *   derived value (e.g. skipping a whole phase); the override survives a snapshot.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link PhaseEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status change; the emitter isolates a
- *   listener throw and routes it to its `error` handler (the `error` option).
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `stop` after the corresponding
+ *   status or runtime-gate change; the emitter isolates a listener throw and routes it to
+ *   its `error` handler (the `error` option).
  * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror
  *   {@link WorkflowInterface.pause} / `resume` / `wait`, scoped to this phase — a driving
  *   {@link WorkflowRunnerInterface.execute} gates a task's own pre-dispatch on BOTH the
@@ -1532,10 +1600,10 @@ export declare interface PhaseSnapshot {
  * derived from its tasks' statuses.
  *
  * @remarks
- * A semantic tier of the shared {@link LifecycleStatus} vocabulary. A phase is
- * `failed` only when a task failed AND the workflow's `bail` policy is in force (a
- * failure under graceful mode is data, not a phase failure). `stopped` propagates
- * when every task was stopped. See {@link import('./helpers.js').derivePhaseStatus}.
+ * A semantic tier of the shared {@link LifecycleStatus} vocabulary. A failed task makes
+ * its phase `failed` regardless of policy; the phase's effective `bail` determines whether
+ * that failure propagates to the workflow or is retained as graceful result data. `stopped`
+ * propagates when every task was stopped. See {@link import('./helpers.js').derivePhaseStatus}.
  */
 export declare type PhaseStatus = LifecycleStatus;
 
@@ -1578,6 +1646,33 @@ export declare const phaseUpdateShape: ObjectShape<{
     bail: OptionalShape<LiteralShape<readonly [true, false]>>;
 }, false>;
 
+/**
+ * Rebuild an interrupted workflow at its remaining retry budget.
+ *
+ * @param snapshot - The hostile persisted snapshot
+ * @param options - Runtime handlers and entity options
+ * @returns A recoverable live workflow
+ */
+export declare function recoverWorkflow(snapshot: unknown, options?: WorkflowOptions): WorkflowInterface;
+
+/**
+ * Convert interrupted running work into a recoverable pending suffix or an
+ * exhausted recovery failure without replenishing attempts.
+ *
+ * @param snapshot - A fully validated owned snapshot with no terminal overrides
+ * @returns The recovery projection
+ */
+export declare function recoverWorkflowSnapshot(snapshot: WorkflowSnapshot): WorkflowSnapshot;
+
+/**
+ * Resolve a task's runtime silence window against its workflow default.
+ *
+ * @param value - The task-level override; any present non-positive or non-finite value disables
+ * @param fallback - The workflow-level default
+ * @returns A host-safe effective window (`1..MAX_TIMER_MS`), or `undefined`
+ */
+export declare function resolveTaskSilence(value: number | undefined, fallback: number | undefined): number | undefined;
+
 /**
  * Rebuild an equivalent live W-b entity tree from a {@link WorkflowSnapshot} — the
  * inverse of {@link WorkflowInterface.snapshot}, restoring structure + each node's status
@@ -1594,6 +1689,9 @@ export declare const phaseUpdateShape: ObjectShape<{
  * still wins when supplied (to deliberately re-run under a different policy). A structurally
  * invalid snapshot (a status — or override — outside the lifecycle vocabulary, or a
  * non-boolean `bail`) throws a `RESTORE` {@link WorkflowError}.
+ * Runtime handlers are optional: without a matching `functions` entry, a persisted `run`
+ * remains visible with an undefined `handler` so the exact state is inspectable. The runner
+ * rejects that unresolved tree if execution is attempted.
  *
  * @param snapshot - The snapshot to restore (carries its own `bail` + `override`)
  * @param options - Runtime options (initial listeners, an optional `bail` override, per-node options)
@@ -1607,7 +1705,7 @@ export declare const phaseUpdateShape: ObjectShape<{
  * restored.status === workflow.status // true
  * ```
  */
-export declare function restoreWorkflow(snapshot: WorkflowSnapshot, options?: WorkflowOptions): WorkflowInterface;
+export declare function restoreWorkflow(snapshot: unknown, options?: WorkflowOptions): WorkflowInterface;
 
 /**
  * A thin generic orchestrator that drives declared units — and any they `spawn` —
@@ -2065,9 +2163,8 @@ export declare function success<T>(value: T): Success<T>;
  *   `TRANSITION` {@link WorkflowError} on an illegal move (e.g. completing a non-`running`
  *   task) — the legal graph is the single source of truth, so the leaf can never reach an
  *   impossible state.
- * - **Override (snapshot fidelity).** `skip` / `stop` set `#override` to the forced terminal
- *   status, so a RESTORE can tell a forced leaf (`skipped` / `stopped`) from a run-produced
- *   one and reinstate it AS an override — preserving the round-trip.
+ * - **Snapshot fidelity.** A leaf needs no override: `skipped` / `stopped` are explicit terminal
+ *   statuses, and restore reinstates the leaf directly from {@link TaskSnapshot.status}.
  * - **The cascade.** Every status change records its boxed result (when any), fires the leaf's
  *   OWN event, THEN calls the parent phase's `#recompute` (injected at construction) so the
  *   transition propagates UP (Task → Phase → Workflow re-derive). The own-event-before-cascade
@@ -2082,12 +2179,13 @@ export declare function success<T>(value: T): Success<T>;
  *   matching {@link import('../types.js').TaskDefinition} / {@link TaskSnapshot} field. `handler`
  *   is the RUNTIME-ONLY counterpart — `run` resolved ONCE at construction against the
  *   workflow-level {@link import('../types.js').WorkflowOptions.functions} registry — and is
- *   NEVER persisted; `undefined` when `run` is omitted or unregistered (the no-handler rule).
+ *   NEVER persisted; `undefined` when `run` is omitted or unregistered. Only omission is a
+ *   deliberate no-op; unresolved named work is rejected before dispatch.
  */
 export declare class Task implements TaskInterface {
     #private;
     readonly description?: string;
-    constructor(context: TaskContext, phase: PhaseInterface, workflow: WorkflowInterface, recompute: () => void, options?: TaskOptions, status?: TaskStatus, result?: TaskResult, run?: string, retries?: number, timeout?: number, handler?: WorkflowFunction);
+    constructor(context: TaskContext, phase: PhaseInterface, workflow: WorkflowInterface, recompute: () => void, options?: TaskOptions, status?: TaskStatus, result?: TaskResult, run?: string, retries?: number, timeout?: number, metadata?: JSONRecord, attempts?: number, activity?: TaskActivity, handler?: WorkflowFunction, silence?: number);
     get emitter(): EmitterInterface<TaskEventMap>;
     get id(): string;
     get name(): string;
@@ -2096,15 +2194,26 @@ export declare class Task implements TaskInterface {
     get workflow(): WorkflowInterface;
     get status(): TaskStatus;
     get result(): TaskResult | undefined;
+    get attempts(): number;
     get run(): string | undefined;
     get handler(): WorkflowFunction | undefined;
     get retries(): number | undefined;
     get timeout(): number | undefined;
+    get activity(): TaskActivity | undefined;
+    get silence(): number | undefined;
+    get silent(): boolean;
+    get paused(): boolean;
+    get signal(): AbortSignal;
     start(): void;
-    complete(value: unknown): void;
-    fail(error: unknown): void;
+    complete(value: JSONValue): void;
+    fail(error: TaskFailure): void;
     skip(): void;
     stop(): void;
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    pulse(): boolean;
+    pause(): void;
+    resume(): void;
+    wait(): Promise<void>;
     /**
      * Apply a validated declarative patch to SELF (`name` / `description`).
      *
@@ -2148,6 +2257,44 @@ export declare const TASK_STATUSES: readonly TaskStatus[];
  */
 export declare const TASK_TRANSITIONS: Readonly<Record<TaskStatus, readonly TaskStatus[]>>;
 
+/**
+ * The bounded, JSON-serializable activity most recently accepted from a task reporter.
+ */
+export declare interface TaskActivity {
+    readonly note?: string;
+    readonly progress?: TaskProgress;
+    readonly operations: readonly TaskOperation[];
+    readonly constraints: readonly TaskConstraint[];
+    readonly updated: number;
+}
+
+/**
+ * One complete replacement of a running task's observable activity.
+ *
+ * @remarks
+ * Omitted `operations` or `constraints` mean an empty list. Omitted `progress` clears the
+ * previous aggregate progress. Use {@link TaskInterface.report} to commit the replacement.
+ */
+export declare interface TaskActivityInput {
+    readonly note?: string;
+    readonly progress?: TaskProgress;
+    readonly operations?: readonly TaskOperation[];
+    readonly constraints?: readonly TaskConstraint[];
+}
+
+/**
+ * One constraint claimed active when a running task's complete frame was accepted.
+ *
+ * @remarks
+ * Constraints describe active limits or requirements without embedding provider policy in
+ * core. `id` is unique within one complete report and `started` is finite and non-negative.
+ */
+export declare interface TaskConstraint {
+    readonly id: string;
+    readonly name: string;
+    readonly started: number;
+}
+
 /**
  * The ambient context of a task — its own identity plus a back-reference to the
  * phase (and, transitively, the workflow) it belongs to.
@@ -2162,18 +2309,17 @@ export declare interface TaskContext extends WorkflowContext {
 }
 
 /**
- * The lean per-task handle a {@link import('./types.js').WorkflowFunction} receives — the
- * running task's folded cancellation, its input, its lineage, and read-UP access to the
- * result tree.
+ * The attempt-scoped handle a {@link import('./types.js').WorkflowFunction} receives.
  *
  * @remarks
  * - **A leaf handle, NOT the runner `Controller`.** A workflow task is a leaf of the
- *   declarative W-b tree, not a fan-out unit, so this carries none of the runner
- *   `Controller`'s `spawn` / `wait` — only what a leaf needs.
- * - **Folded signal.** `signal` is the cancellation the runner folds for THIS run: it fires
- *   on a workflow-level abort / timeout / budget ceiling, or — under `bail: true` — when a
- *   sibling task fails (the runner aborts the in-flight siblings via the substrate's
- *   fail-fast). A handler races its work against it; `aborted` reads it.
+ *   declarative W-b tree, not a fan-out unit, so it has no `spawn`; its `wait` instead
+ *   checkpoints the workflow, phase, and task cooperative gates.
+ * - **Folded signal.** `signal` is the cancellation folded for THIS attempt: its per-attempt
+ *   deadline, task stop/skip, workflow abort/timeout/budget/destroy, or a sibling fail-fast.
+ *   A handler races its work against it; `aborted` reads it.
+ * - **Attempt ownership.** `report` / `pulse` are closures supplied by the runner and refuse
+ *   after this signal aborts or a retry token supersedes this handle.
  * - **Input + lineage.** `input` is the task's open `metadata` bag (its
  *   {@link import('./types.js').TaskInput} payload, `{}` when none); `task` is the full
  *   {@link TaskContext}, so `task.phase` / `task.phase.workflow` navigate UP the lineage.
@@ -2188,10 +2334,15 @@ export declare interface TaskContext extends WorkflowContext {
 declare class TaskController_2 implements TaskControllerInterface {
     #private;
     readonly signal: AbortSignal;
-    readonly input: Readonly<Record<string, unknown>>;
+    readonly input: JSONRecord;
     readonly task: TaskContext;
-    constructor(signal: AbortSignal, input: Readonly<Record<string, unknown>>, task: TaskContext, results: () => readonly TaskResult[]);
+    readonly attempt: number;
+    constructor(signal: AbortSignal, input: JSONRecord, task: TaskInterface, attempt: number, results: () => readonly TaskResult[], report: (input: TaskActivityInput) => Result<TaskActivity, WorkflowError>, pulse: () => boolean);
     get aborted(): boolean;
+    get paused(): boolean;
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    pulse(): boolean;
+    wait(): Promise<void>;
     results(): readonly TaskResult[];
 }
 export { TaskController_2 as TaskController }
@@ -2201,26 +2352,49 @@ export { TaskController_2 as TaskController }
  * cancellation, its input, its lineage, and read-UP access to the result tree.
  *
  * @remarks
- * A NEW, lean handle (NOT the runner `Controller` — it carries no `spawn` / `wait`; a
- * workflow task is a leaf of the declarative tree, not a fan-out unit). It exposes:
- * - `signal` — the task's folded cancellation: fires on a workflow-level `abort` /
- *   `timeout` / `budget` ceiling, or — under `bail: true` — when a sibling task fails (the
- *   runner aborts the in-flight siblings). A handler races its work against it.
+ * A NEW, lean handle (NOT the runner `Controller` — it carries no `spawn`; a workflow task
+ * is a leaf of the declarative tree, not a fan-out unit). It exposes:
+ * - `signal` — this attempt's folded cancellation: its per-attempt deadline, task
+ *   stop/skip, workflow abort/timeout/budget/destroy, or a sibling fail-fast.
  * - `aborted` — whether `signal` has fired.
  * - `input` — the task's `metadata` bag (the open consumer payload from its
  *   {@link TaskInput}); `{}` when none.
  * - `task` — the task's full {@link TaskContext} (so `task.phase` / `task.phase.workflow`
  *   navigate UP the lineage).
+ * - `wait()` — a cooperative checkpoint for the workflow, phase, and task pause gates.
  * - `results()` — every settled task's {@link TaskResult} across already-finished phases,
  *   so a `function` task can read an earlier phase's output (the W-b result tree, read-only).
  */
 export declare interface TaskControllerInterface {
-    /** Fires on a workflow-level abort / timeout / budget, or a sibling failure under `bail: true`. */
+    /** Fires on this attempt's deadline, task stop/skip, run cancellation, or sibling fail-fast. */
     readonly signal: AbortSignal;
     readonly aborted: boolean;
     /** The task's open `metadata` bag (its {@link TaskInput} payload); `{}` when none. */
-    readonly input: Readonly<Record<string, unknown>>;
+    readonly input: JSONRecord;
     readonly task: TaskContext;
+    /** The one-based persisted launch represented by this handle. */
+    readonly attempt: number;
+    /** Whether the workflow, phase, or task cooperative gate is currently paused. */
+    readonly paused: boolean;
+    /**
+     * Replace this running task's complete observable activity.
+     *
+     * @param input - The complete operations, progress, and constraints replacement
+     * @returns The accepted frame, or a `TRANSITION` failure after ownership is lost or this attempt aborts
+     */
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    /**
+     * Confirm liveness without replacing current activity.
+     *
+     * @returns `true` when committed, or `false` after ownership is lost or this attempt aborts
+     */
+    pulse(): boolean;
+    /**
+     * Cooperatively park while any workflow, phase, or task gate is paused, or until cancelled.
+     *
+     * @returns A promise that resolves when every applicable gate is open or the signal aborts
+     */
+    wait(): Promise<void>;
     /** Every settled task's result across already-finished phases — the result tree, read-only. */
     results(): readonly TaskResult[];
 }
@@ -2235,8 +2409,8 @@ export declare interface TaskControllerInterface {
  * its phase; `name` is the human label; `description` is optional prose. `run` is a
  * PLAIN NAME — a key resolved ONCE at construction against a workflow-level
  * {@link WorkflowFunctions} registry into a runtime {@link TaskInterface.handler}
- * carried on the live task. A task whose `run` is omitted, or whose name is unregistered,
- * has no handler and AUTO-COMPLETES (the no-handler rule).
+ * carried on the live task. An omitted `run` is the deliberate no-op form and completes
+ * with JSON `null`; an unresolved present name remains inspectable but is not executable.
  */
 export declare interface TaskDefinition {
     readonly id: string;
@@ -2254,11 +2428,10 @@ export declare interface TaskDefinition {
     readonly retries?: number;
     /**
      * @remarks
-     * The per-attempt deadline in milliseconds (a non-negative integer); the runner threads it to
-     * this task's substrate unit, OVERRIDING the phase Runner's `timeout` default. Omitted (or a
-     * non-positive value) ⇒ no deadline. PERSISTED in a {@link TaskSnapshot} (like `bail` and
-     * `concurrency`), so `restoreWorkflow(snapshot, { functions })` resumes with the same
-     * reliability config; only the resolved handler itself is runtime-only.
+     * The workflow-owned per-attempt deadline in milliseconds, an integer from `0` through
+     * `MAX_TIMER_MS`. Zero or omission means no deadline. PERSISTED in a {@link TaskSnapshot},
+     * so `restoreWorkflow(snapshot, { functions })` resumes with the same reliability config;
+     * only the resolved handler itself is runtime-only.
      */
     readonly timeout?: number;
 }
@@ -2286,7 +2459,8 @@ export declare function taskDefinitionToSnapshot(task: WorkflowDefinition['phase
  * @remarks
  * `start` fires when the task begins; `complete` when it finishes successfully
  * (carrying its {@link TaskResult}); `fail` when it errors (carrying the result);
- * `skip` when it is intentionally not executed; `stop` when it is ended early. A
+ * `pause` / `resume` when its runtime gate closes / opens; `skip` when it is
+ * intentionally not executed; `stop` when it is ended early. A
  * throwing listener is isolated by the emitter and routed to its `error` handler,
  * not the domain surface (AGENTS §13). A `type` alias (AGENTS §4.5) so it satisfies
  * `EventMap`.
@@ -2298,12 +2472,46 @@ export declare type TaskEventMap = {
     readonly complete: readonly [result: TaskResult];
     /** The task failed — its result. */
     readonly fail: readonly [result: TaskResult];
+    /** The task's runtime gate closed. */
+    readonly pause: readonly [];
+    /** The task's runtime gate opened. */
+    readonly resume: readonly [];
     /** The task was intentionally skipped. */
     readonly skip: readonly [];
     /** The task was permanently stopped. */
     readonly stop: readonly [];
+    /** A complete activity replacement was committed. */
+    readonly report: readonly [activity: TaskActivity];
+    /** The task confirmed liveness without replacing its current activity. */
+    readonly pulse: readonly [activity: TaskActivity];
+    /** No report or pulse was accepted during the effective silence window. */
+    readonly silence: readonly [];
 };
 
+/** A normalized JSON-safe task failure persisted without a stack or cause. */
+export declare interface TaskFailure {
+    readonly origin: TaskFailureOrigin;
+    readonly message: string;
+}
+
+/**
+ * The structured outcome of a task execution — its full lineage, its terminal
+ * status, the moment it settled, and its boxed produced outcome.
+ *
+ * @remarks
+ * Carries the complete lineage (`task` / `phase` / `workflow` contexts) so a result
+ * is self-describing wherever it travels. `status` is the terminal state this
+ * result records. `result` BOXES the produced outcome in a {@link Result}: it is
+ * PRESENT exactly when `status` is `completed` (a {@link import('@orkestrel/contract').Success})
+ * or `failed` (a {@link import('@orkestrel/contract').Failure}), and ABSENT when `status` is
+ * `skipped` or `stopped` (terminal, but produced no outcome) — a pending/running
+ * task has no result at all (a non-terminal status, per
+ * {@link import('./helpers.js').isTerminalStatus}). This boxed `result` REPLACES separate
+ * `value?` / `error?` fields: a success's payload is `result.value`, a failure's reason is `result.error`.
+ * `timestamp` is when the result was created (ms since epoch).
+ */
+export declare type TaskFailureOrigin = 'handler' | 'timeout' | 'recovery';
+
 /** Initial {@link TaskEventMap} listeners — the reserved `on` option (AGENTS §8). */
 export declare type TaskHooks = EmitterHooks<TaskEventMap>;
 
@@ -2318,7 +2526,7 @@ export declare type TaskHooks = EmitterHooks<TaskEventMap>;
  */
 export declare interface TaskInput extends Partial<TaskContext> {
     /** An open consumer bag — stored and snapshotted, never interpreted by the workflow. */
-    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly metadata?: JSONRecord;
 }
 
 /**
@@ -2337,13 +2545,15 @@ export declare interface TaskInput extends Partial<TaskContext> {
  *   {@link import('@orkestrel/contract').Failure}), `skip` (AGENTS §10 — intentionally not run),
  *   and `stop` (AGENTS §10 — ended early). Each is GUARDED: an illegal transition (e.g.
  *   completing a non-`running` task) throws a {@link import('./errors.js').WorkflowError}.
- *   `skip` / `stop` set the override so the leaf's terminal state survives a snapshot.
+ *   A leaf needs no override: `skipped` / `stopped` are explicit terminal statuses and
+ *   restore directly from {@link TaskSnapshot.status}.
  * - **Result.** `result` is the recorded {@link TaskResult} once the task settled with an
  *   outcome (`completed` / `failed`), else `undefined` — the lineage-navigable leaf of the
  *   result tree.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link TaskEventMap}) fires
- *   `start` / `complete` / `fail` / `skip` / `stop` strictly AFTER each transition; the
- *   emitter isolates a listener throw and routes it to its `error` handler (the `error` option).
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` strictly AFTER
+ *   each state change; the emitter isolates a listener throw and routes it to its `error`
+ *   handler (the `error` option).
  */
 export declare interface TaskInterface {
     readonly emitter: EmitterInterface<TaskEventMap>;
@@ -2354,6 +2564,8 @@ export declare interface TaskInterface {
     readonly phase: PhaseInterface;
     readonly workflow: WorkflowInterface;
     readonly status: TaskStatus;
+    /** Total launches already consumed; zero while fresh and one-based after launch. */
+    readonly attempts: number;
     /** The recorded outcome once the task settled with one (`completed` / `failed`), else `undefined`. */
     readonly result: TaskResult | undefined;
     /**
@@ -2366,9 +2578,9 @@ export declare interface TaskInterface {
      * The RESOLVED runtime handler — RUNTIME-ONLY, NEVER persisted in a {@link TaskSnapshot}.
      * Resolved ONCE at construction (build, restore, or a live mint) by looking `run` up in the
      * workflow-level {@link WorkflowOptions.functions} registry: `functions?.[run]` when `run`
-     * is defined, else `undefined`. A task with no `handler` (an omitted `run`, or a `run` name
-     * absent from the registry) AUTO-COMPLETES (the no-handler rule) — its phase/workflow still
-     * reaches a terminal status, just with no dispatched behavior.
+     * is defined, else `undefined`. An omitted `run` is the deliberate no-op form. A present,
+     * unresolved `run` remains visible on exact restore, but the runner rejects it before
+     * dispatch instead of falsely completing named work.
      */
     readonly handler: WorkflowFunction | undefined;
     /**
@@ -2377,15 +2589,49 @@ export declare interface TaskInterface {
      */
     readonly retries: number | undefined;
     /**
-     * The per-attempt deadline in milliseconds — PERSISTED (mirrors {@link TaskDefinition.timeout}
-     * / {@link TaskSnapshot.timeout}). `undefined` ⇒ no deadline.
+     * The workflow-owned per-attempt deadline in milliseconds (`0..MAX_TIMER_MS`) — PERSISTED
+     * (mirrors {@link TaskDefinition.timeout} / {@link TaskSnapshot.timeout}). Zero or
+     * `undefined` means no deadline.
      */
     readonly timeout: number | undefined;
+    /** The last accepted reporter claim, absent while pending. */
+    readonly activity: TaskActivity | undefined;
+    /** The effective host-safe silence window (`1..MAX_TIMER_MS`), or `undefined` when disabled. */
+    readonly silence: number | undefined;
+    /** Whether no report or pulse was accepted during the current silence window. */
+    readonly silent: boolean;
+    /** Whether this task's cooperative execution gate is paused. */
+    readonly paused: boolean;
+    /** This task's own cancellation signal; running/pending {@link stop} or {@link skip} fires it. */
+    readonly signal: AbortSignal;
     start(): void;
-    complete(value: unknown): void;
-    fail(error: unknown): void;
+    complete(value: JSONValue): void;
+    fail(error: TaskFailure): void;
     skip(): void;
     stop(): void;
+    /**
+     * Replace the complete observable activity of this running task.
+     *
+     * @param input - The complete operations, progress, and constraints replacement
+     * @returns The accepted immutable frame; `MUTATION` for invalid input or `TRANSITION` when not running
+     */
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    /**
+     * Confirm liveness without replacing the current operations, progress, or constraints.
+     *
+     * @returns `true` when committed, or `false` when the task is not running
+     */
+    pulse(): boolean;
+    /** Suspend this task's cooperative gate while pending or running; idempotent. */
+    pause(): void;
+    /** Continue this task's cooperative gate; idempotent. */
+    resume(): void;
+    /**
+     * Park until this task is not paused.
+     *
+     * @returns A promise that resolves once the task gate is released
+     */
+    wait(): Promise<void>;
     /**
      * Apply a validated declarative patch to SELF (`name` / `description`).
      *
@@ -2514,6 +2760,19 @@ export declare interface TaskManagerInterface {
     tasks(): readonly TaskInterface[];
 }
 
+/**
+ * One operation claimed active when a running task's complete frame was accepted.
+ *
+ * @remarks
+ * `id` is stable within one complete activity report, `name` is the human-readable label,
+ * and `started` is a finite non-negative reporter timestamp.
+ */
+export declare interface TaskOperation {
+    readonly id: string;
+    readonly name: string;
+    readonly started: number;
+}
+
 /**
  * The runtime options for a {@link TaskInterface} — the construction bag the live
  * leaf state machine (W-b) carries that the W-a {@link TaskDefinition} did not.
@@ -2531,32 +2790,31 @@ export declare interface TaskOptions {
     /** The emitter's listener-error handler (AGENTS §13) — a listener throw routes here, not to a domain event. */
     readonly error?: EmitterErrorHandler;
     /** An open consumer bag — stored and snapshotted, never interpreted by the workflow. */
-    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly metadata?: JSONRecord;
+    /** Runtime-only silence window; non-positive, non-finite, or over-`MAX_TIMER_MS` disables inheritance. */
+    readonly silence?: number;
 }
 
 /**
- * The structured outcome of a task execution — its full lineage, its terminal
- * status, the moment it settled, and its boxed produced outcome.
+ * The aggregate progress most recently reported by a running task.
  *
  * @remarks
- * Carries the complete lineage (`task` / `phase` / `workflow` contexts) so a result
- * is self-describing wherever it travels. `status` is the terminal state this
- * result records. `result` BOXES the produced outcome in a {@link Result}: it is
- * PRESENT exactly when `status` is `completed` (a {@link import('@orkestrel/contract').Success})
- * or `failed` (a {@link import('@orkestrel/contract').Failure}), and ABSENT when `status` is
- * `skipped` or `stopped` (terminal, but produced no outcome) — a pending/running
- * task has no result at all (a non-terminal status, per
- * {@link import('./helpers.js').isTerminalStatus}). This boxed `result` REPLACES separate
- * `value?` / `error?` fields: a success's payload is `result.value`, a failure's reason is `result.error`.
- * `timestamp` is when the result was created (ms since epoch).
+ * `current` and an optional `total` are finite non-negative numbers; when `total` is present
+ * it is at least `current`. `unit` is optional observer-facing text.
  */
+export declare interface TaskProgress {
+    readonly current: number;
+    readonly total?: number;
+    readonly unit?: string;
+}
+
 export declare interface TaskResult {
     readonly task: TaskContext;
     readonly phase: PhaseContext;
     readonly workflow: WorkflowContext;
     readonly status: TaskStatus;
     /** The boxed outcome — present for `completed` (Success) / `failed` (Failure), absent otherwise. */
-    readonly result?: Result<unknown>;
+    readonly result?: Result<JSONValue, TaskFailure>;
     readonly timestamp: number;
 }
 
@@ -2595,13 +2853,17 @@ export declare interface TaskSnapshot {
     readonly description?: string;
     readonly status: TaskStatus;
     readonly result?: TaskResult;
-    readonly metadata: Readonly<Record<string, unknown>>;
+    readonly metadata: JSONRecord;
+    /** Total launches already consumed; zero while fresh and never reset by recovery. */
+    readonly attempts: number;
     /** The behavior reference — a registry key resolved against {@link WorkflowFunctions} on restore/build. */
     readonly run?: string;
     /** Extra attempts after the first on failure (a non-negative integer); overrides the phase Runner default. */
     readonly retries?: number;
-    /** The per-attempt deadline in milliseconds (a non-negative integer); overrides the phase Runner default. */
+    /** Workflow-owned per-attempt deadline (`0..MAX_TIMER_MS`); zero or omission means disabled. */
     readonly timeout?: number;
+    /** Pending omits activity; running/completed/failed require it; skipped/stopped may retain it. */
+    readonly activity?: TaskActivity;
 }
 
 /**
@@ -2700,18 +2962,20 @@ export declare type UnitOutcome<TResult> = {
  *   reachable ONLY under `bail: true` (a single failed task halts the workflow); under
  *   `bail: false` a failed phase folds into `completed`. {@link #recompute} diffs on each phase
  *   change; a CHANGE emits.
- * - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; the override is PERSISTED in the
- *   snapshot's own `override` field and restored DIRECTLY (no divergence guess). The snapshot also
- *   persists `bail`, so a restore re-derives status identically without a silent policy default.
+ * - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; an executed task-free pending tree
+ *   may also be force-completed vacuously. The override is PERSISTED in the snapshot's own
+ *   `override` field and restored DIRECTLY (no divergence guess). The snapshot also persists
+ *   `bail`, so a restore re-derives status identically without a silent policy default.
  * - **Result tree.** `results()` flattens every phase's `results()` ({@link collectResults}) — the
  *   workflow tier; `phase(id)` + each `phase.task(id)` navigate DOWN, a task's `phase` / `workflow`
  *   navigate UP.
  * - **Snapshot.** `snapshot()` serializes the whole live tree to a {@link WorkflowSnapshot} (pure
  *   JSON); {@link import('./factories.js').restoreWorkflow} rebuilds an equivalent live tree.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link WorkflowEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE; the emitter isolates a
- *   listener throw and routes it to its `error` handler (the `error` option); `fail` carries
- *   the failing task's {@link TaskResult}.
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+ *   corresponding status or runtime-gate change; the emitter isolates a listener throw and
+ *   routes it to its `error` handler (the `error` option); `fail` carries the failing task's
+ *   {@link TaskResult}.
  * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
  *   delegating to {@link phases} (the manager gates the target's own existence/status/id/
  *   bounds), then emit the matching {@link WorkflowEventMap} event on success only. NATIVE,
@@ -2723,10 +2987,10 @@ export declare type UnitOutcome<TResult> = {
  *   naturally accepted.
  * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` gate execution at the runner's
  *   phase/task boundaries WITHOUT touching {@link status} — `paused` is runtime-only, never
- *   persisted. `destroy` is a terminal teardown: it aborts {@link signal}, `stop`s every
- *   non-terminal live phase (so an engine parked on a phase's own gate unparks and the tree
- *   lands coherent), forces the `stop` override on THIS workflow when not already terminal,
- *   releases any parked {@link wait} waiter, and marks {@link destroyed} — all four idempotent.
+ *   persisted. `destroy` is a terminal teardown: it `stop`s every non-terminal task and
+ *   phase (releasing their gates and liveness resources), aborts {@link signal}, forces the
+ *   workflow `stop` override when needed, releases its parked waiter, and marks
+ *   {@link destroyed} — all idempotent.
  */
 export declare class Workflow implements WorkflowInterface {
     #private;
@@ -2761,6 +3025,9 @@ export declare class Workflow implements WorkflowInterface {
 /** Every {@link WorkflowStatus} value, frozen — the lifecycle vocabulary of a workflow. */
 export declare const WORKFLOW_STATUSES: readonly WorkflowStatus[];
 
+/** A runner-owned durability boundary. */
+export declare type WorkflowCheckpoint = 'initial' | 'attempt' | 'settlement' | 'final';
+
 /**
  * The ambient context of a workflow — the identity every level inherits.
  *
@@ -2797,18 +3064,13 @@ export declare interface WorkflowDefinition {
 }
 
 /**
- * An error thrown by the workflow entity + W-c2 recursion layer.
+ * An error raised by the workflow runtime.
  *
  * @remarks
  * Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
- * offending node id / status. Thrown for an illegal lifecycle transition
+ * offending node id / status. Raised for an illegal lifecycle transition
  * (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
- * passed to {@link import('./factories.js').restoreWorkflow} (`RESTORE`), an over-deep /
- * cyclic nested-workflow dispatch (`DEPTH`), and a malformed workflow-authoring-tool args
- * blob (`TOOL`). `DEPTH` and `TOOL` are public type surface constructed by the
- * `@orkestrel/tool` package's workflow-tool / agent-function adapters; on that seam the
- * throw is ISOLATED by its `ToolManager` into the tool result's top-level `error`
- * (AGENTS §14 — the universal tool-handler contract).
+ * boundary (`RESTORE`), or a refused structural/activity edit (`MUTATION`).
  */
 export declare class WorkflowError extends Error {
     readonly code: WorkflowErrorCode;
@@ -2826,21 +3088,6 @@ export declare class WorkflowError extends Error {
  *   the offending current status + requested transition in the error `context`.
  * - `RESTORE` — a {@link import('./factories.js').restoreWorkflow} given a structurally
  *   invalid {@link WorkflowSnapshot} (a status outside the lifecycle vocabulary).
- * - `DEPTH` — a nested-workflow dispatch (W-c2) that a depth / cycle guard rejected:
- *   running it would push the nested-workflow chain past a bounded max depth, OR its
- *   target agent (or a workflow it would author) is already an ancestor of the current
- *   run (a re-entry cycle). Public type surface consumed by the `@orkestrel/tool`
- *   package's workflow-tool / agent-function adapters, which construct
- *   {@link import('./errors.js').WorkflowError}s with this code (thrown, then ISOLATED
- *   by that package's `ToolManager` into the tool result's `error`). The error `context`
- *   names the offending agent / workflow id + the depth.
- * - `TOOL` — a workflow-authoring tool handler (in `@orkestrel/tool`) was handed a
- *   MALFORMED / over-constraint authored args blob (e.g. an empty `id`, `concurrency: 0`)
- *   that {@link import('./factories.js').createWorkflowContract} rejected, so no workflow
- *   ran. Public type surface: `@orkestrel/tool` constructs this code and THROWS it
- *   (rather than returning a failure result); its `ToolManager` ISOLATES the throw into
- *   the canonical tool result's top-level `error` (AGENTS §14 — the universal
- *   tool-handler contract); the error `context` names the wrapped workflow id.
  * - `MUTATION` — a GATED structural or patch edit was refused: a duplicate id on
  *   `append`/`add`, a target that does not exist or is not `pending`, an out-of-bounds
  *   `index`, a patch that failed shaper validation, or a live structural edit refused by
@@ -2854,7 +3101,7 @@ export declare class WorkflowError extends Error {
  *   guard (both genuine programmer-error paths, AGENTS §12). The error `context` names
  *   the offending id / index / status.
  */
-export declare type WorkflowErrorCode = 'TRANSITION' | 'RESTORE' | 'DEPTH' | 'TOOL' | 'MUTATION';
+export declare type WorkflowErrorCode = 'TRANSITION' | 'RESTORE' | 'MUTATION';
 
 /**
  * The push observation surface (AGENTS §13) of the workflow entity (W-b) — the
@@ -2864,8 +3111,10 @@ export declare type WorkflowErrorCode = 'TRANSITION' | 'RESTORE' | 'DEPTH' | 'TO
  * @remarks
  * Present-tense events with arg tuples. `start` fires when the workflow begins;
  * `complete` when every phase settled successfully; `fail` when a phase failed
- * under `bail` (carrying the failing {@link TaskResult}); `stop` when the workflow
- * was permanently ended. `add` / `remove` / `move` / `update` fire on a successful
+ * under `bail` (carrying the failing {@link TaskResult}); `pause` / `resume` when its
+ * runtime gate closes / opens; `skip` when the workflow was intentionally skipped;
+ * `stop` when it was permanently ended. `add` / `remove`
+ * / `move` / `update` fire on a successful
  * structural or patch edit through {@link WorkflowInterface.add} / `remove` / `move` /
  * `update` (AGENTS §7) — never on a refused/gated one. A throwing listener never
  * reaches the domain surface — the emitter isolates it and routes it to its OWN
@@ -2880,6 +3129,12 @@ export declare type WorkflowEventMap = {
     readonly complete: readonly [];
     /** A phase failed under `bail` — the failing task's result. */
     readonly fail: readonly [result: TaskResult];
+    /** The workflow's runtime gate closed. */
+    readonly pause: readonly [];
+    /** The workflow's runtime gate opened. */
+    readonly resume: readonly [];
+    /** The workflow was intentionally skipped. */
+    readonly skip: readonly [];
     /** The workflow was permanently stopped. */
     readonly stop: readonly [];
     /** A phase was inserted — the inserted phase + its final index. */
@@ -2892,6 +3147,15 @@ export declare type WorkflowEventMap = {
     readonly update: readonly [phase: PhaseInterface];
 };
 
+/** A normalized persistence failure surfaced as workflow result data. */
+export declare interface WorkflowFault {
+    readonly origin: 'persistence';
+    readonly checkpoint: WorkflowCheckpoint;
+    readonly message: string;
+    readonly task?: string;
+    readonly attempt?: number;
+}
+
 /**
  * A registered workflow function — the behavior a `function`-form
  * {@link TaskDefinition} runs, resolved BY NAME through the {@link WorkflowFunctions}
@@ -2906,7 +3170,7 @@ export declare type WorkflowEventMap = {
  * should honour `controller.signal` (a workflow-level abort / timeout / budget, or — under
  * `bail: true` — a sibling's failure, fires it) so a cancel stops it promptly.
  */
-export declare type WorkflowFunction = (controller: TaskControllerInterface) => Promise<unknown> | unknown;
+export declare type WorkflowFunction = (controller: TaskControllerInterface) => Promise<JSONValue> | JSONValue;
 
 /**
  * The `function`-task behavior registry — workflow function names mapped to their
@@ -2914,9 +3178,10 @@ export declare type WorkflowFunction = (controller: TaskControllerInterface) =>
  *
  * @remarks
  * A live {@link TaskInterface} resolves its `run` name against this registry ONCE at
- * construction into its {@link TaskInterface.handler}. A name absent from the registry (or
- * an omitted `run`) is the no-handler case — the task AUTO-COMPLETES (the ROADMAP rule). A
- * plain record (not a manager) — the registry is a lookup, with no lifecycle of its own.
+ * construction into its {@link TaskInterface.handler}. An omitted `run` is the deliberate
+ * no-op case. A present name absent from the registry remains inspectable but makes the tree
+ * non-drivable until restored with a matching handler. A plain record (not a manager) — the
+ * registry is a lookup, with no lifecycle of its own.
  */
 export declare type WorkflowFunctions = Readonly<Record<string, WorkflowFunction>>;
 
@@ -2940,14 +3205,15 @@ export declare type WorkflowInput = Partial<WorkflowContext>;
  * - **Children.** `phases` is the lean {@link PhaseManagerInterface} (AGENTS §9);
  *   `phase(id)` / `phases().phases()` read in positional order. `results` collects ALL
  *   tasks' results across every phase (the workflow tier of the result tree).
- * - **Override.** `skip` / `stop` (AGENTS §10) FORCE the workflow's status; the override
- *   survives a snapshot.
+ * - **Override.** `skip` / `stop` (AGENTS §10) FORCE the workflow's status; `complete`
+ *   may force only a task-free, otherwise-pending tree. The override survives a snapshot.
  * - **Snapshot.** `snapshot()` serializes the whole live tree to a {@link WorkflowSnapshot}
  *   (pure JSON — structure + each node's status + recorded results + positional order);
  *   {@link restoreWorkflow} rebuilds an equivalent live tree.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link WorkflowEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status change; the emitter isolates a
- *   listener throw and routes it to its `error` handler (the `error` option).
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `stop` after the corresponding
+ *   status or runtime-gate change; the emitter isolates a listener throw and routes it to
+ *   its `error` handler (the `error` option).
  */
 export declare interface WorkflowInterface {
     readonly emitter: EmitterInterface<WorkflowEventMap>;
@@ -2997,9 +3263,9 @@ export declare interface WorkflowInterface {
      * FORCE this workflow to `completed` (AGENTS §10), overriding the derived value.
      *
      * @remarks
-     * A NO-OP unless `status` is `pending` — its ONLY legitimate use is settling a vacuously
-     * DONE tree (no work happened), mirroring the runner's own gate. Never overrides a real
-     * `completed` / a bail-true `failed` / a `stopped` / a derived `skipped`.
+     * A NO-OP unless `status` is `pending` and the tree is genuinely vacuous: zero phases or
+     * every phase contains zero tasks. Its ONLY legitimate use is settling an executed no-op
+     * tree. It never overrides pending work or any started/terminal state.
      */
     complete(): void;
     /**
@@ -3033,16 +3299,15 @@ export declare interface WorkflowInterface {
      */
     resume(): void;
     /**
-     * Tear this workflow down (AGENTS §10) — a TERMINAL teardown: aborts {@link signal},
-     * `stop`s every non-terminal live phase (so any engine parked on a phase's own gate
-     * unparks and the tree lands coherent), forces the `stop` override on THIS workflow if
-     * it is not already terminal, resolves any parked {@link wait} waiter, and marks
-     * {@link destroyed}; idempotent.
+     * Tear this workflow down (AGENTS §10) — an atomic TERMINAL teardown: mark
+     * {@link destroyed}, pin non-terminal workflow/phase overrides to `stopped`, stop every
+     * non-terminal task, release gates and liveness resources, abort {@link signal}, then
+     * destroy task, phase, and workflow emitters in ownership order; idempotent.
      *
      * @remarks
-     * After `destroy`, every structural mutator (`add` / `remove` / `move` / `update` /
-     * `patch`) and `pause` / `resume` reject (a `Result` failure) or no-op — never throws
-     * for calling `destroy` itself twice.
+     * {@link destroyed} is set before final events, so reentrant mutation is refused and a
+     * recursive `destroy` is a no-op. Already-terminal genuine completed/failed state is
+     * preserved, and state/snapshots remain inspectable after emitter resources are destroyed.
      *
      * @example
      * ```ts
@@ -3298,9 +3563,8 @@ export declare interface WorkflowManagerInterface {
  * every {@link import('./factories.js').createWorkflow} ({@link WorkflowManagerInterface.add})
  * and every {@link import('./factories.js').restoreWorkflow}
  * ({@link WorkflowManagerInterface.open}'s hydration path) the manager performs — so a
- * hydrated workflow carries real resolved `handler`s and is RUNNABLE, not merely a restored
- * state mirror. Omitted ⇒ every minted/hydrated task resolves no `handler` (the no-handler
- * rule — it auto-completes if driven).
+ * hydrated workflow carries real resolved `handler`s and is RUNNABLE. Omitted ⇒ named work
+ * remains inspectable but cannot be driven; omitted-`run` tasks remain deliberate no-ops.
  */
 export declare interface WorkflowManagerOptions {
     /**
@@ -3316,7 +3580,7 @@ export declare interface WorkflowManagerOptions {
      * (`add`, via {@link import('./factories.js').createWorkflow}) or hydrates (`open`'s
      * registry-miss path, via {@link import('./factories.js').restoreWorkflow}) — so a
      * hydrated workflow is RUNNABLE, its tasks carrying real resolved `handler`s. Omitted ⇒
-     * every task resolves no `handler` (the no-handler rule).
+     * named tasks remain inspectable but execution rejects them.
      */
     readonly functions?: WorkflowFunctions;
 }
@@ -3354,12 +3618,66 @@ export declare interface WorkflowOptions {
      * fresh build ({@link import('./factories.js').createWorkflow}) and a restore
      * ({@link import('./factories.js').restoreWorkflow}) both consume, and the same shape a
      * live {@link WorkflowInterface.add} / {@link PhaseInterface.add} mint resolves a newly
-     * minted task against. A `run` name absent from `functions` (or omitted entirely)
-     * resolves to no handler — that task AUTO-COMPLETES (the no-handler rule): its
-     * phase/workflow still reaches a terminal status, just with no dispatched behavior.
-     * Omitted ⇒ an empty registry (every task auto-completes).
+     * minted task against. An omitted `run` resolves to no handler and is the deliberate
+     * no-op form. A present name absent from `functions` also has no handler so exact restore
+     * remains inspectable, but {@link WorkflowRunnerInterface.execute} rejects that tree.
+     * Omitted ⇒ an empty registry; only tasks that also omit `run` are executable no-ops.
      */
     readonly functions?: WorkflowFunctions;
+    /** Runtime-only default silence; non-positive, non-finite, or over-`MAX_TIMER_MS` disables it. */
+    readonly silence?: number;
+}
+
+/**
+ * Advanced run-local snapshot persistence with one writer and one coalesced latest obligation.
+ *
+ * @remarks
+ * Normally composed by `WorkflowRunner.execute({ store })`; exported for hosts that need to
+ * coordinate the same required boundaries around their own runner integration.
+ */
+export declare class WorkflowPersistence implements WorkflowPersistenceInterface {
+    #private;
+    constructor(workflow: WorkflowInterface, store: WorkflowStoreInterface);
+    get fault(): WorkflowFault | undefined;
+    /**
+     * Persist every change through this required boundary.
+     *
+     * @param checkpoint - The boundary being made durable
+     * @param task - The task owning an attempt or settlement
+     * @param attempt - The persisted attempt number
+     * @returns Whether the latest state reached the store
+     */
+    checkpoint(checkpoint: WorkflowCheckpoint, task?: TaskInterface, attempt?: number): Promise<boolean>;
+    /**
+     * Stop observing the live tree and persist its final state.
+     *
+     * @returns Whether the final snapshot reached the store
+     */
+    finalize(): Promise<boolean>;
+    /** Stop observing the live tree. */
+    detach(): void;
+}
+
+/**
+ * The advanced run-local durability coordinator normally composed by
+ * {@link WorkflowRunnerInterface.execute} when `store` is supplied.
+ */
+export declare interface WorkflowPersistenceInterface {
+    /** The first required checkpoint failure, if one occurred. */
+    readonly fault: WorkflowFault | undefined;
+    /**
+     * Make the latest state durable at one required boundary.
+     *
+     * @param checkpoint - The required durability boundary
+     * @param task - The task owning an attempt or settlement
+     * @param attempt - The persisted one-based attempt number
+     * @returns Whether the latest live state reached the store
+     */
+    checkpoint(checkpoint: WorkflowCheckpoint, task?: TaskInterface, attempt?: number): Promise<boolean>;
+    /** Detach observers and make the final live state durable. */
+    finalize(): Promise<boolean>;
+    /** Stop observing the live workflow tree; idempotent. */
+    detach(): void;
 }
 
 /**
@@ -3376,11 +3694,17 @@ export declare interface WorkflowOptions {
  * settled task across all phases, in positional order — the same array `workflow.results()`
  * yields). Returning the live `workflow` (not just a snapshot) keeps the entity tree the
  * source of truth — the runner adds only the convenience `status` / `results` projections.
+ * A scheduler or other engine-infrastructure failure rejects after the runner coherently
+ * stops remaining work and attempts final persistence.
  */
 export declare interface WorkflowResult {
     readonly workflow: WorkflowInterface;
     readonly status: WorkflowStatus;
     readonly results: readonly TaskResult[];
+    /** Whether the returned final state is stored; omitted when no store was supplied. */
+    readonly durable?: boolean;
+    /** The first required persistence failure; omitted when none occurred. */
+    readonly fault?: WorkflowFault;
 }
 
 /**
@@ -3396,17 +3720,16 @@ export declare interface WorkflowResult {
  *   `AbortSignal.any` (exactly as the agent runtime folds its bounds); pacing is the shipped
  *   {@link SchedulerInterface}. The runner writes ZERO concurrency / retry / abort logic of
  *   its own — it only sequences phases, dispatches a task's own handler, and drives the live
- *   entity.
- * - **Pure engine — no registries, no tool/agent knowledge.** The runner carries no
- *   `functions` / `tools` / `agents` registry: each live {@link TaskInterface} already
+ *   entity. The workflow layer owns per-task deadlines because timeout settlement must
+ *   update the live leaf under the phase's `bail` policy before the substrate unit settles.
+ * - **Pure engine — no integration registry.** The runner carries no behavior or provider
+ *   registry: each live {@link TaskInterface} already
  *   resolved its own {@link import('./types.js').WorkflowFunction} into
  *   {@link import('./types.js').TaskInterface.handler} ONCE at construction (build, restore,
  *   or a live mint all resolve it identically, from {@link WorkflowOptions.functions}), so
- *   dispatch is simply "invoke the task's own handler". Static tool / agent calling is an
- *   OPT-IN concern of the `@orkestrel/tool` package's adapter factories — plain
- *   {@link import('./types.js').WorkflowFunction}s a caller wires into
- *   {@link WorkflowOptions.functions} like any other behavior. This module never imports
- *   any tool/agent package.
+ *   dispatch is simply "invoke the task's own handler". Provider, protocol, and tool
+ *   integrations remain application-owned {@link import('./types.js').WorkflowFunction}s
+ *   composed into {@link WorkflowOptions.functions}. This module imports none of them.
  * - **Two `execute` forms, one engine.** `execute(definition, options)` BUILDS the live tree
  *   from a {@link WorkflowDefinition} (single source of truth for the `run` / `concurrency`
  *   metadata); `execute(workflow, options)` DRIVES a caller-owned, ALREADY-BUILT
@@ -3426,10 +3749,9 @@ export declare interface WorkflowResult {
  *   for `spawn` to accept (the runner already drained) is swept `skip`ped afterward so the
  *   phase always reaches a coherent terminal state.
  * - **Dispatch by handler.** `#runTask` invokes the live task's own
- *   {@link import('./types.js').TaskInterface.handler} directly: `undefined` (an omitted `run`,
- *   or a `run` name absent from the {@link WorkflowOptions.functions} registry it was resolved
- *   against) AUTO-COMPLETES — the ROADMAP no-handler rule; otherwise the handler runs with the
- *   task's {@link import('./types.js').TaskControllerInterface} handle.
+ *   {@link import('./types.js').TaskInterface.handler} directly. An omitted `run` deliberately
+ *   auto-completes with JSON `null`; a present unresolved name is rejected by the synchronous
+ *   execution claim and never false-completes.
  * - **`bail` → substrate.** Under `bail: true` (halt) a genuine task failure `fail`s the leaf
  *   THEN re-throws, so the substrate Runner fail-fasts — it aborts the in-flight siblings
  *   (their `controller.signal` fires; a mid-flight sibling `skip`s) and rejects the phase run;
@@ -3437,11 +3759,12 @@ export declare interface WorkflowResult {
  *   Under `bail: false` (graceful) a failure `fail`s the leaf and RESOLVES (never throws), so
  *   the Runner settles every unit (allSettled) and the run finishes (the workflow derives
  *   `completed`, the failure recorded in the result tree).
- * - **Pause / stop / destroy gates.** `workflow.pause()` is honoured at exactly two points —
- *   the next phase boundary (workflow-only) and each task's own pre-dispatch (before
- *   `task.start()`, workflow gate FIRST then this task's own `phase.pause()`) — by parking on
- *   {@link WorkflowInterface.wait} / {@link PhaseInterface.wait}; an in-flight task body is
- *   NEVER suspended mid-flight. A GRACEFUL `workflow.stop()` (no signal involved) is caught at
+ * - **Pause / stop / destroy gates.** Workflow, phase, and task gates are checked before
+ *   dispatch, and a running handler can checkpoint their folded state through
+ *   {@link import('./types.js').TaskControllerInterface.wait}. Because the substrate acquires
+ *   concurrency before this handler gate, a paused task occupies one phase slot until resume;
+ *   already-running siblings continue and its per-attempt timeout keeps counting. A GRACEFUL
+ *   `workflow.stop()` (no signal involved) is caught at
  *   those same gates: not-yet-started work is `skip`ped, in-flight work finishes naturally. A
  *   HARD `workflow.destroy()` aborts {@link WorkflowInterface.signal}, which `#fold` has folded
  *   into the run's composed signal — so it cancels the active phase Runner (and every
@@ -3458,8 +3781,8 @@ export declare interface WorkflowResult {
  *   {@link TaskController} signal `AbortSignal.any`-combines the substrate per-unit signal with
  *   `runSignal`, so a handler observes either cause directly.
  * - **Re-entrant-safe.** No shared per-run mutable field: the active-Runner holder is LOCAL to
- *   each `#execute`, so a nested `execute` (a bound workflow-tool handler re-entering this
- *   instance while the outer run is suspended awaiting it) cannot clobber the outer run's state.
+ *   each `#execute`, so a nested application-level `execute` cannot clobber the outer run's
+ *   state.
  */
 export declare class WorkflowRunner implements WorkflowRunnerInterface {
     #private;
@@ -3482,6 +3805,8 @@ export declare class WorkflowRunner implements WorkflowRunnerInterface {
      * {@link WorkflowRunOptions} abort / timeout / budget fires every in-flight task's signal
      * and `stop`s the run. `execute` resolves (never rejects) on a cancel — the partial outcome
      * is read from the returned {@link WorkflowResult} (its `workflow` / `status` / `results`).
+     * An unexpected scheduler or engine-infrastructure failure rejects after remaining work is
+     * stopped, swept, and final persistence is attempted.
      *
      * @param definition - The {@link WorkflowDefinition} to build the live tree from and drive
      * @param options - The construction options ({@link WorkflowOptions}: `on` / `bail` /
@@ -3501,10 +3826,11 @@ export declare class WorkflowRunner implements WorkflowRunnerInterface {
      * @remarks
      * `createWorkflow` mints the live tree, this overload drives it, and the caller controls
      * the SAME entity mid-run via its own `pause` / `resume` / `add` / `stop` / `destroy`
-     * (AGENTS §10). Requires `workflow.status === 'pending'` and `!workflow.destroyed` —
-     * otherwise this is a programmer-timing error and it THROWS a `TRANSITION`
-     * {@link WorkflowError} (AGENTS §12) rather than silently no-opping or building a second
-     * tree. Once accepted, observable semantics are byte-identical to the `definition` form —
+     * (AGENTS §10). Requires `workflow.status === 'pending'`, `!workflow.destroyed`, and no
+     * prior execution claim. A process-local object-identity claim shared by all runner instances
+     * is acquired synchronously and never released, so a same-object second call throws a `TRANSITION`
+     * {@link WorkflowError} before any asynchronous status change. Once accepted, observable
+     * semantics are byte-identical to the `definition` form —
      * except the phase loop RE-READS the live tree every iteration, so a caller's live `add`
      * mid-run is picked up and actually dispatched. `options` carries only the per-run bounds
      * (`signal` / `timeout` / `budget`) — the construction half of {@link WorkflowRunOptions}
@@ -3542,8 +3868,8 @@ export declare class WorkflowRunner implements WorkflowRunnerInterface {
  * {@link WorkflowOptions.functions}) and each phase's `concurrency` (so there is no
  * separately-supplied workflow to drift from the definition). The freshly-built live tree is
  * returned in {@link WorkflowResult.workflow}. The runner carries NO registry of its own — it
- * simply invokes each task's OWN {@link TaskInterface.handler}; a task with no handler
- * AUTO-COMPLETES. The runner DRIVES the live entity (`start` → `complete` / `fail`), never
+ * simply invokes each task's OWN {@link TaskInterface.handler}; an omitted `run` is the only
+ * auto-completing no-op. The runner DRIVES the live entity (`start` → `complete` / `fail`), never
  * re-implementing status. The `bail` policy maps onto the substrate's fail-fast (`bail: true`
  * — the first failure aborts in-flight siblings and skips the rest) vs settle-all (`bail:
  * false` — failures are recorded and the run finishes). The {@link WorkflowOptions} half of
@@ -3581,9 +3907,9 @@ export declare interface WorkflowRunnerInterface {
      * **Programmer-error exception (AGENTS §12).** A PATHOLOGICAL `definition` (e.g. a
      * duplicate phase or task `id`) THROWS SYNCHRONOUSLY at construction — before any phase
      * runs, and before the returned `Promise` is even created — rather than resolving a
-     * failed/partial {@link WorkflowResult}. This is the one exception to the "resolves,
-     * never rejects" contract above: a malformed definition is a programmer-timing error, not
-     * a runtime outcome to report through the result tree.
+     * failed/partial {@link WorkflowResult}. Unexpected scheduler or engine-infrastructure
+     * failures may reject asynchronously after remaining work is stopped, swept, and final
+     * persistence is attempted. Neither case is a domain task outcome to disguise as a result.
      *
      * @param definition - The {@link WorkflowDefinition} to build the live tree from and drive
      * @param options - The construction options ({@link WorkflowOptions}: `on` / `bail` /
@@ -3599,10 +3925,11 @@ export declare interface WorkflowRunnerInterface {
      * The entity itself is now the single control surface (no separate run handle):
      * `createWorkflow` mints the live tree, this overload drives it, and the caller
      * controls the SAME entity mid-run via its own `pause` / `resume` / `add` / `stop` /
-     * `destroy` (AGENTS §10). Requires `workflow.status === 'pending'` and
-     * `!workflow.destroyed` — otherwise this is a programmer-timing error and it THROWS a
-     * `TRANSITION` {@link import('./errors.js').WorkflowError} (AGENTS §12) rather than
-     * silently no-opping or building a second tree. Once accepted, phases run
+     * `destroy` (AGENTS §10). Requires `workflow.status === 'pending'`,
+     * `!workflow.destroyed`, and no prior execution claim. A process-local object-identity claim
+     * shared by every runner instance is acquired synchronously and never released, so a same-object
+     * call throws a `TRANSITION` {@link import('./errors.js').WorkflowError} even before an
+     * asynchronous status change. Once accepted, phases run
      * SEQUENTIALLY and, within each phase, tasks CONCURRENTLY — byte-identical observable
      * semantics to the `definition`-form `execute` — except the phase loop RE-READS the
      * live `workflow.phases` / each phase's live `tasks` every iteration (a cursor over
@@ -3619,12 +3946,10 @@ export declare interface WorkflowRunnerInterface {
      * {@link import('./factories.js').restoreWorkflow} behaves according to whether a
      * {@link WorkflowFunctions} registry was supplied at that build: WITH a registry,
      * each task's `run` name is re-resolved against it, so a matched task carries a real
-     * handler and this overload actually DISPATCHES it, resuming real work. WITHOUT a
-     * registry (or when a task's `run` name has no match in it), the task's
-     * {@link TaskInterface.run} is `undefined` — the no-handler rule then AUTO-COMPLETES
-     * that task (no dispatch occurs). A PARTIALLY-run restored tree (any live phase/task
-     * not `pending`) is rejected outright by the `workflow.status === 'pending'` guard
-     * above — only a wholly `pending` restored tree is drivable.
+     * handler and this overload actually DISPATCHES it, resuming real work. Without a registry,
+     * the persisted {@link TaskInterface.run} remains visible for inspection while `handler` is
+     * `undefined`, and this overload rejects the tree before dispatch. A quiescent recovered tree may contain
+     * terminal work plus pending work; a tree with any `running` leaf is not drivable.
      *
      * @param workflow - The live {@link WorkflowInterface} to drive (its own entity surface —
      *   `pause` / `resume` / `add` / `stop` / `destroy` — is the caller's control seam)
@@ -3642,9 +3967,7 @@ export declare interface WorkflowRunnerInterface {
  * @remarks
  * The runner is a PURE engine — it carries no `functions` / `tools` / `agents` registry
  * (each live task already resolved its own handler at construction from
- * {@link WorkflowOptions.functions}); wiring a `function`-form task to a tool or an agent is
- * an OPT-IN concern of the `@orkestrel/tool` package's adapter factories, which a caller
- * composes into its OWN `functions` registry.
+ * {@link WorkflowOptions.functions}).
  * - `scheduler` — the {@link SchedulerInterface} that paces the tree (a cooperative
  *   `yield` between phases). Omitted ⇒ the shipped cross-environment default
  *   ({@link createScheduler}).
@@ -3679,23 +4002,19 @@ export declare interface WorkflowRunnerOptions {
  * {@link TaskControllerInterface.signal} fires) and HALTS the run — the remaining tasks
  * and phases are `skip`ped and the workflow settles `stopped`.
  * - `signal` — an external cancellation (a caller `AbortController`).
- * - `timeout` — a whole-run deadline in milliseconds. A non-positive value (`0` or negative)
- *   ⇒ NO deadline (the runner arms an `@orkestrel/timeout` `TimeoutInterface`
- *   only when `timeout > 0`).
+ * - `timeout` — a whole-run deadline in milliseconds. A non-positive, non-finite, or
+ *   over-`MAX_TIMER_MS` value means no deadline.
  * - `budget` — a whole-run cost ceiling (a {@link BudgetInterface} over {@link TokenUsage}
  *   — its `signal` fires when a task-reported usage crosses `max`); the runner folds its
  *   `signal` and `start`s it. (A `max: 0` budget is exhausted from its first `start`, so it
  *   cancels the run at entry — a DIFFERENT primitive from the `timeout: 0` "no deadline" case.)
  *
- * The engine itself carries NO nesting bookkeeping — the depth / cycle guard for a nested
- * `agent` → workflow-tool → workflow chain lives entirely in the OPT-IN adapter factories
- * shipped by `@orkestrel/tool`, closed over their own `depth` / `ancestry`, never threaded
- * through `execute`'s options.
  */
 export declare type WorkflowRunOptions = WorkflowOptions & {
     readonly signal?: AbortSignal;
     readonly timeout?: number;
     readonly budget?: BudgetInterface<TokenUsage>;
+    readonly store?: WorkflowStoreInterface;
 };
 
 /**
@@ -3738,17 +4057,18 @@ export declare const workflowShape: ObjectShape<{
  * it is self-contained, it carries the policy it ran under: `bail` (AGENTS §4.4) is the
  * failure policy, so {@link import('./factories.js').restoreWorkflow} re-derives status
  * IDENTICALLY without a silent default. `status` is the EFFECTIVE status (override-or-derived)
- * at snapshot time; `override` is the forced status of a whole-workflow `skip` / `stop`,
- * PRESENT only when one is in force (so a restore reinstates it DIRECTLY rather than guessing
- * from a status divergence). `phases` are the workflow's {@link PhaseSnapshot}s in order;
- * `created` / `updated` are ms since epoch.
+ * at snapshot time; `override` is the forced status of a whole-workflow `skip` / `stop` or
+ * vacuous `completed`. The completed override is valid only for an otherwise-derived pending
+ * tree containing no tasks. An override is PRESENT only when one is in force (so a restore
+ * reinstates it DIRECTLY rather than guessing from a status divergence). `phases` are the
+ * workflow's {@link PhaseSnapshot}s in order; `created` / `updated` are ms since epoch.
  */
 export declare interface WorkflowSnapshot {
     readonly id: string;
     readonly name: string;
     readonly description?: string;
     readonly status: WorkflowStatus;
-    /** The forced status of a whole-workflow `skip` / `stop`; present only when an override is in force. */
+    /** Whole-workflow `skip` / `stop` or valid task-free vacuous `completed`; omitted when derived. */
     readonly override?: WorkflowStatus;
     /** The failure policy the workflow ran under (AGENTS §4.4) — persisted so a restore re-derives identically. */
     readonly bail: boolean;
@@ -3757,6 +4077,9 @@ export declare interface WorkflowSnapshot {
     readonly updated: number;
 }
 
+/** Locate the nearest identifiable node for an inconsistent owned snapshot. */
+export declare function workflowSnapshotContext(value: unknown): Readonly<Record<string, unknown>> | undefined;
+
 /**
  * One row of the table a {@link import('./stores/DatabaseWorkflowStore.js').DatabaseWorkflowStore}
  * persists — a workflow `id` plus its {@link WorkflowSnapshot} held as ONE OPAQUE JSON column.