@orkestrel/workflow 0.0.7 → 0.0.9

package/dist/src/core/index.d.ts

@@ -7,6 +7,8 @@ import { EmitterErrorHandler } from '@orkestrel/emitter';
 import { EmitterHooks } from '@orkestrel/emitter';
 import { EmitterInterface } from '@orkestrel/emitter';
 import { Failure } from '@orkestrel/contract';
+import { JSONRecord } from '@orkestrel/contract';
+import { JSONValue } from '@orkestrel/contract';
 import { LiteralShape } from '@orkestrel/contract';
 import { NumberShape } from '@orkestrel/contract';
 import { ObjectShape } from '@orkestrel/contract';
@@ -37,7 +39,7 @@ import { TokenUsage } from '@orkestrel/budget';
  *
  * @param snapshot - The snapshot to validate
  */
-export declare function assertSnapshot(snapshot: WorkflowSnapshot): void;
+export declare function assertSnapshot(snapshot: unknown): void;
 
 /**
  * Build a {@link PhaseContext} — a phase's own identity plus a back-reference to its
@@ -90,6 +92,54 @@ export declare function buildWorkflowContext(node: WorkflowContext): WorkflowCon
  */
 export declare function canTransitionTask(from: TaskStatus, to: TaskStatus): boolean;
 
+/**
+ * Capture every top-level {@link WorkflowOptions} value exactly once into an owned plain bag.
+ *
+ * @remarks
+ * Direct property reads preserve inherited and non-enumerable option values while preventing
+ * accessor-backed caller bags from shifting policy, handlers, hooks, or nested options between
+ * construction stages. Nested bags and the functions registry retain their original identities so
+ * entity constructors can snapshot keyed child options and live additions can resolve against the
+ * same registry.
+ *
+ * @param options - The caller-owned workflow construction options
+ * @returns An owned top-level options bag containing the captured values
+ *
+ * @example
+ * ```ts
+ * const captured = captureWorkflowOptions(options)
+ * const workflow = createWorkflow(definition, captured)
+ * ```
+ */
+export declare function captureWorkflowOptions(options?: WorkflowOptions): WorkflowOptions;
+
+/**
+ * Validate and clone one complete task activity frame.
+ *
+ * @remarks
+ * This is the hostile boundary behind task reports and snapshot hydration. Supplying
+ * `updated` stamps an input frame without reading an `updated` property from it; omitting
+ * `updated` restores a stored frame and reads its persisted timestamp exactly once. Every
+ * untrusted property is captured once inside one protected boundary. The returned frame,
+ * collections, progress, operations, and constraints are copied and frozen.
+ *
+ * @param input - The untrusted complete activity frame
+ * @param updated - An optional accepted timestamp used instead of a persisted `updated`
+ * @returns An immutable cloned {@link TaskActivity}
+ * @throws {WorkflowError} With `MUTATION` when the frame cannot be read or validated
+ */
+export declare function cloneTaskActivity(input: unknown, updated?: number): TaskActivity;
+
+/**
+ * Validate and own a workflow snapshot before live construction.
+ *
+ * @param input - The hostile snapshot boundary
+ * @param id - The optional storage key the owned snapshot must match
+ * @returns A deeply owned frozen snapshot
+ * @throws {WorkflowError} With `RESTORE` when the snapshot is invalid or does not match `id`
+ */
+export declare function cloneWorkflowSnapshot(input: unknown, id?: string): WorkflowSnapshot;
+
 /**
  * Flatten a nested list of per-phase {@link TaskResult} lists into one positional list
  * — the workflow tier of the result tree, built from each phase's `results()`.
@@ -215,7 +265,7 @@ export declare interface ControllerInterface<TInput, TResult> {
  * @remarks
  * Builds a one-table database (`snapshots`, keyed by `id`) over the supplied driver, the snapshot
  * held as ONE OPAQUE JSON COLUMN — the column map is `{ id; snapshot }` where `snapshot` is a
- * `rawShape` (a JSON blob), exactly as {@link createDatabaseQueueStore} stores its `input`. The
+ * `rawShape` (a JSON blob), exactly as `createDatabaseQueueStore` stores its `input`. The
  * snapshot is already a COMPLETE, self-contained, pure-JSON payload, so storing it whole is lossless
  * AND keeps the row type FLAT — a structured multi-column snapshot table would force the contract to
  * `Infer` the deeply-nested snapshot shape (workflow → phases → tasks → results) and trip TS2589;
@@ -231,7 +281,8 @@ export declare interface ControllerInterface<TInput, TResult> {
  *
  * @example
  * ```ts
- * import { createDatabaseWorkflowStore, createMemoryDriver, createWorkflow, restoreWorkflow } from '@src/core'
+ * import { createMemoryDriver } from '@orkestrel/database'
+ * import { createDatabaseWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
  *
  * const store = createDatabaseWorkflowStore(createMemoryDriver()) // a durable driver swaps in here
  * const workflow = createWorkflow(definition)
@@ -258,7 +309,7 @@ export declare function createDeferred<T>(): DeferredInterface<T>;
  *
  * @remarks
  * The snapshot analogue of the server package's `createMemorySessionStore`
- * (and the {@link createMemoryQueueStore} family), but LEANER — there is no idle-TTL, so no
+ * (and the `createMemoryQueueStore` family), but LEANER — there is no idle-TTL, so no
  * options bag (AGENTS §21 minimal): a persisted run-state lives until an explicit `delete`. This is
  * the zero-plumbing DEFAULT (a plain `Map`); its driver-pluggable twin is
  * {@link createDatabaseWorkflowStore} (the snapshot as one opaque JSON column over a `databases`
@@ -270,7 +321,7 @@ export declare function createDeferred<T>(): DeferredInterface<T>;
  *
  * @example
  * ```ts
- * import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@src/core'
+ * import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
  *
  * const store = createMemoryWorkflowStore()
  * const workflow = createWorkflow(definition)
@@ -310,7 +361,7 @@ export declare function createMemoryWorkflowStore(): WorkflowStoreInterface;
  *
  * @example
  * ```ts
- * import { createRunner } from '@src/core'
+ * import { createRunner } from '@orkestrel/workflow'
  *
  * // A handler that fans out one sibling per declared unit, then returns its own value.
  * const runner = createRunner<number, number>({
@@ -336,7 +387,8 @@ export declare function createRunner<TInput, TResult>(options: RunnerOptions<TIn
  * `yield()` gives the host a turn via a zero-delay macrotask (so pending I/O,
  * timers, and rendering actually run — a microtask would not); `delay(ms)` resumes
  * after at least `ms`. Pass `options.signal` to make a pending yield/delay reject
- * with the signal's `reason` on abort (with full timer/listener cleanup).
+ * with the signal's exact `reason`; the shared owned-signal lifecycle clears the timer
+ * without invoking caller-owned listener methods.
  * `options.priority` is accepted for contract compliance but treated uniformly by
  * this default — environment backends honour it.
  *
@@ -344,7 +396,8 @@ export declare function createRunner<TInput, TResult>(options: RunnerOptions<TIn
  *
  * @example
  * ```ts
- * import { createAbort, createScheduler } from '@src/core'
+ * import { createAbort } from '@orkestrel/abort'
+ * import { createScheduler } from '@orkestrel/workflow'
  *
  * const abort = createAbort()
  * const scheduler = createScheduler()
@@ -358,7 +411,7 @@ export declare function createRunner<TInput, TResult>(options: RunnerOptions<TIn
  *
  * @example
  * ```ts
- * import { createScheduler } from '@src/core'
+ * import { createScheduler } from '@orkestrel/workflow'
  *
  * // A backoff: wait a growing interval between retries.
  * const scheduler = createScheduler()
@@ -388,8 +441,8 @@ export declare function createScheduler(): SchedulerInterface;
  *
  * `options.functions` is the {@link import('./types.js').WorkflowFunctions} registry each live
  * task's `run` name resolves against ONCE at construction into its runtime
- * {@link import('./types.js').TaskInterface.handler} — a name omitted or absent from the
- * registry resolves to no handler (the no-handler rule).
+ * {@link import('./types.js').TaskInterface.handler}. An omitted name is the deliberate no-op;
+ * an unresolved present name remains inspectable but is rejected if execution is attempted.
  *
  * @param definition - The workflow definition to bring to life
  * @param options - Runtime options (initial listeners, `bail` override, per-node options)
@@ -397,7 +450,7 @@ export declare function createScheduler(): SchedulerInterface;
  *
  * @example
  * ```ts
- * import { createWorkflow } from '@src/core'
+ * import { createWorkflow } from '@orkestrel/workflow'
  *
  * const workflow = createWorkflow(definition, { on: { complete: () => done() } })
  * const phase = workflow.phase('phase-build')
@@ -425,7 +478,7 @@ export declare function createWorkflow(definition: WorkflowDefinition, options?:
  *
  * @example
  * ```ts
- * import { createWorkflowContract } from '@src/core'
+ * import { createWorkflowContract } from '@orkestrel/workflow'
  *
  * const contract = createWorkflowContract()
  * const definition = contract.generate()       // a valid WorkflowDefinition
@@ -455,7 +508,7 @@ export declare function createWorkflowContract(): ContractInterface<WorkflowDefi
  *
  * @example
  * ```ts
- * import { createMemoryWorkflowStore, createWorkflowManager } from '@src/core'
+ * import { createMemoryWorkflowStore, createWorkflowManager } from '@orkestrel/workflow'
  *
  * const manager = createWorkflowManager({
  * 	store: createMemoryWorkflowStore(),
@@ -475,7 +528,7 @@ export declare function createWorkflowManager(options?: WorkflowManagerOptions):
  *
  * @remarks
  * The runner is a PURE engine — it re-implements no concurrency / retry / abort logic, AND it
- * carries no `functions` / `tools` / `agents` registry of its own: each live task already
+ * carries no behavior or provider registry of its own: each live task already
  * resolved its own {@link import('./types.js').WorkflowFunction} into
  * {@link import('./types.js').TaskInterface.handler} ONCE at construction, from the
  * {@link WorkflowOptions.functions} registry supplied to `execute` / {@link createWorkflow}.
@@ -489,11 +542,10 @@ export declare function createWorkflowManager(options?: WorkflowManagerOptions):
  * the live entity (`start` → `complete` / `fail`), and resolves a
  * {@link import('./types.js').WorkflowResult}.
  *
- * Static tool / agent calling is OPT-IN: a caller wires a plain
- * {@link import('./types.js').WorkflowFunction} into its OWN {@link WorkflowOptions.functions}
- * registry, same as any other behavior — the `@orkestrel/tool` package ships the
- * tool/agent adapter factories for that. A task with no resolved handler AUTO-COMPLETES
- * (the ROADMAP no-handler rule).
+ * External integrations remain application-owned: a caller wires an ordinary
+ * {@link import('./types.js').WorkflowFunction} into its own {@link WorkflowOptions.functions}
+ * registry. Only a task that omits `run` auto-completes; unresolved named work is rejected
+ * before dispatch.
  *
  * @param options - An optional pacing `scheduler` (default the shipped cross-environment one).
  *   See {@link WorkflowRunnerOptions}.
@@ -501,7 +553,7 @@ export declare function createWorkflowManager(options?: WorkflowManagerOptions):
  *
  * @example
  * ```ts
- * import { createWorkflowRunner } from '@src/core'
+ * import { createWorkflowRunner } from '@orkestrel/workflow'
  *
  * const runner = createWorkflowRunner()
  * const definition = { id: 'w', name: 'W', phases: [{ id: 'p', name: 'P', tasks: [
@@ -543,7 +595,8 @@ export declare function createWorkflowRunner(options?: WorkflowRunnerOptions): W
  *   the row `{ id: snapshot.id, snapshot }`.
  * - **`get(id)` resolves the stored snapshot for an id**, narrowing the opaque JSON column back to
  *   a {@link WorkflowSnapshot} ({@link import('../helpers.js').isWorkflowSnapshot} — the AGENTS §14
- *   boundary narrow for an untrusted storage read), or `undefined` if none is stored.
+ *   boundary narrow for an untrusted storage read), or `undefined` if none is stored. A present
+ *   snapshot whose own id differs from the requested key rejects with normalized `RESTORE` evidence.
  * - **`delete(id)` drops a snapshot by id**; an absent id is a no-op (no throw).
  *
  * UNLIKE the server package's `SessionStoreInterface` there is NO
@@ -554,7 +607,8 @@ export declare function createWorkflowRunner(options?: WorkflowRunnerOptions): W
  *
  * @example
  * ```ts
- * import { createDatabaseWorkflowStore, createMemoryDriver, createWorkflow, restoreWorkflow } from '@src/core'
+ * import { createMemoryDriver } from '@orkestrel/database'
+ * import { createDatabaseWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
  *
  * const store = createDatabaseWorkflowStore(createMemoryDriver()) // a durable driver swaps in here
  * const workflow = createWorkflow(definition)
@@ -573,7 +627,7 @@ export declare class DatabaseWorkflowStore implements WorkflowStoreInterface {
      *   {@link WorkflowSnapshotRow} `{ id; snapshot }` shape (the snapshot one opaque JSON column)
      */
     constructor(table: TableInterface<WorkflowSnapshotRow>);
-    /** Resolve the persisted snapshot for `id`, narrowing the opaque JSON column back to a `WorkflowSnapshot`. */
+    /** Resolve and key-check the snapshot for `id`, narrowing the opaque column to `WorkflowSnapshot`. */
     get(id: string): Promise<WorkflowSnapshot | undefined>;
     /** Insert or replace under the snapshot's OWN `id` (no separate id param) — the row is `{ id, snapshot }`. */
     set(snapshot: WorkflowSnapshot): Promise<void>;
@@ -728,6 +782,14 @@ export declare function derivePhaseStatus(tasks: readonly TaskStatus[]): PhaseSt
  */
 export declare function deriveWorkflowStatus(phases: readonly PhaseDerivation[]): WorkflowStatus;
 
+/**
+ * Normalize an unknown thrown value to a non-empty persistence-safe message.
+ *
+ * @param error - The caught value
+ * @returns A non-empty message without stack or cause data
+ */
+export declare function errorToMessage(error: unknown): string;
+
 /**
  * Box an error as a {@link Failure} — the graceful outcome half of a {@link Result}.
  *
@@ -765,6 +827,20 @@ export declare function failure<E>(error: E): Failure<E>;
  */
 export declare function findFailure(results: readonly TaskResult[]): TaskResult | undefined;
 
+/**
+ * Test that every named task has a callable runtime handler before dispatch.
+ *
+ * @remarks
+ * A snapshot lookup reads each unique `run` binding at most once from `functions`. A live workflow
+ * validates its tasks' already-resolved handlers without consulting the retained registry again.
+ *
+ * @param workflow - The persisted snapshot or constructed live workflow to validate
+ * @returns Whether every named task resolves to a callable handler
+ */
+export declare function hasWorkflowHandlers(workflow: WorkflowInterface): boolean;
+
+export declare function hasWorkflowHandlers(workflow: WorkflowSnapshot, functions: WorkflowFunctions | undefined): boolean;
+
 /**
  * Insert one `[key, value]` entry at a positional index into a readonly entries array —
  * the pure splice-in step behind an insertion-ordered registry's `add`.
@@ -791,6 +867,34 @@ export declare function findFailure(results: readonly TaskResult[]): TaskResult
  */
 export declare function insertEntry<T>(entries: readonly (readonly [string, T])[], index: number, key: string, value: T): readonly (readonly [string, T])[];
 
+/** Test the workflow lifecycle vocabulary. */
+export declare function isLifecycleStatus(value: unknown): value is LifecycleStatus;
+
+/**
+ * Validate a safe owned JSON graph as a coherent workflow snapshot.
+ *
+ * @remarks
+ * Callers at hostile boundaries use {@link isWorkflowSnapshot}, which owns the
+ * graph first so this semantic pass never observes accessors or prototypes.
+ */
+export declare function isOwnedWorkflowSnapshot(value: unknown): value is WorkflowSnapshot;
+
+/**
+ * Test whether an unknown value is valid persisted task activity.
+ */
+export declare function isTaskActivity(value: unknown): value is TaskActivity;
+
+/**
+ * Test whether an unknown value is a valid whole-frame activity report.
+ */
+export declare function isTaskActivityInput(value: unknown): value is TaskActivityInput;
+
+/** Test a normalized persisted task failure. */
+export declare function isTaskFailure(value: unknown): value is TaskFailure;
+
+/** Test a result's lineage against its containing snapshot nodes. */
+export declare function isTaskResult(value: unknown, workflow: unknown, phase: unknown, task: unknown): value is TaskResult;
+
 /**
  * Test whether a {@link LifecycleStatus} is TERMINAL — a node in this state will not
  * transition further.
@@ -825,24 +929,7 @@ export declare function isTerminalStatus(status: LifecycleStatus): boolean;
  */
 export declare function isWorkflowError(value: unknown): value is WorkflowError;
 
-/**
- * Narrow an `unknown` to a {@link WorkflowSnapshot} — the AGENTS §14 boundary guard for an
- * UNTRUSTED snapshot read (a storage row a {@link import('./stores/DatabaseWorkflowStore.js').DatabaseWorkflowStore}
- * reads back from its opaque JSON column, a snapshot loaded from disk).
- *
- * @remarks
- * A total guard (it NEVER throws — adversarial input returns `false`, AGENTS §14). It checks the
- * snapshot's SHAPE — `id` / `name` / `status` strings, a `boolean` `bail`, an array of `phases`,
- * `created` / `updated` numbers — enough to safely impose the {@link WorkflowSnapshot} type at a
- * storage boundary WITHOUT a cast. It is complementary to
- * {@link import('./factories.js').assertSnapshot}, which validates the DEEPER invariant (every
- * node's status / override drawn from the lifecycle vocabulary) and THROWS a `RESTORE`
- * {@link import('./errors.js').WorkflowError} — the deep gate a {@link import('./factories.js').restoreWorkflow}
- * applies. A boundary read narrows shape with this guard; a restore validates vocabulary with `assertSnapshot`.
- *
- * @param value - The value to test (an opaque storage read)
- * @returns `true` when `value` has the structural shape of a {@link WorkflowSnapshot}
- */
+/** Total hostile-boundary workflow snapshot guard. */
 export declare function isWorkflowSnapshot(value: unknown): value is WorkflowSnapshot;
 
 /**
@@ -861,6 +948,14 @@ export declare function isWorkflowSnapshot(value: unknown): value is WorkflowSna
  */
 export declare type LifecycleStatus = 'pending' | 'running' | 'completed' | 'failed' | 'skipped' | 'stopped';
 
+/** Compare two optional description values. */
+export declare function matchesDescription(left: unknown, right: unknown): boolean;
+
+/**
+ * The largest delay representable by the host timer APIs without overflow or clamping.
+ */
+export declare const MAX_TIMER_MS = 2147483647;
+
 /**
  * The in-memory {@link WorkflowStoreInterface} — a process-lifetime `Map` of
  * {@link WorkflowSnapshot}s keyed by workflow id, the DEFAULT store
@@ -889,7 +984,7 @@ export declare type LifecycleStatus = 'pending' | 'running' | 'completed' | 'fai
  *
  * @example
  * ```ts
- * import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@src/core'
+ * import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
  *
  * const store = createMemoryWorkflowStore()
  * const workflow = createWorkflow(definition)
@@ -961,9 +1056,9 @@ export declare function parkSignal(signal: AbortSignal): Promise<void>;
  *
  * @remarks
  * - **Derived status.** `status` is `#override` when one is in force, else
- *   {@link derivePhaseStatus} over the live tasks' statuses. {@link #recompute} (passed to
+ *   {@link derivePhaseStatus} over the live tasks' statuses. `#recompute` (passed to
  *   each child {@link Task}) re-derives on every child transition; a CHANGE emits the matching
- *   event AND escalates to the workflow ({@link #escalate}, the upward step of the cascade).
+ *   event AND escalates to the workflow (`#escalate`, the upward step of the cascade).
  * - **Override (AGENTS §10).** `skip` / `stop` FORCE the phase's status (e.g. skipping a whole
  *   phase), overriding the derived value; the override is PERSISTED in the snapshot's own
  *   `override` field and restored DIRECTLY (no divergence guess), so a forced phase round-trips.
@@ -972,9 +1067,11 @@ export declare function parkSignal(signal: AbortSignal): Promise<void>;
  *   `results()` collects the settled tasks' {@link TaskResult}s (the phase tier of the result
  *   tree); `workflow` navigates UP to the live parent.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link PhaseEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE, strictly AFTER the
- *   recompute + escalate; the emitter isolates a listener throw and routes it to its `error`
- *   handler (the `error` option); `fail` carries the failing task's {@link TaskResult}.
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+ *   corresponding status or runtime-gate change. Status events fire after the phase recomputes
+ *   and before it escalates to the workflow, preserving child/phase cause before parent effect.
+ *   The emitter isolates a listener throw and routes it to its `error` handler (the `error`
+ *   option); `fail` carries the failing task's {@link TaskResult}.
  * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
  *   delegating to {@link tasks} (the manager gates the target's own existence/status/id/
  *   bounds), then emit the matching {@link PhaseEventMap} event on success only. NATIVE
@@ -992,9 +1089,12 @@ export declare function parkSignal(signal: AbortSignal): Promise<void>;
  *   construction path {@link #append} uses at build time, so a live mint and a restored/built
  *   task are wired IDENTICALLY. At construction, the workflow-level
  *   {@link import('../types.js').WorkflowFunctions} registry (threaded from
- *   {@link import('../types.js').WorkflowOptions.functions}) resolves each task's `run` name into
- *   its runtime {@link import('../types.js').TaskInterface.handler} ONCE; a `run` that is omitted
- *   or unregistered resolves to no handler (the no-handler rule).
+ *   {@link import('../types.js').WorkflowOptions.functions}) resolves every unique initial `run`
+ *   name ONCE before any task is built; siblings sharing a name receive the exact same captured
+ *   runtime {@link import('../types.js').TaskInterface.handler}. A later live {@link add} reads
+ *   that name once from the retained registry at its own mint moment. An omitted or unregistered
+ *   `run` resolves to no handler; only omission is a no-op, while an unresolved present name makes
+ *   the containing tree non-drivable.
  * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror the workflow's own
  *   quartet, scoped to this phase — a driving
  *   {@link import('../types.js').WorkflowRunnerInterface.execute} gates a task's own
@@ -1007,7 +1107,7 @@ export declare function parkSignal(signal: AbortSignal): Promise<void>;
 export declare class Phase implements PhaseInterface {
     #private;
     readonly description?: string;
-    constructor(snapshot: PhaseSnapshot, workflow: WorkflowInterface, escalate: () => void, options?: PhaseOptions, bail?: boolean, functions?: WorkflowFunctions);
+    constructor(snapshot: PhaseSnapshot, workflow: WorkflowInterface, escalate: () => void, options?: PhaseOptions, bail?: boolean, functions?: WorkflowFunctions, silence?: number);
     get emitter(): EmitterInterface<PhaseEventMap>;
     get id(): string;
     get name(): string;
@@ -1116,8 +1216,10 @@ export declare interface PhaseDerivation {
  * @remarks
  * `start` fires when the phase begins; `complete` when all its tasks settled
  * successfully; `fail` when a task failed under `bail` (carrying the
- * {@link TaskResult}); `stop` when the phase was ended. `add` / `remove` / `move` /
- * `update` fire on a successful structural or patch edit through
+ * {@link TaskResult}); `pause` / `resume` when its runtime gate closes / opens;
+ * `skip` when the phase was intentionally skipped; `stop` when the phase was ended.
+ * `add` / `remove` / `move` / `update` fire on a successful
+ * structural or patch edit through
  * {@link PhaseInterface.add} / `remove` / `move` / `update` (AGENTS §7) — never on a
  * refused/gated one. A throwing listener is isolated by the emitter and routed to its
  * `error` handler, not the domain surface (AGENTS §13). A `type` alias (AGENTS §4.5)
@@ -1130,6 +1232,12 @@ export declare type PhaseEventMap = {
     readonly complete: readonly [];
     /** A task failed under `bail` — the failing task's result. */
     readonly fail: readonly [result: TaskResult];
+    /** The phase's runtime gate closed. */
+    readonly pause: readonly [];
+    /** The phase's runtime gate opened. */
+    readonly resume: readonly [];
+    /** The phase was intentionally skipped. */
+    readonly skip: readonly [];
     /** The phase was permanently stopped. */
     readonly stop: readonly [];
     /** A task was inserted — the inserted task + its final index. */
@@ -1165,8 +1273,9 @@ export declare type PhaseInput = Partial<PhaseContext>;
  * - **Override.** `skip` / `stop` (AGENTS §10) FORCE the phase's status, overriding the
  *   derived value (e.g. skipping a whole phase); the override survives a snapshot.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link PhaseEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status change; the emitter isolates a
- *   listener throw and routes it to its `error` handler (the `error` option).
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `stop` after the corresponding
+ *   status or runtime-gate change; the emitter isolates a listener throw and routes it to
+ *   its `error` handler (the `error` option).
  * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror
  *   {@link WorkflowInterface.pause} / `resume` / `wait`, scoped to this phase — a driving
  *   {@link WorkflowRunnerInterface.execute} gates a task's own pre-dispatch on BOTH the
@@ -1532,10 +1641,10 @@ export declare interface PhaseSnapshot {
  * derived from its tasks' statuses.
  *
  * @remarks
- * A semantic tier of the shared {@link LifecycleStatus} vocabulary. A phase is
- * `failed` only when a task failed AND the workflow's `bail` policy is in force (a
- * failure under graceful mode is data, not a phase failure). `stopped` propagates
- * when every task was stopped. See {@link import('./helpers.js').derivePhaseStatus}.
+ * A semantic tier of the shared {@link LifecycleStatus} vocabulary. A failed task makes
+ * its phase `failed` regardless of policy; the phase's effective `bail` determines whether
+ * that failure propagates to the workflow or is retained as graceful result data. `stopped`
+ * propagates when every task was stopped. See {@link import('./helpers.js').derivePhaseStatus}.
  */
 export declare type PhaseStatus = LifecycleStatus;
 
@@ -1578,6 +1687,38 @@ export declare const phaseUpdateShape: ObjectShape<{
     bail: OptionalShape<LiteralShape<readonly [true, false]>>;
 }, false>;
 
+/**
+ * Rebuild an interrupted workflow at its remaining retry budget.
+ *
+ * @remarks
+ * Each phase captures every unique initial `run` binding once before constructing tasks. Recovery
+ * validates those live tasks' captured callable handlers without rereading the registry, while the
+ * retained registry identity remains available to resolve future live additions at their mint time.
+ *
+ * @param snapshot - The hostile persisted snapshot
+ * @param options - Runtime handlers and entity options
+ * @returns A recoverable live workflow
+ */
+export declare function recoverWorkflow(snapshot: unknown, options?: WorkflowOptions): WorkflowInterface;
+
+/**
+ * Convert interrupted running work into a recoverable pending suffix or an
+ * exhausted recovery failure without replenishing attempts.
+ *
+ * @param snapshot - A fully validated owned snapshot with no terminal overrides
+ * @returns The recovery projection
+ */
+export declare function recoverWorkflowSnapshot(snapshot: WorkflowSnapshot): WorkflowSnapshot;
+
+/**
+ * Resolve a task's runtime silence window against its workflow default.
+ *
+ * @param value - The task-level override; any present non-positive or non-finite value disables
+ * @param fallback - The workflow-level default
+ * @returns A host-safe effective window (`1..MAX_TIMER_MS`), or `undefined`
+ */
+export declare function resolveTaskSilence(value: number | undefined, fallback: number | undefined): number | undefined;
+
 /**
  * Rebuild an equivalent live W-b entity tree from a {@link WorkflowSnapshot} — the
  * inverse of {@link WorkflowInterface.snapshot}, restoring structure + each node's status
@@ -1594,6 +1735,9 @@ export declare const phaseUpdateShape: ObjectShape<{
  * still wins when supplied (to deliberately re-run under a different policy). A structurally
  * invalid snapshot (a status — or override — outside the lifecycle vocabulary, or a
  * non-boolean `bail`) throws a `RESTORE` {@link WorkflowError}.
+ * Runtime handlers are optional: without a matching `functions` entry, a persisted `run`
+ * remains visible with an undefined `handler` so the exact state is inspectable. The runner
+ * rejects that unresolved tree if execution is attempted.
  *
  * @param snapshot - The snapshot to restore (carries its own `bail` + `override`)
  * @param options - Runtime options (initial listeners, an optional `bail` override, per-node options)
@@ -1601,13 +1745,13 @@ export declare const phaseUpdateShape: ObjectShape<{
  *
  * @example
  * ```ts
- * import { restoreWorkflow } from '@src/core'
+ * import { restoreWorkflow } from '@orkestrel/workflow'
  *
  * const restored = restoreWorkflow(workflow.snapshot()) // bail comes from the snapshot
  * restored.status === workflow.status // true
  * ```
  */
-export declare function restoreWorkflow(snapshot: WorkflowSnapshot, options?: WorkflowOptions): WorkflowInterface;
+export declare function restoreWorkflow(snapshot: unknown, options?: WorkflowOptions): WorkflowInterface;
 
 /**
  * A thin generic orchestrator that drives declared units — and any they `spawn` —
@@ -1696,7 +1840,7 @@ export declare class Runner<TInput, TResult> implements RunnerInterface<TInput,
      */
     spawn(input: TInput): Promise<TResult> | undefined;
     execute(inputs: readonly TInput[]): Promise<readonly TResult[]>;
-    abort(reason?: unknown): void;
+    abort(reason?: unknown): Promise<void>;
     /**
      * Suspend dispatch (AGENTS §10 — resumable): delegates to the backing queue's own
      * `pause`, which holds the NEXT dispatch while any in-flight unit finishes.
@@ -1726,8 +1870,8 @@ export declare class Runner<TInput, TResult> implements RunnerInterface<TInput,
      * gate, no recorded failure, no fail-fast trip) rather than a genuine failure — a
      * dispatched unit's rejection while stopping is still a real failure. Idempotent.
      */
-    stop(): void;
-    destroy(): void;
+    stop(): Promise<void>;
+    destroy(): Promise<void>;
 }
 
 /**
@@ -1859,8 +2003,9 @@ export declare interface RunnerInterface<TInput, TResult> {
      * `execute` reject.
      *
      * @param reason - An optional cancellation reason propagated to every unit's signal
+     * @returns The stable cleanup barrier
      */
-    abort(reason?: unknown): void;
+    abort(reason?: unknown): Promise<void>;
     /**
      * Suspend dispatch (AGENTS §10 — resumable): the backing queue holds the NEXT dispatch
      * while any in-flight unit finishes; idempotent.
@@ -1897,10 +2042,15 @@ export declare interface RunnerInterface<TInput, TResult> {
      * runner.stop() // the in-flight unit finishes; the rest are gracefully dropped
      * await results // resolves with whatever settled — never rejects
      * ```
+     * @returns The stable graceful-cleanup barrier
      */
-    stop(): void;
-    /** Tear the runner down — `abort` plus stop the backing queue; idempotent. */
-    destroy(): void;
+    stop(): Promise<void>;
+    /**
+     * Tear the runner down, awaiting backing-queue cleanup before destroying the emitter last.
+     *
+     * @returns The stable teardown barrier
+     */
+    destroy(): Promise<void>;
 }
 
 /**
@@ -1910,11 +2060,11 @@ export declare interface RunnerInterface<TInput, TResult> {
  * - `handler` — runs each unit's work against its {@link ControllerInterface};
  *   rejecting fails the unit (and, after retries are exhausted, fails the run).
  * - `concurrency` — the maximum units in flight at once; defaults to `1` (ordered,
- *   one-at-a-time). Floored at `1`.
+ *   one-at-a-time) and must be a positive safe integer.
  * - `retries` — the default extra attempts per unit on failure (or a per-attempt
- *   timeout); defaults to `0`.
- * - `timeout` — the per-attempt deadline in milliseconds; defaults to none (a
- *   non-positive value means no deadline).
+ *   timeout); defaults to `0` and must be a nonnegative safe integer.
+ * - `timeout` — the per-attempt deadline in milliseconds; defaults to `0`, must be
+ *   an integer in `0..2_147_483_647`, and `0` disables the deadline.
  * - `entries` — per-entry `retries` / `timeout` overrides, resolved from each
  *   input; falls back to the runner-level `retries` / `timeout` defaults.
  * - `on` — the reserved {@link EmitterHooks} key (§8): initial listeners for the runner's
@@ -1950,6 +2100,25 @@ export declare interface RunnerUnit<TInput> {
     readonly input: TInput;
 }
 
+/**
+ * Schedule one cancellable host operation behind an owned settlement signal.
+ *
+ * @remarks
+ * The completion and failure paths each own an {@link AbortController}; their native composite is
+ * linked to the optional caller signal before `start` can arm host work. Scheduler backends attach
+ * only to that safe composite, so caller mutation of `addEventListener` or `removeEventListener`
+ * cannot strand the operation. The first completion resolves, the first host failure rejects with
+ * its exact value, and caller abort rejects with its exact linked reason. Caller abort and host
+ * failure cancel an armed handle; synchronous settlement also cancels the handle immediately after
+ * `start` returns it. Cancellation is secondary cleanup: if its closure throws, the already-winning
+ * completion, exact host failure, or exact caller reason still settles without escape or replacement.
+ *
+ * @param start - Arm host work and return its cancellation closure
+ * @param signal - Optional caller cancellation signal
+ * @returns A promise settled exactly once by completion, host failure, or caller abort
+ */
+export declare function scheduleHost(start: (complete: () => void, failure: (error: unknown) => void) => () => void, signal?: AbortSignal): Promise<void>;
+
 /**
  * The safe cross-environment cooperative-yield default — a {@link SchedulerInterface}
  * built on `setTimeout` / `clearTimeout` alone, so it runs unchanged in both the
@@ -1966,11 +2135,10 @@ export declare interface RunnerUnit<TInput> {
  *   regains control, so it would not actually let pending I/O, timers, or
  *   rendering run — it only defers within the current task. A zero-delay timer is
  *   the correct cross-environment "give the host a turn".
- * - **Abort-aware.** A pending `yield` / `delay` rejects with `signal.reason` when
- *   the signal aborts (the standard `AbortSignal` convention). An already-aborted
- *   signal rejects immediately without arming a timer. Either settle path clears
- *   the timer and removes the abort listener — no leaked timer, no leaked
- *   listener, and no double-settle.
+ * - **Abort-aware.** A pending `yield` / `delay` rejects with `signal.reason` exactly.
+ *   {@link scheduleHost} links an owned settlement composite to the caller before arming
+ *   the timer, so pre-abort schedules nothing, caller signal method mutation is harmless,
+ *   cancellation clears the handle, and native first-settlement wins exactly once.
  * - **Priority is accepted but uniform.** `options.priority` is part of the
  *   contract, but a `setTimeout`-based default cannot act on urgency, so it treats
  *   every priority the same. Environment backends honour it.
@@ -2065,9 +2233,8 @@ export declare function success<T>(value: T): Success<T>;
  *   `TRANSITION` {@link WorkflowError} on an illegal move (e.g. completing a non-`running`
  *   task) — the legal graph is the single source of truth, so the leaf can never reach an
  *   impossible state.
- * - **Override (snapshot fidelity).** `skip` / `stop` set `#override` to the forced terminal
- *   status, so a RESTORE can tell a forced leaf (`skipped` / `stopped`) from a run-produced
- *   one and reinstate it AS an override — preserving the round-trip.
+ * - **Snapshot fidelity.** A leaf needs no override: `skipped` / `stopped` are explicit terminal
+ *   statuses, and restore reinstates the leaf directly from {@link TaskSnapshot.status}.
  * - **The cascade.** Every status change records its boxed result (when any), fires the leaf's
  *   OWN event, THEN calls the parent phase's `#recompute` (injected at construction) so the
  *   transition propagates UP (Task → Phase → Workflow re-derive). The own-event-before-cascade
@@ -2082,12 +2249,13 @@ export declare function success<T>(value: T): Success<T>;
  *   matching {@link import('../types.js').TaskDefinition} / {@link TaskSnapshot} field. `handler`
  *   is the RUNTIME-ONLY counterpart — `run` resolved ONCE at construction against the
  *   workflow-level {@link import('../types.js').WorkflowOptions.functions} registry — and is
- *   NEVER persisted; `undefined` when `run` is omitted or unregistered (the no-handler rule).
+ *   NEVER persisted; `undefined` when `run` is omitted or unregistered. Only omission is a
+ *   deliberate no-op; unresolved named work is rejected before dispatch.
  */
 export declare class Task implements TaskInterface {
     #private;
     readonly description?: string;
-    constructor(context: TaskContext, phase: PhaseInterface, workflow: WorkflowInterface, recompute: () => void, options?: TaskOptions, status?: TaskStatus, result?: TaskResult, run?: string, retries?: number, timeout?: number, handler?: WorkflowFunction);
+    constructor(context: TaskContext, phase: PhaseInterface, workflow: WorkflowInterface, recompute: () => void, options?: TaskOptions, status?: TaskStatus, result?: TaskResult, run?: string, retries?: number, timeout?: number, metadata?: JSONRecord, attempts?: number, activity?: TaskActivity, handler?: WorkflowFunction, silence?: number);
     get emitter(): EmitterInterface<TaskEventMap>;
     get id(): string;
     get name(): string;
@@ -2096,15 +2264,26 @@ export declare class Task implements TaskInterface {
     get workflow(): WorkflowInterface;
     get status(): TaskStatus;
     get result(): TaskResult | undefined;
+    get attempts(): number;
     get run(): string | undefined;
     get handler(): WorkflowFunction | undefined;
     get retries(): number | undefined;
     get timeout(): number | undefined;
+    get activity(): TaskActivity | undefined;
+    get silence(): number | undefined;
+    get silent(): boolean;
+    get paused(): boolean;
+    get signal(): AbortSignal;
     start(): void;
-    complete(value: unknown): void;
-    fail(error: unknown): void;
+    complete(value: JSONValue): void;
+    fail(error: TaskFailure): void;
     skip(): void;
     stop(): void;
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    pulse(): boolean;
+    pause(): void;
+    resume(): void;
+    wait(): Promise<void>;
     /**
      * Apply a validated declarative patch to SELF (`name` / `description`).
      *
@@ -2148,6 +2327,44 @@ export declare const TASK_STATUSES: readonly TaskStatus[];
  */
 export declare const TASK_TRANSITIONS: Readonly<Record<TaskStatus, readonly TaskStatus[]>>;
 
+/**
+ * The bounded, JSON-serializable activity most recently accepted from a task reporter.
+ */
+export declare interface TaskActivity {
+    readonly note?: string;
+    readonly progress?: TaskProgress;
+    readonly operations: readonly TaskOperation[];
+    readonly constraints: readonly TaskConstraint[];
+    readonly updated: number;
+}
+
+/**
+ * One complete replacement of a running task's observable activity.
+ *
+ * @remarks
+ * Omitted `operations` or `constraints` mean an empty list. Omitted `progress` clears the
+ * previous aggregate progress. Use {@link TaskInterface.report} to commit the replacement.
+ */
+export declare interface TaskActivityInput {
+    readonly note?: string;
+    readonly progress?: TaskProgress;
+    readonly operations?: readonly TaskOperation[];
+    readonly constraints?: readonly TaskConstraint[];
+}
+
+/**
+ * One constraint claimed active when a running task's complete frame was accepted.
+ *
+ * @remarks
+ * Constraints describe active limits or requirements without embedding provider policy in
+ * core. `id` is unique within one complete report and `started` is finite and non-negative.
+ */
+export declare interface TaskConstraint {
+    readonly id: string;
+    readonly name: string;
+    readonly started: number;
+}
+
 /**
  * The ambient context of a task — its own identity plus a back-reference to the
  * phase (and, transitively, the workflow) it belongs to.
@@ -2162,18 +2379,17 @@ export declare interface TaskContext extends WorkflowContext {
 }
 
 /**
- * The lean per-task handle a {@link import('./types.js').WorkflowFunction} receives — the
- * running task's folded cancellation, its input, its lineage, and read-UP access to the
- * result tree.
+ * The attempt-scoped handle a {@link import('./types.js').WorkflowFunction} receives.
  *
  * @remarks
  * - **A leaf handle, NOT the runner `Controller`.** A workflow task is a leaf of the
- *   declarative W-b tree, not a fan-out unit, so this carries none of the runner
- *   `Controller`'s `spawn` / `wait` — only what a leaf needs.
- * - **Folded signal.** `signal` is the cancellation the runner folds for THIS run: it fires
- *   on a workflow-level abort / timeout / budget ceiling, or — under `bail: true` — when a
- *   sibling task fails (the runner aborts the in-flight siblings via the substrate's
- *   fail-fast). A handler races its work against it; `aborted` reads it.
+ *   declarative W-b tree, not a fan-out unit, so it has no `spawn`; its `wait` instead
+ *   checkpoints the workflow, phase, and task cooperative gates.
+ * - **Folded signal.** `signal` is the cancellation folded for THIS attempt: its per-attempt
+ *   deadline, task stop/skip, workflow abort/timeout/budget/destroy, or a sibling fail-fast.
+ *   A handler races its work against it; `aborted` reads it.
+ * - **Attempt ownership.** `report` / `pulse` are closures supplied by the runner and refuse
+ *   after this signal aborts or a retry token supersedes this handle.
  * - **Input + lineage.** `input` is the task's open `metadata` bag (its
  *   {@link import('./types.js').TaskInput} payload, `{}` when none); `task` is the full
  *   {@link TaskContext}, so `task.phase` / `task.phase.workflow` navigate UP the lineage.
@@ -2188,10 +2404,15 @@ export declare interface TaskContext extends WorkflowContext {
 declare class TaskController_2 implements TaskControllerInterface {
     #private;
     readonly signal: AbortSignal;
-    readonly input: Readonly<Record<string, unknown>>;
+    readonly input: JSONRecord;
     readonly task: TaskContext;
-    constructor(signal: AbortSignal, input: Readonly<Record<string, unknown>>, task: TaskContext, results: () => readonly TaskResult[]);
+    readonly attempt: number;
+    constructor(signal: AbortSignal, input: JSONRecord, task: TaskInterface, attempt: number, results: () => readonly TaskResult[], report: (input: TaskActivityInput) => Result<TaskActivity, WorkflowError>, pulse: () => boolean);
     get aborted(): boolean;
+    get paused(): boolean;
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    pulse(): boolean;
+    wait(): Promise<void>;
     results(): readonly TaskResult[];
 }
 export { TaskController_2 as TaskController }
@@ -2201,26 +2422,49 @@ export { TaskController_2 as TaskController }
  * cancellation, its input, its lineage, and read-UP access to the result tree.
  *
  * @remarks
- * A NEW, lean handle (NOT the runner `Controller` — it carries no `spawn` / `wait`; a
- * workflow task is a leaf of the declarative tree, not a fan-out unit). It exposes:
- * - `signal` — the task's folded cancellation: fires on a workflow-level `abort` /
- *   `timeout` / `budget` ceiling, or — under `bail: true` — when a sibling task fails (the
- *   runner aborts the in-flight siblings). A handler races its work against it.
+ * A NEW, lean handle (NOT the runner `Controller` — it carries no `spawn`; a workflow task
+ * is a leaf of the declarative tree, not a fan-out unit). It exposes:
+ * - `signal` — this attempt's folded cancellation: its per-attempt deadline, task
+ *   stop/skip, workflow abort/timeout/budget/destroy, or a sibling fail-fast.
  * - `aborted` — whether `signal` has fired.
  * - `input` — the task's `metadata` bag (the open consumer payload from its
  *   {@link TaskInput}); `{}` when none.
  * - `task` — the task's full {@link TaskContext} (so `task.phase` / `task.phase.workflow`
  *   navigate UP the lineage).
+ * - `wait()` — a cooperative checkpoint for the workflow, phase, and task pause gates.
  * - `results()` — every settled task's {@link TaskResult} across already-finished phases,
  *   so a `function` task can read an earlier phase's output (the W-b result tree, read-only).
  */
 export declare interface TaskControllerInterface {
-    /** Fires on a workflow-level abort / timeout / budget, or a sibling failure under `bail: true`. */
+    /** Fires on this attempt's deadline, task stop/skip, run cancellation, or sibling fail-fast. */
     readonly signal: AbortSignal;
     readonly aborted: boolean;
     /** The task's open `metadata` bag (its {@link TaskInput} payload); `{}` when none. */
-    readonly input: Readonly<Record<string, unknown>>;
+    readonly input: JSONRecord;
     readonly task: TaskContext;
+    /** The one-based persisted launch represented by this handle. */
+    readonly attempt: number;
+    /** Whether the workflow, phase, or task cooperative gate is currently paused. */
+    readonly paused: boolean;
+    /**
+     * Replace this running task's complete observable activity.
+     *
+     * @param input - The complete operations, progress, and constraints replacement
+     * @returns The accepted frame, or a `TRANSITION` failure after ownership is lost or this attempt aborts
+     */
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    /**
+     * Confirm liveness without replacing current activity.
+     *
+     * @returns `true` when committed, or `false` after ownership is lost or this attempt aborts
+     */
+    pulse(): boolean;
+    /**
+     * Cooperatively park while any workflow, phase, or task gate is paused, or until cancelled.
+     *
+     * @returns A promise that resolves when every applicable gate is open or the signal aborts
+     */
+    wait(): Promise<void>;
     /** Every settled task's result across already-finished phases — the result tree, read-only. */
     results(): readonly TaskResult[];
 }
@@ -2235,8 +2479,8 @@ export declare interface TaskControllerInterface {
  * its phase; `name` is the human label; `description` is optional prose. `run` is a
  * PLAIN NAME — a key resolved ONCE at construction against a workflow-level
  * {@link WorkflowFunctions} registry into a runtime {@link TaskInterface.handler}
- * carried on the live task. A task whose `run` is omitted, or whose name is unregistered,
- * has no handler and AUTO-COMPLETES (the no-handler rule).
+ * carried on the live task. An omitted `run` is the deliberate no-op form and completes
+ * with JSON `null`; an unresolved present name remains inspectable but is not executable.
  */
 export declare interface TaskDefinition {
     readonly id: string;
@@ -2254,11 +2498,10 @@ export declare interface TaskDefinition {
     readonly retries?: number;
     /**
      * @remarks
-     * The per-attempt deadline in milliseconds (a non-negative integer); the runner threads it to
-     * this task's substrate unit, OVERRIDING the phase Runner's `timeout` default. Omitted (or a
-     * non-positive value) ⇒ no deadline. PERSISTED in a {@link TaskSnapshot} (like `bail` and
-     * `concurrency`), so `restoreWorkflow(snapshot, { functions })` resumes with the same
-     * reliability config; only the resolved handler itself is runtime-only.
+     * The workflow-owned per-attempt deadline in milliseconds, an integer from `0` through
+     * `MAX_TIMER_MS`. Zero or omission means no deadline. PERSISTED in a {@link TaskSnapshot},
+     * so `restoreWorkflow(snapshot, { functions })` resumes with the same reliability config;
+     * only the resolved handler itself is runtime-only.
      */
     readonly timeout?: number;
 }
@@ -2286,7 +2529,8 @@ export declare function taskDefinitionToSnapshot(task: WorkflowDefinition['phase
  * @remarks
  * `start` fires when the task begins; `complete` when it finishes successfully
  * (carrying its {@link TaskResult}); `fail` when it errors (carrying the result);
- * `skip` when it is intentionally not executed; `stop` when it is ended early. A
+ * `pause` / `resume` when its runtime gate closes / opens; `skip` when it is
+ * intentionally not executed; `stop` when it is ended early. A
  * throwing listener is isolated by the emitter and routed to its `error` handler,
  * not the domain surface (AGENTS §13). A `type` alias (AGENTS §4.5) so it satisfies
  * `EventMap`.
@@ -2298,12 +2542,46 @@ export declare type TaskEventMap = {
     readonly complete: readonly [result: TaskResult];
     /** The task failed — its result. */
     readonly fail: readonly [result: TaskResult];
+    /** The task's runtime gate closed. */
+    readonly pause: readonly [];
+    /** The task's runtime gate opened. */
+    readonly resume: readonly [];
     /** The task was intentionally skipped. */
     readonly skip: readonly [];
     /** The task was permanently stopped. */
     readonly stop: readonly [];
+    /** A complete activity replacement was committed. */
+    readonly report: readonly [activity: TaskActivity];
+    /** The task confirmed liveness without replacing its current activity. */
+    readonly pulse: readonly [activity: TaskActivity];
+    /** No report or pulse was accepted during the effective silence window. */
+    readonly silence: readonly [];
 };
 
+/** A normalized JSON-safe task failure persisted without a stack or cause. */
+export declare interface TaskFailure {
+    readonly origin: TaskFailureOrigin;
+    readonly message: string;
+}
+
+/**
+ * The structured outcome of a task execution — its full lineage, its terminal
+ * status, the moment it settled, and its boxed produced outcome.
+ *
+ * @remarks
+ * Carries the complete lineage (`task` / `phase` / `workflow` contexts) so a result
+ * is self-describing wherever it travels. `status` is the terminal state this
+ * result records. `result` BOXES the produced outcome in a {@link Result}: it is
+ * PRESENT exactly when `status` is `completed` (a {@link import('@orkestrel/contract').Success})
+ * or `failed` (a {@link import('@orkestrel/contract').Failure}), and ABSENT when `status` is
+ * `skipped` or `stopped` (terminal, but produced no outcome) — a pending/running
+ * task has no result at all (a non-terminal status, per
+ * {@link import('./helpers.js').isTerminalStatus}). This boxed `result` REPLACES separate
+ * `value?` / `error?` fields: a success's payload is `result.value`, a failure's reason is `result.error`.
+ * `timestamp` is when the result was created (ms since epoch).
+ */
+export declare type TaskFailureOrigin = 'handler' | 'timeout' | 'recovery';
+
 /** Initial {@link TaskEventMap} listeners — the reserved `on` option (AGENTS §8). */
 export declare type TaskHooks = EmitterHooks<TaskEventMap>;
 
@@ -2318,7 +2596,7 @@ export declare type TaskHooks = EmitterHooks<TaskEventMap>;
  */
 export declare interface TaskInput extends Partial<TaskContext> {
     /** An open consumer bag — stored and snapshotted, never interpreted by the workflow. */
-    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly metadata?: JSONRecord;
 }
 
 /**
@@ -2337,13 +2615,15 @@ export declare interface TaskInput extends Partial<TaskContext> {
  *   {@link import('@orkestrel/contract').Failure}), `skip` (AGENTS §10 — intentionally not run),
  *   and `stop` (AGENTS §10 — ended early). Each is GUARDED: an illegal transition (e.g.
  *   completing a non-`running` task) throws a {@link import('./errors.js').WorkflowError}.
- *   `skip` / `stop` set the override so the leaf's terminal state survives a snapshot.
+ *   A leaf needs no override: `skipped` / `stopped` are explicit terminal statuses and
+ *   restore directly from {@link TaskSnapshot.status}.
  * - **Result.** `result` is the recorded {@link TaskResult} once the task settled with an
  *   outcome (`completed` / `failed`), else `undefined` — the lineage-navigable leaf of the
  *   result tree.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link TaskEventMap}) fires
- *   `start` / `complete` / `fail` / `skip` / `stop` strictly AFTER each transition; the
- *   emitter isolates a listener throw and routes it to its `error` handler (the `error` option).
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` strictly AFTER
+ *   each state change; the emitter isolates a listener throw and routes it to its `error`
+ *   handler (the `error` option).
  */
 export declare interface TaskInterface {
     readonly emitter: EmitterInterface<TaskEventMap>;
@@ -2354,6 +2634,8 @@ export declare interface TaskInterface {
     readonly phase: PhaseInterface;
     readonly workflow: WorkflowInterface;
     readonly status: TaskStatus;
+    /** Total launches already consumed; zero while fresh and one-based after launch. */
+    readonly attempts: number;
     /** The recorded outcome once the task settled with one (`completed` / `failed`), else `undefined`. */
     readonly result: TaskResult | undefined;
     /**
@@ -2366,9 +2648,9 @@ export declare interface TaskInterface {
      * The RESOLVED runtime handler — RUNTIME-ONLY, NEVER persisted in a {@link TaskSnapshot}.
      * Resolved ONCE at construction (build, restore, or a live mint) by looking `run` up in the
      * workflow-level {@link WorkflowOptions.functions} registry: `functions?.[run]` when `run`
-     * is defined, else `undefined`. A task with no `handler` (an omitted `run`, or a `run` name
-     * absent from the registry) AUTO-COMPLETES (the no-handler rule) — its phase/workflow still
-     * reaches a terminal status, just with no dispatched behavior.
+     * is defined, else `undefined`. An omitted `run` is the deliberate no-op form. A present,
+     * unresolved `run` remains visible on exact restore, but the runner rejects it before
+     * dispatch instead of falsely completing named work.
      */
     readonly handler: WorkflowFunction | undefined;
     /**
@@ -2377,15 +2659,49 @@ export declare interface TaskInterface {
      */
     readonly retries: number | undefined;
     /**
-     * The per-attempt deadline in milliseconds — PERSISTED (mirrors {@link TaskDefinition.timeout}
-     * / {@link TaskSnapshot.timeout}). `undefined` ⇒ no deadline.
+     * The workflow-owned per-attempt deadline in milliseconds (`0..MAX_TIMER_MS`) — PERSISTED
+     * (mirrors {@link TaskDefinition.timeout} / {@link TaskSnapshot.timeout}). Zero or
+     * `undefined` means no deadline.
      */
     readonly timeout: number | undefined;
+    /** The last accepted reporter claim, absent while pending. */
+    readonly activity: TaskActivity | undefined;
+    /** The effective host-safe silence window (`1..MAX_TIMER_MS`), or `undefined` when disabled. */
+    readonly silence: number | undefined;
+    /** Whether no report or pulse was accepted during the current silence window. */
+    readonly silent: boolean;
+    /** Whether this task's cooperative execution gate is paused. */
+    readonly paused: boolean;
+    /** This task's own cancellation signal; running/pending {@link stop} or {@link skip} fires it. */
+    readonly signal: AbortSignal;
     start(): void;
-    complete(value: unknown): void;
-    fail(error: unknown): void;
+    complete(value: JSONValue): void;
+    fail(error: TaskFailure): void;
     skip(): void;
     stop(): void;
+    /**
+     * Replace the complete observable activity of this running task.
+     *
+     * @param input - The complete operations, progress, and constraints replacement
+     * @returns The accepted immutable frame; `MUTATION` for invalid input or `TRANSITION` when not running
+     */
+    report(input: TaskActivityInput): Result<TaskActivity, WorkflowError>;
+    /**
+     * Confirm liveness without replacing the current operations, progress, or constraints.
+     *
+     * @returns `true` when committed, or `false` when the task is not running
+     */
+    pulse(): boolean;
+    /** Suspend this task's cooperative gate while pending or running; idempotent. */
+    pause(): void;
+    /** Continue this task's cooperative gate; idempotent. */
+    resume(): void;
+    /**
+     * Park until this task is not paused.
+     *
+     * @returns A promise that resolves once the task gate is released
+     */
+    wait(): Promise<void>;
     /**
      * Apply a validated declarative patch to SELF (`name` / `description`).
      *
@@ -2514,6 +2830,19 @@ export declare interface TaskManagerInterface {
     tasks(): readonly TaskInterface[];
 }
 
+/**
+ * One operation claimed active when a running task's complete frame was accepted.
+ *
+ * @remarks
+ * `id` is stable within one complete activity report, `name` is the human-readable label,
+ * and `started` is a finite non-negative reporter timestamp.
+ */
+export declare interface TaskOperation {
+    readonly id: string;
+    readonly name: string;
+    readonly started: number;
+}
+
 /**
  * The runtime options for a {@link TaskInterface} — the construction bag the live
  * leaf state machine (W-b) carries that the W-a {@link TaskDefinition} did not.
@@ -2531,32 +2860,31 @@ export declare interface TaskOptions {
     /** The emitter's listener-error handler (AGENTS §13) — a listener throw routes here, not to a domain event. */
     readonly error?: EmitterErrorHandler;
     /** An open consumer bag — stored and snapshotted, never interpreted by the workflow. */
-    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly metadata?: JSONRecord;
+    /** Runtime-only silence window; non-positive, non-finite, or over-`MAX_TIMER_MS` disables inheritance. */
+    readonly silence?: number;
 }
 
 /**
- * The structured outcome of a task execution — its full lineage, its terminal
- * status, the moment it settled, and its boxed produced outcome.
+ * The aggregate progress most recently reported by a running task.
  *
  * @remarks
- * Carries the complete lineage (`task` / `phase` / `workflow` contexts) so a result
- * is self-describing wherever it travels. `status` is the terminal state this
- * result records. `result` BOXES the produced outcome in a {@link Result}: it is
- * PRESENT exactly when `status` is `completed` (a {@link import('@orkestrel/contract').Success})
- * or `failed` (a {@link import('@orkestrel/contract').Failure}), and ABSENT when `status` is
- * `skipped` or `stopped` (terminal, but produced no outcome) — a pending/running
- * task has no result at all (a non-terminal status, per
- * {@link import('./helpers.js').isTerminalStatus}). This boxed `result` REPLACES separate
- * `value?` / `error?` fields: a success's payload is `result.value`, a failure's reason is `result.error`.
- * `timestamp` is when the result was created (ms since epoch).
+ * `current` and an optional `total` are finite non-negative numbers; when `total` is present
+ * it is at least `current`. `unit` is optional observer-facing text.
  */
+export declare interface TaskProgress {
+    readonly current: number;
+    readonly total?: number;
+    readonly unit?: string;
+}
+
 export declare interface TaskResult {
     readonly task: TaskContext;
     readonly phase: PhaseContext;
     readonly workflow: WorkflowContext;
     readonly status: TaskStatus;
     /** The boxed outcome — present for `completed` (Success) / `failed` (Failure), absent otherwise. */
-    readonly result?: Result<unknown>;
+    readonly result?: Result<JSONValue, TaskFailure>;
     readonly timestamp: number;
 }
 
@@ -2595,13 +2923,17 @@ export declare interface TaskSnapshot {
     readonly description?: string;
     readonly status: TaskStatus;
     readonly result?: TaskResult;
-    readonly metadata: Readonly<Record<string, unknown>>;
+    readonly metadata: JSONRecord;
+    /** Total launches already consumed; zero while fresh and never reset by recovery. */
+    readonly attempts: number;
     /** The behavior reference — a registry key resolved against {@link WorkflowFunctions} on restore/build. */
     readonly run?: string;
     /** Extra attempts after the first on failure (a non-negative integer); overrides the phase Runner default. */
     readonly retries?: number;
-    /** The per-attempt deadline in milliseconds (a non-negative integer); overrides the phase Runner default. */
+    /** Workflow-owned per-attempt deadline (`0..MAX_TIMER_MS`); zero or omission means disabled. */
     readonly timeout?: number;
+    /** Pending omits activity; running/completed/failed require it; skipped/stopped may retain it. */
+    readonly activity?: TaskActivity;
 }
 
 /**
@@ -2694,24 +3026,26 @@ export declare type UnitOutcome<TResult> = {
  * - **Construction.** Built from a {@link WorkflowSnapshot} (the unified input —
  *   {@link import('./factories.js').createWorkflow} seeds an initial snapshot from a
  *   {@link import('./types.js').WorkflowDefinition}, {@link import('./factories.js').restoreWorkflow}
- *   passes a persisted one). Each child {@link Phase} is wired to escalate to {@link #recompute}.
+ *   passes a persisted one). Each child {@link Phase} is wired to escalate to `#recompute`.
  * - **Derived status.** `status` is `#override` when forced, else
  *   {@link deriveWorkflowStatus} over the live phases' statuses feeding `bail`. `failed` is
  *   reachable ONLY under `bail: true` (a single failed task halts the workflow); under
- *   `bail: false` a failed phase folds into `completed`. {@link #recompute} diffs on each phase
+ *   `bail: false` a failed phase folds into `completed`. `#recompute` diffs on each phase
  *   change; a CHANGE emits.
- * - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; the override is PERSISTED in the
- *   snapshot's own `override` field and restored DIRECTLY (no divergence guess). The snapshot also
- *   persists `bail`, so a restore re-derives status identically without a silent policy default.
+ * - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; an executed task-free pending tree
+ *   may also be force-completed vacuously. The override is PERSISTED in the snapshot's own
+ *   `override` field and restored DIRECTLY (no divergence guess). The snapshot also persists
+ *   `bail`, so a restore re-derives status identically without a silent policy default.
  * - **Result tree.** `results()` flattens every phase's `results()` ({@link collectResults}) — the
  *   workflow tier; `phase(id)` + each `phase.task(id)` navigate DOWN, a task's `phase` / `workflow`
  *   navigate UP.
  * - **Snapshot.** `snapshot()` serializes the whole live tree to a {@link WorkflowSnapshot} (pure
  *   JSON); {@link import('./factories.js').restoreWorkflow} rebuilds an equivalent live tree.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link WorkflowEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE; the emitter isolates a
- *   listener throw and routes it to its `error` handler (the `error` option); `fail` carries
- *   the failing task's {@link TaskResult}.
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+ *   corresponding status or runtime-gate change; the emitter isolates a listener throw and
+ *   routes it to its `error` handler (the `error` option); `fail` carries the failing task's
+ *   {@link TaskResult}.
  * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
  *   delegating to {@link phases} (the manager gates the target's own existence/status/id/
  *   bounds), then emit the matching {@link WorkflowEventMap} event on success only. NATIVE,
@@ -2723,10 +3057,10 @@ export declare type UnitOutcome<TResult> = {
  *   naturally accepted.
  * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` gate execution at the runner's
  *   phase/task boundaries WITHOUT touching {@link status} — `paused` is runtime-only, never
- *   persisted. `destroy` is a terminal teardown: it aborts {@link signal}, `stop`s every
- *   non-terminal live phase (so an engine parked on a phase's own gate unparks and the tree
- *   lands coherent), forces the `stop` override on THIS workflow when not already terminal,
- *   releases any parked {@link wait} waiter, and marks {@link destroyed} — all four idempotent.
+ *   persisted. `destroy` is a terminal teardown: it `stop`s every non-terminal task and
+ *   phase (releasing their gates and liveness resources), aborts {@link signal}, forces the
+ *   workflow `stop` override when needed, releases its parked waiter, and marks
+ *   {@link destroyed} — all idempotent.
  */
 export declare class Workflow implements WorkflowInterface {
     #private;
@@ -2761,6 +3095,9 @@ export declare class Workflow implements WorkflowInterface {
 /** Every {@link WorkflowStatus} value, frozen — the lifecycle vocabulary of a workflow. */
 export declare const WORKFLOW_STATUSES: readonly WorkflowStatus[];
 
+/** A runner-owned durability boundary. */
+export declare type WorkflowCheckpoint = 'initial' | 'attempt' | 'settlement' | 'final';
+
 /**
  * The ambient context of a workflow — the identity every level inherits.
  *
@@ -2797,18 +3134,13 @@ export declare interface WorkflowDefinition {
 }
 
 /**
- * An error thrown by the workflow entity + W-c2 recursion layer.
+ * An error raised by the workflow runtime.
  *
  * @remarks
  * Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
- * offending node id / status. Thrown for an illegal lifecycle transition
+ * offending node id / status. Raised for an illegal lifecycle transition
  * (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
- * passed to {@link import('./factories.js').restoreWorkflow} (`RESTORE`), an over-deep /
- * cyclic nested-workflow dispatch (`DEPTH`), and a malformed workflow-authoring-tool args
- * blob (`TOOL`). `DEPTH` and `TOOL` are public type surface constructed by the
- * `@orkestrel/tool` package's workflow-tool / agent-function adapters; on that seam the
- * throw is ISOLATED by its `ToolManager` into the tool result's top-level `error`
- * (AGENTS §14 — the universal tool-handler contract).
+ * boundary (`RESTORE`), or a refused structural/activity edit (`MUTATION`).
  */
 export declare class WorkflowError extends Error {
     readonly code: WorkflowErrorCode;
@@ -2826,21 +3158,6 @@ export declare class WorkflowError extends Error {
  *   the offending current status + requested transition in the error `context`.
  * - `RESTORE` — a {@link import('./factories.js').restoreWorkflow} given a structurally
  *   invalid {@link WorkflowSnapshot} (a status outside the lifecycle vocabulary).
- * - `DEPTH` — a nested-workflow dispatch (W-c2) that a depth / cycle guard rejected:
- *   running it would push the nested-workflow chain past a bounded max depth, OR its
- *   target agent (or a workflow it would author) is already an ancestor of the current
- *   run (a re-entry cycle). Public type surface consumed by the `@orkestrel/tool`
- *   package's workflow-tool / agent-function adapters, which construct
- *   {@link import('./errors.js').WorkflowError}s with this code (thrown, then ISOLATED
- *   by that package's `ToolManager` into the tool result's `error`). The error `context`
- *   names the offending agent / workflow id + the depth.
- * - `TOOL` — a workflow-authoring tool handler (in `@orkestrel/tool`) was handed a
- *   MALFORMED / over-constraint authored args blob (e.g. an empty `id`, `concurrency: 0`)
- *   that {@link import('./factories.js').createWorkflowContract} rejected, so no workflow
- *   ran. Public type surface: `@orkestrel/tool` constructs this code and THROWS it
- *   (rather than returning a failure result); its `ToolManager` ISOLATES the throw into
- *   the canonical tool result's top-level `error` (AGENTS §14 — the universal
- *   tool-handler contract); the error `context` names the wrapped workflow id.
  * - `MUTATION` — a GATED structural or patch edit was refused: a duplicate id on
  *   `append`/`add`, a target that does not exist or is not `pending`, an out-of-bounds
  *   `index`, a patch that failed shaper validation, or a live structural edit refused by
@@ -2854,7 +3171,7 @@ export declare class WorkflowError extends Error {
  *   guard (both genuine programmer-error paths, AGENTS §12). The error `context` names
  *   the offending id / index / status.
  */
-export declare type WorkflowErrorCode = 'TRANSITION' | 'RESTORE' | 'DEPTH' | 'TOOL' | 'MUTATION';
+export declare type WorkflowErrorCode = 'TRANSITION' | 'RESTORE' | 'MUTATION';
 
 /**
  * The push observation surface (AGENTS §13) of the workflow entity (W-b) — the
@@ -2864,8 +3181,10 @@ export declare type WorkflowErrorCode = 'TRANSITION' | 'RESTORE' | 'DEPTH' | 'TO
  * @remarks
  * Present-tense events with arg tuples. `start` fires when the workflow begins;
  * `complete` when every phase settled successfully; `fail` when a phase failed
- * under `bail` (carrying the failing {@link TaskResult}); `stop` when the workflow
- * was permanently ended. `add` / `remove` / `move` / `update` fire on a successful
+ * under `bail` (carrying the failing {@link TaskResult}); `pause` / `resume` when its
+ * runtime gate closes / opens; `skip` when the workflow was intentionally skipped;
+ * `stop` when it was permanently ended. `add` / `remove`
+ * / `move` / `update` fire on a successful
  * structural or patch edit through {@link WorkflowInterface.add} / `remove` / `move` /
  * `update` (AGENTS §7) — never on a refused/gated one. A throwing listener never
  * reaches the domain surface — the emitter isolates it and routes it to its OWN
@@ -2880,6 +3199,12 @@ export declare type WorkflowEventMap = {
     readonly complete: readonly [];
     /** A phase failed under `bail` — the failing task's result. */
     readonly fail: readonly [result: TaskResult];
+    /** The workflow's runtime gate closed. */
+    readonly pause: readonly [];
+    /** The workflow's runtime gate opened. */
+    readonly resume: readonly [];
+    /** The workflow was intentionally skipped. */
+    readonly skip: readonly [];
     /** The workflow was permanently stopped. */
     readonly stop: readonly [];
     /** A phase was inserted — the inserted phase + its final index. */
@@ -2892,6 +3217,15 @@ export declare type WorkflowEventMap = {
     readonly update: readonly [phase: PhaseInterface];
 };
 
+/** A normalized persistence failure surfaced as workflow result data. */
+export declare interface WorkflowFault {
+    readonly origin: 'persistence';
+    readonly checkpoint: WorkflowCheckpoint;
+    readonly message: string;
+    readonly task?: string;
+    readonly attempt?: number;
+}
+
 /**
  * A registered workflow function — the behavior a `function`-form
  * {@link TaskDefinition} runs, resolved BY NAME through the {@link WorkflowFunctions}
@@ -2906,7 +3240,7 @@ export declare type WorkflowEventMap = {
  * should honour `controller.signal` (a workflow-level abort / timeout / budget, or — under
  * `bail: true` — a sibling's failure, fires it) so a cancel stops it promptly.
  */
-export declare type WorkflowFunction = (controller: TaskControllerInterface) => Promise<unknown> | unknown;
+export declare type WorkflowFunction = (controller: TaskControllerInterface) => Promise<JSONValue> | JSONValue;
 
 /**
  * The `function`-task behavior registry — workflow function names mapped to their
@@ -2914,9 +3248,10 @@ export declare type WorkflowFunction = (controller: TaskControllerInterface) =>
  *
  * @remarks
  * A live {@link TaskInterface} resolves its `run` name against this registry ONCE at
- * construction into its {@link TaskInterface.handler}. A name absent from the registry (or
- * an omitted `run`) is the no-handler case — the task AUTO-COMPLETES (the ROADMAP rule). A
- * plain record (not a manager) — the registry is a lookup, with no lifecycle of its own.
+ * construction into its {@link TaskInterface.handler}. An omitted `run` is the deliberate
+ * no-op case. A present name absent from the registry remains inspectable but makes the tree
+ * non-drivable until restored with a matching handler. A plain record (not a manager) — the
+ * registry is a lookup, with no lifecycle of its own.
  */
 export declare type WorkflowFunctions = Readonly<Record<string, WorkflowFunction>>;
 
@@ -2940,14 +3275,15 @@ export declare type WorkflowInput = Partial<WorkflowContext>;
  * - **Children.** `phases` is the lean {@link PhaseManagerInterface} (AGENTS §9);
  *   `phase(id)` / `phases().phases()` read in positional order. `results` collects ALL
  *   tasks' results across every phase (the workflow tier of the result tree).
- * - **Override.** `skip` / `stop` (AGENTS §10) FORCE the workflow's status; the override
- *   survives a snapshot.
+ * - **Override.** `skip` / `stop` (AGENTS §10) FORCE the workflow's status; `complete`
+ *   may force only a task-free, otherwise-pending tree. The override survives a snapshot.
  * - **Snapshot.** `snapshot()` serializes the whole live tree to a {@link WorkflowSnapshot}
  *   (pure JSON — structure + each node's status + recorded results + positional order);
  *   {@link restoreWorkflow} rebuilds an equivalent live tree.
  * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link WorkflowEventMap}) fires
- *   `start` / `complete` / `fail` / `stop` on a derived-status change; the emitter isolates a
- *   listener throw and routes it to its `error` handler (the `error` option).
+ *   `start` / `complete` / `fail` / `pause` / `resume` / `stop` after the corresponding
+ *   status or runtime-gate change; the emitter isolates a listener throw and routes it to
+ *   its `error` handler (the `error` option).
  */
 export declare interface WorkflowInterface {
     readonly emitter: EmitterInterface<WorkflowEventMap>;
@@ -2997,9 +3333,9 @@ export declare interface WorkflowInterface {
      * FORCE this workflow to `completed` (AGENTS §10), overriding the derived value.
      *
      * @remarks
-     * A NO-OP unless `status` is `pending` — its ONLY legitimate use is settling a vacuously
-     * DONE tree (no work happened), mirroring the runner's own gate. Never overrides a real
-     * `completed` / a bail-true `failed` / a `stopped` / a derived `skipped`.
+     * A NO-OP unless `status` is `pending` and the tree is genuinely vacuous: zero phases or
+     * every phase contains zero tasks. Its ONLY legitimate use is settling an executed no-op
+     * tree. It never overrides pending work or any started/terminal state.
      */
     complete(): void;
     /**
@@ -3033,16 +3369,15 @@ export declare interface WorkflowInterface {
      */
     resume(): void;
     /**
-     * Tear this workflow down (AGENTS §10) — a TERMINAL teardown: aborts {@link signal},
-     * `stop`s every non-terminal live phase (so any engine parked on a phase's own gate
-     * unparks and the tree lands coherent), forces the `stop` override on THIS workflow if
-     * it is not already terminal, resolves any parked {@link wait} waiter, and marks
-     * {@link destroyed}; idempotent.
+     * Tear this workflow down (AGENTS §10) — an atomic TERMINAL teardown: mark
+     * {@link destroyed}, pin non-terminal workflow/phase overrides to `stopped`, stop every
+     * non-terminal task, release gates and liveness resources, abort {@link signal}, then
+     * destroy task, phase, and workflow emitters in ownership order; idempotent.
      *
      * @remarks
-     * After `destroy`, every structural mutator (`add` / `remove` / `move` / `update` /
-     * `patch`) and `pause` / `resume` reject (a `Result` failure) or no-op — never throws
-     * for calling `destroy` itself twice.
+     * {@link destroyed} is set before final events, so reentrant mutation is refused and a
+     * recursive `destroy` is a no-op. Already-terminal genuine completed/failed state is
+     * preserved, and state/snapshots remain inspectable after emitter resources are destroyed.
      *
      * @example
      * ```ts
@@ -3149,12 +3484,11 @@ export declare interface WorkflowInterface {
  *   `functions` registry in) and stores it under `definition.id` — an already-present id
  *   OVERWRITES (last write wins). `count` is the map size, `workflow(id)` looks one up,
  *   `workflows()` lists them in insertion order.
- * - **Durable open / save.** `open(id)` returns an already-registered workflow directly; on a
- *   registry MISS with a `store` set it rehydrates through {@link restoreWorkflow} (flowing the
- *   manager's `functions` registry in so the rehydrated tree is RUNNABLE), registers it, and
- *   returns it — lenient (`undefined`) with no store or a store miss. `save(id)` persists a
- *   registered workflow's `snapshot()` to the `store` — lenient (`false`) with no store or an
- *   unknown id.
+ * - **Durable open / save.** `open(id)` returns an already-registered workflow directly; same-id
+ *   misses share one hydration. A concurrent `add` wins, while `remove` / `clear` invalidate
+ *   earlier reads; wrong-key payloads reject with `RESTORE`. `save(id)` captures a registered
+ *   workflow's snapshot at invocation and serializes same-id writes without coupling other ids.
+ *   Both remain lenient without a store or registered id.
  * - **Removal.** `remove` drops one by id, or a batch (§9.2, array overload FIRST) — `true` when
  *   any was removed. `clear` empties the registry.
  * - **No active pointer.** Unlike its `ConversationManager` / `WorkspaceManager` twins, there is
@@ -3204,10 +3538,17 @@ export declare class WorkflowManager implements WorkflowManagerInterface {
  *   `workflows()` lists them in insertion order.
  * - **Durable open / save (the optional `store` seam).** When a {@link WorkflowStoreInterface}
  *   is supplied (the `store` option), `open(id)` resolves an already-registered workflow
- *   directly (no store hit); on a registry MISS it HYDRATES one from `store.get(id)` through
+ *   directly (no store hit); same-id registry misses share one in-flight hydration. On a MISS
+ *   it HYDRATES one from `store.get(id)` through
  *   {@link import('./factories.js').restoreWorkflow} — flowing this manager's `functions`
- *   registry in so the rehydrated tree is RUNNABLE — registers it, and returns it. `save(id)`
- *   PERSISTS a registered workflow's {@link WorkflowInterface.snapshot} to the store. Both are
+ *   registry in so the rehydrated tree is RUNNABLE — registers it, and returns it. Registry
+ *   mutation wins over an earlier pending hydration: `add` supplies the live result, while
+ *   `remove` (even for an absent id) and `clear` invalidate the earlier read. Missed and failed
+ *   reads leave no stale in-flight entry, and a payload whose own id differs from the requested
+ *   key rejects with `RESTORE` instead of registering under either id. `save(id)` captures a
+ *   registered workflow's {@link WorkflowInterface.snapshot} at invocation, then PERSISTS it.
+ *   Same-id writes run serially in invocation order; different ids remain independent, and an
+ *   earlier rejection reaches its caller without preventing a later queued write. Both are
  *   LENIENT without a store — `open` resolves only registered ids, `save` is a no-op
  *   (`false`) — never a throw. The EXACT analogue of
  *   `ConversationManagerInterface.open` / `.save` and `WorkspaceManagerInterface.open` /
@@ -3221,7 +3562,7 @@ export declare class WorkflowManager implements WorkflowManagerInterface {
  *
  * @example
  * ```ts
- * import { createWorkflowManager } from '@src/core'
+ * import { createWorkflowManager } from '@orkestrel/workflow'
  *
  * const manager = createWorkflowManager({
  * 	functions: { compile: async (controller) => `built ${controller.task.id}` },
@@ -3255,11 +3596,17 @@ export declare interface WorkflowManagerInterface {
      *
      * @remarks
      * - If `id` is ALREADY registered, it is returned directly — no store hit.
-     * - Else if a `store` is set, `store.get(id)` is awaited; on a HIT the snapshot is
+     * - Same-id registry misses share one in-flight `store.get(id)` and resolve to the same live
+     *   object. On a HIT the snapshot is
      *   rehydrated into a fresh {@link WorkflowInterface} via
      *   {@link import('./factories.js').restoreWorkflow}, flowing this manager's `functions`
      *   registry in (so the rehydrated tree carries real resolved `handler`s and can RESUME
-     *   real work), registers it, and returns it.
+     *   real work), registers it, and returns it. A payload whose own id differs from `id` rejects
+     *   with a normalized `RESTORE` error carrying the requested and payload ids.
+     * - Registry mutation after the store read starts has precedence: `add(definition)` for the
+     *   same id wins and becomes every pending caller's result; `remove(id)` invalidates that read
+     *   even when the id was absent; `clear()` invalidates every earlier read. A miss or rejection
+     *   clears the in-flight entry so a later call retries.
      * - Else (no store, or a store MISS) ⇒ `undefined` (lenient — no throw).
      *
      * @param id - The workflow id to open
@@ -3271,9 +3618,10 @@ export declare interface WorkflowManagerInterface {
      * {@link WorkflowStoreInterface} (`store`).
      *
      * @remarks
-     * Lenient: when a `store` is set AND `id` is registered, `store.set(workflow.snapshot())`
-     * is awaited and `true` is returned; otherwise (no store, OR an unknown id) it is a NO-OP
-     * returning `false` — never a throw.
+     * When a `store` is set AND `id` is registered, the snapshot is captured synchronously at
+     * invocation. Same-id `store.set` calls are serialized in invocation order; different ids are
+     * independent. A rejected write reaches that caller unchanged but does not poison a later
+     * queued write. Otherwise (no store, OR an unknown id) it is a NO-OP returning `false`.
      *
      * @param id - The id of the registered workflow to persist
      * @returns `true` when the snapshot was persisted; `false` when no store / unknown id
@@ -3298,9 +3646,8 @@ export declare interface WorkflowManagerInterface {
  * every {@link import('./factories.js').createWorkflow} ({@link WorkflowManagerInterface.add})
  * and every {@link import('./factories.js').restoreWorkflow}
  * ({@link WorkflowManagerInterface.open}'s hydration path) the manager performs — so a
- * hydrated workflow carries real resolved `handler`s and is RUNNABLE, not merely a restored
- * state mirror. Omitted ⇒ every minted/hydrated task resolves no `handler` (the no-handler
- * rule — it auto-completes if driven).
+ * hydrated workflow carries real resolved `handler`s and is RUNNABLE. Omitted ⇒ named work
+ * remains inspectable but cannot be driven; omitted-`run` tasks remain deliberate no-ops.
  */
 export declare interface WorkflowManagerOptions {
     /**
@@ -3316,7 +3663,7 @@ export declare interface WorkflowManagerOptions {
      * (`add`, via {@link import('./factories.js').createWorkflow}) or hydrates (`open`'s
      * registry-miss path, via {@link import('./factories.js').restoreWorkflow}) — so a
      * hydrated workflow is RUNNABLE, its tasks carrying real resolved `handler`s. Omitted ⇒
-     * every task resolves no `handler` (the no-handler rule).
+     * named tasks remain inspectable but execution rejects them.
      */
     readonly functions?: WorkflowFunctions;
 }
@@ -3354,12 +3701,66 @@ export declare interface WorkflowOptions {
      * fresh build ({@link import('./factories.js').createWorkflow}) and a restore
      * ({@link import('./factories.js').restoreWorkflow}) both consume, and the same shape a
      * live {@link WorkflowInterface.add} / {@link PhaseInterface.add} mint resolves a newly
-     * minted task against. A `run` name absent from `functions` (or omitted entirely)
-     * resolves to no handler — that task AUTO-COMPLETES (the no-handler rule): its
-     * phase/workflow still reaches a terminal status, just with no dispatched behavior.
-     * Omitted ⇒ an empty registry (every task auto-completes).
+     * minted task against. An omitted `run` resolves to no handler and is the deliberate
+     * no-op form. A present name absent from `functions` also has no handler so exact restore
+     * remains inspectable, but {@link WorkflowRunnerInterface.execute} rejects that tree.
+     * Omitted ⇒ an empty registry; only tasks that also omit `run` are executable no-ops.
      */
     readonly functions?: WorkflowFunctions;
+    /** Runtime-only default silence; non-positive, non-finite, or over-`MAX_TIMER_MS` disables it. */
+    readonly silence?: number;
+}
+
+/**
+ * Advanced run-local snapshot persistence with one writer and one coalesced latest obligation.
+ *
+ * @remarks
+ * Normally composed by `WorkflowRunner.execute({ store })`; exported for hosts that need to
+ * coordinate the same required boundaries around their own runner integration.
+ */
+export declare class WorkflowPersistence implements WorkflowPersistenceInterface {
+    #private;
+    constructor(workflow: WorkflowInterface, store: WorkflowStoreInterface);
+    get fault(): WorkflowFault | undefined;
+    /**
+     * Persist every change through this required boundary.
+     *
+     * @param checkpoint - The boundary being made durable
+     * @param task - The task owning an attempt or settlement
+     * @param attempt - The persisted attempt number
+     * @returns Whether the latest state reached the store
+     */
+    checkpoint(checkpoint: WorkflowCheckpoint, task?: TaskInterface, attempt?: number): Promise<boolean>;
+    /**
+     * Stop observing the live tree and persist its final state.
+     *
+     * @returns Whether the final snapshot reached the store
+     */
+    finalize(): Promise<boolean>;
+    /** Stop observing the live tree. */
+    detach(): void;
+}
+
+/**
+ * The advanced run-local durability coordinator normally composed by
+ * {@link WorkflowRunnerInterface.execute} when `store` is supplied.
+ */
+export declare interface WorkflowPersistenceInterface {
+    /** The first required checkpoint failure, if one occurred. */
+    readonly fault: WorkflowFault | undefined;
+    /**
+     * Make the latest state durable at one required boundary.
+     *
+     * @param checkpoint - The required durability boundary
+     * @param task - The task owning an attempt or settlement
+     * @param attempt - The persisted one-based attempt number
+     * @returns Whether the latest live state reached the store
+     */
+    checkpoint(checkpoint: WorkflowCheckpoint, task?: TaskInterface, attempt?: number): Promise<boolean>;
+    /** Detach observers and make the final live state durable. */
+    finalize(): Promise<boolean>;
+    /** Stop observing the live workflow tree; idempotent. */
+    detach(): void;
 }
 
 /**
@@ -3376,11 +3777,17 @@ export declare interface WorkflowOptions {
  * settled task across all phases, in positional order — the same array `workflow.results()`
  * yields). Returning the live `workflow` (not just a snapshot) keeps the entity tree the
  * source of truth — the runner adds only the convenience `status` / `results` projections.
+ * A scheduler or other engine-infrastructure failure rejects after the runner coherently
+ * stops remaining work and attempts final persistence.
  */
 export declare interface WorkflowResult {
     readonly workflow: WorkflowInterface;
     readonly status: WorkflowStatus;
     readonly results: readonly TaskResult[];
+    /** Whether the returned final state is stored; omitted when no store was supplied. */
+    readonly durable?: boolean;
+    /** The first required persistence failure; omitted when none occurred. */
+    readonly fault?: WorkflowFault;
 }
 
 /**
@@ -3392,21 +3799,21 @@ export declare interface WorkflowResult {
  * - **Composes, never re-implements.** Per-phase bounded concurrency is one
  *   {@link createRunner} per phase (the substrate {@link RunnerInterface} over the workers
  *   `Queue`); `bail` maps onto that Runner's fail-fast vs settle-all; the run-level abort /
- *   timeout / budget / entity `signal` fold through {@link createAbort} / {@link createTimeout} +
- *   `AbortSignal.any` (exactly as the agent runtime folds its bounds); pacing is the shipped
+ *   timeout / budget / entity `signal` fold through the `@orkestrel/abort` signal contract,
+ *   {@link createTimeout}, and `AbortSignal.any` (exactly as the agent runtime folds its bounds);
+ *   pacing is the shipped
  *   {@link SchedulerInterface}. The runner writes ZERO concurrency / retry / abort logic of
  *   its own — it only sequences phases, dispatches a task's own handler, and drives the live
- *   entity.
- * - **Pure engine — no registries, no tool/agent knowledge.** The runner carries no
- *   `functions` / `tools` / `agents` registry: each live {@link TaskInterface} already
+ *   entity. The workflow layer owns per-task deadlines because timeout settlement must
+ *   update the live leaf under the phase's `bail` policy before the substrate unit settles.
+ * - **Pure engine — no integration registry.** The runner carries no behavior or provider
+ *   registry: each live {@link TaskInterface} already
  *   resolved its own {@link import('./types.js').WorkflowFunction} into
  *   {@link import('./types.js').TaskInterface.handler} ONCE at construction (build, restore,
  *   or a live mint all resolve it identically, from {@link WorkflowOptions.functions}), so
- *   dispatch is simply "invoke the task's own handler". Static tool / agent calling is an
- *   OPT-IN concern of the `@orkestrel/tool` package's adapter factories — plain
- *   {@link import('./types.js').WorkflowFunction}s a caller wires into
- *   {@link WorkflowOptions.functions} like any other behavior. This module never imports
- *   any tool/agent package.
+ *   dispatch is simply "invoke the task's own handler". Provider, protocol, and tool
+ *   integrations remain application-owned {@link import('./types.js').WorkflowFunction}s
+ *   composed into {@link WorkflowOptions.functions}. This module imports none of them.
  * - **Two `execute` forms, one engine.** `execute(definition, options)` BUILDS the live tree
  *   from a {@link WorkflowDefinition} (single source of truth for the `run` / `concurrency`
  *   metadata); `execute(workflow, options)` DRIVES a caller-owned, ALREADY-BUILT
@@ -3426,10 +3833,9 @@ export declare interface WorkflowResult {
  *   for `spawn` to accept (the runner already drained) is swept `skip`ped afterward so the
  *   phase always reaches a coherent terminal state.
  * - **Dispatch by handler.** `#runTask` invokes the live task's own
- *   {@link import('./types.js').TaskInterface.handler} directly: `undefined` (an omitted `run`,
- *   or a `run` name absent from the {@link WorkflowOptions.functions} registry it was resolved
- *   against) AUTO-COMPLETES — the ROADMAP no-handler rule; otherwise the handler runs with the
- *   task's {@link import('./types.js').TaskControllerInterface} handle.
+ *   {@link import('./types.js').TaskInterface.handler} directly. An omitted `run` deliberately
+ *   auto-completes with JSON `null`; a present unresolved name is rejected by the synchronous
+ *   execution claim and never false-completes.
  * - **`bail` → substrate.** Under `bail: true` (halt) a genuine task failure `fail`s the leaf
  *   THEN re-throws, so the substrate Runner fail-fasts — it aborts the in-flight siblings
  *   (their `controller.signal` fires; a mid-flight sibling `skip`s) and rejects the phase run;
@@ -3437,11 +3843,12 @@ export declare interface WorkflowResult {
  *   Under `bail: false` (graceful) a failure `fail`s the leaf and RESOLVES (never throws), so
  *   the Runner settles every unit (allSettled) and the run finishes (the workflow derives
  *   `completed`, the failure recorded in the result tree).
- * - **Pause / stop / destroy gates.** `workflow.pause()` is honoured at exactly two points —
- *   the next phase boundary (workflow-only) and each task's own pre-dispatch (before
- *   `task.start()`, workflow gate FIRST then this task's own `phase.pause()`) — by parking on
- *   {@link WorkflowInterface.wait} / {@link PhaseInterface.wait}; an in-flight task body is
- *   NEVER suspended mid-flight. A GRACEFUL `workflow.stop()` (no signal involved) is caught at
+ * - **Pause / stop / destroy gates.** Workflow, phase, and task gates are checked before
+ *   dispatch, and a running handler can checkpoint their folded state through
+ *   {@link import('./types.js').TaskControllerInterface.wait}. Because the substrate acquires
+ *   concurrency before this handler gate, a paused task occupies one phase slot until resume;
+ *   already-running siblings continue and its per-attempt timeout keeps counting. A GRACEFUL
+ *   `workflow.stop()` (no signal involved) is caught at
  *   those same gates: not-yet-started work is `skip`ped, in-flight work finishes naturally. A
  *   HARD `workflow.destroy()` aborts {@link WorkflowInterface.signal}, which `#fold` has folded
  *   into the run's composed signal — so it cancels the active phase Runner (and every
@@ -3458,8 +3865,8 @@ export declare interface WorkflowResult {
  *   {@link TaskController} signal `AbortSignal.any`-combines the substrate per-unit signal with
  *   `runSignal`, so a handler observes either cause directly.
  * - **Re-entrant-safe.** No shared per-run mutable field: the active-Runner holder is LOCAL to
- *   each `#execute`, so a nested `execute` (a bound workflow-tool handler re-entering this
- *   instance while the outer run is suspended awaiting it) cannot clobber the outer run's state.
+ *   each `#execute`, so a nested application-level `execute` cannot clobber the outer run's
+ *   state.
  */
 export declare class WorkflowRunner implements WorkflowRunnerInterface {
     #private;
@@ -3482,6 +3889,8 @@ export declare class WorkflowRunner implements WorkflowRunnerInterface {
      * {@link WorkflowRunOptions} abort / timeout / budget fires every in-flight task's signal
      * and `stop`s the run. `execute` resolves (never rejects) on a cancel — the partial outcome
      * is read from the returned {@link WorkflowResult} (its `workflow` / `status` / `results`).
+     * An unexpected scheduler or engine-infrastructure failure rejects after remaining work is
+     * stopped, swept, and final persistence is attempted.
      *
      * @param definition - The {@link WorkflowDefinition} to build the live tree from and drive
      * @param options - The construction options ({@link WorkflowOptions}: `on` / `bail` /
@@ -3501,10 +3910,11 @@ export declare class WorkflowRunner implements WorkflowRunnerInterface {
      * @remarks
      * `createWorkflow` mints the live tree, this overload drives it, and the caller controls
      * the SAME entity mid-run via its own `pause` / `resume` / `add` / `stop` / `destroy`
-     * (AGENTS §10). Requires `workflow.status === 'pending'` and `!workflow.destroyed` —
-     * otherwise this is a programmer-timing error and it THROWS a `TRANSITION`
-     * {@link WorkflowError} (AGENTS §12) rather than silently no-opping or building a second
-     * tree. Once accepted, observable semantics are byte-identical to the `definition` form —
+     * (AGENTS §10). Requires `workflow.status === 'pending'`, `!workflow.destroyed`, and no
+     * prior execution claim. A process-local object-identity claim shared by all runner instances
+     * is acquired synchronously and never released, so a same-object second call throws a `TRANSITION`
+     * {@link WorkflowError} before any asynchronous status change. Once accepted, observable
+     * semantics are byte-identical to the `definition` form —
      * except the phase loop RE-READS the live tree every iteration, so a caller's live `add`
      * mid-run is picked up and actually dispatched. `options` carries only the per-run bounds
      * (`signal` / `timeout` / `budget`) — the construction half of {@link WorkflowRunOptions}
@@ -3542,8 +3952,8 @@ export declare class WorkflowRunner implements WorkflowRunnerInterface {
  * {@link WorkflowOptions.functions}) and each phase's `concurrency` (so there is no
  * separately-supplied workflow to drift from the definition). The freshly-built live tree is
  * returned in {@link WorkflowResult.workflow}. The runner carries NO registry of its own — it
- * simply invokes each task's OWN {@link TaskInterface.handler}; a task with no handler
- * AUTO-COMPLETES. The runner DRIVES the live entity (`start` → `complete` / `fail`), never
+ * simply invokes each task's OWN {@link TaskInterface.handler}; an omitted `run` is the only
+ * auto-completing no-op. The runner DRIVES the live entity (`start` → `complete` / `fail`), never
  * re-implementing status. The `bail` policy maps onto the substrate's fail-fast (`bail: true`
  * — the first failure aborts in-flight siblings and skips the rest) vs settle-all (`bail:
  * false` — failures are recorded and the run finishes). The {@link WorkflowOptions} half of
@@ -3581,9 +3991,9 @@ export declare interface WorkflowRunnerInterface {
      * **Programmer-error exception (AGENTS §12).** A PATHOLOGICAL `definition` (e.g. a
      * duplicate phase or task `id`) THROWS SYNCHRONOUSLY at construction — before any phase
      * runs, and before the returned `Promise` is even created — rather than resolving a
-     * failed/partial {@link WorkflowResult}. This is the one exception to the "resolves,
-     * never rejects" contract above: a malformed definition is a programmer-timing error, not
-     * a runtime outcome to report through the result tree.
+     * failed/partial {@link WorkflowResult}. Unexpected scheduler or engine-infrastructure
+     * failures may reject asynchronously after remaining work is stopped, swept, and final
+     * persistence is attempted. Neither case is a domain task outcome to disguise as a result.
      *
      * @param definition - The {@link WorkflowDefinition} to build the live tree from and drive
      * @param options - The construction options ({@link WorkflowOptions}: `on` / `bail` /
@@ -3599,10 +4009,11 @@ export declare interface WorkflowRunnerInterface {
      * The entity itself is now the single control surface (no separate run handle):
      * `createWorkflow` mints the live tree, this overload drives it, and the caller
      * controls the SAME entity mid-run via its own `pause` / `resume` / `add` / `stop` /
-     * `destroy` (AGENTS §10). Requires `workflow.status === 'pending'` and
-     * `!workflow.destroyed` — otherwise this is a programmer-timing error and it THROWS a
-     * `TRANSITION` {@link import('./errors.js').WorkflowError} (AGENTS §12) rather than
-     * silently no-opping or building a second tree. Once accepted, phases run
+     * `destroy` (AGENTS §10). Requires `workflow.status === 'pending'`,
+     * `!workflow.destroyed`, and no prior execution claim. A process-local object-identity claim
+     * shared by every runner instance is acquired synchronously and never released, so a same-object
+     * call throws a `TRANSITION` {@link import('./errors.js').WorkflowError} even before an
+     * asynchronous status change. Once accepted, phases run
      * SEQUENTIALLY and, within each phase, tasks CONCURRENTLY — byte-identical observable
      * semantics to the `definition`-form `execute` — except the phase loop RE-READS the
      * live `workflow.phases` / each phase's live `tasks` every iteration (a cursor over
@@ -3619,12 +4030,10 @@ export declare interface WorkflowRunnerInterface {
      * {@link import('./factories.js').restoreWorkflow} behaves according to whether a
      * {@link WorkflowFunctions} registry was supplied at that build: WITH a registry,
      * each task's `run` name is re-resolved against it, so a matched task carries a real
-     * handler and this overload actually DISPATCHES it, resuming real work. WITHOUT a
-     * registry (or when a task's `run` name has no match in it), the task's
-     * {@link TaskInterface.run} is `undefined` — the no-handler rule then AUTO-COMPLETES
-     * that task (no dispatch occurs). A PARTIALLY-run restored tree (any live phase/task
-     * not `pending`) is rejected outright by the `workflow.status === 'pending'` guard
-     * above — only a wholly `pending` restored tree is drivable.
+     * handler and this overload actually DISPATCHES it, resuming real work. Without a registry,
+     * the persisted {@link TaskInterface.run} remains visible for inspection while `handler` is
+     * `undefined`, and this overload rejects the tree before dispatch. A quiescent recovered tree may contain
+     * terminal work plus pending work; a tree with any `running` leaf is not drivable.
      *
      * @param workflow - The live {@link WorkflowInterface} to drive (its own entity surface —
      *   `pause` / `resume` / `add` / `stop` / `destroy` — is the caller's control seam)
@@ -3642,9 +4051,7 @@ export declare interface WorkflowRunnerInterface {
  * @remarks
  * The runner is a PURE engine — it carries no `functions` / `tools` / `agents` registry
  * (each live task already resolved its own handler at construction from
- * {@link WorkflowOptions.functions}); wiring a `function`-form task to a tool or an agent is
- * an OPT-IN concern of the `@orkestrel/tool` package's adapter factories, which a caller
- * composes into its OWN `functions` registry.
+ * {@link WorkflowOptions.functions}).
  * - `scheduler` — the {@link SchedulerInterface} that paces the tree (a cooperative
  *   `yield` between phases). Omitted ⇒ the shipped cross-environment default
  *   ({@link createScheduler}).
@@ -3679,23 +4086,19 @@ export declare interface WorkflowRunnerOptions {
  * {@link TaskControllerInterface.signal} fires) and HALTS the run — the remaining tasks
  * and phases are `skip`ped and the workflow settles `stopped`.
  * - `signal` — an external cancellation (a caller `AbortController`).
- * - `timeout` — a whole-run deadline in milliseconds. A non-positive value (`0` or negative)
- *   ⇒ NO deadline (the runner arms an `@orkestrel/timeout` `TimeoutInterface`
- *   only when `timeout > 0`).
+ * - `timeout` — a whole-run deadline in milliseconds. A non-positive, non-finite, or
+ *   over-`MAX_TIMER_MS` value means no deadline.
  * - `budget` — a whole-run cost ceiling (a {@link BudgetInterface} over {@link TokenUsage}
  *   — its `signal` fires when a task-reported usage crosses `max`); the runner folds its
  *   `signal` and `start`s it. (A `max: 0` budget is exhausted from its first `start`, so it
  *   cancels the run at entry — a DIFFERENT primitive from the `timeout: 0` "no deadline" case.)
  *
- * The engine itself carries NO nesting bookkeeping — the depth / cycle guard for a nested
- * `agent` → workflow-tool → workflow chain lives entirely in the OPT-IN adapter factories
- * shipped by `@orkestrel/tool`, closed over their own `depth` / `ancestry`, never threaded
- * through `execute`'s options.
  */
 export declare type WorkflowRunOptions = WorkflowOptions & {
     readonly signal?: AbortSignal;
     readonly timeout?: number;
     readonly budget?: BudgetInterface<TokenUsage>;
+    readonly store?: WorkflowStoreInterface;
 };
 
 /**
@@ -3738,17 +4141,18 @@ export declare const workflowShape: ObjectShape<{
  * it is self-contained, it carries the policy it ran under: `bail` (AGENTS §4.4) is the
  * failure policy, so {@link import('./factories.js').restoreWorkflow} re-derives status
  * IDENTICALLY without a silent default. `status` is the EFFECTIVE status (override-or-derived)
- * at snapshot time; `override` is the forced status of a whole-workflow `skip` / `stop`,
- * PRESENT only when one is in force (so a restore reinstates it DIRECTLY rather than guessing
- * from a status divergence). `phases` are the workflow's {@link PhaseSnapshot}s in order;
- * `created` / `updated` are ms since epoch.
+ * at snapshot time; `override` is the forced status of a whole-workflow `skip` / `stop` or
+ * vacuous `completed`. The completed override is valid only for an otherwise-derived pending
+ * tree containing no tasks. An override is PRESENT only when one is in force (so a restore
+ * reinstates it DIRECTLY rather than guessing from a status divergence). `phases` are the
+ * workflow's {@link PhaseSnapshot}s in order; `created` / `updated` are ms since epoch.
  */
 export declare interface WorkflowSnapshot {
     readonly id: string;
     readonly name: string;
     readonly description?: string;
     readonly status: WorkflowStatus;
-    /** The forced status of a whole-workflow `skip` / `stop`; present only when an override is in force. */
+    /** Whole-workflow `skip` / `stop` or valid task-free vacuous `completed`; omitted when derived. */
     readonly override?: WorkflowStatus;
     /** The failure policy the workflow ran under (AGENTS §4.4) — persisted so a restore re-derives identically. */
     readonly bail: boolean;
@@ -3757,6 +4161,9 @@ export declare interface WorkflowSnapshot {
     readonly updated: number;
 }
 
+/** Locate the nearest identifiable node for an inconsistent owned snapshot. */
+export declare function workflowSnapshotContext(value: unknown): Readonly<Record<string, unknown>> | undefined;
+
 /**
  * One row of the table a {@link import('./stores/DatabaseWorkflowStore.js').DatabaseWorkflowStore}
  * persists — a workflow `id` plus its {@link WorkflowSnapshot} held as ONE OPAQUE JSON column.
@@ -3792,8 +4199,8 @@ export declare type WorkflowStatus = LifecycleStatus;
 /**
  * The durable persistence seam for a {@link WorkflowSnapshot} — three async primitives
  * (`get` / `set` / `delete`) keyed by a workflow id, the snapshot analogue of
- * the server package's `SessionStoreInterface` (and the
- * {@link QueueStoreInterface} driver-swap pattern).
+ * the server package's `SessionStoreInterface` (and the `@orkestrel/queue`
+ * `QueueStoreInterface` driver-swap pattern).
  *
  * @remarks
  * The store persists the W-a {@link WorkflowSnapshot} — the COMPLETE, self-contained,
@@ -3806,7 +4213,7 @@ export declare type WorkflowStatus = LifecycleStatus;
  *
  * Every primitive is async (a `Promise`), so a durable backend (a database round-trip) fits the
  * same shape as the memory one. The snapshot carries its OWN id, so `set` takes no separate id
- * param (mirroring {@link QueueStoreInterface.save} / the server package's
+ * param (mirroring `QueueStoreInterface.save` from `@orkestrel/queue` / the server package's
  * `SessionStoreInterface.set`, which key off the value's own
  * `id`). UNLIKE a session store there is NO idle-TTL / eviction — a persisted workflow run-state
  * lives until an explicit `delete`, never silently expiring (it is durable orchestration state,
@@ -3816,6 +4223,8 @@ export declare type WorkflowStatus = LifecycleStatus;
 export declare interface WorkflowStoreInterface {
     /**
      * Resolve the persisted snapshot for `id`, or `undefined` if none is stored.
+     * A present payload whose own `id` differs from the requested storage key is corrupt and
+     * rejects with a normalized `RESTORE` error carrying both ids.
      *
      * @param id - The workflow id to resolve (a {@link WorkflowSnapshot.id})
      * @returns The persisted snapshot, or `undefined` if absent
@@ -3823,7 +4232,7 @@ export declare interface WorkflowStoreInterface {
     get(id: string): Promise<WorkflowSnapshot | undefined>;
     /**
      * Insert or replace a snapshot under its own `snapshot.id` (no separate id param —
-     * mirroring {@link QueueStoreInterface.save}).
+     * mirroring `QueueStoreInterface.save` from `@orkestrel/queue`).
      *
      * @param snapshot - The snapshot to store (keyed by its `id`)
      */