@orkestrel/workflow 0.0.7 → 0.0.8

package/dist/src/core/index.js

@@ -1,4 +1,4 @@
-import { arrayShape, compileGuard, createContract, integerShape, isArray, isBoolean, isNumber, isRecord, isString, literalShape, objectShape, optionalShape, rawShape, stringShape } from "@orkestrel/contract";
+import { arrayShape, attempt, cloneJSONRecord, cloneJSONValue, compileGuard, createContract, integerShape, isArray, isBoolean, isContractError, isFiniteNumber, isInteger, isJSONValue, isNonEmptyString, isRecord, literalShape, objectShape, optionalShape, rawShape, stringShape } from "@orkestrel/contract";
 import { createDatabase, createMemoryDriver } from "@orkestrel/database";
 import { createAbort } from "@orkestrel/abort";
 import { Emitter } from "@orkestrel/emitter";
@@ -178,21 +178,20 @@ var TASK_TRANSITIONS = Object.freeze({
 * phase may still DECLARE a larger explicit `concurrency` and pays that allocation knowingly.
 */
 var DEFAULT_PHASE_CONCURRENCY = 1024;
+/**
+* The largest delay representable by the host timer APIs without overflow or clamping.
+*/
+var MAX_TIMER_MS = 2147483647;
 //#endregion
 //#region src/core/errors.ts
 /**
-* An error thrown by the workflow entity + W-c2 recursion layer.
+* An error raised by the workflow runtime.
 *
 * @remarks
 * Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
-* offending node id / status. Thrown for an illegal lifecycle transition
+* offending node id / status. Raised for an illegal lifecycle transition
 * (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
-* passed to {@link import('./factories.js').restoreWorkflow} (`RESTORE`), an over-deep /
-* cyclic nested-workflow dispatch (`DEPTH`), and a malformed workflow-authoring-tool args
-* blob (`TOOL`). `DEPTH` and `TOOL` are public type surface constructed by the
-* `@orkestrel/tool` package's workflow-tool / agent-function adapters; on that seam the
-* throw is ISOLATED by its `ToolManager` into the tool result's top-level `error`
-* (AGENTS §14 — the universal tool-handler contract).
+* boundary (`RESTORE`), or a refused structural/activity edit (`MUTATION`).
 */
 var WorkflowError = class extends Error {
 	code;
@@ -220,7 +219,11 @@ var WorkflowError = class extends Error {
 * ```
 */
 function isWorkflowError(value) {
-	return value instanceof WorkflowError;
+	try {
+		return value instanceof WorkflowError;
+	} catch {
+		return false;
+	}
 }
 //#endregion
 //#region src/core/helpers.ts
@@ -357,6 +360,17 @@ function canTransitionTask(from, to) {
 	return TASK_TRANSITIONS[from].includes(to);
 }
 /**
+* Resolve a task's runtime silence window against its workflow default.
+*
+* @param value - The task-level override; any present non-positive or non-finite value disables
+* @param fallback - The workflow-level default
+* @returns A host-safe effective window (`1..MAX_TIMER_MS`), or `undefined`
+*/
+function resolveTaskSilence(value, fallback) {
+	if (value !== void 0) return Number.isFinite(value) && value > 0 && value <= 2147483647 ? value : void 0;
+	return fallback !== void 0 && Number.isFinite(fallback) && fallback > 0 && fallback <= 2147483647 ? fallback : void 0;
+}
+/**
 * Box a value as a {@link Success} — the graceful outcome half of a {@link Result}.
 *
 * @typeParam T - The boxed value's type
@@ -393,6 +407,20 @@ function failure(error) {
 	};
 }
 /**
+* Normalize an unknown thrown value to a non-empty persistence-safe message.
+*
+* @param error - The caught value
+* @returns A non-empty message without stack or cause data
+*/
+function errorToMessage(error) {
+	try {
+		const message = error instanceof Error ? error.message : String(error);
+		return typeof message === "string" && message.length > 0 ? message : "unknown failure";
+	} catch {
+		return "unknown failure";
+	}
+}
+/**
 * Find the first {@link TaskResult} in a positional list whose boxed outcome is a
 * `Failure` — the pure scan shared by a phase's and a workflow's derived-`failed`
 * `fail`-event lookup.
@@ -429,11 +457,11 @@ function findFailure(results) {
 * @returns The {@link WorkflowContext}
 */
 function buildWorkflowContext(node) {
-	return {
+	return Object.freeze({
 		id: node.id,
 		name: node.name,
 		...node.description === void 0 ? {} : { description: node.description }
-	};
+	});
 }
 /**
 * Build a {@link PhaseContext} — a phase's own identity plus a back-reference to its
@@ -444,10 +472,10 @@ function buildWorkflowContext(node) {
 * @returns The {@link PhaseContext}
 */
 function buildPhaseContext(workflow, node) {
-	return {
+	return Object.freeze({
 		...buildWorkflowContext(node),
-		workflow
-	};
+		workflow: buildWorkflowContext(workflow)
+	});
 }
 /**
 * Build a {@link TaskContext} — a task's own identity plus a back-reference to its phase
@@ -459,31 +487,10 @@ function buildPhaseContext(workflow, node) {
 * @returns The {@link TaskContext}
 */
 function buildTaskContext(phase, node) {
-	return {
+	return Object.freeze({
 		...buildWorkflowContext(node),
-		phase
-	};
-}
-/**
-* Narrow an `unknown` to a {@link WorkflowSnapshot} — the AGENTS §14 boundary guard for an
-* UNTRUSTED snapshot read (a storage row a {@link import('./stores/DatabaseWorkflowStore.js').DatabaseWorkflowStore}
-* reads back from its opaque JSON column, a snapshot loaded from disk).
-*
-* @remarks
-* A total guard (it NEVER throws — adversarial input returns `false`, AGENTS §14). It checks the
-* snapshot's SHAPE — `id` / `name` / `status` strings, a `boolean` `bail`, an array of `phases`,
-* `created` / `updated` numbers — enough to safely impose the {@link WorkflowSnapshot} type at a
-* storage boundary WITHOUT a cast. It is complementary to
-* {@link import('./factories.js').assertSnapshot}, which validates the DEEPER invariant (every
-* node's status / override drawn from the lifecycle vocabulary) and THROWS a `RESTORE`
-* {@link import('./errors.js').WorkflowError} — the deep gate a {@link import('./factories.js').restoreWorkflow}
-* applies. A boundary read narrows shape with this guard; a restore validates vocabulary with `assertSnapshot`.
-*
-* @param value - The value to test (an opaque storage read)
-* @returns `true` when `value` has the structural shape of a {@link WorkflowSnapshot}
-*/
-function isWorkflowSnapshot(value) {
-	return isRecord(value) && isString(value.id) && isString(value.name) && isString(value.status) && isBoolean(value.bail) && isArray(value.phases) && isNumber(value.created) && isNumber(value.updated);
+		phase: buildPhaseContext(phase.workflow, phase)
+	});
 }
 /**
 * Convert a {@link WorkflowDefinition} into an INITIAL {@link WorkflowSnapshot} — every
@@ -573,12 +580,91 @@ function taskDefinitionToSnapshot(task) {
 		...task.description === void 0 ? {} : { description: task.description },
 		status: "pending",
 		metadata: {},
+		attempts: 0,
 		...task.run === void 0 ? {} : { run: task.run },
 		...task.retries === void 0 ? {} : { retries: task.retries },
 		...task.timeout === void 0 ? {} : { timeout: task.timeout }
 	};
 }
 /**
+* Convert interrupted running work into a recoverable pending suffix or an
+* exhausted recovery failure without replenishing attempts.
+*
+* @param snapshot - A fully validated owned snapshot with no terminal overrides
+* @returns The recovery projection
+*/
+function recoverWorkflowSnapshot(snapshot) {
+	const phases = [];
+	let halted = false;
+	const now = Math.max(Date.now(), snapshot.updated);
+	const workflow = buildWorkflowContext(snapshot);
+	for (const phase of snapshot.phases) {
+		const exhausted = /* @__PURE__ */ new Set();
+		for (const task of phase.tasks) {
+			const budget = (task.retries ?? 0) + 1;
+			if (task.status === "running" && task.attempts >= budget) exhausted.add(task.id);
+		}
+		const strict = phase.bail && (exhausted.size > 0 || phase.tasks.some((task) => task.status === "failed"));
+		const tasks = [];
+		for (const task of phase.tasks) {
+			const eligible = task.status === "pending" || task.status === "running";
+			if ((halted || strict) && eligible && !exhausted.has(task.id)) {
+				tasks.push({
+					...task,
+					status: "skipped"
+				});
+				continue;
+			}
+			if (!exhausted.has(task.id)) {
+				if (task.status === "running") {
+					const { activity: _activity, ...pending } = task;
+					tasks.push({
+						...pending,
+						status: "pending"
+					});
+				} else tasks.push(task);
+				continue;
+			}
+			const phaseContext = buildPhaseContext(workflow, phase);
+			const result = {
+				task: buildTaskContext(phaseContext, task),
+				phase: phaseContext,
+				workflow,
+				status: "failed",
+				result: {
+					success: false,
+					error: {
+						origin: "recovery",
+						message: `task '${task.id}' exhausted its retry budget during recovery`
+					}
+				},
+				timestamp: now
+			};
+			tasks.push({
+				...task,
+				status: "failed",
+				result
+			});
+		}
+		const status = derivePhaseStatus(tasks.map((task) => task.status));
+		phases.push({
+			...phase,
+			status,
+			tasks
+		});
+		if (strict) halted = true;
+	}
+	return {
+		...snapshot,
+		status: deriveWorkflowStatus(phases.map((phase) => ({
+			status: phase.status,
+			bail: phase.bail
+		}))),
+		phases,
+		updated: now
+	};
+}
+/**
 * Flatten a nested list of per-phase {@link TaskResult} lists into one positional list
 * — the workflow tier of the result tree, built from each phase's `results()`.
 *
@@ -691,6 +777,302 @@ function parkSignal(signal) {
 	});
 }
 //#endregion
+//#region src/core/validators.ts
+/** Test the workflow lifecycle vocabulary. */
+function isLifecycleStatus(value) {
+	return value === "pending" || value === "running" || value === "completed" || value === "failed" || value === "skipped" || value === "stopped";
+}
+/** Test a normalized persisted task failure. */
+function isTaskFailure(value) {
+	try {
+		return isRecord(value) && Object.keys(value).every((key) => key === "origin" || key === "message") && (value.origin === "handler" || value.origin === "timeout" || value.origin === "recovery") && isNonEmptyString(value.message);
+	} catch {
+		return false;
+	}
+}
+/** Compare two optional description values. */
+function matchesDescription(left, right) {
+	return left === right && (left === void 0 || typeof left === "string");
+}
+/** Test a result's lineage against its containing snapshot nodes. */
+function isTaskResult(value, workflow, phase, task) {
+	try {
+		if (!isRecord(value) || !isRecord(workflow) || !isRecord(phase) || !isRecord(task) || !Object.keys(value).every((key) => key === "task" || key === "phase" || key === "workflow" || key === "status" || key === "result" || key === "timestamp") || !isLifecycleStatus(value.status) || value.status !== task.status || !isFiniteNumber(value.timestamp) || value.timestamp < 0 || !isRecord(value.task) || !isRecord(value.phase) || !isRecord(value.workflow) || !Object.keys(value.workflow).every((key) => key === "id" || key === "name" || key === "description") || !Object.keys(value.phase).every((key) => key === "id" || key === "name" || key === "description" || key === "workflow") || !Object.keys(value.task).every((key) => key === "id" || key === "name" || key === "description" || key === "phase")) return false;
+		if (value.task.id !== task.id || value.task.name !== task.name || !matchesDescription(value.task.description, task.description) || value.phase.id !== phase.id || value.phase.name !== phase.name || !matchesDescription(value.phase.description, phase.description) || value.workflow.id !== workflow.id || value.workflow.name !== workflow.name || !matchesDescription(value.workflow.description, workflow.description)) return false;
+		if (!isRecord(value.task.phase) || !isRecord(value.task.phase.workflow) || !isRecord(value.phase.workflow) || !Object.keys(value.task.phase).every((key) => key === "id" || key === "name" || key === "description" || key === "workflow") || !Object.keys(value.task.phase.workflow).every((key) => key === "id" || key === "name" || key === "description") || !Object.keys(value.phase.workflow).every((key) => key === "id" || key === "name" || key === "description")) return false;
+		if (value.task.phase.id !== phase.id || value.task.phase.name !== phase.name || !matchesDescription(value.task.phase.description, phase.description) || value.phase.workflow.id !== workflow.id || value.phase.workflow.name !== workflow.name || !matchesDescription(value.phase.workflow.description, workflow.description) || value.task.phase.workflow.id !== workflow.id || value.task.phase.workflow.name !== workflow.name || !matchesDescription(value.task.phase.workflow.description, workflow.description)) return false;
+		if (value.status === "completed") return isRecord(value.result) && value.result.success === true && Object.keys(value.result).every((key) => key === "success" || key === "value") && isJSONValue(value.result.value);
+		if (value.status === "failed") return isRecord(value.result) && value.result.success === false && Object.keys(value.result).every((key) => key === "success" || key === "error") && isTaskFailure(value.result.error);
+		return false;
+	} catch {
+		return false;
+	}
+}
+/**
+* Validate a safe owned JSON graph as a coherent workflow snapshot.
+*
+* @remarks
+* Callers at hostile boundaries use {@link isWorkflowSnapshot}, which owns the
+* graph first so this semantic pass never observes accessors or prototypes.
+*/
+function isOwnedWorkflowSnapshot(value) {
+	try {
+		if (!isRecord(value) || !Object.keys(value).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "override" || key === "bail" || key === "phases" || key === "created" || key === "updated") || !isNonEmptyString(value.id) || !isNonEmptyString(value.name) || value.description !== void 0 && typeof value.description !== "string" || !isLifecycleStatus(value.status) || value.override !== void 0 && value.override !== "completed" && value.override !== "skipped" && value.override !== "stopped" || !isBoolean(value.bail) || !isArray(value.phases) || !isFiniteNumber(value.created) || value.created < 0 || !isFiniteNumber(value.updated) || value.updated < value.created) return false;
+		const phaseIds = /* @__PURE__ */ new Set();
+		const derivations = [];
+		let frontier = false;
+		let running = false;
+		let vacuous = true;
+		for (const phase of value.phases) {
+			if (!isRecord(phase) || !Object.keys(phase).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "override" || key === "bail" || key === "concurrency" || key === "tasks") || !isNonEmptyString(phase.id) || phaseIds.has(phase.id) || !isNonEmptyString(phase.name) || phase.description !== void 0 && typeof phase.description !== "string" || !isLifecycleStatus(phase.status) || phase.override !== void 0 && phase.override !== "skipped" && phase.override !== "stopped" || !isBoolean(phase.bail) || phase.concurrency !== void 0 && (!isInteger(phase.concurrency) || phase.concurrency < 1) || !isArray(phase.tasks)) return false;
+			const forced = phase.override === "skipped" || phase.override === "stopped";
+			const started = phase.status === "running" || phase.status === "completed" || phase.status === "failed";
+			if (!forced && frontier && started || phase.status === "running" && running) return false;
+			if (phase.status === "running") running = true;
+			if (!forced && (phase.status === "pending" || phase.status === "running" || phase.status === "failed" && phase.bail)) frontier = true;
+			phaseIds.add(phase.id);
+			const taskIds = /* @__PURE__ */ new Set();
+			const statuses = [];
+			if (phase.tasks.length > 0) vacuous = false;
+			for (const task of phase.tasks) {
+				if (!isRecord(task) || !Object.keys(task).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "result" || key === "metadata" || key === "attempts" || key === "run" || key === "retries" || key === "timeout" || key === "activity") || !isNonEmptyString(task.id) || taskIds.has(task.id) || !isNonEmptyString(task.name) || task.description !== void 0 && typeof task.description !== "string" || !isLifecycleStatus(task.status) || !isRecord(task.metadata) || !isJSONValue(task.metadata) || !isInteger(task.attempts) || task.attempts < 0 || task.run !== void 0 && !isNonEmptyString(task.run) || task.retries !== void 0 && (!isInteger(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!isInteger(task.timeout) || task.timeout < 0 || task.timeout > 2147483647)) return false;
+				const budget = (task.retries ?? 0) + 1;
+				if (task.attempts > budget || task.status === "pending" && task.attempts >= budget) return false;
+				if (!(task.activity === void 0 || isTaskActivity(task.activity))) return false;
+				if (task.status === "running" || task.status === "completed" || task.status === "failed") {
+					if (task.attempts < 1 || task.activity === void 0) return false;
+				}
+				if (task.status === "pending" && task.activity !== void 0) return false;
+				if (task.status === "completed" || task.status === "failed") {
+					if (!isTaskResult(task.result, value, phase, task)) return false;
+				} else if (task.result !== void 0) return false;
+				taskIds.add(task.id);
+				statuses.push(task.status);
+			}
+			const derived = derivePhaseStatus(statuses);
+			if (phase.status !== (phase.override ?? derived) || phase.override !== void 0 && phase.status !== phase.override) return false;
+			derivations.push({
+				status: phase.status,
+				bail: phase.bail
+			});
+		}
+		const derived = deriveWorkflowStatus(derivations);
+		if (value.override === "completed") return value.status === "completed" && derived === "pending" && vacuous;
+		return value.status === (value.override ?? derived);
+	} catch {
+		return false;
+	}
+}
+/** Total hostile-boundary workflow snapshot guard. */
+function isWorkflowSnapshot(value) {
+	const cloned = attempt(() => cloneJSONValue(value));
+	return cloned.success && isOwnedWorkflowSnapshot(cloned.value);
+}
+/** Test that every present behavior reference resolves before dispatch. */
+function hasWorkflowHandlers(snapshot, functions) {
+	for (const phase of snapshot.phases) for (const task of phase.tasks) if (task.run !== void 0 && functions?.[task.run] === void 0) return false;
+	return true;
+}
+/** Locate the nearest identifiable node for an inconsistent owned snapshot. */
+function workflowSnapshotContext(value) {
+	if (!isRecord(value) || !isArray(value.phases)) return void 0;
+	for (const phase of value.phases) {
+		if (!isRecord(phase)) continue;
+		const phaseContext = isNonEmptyString(phase.id) ? { phase: phase.id } : void 0;
+		if (!isBoolean(phase.bail) || phase.concurrency !== void 0 && (!isInteger(phase.concurrency) || phase.concurrency < 1) || !isArray(phase.tasks)) return phaseContext;
+		for (const task of phase.tasks) {
+			if (!isRecord(task)) continue;
+			if (task.run !== void 0 && !isNonEmptyString(task.run) || task.retries !== void 0 && (!isInteger(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!isInteger(task.timeout) || task.timeout < 0 || task.timeout > 2147483647) || !isInteger(task.attempts) || task.attempts < 0) return {
+				...phaseContext ?? {},
+				...isNonEmptyString(task.id) ? { task: task.id } : {}
+			};
+		}
+	}
+}
+/**
+* Test whether an unknown value is a valid whole-frame activity report.
+*/
+function isTaskActivityInput(value) {
+	try {
+		if (!isRecord(value)) return false;
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null || !Object.keys(value).every((key) => key === "note" || key === "progress" || key === "operations" || key === "constraints")) return false;
+		const note = value.note;
+		const progress = value.progress;
+		const operations = value.operations;
+		const constraints = value.constraints;
+		if (note !== void 0 && !isNonEmptyString(note)) return false;
+		if (progress !== void 0) {
+			if (!isRecord(progress)) return false;
+			const progressPrototype = Object.getPrototypeOf(progress);
+			if (progressPrototype !== Object.prototype && progressPrototype !== null || !Object.keys(progress).every((key) => key === "current" || key === "total" || key === "unit")) return false;
+			const current = progress.current;
+			const total = progress.total;
+			const unit = progress.unit;
+			if (!isFiniteNumber(current) || current < 0 || total !== void 0 && (!isFiniteNumber(total) || total < current) || unit !== void 0 && !isNonEmptyString(unit)) return false;
+		}
+		if (operations !== void 0) {
+			if (!isArray(operations)) return false;
+			const ids = /* @__PURE__ */ new Set();
+			for (const operation of operations) {
+				if (!isRecord(operation)) return false;
+				const operationPrototype = Object.getPrototypeOf(operation);
+				if (operationPrototype !== Object.prototype && operationPrototype !== null || !Object.keys(operation).every((key) => key === "id" || key === "name" || key === "started")) return false;
+				const id = operation.id;
+				const name = operation.name;
+				const started = operation.started;
+				if (!isNonEmptyString(id) || !isNonEmptyString(name) || !isFiniteNumber(started) || started < 0 || ids.has(id)) return false;
+				ids.add(id);
+			}
+		}
+		if (constraints !== void 0) {
+			if (!isArray(constraints)) return false;
+			const ids = /* @__PURE__ */ new Set();
+			for (const constraint of constraints) {
+				if (!isRecord(constraint)) return false;
+				const constraintPrototype = Object.getPrototypeOf(constraint);
+				if (constraintPrototype !== Object.prototype && constraintPrototype !== null || !Object.keys(constraint).every((key) => key === "id" || key === "name" || key === "started")) return false;
+				const id = constraint.id;
+				const name = constraint.name;
+				const started = constraint.started;
+				if (!isNonEmptyString(id) || !isNonEmptyString(name) || !isFiniteNumber(started) || started < 0 || ids.has(id)) return false;
+				ids.add(id);
+			}
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Test whether an unknown value is valid persisted task activity.
+*/
+function isTaskActivity(value) {
+	try {
+		if (!isRecord(value)) return false;
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null || !Object.keys(value).every((key) => key === "note" || key === "progress" || key === "operations" || key === "constraints" || key === "updated")) return false;
+		const note = value.note;
+		const progress = value.progress;
+		const operations = value.operations;
+		const constraints = value.constraints;
+		const updated = value.updated;
+		if (operations === void 0 || constraints === void 0 || !isFiniteNumber(updated) || updated < 0) return false;
+		return isTaskActivityInput({
+			...note === void 0 ? {} : { note },
+			...progress === void 0 ? {} : { progress },
+			operations,
+			constraints
+		});
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/core/cloners.ts
+/**
+* Validate and own a workflow snapshot before live construction.
+*
+* @param input - The hostile snapshot boundary
+* @returns A deeply owned frozen snapshot
+*/
+function cloneWorkflowSnapshot(input) {
+	try {
+		const cloned = cloneJSONValue(input);
+		if (!isOwnedWorkflowSnapshot(cloned)) throw new WorkflowError("RESTORE", "workflow snapshot is inconsistent", workflowSnapshotContext(cloned));
+		return cloned;
+	} catch (error) {
+		if (isWorkflowError(error)) throw error;
+		if (isContractError(error)) throw new WorkflowError("RESTORE", `workflow snapshot could not be read safely: ${error.message}`);
+		throw new WorkflowError("RESTORE", "workflow snapshot could not be read safely");
+	}
+}
+/**
+* Validate and clone one complete task activity frame.
+*
+* @remarks
+* This is the hostile boundary behind task reports and snapshot hydration. Supplying
+* `updated` stamps an input frame without reading an `updated` property from it; omitting
+* `updated` restores a stored frame and reads its persisted timestamp exactly once. Every
+* untrusted property is captured once inside one protected boundary. The returned frame,
+* collections, progress, operations, and constraints are copied and frozen.
+*
+* @param input - The untrusted complete activity frame
+* @param updated - An optional accepted timestamp used instead of a persisted `updated`
+* @returns An immutable cloned {@link TaskActivity}
+* @throws {WorkflowError} With `MUTATION` when the frame cannot be read or validated
+*/
+function cloneTaskActivity(input, updated) {
+	try {
+		if (!isRecord(input)) throw new WorkflowError("MUTATION", "task activity must be a record");
+		const inputPrototype = Object.getPrototypeOf(input);
+		if (inputPrototype !== Object.prototype && inputPrototype !== null || !Object.keys(input).every((key) => key === "note" || key === "progress" || key === "operations" || key === "constraints" || updated === void 0 && key === "updated")) throw new WorkflowError("MUTATION", "task activity must be a record");
+		const note = input.note;
+		const progressInput = input.progress;
+		const operationsInput = input.operations;
+		const constraintsInput = input.constraints;
+		const accepted = updated === void 0 ? input.updated : updated;
+		const operationInputs = operationsInput === void 0 ? [] : isArray(operationsInput) ? [...operationsInput] : void 0;
+		if (operationInputs === void 0) throw new WorkflowError("MUTATION", "task activity operations must be an array");
+		const operations = [];
+		for (const operation of operationInputs) {
+			if (!isRecord(operation)) throw new WorkflowError("MUTATION", "task activity contains an invalid operation");
+			const operationPrototype = Object.getPrototypeOf(operation);
+			if (operationPrototype !== Object.prototype && operationPrototype !== null || !Object.keys(operation).every((key) => key === "id" || key === "name" || key === "started")) throw new WorkflowError("MUTATION", "task activity contains an invalid operation");
+			const id = operation.id;
+			const name = operation.name;
+			const started = operation.started;
+			operations.push(Object.freeze({
+				id,
+				name,
+				started
+			}));
+		}
+		let progress;
+		if (progressInput !== void 0) {
+			if (!isRecord(progressInput)) throw new WorkflowError("MUTATION", "task activity contains invalid progress");
+			const progressPrototype = Object.getPrototypeOf(progressInput);
+			if (progressPrototype !== Object.prototype && progressPrototype !== null || !Object.keys(progressInput).every((key) => key === "current" || key === "total" || key === "unit")) throw new WorkflowError("MUTATION", "task activity contains invalid progress");
+			const current = progressInput.current;
+			const total = progressInput.total;
+			const unit = progressInput.unit;
+			progress = Object.freeze({
+				current,
+				...total === void 0 ? {} : { total },
+				...unit === void 0 ? {} : { unit }
+			});
+		}
+		const constraintInputs = constraintsInput === void 0 ? [] : isArray(constraintsInput) ? [...constraintsInput] : void 0;
+		if (constraintInputs === void 0) throw new WorkflowError("MUTATION", "task activity constraints must be an array");
+		const constraints = [];
+		for (const constraint of constraintInputs) {
+			if (!isRecord(constraint)) throw new WorkflowError("MUTATION", "task activity contains an invalid constraint");
+			const constraintPrototype = Object.getPrototypeOf(constraint);
+			if (constraintPrototype !== Object.prototype && constraintPrototype !== null || !Object.keys(constraint).every((key) => key === "id" || key === "name" || key === "started")) throw new WorkflowError("MUTATION", "task activity contains an invalid constraint");
+			const id = constraint.id;
+			const name = constraint.name;
+			const started = constraint.started;
+			constraints.push(Object.freeze({
+				id,
+				name,
+				started
+			}));
+		}
+		const activity = Object.freeze({
+			...note === void 0 ? {} : { note },
+			...progress === void 0 ? {} : { progress },
+			operations: Object.freeze(operations),
+			constraints: Object.freeze(constraints),
+			updated: accepted
+		});
+		if (!isTaskActivity(activity)) throw new WorkflowError("MUTATION", "task activity is invalid");
+		return activity;
+	} catch (error) {
+		if (isWorkflowError(error)) throw error;
+		throw new WorkflowError("MUTATION", "task activity could not be read safely");
+	}
+}
+//#endregion
 //#region src/core/shapers.ts
 /**
 * The shape of a {@link import('./types.js').TaskDefinition} — identity plus an optional
@@ -717,6 +1099,7 @@ var taskShape = objectShape({
 	})),
 	timeout: optionalShape(integerShape({
 		min: 0,
+		max: MAX_TIMER_MS,
 		description: "Per-attempt deadline in milliseconds; overrides the phase default. Omitted means no deadline."
 	}))
 });
@@ -863,13 +1246,14 @@ var DatabaseWorkflowStore = class {
 	async get(id) {
 		const row = await this.#table.get(id);
 		if (row === void 0) return void 0;
-		return isWorkflowSnapshot(row.snapshot) ? row.snapshot : void 0;
+		return cloneWorkflowSnapshot(row.snapshot);
 	}
 	/** Insert or replace under the snapshot's OWN `id` (no separate id param) — the row is `{ id, snapshot }`. */
 	async set(snapshot) {
+		const owned = cloneWorkflowSnapshot(snapshot);
 		await this.#table.set({
-			id: snapshot.id,
-			snapshot
+			id: owned.id,
+			snapshot: owned
 		});
 	}
 	/** Drop a snapshot by id; an absent id is a no-op (no throw). */
@@ -920,10 +1304,12 @@ var DatabaseWorkflowStore = class {
 var MemoryWorkflowStore = class {
 	#snapshots = /* @__PURE__ */ new Map();
 	get(id) {
-		return Promise.resolve(this.#snapshots.get(id));
+		const snapshot = this.#snapshots.get(id);
+		return Promise.resolve(snapshot === void 0 ? void 0 : cloneWorkflowSnapshot(snapshot));
 	}
 	set(snapshot) {
-		this.#snapshots.set(snapshot.id, snapshot);
+		const owned = cloneWorkflowSnapshot(snapshot);
+		this.#snapshots.set(owned.id, owned);
 		return Promise.resolve();
 	}
 	delete(id) {
@@ -946,9 +1332,8 @@ var MemoryWorkflowStore = class {
 *   `TRANSITION` {@link WorkflowError} on an illegal move (e.g. completing a non-`running`
 *   task) — the legal graph is the single source of truth, so the leaf can never reach an
 *   impossible state.
-* - **Override (snapshot fidelity).** `skip` / `stop` set `#override` to the forced terminal
-*   status, so a RESTORE can tell a forced leaf (`skipped` / `stopped`) from a run-produced
-*   one and reinstate it AS an override — preserving the round-trip.
+* - **Snapshot fidelity.** A leaf needs no override: `skipped` / `stopped` are explicit terminal
+*   statuses, and restore reinstates the leaf directly from {@link TaskSnapshot.status}.
 * - **The cascade.** Every status change records its boxed result (when any), fires the leaf's
 *   OWN event, THEN calls the parent phase's `#recompute` (injected at construction) so the
 *   transition propagates UP (Task → Phase → Workflow re-derive). The own-event-before-cascade
@@ -963,7 +1348,8 @@ var MemoryWorkflowStore = class {
 *   matching {@link import('../types.js').TaskDefinition} / {@link TaskSnapshot} field. `handler`
 *   is the RUNTIME-ONLY counterpart — `run` resolved ONCE at construction against the
 *   workflow-level {@link import('../types.js').WorkflowOptions.functions} registry — and is
-*   NEVER persisted; `undefined` when `run` is omitted or unregistered (the no-handler rule).
+*   NEVER persisted; `undefined` when `run` is omitted or unregistered. Only omission is a
+*   deliberate no-op; unresolved named work is rejected before dispatch.
 */
 var Task = class {
 	#context;
@@ -978,13 +1364,27 @@ var Task = class {
 	#run;
 	#retries;
 	#timeout;
+	#attempts;
 	#handler;
-	constructor(context, phase, workflow, recompute, options, status = "pending", result, run, retries, timeout, handler) {
-		this.#context = context;
+	#abort;
+	#silence;
+	#onSilence;
+	#liveness;
+	#activity;
+	#paused;
+	#gate;
+	#timerSignal;
+	constructor(context, phase, workflow, recompute, options, status = "pending", result, run, retries, timeout, metadata = {}, attempts = 0, activity, handler, silence) {
+		this.#context = buildTaskContext(context.phase, context);
 		this.#phase = phase;
 		this.#workflow = workflow;
 		this.#recompute = recompute;
-		this.#metadata = options?.metadata ?? {};
+		try {
+			this.#metadata = cloneJSONRecord(options?.metadata ?? metadata);
+		} catch (error) {
+			if (isContractError(error)) throw new WorkflowError("RESTORE", `task '${context.id}' metadata could not be read safely: ${error.message}`, { task: context.id });
+			throw new WorkflowError("RESTORE", `task '${context.id}' metadata could not be read safely`, { task: context.id });
+		}
 		this.#emitter = new Emitter({
 			...options?.on === void 0 ? {} : { on: options.on },
 			...options?.error === void 0 ? {} : { error: options.error }
@@ -999,7 +1399,19 @@ var Task = class {
 		this.#run = run;
 		this.#retries = retries;
 		this.#timeout = timeout;
+		this.#attempts = attempts;
 		this.#handler = handler;
+		this.#abort = createAbort();
+		this.#silence = resolveTaskSilence(options?.silence, silence);
+		this.#onSilence = this.#expire.bind(this);
+		this.#liveness = this.#silence === void 0 ? void 0 : createTimeout({
+			ms: this.#silence,
+			signal: this.#abort.signal
+		});
+		this.#activity = activity === void 0 ? void 0 : cloneTaskActivity(activity);
+		this.#paused = false;
+		this.#gate = void 0;
+		this.#timerSignal = void 0;
 	}
 	get emitter() {
 		return this.#emitter;
@@ -1025,6 +1437,9 @@ var Task = class {
 	get result() {
 		return this.#result;
 	}
+	get attempts() {
+		return this.#attempts;
+	}
 	get run() {
 		return this.#run;
 	}
@@ -1037,40 +1452,120 @@ var Task = class {
 	get timeout() {
 		return this.#timeout;
 	}
+	get activity() {
+		return this.#activity;
+	}
+	get silence() {
+		return this.#silence;
+	}
+	get silent() {
+		return this.#status === "running" && this.#liveness?.expired === true;
+	}
+	get paused() {
+		return this.#paused;
+	}
+	get signal() {
+		return this.#abort.signal;
+	}
 	start() {
-		this.#transition("running");
+		const budget = Math.max(0, this.#retries ?? 0) + 1;
+		if (this.#status !== "pending" && this.#status !== "running" || this.#attempts >= budget) throw new WorkflowError("TRANSITION", `task '${this.id}' cannot start another attempt`, {
+			task: this.id,
+			status: this.#status,
+			attempts: this.#attempts,
+			budget
+		});
+		if (this.#status === "pending") this.#transition("running");
+		this.#attempts += 1;
+		this.#activity = cloneTaskActivity({}, this.#stamp());
+		this.#arm();
 		this.#emitter.emit("start", this.id);
 		this.#escalate();
 	}
 	complete(value) {
+		let owned;
+		try {
+			owned = cloneJSONValue(value);
+		} catch (error) {
+			if (isContractError(error)) throw new WorkflowError("RESTORE", `task '${this.id}' result could not be read safely: ${error.message}`, { task: this.id });
+			throw new WorkflowError("RESTORE", `task '${this.id}' result could not be read safely`, { task: this.id });
+		}
 		this.#transition("completed");
-		const result = this.#record("completed", {
+		this.#finish();
+		const result = this.#record("completed", Object.freeze({
 			success: true,
-			value
-		});
+			value: owned
+		}));
 		this.#emitter.emit("complete", result);
 		this.#escalate();
 	}
 	fail(error) {
+		const origin = error.origin === "handler" || error.origin === "timeout" || error.origin === "recovery" ? error.origin : "handler";
+		const message = typeof error.message === "string" && error.message.length > 0 ? error.message : "unknown failure";
 		this.#transition("failed");
-		const reason = error instanceof Error ? error : new Error(String(error), { cause: error });
-		const result = this.#record("failed", {
+		this.#finish();
+		const result = this.#record("failed", Object.freeze({
 			success: false,
-			error: reason
-		});
+			error: Object.freeze({
+				origin,
+				message
+			})
+		}));
 		this.#emitter.emit("fail", result);
 		this.#escalate();
 	}
 	skip() {
 		this.#transition("skipped");
+		this.#finish();
+		this.#abort.abort();
 		this.#emitter.emit("skip");
 		this.#escalate();
 	}
 	stop() {
 		this.#transition("stopped");
+		this.#finish();
+		this.#abort.abort();
 		this.#emitter.emit("stop");
 		this.#escalate();
 	}
+	report(input) {
+		if (this.#status !== "running") return failure(new WorkflowError("TRANSITION", `task '${this.id}' cannot report while '${this.#status}'`, {
+			task: this.id,
+			status: this.#status
+		}));
+		try {
+			const activity = cloneTaskActivity(input, this.#stamp());
+			this.#activity = activity;
+			this.#arm();
+			this.#emitter.emit("report", activity);
+			return success(activity);
+		} catch (error) {
+			return failure(error instanceof WorkflowError ? error : new WorkflowError("MUTATION", "task activity report was refused", { task: this.id }));
+		}
+	}
+	pulse() {
+		if (this.#status !== "running" || this.#activity === void 0) return false;
+		this.#touch();
+		this.#arm();
+		const activity = this.#activity;
+		this.#emitter.emit("pulse", activity);
+		return true;
+	}
+	pause() {
+		if (this.#paused || this.#status !== "pending" && this.#status !== "running") return;
+		this.#paused = true;
+		this.#gate = createDeferred();
+		this.#emitter.emit("pause");
+	}
+	resume() {
+		if (!this.#paused) return;
+		this.#paused = false;
+		this.#release();
+		this.#emitter.emit("resume");
+	}
+	wait() {
+		return this.#paused && this.#gate !== void 0 ? this.#gate.promise : Promise.resolve();
+	}
 	/**
 	* Apply a validated declarative patch to SELF (`name` / `description`).
 	*
@@ -1105,9 +1600,11 @@ var Task = class {
 			status: this.#status,
 			...this.#result === void 0 ? {} : { result: this.#result },
 			metadata: this.#metadata,
+			attempts: this.#attempts,
 			...this.#run === void 0 ? {} : { run: this.#run },
 			...this.#retries === void 0 ? {} : { retries: this.#retries },
-			...this.#timeout === void 0 ? {} : { timeout: this.#timeout }
+			...this.#timeout === void 0 ? {} : { timeout: this.#timeout },
+			...this.#activity === void 0 ? {} : { activity: this.#activity }
 		};
 	}
 	#transition(to) {
@@ -1127,12 +1624,53 @@ var Task = class {
 			...result === void 0 ? {} : { result },
 			timestamp: Date.now()
 		};
-		this.#result = record;
-		return record;
+		const frozen = Object.freeze(record);
+		this.#result = frozen;
+		return frozen;
 	}
 	#escalate() {
 		this.#recompute();
 	}
+	#touch() {
+		if (this.#activity === void 0) return;
+		this.#activity = Object.freeze({
+			...this.#activity,
+			updated: this.#stamp()
+		});
+	}
+	#stamp() {
+		return Math.max(Date.now(), this.#activity?.updated ?? 0);
+	}
+	#finish() {
+		this.#clear();
+		this.#paused = false;
+		this.#release();
+	}
+	#arm() {
+		this.#clear();
+		const liveness = this.#liveness;
+		if (liveness === void 0 || this.#status !== "running") return;
+		liveness.start();
+		const signal = liveness.signal;
+		this.#timerSignal = signal;
+		signal.addEventListener("abort", this.#onSilence, { once: true });
+	}
+	#clear() {
+		const signal = this.#timerSignal;
+		if (signal !== void 0) signal.removeEventListener("abort", this.#onSilence);
+		this.#timerSignal = void 0;
+		this.#liveness?.clear();
+	}
+	#expire() {
+		this.#timerSignal = void 0;
+		if (this.#status !== "running" || this.#liveness?.expired !== true) return;
+		this.#emitter.emit("silence");
+	}
+	#release() {
+		if (this.#gate === void 0) return;
+		this.#gate.resolve();
+		this.#gate = void 0;
+	}
 };
 //#endregion
 //#region src/core/tasks/TaskManager.ts
@@ -1233,9 +1771,11 @@ var TaskManager = class {
 *   `results()` collects the settled tasks' {@link TaskResult}s (the phase tier of the result
 *   tree); `workflow` navigates UP to the live parent.
 * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link PhaseEventMap}) fires
-*   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE, strictly AFTER the
-*   recompute + escalate; the emitter isolates a listener throw and routes it to its `error`
-*   handler (the `error` option); `fail` carries the failing task's {@link TaskResult}.
+*   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+*   corresponding status or runtime-gate change. Status events fire after the phase recomputes
+*   and before it escalates to the workflow, preserving child/phase cause before parent effect.
+*   The emitter isolates a listener throw and routes it to its `error` handler (the `error`
+*   option); `fail` carries the failing task's {@link TaskResult}.
 * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
 *   delegating to {@link tasks} (the manager gates the target's own existence/status/id/
 *   bounds), then emit the matching {@link PhaseEventMap} event on success only. NATIVE
@@ -1255,7 +1795,8 @@ var TaskManager = class {
 *   {@link import('../types.js').WorkflowFunctions} registry (threaded from
 *   {@link import('../types.js').WorkflowOptions.functions}) resolves each task's `run` name into
 *   its runtime {@link import('../types.js').TaskInterface.handler} ONCE; a `run` that is omitted
-*   or unregistered resolves to no handler (the no-handler rule).
+*   or unregistered resolves to no handler; only an omitted `run` is a no-op, while an
+*   unresolved present name makes the containing tree non-drivable.
 * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror the workflow's own
 *   quartet, scoped to this phase — a driving
 *   {@link import('../types.js').WorkflowRunnerInterface.execute} gates a task's own
@@ -1272,6 +1813,7 @@ var Phase = class {
 	#escalateUp;
 	#tasks = new TaskManager();
 	#functions;
+	#silence;
 	#bail;
 	#concurrency;
 	#emitter;
@@ -1279,7 +1821,7 @@ var Phase = class {
 	#override;
 	#paused;
 	#gate;
-	constructor(snapshot, workflow, escalate, options, bail, functions) {
+	constructor(snapshot, workflow, escalate, options, bail, functions, silence) {
 		this.#id = snapshot.id;
 		this.#name = snapshot.name;
 		if (snapshot.description !== void 0) Object.defineProperty(this, "description", {
@@ -1289,6 +1831,7 @@ var Phase = class {
 		this.#workflow = workflow;
 		this.#escalateUp = escalate;
 		this.#functions = functions;
+		this.#silence = silence;
 		this.#bail = bail ?? snapshot.bail;
 		this.#concurrency = snapshot.concurrency;
 		this.#emitter = new Emitter({
@@ -1357,11 +1900,13 @@ var Phase = class {
 		if (this.#paused || isTerminalStatus(this.status)) return;
 		this.#paused = true;
 		this.#gate = createDeferred();
+		this.#emitter.emit("pause");
 	}
 	resume() {
 		if (!this.#paused) return;
 		this.#paused = false;
 		this.#release();
+		this.#emitter.emit("resume");
 	}
 	wait() {
 		return this.#paused && this.#gate !== void 0 ? this.#gate.promise : Promise.resolve();
@@ -1442,6 +1987,10 @@ var Phase = class {
 			return;
 		}
 		this.#status = next;
+		if (isTerminalStatus(next)) {
+			this.#paused = false;
+			this.#release();
+		}
 		this.#emitFor(next);
 		this.#escalateUp();
 	}
@@ -1453,6 +2002,7 @@ var Phase = class {
 		if (status === "running") this.#emitter.emit("start", this.id);
 		else if (status === "completed") this.#emitter.emit("complete");
 		else if (status === "failed") this.#emitter.emit("fail", this.#failure());
+		else if (status === "skipped") this.#emitter.emit("skip");
 		else if (status === "stopped") this.#emitter.emit("stop");
 	}
 	#failure() {
@@ -1477,7 +2027,7 @@ var Phase = class {
 	#create(snapshot, options) {
 		const context = buildTaskContext(this.context, snapshot);
 		const handler = snapshot.run === void 0 ? void 0 : this.#functions?.[snapshot.run];
-		return new Task(context, this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.run, snapshot.retries, snapshot.timeout, handler);
+		return new Task(context, this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.run, snapshot.retries, snapshot.timeout, snapshot.metadata, snapshot.attempts, snapshot.activity, handler, this.#silence);
 	}
 	#mint(definition) {
 		return this.#create(taskDefinitionToSnapshot(definition), void 0);
@@ -1581,18 +2131,20 @@ var PhaseManager = class {
 *   reachable ONLY under `bail: true` (a single failed task halts the workflow); under
 *   `bail: false` a failed phase folds into `completed`. {@link #recompute} diffs on each phase
 *   change; a CHANGE emits.
-* - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; the override is PERSISTED in the
-*   snapshot's own `override` field and restored DIRECTLY (no divergence guess). The snapshot also
-*   persists `bail`, so a restore re-derives status identically without a silent policy default.
+* - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; an executed task-free pending tree
+*   may also be force-completed vacuously. The override is PERSISTED in the snapshot's own
+*   `override` field and restored DIRECTLY (no divergence guess). The snapshot also persists
+*   `bail`, so a restore re-derives status identically without a silent policy default.
 * - **Result tree.** `results()` flattens every phase's `results()` ({@link collectResults}) — the
 *   workflow tier; `phase(id)` + each `phase.task(id)` navigate DOWN, a task's `phase` / `workflow`
 *   navigate UP.
 * - **Snapshot.** `snapshot()` serializes the whole live tree to a {@link WorkflowSnapshot} (pure
 *   JSON); {@link import('./factories.js').restoreWorkflow} rebuilds an equivalent live tree.
 * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link WorkflowEventMap}) fires
-*   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE; the emitter isolates a
-*   listener throw and routes it to its `error` handler (the `error` option); `fail` carries
-*   the failing task's {@link TaskResult}.
+*   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+*   corresponding status or runtime-gate change; the emitter isolates a listener throw and
+*   routes it to its `error` handler (the `error` option); `fail` carries the failing task's
+*   {@link TaskResult}.
 * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
 *   delegating to {@link phases} (the manager gates the target's own existence/status/id/
 *   bounds), then emit the matching {@link WorkflowEventMap} event on success only. NATIVE,
@@ -1604,16 +2156,17 @@ var PhaseManager = class {
 *   naturally accepted.
 * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` gate execution at the runner's
 *   phase/task boundaries WITHOUT touching {@link status} — `paused` is runtime-only, never
-*   persisted. `destroy` is a terminal teardown: it aborts {@link signal}, `stop`s every
-*   non-terminal live phase (so an engine parked on a phase's own gate unparks and the tree
-*   lands coherent), forces the `stop` override on THIS workflow when not already terminal,
-*   releases any parked {@link wait} waiter, and marks {@link destroyed} — all four idempotent.
+*   persisted. `destroy` is a terminal teardown: it `stop`s every non-terminal task and
+*   phase (releasing their gates and liveness resources), aborts {@link signal}, forces the
+*   workflow `stop` override when needed, releases its parked waiter, and marks
+*   {@link destroyed} — all idempotent.
 */
 var Workflow = class {
 	#context;
 	#bail;
 	#bailOverride;
 	#functions;
+	#silence;
 	#phases = new PhaseManager();
 	#emitter;
 	#created;
@@ -1630,6 +2183,7 @@ var Workflow = class {
 		this.#bail = options?.bail ?? snapshot.bail;
 		this.#bailOverride = options?.bail;
 		this.#functions = options?.functions;
+		this.#silence = options?.silence;
 		this.#emitter = new Emitter({
 			...options?.on === void 0 ? {} : { on: options.on },
 			...options?.error === void 0 ? {} : { error: options.error }
@@ -1691,26 +2245,35 @@ var Workflow = class {
 		this.#release();
 	}
 	complete() {
-		if (this.status === "pending") this.#force("completed");
+		if (this.status === "pending" && this.#phases.phases().every((phase) => phase.tasks.count === 0)) this.#force("completed");
 	}
 	pause() {
 		if (this.#paused || isTerminalStatus(this.status) || this.#destroyed) return;
 		this.#paused = true;
 		this.#gate = createDeferred();
+		this.#emitter.emit("pause");
 	}
 	resume() {
 		if (!this.#paused) return;
 		this.#paused = false;
 		this.#release();
+		this.#emitter.emit("resume");
 	}
 	destroy() {
 		if (this.#destroyed) return;
 		this.#destroyed = true;
-		this.#abort.abort();
-		for (const phase of this.#phases.phases()) if (!isTerminalStatus(phase.status)) phase.stop();
+		const phases = this.#phases.phases();
 		if (!isTerminalStatus(this.status)) this.stop();
+		for (const phase of phases) phase.stop();
+		for (const phase of phases) for (const task of phase.tasks.tasks()) if (!isTerminalStatus(task.status)) task.stop();
 		this.#paused = false;
 		this.#release();
+		this.#abort.abort();
+		for (const phase of phases) {
+			for (const task of phase.tasks.tasks()) task.emitter.destroy();
+			phase.emitter.destroy();
+		}
+		this.#emitter.destroy();
 	}
 	wait() {
 		return this.#paused && this.#gate !== void 0 ? this.#gate.promise : Promise.resolve();
@@ -1772,7 +2335,7 @@ var Workflow = class {
 		return result;
 	}
 	snapshot() {
-		return {
+		return cloneWorkflowSnapshot({
 			id: this.id,
 			name: this.name,
 			...this.description === void 0 ? {} : { description: this.description },
@@ -1782,13 +2345,17 @@ var Workflow = class {
 			phases: this.#phases.phases().map((phase) => phase.snapshot()),
 			created: this.#created,
 			updated: this.#updated
-		};
+		});
 	}
 	#recompute() {
 		const next = this.status;
 		if (next === this.#status) return;
 		this.#status = next;
-		this.#updated = Date.now();
+		if (isTerminalStatus(next)) {
+			this.#paused = false;
+			this.#release();
+		}
+		this.#updated = Math.max(Date.now(), this.#updated);
 		this.#emitFor(next);
 	}
 	#force(status) {
@@ -1799,6 +2366,7 @@ var Workflow = class {
 		if (status === "running") this.#emitter.emit("start", this.id);
 		else if (status === "completed") this.#emitter.emit("complete");
 		else if (status === "failed") this.#emitter.emit("fail", this.#failure());
+		else if (status === "skipped") this.#emitter.emit("skip");
 		else if (status === "stopped") this.#emitter.emit("stop");
 	}
 	#addTo(phase, index, at) {
@@ -1818,11 +2386,11 @@ var Workflow = class {
 		return found;
 	}
 	#append(phase, options) {
-		const created = new Phase(phase, this, () => this.#recompute(), options?.phases?.[phase.id], this.#bailOverride, this.#functions);
+		const created = new Phase(phase, this, () => this.#recompute(), options?.phases?.[phase.id], this.#bailOverride, this.#functions, this.#silence);
 		this.#phases.append(created);
 	}
 	#mint(definition) {
-		return new Phase(phaseDefinitionToSnapshot(definition, this.#bail), this, () => this.#recompute(), void 0, this.#bailOverride, this.#functions);
+		return new Phase(phaseDefinitionToSnapshot(definition, this.#bail), this, () => this.#recompute(), void 0, this.#bailOverride, this.#functions, this.#silence);
 	}
 	#release() {
 		if (this.#gate === void 0) return;
@@ -2242,18 +2810,17 @@ var Runner = class {
 //#endregion
 //#region src/core/tasks/TaskController.ts
 /**
-* The lean per-task handle a {@link import('./types.js').WorkflowFunction} receives — the
-* running task's folded cancellation, its input, its lineage, and read-UP access to the
-* result tree.
+* The attempt-scoped handle a {@link import('./types.js').WorkflowFunction} receives.
 *
 * @remarks
 * - **A leaf handle, NOT the runner `Controller`.** A workflow task is a leaf of the
-*   declarative W-b tree, not a fan-out unit, so this carries none of the runner
-*   `Controller`'s `spawn` / `wait` — only what a leaf needs.
-* - **Folded signal.** `signal` is the cancellation the runner folds for THIS run: it fires
-*   on a workflow-level abort / timeout / budget ceiling, or — under `bail: true` — when a
-*   sibling task fails (the runner aborts the in-flight siblings via the substrate's
-*   fail-fast). A handler races its work against it; `aborted` reads it.
+*   declarative W-b tree, not a fan-out unit, so it has no `spawn`; its `wait` instead
+*   checkpoints the workflow, phase, and task cooperative gates.
+* - **Folded signal.** `signal` is the cancellation folded for THIS attempt: its per-attempt
+*   deadline, task stop/skip, workflow abort/timeout/budget/destroy, or a sibling fail-fast.
+*   A handler races its work against it; `aborted` reads it.
+* - **Attempt ownership.** `report` / `pulse` are closures supplied by the runner and refuse
+*   after this signal aborts or a retry token supersedes this handle.
 * - **Input + lineage.** `input` is the task's open `metadata` bag (its
 *   {@link import('./types.js').TaskInput} payload, `{}` when none); `task` is the full
 *   {@link TaskContext}, so `task.phase` / `task.phase.workflow` navigate UP the lineage.
@@ -2269,19 +2836,273 @@ var TaskController = class {
 	signal;
 	input;
 	task;
+	attempt;
+	#entity;
+	#report;
+	#pulse;
 	#results;
-	constructor(signal, input, task, results) {
+	constructor(signal, input, task, attempt, results, report, pulse) {
 		this.signal = signal;
 		this.input = input;
-		this.task = task;
+		this.task = task.context;
+		this.attempt = attempt;
+		this.#entity = task;
 		this.#results = results;
+		this.#report = report;
+		this.#pulse = pulse;
 	}
 	get aborted() {
 		return this.signal.aborted;
 	}
+	get paused() {
+		if (this.#ancestorTerminal()) return false;
+		return this.#entity.workflow.paused || this.#entity.phase.paused || !isTerminalStatus(this.#entity.status) && this.#entity.paused;
+	}
+	report(input) {
+		return this.#report(input);
+	}
+	pulse() {
+		return this.#pulse();
+	}
+	async wait() {
+		while (this.paused && !this.signal.aborted) await this.#race(this.#gates());
+	}
 	results() {
 		return this.#results();
 	}
+	#gates() {
+		if (this.#ancestorTerminal()) return [];
+		const gates = [];
+		if (this.#entity.workflow.paused) gates.push(this.#entity.workflow.wait());
+		if (this.#entity.phase.paused) gates.push(this.#entity.phase.wait());
+		if (!isTerminalStatus(this.#entity.status) && this.#entity.paused) gates.push(this.#entity.wait());
+		return gates;
+	}
+	async #race(gates) {
+		if (this.signal.aborted || gates.length === 0) return;
+		const deferred = Promise.withResolvers();
+		const onAbort = this.#resolve.bind(this, deferred);
+		const onTerminal = this.#resolve.bind(this, deferred);
+		this.signal.addEventListener("abort", onAbort, { once: true });
+		this.#entity.workflow.emitter.on("skip", onTerminal);
+		this.#entity.workflow.emitter.on("stop", onTerminal);
+		this.#entity.phase.emitter.on("skip", onTerminal);
+		this.#entity.phase.emitter.on("stop", onTerminal);
+		try {
+			if (this.#ancestorTerminal()) deferred.resolve();
+			await Promise.race([Promise.all(gates), deferred.promise]);
+		} finally {
+			this.signal.removeEventListener("abort", onAbort);
+			this.#entity.workflow.emitter.off("skip", onTerminal);
+			this.#entity.workflow.emitter.off("stop", onTerminal);
+			this.#entity.phase.emitter.off("skip", onTerminal);
+			this.#entity.phase.emitter.off("stop", onTerminal);
+		}
+	}
+	#ancestorTerminal() {
+		return isTerminalStatus(this.#entity.workflow.status) || isTerminalStatus(this.#entity.phase.status);
+	}
+	#resolve(deferred) {
+		deferred.resolve();
+	}
+};
+//#endregion
+//#region src/core/WorkflowPersistence.ts
+/**
+* Advanced run-local snapshot persistence with one writer and one coalesced latest obligation.
+*
+* @remarks
+* Normally composed by `WorkflowRunner.execute({ store })`; exported for hosts that need to
+* coordinate the same required boundaries around their own runner integration.
+*/
+var WorkflowPersistence = class {
+	#workflow;
+	#store;
+	#phases = /* @__PURE__ */ new Set();
+	#tasks = /* @__PURE__ */ new Set();
+	#onWorkflowChange;
+	#onWorkflowAdd;
+	#onWorkflowRemove;
+	#onPhaseChange;
+	#onPhaseAdd;
+	#onPhaseRemove;
+	#onTaskChange;
+	#writing;
+	#error;
+	#fault;
+	#attached = true;
+	#revision = 0;
+	#stored = 0;
+	constructor(workflow, store) {
+		this.#workflow = workflow;
+		this.#store = store;
+		this.#onWorkflowChange = this.#change.bind(this);
+		this.#onWorkflowAdd = this.#addPhase.bind(this);
+		this.#onWorkflowRemove = this.#removePhase.bind(this);
+		this.#onPhaseChange = this.#change.bind(this);
+		this.#onPhaseAdd = this.#addTask.bind(this);
+		this.#onPhaseRemove = this.#removeTask.bind(this);
+		this.#onTaskChange = this.#change.bind(this);
+		this.#attachWorkflow();
+	}
+	get fault() {
+		return this.#fault;
+	}
+	/**
+	* Persist every change through this required boundary.
+	*
+	* @param checkpoint - The boundary being made durable
+	* @param task - The task owning an attempt or settlement
+	* @param attempt - The persisted attempt number
+	* @returns Whether the latest state reached the store
+	*/
+	async checkpoint(checkpoint, task, attempt) {
+		const revision = this.#mark();
+		while (this.#stored < revision) await this.#flush();
+		if (this.#error === void 0) return true;
+		if (this.#fault === void 0) this.#fault = Object.freeze({
+			origin: "persistence",
+			checkpoint,
+			message: this.#error,
+			...task === void 0 ? {} : { task: task.id },
+			...attempt === void 0 ? {} : { attempt }
+		});
+		return false;
+	}
+	/**
+	* Stop observing the live tree and persist its final state.
+	*
+	* @returns Whether the final snapshot reached the store
+	*/
+	async finalize() {
+		this.detach();
+		return this.checkpoint("final");
+	}
+	/** Stop observing the live tree. */
+	detach() {
+		if (!this.#attached) return;
+		this.#attached = false;
+		this.#workflow.emitter.off("start", this.#onWorkflowChange);
+		this.#workflow.emitter.off("complete", this.#onWorkflowChange);
+		this.#workflow.emitter.off("fail", this.#onWorkflowChange);
+		this.#workflow.emitter.off("skip", this.#onWorkflowChange);
+		this.#workflow.emitter.off("stop", this.#onWorkflowChange);
+		this.#workflow.emitter.off("move", this.#onWorkflowChange);
+		this.#workflow.emitter.off("update", this.#onWorkflowChange);
+		this.#workflow.emitter.off("add", this.#onWorkflowAdd);
+		this.#workflow.emitter.off("remove", this.#onWorkflowRemove);
+		for (const phase of this.#phases) this.#detachPhase(phase);
+	}
+	#attachWorkflow() {
+		this.#workflow.emitter.on("start", this.#onWorkflowChange);
+		this.#workflow.emitter.on("complete", this.#onWorkflowChange);
+		this.#workflow.emitter.on("fail", this.#onWorkflowChange);
+		this.#workflow.emitter.on("skip", this.#onWorkflowChange);
+		this.#workflow.emitter.on("stop", this.#onWorkflowChange);
+		this.#workflow.emitter.on("move", this.#onWorkflowChange);
+		this.#workflow.emitter.on("update", this.#onWorkflowChange);
+		this.#workflow.emitter.on("add", this.#onWorkflowAdd);
+		this.#workflow.emitter.on("remove", this.#onWorkflowRemove);
+		for (const phase of this.#workflow.phases.phases()) this.#attachPhase(phase);
+	}
+	#attachPhase(phase) {
+		if (this.#phases.has(phase)) return;
+		this.#phases.add(phase);
+		phase.emitter.on("start", this.#onPhaseChange);
+		phase.emitter.on("complete", this.#onPhaseChange);
+		phase.emitter.on("fail", this.#onPhaseChange);
+		phase.emitter.on("skip", this.#onPhaseChange);
+		phase.emitter.on("stop", this.#onPhaseChange);
+		phase.emitter.on("move", this.#onPhaseChange);
+		phase.emitter.on("update", this.#onPhaseChange);
+		phase.emitter.on("add", this.#onPhaseAdd);
+		phase.emitter.on("remove", this.#onPhaseRemove);
+		for (const task of phase.tasks.tasks()) this.#attachTask(task);
+	}
+	#detachPhase(phase) {
+		if (!this.#phases.delete(phase)) return;
+		phase.emitter.off("start", this.#onPhaseChange);
+		phase.emitter.off("complete", this.#onPhaseChange);
+		phase.emitter.off("fail", this.#onPhaseChange);
+		phase.emitter.off("skip", this.#onPhaseChange);
+		phase.emitter.off("stop", this.#onPhaseChange);
+		phase.emitter.off("move", this.#onPhaseChange);
+		phase.emitter.off("update", this.#onPhaseChange);
+		phase.emitter.off("add", this.#onPhaseAdd);
+		phase.emitter.off("remove", this.#onPhaseRemove);
+		for (const task of phase.tasks.tasks()) this.#detachTask(task);
+	}
+	#attachTask(task) {
+		if (this.#tasks.has(task)) return;
+		this.#tasks.add(task);
+		task.emitter.on("start", this.#onTaskChange);
+		task.emitter.on("complete", this.#onTaskChange);
+		task.emitter.on("fail", this.#onTaskChange);
+		task.emitter.on("skip", this.#onTaskChange);
+		task.emitter.on("stop", this.#onTaskChange);
+		task.emitter.on("report", this.#onTaskChange);
+		task.emitter.on("pulse", this.#onTaskChange);
+	}
+	#detachTask(task) {
+		if (!this.#tasks.delete(task)) return;
+		task.emitter.off("start", this.#onTaskChange);
+		task.emitter.off("complete", this.#onTaskChange);
+		task.emitter.off("fail", this.#onTaskChange);
+		task.emitter.off("skip", this.#onTaskChange);
+		task.emitter.off("stop", this.#onTaskChange);
+		task.emitter.off("report", this.#onTaskChange);
+		task.emitter.off("pulse", this.#onTaskChange);
+	}
+	#addPhase(phase) {
+		this.#attachPhase(phase);
+		this.#change();
+	}
+	#removePhase(phase) {
+		this.#detachPhase(phase);
+		this.#change();
+	}
+	#addTask(task) {
+		this.#attachTask(task);
+		this.#change();
+	}
+	#removeTask(task) {
+		this.#detachTask(task);
+		this.#change();
+	}
+	#change() {
+		this.#mark();
+		this.#flush();
+	}
+	async #flush() {
+		if (this.#writing !== void 0) {
+			await this.#writing;
+			return;
+		}
+		const writing = this.#drain();
+		this.#writing = writing;
+		try {
+			await writing;
+		} finally {
+			if (this.#writing === writing) this.#writing = void 0;
+			if (this.#stored < this.#revision) this.#flush();
+		}
+	}
+	async #drain() {
+		while (this.#stored < this.#revision) {
+			const revision = this.#revision;
+			try {
+				await this.#store.set(this.#workflow.snapshot());
+				this.#error = void 0;
+			} catch (error) {
+				this.#error = errorToMessage(error);
+			}
+			this.#stored = revision;
+		}
+	}
+	#mark() {
+		this.#revision += 1;
+		return this.#revision;
+	}
 };
 //#endregion
 //#region src/core/WorkflowRunner.ts
@@ -2298,17 +3119,16 @@ var TaskController = class {
 *   `AbortSignal.any` (exactly as the agent runtime folds its bounds); pacing is the shipped
 *   {@link SchedulerInterface}. The runner writes ZERO concurrency / retry / abort logic of
 *   its own — it only sequences phases, dispatches a task's own handler, and drives the live
-*   entity.
-* - **Pure engine — no registries, no tool/agent knowledge.** The runner carries no
-*   `functions` / `tools` / `agents` registry: each live {@link TaskInterface} already
+*   entity. The workflow layer owns per-task deadlines because timeout settlement must
+*   update the live leaf under the phase's `bail` policy before the substrate unit settles.
+* - **Pure engine — no integration registry.** The runner carries no behavior or provider
+*   registry: each live {@link TaskInterface} already
 *   resolved its own {@link import('./types.js').WorkflowFunction} into
 *   {@link import('./types.js').TaskInterface.handler} ONCE at construction (build, restore,
 *   or a live mint all resolve it identically, from {@link WorkflowOptions.functions}), so
-*   dispatch is simply "invoke the task's own handler". Static tool / agent calling is an
-*   OPT-IN concern of the `@orkestrel/tool` package's adapter factories — plain
-*   {@link import('./types.js').WorkflowFunction}s a caller wires into
-*   {@link WorkflowOptions.functions} like any other behavior. This module never imports
-*   any tool/agent package.
+*   dispatch is simply "invoke the task's own handler". Provider, protocol, and tool
+*   integrations remain application-owned {@link import('./types.js').WorkflowFunction}s
+*   composed into {@link WorkflowOptions.functions}. This module imports none of them.
 * - **Two `execute` forms, one engine.** `execute(definition, options)` BUILDS the live tree
 *   from a {@link WorkflowDefinition} (single source of truth for the `run` / `concurrency`
 *   metadata); `execute(workflow, options)` DRIVES a caller-owned, ALREADY-BUILT
@@ -2328,10 +3148,9 @@ var TaskController = class {
 *   for `spawn` to accept (the runner already drained) is swept `skip`ped afterward so the
 *   phase always reaches a coherent terminal state.
 * - **Dispatch by handler.** `#runTask` invokes the live task's own
-*   {@link import('./types.js').TaskInterface.handler} directly: `undefined` (an omitted `run`,
-*   or a `run` name absent from the {@link WorkflowOptions.functions} registry it was resolved
-*   against) AUTO-COMPLETES — the ROADMAP no-handler rule; otherwise the handler runs with the
-*   task's {@link import('./types.js').TaskControllerInterface} handle.
+*   {@link import('./types.js').TaskInterface.handler} directly. An omitted `run` deliberately
+*   auto-completes with JSON `null`; a present unresolved name is rejected by the synchronous
+*   execution claim and never false-completes.
 * - **`bail` → substrate.** Under `bail: true` (halt) a genuine task failure `fail`s the leaf
 *   THEN re-throws, so the substrate Runner fail-fasts — it aborts the in-flight siblings
 *   (their `controller.signal` fires; a mid-flight sibling `skip`s) and rejects the phase run;
@@ -2339,11 +3158,12 @@ var TaskController = class {
 *   Under `bail: false` (graceful) a failure `fail`s the leaf and RESOLVES (never throws), so
 *   the Runner settles every unit (allSettled) and the run finishes (the workflow derives
 *   `completed`, the failure recorded in the result tree).
-* - **Pause / stop / destroy gates.** `workflow.pause()` is honoured at exactly two points —
-*   the next phase boundary (workflow-only) and each task's own pre-dispatch (before
-*   `task.start()`, workflow gate FIRST then this task's own `phase.pause()`) — by parking on
-*   {@link WorkflowInterface.wait} / {@link PhaseInterface.wait}; an in-flight task body is
-*   NEVER suspended mid-flight. A GRACEFUL `workflow.stop()` (no signal involved) is caught at
+* - **Pause / stop / destroy gates.** Workflow, phase, and task gates are checked before
+*   dispatch, and a running handler can checkpoint their folded state through
+*   {@link import('./types.js').TaskControllerInterface.wait}. Because the substrate acquires
+*   concurrency before this handler gate, a paused task occupies one phase slot until resume;
+*   already-running siblings continue and its per-attempt timeout keeps counting. A GRACEFUL
+*   `workflow.stop()` (no signal involved) is caught at
 *   those same gates: not-yet-started work is `skip`ped, in-flight work finishes naturally. A
 *   HARD `workflow.destroy()` aborts {@link WorkflowInterface.signal}, which `#fold` has folded
 *   into the run's composed signal — so it cancels the active phase Runner (and every
@@ -2360,37 +3180,49 @@ var TaskController = class {
 *   {@link TaskController} signal `AbortSignal.any`-combines the substrate per-unit signal with
 *   `runSignal`, so a handler observes either cause directly.
 * - **Re-entrant-safe.** No shared per-run mutable field: the active-Runner holder is LOCAL to
-*   each `#execute`, so a nested `execute` (a bound workflow-tool handler re-entering this
-*   instance while the outer run is suspended awaiting it) cannot clobber the outer run's state.
+*   each `#execute`, so a nested application-level `execute` cannot clobber the outer run's
+*   state.
 */
-var WorkflowRunner = class {
+var WorkflowRunner = class WorkflowRunner {
+	static #executions = /* @__PURE__ */ new WeakSet();
 	#scheduler;
 	constructor(scheduler) {
 		this.#scheduler = scheduler;
 	}
 	execute(target, options) {
 		if (this.#isWorkflow(target)) {
-			if (target.status !== "pending" || target.destroyed) throw new WorkflowError("TRANSITION", `workflow '${target.id}' is not drivable`, {
-				id: target.id,
-				status: target.status,
-				destroyed: target.destroyed
-			});
+			this.#acquire(target);
 			return this.#execute(target, options);
 		}
 		const workflow = new Workflow(definitionToSnapshot(target, options?.bail ?? target.bail ?? false), options);
+		this.#acquire(workflow);
 		return this.#execute(workflow, options);
 	}
+	#acquire(workflow) {
+		const tasks = workflow.phases.phases().flatMap((phase) => phase.tasks.tasks());
+		if (!((workflow.status === "pending" || workflow.status === "running") && tasks.every((task) => task.status !== "running") && (tasks.length === 0 || tasks.some((task) => task.status === "pending")) && tasks.every((task) => task.run === void 0 || task.handler !== void 0)) || workflow.destroyed || WorkflowRunner.#executions.has(workflow)) throw new WorkflowError("TRANSITION", `workflow '${workflow.id}' is not drivable`, {
+			id: workflow.id,
+			status: workflow.status,
+			destroyed: workflow.destroyed
+		});
+		WorkflowRunner.#executions.add(workflow);
+	}
 	async #execute(workflow, options) {
 		const ms = options?.timeout;
-		const timeout = ms !== void 0 && ms > 0 ? createTimeout({ ms }) : void 0;
+		const timeout = ms !== void 0 && Number.isFinite(ms) && ms > 0 && ms <= 2147483647 ? createTimeout({ ms }) : void 0;
 		timeout?.start();
 		options?.budget?.start();
 		const runSignal = this.#fold(workflow, options, timeout);
+		const persistence = options?.store === void 0 ? void 0 : new WorkflowPersistence(workflow, options.store);
 		const holder = { runner: void 0 };
 		const onCancel = this.#abortActive.bind(this, holder, runSignal);
 		if (runSignal.aborted) onCancel();
 		else runSignal.addEventListener("abort", onCancel, { once: true });
 		try {
+			if (persistence !== void 0 && !await persistence.checkpoint("initial")) {
+				if (this.#stoppable(workflow)) workflow.stop();
+				this.#skipFrom(workflow.phases.phases(), 0);
+			}
 			let index = 0;
 			for (;;) {
 				const phases = workflow.phases.phases();
@@ -2404,12 +3236,17 @@ var WorkflowRunner = class {
 					this.#haltFrom(phases, index, workflow, runSignal);
 					break;
 				}
-				if (workflow.paused) await this.#raceWait(() => workflow.wait(), runSignal);
+				if (workflow.paused) await this.#raceWait(workflow.wait(), runSignal, void 0, workflow);
 				if (this.#cancelled(runSignal) || this.#halted(workflow)) {
 					this.#haltFrom(workflow.phases.phases(), index, workflow, runSignal);
 					break;
 				}
-				if (await this.#runPhase(workflow, phase, runSignal, holder)) {
+				if (phase.status === "skipped" || phase.status === "stopped") {
+					this.#skipFrom([phase], 0);
+					index += 1;
+					continue;
+				}
+				if (await this.#runPhase(workflow, phase, runSignal, holder, persistence)) {
 					this.#skipFrom(workflow.phases.phases(), index + 1);
 					break;
 				}
@@ -2423,17 +3260,26 @@ var WorkflowRunner = class {
 			}
 			if (this.#cancelled(runSignal)) this.#haltFrom(workflow.phases.phases(), 0, workflow, runSignal);
 			else if (this.#completable(workflow)) workflow.complete();
+			const durable = await persistence?.finalize();
 			return {
 				workflow,
 				status: workflow.status,
-				results: workflow.results()
+				results: workflow.results(),
+				...durable === void 0 ? {} : { durable },
+				...persistence?.fault === void 0 ? {} : { fault: persistence.fault }
 			};
+		} catch (error) {
+			if (this.#stoppable(workflow)) workflow.stop();
+			this.#skipFrom(workflow.phases.phases(), 0);
+			await persistence?.finalize();
+			throw error;
 		} finally {
+			persistence?.detach();
 			timeout?.clear();
 			runSignal.removeEventListener("abort", onCancel);
 		}
 	}
-	async #runPhase(workflow, phase, runSignal, holder) {
+	async #runPhase(workflow, phase, runSignal, holder, persistence) {
 		const launched = /* @__PURE__ */ new Set();
 		const onAdd = this.#spawnAdded.bind(this, launched, holder);
 		phase.emitter.on("add", onAdd);
@@ -2444,10 +3290,12 @@ var WorkflowRunner = class {
 			const bail = phase.bail;
 			const concurrency = phase.concurrency !== void 0 && phase.concurrency > 0 ? phase.concurrency : DEFAULT_PHASE_CONCURRENCY;
 			const attempts = /* @__PURE__ */ new Map();
+			for (const task of tasks) attempts.set(task.id, task.attempts);
+			const owners = /* @__PURE__ */ new Map();
 			const created = new Runner({
 				concurrency,
 				entries: this.#entry.bind(this),
-				handler: this.#runUnit.bind(this, workflow, runSignal, bail, attempts)
+				handler: this.#runUnit.bind(this, workflow, runSignal, bail, attempts, owners, persistence)
 			});
 			holder.runner = created;
 			try {
@@ -2474,75 +3322,199 @@ var WorkflowRunner = class {
 		holder.runner?.spawn(task);
 	}
 	#entry(task) {
-		return {
-			...task.retries === void 0 ? {} : { retries: task.retries },
-			...task.timeout === void 0 ? {} : { timeout: task.timeout }
-		};
+		const retries = Math.max(0, (task.retries ?? 0) - task.attempts);
+		return retries === 0 ? {} : { retries };
 	}
-	#runUnit(workflow, runSignal, bail, attempts, controller) {
-		return this.#runTask(workflow, controller.input, controller, runSignal, bail, attempts);
+	#runUnit(workflow, runSignal, bail, attempts, owners, persistence, controller) {
+		return this.#runTask(workflow, controller.input, controller, runSignal, bail, attempts, owners, persistence);
 	}
-	async #runTask(workflow, task, controller, runSignal, bail, attempts) {
-		const signal = this.#taskSignal(controller.signal, runSignal);
+	async #runTask(workflow, task, controller, runSignal, bail, attempts, owners, persistence) {
 		const attempt = (attempts.get(task.id) ?? 0) + 1;
 		attempts.set(task.id, attempt);
 		const last = attempt > Math.max(0, task.retries ?? 0);
-		if (workflow.paused) await this.#raceWait(() => workflow.wait(), runSignal);
-		if (task.phase.paused) await this.#raceWait(() => task.phase.wait(), runSignal);
-		if (this.#skipping(controller, runSignal) || this.#halted(workflow)) {
-			this.#skipCancelled(task, workflow, runSignal);
-			return;
-		}
-		if (task.status === "pending") task.start();
-		if (this.#skipping(controller, runSignal) || this.#halted(workflow)) {
-			this.#skipCancelled(task, workflow, runSignal);
+		if (task.status !== "pending" && task.status !== "running") return;
+		if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+			this.#settleCancelled(task, workflow, runSignal);
 			return;
 		}
-		const handle = new TaskController(signal, task.snapshot().metadata, task.context, () => workflow.results());
+		const ms = task.timeout;
+		const deadline = ms !== void 0 && Number.isFinite(ms) && ms > 0 && ms <= 2147483647 ? createTimeout({ ms }) : void 0;
+		const signal = this.#taskSignal(task, controller.signal, runSignal, deadline);
 		try {
-			const value = task.handler === void 0 ? void 0 : await task.handler(handle);
-			if (task.status !== "running" || this.#skipping(controller, runSignal)) {
-				this.#skipCancelled(task, workflow, runSignal);
+			task.start();
+			if (task.attempts !== attempt) return;
+			owners.set(task.id, attempt);
+			deadline?.start();
+			const durable = persistence === void 0 ? true : await persistence.checkpoint("attempt", task, attempt);
+			if (!this.#owns(owners, task, attempt)) return;
+			if (!durable) {
+				if (this.#stoppable(workflow)) workflow.stop();
 				return;
 			}
-			if (signal.aborted) {
-				this.#timedOut(task, last);
+			if (task.run !== void 0 && task.handler === void 0) {
+				const error = new WorkflowError("TRANSITION", `task '${task.id}' has an unresolved run '${task.run}'`, {
+					task: task.id,
+					run: task.run
+				});
+				task.fail({
+					origin: "handler",
+					message: error.message
+				});
+				if (bail) throw error;
 				return;
 			}
-			task.complete(value);
-		} catch (error) {
-			if (task.status !== "running" || this.#skipping(controller, runSignal)) {
-				this.#skipCancelled(task, workflow, runSignal);
+			if (await this.#gate(workflow.paused ? workflow.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
+			if (await this.#gate(task.phase.paused ? task.phase.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
+			if (await this.#gate(task.paused ? task.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
+			if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+				this.#settleCancelled(task, workflow, runSignal);
+				return;
+			}
+			if (task.status !== "running") return;
+			const handle = new TaskController(signal, task.snapshot().metadata, task, attempt, () => workflow.results(), (input) => this.#owns(owners, task, attempt) && !signal.aborted ? task.report(input) : failure(new WorkflowError("TRANSITION", `task '${task.id}' attempt '${attempt}' no longer owns activity`, {
+				task: task.id,
+				attempt
+			})), () => this.#owns(owners, task, attempt) && !signal.aborted && task.pulse());
+			let outcome;
+			try {
+				outcome = task.handler === void 0 ? [true, null] : await this.#raceHandler(Promise.resolve(task.handler(handle)), signal, this.#skipping.bind(this, task, controller, runSignal));
+			} catch (error) {
+				if (!this.#owns(owners, task, attempt)) return;
+				if (task.status !== "running" || this.#skipping(task, controller, runSignal)) {
+					this.#settleCancelled(task, workflow, runSignal);
+					return;
+				}
+				if (signal.aborted) {
+					this.#timedOut(owners, task, attempt, last, bail);
+					return;
+				}
+				this.#failed(owners, task, attempt, error, last, bail);
+				return;
+			}
+			if (!this.#owns(owners, task, attempt)) return;
+			if (!outcome[0]) {
+				this.#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, outcome[2]);
+				return;
+			}
+			if (task.status !== "running") return;
+			if (this.#skipping(task, controller, runSignal)) {
+				this.#settleCancelled(task, workflow, runSignal);
 				return;
 			}
 			if (signal.aborted) {
-				this.#timedOut(task, last);
+				this.#timedOut(owners, task, attempt, last, bail);
 				return;
 			}
-			if (!last) throw error;
-			task.fail(error);
-			if (bail) throw error;
+			if (!this.#owns(owners, task, attempt)) return;
+			try {
+				task.complete(outcome[1]);
+			} catch (error) {
+				if (!this.#owns(owners, task, attempt)) return;
+				if (task.status !== "running") throw error;
+				this.#failed(owners, task, attempt, error, last, bail);
+			}
+		} finally {
+			deadline?.clear();
+			if (persistence !== void 0 && this.#owns(owners, task, attempt) && isTerminalStatus(task.status) && !await persistence.checkpoint("settlement", task, attempt) && this.#stoppable(workflow)) workflow.stop();
+			this.#revoke(owners, task.id, attempt);
 		}
 	}
-	#timedOut(task, last) {
-		if (!last) return;
-		task.fail(/* @__PURE__ */ new Error(`task '${task.id}' timed out`));
+	async #gate(wait, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail) {
+		const genuine = wait === void 0 ? void 0 : await this.#raceWait(wait, signal, this.#skipping.bind(this, task, controller, runSignal), workflow, task.phase);
+		return this.#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, genuine);
 	}
-	async #raceWait(wait, runSignal) {
-		if (runSignal.aborted) return;
-		let onAbort;
-		const cancelled = new Promise((resolve) => {
-			onAbort = resolve.bind(void 0, void 0);
-			runSignal.addEventListener("abort", onAbort, { once: true });
+	#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, genuine) {
+		if (attempts.get(task.id) !== attempt || !this.#owns(owners, task, attempt)) return true;
+		if (signal.aborted) {
+			if (genuine ?? this.#skipping(task, controller, runSignal)) this.#settleCancelled(task, workflow, runSignal);
+			else this.#timedOut(owners, task, attempt, last, bail);
+			return true;
+		}
+		if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+			this.#settleCancelled(task, workflow, runSignal);
+			return true;
+		}
+		return task.status !== "running";
+	}
+	async #raceHandler(handler, signal, cancelled) {
+		if (signal.aborted) return [
+			false,
+			void 0,
+			cancelled()
+		];
+		const deferred = Promise.withResolvers();
+		const onAbort = this.#resolveHandlerAbort.bind(this, deferred, cancelled);
+		signal.addEventListener("abort", onAbort, { once: true });
+		try {
+			return await Promise.race([handler.then((value) => [true, value]), deferred.promise]);
+		} finally {
+			signal.removeEventListener("abort", onAbort);
+		}
+	}
+	#resolveHandlerAbort(deferred, cancelled) {
+		deferred.resolve([
+			false,
+			void 0,
+			cancelled()
+		]);
+	}
+	#timedOut(owners, task, attempt, last, bail) {
+		if (!this.#owns(owners, task, attempt)) return;
+		const error = /* @__PURE__ */ new Error(`task '${task.id}' timed out`);
+		if (last) task.fail({
+			origin: "timeout",
+			message: error.message
 		});
+		if (!last || bail) throw error;
+	}
+	#failed(owners, task, attempt, error, last, bail) {
+		if (!this.#owns(owners, task, attempt)) return;
+		if (!last) throw error;
+		task.fail({
+			origin: "handler",
+			message: errorToMessage(error)
+		});
+		if (bail) throw error;
+	}
+	#owns(owners, task, attempt) {
+		return owners.get(task.id) === attempt && task.attempts === attempt;
+	}
+	#revoke(owners, id, attempt) {
+		if (owners.get(id) === attempt) owners.delete(id);
+	}
+	async #raceWait(wait, signal, cancelled, workflow, phase) {
+		if (signal.aborted) return cancelled?.();
+		const deferred = Promise.withResolvers();
+		const onAbort = this.#resolveWaitAbort.bind(this, deferred, cancelled);
+		const onTerminal = this.#resolveWaitAbort.bind(this, deferred, void 0);
+		signal.addEventListener("abort", onAbort, { once: true });
+		workflow?.emitter.on("skip", onTerminal);
+		workflow?.emitter.on("stop", onTerminal);
+		phase?.emitter.on("skip", onTerminal);
+		phase?.emitter.on("stop", onTerminal);
 		try {
-			await Promise.race([wait(), cancelled]);
+			if (workflow !== void 0 && this.#halted(workflow, phase)) deferred.resolve(void 0);
+			const outcome = await Promise.race([wait, deferred.promise]);
+			return typeof outcome === "boolean" ? outcome : void 0;
 		} finally {
-			if (onAbort !== void 0) runSignal.removeEventListener("abort", onAbort);
+			signal.removeEventListener("abort", onAbort);
+			workflow?.emitter.off("skip", onTerminal);
+			workflow?.emitter.off("stop", onTerminal);
+			phase?.emitter.off("skip", onTerminal);
+			phase?.emitter.off("stop", onTerminal);
 		}
 	}
-	#taskSignal(unitSignal, runSignal) {
-		return AbortSignal.any([unitSignal, runSignal]);
+	#resolveWaitAbort(deferred, cancelled) {
+		deferred.resolve(cancelled?.());
+	}
+	#taskSignal(task, unitSignal, runSignal, timeout) {
+		const signals = [
+			task.signal,
+			unitSignal,
+			runSignal
+		];
+		if (timeout !== void 0) signals.push(timeout.signal);
+		return AbortSignal.any(signals);
 	}
 	#fold(workflow, options, timeout) {
 		const signals = [workflow.signal];
@@ -2562,22 +3534,22 @@ var WorkflowRunner = class {
 			for (const task of phase.tasks.tasks()) this.#skip(task);
 		}
 	}
-	#skipCancelled(task, workflow, runSignal) {
+	#settleCancelled(task, workflow, runSignal) {
 		if (this.#cancelled(runSignal) && this.#stoppable(workflow)) workflow.stop();
 		this.#skip(task);
 	}
 	#skip(task) {
 		if (task.status === "pending" || task.status === "running") task.skip();
 	}
-	#skipping(controller, runSignal) {
-		return controller.aborted || runSignal.aborted;
+	#skipping(task, controller, runSignal) {
+		return task.signal.aborted || controller.aborted || runSignal.aborted;
 	}
 	#cancelled(runSignal) {
 		return runSignal.aborted;
 	}
-	#halted(workflow) {
+	#halted(workflow, phase) {
 		const status = workflow.status;
-		return status === "failed" || status === "skipped" || status === "stopped";
+		return status === "failed" || status === "skipped" || status === "stopped" || phase?.status === "skipped" || phase?.status === "stopped";
 	}
 	#stoppable(workflow) {
 		const status = workflow.status;
@@ -2640,8 +3612,8 @@ function createWorkflowContract() {
 *
 * `options.functions` is the {@link import('./types.js').WorkflowFunctions} registry each live
 * task's `run` name resolves against ONCE at construction into its runtime
-* {@link import('./types.js').TaskInterface.handler} — a name omitted or absent from the
-* registry resolves to no handler (the no-handler rule).
+* {@link import('./types.js').TaskInterface.handler}. An omitted name is the deliberate no-op;
+* an unresolved present name remains inspectable but is rejected if execution is attempted.
 *
 * @param definition - The workflow definition to bring to life
 * @param options - Runtime options (initial listeners, `bail` override, per-node options)
@@ -2675,6 +3647,9 @@ function createWorkflow(definition, options) {
 * still wins when supplied (to deliberately re-run under a different policy). A structurally
 * invalid snapshot (a status — or override — outside the lifecycle vocabulary, or a
 * non-boolean `bail`) throws a `RESTORE` {@link WorkflowError}.
+* Runtime handlers are optional: without a matching `functions` entry, a persisted `run`
+* remains visible with an undefined `handler` so the exact state is inspectable. The runner
+* rejects that unresolved tree if execution is attempted.
 *
 * @param snapshot - The snapshot to restore (carries its own `bail` + `override`)
 * @param options - Runtime options (initial listeners, an optional `bail` override, per-node options)
@@ -2689,8 +3664,20 @@ function createWorkflow(definition, options) {
 * ```
 */
 function restoreWorkflow(snapshot, options) {
-	assertSnapshot(snapshot);
-	return new Workflow(snapshot, options);
+	return new Workflow(cloneWorkflowSnapshot(snapshot), options);
+}
+/**
+* Rebuild an interrupted workflow at its remaining retry budget.
+*
+* @param snapshot - The hostile persisted snapshot
+* @param options - Runtime handlers and entity options
+* @returns A recoverable live workflow
+*/
+function recoverWorkflow(snapshot, options) {
+	const owned = cloneWorkflowSnapshot(snapshot);
+	if (owned.override !== void 0 || owned.phases.some((phase) => phase.override !== void 0)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has a terminal override`, { workflow: owned.id });
+	if (!hasWorkflowHandlers(owned, options?.functions)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has an unresolved run`, { workflow: owned.id });
+	return new Workflow(cloneWorkflowSnapshot(recoverWorkflowSnapshot(owned)), options);
 }
 /**
 * Assert that a {@link WorkflowSnapshot} carries a `boolean` `bail` — at the workflow tier AND
@@ -2713,54 +3700,7 @@ function restoreWorkflow(snapshot, options) {
 * @param snapshot - The snapshot to validate
 */
 function assertSnapshot(snapshot) {
-	if (typeof snapshot.bail !== "boolean") throw new WorkflowError("RESTORE", `workflow '${snapshot.id}' has a non-boolean bail`, {
-		workflow: snapshot.id,
-		bail: snapshot.bail
-	});
-	if (!WORKFLOW_STATUSES.includes(snapshot.status)) throw new WorkflowError("RESTORE", `workflow '${snapshot.id}' has an invalid status`, {
-		workflow: snapshot.id,
-		status: snapshot.status
-	});
-	if (snapshot.override !== void 0 && !WORKFLOW_STATUSES.includes(snapshot.override)) throw new WorkflowError("RESTORE", `workflow '${snapshot.id}' has an invalid override`, {
-		workflow: snapshot.id,
-		override: snapshot.override
-	});
-	for (const phase of snapshot.phases) {
-		if (typeof phase.bail !== "boolean") throw new WorkflowError("RESTORE", `phase '${phase.id}' has a non-boolean bail`, {
-			phase: phase.id,
-			bail: phase.bail
-		});
-		if (!PHASE_STATUSES.includes(phase.status)) throw new WorkflowError("RESTORE", `phase '${phase.id}' has an invalid status`, {
-			phase: phase.id,
-			status: phase.status
-		});
-		if (phase.override !== void 0 && !PHASE_STATUSES.includes(phase.override)) throw new WorkflowError("RESTORE", `phase '${phase.id}' has an invalid override`, {
-			phase: phase.id,
-			override: phase.override
-		});
-		if (phase.concurrency !== void 0 && (!Number.isInteger(phase.concurrency) || phase.concurrency < 1)) throw new WorkflowError("RESTORE", `phase '${phase.id}' has an invalid concurrency`, {
-			phase: phase.id,
-			concurrency: phase.concurrency
-		});
-		for (const task of phase.tasks) {
-			if (!TASK_STATUSES.includes(task.status)) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid status`, {
-				task: task.id,
-				status: task.status
-			});
-			if (task.run !== void 0 && task.run.length < 1) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid run`, {
-				task: task.id,
-				run: task.run
-			});
-			if (task.retries !== void 0 && (!Number.isInteger(task.retries) || task.retries < 0)) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid retries`, {
-				task: task.id,
-				retries: task.retries
-			});
-			if (task.timeout !== void 0 && (!Number.isInteger(task.timeout) || task.timeout < 0)) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid timeout`, {
-				task: task.id,
-				timeout: task.timeout
-			});
-		}
-	}
+	cloneWorkflowSnapshot(snapshot);
 }
 /**
 * Create the in-memory durable {@link WorkflowStoreInterface} — a process-lifetime
@@ -2827,12 +3767,13 @@ function createMemoryWorkflowStore() {
 * ```
 */
 function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
+	const columns = {
+		id: stringShape(),
+		snapshot: rawShape({})
+	};
 	return new DatabaseWorkflowStore(createDatabase({
 		driver,
-		tables: { snapshots: {
-			id: stringShape(),
-			snapshot: rawShape({})
-		} }
+		tables: { snapshots: columns }
 	}).table("snapshots"));
 }
 /**
@@ -2842,7 +3783,7 @@ function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
 *
 * @remarks
 * The runner is a PURE engine — it re-implements no concurrency / retry / abort logic, AND it
-* carries no `functions` / `tools` / `agents` registry of its own: each live task already
+* carries no behavior or provider registry of its own: each live task already
 * resolved its own {@link import('./types.js').WorkflowFunction} into
 * {@link import('./types.js').TaskInterface.handler} ONCE at construction, from the
 * {@link WorkflowOptions.functions} registry supplied to `execute` / {@link createWorkflow}.
@@ -2856,11 +3797,10 @@ function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
 * the live entity (`start` → `complete` / `fail`), and resolves a
 * {@link import('./types.js').WorkflowResult}.
 *
-* Static tool / agent calling is OPT-IN: a caller wires a plain
-* {@link import('./types.js').WorkflowFunction} into its OWN {@link WorkflowOptions.functions}
-* registry, same as any other behavior — the `@orkestrel/tool` package ships the
-* tool/agent adapter factories for that. A task with no resolved handler AUTO-COMPLETES
-* (the ROADMAP no-handler rule).
+* External integrations remain application-owned: a caller wires an ordinary
+* {@link import('./types.js').WorkflowFunction} into its own {@link WorkflowOptions.functions}
+* registry. Only a task that omits `run` auto-completes; unresolved named work is rejected
+* before dispatch.
 *
 * @param options - An optional pacing `scheduler` (default the shipped cross-environment one).
 *   See {@link WorkflowRunnerOptions}.
@@ -3010,6 +3950,6 @@ function createRunner(options) {
 	return new Runner(options);
 }
 //#endregion
-export { Controller, DEFAULT_BAIL, DEFAULT_PHASE_CONCURRENCY, DatabaseWorkflowStore, MemoryWorkflowStore, PHASE_STATUSES, Phase, PhaseManager, Runner, Scheduler, TASK_STATUSES, TASK_TRANSITIONS, TERMINAL_TASK_STATUSES, Task, TaskController, TaskManager, WORKFLOW_STATUSES, Workflow, WorkflowError, WorkflowManager, WorkflowRunner, assertSnapshot, buildPhaseContext, buildTaskContext, buildWorkflowContext, canTransitionTask, collectResults, createDatabaseWorkflowStore, createDeferred, createMemoryWorkflowStore, createRunner, createScheduler, createWorkflow, createWorkflowContract, createWorkflowManager, createWorkflowRunner, definitionToSnapshot, deriveBoundary, derivePhaseStatus, deriveWorkflowStatus, failure, findFailure, insertEntry, isTerminalStatus, isWorkflowError, isWorkflowSnapshot, moveEntry, parkSignal, phaseDefinitionToSnapshot, phaseShape, phaseUpdateShape, restoreWorkflow, success, taskDefinitionToSnapshot, taskShape, taskUpdateShape, workflowShape };
+export { Controller, DEFAULT_BAIL, DEFAULT_PHASE_CONCURRENCY, DatabaseWorkflowStore, MAX_TIMER_MS, MemoryWorkflowStore, PHASE_STATUSES, Phase, PhaseManager, Runner, Scheduler, TASK_STATUSES, TASK_TRANSITIONS, TERMINAL_TASK_STATUSES, Task, TaskController, TaskManager, WORKFLOW_STATUSES, Workflow, WorkflowError, WorkflowManager, WorkflowPersistence, WorkflowRunner, assertSnapshot, buildPhaseContext, buildTaskContext, buildWorkflowContext, canTransitionTask, cloneTaskActivity, cloneWorkflowSnapshot, collectResults, createDatabaseWorkflowStore, createDeferred, createMemoryWorkflowStore, createRunner, createScheduler, createWorkflow, createWorkflowContract, createWorkflowManager, createWorkflowRunner, definitionToSnapshot, deriveBoundary, derivePhaseStatus, deriveWorkflowStatus, errorToMessage, failure, findFailure, hasWorkflowHandlers, insertEntry, isLifecycleStatus, isOwnedWorkflowSnapshot, isTaskActivity, isTaskActivityInput, isTaskFailure, isTaskResult, isTerminalStatus, isWorkflowError, isWorkflowSnapshot, matchesDescription, moveEntry, parkSignal, phaseDefinitionToSnapshot, phaseShape, phaseUpdateShape, recoverWorkflow, recoverWorkflowSnapshot, resolveTaskSilence, restoreWorkflow, success, taskDefinitionToSnapshot, taskShape, taskUpdateShape, workflowShape, workflowSnapshotContext };
 
 //# sourceMappingURL=index.js.map