@orkestrel/workflow 0.0.7 → 0.0.9

package/dist/src/core/index.js

@@ -1,83 +1,9 @@
-import { arrayShape, compileGuard, createContract, integerShape, isArray, isBoolean, isNumber, isRecord, isString, literalShape, objectShape, optionalShape, rawShape, stringShape } from "@orkestrel/contract";
+import { createAbort, linkSignal } from "@orkestrel/abort";
+import { arrayShape, attempt, cloneJSONRecord, cloneJSONValue, compileGuard, createContract, integerShape, isArray, isBoolean, isContractError, isFiniteNumber, isFunction, isInteger, isJSONValue, isNonEmptyString, isRecord, literalShape, objectShape, optionalShape, rawShape, stringShape } from "@orkestrel/contract";
 import { createDatabase, createMemoryDriver } from "@orkestrel/database";
-import { createAbort } from "@orkestrel/abort";
 import { Emitter } from "@orkestrel/emitter";
 import { createTimeout } from "@orkestrel/timeout";
 import { createQueue } from "@orkestrel/queue";
-//#region src/core/Scheduler.ts
-/**
-* The safe cross-environment cooperative-yield default — a {@link SchedulerInterface}
-* built on `setTimeout` / `clearTimeout` alone, so it runs unchanged in both the
-* browser and Node.
-*
-* @remarks
-* - **Cross-environment.** Uses ONLY `setTimeout` / `clearTimeout` — universally
-*   available. It deliberately avoids env-specific fast paths (`setImmediate`,
-*   `scheduler.yield`, `requestAnimationFrame`, `node:timers/promises`,
-*   `MessageChannel`); those belong to the environment backends, built with the
-*   agent loop that consumes them.
-* - **`yield` is a macrotask host-turn, not a microtask.** `yield()` waits on a
-*   `setTimeout(0)`, NOT `queueMicrotask`. A microtask drains before the host
-*   regains control, so it would not actually let pending I/O, timers, or
-*   rendering run — it only defers within the current task. A zero-delay timer is
-*   the correct cross-environment "give the host a turn".
-* - **Abort-aware.** A pending `yield` / `delay` rejects with `signal.reason` when
-*   the signal aborts (the standard `AbortSignal` convention). An already-aborted
-*   signal rejects immediately without arming a timer. Either settle path clears
-*   the timer and removes the abort listener — no leaked timer, no leaked
-*   listener, and no double-settle.
-* - **Priority is accepted but uniform.** `options.priority` is part of the
-*   contract, but a `setTimeout`-based default cannot act on urgency, so it treats
-*   every priority the same. Environment backends honour it.
-* - **Event-free.** A pure functional primitive — no Emitter, no events.
-*
-* @example
-* ```ts
-* const scheduler = new Scheduler()
-* while (!signal.aborted) {
-* 	doSomeWork()
-* 	await scheduler.yield({ signal }) // let the host run between work units
-* }
-* ```
-*/
-var Scheduler = class {
-	/**
-	* Yield control back to the host so other tasks (I/O, timers, rendering) can
-	* run, then resume — a macrotask turn via `setTimeout(0)` (NOT a microtask,
-	* which would resume before the host regains control).
-	*/
-	yield(options) {
-		return this.#sleep(0, options?.signal);
-	}
-	/**
-	* Resume after at least `ms` milliseconds; abort rejects with `signal.reason`.
-	*
-	* @remarks
-	* `ms` should be a non-negative finite number. The primitive stays minimal and
-	* does no validation: it passes `ms` straight to the host `setTimeout`, which
-	* clamps a negative value or `NaN` to ~0 — so an out-of-domain `ms` resolves on
-	* the next host turn rather than throwing.
-	*/
-	delay(ms, options) {
-		return this.#sleep(ms, options?.signal);
-	}
-	#sleep(ms, signal) {
-		if (signal?.aborted === true) return Promise.reject(signal.reason);
-		return new Promise((resolve, reject) => {
-			const handle = setTimeout(() => {
-				signal?.removeEventListener("abort", onAbort);
-				resolve();
-			}, ms);
-			const onAbort = this.#abort.bind(this, handle, reject, signal);
-			signal?.addEventListener("abort", onAbort, { once: true });
-		});
-	}
-	#abort(handle, reject, signal) {
-		clearTimeout(handle);
-		reject(signal?.reason);
-	}
-};
-//#endregion
 //#region src/core/constants.ts
 /** The default {@link import('./types.js').WorkflowDefinition.bail} — graceful (continue on a leaf failure). */
 var DEFAULT_BAIL = false;
@@ -178,52 +104,47 @@ var TASK_TRANSITIONS = Object.freeze({
 * phase may still DECLARE a larger explicit `concurrency` and pays that allocation knowingly.
 */
 var DEFAULT_PHASE_CONCURRENCY = 1024;
+/**
+* The largest delay representable by the host timer APIs without overflow or clamping.
+*/
+var MAX_TIMER_MS = 2147483647;
 //#endregion
-//#region src/core/errors.ts
+//#region src/core/helpers.ts
 /**
-* An error thrown by the workflow entity + W-c2 recursion layer.
+* Capture every top-level {@link WorkflowOptions} value exactly once into an owned plain bag.
 *
 * @remarks
-* Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
-* offending node id / status. Thrown for an illegal lifecycle transition
-* (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
-* passed to {@link import('./factories.js').restoreWorkflow} (`RESTORE`), an over-deep /
-* cyclic nested-workflow dispatch (`DEPTH`), and a malformed workflow-authoring-tool args
-* blob (`TOOL`). `DEPTH` and `TOOL` are public type surface constructed by the
-* `@orkestrel/tool` package's workflow-tool / agent-function adapters; on that seam the
-* throw is ISOLATED by its `ToolManager` into the tool result's top-level `error`
-* (AGENTS §14 — the universal tool-handler contract).
-*/
-var WorkflowError = class extends Error {
-	code;
-	context;
-	constructor(code, message, context) {
-		super(message);
-		this.name = "WorkflowError";
-		this.code = code;
-		if (context !== void 0) this.context = context;
-	}
-};
-/**
-* Narrow an unknown caught value to a {@link WorkflowError}.
+* Direct property reads preserve inherited and non-enumerable option values while preventing
+* accessor-backed caller bags from shifting policy, handlers, hooks, or nested options between
+* construction stages. Nested bags and the functions registry retain their original identities so
+* entity constructors can snapshot keyed child options and live additions can resolve against the
+* same registry.
 *
-* @param value - The value to test (typically a `catch` binding)
-* @returns `true` when `value` is a {@link WorkflowError}
+* @param options - The caller-owned workflow construction options
+* @returns An owned top-level options bag containing the captured values
 *
 * @example
 * ```ts
-* try {
-* 	task.complete('done')
-* } catch (error) {
-* 	if (isWorkflowError(error) && error.code === 'TRANSITION') retry()
-* }
+* const captured = captureWorkflowOptions(options)
+* const workflow = createWorkflow(definition, captured)
 * ```
 */
-function isWorkflowError(value) {
-	return value instanceof WorkflowError;
+function captureWorkflowOptions(options) {
+	const on = options?.on;
+	const bail = options?.bail;
+	const error = options?.error;
+	const phases = options?.phases;
+	const functions = options?.functions;
+	const silence = options?.silence;
+	return Object.freeze({
+		...on === void 0 ? {} : { on },
+		...bail === void 0 ? {} : { bail },
+		...error === void 0 ? {} : { error },
+		...phases === void 0 ? {} : { phases },
+		...functions === void 0 ? {} : { functions },
+		...silence === void 0 ? {} : { silence }
+	});
 }
-//#endregion
-//#region src/core/helpers.ts
 /**
 * Test whether a {@link LifecycleStatus} is TERMINAL — a node in this state will not
 * transition further.
@@ -357,6 +278,17 @@ function canTransitionTask(from, to) {
 	return TASK_TRANSITIONS[from].includes(to);
 }
 /**
+* Resolve a task's runtime silence window against its workflow default.
+*
+* @param value - The task-level override; any present non-positive or non-finite value disables
+* @param fallback - The workflow-level default
+* @returns A host-safe effective window (`1..MAX_TIMER_MS`), or `undefined`
+*/
+function resolveTaskSilence(value, fallback) {
+	if (value !== void 0) return Number.isFinite(value) && value > 0 && value <= 2147483647 ? value : void 0;
+	return fallback !== void 0 && Number.isFinite(fallback) && fallback > 0 && fallback <= 2147483647 ? fallback : void 0;
+}
+/**
 * Box a value as a {@link Success} — the graceful outcome half of a {@link Result}.
 *
 * @typeParam T - The boxed value's type
@@ -393,6 +325,20 @@ function failure(error) {
 	};
 }
 /**
+* Normalize an unknown thrown value to a non-empty persistence-safe message.
+*
+* @param error - The caught value
+* @returns A non-empty message without stack or cause data
+*/
+function errorToMessage(error) {
+	try {
+		const message = error instanceof Error ? error.message : String(error);
+		return typeof message === "string" && message.length > 0 ? message : "unknown failure";
+	} catch {
+		return "unknown failure";
+	}
+}
+/**
 * Find the first {@link TaskResult} in a positional list whose boxed outcome is a
 * `Failure` — the pure scan shared by a phase's and a workflow's derived-`failed`
 * `fail`-event lookup.
@@ -429,11 +375,11 @@ function findFailure(results) {
 * @returns The {@link WorkflowContext}
 */
 function buildWorkflowContext(node) {
-	return {
+	return Object.freeze({
 		id: node.id,
 		name: node.name,
 		...node.description === void 0 ? {} : { description: node.description }
-	};
+	});
 }
 /**
 * Build a {@link PhaseContext} — a phase's own identity plus a back-reference to its
@@ -444,10 +390,10 @@ function buildWorkflowContext(node) {
 * @returns The {@link PhaseContext}
 */
 function buildPhaseContext(workflow, node) {
-	return {
+	return Object.freeze({
 		...buildWorkflowContext(node),
-		workflow
-	};
+		workflow: buildWorkflowContext(workflow)
+	});
 }
 /**
 * Build a {@link TaskContext} — a task's own identity plus a back-reference to its phase
@@ -459,31 +405,10 @@ function buildPhaseContext(workflow, node) {
 * @returns The {@link TaskContext}
 */
 function buildTaskContext(phase, node) {
-	return {
+	return Object.freeze({
 		...buildWorkflowContext(node),
-		phase
-	};
-}
-/**
-* Narrow an `unknown` to a {@link WorkflowSnapshot} — the AGENTS §14 boundary guard for an
-* UNTRUSTED snapshot read (a storage row a {@link import('./stores/DatabaseWorkflowStore.js').DatabaseWorkflowStore}
-* reads back from its opaque JSON column, a snapshot loaded from disk).
-*
-* @remarks
-* A total guard (it NEVER throws — adversarial input returns `false`, AGENTS §14). It checks the
-* snapshot's SHAPE — `id` / `name` / `status` strings, a `boolean` `bail`, an array of `phases`,
-* `created` / `updated` numbers — enough to safely impose the {@link WorkflowSnapshot} type at a
-* storage boundary WITHOUT a cast. It is complementary to
-* {@link import('./factories.js').assertSnapshot}, which validates the DEEPER invariant (every
-* node's status / override drawn from the lifecycle vocabulary) and THROWS a `RESTORE`
-* {@link import('./errors.js').WorkflowError} — the deep gate a {@link import('./factories.js').restoreWorkflow}
-* applies. A boundary read narrows shape with this guard; a restore validates vocabulary with `assertSnapshot`.
-*
-* @param value - The value to test (an opaque storage read)
-* @returns `true` when `value` has the structural shape of a {@link WorkflowSnapshot}
-*/
-function isWorkflowSnapshot(value) {
-	return isRecord(value) && isString(value.id) && isString(value.name) && isString(value.status) && isBoolean(value.bail) && isArray(value.phases) && isNumber(value.created) && isNumber(value.updated);
+		phase: buildPhaseContext(phase.workflow, phase)
+	});
 }
 /**
 * Convert a {@link WorkflowDefinition} into an INITIAL {@link WorkflowSnapshot} — every
@@ -573,12 +498,91 @@ function taskDefinitionToSnapshot(task) {
 		...task.description === void 0 ? {} : { description: task.description },
 		status: "pending",
 		metadata: {},
+		attempts: 0,
 		...task.run === void 0 ? {} : { run: task.run },
 		...task.retries === void 0 ? {} : { retries: task.retries },
 		...task.timeout === void 0 ? {} : { timeout: task.timeout }
 	};
 }
 /**
+* Convert interrupted running work into a recoverable pending suffix or an
+* exhausted recovery failure without replenishing attempts.
+*
+* @param snapshot - A fully validated owned snapshot with no terminal overrides
+* @returns The recovery projection
+*/
+function recoverWorkflowSnapshot(snapshot) {
+	const phases = [];
+	let halted = false;
+	const now = Math.max(Date.now(), snapshot.updated);
+	const workflow = buildWorkflowContext(snapshot);
+	for (const phase of snapshot.phases) {
+		const exhausted = /* @__PURE__ */ new Set();
+		for (const task of phase.tasks) {
+			const budget = (task.retries ?? 0) + 1;
+			if (task.status === "running" && task.attempts >= budget) exhausted.add(task.id);
+		}
+		const strict = phase.bail && (exhausted.size > 0 || phase.tasks.some((task) => task.status === "failed"));
+		const tasks = [];
+		for (const task of phase.tasks) {
+			const eligible = task.status === "pending" || task.status === "running";
+			if ((halted || strict) && eligible && !exhausted.has(task.id)) {
+				tasks.push({
+					...task,
+					status: "skipped"
+				});
+				continue;
+			}
+			if (!exhausted.has(task.id)) {
+				if (task.status === "running") {
+					const { activity: _activity, ...pending } = task;
+					tasks.push({
+						...pending,
+						status: "pending"
+					});
+				} else tasks.push(task);
+				continue;
+			}
+			const phaseContext = buildPhaseContext(workflow, phase);
+			const result = {
+				task: buildTaskContext(phaseContext, task),
+				phase: phaseContext,
+				workflow,
+				status: "failed",
+				result: {
+					success: false,
+					error: {
+						origin: "recovery",
+						message: `task '${task.id}' exhausted its retry budget during recovery`
+					}
+				},
+				timestamp: now
+			};
+			tasks.push({
+				...task,
+				status: "failed",
+				result
+			});
+		}
+		const status = derivePhaseStatus(tasks.map((task) => task.status));
+		phases.push({
+			...phase,
+			status,
+			tasks
+		});
+		if (strict) halted = true;
+	}
+	return {
+		...snapshot,
+		status: deriveWorkflowStatus(phases.map((phase) => ({
+			status: phase.status,
+			bail: phase.bail
+		}))),
+		phases,
+		updated: now
+	};
+}
+/**
 * Flatten a nested list of per-phase {@link TaskResult} lists into one positional list
 * — the workflow tier of the result tree, built from each phase's `results()`.
 *
@@ -664,6 +668,61 @@ function createDeferred() {
 	return Promise.withResolvers();
 }
 /**
+* Schedule one cancellable host operation behind an owned settlement signal.
+*
+* @remarks
+* The completion and failure paths each own an {@link AbortController}; their native composite is
+* linked to the optional caller signal before `start` can arm host work. Scheduler backends attach
+* only to that safe composite, so caller mutation of `addEventListener` or `removeEventListener`
+* cannot strand the operation. The first completion resolves, the first host failure rejects with
+* its exact value, and caller abort rejects with its exact linked reason. Caller abort and host
+* failure cancel an armed handle; synchronous settlement also cancels the handle immediately after
+* `start` returns it. Cancellation is secondary cleanup: if its closure throws, the already-winning
+* completion, exact host failure, or exact caller reason still settles without escape or replacement.
+*
+* @param start - Arm host work and return its cancellation closure
+* @param signal - Optional caller cancellation signal
+* @returns A promise settled exactly once by completion, host failure, or caller abort
+*/
+function scheduleHost(start, signal) {
+	const completion = new AbortController();
+	const failed = new AbortController();
+	let settled;
+	try {
+		settled = linkSignal(AbortSignal.any([completion.signal, failed.signal]), signal);
+	} catch (error) {
+		return Promise.reject(error);
+	}
+	if (settled.aborted) return Promise.reject(settled.reason);
+	return new Promise((resolve, reject) => {
+		let cancel;
+		let hostFailure;
+		settled.addEventListener("abort", () => {
+			if (completion.signal.aborted) {
+				resolve();
+				return;
+			}
+			const reason = failed.signal.aborted ? hostFailure : settled.reason;
+			try {
+				cancel?.();
+			} catch {}
+			reject(reason);
+		}, { once: true });
+		try {
+			cancel = start(() => completion.abort(), (error) => {
+				hostFailure = error;
+				failed.abort();
+			});
+		} catch (error) {
+			hostFailure = error;
+			failed.abort();
+		}
+		if (settled.aborted) try {
+			cancel?.();
+		} catch {}
+	});
+}
+/**
 * Park until `signal` aborts — a promise-parked wait (AGENTS §21), never a timer or
 * busy-loop, that NEVER rejects.
 *
@@ -691,6 +750,424 @@ function parkSignal(signal) {
 	});
 }
 //#endregion
+//#region src/core/Scheduler.ts
+/**
+* The safe cross-environment cooperative-yield default — a {@link SchedulerInterface}
+* built on `setTimeout` / `clearTimeout` alone, so it runs unchanged in both the
+* browser and Node.
+*
+* @remarks
+* - **Cross-environment.** Uses ONLY `setTimeout` / `clearTimeout` — universally
+*   available. It deliberately avoids env-specific fast paths (`setImmediate`,
+*   `scheduler.yield`, `requestAnimationFrame`, `node:timers/promises`,
+*   `MessageChannel`); those belong to the environment backends, built with the
+*   agent loop that consumes them.
+* - **`yield` is a macrotask host-turn, not a microtask.** `yield()` waits on a
+*   `setTimeout(0)`, NOT `queueMicrotask`. A microtask drains before the host
+*   regains control, so it would not actually let pending I/O, timers, or
+*   rendering run — it only defers within the current task. A zero-delay timer is
+*   the correct cross-environment "give the host a turn".
+* - **Abort-aware.** A pending `yield` / `delay` rejects with `signal.reason` exactly.
+*   {@link scheduleHost} links an owned settlement composite to the caller before arming
+*   the timer, so pre-abort schedules nothing, caller signal method mutation is harmless,
+*   cancellation clears the handle, and native first-settlement wins exactly once.
+* - **Priority is accepted but uniform.** `options.priority` is part of the
+*   contract, but a `setTimeout`-based default cannot act on urgency, so it treats
+*   every priority the same. Environment backends honour it.
+* - **Event-free.** A pure functional primitive — no Emitter, no events.
+*
+* @example
+* ```ts
+* const scheduler = new Scheduler()
+* while (!signal.aborted) {
+* 	doSomeWork()
+* 	await scheduler.yield({ signal }) // let the host run between work units
+* }
+* ```
+*/
+var Scheduler = class {
+	/**
+	* Yield control back to the host so other tasks (I/O, timers, rendering) can
+	* run, then resume — a macrotask turn via `setTimeout(0)` (NOT a microtask,
+	* which would resume before the host regains control).
+	*/
+	yield(options) {
+		return this.#sleep(0, options?.signal);
+	}
+	/**
+	* Resume after at least `ms` milliseconds; abort rejects with `signal.reason`.
+	*
+	* @remarks
+	* `ms` should be a non-negative finite number. The primitive stays minimal and
+	* does no validation: it passes `ms` straight to the host `setTimeout`, which
+	* clamps a negative value or `NaN` to ~0 — so an out-of-domain `ms` resolves on
+	* the next host turn rather than throwing.
+	*/
+	delay(ms, options) {
+		return this.#sleep(ms, options?.signal);
+	}
+	#sleep(ms, signal) {
+		return scheduleHost((complete) => {
+			const handle = setTimeout(complete, ms);
+			return () => clearTimeout(handle);
+		}, signal);
+	}
+};
+//#endregion
+//#region src/core/errors.ts
+/**
+* An error raised by the workflow runtime.
+*
+* @remarks
+* Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
+* offending node id / status. Raised for an illegal lifecycle transition
+* (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
+* boundary (`RESTORE`), or a refused structural/activity edit (`MUTATION`).
+*/
+var WorkflowError = class extends Error {
+	code;
+	context;
+	constructor(code, message, context) {
+		super(message);
+		this.name = "WorkflowError";
+		this.code = code;
+		if (context !== void 0) this.context = context;
+	}
+};
+/**
+* Narrow an unknown caught value to a {@link WorkflowError}.
+*
+* @param value - The value to test (typically a `catch` binding)
+* @returns `true` when `value` is a {@link WorkflowError}
+*
+* @example
+* ```ts
+* try {
+* 	task.complete('done')
+* } catch (error) {
+* 	if (isWorkflowError(error) && error.code === 'TRANSITION') retry()
+* }
+* ```
+*/
+function isWorkflowError(value) {
+	try {
+		return value instanceof WorkflowError;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/core/validators.ts
+/** Test the workflow lifecycle vocabulary. */
+function isLifecycleStatus(value) {
+	return value === "pending" || value === "running" || value === "completed" || value === "failed" || value === "skipped" || value === "stopped";
+}
+/** Test a normalized persisted task failure. */
+function isTaskFailure(value) {
+	try {
+		return isRecord(value) && Object.keys(value).every((key) => key === "origin" || key === "message") && (value.origin === "handler" || value.origin === "timeout" || value.origin === "recovery") && isNonEmptyString(value.message);
+	} catch {
+		return false;
+	}
+}
+/** Compare two optional description values. */
+function matchesDescription(left, right) {
+	return left === right && (left === void 0 || typeof left === "string");
+}
+/** Test a result's lineage against its containing snapshot nodes. */
+function isTaskResult(value, workflow, phase, task) {
+	try {
+		if (!isRecord(value) || !isRecord(workflow) || !isRecord(phase) || !isRecord(task) || !Object.keys(value).every((key) => key === "task" || key === "phase" || key === "workflow" || key === "status" || key === "result" || key === "timestamp") || !isLifecycleStatus(value.status) || value.status !== task.status || !isFiniteNumber(value.timestamp) || value.timestamp < 0 || !isRecord(value.task) || !isRecord(value.phase) || !isRecord(value.workflow) || !Object.keys(value.workflow).every((key) => key === "id" || key === "name" || key === "description") || !Object.keys(value.phase).every((key) => key === "id" || key === "name" || key === "description" || key === "workflow") || !Object.keys(value.task).every((key) => key === "id" || key === "name" || key === "description" || key === "phase")) return false;
+		if (value.task.id !== task.id || value.task.name !== task.name || !matchesDescription(value.task.description, task.description) || value.phase.id !== phase.id || value.phase.name !== phase.name || !matchesDescription(value.phase.description, phase.description) || value.workflow.id !== workflow.id || value.workflow.name !== workflow.name || !matchesDescription(value.workflow.description, workflow.description)) return false;
+		if (!isRecord(value.task.phase) || !isRecord(value.task.phase.workflow) || !isRecord(value.phase.workflow) || !Object.keys(value.task.phase).every((key) => key === "id" || key === "name" || key === "description" || key === "workflow") || !Object.keys(value.task.phase.workflow).every((key) => key === "id" || key === "name" || key === "description") || !Object.keys(value.phase.workflow).every((key) => key === "id" || key === "name" || key === "description")) return false;
+		if (value.task.phase.id !== phase.id || value.task.phase.name !== phase.name || !matchesDescription(value.task.phase.description, phase.description) || value.phase.workflow.id !== workflow.id || value.phase.workflow.name !== workflow.name || !matchesDescription(value.phase.workflow.description, workflow.description) || value.task.phase.workflow.id !== workflow.id || value.task.phase.workflow.name !== workflow.name || !matchesDescription(value.task.phase.workflow.description, workflow.description)) return false;
+		if (value.status === "completed") return isRecord(value.result) && value.result.success === true && Object.keys(value.result).every((key) => key === "success" || key === "value") && isJSONValue(value.result.value);
+		if (value.status === "failed") return isRecord(value.result) && value.result.success === false && Object.keys(value.result).every((key) => key === "success" || key === "error") && isTaskFailure(value.result.error);
+		return false;
+	} catch {
+		return false;
+	}
+}
+/**
+* Validate a safe owned JSON graph as a coherent workflow snapshot.
+*
+* @remarks
+* Callers at hostile boundaries use {@link isWorkflowSnapshot}, which owns the
+* graph first so this semantic pass never observes accessors or prototypes.
+*/
+function isOwnedWorkflowSnapshot(value) {
+	try {
+		if (!isRecord(value) || !Object.keys(value).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "override" || key === "bail" || key === "phases" || key === "created" || key === "updated") || !isNonEmptyString(value.id) || !isNonEmptyString(value.name) || value.description !== void 0 && typeof value.description !== "string" || !isLifecycleStatus(value.status) || value.override !== void 0 && value.override !== "completed" && value.override !== "skipped" && value.override !== "stopped" || !isBoolean(value.bail) || !isArray(value.phases) || !isFiniteNumber(value.created) || value.created < 0 || !isFiniteNumber(value.updated) || value.updated < value.created) return false;
+		const phaseIds = /* @__PURE__ */ new Set();
+		const derivations = [];
+		let frontier = false;
+		let running = false;
+		let vacuous = true;
+		for (const phase of value.phases) {
+			if (!isRecord(phase) || !Object.keys(phase).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "override" || key === "bail" || key === "concurrency" || key === "tasks") || !isNonEmptyString(phase.id) || phaseIds.has(phase.id) || !isNonEmptyString(phase.name) || phase.description !== void 0 && typeof phase.description !== "string" || !isLifecycleStatus(phase.status) || phase.override !== void 0 && phase.override !== "skipped" && phase.override !== "stopped" || !isBoolean(phase.bail) || phase.concurrency !== void 0 && (!isInteger(phase.concurrency) || phase.concurrency < 1) || !isArray(phase.tasks)) return false;
+			const forced = phase.override === "skipped" || phase.override === "stopped";
+			const started = phase.status === "running" || phase.status === "completed" || phase.status === "failed";
+			if (!forced && frontier && started || phase.status === "running" && running) return false;
+			if (phase.status === "running") running = true;
+			if (!forced && (phase.status === "pending" || phase.status === "running" || phase.status === "failed" && phase.bail)) frontier = true;
+			phaseIds.add(phase.id);
+			const taskIds = /* @__PURE__ */ new Set();
+			const statuses = [];
+			if (phase.tasks.length > 0) vacuous = false;
+			for (const task of phase.tasks) {
+				if (!isRecord(task) || !Object.keys(task).every((key) => key === "id" || key === "name" || key === "description" || key === "status" || key === "result" || key === "metadata" || key === "attempts" || key === "run" || key === "retries" || key === "timeout" || key === "activity") || !isNonEmptyString(task.id) || taskIds.has(task.id) || !isNonEmptyString(task.name) || task.description !== void 0 && typeof task.description !== "string" || !isLifecycleStatus(task.status) || !isRecord(task.metadata) || !isJSONValue(task.metadata) || !isInteger(task.attempts) || task.attempts < 0 || task.run !== void 0 && !isNonEmptyString(task.run) || task.retries !== void 0 && (!isInteger(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!isInteger(task.timeout) || task.timeout < 0 || task.timeout > 2147483647)) return false;
+				const budget = (task.retries ?? 0) + 1;
+				if (task.attempts > budget || task.status === "pending" && task.attempts >= budget) return false;
+				if (!(task.activity === void 0 || isTaskActivity(task.activity))) return false;
+				if (task.status === "running" || task.status === "completed" || task.status === "failed") {
+					if (task.attempts < 1 || task.activity === void 0) return false;
+				}
+				if (task.status === "pending" && task.activity !== void 0) return false;
+				if (task.status === "completed" || task.status === "failed") {
+					if (!isTaskResult(task.result, value, phase, task)) return false;
+				} else if (task.result !== void 0) return false;
+				taskIds.add(task.id);
+				statuses.push(task.status);
+			}
+			const derived = derivePhaseStatus(statuses);
+			if (phase.status !== (phase.override ?? derived) || phase.override !== void 0 && phase.status !== phase.override) return false;
+			derivations.push({
+				status: phase.status,
+				bail: phase.bail
+			});
+		}
+		const derived = deriveWorkflowStatus(derivations);
+		if (value.override === "completed") return value.status === "completed" && derived === "pending" && vacuous;
+		return value.status === (value.override ?? derived);
+	} catch {
+		return false;
+	}
+}
+/** Total hostile-boundary workflow snapshot guard. */
+function isWorkflowSnapshot(value) {
+	const cloned = attempt(() => cloneJSONValue(value));
+	return cloned.success && isOwnedWorkflowSnapshot(cloned.value);
+}
+function hasWorkflowHandlers(workflow, functions) {
+	if ("destroyed" in workflow) {
+		for (const phase of workflow.phases.phases()) for (const task of phase.tasks.tasks()) if (task.run !== void 0 && !isFunction(task.handler)) return false;
+		return true;
+	}
+	const runs = /* @__PURE__ */ new Set();
+	for (const phase of workflow.phases) for (const task of phase.tasks) {
+		if (task.run === void 0 || runs.has(task.run)) continue;
+		runs.add(task.run);
+		if (!isFunction(functions?.[task.run])) return false;
+	}
+	return true;
+}
+/** Locate the nearest identifiable node for an inconsistent owned snapshot. */
+function workflowSnapshotContext(value) {
+	if (!isRecord(value) || !isArray(value.phases)) return void 0;
+	for (const phase of value.phases) {
+		if (!isRecord(phase)) continue;
+		const phaseContext = isNonEmptyString(phase.id) ? { phase: phase.id } : void 0;
+		if (!isBoolean(phase.bail) || phase.concurrency !== void 0 && (!isInteger(phase.concurrency) || phase.concurrency < 1) || !isArray(phase.tasks)) return phaseContext;
+		for (const task of phase.tasks) {
+			if (!isRecord(task)) continue;
+			if (task.run !== void 0 && !isNonEmptyString(task.run) || task.retries !== void 0 && (!isInteger(task.retries) || task.retries < 0) || task.timeout !== void 0 && (!isInteger(task.timeout) || task.timeout < 0 || task.timeout > 2147483647) || !isInteger(task.attempts) || task.attempts < 0) return {
+				...phaseContext ?? {},
+				...isNonEmptyString(task.id) ? { task: task.id } : {}
+			};
+		}
+	}
+}
+/**
+* Test whether an unknown value is a valid whole-frame activity report.
+*/
+function isTaskActivityInput(value) {
+	try {
+		if (!isRecord(value)) return false;
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null || !Object.keys(value).every((key) => key === "note" || key === "progress" || key === "operations" || key === "constraints")) return false;
+		const note = value.note;
+		const progress = value.progress;
+		const operations = value.operations;
+		const constraints = value.constraints;
+		if (note !== void 0 && !isNonEmptyString(note)) return false;
+		if (progress !== void 0) {
+			if (!isRecord(progress)) return false;
+			const progressPrototype = Object.getPrototypeOf(progress);
+			if (progressPrototype !== Object.prototype && progressPrototype !== null || !Object.keys(progress).every((key) => key === "current" || key === "total" || key === "unit")) return false;
+			const current = progress.current;
+			const total = progress.total;
+			const unit = progress.unit;
+			if (!isFiniteNumber(current) || current < 0 || total !== void 0 && (!isFiniteNumber(total) || total < current) || unit !== void 0 && !isNonEmptyString(unit)) return false;
+		}
+		if (operations !== void 0) {
+			if (!isArray(operations)) return false;
+			const ids = /* @__PURE__ */ new Set();
+			for (const operation of operations) {
+				if (!isRecord(operation)) return false;
+				const operationPrototype = Object.getPrototypeOf(operation);
+				if (operationPrototype !== Object.prototype && operationPrototype !== null || !Object.keys(operation).every((key) => key === "id" || key === "name" || key === "started")) return false;
+				const id = operation.id;
+				const name = operation.name;
+				const started = operation.started;
+				if (!isNonEmptyString(id) || !isNonEmptyString(name) || !isFiniteNumber(started) || started < 0 || ids.has(id)) return false;
+				ids.add(id);
+			}
+		}
+		if (constraints !== void 0) {
+			if (!isArray(constraints)) return false;
+			const ids = /* @__PURE__ */ new Set();
+			for (const constraint of constraints) {
+				if (!isRecord(constraint)) return false;
+				const constraintPrototype = Object.getPrototypeOf(constraint);
+				if (constraintPrototype !== Object.prototype && constraintPrototype !== null || !Object.keys(constraint).every((key) => key === "id" || key === "name" || key === "started")) return false;
+				const id = constraint.id;
+				const name = constraint.name;
+				const started = constraint.started;
+				if (!isNonEmptyString(id) || !isNonEmptyString(name) || !isFiniteNumber(started) || started < 0 || ids.has(id)) return false;
+				ids.add(id);
+			}
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Test whether an unknown value is valid persisted task activity.
+*/
+function isTaskActivity(value) {
+	try {
+		if (!isRecord(value)) return false;
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null || !Object.keys(value).every((key) => key === "note" || key === "progress" || key === "operations" || key === "constraints" || key === "updated")) return false;
+		const note = value.note;
+		const progress = value.progress;
+		const operations = value.operations;
+		const constraints = value.constraints;
+		const updated = value.updated;
+		if (operations === void 0 || constraints === void 0 || !isFiniteNumber(updated) || updated < 0) return false;
+		return isTaskActivityInput({
+			...note === void 0 ? {} : { note },
+			...progress === void 0 ? {} : { progress },
+			operations,
+			constraints
+		});
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/core/cloners.ts
+/**
+* Validate and own a workflow snapshot before live construction.
+*
+* @param input - The hostile snapshot boundary
+* @param id - The optional storage key the owned snapshot must match
+* @returns A deeply owned frozen snapshot
+* @throws {WorkflowError} With `RESTORE` when the snapshot is invalid or does not match `id`
+*/
+function cloneWorkflowSnapshot(input, id) {
+	let cloned;
+	try {
+		cloned = cloneJSONValue(input);
+	} catch (error) {
+		if (isWorkflowError(error)) throw error;
+		if (isContractError(error)) throw new WorkflowError("RESTORE", `workflow snapshot could not be read safely: ${error.message}`);
+		throw new WorkflowError("RESTORE", "workflow snapshot could not be read safely");
+	}
+	if (!isOwnedWorkflowSnapshot(cloned)) throw new WorkflowError("RESTORE", "workflow snapshot is inconsistent", workflowSnapshotContext(cloned));
+	if (id !== void 0 && cloned.id !== id) throw new WorkflowError("RESTORE", `workflow snapshot '${cloned.id}' does not match storage key '${id}'`, {
+		requested: id,
+		payload: cloned.id
+	});
+	return cloned;
+}
+/**
+* Validate and clone one complete task activity frame.
+*
+* @remarks
+* This is the hostile boundary behind task reports and snapshot hydration. Supplying
+* `updated` stamps an input frame without reading an `updated` property from it; omitting
+* `updated` restores a stored frame and reads its persisted timestamp exactly once. Every
+* untrusted property is captured once inside one protected boundary. The returned frame,
+* collections, progress, operations, and constraints are copied and frozen.
+*
+* @param input - The untrusted complete activity frame
+* @param updated - An optional accepted timestamp used instead of a persisted `updated`
+* @returns An immutable cloned {@link TaskActivity}
+* @throws {WorkflowError} With `MUTATION` when the frame cannot be read or validated
+*/
+function cloneTaskActivity(input, updated) {
+	try {
+		if (!isRecord(input)) throw new WorkflowError("MUTATION", "task activity must be a record");
+		const inputPrototype = Object.getPrototypeOf(input);
+		if (inputPrototype !== Object.prototype && inputPrototype !== null || !Object.keys(input).every((key) => key === "note" || key === "progress" || key === "operations" || key === "constraints" || updated === void 0 && key === "updated")) throw new WorkflowError("MUTATION", "task activity must be a record");
+		const note = input.note;
+		const progressInput = input.progress;
+		const operationsInput = input.operations;
+		const constraintsInput = input.constraints;
+		const accepted = updated === void 0 ? input.updated : updated;
+		const operationInputs = operationsInput === void 0 ? [] : isArray(operationsInput) ? [...operationsInput] : void 0;
+		if (operationInputs === void 0) throw new WorkflowError("MUTATION", "task activity operations must be an array");
+		const operations = [];
+		for (const operation of operationInputs) {
+			if (!isRecord(operation)) throw new WorkflowError("MUTATION", "task activity contains an invalid operation");
+			const operationPrototype = Object.getPrototypeOf(operation);
+			if (operationPrototype !== Object.prototype && operationPrototype !== null || !Object.keys(operation).every((key) => key === "id" || key === "name" || key === "started")) throw new WorkflowError("MUTATION", "task activity contains an invalid operation");
+			const id = operation.id;
+			const name = operation.name;
+			const started = operation.started;
+			operations.push(Object.freeze({
+				id,
+				name,
+				started
+			}));
+		}
+		let progress;
+		if (progressInput !== void 0) {
+			if (!isRecord(progressInput)) throw new WorkflowError("MUTATION", "task activity contains invalid progress");
+			const progressPrototype = Object.getPrototypeOf(progressInput);
+			if (progressPrototype !== Object.prototype && progressPrototype !== null || !Object.keys(progressInput).every((key) => key === "current" || key === "total" || key === "unit")) throw new WorkflowError("MUTATION", "task activity contains invalid progress");
+			const current = progressInput.current;
+			const total = progressInput.total;
+			const unit = progressInput.unit;
+			progress = Object.freeze({
+				current,
+				...total === void 0 ? {} : { total },
+				...unit === void 0 ? {} : { unit }
+			});
+		}
+		const constraintInputs = constraintsInput === void 0 ? [] : isArray(constraintsInput) ? [...constraintsInput] : void 0;
+		if (constraintInputs === void 0) throw new WorkflowError("MUTATION", "task activity constraints must be an array");
+		const constraints = [];
+		for (const constraint of constraintInputs) {
+			if (!isRecord(constraint)) throw new WorkflowError("MUTATION", "task activity contains an invalid constraint");
+			const constraintPrototype = Object.getPrototypeOf(constraint);
+			if (constraintPrototype !== Object.prototype && constraintPrototype !== null || !Object.keys(constraint).every((key) => key === "id" || key === "name" || key === "started")) throw new WorkflowError("MUTATION", "task activity contains an invalid constraint");
+			const id = constraint.id;
+			const name = constraint.name;
+			const started = constraint.started;
+			constraints.push(Object.freeze({
+				id,
+				name,
+				started
+			}));
+		}
+		const activity = Object.freeze({
+			...note === void 0 ? {} : { note },
+			...progress === void 0 ? {} : { progress },
+			operations: Object.freeze(operations),
+			constraints: Object.freeze(constraints),
+			updated: accepted
+		});
+		if (!isTaskActivity(activity)) throw new WorkflowError("MUTATION", "task activity is invalid");
+		return activity;
+	} catch (error) {
+		if (isWorkflowError(error)) throw error;
+		throw new WorkflowError("MUTATION", "task activity could not be read safely");
+	}
+}
+//#endregion
 //#region src/core/shapers.ts
 /**
 * The shape of a {@link import('./types.js').TaskDefinition} — identity plus an optional
@@ -717,6 +1194,7 @@ var taskShape = objectShape({
 	})),
 	timeout: optionalShape(integerShape({
 		min: 0,
+		max: MAX_TIMER_MS,
 		description: "Per-attempt deadline in milliseconds; overrides the phase default. Omitted means no deadline."
 	}))
 });
@@ -827,7 +1305,8 @@ var phaseUpdateShape = objectShape({
 *   the row `{ id: snapshot.id, snapshot }`.
 * - **`get(id)` resolves the stored snapshot for an id**, narrowing the opaque JSON column back to
 *   a {@link WorkflowSnapshot} ({@link import('../helpers.js').isWorkflowSnapshot} — the AGENTS §14
-*   boundary narrow for an untrusted storage read), or `undefined` if none is stored.
+*   boundary narrow for an untrusted storage read), or `undefined` if none is stored. A present
+*   snapshot whose own id differs from the requested key rejects with normalized `RESTORE` evidence.
 * - **`delete(id)` drops a snapshot by id**; an absent id is a no-op (no throw).
 *
 * UNLIKE the server package's `SessionStoreInterface` there is NO
@@ -838,7 +1317,8 @@ var phaseUpdateShape = objectShape({
 *
 * @example
 * ```ts
-* import { createDatabaseWorkflowStore, createMemoryDriver, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryDriver } from '@orkestrel/database'
+* import { createDatabaseWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createDatabaseWorkflowStore(createMemoryDriver()) // a durable driver swaps in here
 * const workflow = createWorkflow(definition)
@@ -859,17 +1339,18 @@ var DatabaseWorkflowStore = class {
 	constructor(table) {
 		this.#table = table;
 	}
-	/** Resolve the persisted snapshot for `id`, narrowing the opaque JSON column back to a `WorkflowSnapshot`. */
+	/** Resolve and key-check the snapshot for `id`, narrowing the opaque column to `WorkflowSnapshot`. */
 	async get(id) {
 		const row = await this.#table.get(id);
 		if (row === void 0) return void 0;
-		return isWorkflowSnapshot(row.snapshot) ? row.snapshot : void 0;
+		return cloneWorkflowSnapshot(row.snapshot, id);
 	}
 	/** Insert or replace under the snapshot's OWN `id` (no separate id param) — the row is `{ id, snapshot }`. */
 	async set(snapshot) {
+		const owned = cloneWorkflowSnapshot(snapshot);
 		await this.#table.set({
-			id: snapshot.id,
-			snapshot
+			id: owned.id,
+			snapshot: owned
 		});
 	}
 	/** Drop a snapshot by id; an absent id is a no-op (no throw). */
@@ -907,7 +1388,7 @@ var DatabaseWorkflowStore = class {
 *
 * @example
 * ```ts
-* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createMemoryWorkflowStore()
 * const workflow = createWorkflow(definition)
@@ -920,10 +1401,12 @@ var DatabaseWorkflowStore = class {
 var MemoryWorkflowStore = class {
 	#snapshots = /* @__PURE__ */ new Map();
 	get(id) {
-		return Promise.resolve(this.#snapshots.get(id));
+		const snapshot = this.#snapshots.get(id);
+		return Promise.resolve(snapshot === void 0 ? void 0 : cloneWorkflowSnapshot(snapshot));
 	}
 	set(snapshot) {
-		this.#snapshots.set(snapshot.id, snapshot);
+		const owned = cloneWorkflowSnapshot(snapshot);
+		this.#snapshots.set(owned.id, owned);
 		return Promise.resolve();
 	}
 	delete(id) {
@@ -946,9 +1429,8 @@ var MemoryWorkflowStore = class {
 *   `TRANSITION` {@link WorkflowError} on an illegal move (e.g. completing a non-`running`
 *   task) — the legal graph is the single source of truth, so the leaf can never reach an
 *   impossible state.
-* - **Override (snapshot fidelity).** `skip` / `stop` set `#override` to the forced terminal
-*   status, so a RESTORE can tell a forced leaf (`skipped` / `stopped`) from a run-produced
-*   one and reinstate it AS an override — preserving the round-trip.
+* - **Snapshot fidelity.** A leaf needs no override: `skipped` / `stopped` are explicit terminal
+*   statuses, and restore reinstates the leaf directly from {@link TaskSnapshot.status}.
 * - **The cascade.** Every status change records its boxed result (when any), fires the leaf's
 *   OWN event, THEN calls the parent phase's `#recompute` (injected at construction) so the
 *   transition propagates UP (Task → Phase → Workflow re-derive). The own-event-before-cascade
@@ -963,7 +1445,8 @@ var MemoryWorkflowStore = class {
 *   matching {@link import('../types.js').TaskDefinition} / {@link TaskSnapshot} field. `handler`
 *   is the RUNTIME-ONLY counterpart — `run` resolved ONCE at construction against the
 *   workflow-level {@link import('../types.js').WorkflowOptions.functions} registry — and is
-*   NEVER persisted; `undefined` when `run` is omitted or unregistered (the no-handler rule).
+*   NEVER persisted; `undefined` when `run` is omitted or unregistered. Only omission is a
+*   deliberate no-op; unresolved named work is rejected before dispatch.
 */
 var Task = class {
 	#context;
@@ -978,16 +1461,34 @@ var Task = class {
 	#run;
 	#retries;
 	#timeout;
+	#attempts;
 	#handler;
-	constructor(context, phase, workflow, recompute, options, status = "pending", result, run, retries, timeout, handler) {
-		this.#context = context;
+	#abort;
+	#silence;
+	#onSilence;
+	#liveness;
+	#activity;
+	#paused;
+	#gate;
+	#timerSignal;
+	constructor(context, phase, workflow, recompute, options, status = "pending", result, run, retries, timeout, metadata = {}, attempts = 0, activity, handler, silence) {
+		this.#context = buildTaskContext(context.phase, context);
 		this.#phase = phase;
 		this.#workflow = workflow;
 		this.#recompute = recompute;
-		this.#metadata = options?.metadata ?? {};
+		try {
+			const metadataOption = options?.metadata;
+			this.#metadata = cloneJSONRecord(metadataOption ?? metadata);
+		} catch (error) {
+			if (isContractError(error)) throw new WorkflowError("RESTORE", `task '${context.id}' metadata could not be read safely: ${error.message}`, { task: context.id });
+			throw new WorkflowError("RESTORE", `task '${context.id}' metadata could not be read safely`, { task: context.id });
+		}
+		const on = options?.on;
+		const listenerError = options?.error;
+		const silenceOption = options?.silence;
 		this.#emitter = new Emitter({
-			...options?.on === void 0 ? {} : { on: options.on },
-			...options?.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...listenerError === void 0 ? {} : { error: listenerError }
 		});
 		this.#status = status;
 		this.#result = result;
@@ -999,7 +1500,19 @@ var Task = class {
 		this.#run = run;
 		this.#retries = retries;
 		this.#timeout = timeout;
+		this.#attempts = attempts;
 		this.#handler = handler;
+		this.#abort = createAbort();
+		this.#silence = resolveTaskSilence(silenceOption, silence);
+		this.#onSilence = this.#expire.bind(this);
+		this.#liveness = this.#silence === void 0 ? void 0 : createTimeout({
+			ms: this.#silence,
+			signal: this.#abort.signal
+		});
+		this.#activity = activity === void 0 ? void 0 : cloneTaskActivity(activity);
+		this.#paused = false;
+		this.#gate = void 0;
+		this.#timerSignal = void 0;
 	}
 	get emitter() {
 		return this.#emitter;
@@ -1025,6 +1538,9 @@ var Task = class {
 	get result() {
 		return this.#result;
 	}
+	get attempts() {
+		return this.#attempts;
+	}
 	get run() {
 		return this.#run;
 	}
@@ -1037,40 +1553,120 @@ var Task = class {
 	get timeout() {
 		return this.#timeout;
 	}
+	get activity() {
+		return this.#activity;
+	}
+	get silence() {
+		return this.#silence;
+	}
+	get silent() {
+		return this.#status === "running" && this.#liveness?.expired === true;
+	}
+	get paused() {
+		return this.#paused;
+	}
+	get signal() {
+		return this.#abort.signal;
+	}
 	start() {
-		this.#transition("running");
+		const budget = Math.max(0, this.#retries ?? 0) + 1;
+		if (this.#status !== "pending" && this.#status !== "running" || this.#attempts >= budget) throw new WorkflowError("TRANSITION", `task '${this.id}' cannot start another attempt`, {
+			task: this.id,
+			status: this.#status,
+			attempts: this.#attempts,
+			budget
+		});
+		if (this.#status === "pending") this.#transition("running");
+		this.#attempts += 1;
+		this.#activity = cloneTaskActivity({}, this.#stamp());
+		this.#arm();
 		this.#emitter.emit("start", this.id);
 		this.#escalate();
 	}
 	complete(value) {
+		let owned;
+		try {
+			owned = cloneJSONValue(value);
+		} catch (error) {
+			if (isContractError(error)) throw new WorkflowError("RESTORE", `task '${this.id}' result could not be read safely: ${error.message}`, { task: this.id });
+			throw new WorkflowError("RESTORE", `task '${this.id}' result could not be read safely`, { task: this.id });
+		}
 		this.#transition("completed");
-		const result = this.#record("completed", {
+		this.#finish();
+		const result = this.#record("completed", Object.freeze({
 			success: true,
-			value
-		});
+			value: owned
+		}));
 		this.#emitter.emit("complete", result);
 		this.#escalate();
 	}
 	fail(error) {
+		const origin = error.origin === "handler" || error.origin === "timeout" || error.origin === "recovery" ? error.origin : "handler";
+		const message = typeof error.message === "string" && error.message.length > 0 ? error.message : "unknown failure";
 		this.#transition("failed");
-		const reason = error instanceof Error ? error : new Error(String(error), { cause: error });
-		const result = this.#record("failed", {
+		this.#finish();
+		const result = this.#record("failed", Object.freeze({
 			success: false,
-			error: reason
-		});
+			error: Object.freeze({
+				origin,
+				message
+			})
+		}));
 		this.#emitter.emit("fail", result);
 		this.#escalate();
 	}
 	skip() {
 		this.#transition("skipped");
+		this.#finish();
+		this.#abort.abort();
 		this.#emitter.emit("skip");
 		this.#escalate();
 	}
 	stop() {
 		this.#transition("stopped");
+		this.#finish();
+		this.#abort.abort();
 		this.#emitter.emit("stop");
 		this.#escalate();
 	}
+	report(input) {
+		if (this.#status !== "running") return failure(new WorkflowError("TRANSITION", `task '${this.id}' cannot report while '${this.#status}'`, {
+			task: this.id,
+			status: this.#status
+		}));
+		try {
+			const activity = cloneTaskActivity(input, this.#stamp());
+			this.#activity = activity;
+			this.#arm();
+			this.#emitter.emit("report", activity);
+			return success(activity);
+		} catch (error) {
+			return failure(error instanceof WorkflowError ? error : new WorkflowError("MUTATION", "task activity report was refused", { task: this.id }));
+		}
+	}
+	pulse() {
+		if (this.#status !== "running" || this.#activity === void 0) return false;
+		this.#touch();
+		this.#arm();
+		const activity = this.#activity;
+		this.#emitter.emit("pulse", activity);
+		return true;
+	}
+	pause() {
+		if (this.#paused || this.#status !== "pending" && this.#status !== "running") return;
+		this.#paused = true;
+		this.#gate = createDeferred();
+		this.#emitter.emit("pause");
+	}
+	resume() {
+		if (!this.#paused) return;
+		this.#paused = false;
+		this.#release();
+		this.#emitter.emit("resume");
+	}
+	wait() {
+		return this.#paused && this.#gate !== void 0 ? this.#gate.promise : Promise.resolve();
+	}
 	/**
 	* Apply a validated declarative patch to SELF (`name` / `description`).
 	*
@@ -1105,9 +1701,11 @@ var Task = class {
 			status: this.#status,
 			...this.#result === void 0 ? {} : { result: this.#result },
 			metadata: this.#metadata,
+			attempts: this.#attempts,
 			...this.#run === void 0 ? {} : { run: this.#run },
 			...this.#retries === void 0 ? {} : { retries: this.#retries },
-			...this.#timeout === void 0 ? {} : { timeout: this.#timeout }
+			...this.#timeout === void 0 ? {} : { timeout: this.#timeout },
+			...this.#activity === void 0 ? {} : { activity: this.#activity }
 		};
 	}
 	#transition(to) {
@@ -1127,12 +1725,53 @@ var Task = class {
 			...result === void 0 ? {} : { result },
 			timestamp: Date.now()
 		};
-		this.#result = record;
-		return record;
+		const frozen = Object.freeze(record);
+		this.#result = frozen;
+		return frozen;
 	}
 	#escalate() {
 		this.#recompute();
 	}
+	#touch() {
+		if (this.#activity === void 0) return;
+		this.#activity = Object.freeze({
+			...this.#activity,
+			updated: this.#stamp()
+		});
+	}
+	#stamp() {
+		return Math.max(Date.now(), this.#activity?.updated ?? 0);
+	}
+	#finish() {
+		this.#clear();
+		this.#paused = false;
+		this.#release();
+	}
+	#arm() {
+		this.#clear();
+		const liveness = this.#liveness;
+		if (liveness === void 0 || this.#status !== "running") return;
+		liveness.start();
+		const signal = liveness.signal;
+		this.#timerSignal = signal;
+		signal.addEventListener("abort", this.#onSilence, { once: true });
+	}
+	#clear() {
+		const signal = this.#timerSignal;
+		if (signal !== void 0) signal.removeEventListener("abort", this.#onSilence);
+		this.#timerSignal = void 0;
+		this.#liveness?.clear();
+	}
+	#expire() {
+		this.#timerSignal = void 0;
+		if (this.#status !== "running" || this.#liveness?.expired !== true) return;
+		this.#emitter.emit("silence");
+	}
+	#release() {
+		if (this.#gate === void 0) return;
+		this.#gate.resolve();
+		this.#gate = void 0;
+	}
 };
 //#endregion
 //#region src/core/tasks/TaskManager.ts
@@ -1222,9 +1861,9 @@ var TaskManager = class {
 *
 * @remarks
 * - **Derived status.** `status` is `#override` when one is in force, else
-*   {@link derivePhaseStatus} over the live tasks' statuses. {@link #recompute} (passed to
+*   {@link derivePhaseStatus} over the live tasks' statuses. `#recompute` (passed to
 *   each child {@link Task}) re-derives on every child transition; a CHANGE emits the matching
-*   event AND escalates to the workflow ({@link #escalate}, the upward step of the cascade).
+*   event AND escalates to the workflow (`#escalate`, the upward step of the cascade).
 * - **Override (AGENTS §10).** `skip` / `stop` FORCE the phase's status (e.g. skipping a whole
 *   phase), overriding the derived value; the override is PERSISTED in the snapshot's own
 *   `override` field and restored DIRECTLY (no divergence guess), so a forced phase round-trips.
@@ -1233,9 +1872,11 @@ var TaskManager = class {
 *   `results()` collects the settled tasks' {@link TaskResult}s (the phase tier of the result
 *   tree); `workflow` navigates UP to the live parent.
 * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link PhaseEventMap}) fires
-*   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE, strictly AFTER the
-*   recompute + escalate; the emitter isolates a listener throw and routes it to its `error`
-*   handler (the `error` option); `fail` carries the failing task's {@link TaskResult}.
+*   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+*   corresponding status or runtime-gate change. Status events fire after the phase recomputes
+*   and before it escalates to the workflow, preserving child/phase cause before parent effect.
+*   The emitter isolates a listener throw and routes it to its `error` handler (the `error`
+*   option); `fail` carries the failing task's {@link TaskResult}.
 * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
 *   delegating to {@link tasks} (the manager gates the target's own existence/status/id/
 *   bounds), then emit the matching {@link PhaseEventMap} event on success only. NATIVE
@@ -1253,9 +1894,12 @@ var TaskManager = class {
 *   construction path {@link #append} uses at build time, so a live mint and a restored/built
 *   task are wired IDENTICALLY. At construction, the workflow-level
 *   {@link import('../types.js').WorkflowFunctions} registry (threaded from
-*   {@link import('../types.js').WorkflowOptions.functions}) resolves each task's `run` name into
-*   its runtime {@link import('../types.js').TaskInterface.handler} ONCE; a `run` that is omitted
-*   or unregistered resolves to no handler (the no-handler rule).
+*   {@link import('../types.js').WorkflowOptions.functions}) resolves every unique initial `run`
+*   name ONCE before any task is built; siblings sharing a name receive the exact same captured
+*   runtime {@link import('../types.js').TaskInterface.handler}. A later live {@link add} reads
+*   that name once from the retained registry at its own mint moment. An omitted or unregistered
+*   `run` resolves to no handler; only omission is a no-op, while an unresolved present name makes
+*   the containing tree non-drivable.
 * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror the workflow's own
 *   quartet, scoped to this phase — a driving
 *   {@link import('../types.js').WorkflowRunnerInterface.execute} gates a task's own
@@ -1272,6 +1916,7 @@ var Phase = class {
 	#escalateUp;
 	#tasks = new TaskManager();
 	#functions;
+	#silence;
 	#bail;
 	#concurrency;
 	#emitter;
@@ -1279,7 +1924,10 @@ var Phase = class {
 	#override;
 	#paused;
 	#gate;
-	constructor(snapshot, workflow, escalate, options, bail, functions) {
+	constructor(snapshot, workflow, escalate, options, bail, functions, silence) {
+		const on = options?.on;
+		const error = options?.error;
+		const tasks = options?.tasks;
 		this.#id = snapshot.id;
 		this.#name = snapshot.name;
 		if (snapshot.description !== void 0) Object.defineProperty(this, "description", {
@@ -1289,13 +1937,20 @@ var Phase = class {
 		this.#workflow = workflow;
 		this.#escalateUp = escalate;
 		this.#functions = functions;
+		this.#silence = silence;
+		const handlers = /* @__PURE__ */ new Map();
+		for (const task of snapshot.tasks) if (task.run !== void 0 && !handlers.has(task.run)) handlers.set(task.run, functions?.[task.run]);
 		this.#bail = bail ?? snapshot.bail;
 		this.#concurrency = snapshot.concurrency;
 		this.#emitter = new Emitter({
-			...options?.on === void 0 ? {} : { on: options.on },
-			...options?.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
 		});
-		for (const task of snapshot.tasks) this.#append(task, options);
+		for (const task of snapshot.tasks) {
+			const taskOptions = tasks?.[task.id];
+			const handler = task.run === void 0 ? void 0 : handlers.get(task.run);
+			this.#append(task, taskOptions, handler);
+		}
 		this.#override = snapshot.override;
 		this.#status = this.status;
 		this.#paused = false;
@@ -1357,11 +2012,13 @@ var Phase = class {
 		if (this.#paused || isTerminalStatus(this.status)) return;
 		this.#paused = true;
 		this.#gate = createDeferred();
+		this.#emitter.emit("pause");
 	}
 	resume() {
 		if (!this.#paused) return;
 		this.#paused = false;
 		this.#release();
+		this.#emitter.emit("resume");
 	}
 	wait() {
 		return this.#paused && this.#gate !== void 0 ? this.#gate.promise : Promise.resolve();
@@ -1442,6 +2099,10 @@ var Phase = class {
 			return;
 		}
 		this.#status = next;
+		if (isTerminalStatus(next)) {
+			this.#paused = false;
+			this.#release();
+		}
 		this.#emitFor(next);
 		this.#escalateUp();
 	}
@@ -1453,6 +2114,7 @@ var Phase = class {
 		if (status === "running") this.#emitter.emit("start", this.id);
 		else if (status === "completed") this.#emitter.emit("complete");
 		else if (status === "failed") this.#emitter.emit("fail", this.#failure());
+		else if (status === "skipped") this.#emitter.emit("skip");
 		else if (status === "stopped") this.#emitter.emit("stop");
 	}
 	#failure() {
@@ -1470,17 +2132,17 @@ var Phase = class {
 		if (result.success) this.#emitter.emit("add", result.value, at);
 		return result;
 	}
-	#append(task, options) {
-		const created = this.#create(task, options?.tasks?.[task.id]);
+	#append(task, options, handler) {
+		const created = this.#create(task, options, handler);
 		this.#tasks.append(created);
 	}
-	#create(snapshot, options) {
-		const context = buildTaskContext(this.context, snapshot);
-		const handler = snapshot.run === void 0 ? void 0 : this.#functions?.[snapshot.run];
-		return new Task(context, this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.run, snapshot.retries, snapshot.timeout, handler);
+	#create(snapshot, options, handler) {
+		return new Task(buildTaskContext(this.context, snapshot), this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.run, snapshot.retries, snapshot.timeout, snapshot.metadata, snapshot.attempts, snapshot.activity, handler, this.#silence);
 	}
 	#mint(definition) {
-		return this.#create(taskDefinitionToSnapshot(definition), void 0);
+		const snapshot = taskDefinitionToSnapshot(definition);
+		const handler = snapshot.run === void 0 ? void 0 : this.#functions?.[snapshot.run];
+		return this.#create(snapshot, void 0, handler);
 	}
 	#statuses() {
 		return this.#tasks.tasks().map((task) => task.status);
@@ -1575,24 +2237,26 @@ var PhaseManager = class {
 * - **Construction.** Built from a {@link WorkflowSnapshot} (the unified input —
 *   {@link import('./factories.js').createWorkflow} seeds an initial snapshot from a
 *   {@link import('./types.js').WorkflowDefinition}, {@link import('./factories.js').restoreWorkflow}
-*   passes a persisted one). Each child {@link Phase} is wired to escalate to {@link #recompute}.
+*   passes a persisted one). Each child {@link Phase} is wired to escalate to `#recompute`.
 * - **Derived status.** `status` is `#override` when forced, else
 *   {@link deriveWorkflowStatus} over the live phases' statuses feeding `bail`. `failed` is
 *   reachable ONLY under `bail: true` (a single failed task halts the workflow); under
-*   `bail: false` a failed phase folds into `completed`. {@link #recompute} diffs on each phase
+*   `bail: false` a failed phase folds into `completed`. `#recompute` diffs on each phase
 *   change; a CHANGE emits.
-* - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; the override is PERSISTED in the
-*   snapshot's own `override` field and restored DIRECTLY (no divergence guess). The snapshot also
-*   persists `bail`, so a restore re-derives status identically without a silent policy default.
+* - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; an executed task-free pending tree
+*   may also be force-completed vacuously. The override is PERSISTED in the snapshot's own
+*   `override` field and restored DIRECTLY (no divergence guess). The snapshot also persists
+*   `bail`, so a restore re-derives status identically without a silent policy default.
 * - **Result tree.** `results()` flattens every phase's `results()` ({@link collectResults}) — the
 *   workflow tier; `phase(id)` + each `phase.task(id)` navigate DOWN, a task's `phase` / `workflow`
 *   navigate UP.
 * - **Snapshot.** `snapshot()` serializes the whole live tree to a {@link WorkflowSnapshot} (pure
 *   JSON); {@link import('./factories.js').restoreWorkflow} rebuilds an equivalent live tree.
 * - **Observable (AGENTS §13).** The owned {@link emitter} ({@link WorkflowEventMap}) fires
-*   `start` / `complete` / `fail` / `stop` on a derived-status CHANGE; the emitter isolates a
-*   listener throw and routes it to its `error` handler (the `error` option); `fail` carries
-*   the failing task's {@link TaskResult}.
+*   `start` / `complete` / `fail` / `pause` / `resume` / `skip` / `stop` after the
+*   corresponding status or runtime-gate change; the emitter isolates a listener throw and
+*   routes it to its `error` handler (the `error` option); `fail` carries the failing task's
+*   {@link TaskResult}.
 * - **Structural API (AGENTS §7).** `add` / `remove` / `move` / `update` gate BEFORE
 *   delegating to {@link phases} (the manager gates the target's own existence/status/id/
 *   bounds), then emit the matching {@link WorkflowEventMap} event on success only. NATIVE,
@@ -1604,16 +2268,17 @@ var PhaseManager = class {
 *   naturally accepted.
 * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` gate execution at the runner's
 *   phase/task boundaries WITHOUT touching {@link status} — `paused` is runtime-only, never
-*   persisted. `destroy` is a terminal teardown: it aborts {@link signal}, `stop`s every
-*   non-terminal live phase (so an engine parked on a phase's own gate unparks and the tree
-*   lands coherent), forces the `stop` override on THIS workflow when not already terminal,
-*   releases any parked {@link wait} waiter, and marks {@link destroyed} — all four idempotent.
+*   persisted. `destroy` is a terminal teardown: it `stop`s every non-terminal task and
+*   phase (releasing their gates and liveness resources), aborts {@link signal}, forces the
+*   workflow `stop` override when needed, releases its parked waiter, and marks
+*   {@link destroyed} — all idempotent.
 */
 var Workflow = class {
 	#context;
 	#bail;
 	#bailOverride;
 	#functions;
+	#silence;
 	#phases = new PhaseManager();
 	#emitter;
 	#created;
@@ -1625,14 +2290,22 @@ var Workflow = class {
 	#gate;
 	#destroyed;
 	constructor(snapshot, options) {
+		const captured = captureWorkflowOptions(options);
+		const on = captured.on;
+		const bail = captured.bail;
+		const error = captured.error;
+		const phases = captured.phases;
+		const functions = captured.functions;
+		const silence = captured.silence;
 		this.#context = buildWorkflowContext(snapshot);
 		if (snapshot.description !== void 0) Object.defineProperty(this, "description", { value: snapshot.description });
-		this.#bail = options?.bail ?? snapshot.bail;
-		this.#bailOverride = options?.bail;
-		this.#functions = options?.functions;
+		this.#bail = bail ?? snapshot.bail;
+		this.#bailOverride = bail;
+		this.#functions = functions;
+		this.#silence = silence;
 		this.#emitter = new Emitter({
-			...options?.on === void 0 ? {} : { on: options.on },
-			...options?.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
 		});
 		this.#created = snapshot.created;
 		this.#updated = snapshot.updated;
@@ -1640,7 +2313,10 @@ var Workflow = class {
 		this.#paused = false;
 		this.#gate = void 0;
 		this.#destroyed = false;
-		for (const phase of snapshot.phases) this.#append(phase, options);
+		for (const phase of snapshot.phases) {
+			const phaseOptions = phases?.[phase.id];
+			this.#append(phase, phaseOptions);
+		}
 		this.#override = snapshot.override;
 		this.#status = this.status;
 	}
@@ -1691,26 +2367,35 @@ var Workflow = class {
 		this.#release();
 	}
 	complete() {
-		if (this.status === "pending") this.#force("completed");
+		if (this.status === "pending" && this.#phases.phases().every((phase) => phase.tasks.count === 0)) this.#force("completed");
 	}
 	pause() {
 		if (this.#paused || isTerminalStatus(this.status) || this.#destroyed) return;
 		this.#paused = true;
 		this.#gate = createDeferred();
+		this.#emitter.emit("pause");
 	}
 	resume() {
 		if (!this.#paused) return;
 		this.#paused = false;
 		this.#release();
+		this.#emitter.emit("resume");
 	}
 	destroy() {
 		if (this.#destroyed) return;
 		this.#destroyed = true;
-		this.#abort.abort();
-		for (const phase of this.#phases.phases()) if (!isTerminalStatus(phase.status)) phase.stop();
+		const phases = this.#phases.phases();
 		if (!isTerminalStatus(this.status)) this.stop();
+		for (const phase of phases) phase.stop();
+		for (const phase of phases) for (const task of phase.tasks.tasks()) if (!isTerminalStatus(task.status)) task.stop();
 		this.#paused = false;
 		this.#release();
+		this.#abort.abort();
+		for (const phase of phases) {
+			for (const task of phase.tasks.tasks()) task.emitter.destroy();
+			phase.emitter.destroy();
+		}
+		this.#emitter.destroy();
 	}
 	wait() {
 		return this.#paused && this.#gate !== void 0 ? this.#gate.promise : Promise.resolve();
@@ -1772,7 +2457,7 @@ var Workflow = class {
 		return result;
 	}
 	snapshot() {
-		return {
+		return cloneWorkflowSnapshot({
 			id: this.id,
 			name: this.name,
 			...this.description === void 0 ? {} : { description: this.description },
@@ -1782,13 +2467,17 @@ var Workflow = class {
 			phases: this.#phases.phases().map((phase) => phase.snapshot()),
 			created: this.#created,
 			updated: this.#updated
-		};
+		});
 	}
 	#recompute() {
 		const next = this.status;
 		if (next === this.#status) return;
 		this.#status = next;
-		this.#updated = Date.now();
+		if (isTerminalStatus(next)) {
+			this.#paused = false;
+			this.#release();
+		}
+		this.#updated = Math.max(Date.now(), this.#updated);
 		this.#emitFor(next);
 	}
 	#force(status) {
@@ -1799,6 +2488,7 @@ var Workflow = class {
 		if (status === "running") this.#emitter.emit("start", this.id);
 		else if (status === "completed") this.#emitter.emit("complete");
 		else if (status === "failed") this.#emitter.emit("fail", this.#failure());
+		else if (status === "skipped") this.#emitter.emit("skip");
 		else if (status === "stopped") this.#emitter.emit("stop");
 	}
 	#addTo(phase, index, at) {
@@ -1818,11 +2508,11 @@ var Workflow = class {
 		return found;
 	}
 	#append(phase, options) {
-		const created = new Phase(phase, this, () => this.#recompute(), options?.phases?.[phase.id], this.#bailOverride, this.#functions);
+		const created = new Phase(phase, this, () => this.#recompute(), options, this.#bailOverride, this.#functions, this.#silence);
 		this.#phases.append(created);
 	}
 	#mint(definition) {
-		return new Phase(phaseDefinitionToSnapshot(definition, this.#bail), this, () => this.#recompute(), void 0, this.#bailOverride, this.#functions);
+		return new Phase(phaseDefinitionToSnapshot(definition, this.#bail), this, () => this.#recompute(), void 0, this.#bailOverride, this.#functions, this.#silence);
 	}
 	#release() {
 		if (this.#gate === void 0) return;
@@ -1850,12 +2540,11 @@ var Workflow = class {
 *   `functions` registry in) and stores it under `definition.id` — an already-present id
 *   OVERWRITES (last write wins). `count` is the map size, `workflow(id)` looks one up,
 *   `workflows()` lists them in insertion order.
-* - **Durable open / save.** `open(id)` returns an already-registered workflow directly; on a
-*   registry MISS with a `store` set it rehydrates through {@link restoreWorkflow} (flowing the
-*   manager's `functions` registry in so the rehydrated tree is RUNNABLE), registers it, and
-*   returns it — lenient (`undefined`) with no store or a store miss. `save(id)` persists a
-*   registered workflow's `snapshot()` to the `store` — lenient (`false`) with no store or an
-*   unknown id.
+* - **Durable open / save.** `open(id)` returns an already-registered workflow directly; same-id
+*   misses share one hydration. A concurrent `add` wins, while `remove` / `clear` invalidate
+*   earlier reads; wrong-key payloads reject with `RESTORE`. `save(id)` captures a registered
+*   workflow's snapshot at invocation and serializes same-id writes without coupling other ids.
+*   Both remain lenient without a store or registered id.
 * - **Removal.** `remove` drops one by id, or a batch (§9.2, array overload FIRST) — `true` when
 *   any was removed. `clear` empties the registry.
 * - **No active pointer.** Unlike its `ConversationManager` / `WorkspaceManager` twins, there is
@@ -1873,6 +2562,12 @@ var Workflow = class {
 */
 var WorkflowManager = class {
 	#workflows = /* @__PURE__ */ new Map();
+	#opens = /* @__PURE__ */ new Map();
+	#saves = /* @__PURE__ */ new Map();
+	#mutations = /* @__PURE__ */ new Map();
+	#additions = /* @__PURE__ */ new Map();
+	#hydrations = /* @__PURE__ */ new Map();
+	#generation = Symbol();
 	#functions;
 	#store;
 	constructor(options) {
@@ -1890,36 +2585,140 @@ var WorkflowManager = class {
 	}
 	add(definition) {
 		const workflow = createWorkflow(definition, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
+		const mutation = this.#invalidate(workflow.id);
+		if (mutation === void 0) this.#additions.delete(workflow.id);
+		else this.#additions.set(workflow.id, mutation);
 		this.#workflows.set(workflow.id, workflow);
 		return workflow;
 	}
-	async open(id) {
+	open(id) {
 		const existing = this.#workflows.get(id);
-		if (existing !== void 0) return existing;
-		if (this.#store === void 0) return void 0;
-		const snapshot = await this.#store.get(id);
-		if (snapshot === void 0) return void 0;
-		const workflow = restoreWorkflow(snapshot, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
-		this.#workflows.set(workflow.id, workflow);
-		return workflow;
-	}
-	async save(id) {
+		if (existing !== void 0) return Promise.resolve(existing);
+		if (this.#store === void 0) return Promise.resolve(void 0);
+		const pending = this.#opens.get(id);
+		if (pending !== void 0) return pending;
+		const mutation = this.#mutations.get(id);
+		const generation = this.#generation;
+		const lease = this.#retain(id);
+		const reservation = Promise.withResolvers();
+		const opening = reservation.promise;
+		this.#opens.set(id, opening);
+		this.#hydrate(id, mutation, generation, lease, this.#store).then(reservation.resolve, reservation.reject);
+		opening.then(() => this.#releaseOpen(id, opening), () => this.#releaseOpen(id, opening));
+		return opening;
+	}
+	save(id) {
 		const workflow = this.#workflows.get(id);
-		if (this.#store === void 0 || workflow === void 0) return false;
-		await this.#store.set(workflow.snapshot());
-		return true;
+		if (this.#store === void 0 || workflow === void 0) return Promise.resolve(false);
+		const snapshot = workflow.snapshot();
+		const previous = this.#saves.get(id);
+		const reservation = Promise.withResolvers();
+		const saving = reservation.promise;
+		this.#saves.set(id, saving);
+		this.#persist(this.#store, previous, snapshot).then(reservation.resolve, reservation.reject);
+		saving.then(() => this.#settle(id, saving), () => this.#settle(id, saving));
+		return saving.then(() => true);
 	}
 	remove(ids) {
 		if (isArray(ids)) {
 			let removed = false;
-			for (const id of ids) if (this.#workflows.delete(id)) removed = true;
+			for (const id of ids) {
+				this.#invalidate(id);
+				this.#additions.delete(id);
+				if (this.#workflows.delete(id)) removed = true;
+			}
 			return removed;
 		}
+		this.#invalidate(ids);
+		this.#additions.delete(ids);
 		return this.#workflows.delete(ids);
 	}
 	clear() {
+		this.#generation = Symbol();
+		this.#mutations.clear();
+		this.#additions.clear();
+		this.#opens.clear();
 		this.#workflows.clear();
 	}
+	async #hydrate(id, mutation, generation, lease, store) {
+		try {
+			const snapshot = await store.get(id);
+			if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+			if (snapshot === void 0) return void 0;
+			let owned;
+			try {
+				owned = cloneWorkflowSnapshot(snapshot, id);
+			} catch (error) {
+				if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+				throw error;
+			}
+			if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+			let workflow;
+			try {
+				workflow = restoreWorkflow(owned, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
+			} catch (error) {
+				if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+				throw error;
+			}
+			if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+			return this.#register(id, workflow, mutation, generation);
+		} finally {
+			this.#releaseHydration(id, lease);
+		}
+	}
+	#owns(id, mutation, generation) {
+		return this.#generation === generation && this.#mutations.get(id) === mutation;
+	}
+	#resolve(id, generation) {
+		if (this.#generation !== generation) return void 0;
+		const mutation = this.#mutations.get(id);
+		const workflow = this.#workflows.get(id);
+		return workflow !== void 0 && this.#additions.get(id) === mutation ? workflow : void 0;
+	}
+	#register(id, workflow, mutation, generation) {
+		if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+		this.#workflows.set(id, workflow);
+		return workflow;
+	}
+	async #persist(store, previous, snapshot) {
+		if (previous !== void 0) try {
+			await previous;
+		} catch {}
+		await store.set(snapshot);
+	}
+	#invalidate(id) {
+		this.#opens.delete(id);
+		if (!this.#hydrations.has(id)) {
+			this.#mutations.delete(id);
+			this.#additions.delete(id);
+			return;
+		}
+		const mutation = Symbol();
+		this.#mutations.set(id, mutation);
+		return mutation;
+	}
+	#retain(id) {
+		const lease = Symbol();
+		const hydrations = this.#hydrations.get(id);
+		if (hydrations === void 0) this.#hydrations.set(id, /* @__PURE__ */ new Set([lease]));
+		else hydrations.add(lease);
+		return lease;
+	}
+	#releaseOpen(id, opening) {
+		if (this.#opens.get(id) === opening) this.#opens.delete(id);
+	}
+	#releaseHydration(id, lease) {
+		const hydrations = this.#hydrations.get(id);
+		if (hydrations === void 0) return;
+		hydrations.delete(lease);
+		if (hydrations.size !== 0) return;
+		this.#hydrations.delete(id);
+		this.#mutations.delete(id);
+		this.#additions.delete(id);
+	}
+	#settle(id, saving) {
+		if (this.#saves.get(id) === saving) this.#saves.delete(id);
+	}
 };
 //#endregion
 //#region src/core/Controller.ts
@@ -2038,6 +2837,7 @@ var Runner = class {
 	#order = [];
 	#values = /* @__PURE__ */ new Map();
 	#dispatched = /* @__PURE__ */ new Set();
+	#queued = /* @__PURE__ */ new Set();
 	#count = 0;
 	#drained;
 	#started = false;
@@ -2045,18 +2845,28 @@ var Runner = class {
 	#stopped = false;
 	#stopping = false;
 	#failure;
+	#stopPromise;
+	#abortPromise;
+	#destroyPromise;
 	constructor(options) {
-		this.#handler = options.handler;
-		this.#entries = options.entries;
+		const handler = options.handler;
+		const entries = options.entries;
+		const on = options.on;
+		const error = options.error;
+		const concurrency = options.concurrency;
+		const retries = options.retries;
+		const timeout = options.timeout;
+		this.#handler = handler;
+		this.#entries = entries;
 		this.#emitter = new Emitter({
-			...options.on === void 0 ? {} : { on: options.on },
-			...options.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
 		});
 		this.#queue = createQueue({
 			handler: this.#dispatch.bind(this),
-			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency },
-			...options.retries === void 0 ? {} : { retries: options.retries },
-			...options.timeout === void 0 ? {} : { timeout: options.timeout }
+			...concurrency === void 0 ? {} : { concurrency },
+			...retries === void 0 ? {} : { retries },
+			...timeout === void 0 ? {} : { timeout }
 		});
 	}
 	get emitter() {
@@ -2098,7 +2908,7 @@ var Runner = class {
 	* ```
 	*/
 	spawn(input) {
-		if (this.#stopped || !this.#running) return void 0;
+		if (!this.#accepts()) return void 0;
 		return this.#launch(input, void 0, true);
 	}
 	async execute(inputs) {
@@ -2106,29 +2916,37 @@ var Runner = class {
 		if (this.#stopped) throw new Error("runner is stopped");
 		this.#started = true;
 		this.#running = true;
-		this.#emitter.emit("start");
-		if (inputs.length === 0) {
-			this.#running = false;
-			this.#emitter.emit("finish", []);
-			return [];
-		}
 		const drained = createDeferred();
 		this.#drained = drained;
-		for (const input of inputs) this.#launch(input);
+		for (const input of inputs) {
+			if (!this.#accepts()) break;
+			this.#launch(input);
+		}
+		this.#emitter.emit("start");
+		if (this.#count === 0) drained.resolve();
 		await drained.promise;
 		this.#running = false;
+		const cleanup = await this.#cleanup();
 		if (this.#failure !== void 0) throw this.#failure.error;
+		if (cleanup !== void 0) throw cleanup.error;
 		const results = this.#collect();
 		this.#emitter.emit("finish", results);
+		const finishing = await this.#cleanup();
+		if (finishing !== void 0) throw finishing.error;
 		return results;
 	}
 	abort(reason) {
-		if (this.#stopped) return;
+		if (this.#abortPromise !== void 0) return this.#abortPromise;
+		const barrier = createDeferred();
+		this.#abortPromise = barrier.promise;
+		barrier.promise.catch(() => {});
 		if (this.#running && this.#failure === void 0) this.#failure = { error: reason === void 0 ? /* @__PURE__ */ new Error("runner aborted") : reason };
 		this.#cancel(reason);
-		this.#queue.abort(reason);
 		this.#stopped = true;
+		const cleanup = this.#queue.abort(reason);
+		this.#settleLifecycle(barrier, cleanup);
 		this.#emitter.emit("abort", reason);
+		return barrier.promise;
 	}
 	/**
 	* Suspend dispatch (AGENTS §10 — resumable): delegates to the backing queue's own
@@ -2166,18 +2984,28 @@ var Runner = class {
 	* dispatched unit's rejection while stopping is still a real failure. Idempotent.
 	*/
 	stop() {
-		if (this.#stopped) return;
+		if (this.#destroyPromise !== void 0) return this.#destroyPromise;
+		if (this.#abortPromise !== void 0) return this.#abortPromise;
+		if (this.#stopPromise !== void 0) return this.#stopPromise;
+		const barrier = createDeferred();
+		this.#stopPromise = barrier.promise;
+		barrier.promise.catch(() => {});
 		this.#stopping = true;
 		this.#stopped = true;
-		this.#queue.stop();
+		const cleanup = this.#queue.stop();
+		this.#settleLifecycle(barrier, cleanup);
+		return barrier.promise;
 	}
 	destroy() {
-		if (this.#stopped) {
-			this.#queue.destroy();
-			return;
-		}
+		if (this.#destroyPromise !== void 0) return this.#destroyPromise;
+		const barrier = createDeferred();
+		this.#destroyPromise = barrier.promise;
+		barrier.promise.catch(() => {});
+		this.#stopped = true;
 		this.abort();
-		this.#queue.destroy();
+		const cleanup = this.#queue.destroy();
+		this.#settleDestroy(barrier, cleanup);
+		return barrier.promise;
 	}
 	#launch(input, parent, announce = parent !== void 0) {
 		const id = crypto.randomUUID();
@@ -2186,14 +3014,24 @@ var Runner = class {
 		this.#order.push(id);
 		this.#count += 1;
 		if (announce) this.#emitter.emit("spawn", id, parent);
-		const promise = this.#queue.enqueue({
-			id,
-			input
-		}, {
-			id,
-			signal: abort.signal,
-			...this.#entries?.(input)
-		});
+		let promise;
+		try {
+			const entry = this.#entries?.(input);
+			const retries = entry?.retries;
+			const timeout = entry?.timeout;
+			this.#queued.add(id);
+			promise = this.#queue.enqueue({
+				id,
+				input
+			}, {
+				id,
+				signal: abort.signal,
+				...retries === void 0 ? {} : { retries },
+				...timeout === void 0 ? {} : { timeout }
+			});
+		} catch (error) {
+			promise = Promise.reject(error);
+		}
 		promise.then((value) => this.#settle(id, {
 			ok: true,
 			value
@@ -2212,14 +3050,14 @@ var Runner = class {
 		return this.#handler(controller);
 	}
 	#spawn(input, parent) {
-		if (!this.#running) throw new Error("spawn is unavailable outside an active run");
+		if (!this.#accepts()) throw new Error("spawn is unavailable outside an active run");
 		return this.#launch(input, parent);
 	}
 	#settle(id, outcome) {
 		if (outcome.ok) {
 			this.#values.set(id, { value: outcome.value });
 			this.#emitter.emit("settle", id);
-		} else if (this.#stopping && !this.#dispatched.has(id)) {} else if (this.#failure === void 0) {
+		} else if (this.#stopping && this.#queued.has(id) && !this.#dispatched.has(id)) {} else if (this.#failure === void 0) {
 			this.#failure = { error: outcome.error };
 			this.#emitter.emit("fail", id, outcome.error);
 			this.abort(outcome.error);
@@ -2235,6 +3073,46 @@ var Runner = class {
 		}
 		return results;
 	}
+	#accepts() {
+		return this.#running && !this.#stopped;
+	}
+	async #cleanup() {
+		const cleanup = this.#destroyPromise ?? this.#abortPromise ?? this.#stopPromise;
+		if (cleanup === void 0) return void 0;
+		try {
+			await cleanup;
+			return;
+		} catch (error) {
+			return { error };
+		}
+	}
+	async #settleLifecycle(barrier, cleanup) {
+		let failure;
+		try {
+			await cleanup;
+		} catch (error) {
+			failure = { error };
+		}
+		await this.#waitDrain();
+		if (failure === void 0) barrier.resolve();
+		else barrier.reject(failure.error);
+	}
+	async #settleDestroy(barrier, cleanup) {
+		let failure;
+		try {
+			await cleanup;
+		} catch (error) {
+			failure = { error };
+		}
+		await this.#waitDrain();
+		this.#emitter.destroy();
+		if (failure === void 0) barrier.resolve();
+		else barrier.reject(failure.error);
+	}
+	async #waitDrain() {
+		if (this.#count === 0) return;
+		await this.#drained?.promise;
+	}
 	#cancel(reason) {
 		for (const abort of this.#aborts.values()) abort.abort(reason);
 	}
@@ -2242,18 +3120,17 @@ var Runner = class {
 //#endregion
 //#region src/core/tasks/TaskController.ts
 /**
-* The lean per-task handle a {@link import('./types.js').WorkflowFunction} receives — the
-* running task's folded cancellation, its input, its lineage, and read-UP access to the
-* result tree.
+* The attempt-scoped handle a {@link import('./types.js').WorkflowFunction} receives.
 *
 * @remarks
 * - **A leaf handle, NOT the runner `Controller`.** A workflow task is a leaf of the
-*   declarative W-b tree, not a fan-out unit, so this carries none of the runner
-*   `Controller`'s `spawn` / `wait` — only what a leaf needs.
-* - **Folded signal.** `signal` is the cancellation the runner folds for THIS run: it fires
-*   on a workflow-level abort / timeout / budget ceiling, or — under `bail: true` — when a
-*   sibling task fails (the runner aborts the in-flight siblings via the substrate's
-*   fail-fast). A handler races its work against it; `aborted` reads it.
+*   declarative W-b tree, not a fan-out unit, so it has no `spawn`; its `wait` instead
+*   checkpoints the workflow, phase, and task cooperative gates.
+* - **Folded signal.** `signal` is the cancellation folded for THIS attempt: its per-attempt
+*   deadline, task stop/skip, workflow abort/timeout/budget/destroy, or a sibling fail-fast.
+*   A handler races its work against it; `aborted` reads it.
+* - **Attempt ownership.** `report` / `pulse` are closures supplied by the runner and refuse
+*   after this signal aborts or a retry token supersedes this handle.
 * - **Input + lineage.** `input` is the task's open `metadata` bag (its
 *   {@link import('./types.js').TaskInput} payload, `{}` when none); `task` is the full
 *   {@link TaskContext}, so `task.phase` / `task.phase.workflow` navigate UP the lineage.
@@ -2269,19 +3146,275 @@ var TaskController = class {
 	signal;
 	input;
 	task;
+	attempt;
+	#entity;
+	#report;
+	#pulse;
 	#results;
-	constructor(signal, input, task, results) {
+	constructor(signal, input, task, attempt, results, report, pulse) {
 		this.signal = signal;
 		this.input = input;
-		this.task = task;
+		this.task = task.context;
+		this.attempt = attempt;
+		this.#entity = task;
 		this.#results = results;
+		this.#report = report;
+		this.#pulse = pulse;
 	}
 	get aborted() {
 		return this.signal.aborted;
 	}
+	get paused() {
+		if (this.#ancestorTerminal()) return false;
+		return this.#entity.workflow.paused || this.#entity.phase.paused || !isTerminalStatus(this.#entity.status) && this.#entity.paused;
+	}
+	report(input) {
+		return this.#report(input);
+	}
+	pulse() {
+		return this.#pulse();
+	}
+	async wait() {
+		while (this.paused && !this.signal.aborted) await this.#race(this.#gates());
+	}
 	results() {
 		return this.#results();
 	}
+	#gates() {
+		if (this.#ancestorTerminal()) return [];
+		const gates = [];
+		if (this.#entity.workflow.paused) gates.push(this.#entity.workflow.wait());
+		if (this.#entity.phase.paused) gates.push(this.#entity.phase.wait());
+		if (!isTerminalStatus(this.#entity.status) && this.#entity.paused) gates.push(this.#entity.wait());
+		return gates;
+	}
+	async #race(gates) {
+		if (this.signal.aborted || gates.length === 0) return;
+		const deferred = Promise.withResolvers();
+		const onAbort = this.#resolve.bind(this, deferred);
+		const onTerminal = this.#resolve.bind(this, deferred);
+		this.signal.addEventListener("abort", onAbort, { once: true });
+		this.#entity.workflow.emitter.on("skip", onTerminal);
+		this.#entity.workflow.emitter.on("stop", onTerminal);
+		this.#entity.phase.emitter.on("skip", onTerminal);
+		this.#entity.phase.emitter.on("stop", onTerminal);
+		try {
+			if (this.#ancestorTerminal()) deferred.resolve();
+			await Promise.race([Promise.all(gates), deferred.promise]);
+		} finally {
+			this.signal.removeEventListener("abort", onAbort);
+			this.#entity.workflow.emitter.off("skip", onTerminal);
+			this.#entity.workflow.emitter.off("stop", onTerminal);
+			this.#entity.phase.emitter.off("skip", onTerminal);
+			this.#entity.phase.emitter.off("stop", onTerminal);
+		}
+	}
+	#ancestorTerminal() {
+		return isTerminalStatus(this.#entity.workflow.status) || isTerminalStatus(this.#entity.phase.status);
+	}
+	#resolve(deferred) {
+		deferred.resolve();
+	}
+};
+//#endregion
+//#region src/core/WorkflowPersistence.ts
+/**
+* Advanced run-local snapshot persistence with one writer and one coalesced latest obligation.
+*
+* @remarks
+* Normally composed by `WorkflowRunner.execute({ store })`; exported for hosts that need to
+* coordinate the same required boundaries around their own runner integration.
+*/
+var WorkflowPersistence = class {
+	#workflow;
+	#store;
+	#phases = /* @__PURE__ */ new Set();
+	#tasks = /* @__PURE__ */ new Set();
+	#onWorkflowChange;
+	#onWorkflowAdd;
+	#onWorkflowRemove;
+	#onPhaseChange;
+	#onPhaseAdd;
+	#onPhaseRemove;
+	#onTaskChange;
+	#writing;
+	#error;
+	#fault;
+	#attached = true;
+	#revision = 0;
+	#stored = 0;
+	constructor(workflow, store) {
+		this.#workflow = workflow;
+		this.#store = store;
+		this.#onWorkflowChange = this.#change.bind(this);
+		this.#onWorkflowAdd = this.#addPhase.bind(this);
+		this.#onWorkflowRemove = this.#removePhase.bind(this);
+		this.#onPhaseChange = this.#change.bind(this);
+		this.#onPhaseAdd = this.#addTask.bind(this);
+		this.#onPhaseRemove = this.#removeTask.bind(this);
+		this.#onTaskChange = this.#change.bind(this);
+		this.#attachWorkflow();
+	}
+	get fault() {
+		return this.#fault;
+	}
+	/**
+	* Persist every change through this required boundary.
+	*
+	* @param checkpoint - The boundary being made durable
+	* @param task - The task owning an attempt or settlement
+	* @param attempt - The persisted attempt number
+	* @returns Whether the latest state reached the store
+	*/
+	async checkpoint(checkpoint, task, attempt) {
+		const revision = this.#mark();
+		while (this.#stored < revision) await this.#flush();
+		if (this.#error === void 0) return true;
+		if (this.#fault === void 0) this.#fault = Object.freeze({
+			origin: "persistence",
+			checkpoint,
+			message: this.#error,
+			...task === void 0 ? {} : { task: task.id },
+			...attempt === void 0 ? {} : { attempt }
+		});
+		return false;
+	}
+	/**
+	* Stop observing the live tree and persist its final state.
+	*
+	* @returns Whether the final snapshot reached the store
+	*/
+	async finalize() {
+		this.detach();
+		return this.checkpoint("final");
+	}
+	/** Stop observing the live tree. */
+	detach() {
+		if (!this.#attached) return;
+		this.#attached = false;
+		this.#workflow.emitter.off("start", this.#onWorkflowChange);
+		this.#workflow.emitter.off("complete", this.#onWorkflowChange);
+		this.#workflow.emitter.off("fail", this.#onWorkflowChange);
+		this.#workflow.emitter.off("skip", this.#onWorkflowChange);
+		this.#workflow.emitter.off("stop", this.#onWorkflowChange);
+		this.#workflow.emitter.off("move", this.#onWorkflowChange);
+		this.#workflow.emitter.off("update", this.#onWorkflowChange);
+		this.#workflow.emitter.off("add", this.#onWorkflowAdd);
+		this.#workflow.emitter.off("remove", this.#onWorkflowRemove);
+		for (const phase of this.#phases) this.#detachPhase(phase);
+	}
+	#attachWorkflow() {
+		this.#workflow.emitter.on("start", this.#onWorkflowChange);
+		this.#workflow.emitter.on("complete", this.#onWorkflowChange);
+		this.#workflow.emitter.on("fail", this.#onWorkflowChange);
+		this.#workflow.emitter.on("skip", this.#onWorkflowChange);
+		this.#workflow.emitter.on("stop", this.#onWorkflowChange);
+		this.#workflow.emitter.on("move", this.#onWorkflowChange);
+		this.#workflow.emitter.on("update", this.#onWorkflowChange);
+		this.#workflow.emitter.on("add", this.#onWorkflowAdd);
+		this.#workflow.emitter.on("remove", this.#onWorkflowRemove);
+		for (const phase of this.#workflow.phases.phases()) this.#attachPhase(phase);
+	}
+	#attachPhase(phase) {
+		if (this.#phases.has(phase)) return;
+		this.#phases.add(phase);
+		phase.emitter.on("start", this.#onPhaseChange);
+		phase.emitter.on("complete", this.#onPhaseChange);
+		phase.emitter.on("fail", this.#onPhaseChange);
+		phase.emitter.on("skip", this.#onPhaseChange);
+		phase.emitter.on("stop", this.#onPhaseChange);
+		phase.emitter.on("move", this.#onPhaseChange);
+		phase.emitter.on("update", this.#onPhaseChange);
+		phase.emitter.on("add", this.#onPhaseAdd);
+		phase.emitter.on("remove", this.#onPhaseRemove);
+		for (const task of phase.tasks.tasks()) this.#attachTask(task);
+	}
+	#detachPhase(phase) {
+		if (!this.#phases.delete(phase)) return;
+		phase.emitter.off("start", this.#onPhaseChange);
+		phase.emitter.off("complete", this.#onPhaseChange);
+		phase.emitter.off("fail", this.#onPhaseChange);
+		phase.emitter.off("skip", this.#onPhaseChange);
+		phase.emitter.off("stop", this.#onPhaseChange);
+		phase.emitter.off("move", this.#onPhaseChange);
+		phase.emitter.off("update", this.#onPhaseChange);
+		phase.emitter.off("add", this.#onPhaseAdd);
+		phase.emitter.off("remove", this.#onPhaseRemove);
+		for (const task of phase.tasks.tasks()) this.#detachTask(task);
+	}
+	#attachTask(task) {
+		if (this.#tasks.has(task)) return;
+		this.#tasks.add(task);
+		task.emitter.on("start", this.#onTaskChange);
+		task.emitter.on("complete", this.#onTaskChange);
+		task.emitter.on("fail", this.#onTaskChange);
+		task.emitter.on("skip", this.#onTaskChange);
+		task.emitter.on("stop", this.#onTaskChange);
+		task.emitter.on("report", this.#onTaskChange);
+		task.emitter.on("pulse", this.#onTaskChange);
+	}
+	#detachTask(task) {
+		if (!this.#tasks.delete(task)) return;
+		task.emitter.off("start", this.#onTaskChange);
+		task.emitter.off("complete", this.#onTaskChange);
+		task.emitter.off("fail", this.#onTaskChange);
+		task.emitter.off("skip", this.#onTaskChange);
+		task.emitter.off("stop", this.#onTaskChange);
+		task.emitter.off("report", this.#onTaskChange);
+		task.emitter.off("pulse", this.#onTaskChange);
+	}
+	#addPhase(phase) {
+		this.#attachPhase(phase);
+		this.#change();
+	}
+	#removePhase(phase) {
+		this.#detachPhase(phase);
+		this.#change();
+	}
+	#addTask(task) {
+		this.#attachTask(task);
+		this.#change();
+	}
+	#removeTask(task) {
+		this.#detachTask(task);
+		this.#change();
+	}
+	#change() {
+		this.#mark();
+		this.#flush();
+	}
+	async #flush() {
+		if (this.#writing !== void 0) {
+			await this.#writing;
+			return;
+		}
+		const reservation = Promise.withResolvers();
+		const writing = reservation.promise;
+		this.#writing = writing;
+		this.#drain().then(reservation.resolve, reservation.reject);
+		try {
+			await writing;
+		} finally {
+			if (this.#writing === writing) this.#writing = void 0;
+			if (this.#stored < this.#revision) this.#flush();
+		}
+	}
+	async #drain() {
+		while (this.#stored < this.#revision) {
+			const revision = this.#revision;
+			try {
+				await this.#store.set(this.#workflow.snapshot());
+				this.#error = void 0;
+			} catch (error) {
+				this.#error = errorToMessage(error);
+			}
+			this.#stored = revision;
+		}
+	}
+	#mark() {
+		this.#revision += 1;
+		return this.#revision;
+	}
 };
 //#endregion
 //#region src/core/WorkflowRunner.ts
@@ -2294,21 +3427,21 @@ var TaskController = class {
 * - **Composes, never re-implements.** Per-phase bounded concurrency is one
 *   {@link createRunner} per phase (the substrate {@link RunnerInterface} over the workers
 *   `Queue`); `bail` maps onto that Runner's fail-fast vs settle-all; the run-level abort /
-*   timeout / budget / entity `signal` fold through {@link createAbort} / {@link createTimeout} +
-*   `AbortSignal.any` (exactly as the agent runtime folds its bounds); pacing is the shipped
+*   timeout / budget / entity `signal` fold through the `@orkestrel/abort` signal contract,
+*   {@link createTimeout}, and `AbortSignal.any` (exactly as the agent runtime folds its bounds);
+*   pacing is the shipped
 *   {@link SchedulerInterface}. The runner writes ZERO concurrency / retry / abort logic of
 *   its own — it only sequences phases, dispatches a task's own handler, and drives the live
-*   entity.
-* - **Pure engine — no registries, no tool/agent knowledge.** The runner carries no
-*   `functions` / `tools` / `agents` registry: each live {@link TaskInterface} already
+*   entity. The workflow layer owns per-task deadlines because timeout settlement must
+*   update the live leaf under the phase's `bail` policy before the substrate unit settles.
+* - **Pure engine — no integration registry.** The runner carries no behavior or provider
+*   registry: each live {@link TaskInterface} already
 *   resolved its own {@link import('./types.js').WorkflowFunction} into
 *   {@link import('./types.js').TaskInterface.handler} ONCE at construction (build, restore,
 *   or a live mint all resolve it identically, from {@link WorkflowOptions.functions}), so
-*   dispatch is simply "invoke the task's own handler". Static tool / agent calling is an
-*   OPT-IN concern of the `@orkestrel/tool` package's adapter factories — plain
-*   {@link import('./types.js').WorkflowFunction}s a caller wires into
-*   {@link WorkflowOptions.functions} like any other behavior. This module never imports
-*   any tool/agent package.
+*   dispatch is simply "invoke the task's own handler". Provider, protocol, and tool
+*   integrations remain application-owned {@link import('./types.js').WorkflowFunction}s
+*   composed into {@link WorkflowOptions.functions}. This module imports none of them.
 * - **Two `execute` forms, one engine.** `execute(definition, options)` BUILDS the live tree
 *   from a {@link WorkflowDefinition} (single source of truth for the `run` / `concurrency`
 *   metadata); `execute(workflow, options)` DRIVES a caller-owned, ALREADY-BUILT
@@ -2328,10 +3461,9 @@ var TaskController = class {
 *   for `spawn` to accept (the runner already drained) is swept `skip`ped afterward so the
 *   phase always reaches a coherent terminal state.
 * - **Dispatch by handler.** `#runTask` invokes the live task's own
-*   {@link import('./types.js').TaskInterface.handler} directly: `undefined` (an omitted `run`,
-*   or a `run` name absent from the {@link WorkflowOptions.functions} registry it was resolved
-*   against) AUTO-COMPLETES — the ROADMAP no-handler rule; otherwise the handler runs with the
-*   task's {@link import('./types.js').TaskControllerInterface} handle.
+*   {@link import('./types.js').TaskInterface.handler} directly. An omitted `run` deliberately
+*   auto-completes with JSON `null`; a present unresolved name is rejected by the synchronous
+*   execution claim and never false-completes.
 * - **`bail` → substrate.** Under `bail: true` (halt) a genuine task failure `fail`s the leaf
 *   THEN re-throws, so the substrate Runner fail-fasts — it aborts the in-flight siblings
 *   (their `controller.signal` fires; a mid-flight sibling `skip`s) and rejects the phase run;
@@ -2339,11 +3471,12 @@ var TaskController = class {
 *   Under `bail: false` (graceful) a failure `fail`s the leaf and RESOLVES (never throws), so
 *   the Runner settles every unit (allSettled) and the run finishes (the workflow derives
 *   `completed`, the failure recorded in the result tree).
-* - **Pause / stop / destroy gates.** `workflow.pause()` is honoured at exactly two points —
-*   the next phase boundary (workflow-only) and each task's own pre-dispatch (before
-*   `task.start()`, workflow gate FIRST then this task's own `phase.pause()`) — by parking on
-*   {@link WorkflowInterface.wait} / {@link PhaseInterface.wait}; an in-flight task body is
-*   NEVER suspended mid-flight. A GRACEFUL `workflow.stop()` (no signal involved) is caught at
+* - **Pause / stop / destroy gates.** Workflow, phase, and task gates are checked before
+*   dispatch, and a running handler can checkpoint their folded state through
+*   {@link import('./types.js').TaskControllerInterface.wait}. Because the substrate acquires
+*   concurrency before this handler gate, a paused task occupies one phase slot until resume;
+*   already-running siblings continue and its per-attempt timeout keeps counting. A GRACEFUL
+*   `workflow.stop()` (no signal involved) is caught at
 *   those same gates: not-yet-started work is `skip`ped, in-flight work finishes naturally. A
 *   HARD `workflow.destroy()` aborts {@link WorkflowInterface.signal}, which `#fold` has folded
 *   into the run's composed signal — so it cancels the active phase Runner (and every
@@ -2360,37 +3493,61 @@ var TaskController = class {
 *   {@link TaskController} signal `AbortSignal.any`-combines the substrate per-unit signal with
 *   `runSignal`, so a handler observes either cause directly.
 * - **Re-entrant-safe.** No shared per-run mutable field: the active-Runner holder is LOCAL to
-*   each `#execute`, so a nested `execute` (a bound workflow-tool handler re-entering this
-*   instance while the outer run is suspended awaiting it) cannot clobber the outer run's state.
+*   each `#execute`, so a nested application-level `execute` cannot clobber the outer run's
+*   state.
 */
-var WorkflowRunner = class {
+var WorkflowRunner = class WorkflowRunner {
+	static #executions = /* @__PURE__ */ new WeakSet();
 	#scheduler;
 	constructor(scheduler) {
 		this.#scheduler = scheduler;
 	}
 	execute(target, options) {
 		if (this.#isWorkflow(target)) {
-			if (target.status !== "pending" || target.destroyed) throw new WorkflowError("TRANSITION", `workflow '${target.id}' is not drivable`, {
-				id: target.id,
-				status: target.status,
-				destroyed: target.destroyed
-			});
-			return this.#execute(target, options);
+			const signal = options?.signal;
+			const timeout = options?.timeout;
+			const budget = options?.budget;
+			const store = options?.store;
+			this.#acquire(target);
+			return this.#execute(target, signal, timeout, budget, store);
 		}
-		const workflow = new Workflow(definitionToSnapshot(target, options?.bail ?? target.bail ?? false), options);
-		return this.#execute(workflow, options);
-	}
-	async #execute(workflow, options) {
-		const ms = options?.timeout;
-		const timeout = ms !== void 0 && ms > 0 ? createTimeout({ ms }) : void 0;
-		timeout?.start();
-		options?.budget?.start();
-		const runSignal = this.#fold(workflow, options, timeout);
+		const captured = captureWorkflowOptions(options);
+		const signal = options?.signal;
+		const timeout = options?.timeout;
+		const budget = options?.budget;
+		const store = options?.store;
+		const workflow = new Workflow(definitionToSnapshot(target, captured.bail ?? target.bail ?? false), captured);
+		this.#acquire(workflow);
+		return this.#execute(workflow, signal, timeout, budget, store);
+	}
+	#acquire(workflow) {
+		const tasks = workflow.phases.phases().flatMap((phase) => phase.tasks.tasks());
+		if (!((workflow.status === "pending" || workflow.status === "running") && tasks.every((task) => task.status !== "running") && (tasks.length === 0 || tasks.some((task) => task.status === "pending")) && hasWorkflowHandlers(workflow)) || workflow.destroyed || WorkflowRunner.#executions.has(workflow)) throw new WorkflowError("TRANSITION", `workflow '${workflow.id}' is not drivable`, {
+			id: workflow.id,
+			status: workflow.status,
+			destroyed: workflow.destroyed
+		});
+		WorkflowRunner.#executions.add(workflow);
+	}
+	async #execute(workflow, signal, ms, budget, store) {
 		const holder = { runner: void 0 };
-		const onCancel = this.#abortActive.bind(this, holder, runSignal);
-		if (runSignal.aborted) onCancel();
-		else runSignal.addEventListener("abort", onCancel, { once: true });
+		let timeout;
+		let persistence;
+		let runSignal;
+		let onCancel;
 		try {
+			timeout = ms !== void 0 && Number.isFinite(ms) && ms > 0 && ms <= 2147483647 ? createTimeout({ ms }) : void 0;
+			timeout?.start();
+			budget?.start();
+			runSignal = this.#fold(workflow, signal, budget, timeout);
+			persistence = store === void 0 ? void 0 : new WorkflowPersistence(workflow, store);
+			onCancel = this.#abortActive.bind(this, holder, runSignal);
+			if (runSignal.aborted) onCancel();
+			else runSignal.addEventListener("abort", onCancel, { once: true });
+			if (persistence !== void 0 && !await persistence.checkpoint("initial")) {
+				if (this.#stoppable(workflow)) workflow.stop();
+				this.#skipFrom(workflow.phases.phases(), 0);
+			}
 			let index = 0;
 			for (;;) {
 				const phases = workflow.phases.phases();
@@ -2404,36 +3561,53 @@ var WorkflowRunner = class {
 					this.#haltFrom(phases, index, workflow, runSignal);
 					break;
 				}
-				if (workflow.paused) await this.#raceWait(() => workflow.wait(), runSignal);
+				if (workflow.paused) await this.#raceWait(workflow.wait(), runSignal, void 0, workflow);
 				if (this.#cancelled(runSignal) || this.#halted(workflow)) {
 					this.#haltFrom(workflow.phases.phases(), index, workflow, runSignal);
 					break;
 				}
-				if (await this.#runPhase(workflow, phase, runSignal, holder)) {
+				if (phase.status === "skipped" || phase.status === "stopped") {
+					this.#skipFrom([phase], 0);
+					index += 1;
+					continue;
+				}
+				if (await this.#runPhase(workflow, phase, runSignal, holder, persistence)) {
 					this.#skipFrom(workflow.phases.phases(), index + 1);
 					break;
 				}
 				index += 1;
 				const remaining = workflow.phases.phases();
-				if (index < remaining.length && !this.#cancelled(runSignal)) try {
-					await this.#scheduler.yield({ signal: runSignal });
-				} catch (error) {
-					if (!runSignal.aborted) throw error;
-				}
+				if (index < remaining.length && !this.#cancelled(runSignal)) await this.#pace(runSignal);
 			}
 			if (this.#cancelled(runSignal)) this.#haltFrom(workflow.phases.phases(), 0, workflow, runSignal);
 			else if (this.#completable(workflow)) workflow.complete();
+			const durable = await persistence?.finalize();
 			return {
 				workflow,
 				status: workflow.status,
-				results: workflow.results()
+				results: workflow.results(),
+				...durable === void 0 ? {} : { durable },
+				...persistence?.fault === void 0 ? {} : { fault: persistence.fault }
 			};
+		} catch (error) {
+			if (this.#stoppable(workflow)) workflow.stop();
+			this.#skipFrom(workflow.phases.phases(), 0);
+			await persistence?.finalize();
+			throw error;
 		} finally {
+			persistence?.detach();
 			timeout?.clear();
-			runSignal.removeEventListener("abort", onCancel);
+			if (runSignal !== void 0 && onCancel !== void 0) runSignal.removeEventListener("abort", onCancel);
+		}
+	}
+	async #pace(signal) {
+		try {
+			await this.#scheduler.yield({ signal });
+		} catch (error) {
+			if (!signal.aborted) throw error;
 		}
 	}
-	async #runPhase(workflow, phase, runSignal, holder) {
+	async #runPhase(workflow, phase, runSignal, holder, persistence) {
 		const launched = /* @__PURE__ */ new Set();
 		const onAdd = this.#spawnAdded.bind(this, launched, holder);
 		phase.emitter.on("add", onAdd);
@@ -2444,10 +3618,12 @@ var WorkflowRunner = class {
 			const bail = phase.bail;
 			const concurrency = phase.concurrency !== void 0 && phase.concurrency > 0 ? phase.concurrency : DEFAULT_PHASE_CONCURRENCY;
 			const attempts = /* @__PURE__ */ new Map();
+			for (const task of tasks) attempts.set(task.id, task.attempts);
+			const owners = /* @__PURE__ */ new Map();
 			const created = new Runner({
 				concurrency,
 				entries: this.#entry.bind(this),
-				handler: this.#runUnit.bind(this, workflow, runSignal, bail, attempts)
+				handler: this.#runUnit.bind(this, workflow, runSignal, bail, attempts, owners, persistence)
 			});
 			holder.runner = created;
 			try {
@@ -2456,8 +3632,11 @@ var WorkflowRunner = class {
 			} catch {
 				return !this.#cancelled(runSignal);
 			} finally {
-				created.destroy();
-				holder.runner = void 0;
+				try {
+					await created.destroy();
+				} finally {
+					holder.runner = void 0;
+				}
 			}
 		} finally {
 			phase.emitter.off("add", onAdd);
@@ -2474,81 +3653,205 @@ var WorkflowRunner = class {
 		holder.runner?.spawn(task);
 	}
 	#entry(task) {
-		return {
-			...task.retries === void 0 ? {} : { retries: task.retries },
-			...task.timeout === void 0 ? {} : { timeout: task.timeout }
-		};
+		const retries = Math.max(0, (task.retries ?? 0) - task.attempts);
+		return retries === 0 ? {} : { retries };
 	}
-	#runUnit(workflow, runSignal, bail, attempts, controller) {
-		return this.#runTask(workflow, controller.input, controller, runSignal, bail, attempts);
+	#runUnit(workflow, runSignal, bail, attempts, owners, persistence, controller) {
+		return this.#runTask(workflow, controller.input, controller, runSignal, bail, attempts, owners, persistence);
 	}
-	async #runTask(workflow, task, controller, runSignal, bail, attempts) {
-		const signal = this.#taskSignal(controller.signal, runSignal);
+	async #runTask(workflow, task, controller, runSignal, bail, attempts, owners, persistence) {
 		const attempt = (attempts.get(task.id) ?? 0) + 1;
 		attempts.set(task.id, attempt);
 		const last = attempt > Math.max(0, task.retries ?? 0);
-		if (workflow.paused) await this.#raceWait(() => workflow.wait(), runSignal);
-		if (task.phase.paused) await this.#raceWait(() => task.phase.wait(), runSignal);
-		if (this.#skipping(controller, runSignal) || this.#halted(workflow)) {
-			this.#skipCancelled(task, workflow, runSignal);
-			return;
-		}
-		if (task.status === "pending") task.start();
-		if (this.#skipping(controller, runSignal) || this.#halted(workflow)) {
-			this.#skipCancelled(task, workflow, runSignal);
+		if (task.status !== "pending" && task.status !== "running") return;
+		if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+			this.#settleCancelled(task, workflow, runSignal);
 			return;
 		}
-		const handle = new TaskController(signal, task.snapshot().metadata, task.context, () => workflow.results());
+		const ms = task.timeout;
+		const deadline = ms !== void 0 && Number.isFinite(ms) && ms > 0 && ms <= 2147483647 ? createTimeout({ ms }) : void 0;
+		const signal = this.#taskSignal(task, controller.signal, runSignal, deadline);
 		try {
-			const value = task.handler === void 0 ? void 0 : await task.handler(handle);
-			if (task.status !== "running" || this.#skipping(controller, runSignal)) {
-				this.#skipCancelled(task, workflow, runSignal);
+			task.start();
+			if (task.attempts !== attempt) return;
+			owners.set(task.id, attempt);
+			deadline?.start();
+			const durable = persistence === void 0 ? true : await persistence.checkpoint("attempt", task, attempt);
+			if (!this.#owns(owners, task, attempt)) return;
+			if (!durable) {
+				if (this.#stoppable(workflow)) workflow.stop();
 				return;
 			}
-			if (signal.aborted) {
-				this.#timedOut(task, last);
+			if (task.run !== void 0 && task.handler === void 0) {
+				const error = new WorkflowError("TRANSITION", `task '${task.id}' has an unresolved run '${task.run}'`, {
+					task: task.id,
+					run: task.run
+				});
+				task.fail({
+					origin: "handler",
+					message: error.message
+				});
+				if (bail) throw error;
 				return;
 			}
-			task.complete(value);
-		} catch (error) {
-			if (task.status !== "running" || this.#skipping(controller, runSignal)) {
-				this.#skipCancelled(task, workflow, runSignal);
+			if (await this.#gate(workflow.paused ? workflow.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
+			if (await this.#gate(task.phase.paused ? task.phase.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
+			if (await this.#gate(task.paused ? task.wait() : void 0, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail)) return;
+			if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+				this.#settleCancelled(task, workflow, runSignal);
+				return;
+			}
+			if (task.status !== "running") return;
+			const handle = new TaskController(signal, task.snapshot().metadata, task, attempt, () => workflow.results(), (input) => this.#owns(owners, task, attempt) && !signal.aborted ? task.report(input) : failure(new WorkflowError("TRANSITION", `task '${task.id}' attempt '${attempt}' no longer owns activity`, {
+				task: task.id,
+				attempt
+			})), () => this.#owns(owners, task, attempt) && !signal.aborted && task.pulse());
+			let outcome;
+			try {
+				outcome = task.handler === void 0 ? [true, null] : await this.#raceHandler(Promise.resolve(task.handler(handle)), signal, this.#skipping.bind(this, task, controller, runSignal));
+			} catch (error) {
+				if (!this.#owns(owners, task, attempt)) return;
+				if (task.status !== "running" || this.#skipping(task, controller, runSignal)) {
+					this.#settleCancelled(task, workflow, runSignal);
+					return;
+				}
+				if (signal.aborted) {
+					this.#timedOut(owners, task, attempt, last, bail);
+					return;
+				}
+				this.#failed(owners, task, attempt, error, last, bail);
+				return;
+			}
+			if (!this.#owns(owners, task, attempt)) return;
+			if (!outcome[0]) {
+				this.#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, outcome[2]);
+				return;
+			}
+			if (task.status !== "running") return;
+			if (this.#skipping(task, controller, runSignal)) {
+				this.#settleCancelled(task, workflow, runSignal);
 				return;
 			}
 			if (signal.aborted) {
-				this.#timedOut(task, last);
+				this.#timedOut(owners, task, attempt, last, bail);
 				return;
 			}
-			if (!last) throw error;
-			task.fail(error);
-			if (bail) throw error;
+			if (!this.#owns(owners, task, attempt)) return;
+			try {
+				task.complete(outcome[1]);
+			} catch (error) {
+				if (!this.#owns(owners, task, attempt)) return;
+				if (task.status !== "running") throw error;
+				this.#failed(owners, task, attempt, error, last, bail);
+			}
+		} finally {
+			deadline?.clear();
+			if (persistence !== void 0 && this.#owns(owners, task, attempt) && isTerminalStatus(task.status) && !await persistence.checkpoint("settlement", task, attempt) && this.#stoppable(workflow)) workflow.stop();
+			this.#revoke(owners, task.id, attempt);
 		}
 	}
-	#timedOut(task, last) {
-		if (!last) return;
-		task.fail(/* @__PURE__ */ new Error(`task '${task.id}' timed out`));
+	async #gate(wait, task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail) {
+		const genuine = wait === void 0 ? void 0 : await this.#raceWait(wait, signal, this.#skipping.bind(this, task, controller, runSignal), workflow, task.phase);
+		return this.#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, genuine);
+	}
+	#settleAttempt(task, workflow, controller, runSignal, signal, attempts, owners, attempt, last, bail, genuine) {
+		if (attempts.get(task.id) !== attempt || !this.#owns(owners, task, attempt)) return true;
+		if (signal.aborted) {
+			if (genuine ?? this.#skipping(task, controller, runSignal)) this.#settleCancelled(task, workflow, runSignal);
+			else this.#timedOut(owners, task, attempt, last, bail);
+			return true;
+		}
+		if (this.#skipping(task, controller, runSignal) || this.#halted(workflow, task.phase)) {
+			this.#settleCancelled(task, workflow, runSignal);
+			return true;
+		}
+		return task.status !== "running";
+	}
+	async #raceHandler(handler, signal, cancelled) {
+		if (signal.aborted) return [
+			false,
+			void 0,
+			cancelled()
+		];
+		const deferred = Promise.withResolvers();
+		const onAbort = this.#resolveHandlerAbort.bind(this, deferred, cancelled);
+		signal.addEventListener("abort", onAbort, { once: true });
+		try {
+			return await Promise.race([handler.then((value) => [true, value]), deferred.promise]);
+		} finally {
+			signal.removeEventListener("abort", onAbort);
+		}
 	}
-	async #raceWait(wait, runSignal) {
-		if (runSignal.aborted) return;
-		let onAbort;
-		const cancelled = new Promise((resolve) => {
-			onAbort = resolve.bind(void 0, void 0);
-			runSignal.addEventListener("abort", onAbort, { once: true });
+	#resolveHandlerAbort(deferred, cancelled) {
+		deferred.resolve([
+			false,
+			void 0,
+			cancelled()
+		]);
+	}
+	#timedOut(owners, task, attempt, last, bail) {
+		if (!this.#owns(owners, task, attempt)) return;
+		const error = /* @__PURE__ */ new Error(`task '${task.id}' timed out`);
+		if (last) task.fail({
+			origin: "timeout",
+			message: error.message
 		});
+		if (!last || bail) throw error;
+	}
+	#failed(owners, task, attempt, error, last, bail) {
+		if (!this.#owns(owners, task, attempt)) return;
+		if (!last) throw error;
+		task.fail({
+			origin: "handler",
+			message: errorToMessage(error)
+		});
+		if (bail) throw error;
+	}
+	#owns(owners, task, attempt) {
+		return owners.get(task.id) === attempt && task.attempts === attempt;
+	}
+	#revoke(owners, id, attempt) {
+		if (owners.get(id) === attempt) owners.delete(id);
+	}
+	async #raceWait(wait, signal, cancelled, workflow, phase) {
+		if (signal.aborted) return cancelled?.();
+		const deferred = Promise.withResolvers();
+		const onAbort = this.#resolveWaitAbort.bind(this, deferred, cancelled);
+		const onTerminal = this.#resolveWaitAbort.bind(this, deferred, void 0);
+		signal.addEventListener("abort", onAbort, { once: true });
+		workflow?.emitter.on("skip", onTerminal);
+		workflow?.emitter.on("stop", onTerminal);
+		phase?.emitter.on("skip", onTerminal);
+		phase?.emitter.on("stop", onTerminal);
 		try {
-			await Promise.race([wait(), cancelled]);
+			if (workflow !== void 0 && this.#halted(workflow, phase)) deferred.resolve(void 0);
+			const outcome = await Promise.race([wait, deferred.promise]);
+			return typeof outcome === "boolean" ? outcome : void 0;
 		} finally {
-			if (onAbort !== void 0) runSignal.removeEventListener("abort", onAbort);
+			signal.removeEventListener("abort", onAbort);
+			workflow?.emitter.off("skip", onTerminal);
+			workflow?.emitter.off("stop", onTerminal);
+			phase?.emitter.off("skip", onTerminal);
+			phase?.emitter.off("stop", onTerminal);
 		}
 	}
-	#taskSignal(unitSignal, runSignal) {
-		return AbortSignal.any([unitSignal, runSignal]);
+	#resolveWaitAbort(deferred, cancelled) {
+		deferred.resolve(cancelled?.());
+	}
+	#taskSignal(task, unitSignal, runSignal, timeout) {
+		const signals = [
+			task.signal,
+			unitSignal,
+			runSignal
+		];
+		if (timeout !== void 0) signals.push(timeout.signal);
+		return AbortSignal.any(signals);
 	}
-	#fold(workflow, options, timeout) {
+	#fold(workflow, signal, budget, timeout) {
 		const signals = [workflow.signal];
-		if (options?.signal !== void 0) signals.push(options.signal);
+		if (signal !== void 0) signals.push(signal);
 		if (timeout !== void 0) signals.push(timeout.signal);
-		if (options?.budget !== void 0) signals.push(options.budget.signal);
+		if (budget !== void 0) signals.push(budget.signal);
 		return signals.length === 1 ? workflow.signal : AbortSignal.any(signals);
 	}
 	#haltFrom(phases, index, workflow, runSignal) {
@@ -2562,22 +3865,22 @@ var WorkflowRunner = class {
 			for (const task of phase.tasks.tasks()) this.#skip(task);
 		}
 	}
-	#skipCancelled(task, workflow, runSignal) {
+	#settleCancelled(task, workflow, runSignal) {
 		if (this.#cancelled(runSignal) && this.#stoppable(workflow)) workflow.stop();
 		this.#skip(task);
 	}
 	#skip(task) {
 		if (task.status === "pending" || task.status === "running") task.skip();
 	}
-	#skipping(controller, runSignal) {
-		return controller.aborted || runSignal.aborted;
+	#skipping(task, controller, runSignal) {
+		return task.signal.aborted || controller.aborted || runSignal.aborted;
 	}
 	#cancelled(runSignal) {
 		return runSignal.aborted;
 	}
-	#halted(workflow) {
+	#halted(workflow, phase) {
 		const status = workflow.status;
-		return status === "failed" || status === "skipped" || status === "stopped";
+		return status === "failed" || status === "skipped" || status === "stopped" || phase?.status === "skipped" || phase?.status === "stopped";
 	}
 	#stoppable(workflow) {
 		const status = workflow.status;
@@ -2611,7 +3914,7 @@ var WorkflowRunner = class {
 *
 * @example
 * ```ts
-* import { createWorkflowContract } from '@src/core'
+* import { createWorkflowContract } from '@orkestrel/workflow'
 *
 * const contract = createWorkflowContract()
 * const definition = contract.generate()       // a valid WorkflowDefinition
@@ -2640,8 +3943,8 @@ function createWorkflowContract() {
 *
 * `options.functions` is the {@link import('./types.js').WorkflowFunctions} registry each live
 * task's `run` name resolves against ONCE at construction into its runtime
-* {@link import('./types.js').TaskInterface.handler} — a name omitted or absent from the
-* registry resolves to no handler (the no-handler rule).
+* {@link import('./types.js').TaskInterface.handler}. An omitted name is the deliberate no-op;
+* an unresolved present name remains inspectable but is rejected if execution is attempted.
 *
 * @param definition - The workflow definition to bring to life
 * @param options - Runtime options (initial listeners, `bail` override, per-node options)
@@ -2649,7 +3952,7 @@ function createWorkflowContract() {
 *
 * @example
 * ```ts
-* import { createWorkflow } from '@src/core'
+* import { createWorkflow } from '@orkestrel/workflow'
 *
 * const workflow = createWorkflow(definition, { on: { complete: () => done() } })
 * const phase = workflow.phase('phase-build')
@@ -2657,7 +3960,8 @@ function createWorkflowContract() {
 * ```
 */
 function createWorkflow(definition, options) {
-	return new Workflow(definitionToSnapshot(definition, options?.bail ?? definition.bail ?? false), options);
+	const captured = captureWorkflowOptions(options);
+	return new Workflow(definitionToSnapshot(definition, captured.bail ?? definition.bail ?? false), captured);
 }
 /**
 * Rebuild an equivalent live W-b entity tree from a {@link WorkflowSnapshot} — the
@@ -2675,6 +3979,9 @@ function createWorkflow(definition, options) {
 * still wins when supplied (to deliberately re-run under a different policy). A structurally
 * invalid snapshot (a status — or override — outside the lifecycle vocabulary, or a
 * non-boolean `bail`) throws a `RESTORE` {@link WorkflowError}.
+* Runtime handlers are optional: without a matching `functions` entry, a persisted `run`
+* remains visible with an undefined `handler` so the exact state is inspectable. The runner
+* rejects that unresolved tree if execution is attempted.
 *
 * @param snapshot - The snapshot to restore (carries its own `bail` + `override`)
 * @param options - Runtime options (initial listeners, an optional `bail` override, per-node options)
@@ -2682,15 +3989,35 @@ function createWorkflow(definition, options) {
 *
 * @example
 * ```ts
-* import { restoreWorkflow } from '@src/core'
+* import { restoreWorkflow } from '@orkestrel/workflow'
 *
 * const restored = restoreWorkflow(workflow.snapshot()) // bail comes from the snapshot
 * restored.status === workflow.status // true
 * ```
 */
 function restoreWorkflow(snapshot, options) {
-	assertSnapshot(snapshot);
-	return new Workflow(snapshot, options);
+	const captured = captureWorkflowOptions(options);
+	return new Workflow(cloneWorkflowSnapshot(snapshot), captured);
+}
+/**
+* Rebuild an interrupted workflow at its remaining retry budget.
+*
+* @remarks
+* Each phase captures every unique initial `run` binding once before constructing tasks. Recovery
+* validates those live tasks' captured callable handlers without rereading the registry, while the
+* retained registry identity remains available to resolve future live additions at their mint time.
+*
+* @param snapshot - The hostile persisted snapshot
+* @param options - Runtime handlers and entity options
+* @returns A recoverable live workflow
+*/
+function recoverWorkflow(snapshot, options) {
+	const captured = captureWorkflowOptions(options);
+	const owned = cloneWorkflowSnapshot(snapshot);
+	if (owned.override !== void 0 || owned.phases.some((phase) => phase.override !== void 0)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has a terminal override`, { workflow: owned.id });
+	const workflow = new Workflow(cloneWorkflowSnapshot(recoverWorkflowSnapshot(owned)), captured);
+	if (!hasWorkflowHandlers(workflow)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has an unresolved run`, { workflow: owned.id });
+	return workflow;
 }
 /**
 * Assert that a {@link WorkflowSnapshot} carries a `boolean` `bail` — at the workflow tier AND
@@ -2713,54 +4040,7 @@ function restoreWorkflow(snapshot, options) {
 * @param snapshot - The snapshot to validate
 */
 function assertSnapshot(snapshot) {
-	if (typeof snapshot.bail !== "boolean") throw new WorkflowError("RESTORE", `workflow '${snapshot.id}' has a non-boolean bail`, {
-		workflow: snapshot.id,
-		bail: snapshot.bail
-	});
-	if (!WORKFLOW_STATUSES.includes(snapshot.status)) throw new WorkflowError("RESTORE", `workflow '${snapshot.id}' has an invalid status`, {
-		workflow: snapshot.id,
-		status: snapshot.status
-	});
-	if (snapshot.override !== void 0 && !WORKFLOW_STATUSES.includes(snapshot.override)) throw new WorkflowError("RESTORE", `workflow '${snapshot.id}' has an invalid override`, {
-		workflow: snapshot.id,
-		override: snapshot.override
-	});
-	for (const phase of snapshot.phases) {
-		if (typeof phase.bail !== "boolean") throw new WorkflowError("RESTORE", `phase '${phase.id}' has a non-boolean bail`, {
-			phase: phase.id,
-			bail: phase.bail
-		});
-		if (!PHASE_STATUSES.includes(phase.status)) throw new WorkflowError("RESTORE", `phase '${phase.id}' has an invalid status`, {
-			phase: phase.id,
-			status: phase.status
-		});
-		if (phase.override !== void 0 && !PHASE_STATUSES.includes(phase.override)) throw new WorkflowError("RESTORE", `phase '${phase.id}' has an invalid override`, {
-			phase: phase.id,
-			override: phase.override
-		});
-		if (phase.concurrency !== void 0 && (!Number.isInteger(phase.concurrency) || phase.concurrency < 1)) throw new WorkflowError("RESTORE", `phase '${phase.id}' has an invalid concurrency`, {
-			phase: phase.id,
-			concurrency: phase.concurrency
-		});
-		for (const task of phase.tasks) {
-			if (!TASK_STATUSES.includes(task.status)) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid status`, {
-				task: task.id,
-				status: task.status
-			});
-			if (task.run !== void 0 && task.run.length < 1) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid run`, {
-				task: task.id,
-				run: task.run
-			});
-			if (task.retries !== void 0 && (!Number.isInteger(task.retries) || task.retries < 0)) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid retries`, {
-				task: task.id,
-				retries: task.retries
-			});
-			if (task.timeout !== void 0 && (!Number.isInteger(task.timeout) || task.timeout < 0)) throw new WorkflowError("RESTORE", `task '${task.id}' has an invalid timeout`, {
-				task: task.id,
-				timeout: task.timeout
-			});
-		}
-	}
+	cloneWorkflowSnapshot(snapshot);
 }
 /**
 * Create the in-memory durable {@link WorkflowStoreInterface} — a process-lifetime
@@ -2769,7 +4049,7 @@ function assertSnapshot(snapshot) {
 *
 * @remarks
 * The snapshot analogue of the server package's `createMemorySessionStore`
-* (and the {@link createMemoryQueueStore} family), but LEANER — there is no idle-TTL, so no
+* (and the `createMemoryQueueStore` family), but LEANER — there is no idle-TTL, so no
 * options bag (AGENTS §21 minimal): a persisted run-state lives until an explicit `delete`. This is
 * the zero-plumbing DEFAULT (a plain `Map`); its driver-pluggable twin is
 * {@link createDatabaseWorkflowStore} (the snapshot as one opaque JSON column over a `databases`
@@ -2781,7 +4061,7 @@ function assertSnapshot(snapshot) {
 *
 * @example
 * ```ts
-* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createMemoryWorkflowStore()
 * const workflow = createWorkflow(definition)
@@ -2801,7 +4081,7 @@ function createMemoryWorkflowStore() {
 * @remarks
 * Builds a one-table database (`snapshots`, keyed by `id`) over the supplied driver, the snapshot
 * held as ONE OPAQUE JSON COLUMN — the column map is `{ id; snapshot }` where `snapshot` is a
-* `rawShape` (a JSON blob), exactly as {@link createDatabaseQueueStore} stores its `input`. The
+* `rawShape` (a JSON blob), exactly as `createDatabaseQueueStore` stores its `input`. The
 * snapshot is already a COMPLETE, self-contained, pure-JSON payload, so storing it whole is lossless
 * AND keeps the row type FLAT — a structured multi-column snapshot table would force the contract to
 * `Infer` the deeply-nested snapshot shape (workflow → phases → tasks → results) and trip TS2589;
@@ -2817,7 +4097,8 @@ function createMemoryWorkflowStore() {
 *
 * @example
 * ```ts
-* import { createDatabaseWorkflowStore, createMemoryDriver, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryDriver } from '@orkestrel/database'
+* import { createDatabaseWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createDatabaseWorkflowStore(createMemoryDriver()) // a durable driver swaps in here
 * const workflow = createWorkflow(definition)
@@ -2827,12 +4108,13 @@ function createMemoryWorkflowStore() {
 * ```
 */
 function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
+	const columns = {
+		id: stringShape(),
+		snapshot: rawShape({})
+	};
 	return new DatabaseWorkflowStore(createDatabase({
 		driver,
-		tables: { snapshots: {
-			id: stringShape(),
-			snapshot: rawShape({})
-		} }
+		tables: { snapshots: columns }
 	}).table("snapshots"));
 }
 /**
@@ -2842,7 +4124,7 @@ function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
 *
 * @remarks
 * The runner is a PURE engine — it re-implements no concurrency / retry / abort logic, AND it
-* carries no `functions` / `tools` / `agents` registry of its own: each live task already
+* carries no behavior or provider registry of its own: each live task already
 * resolved its own {@link import('./types.js').WorkflowFunction} into
 * {@link import('./types.js').TaskInterface.handler} ONCE at construction, from the
 * {@link WorkflowOptions.functions} registry supplied to `execute` / {@link createWorkflow}.
@@ -2856,11 +4138,10 @@ function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
 * the live entity (`start` → `complete` / `fail`), and resolves a
 * {@link import('./types.js').WorkflowResult}.
 *
-* Static tool / agent calling is OPT-IN: a caller wires a plain
-* {@link import('./types.js').WorkflowFunction} into its OWN {@link WorkflowOptions.functions}
-* registry, same as any other behavior — the `@orkestrel/tool` package ships the
-* tool/agent adapter factories for that. A task with no resolved handler AUTO-COMPLETES
-* (the ROADMAP no-handler rule).
+* External integrations remain application-owned: a caller wires an ordinary
+* {@link import('./types.js').WorkflowFunction} into its own {@link WorkflowOptions.functions}
+* registry. Only a task that omits `run` auto-completes; unresolved named work is rejected
+* before dispatch.
 *
 * @param options - An optional pacing `scheduler` (default the shipped cross-environment one).
 *   See {@link WorkflowRunnerOptions}.
@@ -2868,7 +4149,7 @@ function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
 *
 * @example
 * ```ts
-* import { createWorkflowRunner } from '@src/core'
+* import { createWorkflowRunner } from '@orkestrel/workflow'
 *
 * const runner = createWorkflowRunner()
 * const definition = { id: 'w', name: 'W', phases: [{ id: 'p', name: 'P', tasks: [
@@ -2904,7 +4185,7 @@ function createWorkflowRunner(options) {
 *
 * @example
 * ```ts
-* import { createMemoryWorkflowStore, createWorkflowManager } from '@src/core'
+* import { createMemoryWorkflowStore, createWorkflowManager } from '@orkestrel/workflow'
 *
 * const manager = createWorkflowManager({
 * 	store: createMemoryWorkflowStore(),
@@ -2927,7 +4208,8 @@ function createWorkflowManager(options) {
 * `yield()` gives the host a turn via a zero-delay macrotask (so pending I/O,
 * timers, and rendering actually run — a microtask would not); `delay(ms)` resumes
 * after at least `ms`. Pass `options.signal` to make a pending yield/delay reject
-* with the signal's `reason` on abort (with full timer/listener cleanup).
+* with the signal's exact `reason`; the shared owned-signal lifecycle clears the timer
+* without invoking caller-owned listener methods.
 * `options.priority` is accepted for contract compliance but treated uniformly by
 * this default — environment backends honour it.
 *
@@ -2935,7 +4217,8 @@ function createWorkflowManager(options) {
 *
 * @example
 * ```ts
-* import { createAbort, createScheduler } from '@src/core'
+* import { createAbort } from '@orkestrel/abort'
+* import { createScheduler } from '@orkestrel/workflow'
 *
 * const abort = createAbort()
 * const scheduler = createScheduler()
@@ -2949,7 +4232,7 @@ function createWorkflowManager(options) {
 *
 * @example
 * ```ts
-* import { createScheduler } from '@src/core'
+* import { createScheduler } from '@orkestrel/workflow'
 *
 * // A backoff: wait a growing interval between retries.
 * const scheduler = createScheduler()
@@ -2991,7 +4274,7 @@ function createScheduler() {
 *
 * @example
 * ```ts
-* import { createRunner } from '@src/core'
+* import { createRunner } from '@orkestrel/workflow'
 *
 * // A handler that fans out one sibling per declared unit, then returns its own value.
 * const runner = createRunner<number, number>({
@@ -3010,6 +4293,6 @@ function createRunner(options) {
 	return new Runner(options);
 }
 //#endregion
-export { Controller, DEFAULT_BAIL, DEFAULT_PHASE_CONCURRENCY, DatabaseWorkflowStore, MemoryWorkflowStore, PHASE_STATUSES, Phase, PhaseManager, Runner, Scheduler, TASK_STATUSES, TASK_TRANSITIONS, TERMINAL_TASK_STATUSES, Task, TaskController, TaskManager, WORKFLOW_STATUSES, Workflow, WorkflowError, WorkflowManager, WorkflowRunner, assertSnapshot, buildPhaseContext, buildTaskContext, buildWorkflowContext, canTransitionTask, collectResults, createDatabaseWorkflowStore, createDeferred, createMemoryWorkflowStore, createRunner, createScheduler, createWorkflow, createWorkflowContract, createWorkflowManager, createWorkflowRunner, definitionToSnapshot, deriveBoundary, derivePhaseStatus, deriveWorkflowStatus, failure, findFailure, insertEntry, isTerminalStatus, isWorkflowError, isWorkflowSnapshot, moveEntry, parkSignal, phaseDefinitionToSnapshot, phaseShape, phaseUpdateShape, restoreWorkflow, success, taskDefinitionToSnapshot, taskShape, taskUpdateShape, workflowShape };
+export { Controller, DEFAULT_BAIL, DEFAULT_PHASE_CONCURRENCY, DatabaseWorkflowStore, MAX_TIMER_MS, MemoryWorkflowStore, PHASE_STATUSES, Phase, PhaseManager, Runner, Scheduler, TASK_STATUSES, TASK_TRANSITIONS, TERMINAL_TASK_STATUSES, Task, TaskController, TaskManager, WORKFLOW_STATUSES, Workflow, WorkflowError, WorkflowManager, WorkflowPersistence, WorkflowRunner, assertSnapshot, buildPhaseContext, buildTaskContext, buildWorkflowContext, canTransitionTask, captureWorkflowOptions, cloneTaskActivity, cloneWorkflowSnapshot, collectResults, createDatabaseWorkflowStore, createDeferred, createMemoryWorkflowStore, createRunner, createScheduler, createWorkflow, createWorkflowContract, createWorkflowManager, createWorkflowRunner, definitionToSnapshot, deriveBoundary, derivePhaseStatus, deriveWorkflowStatus, errorToMessage, failure, findFailure, hasWorkflowHandlers, insertEntry, isLifecycleStatus, isOwnedWorkflowSnapshot, isTaskActivity, isTaskActivityInput, isTaskFailure, isTaskResult, isTerminalStatus, isWorkflowError, isWorkflowSnapshot, matchesDescription, moveEntry, parkSignal, phaseDefinitionToSnapshot, phaseShape, phaseUpdateShape, recoverWorkflow, recoverWorkflowSnapshot, resolveTaskSilence, restoreWorkflow, scheduleHost, success, taskDefinitionToSnapshot, taskShape, taskUpdateShape, workflowShape, workflowSnapshotContext };
 
 //# sourceMappingURL=index.js.map