@orkestrel/workflow 0.0.8 → 0.0.10

package/dist/src/core/index.js

@@ -1,83 +1,9 @@
-import { arrayShape, attempt, cloneJSONRecord, cloneJSONValue, compileGuard, createContract, integerShape, isArray, isBoolean, isContractError, isFiniteNumber, isInteger, isJSONValue, isNonEmptyString, isRecord, literalShape, objectShape, optionalShape, rawShape, stringShape } from "@orkestrel/contract";
+import { createAbort, linkSignal } from "@orkestrel/abort";
+import { arrayShape, attempt, cloneJSONRecord, cloneJSONValue, compileGuard, createContract, integerShape, isArray, isBoolean, isContractError, isFiniteNumber, isFunction, isInteger, isJSONValue, isNonEmptyString, isRecord, literalShape, objectShape, optionalShape, rawShape, stringShape } from "@orkestrel/contract";
 import { createDatabase, createMemoryDriver } from "@orkestrel/database";
-import { createAbort } from "@orkestrel/abort";
 import { Emitter } from "@orkestrel/emitter";
 import { createTimeout } from "@orkestrel/timeout";
 import { createQueue } from "@orkestrel/queue";
-//#region src/core/Scheduler.ts
-/**
-* The safe cross-environment cooperative-yield default — a {@link SchedulerInterface}
-* built on `setTimeout` / `clearTimeout` alone, so it runs unchanged in both the
-* browser and Node.
-*
-* @remarks
-* - **Cross-environment.** Uses ONLY `setTimeout` / `clearTimeout` — universally
-*   available. It deliberately avoids env-specific fast paths (`setImmediate`,
-*   `scheduler.yield`, `requestAnimationFrame`, `node:timers/promises`,
-*   `MessageChannel`); those belong to the environment backends, built with the
-*   agent loop that consumes them.
-* - **`yield` is a macrotask host-turn, not a microtask.** `yield()` waits on a
-*   `setTimeout(0)`, NOT `queueMicrotask`. A microtask drains before the host
-*   regains control, so it would not actually let pending I/O, timers, or
-*   rendering run — it only defers within the current task. A zero-delay timer is
-*   the correct cross-environment "give the host a turn".
-* - **Abort-aware.** A pending `yield` / `delay` rejects with `signal.reason` when
-*   the signal aborts (the standard `AbortSignal` convention). An already-aborted
-*   signal rejects immediately without arming a timer. Either settle path clears
-*   the timer and removes the abort listener — no leaked timer, no leaked
-*   listener, and no double-settle.
-* - **Priority is accepted but uniform.** `options.priority` is part of the
-*   contract, but a `setTimeout`-based default cannot act on urgency, so it treats
-*   every priority the same. Environment backends honour it.
-* - **Event-free.** A pure functional primitive — no Emitter, no events.
-*
-* @example
-* ```ts
-* const scheduler = new Scheduler()
-* while (!signal.aborted) {
-* 	doSomeWork()
-* 	await scheduler.yield({ signal }) // let the host run between work units
-* }
-* ```
-*/
-var Scheduler = class {
-	/**
-	* Yield control back to the host so other tasks (I/O, timers, rendering) can
-	* run, then resume — a macrotask turn via `setTimeout(0)` (NOT a microtask,
-	* which would resume before the host regains control).
-	*/
-	yield(options) {
-		return this.#sleep(0, options?.signal);
-	}
-	/**
-	* Resume after at least `ms` milliseconds; abort rejects with `signal.reason`.
-	*
-	* @remarks
-	* `ms` should be a non-negative finite number. The primitive stays minimal and
-	* does no validation: it passes `ms` straight to the host `setTimeout`, which
-	* clamps a negative value or `NaN` to ~0 — so an out-of-domain `ms` resolves on
-	* the next host turn rather than throwing.
-	*/
-	delay(ms, options) {
-		return this.#sleep(ms, options?.signal);
-	}
-	#sleep(ms, signal) {
-		if (signal?.aborted === true) return Promise.reject(signal.reason);
-		return new Promise((resolve, reject) => {
-			const handle = setTimeout(() => {
-				signal?.removeEventListener("abort", onAbort);
-				resolve();
-			}, ms);
-			const onAbort = this.#abort.bind(this, handle, reject, signal);
-			signal?.addEventListener("abort", onAbort, { once: true });
-		});
-	}
-	#abort(handle, reject, signal) {
-		clearTimeout(handle);
-		reject(signal?.reason);
-	}
-};
-//#endregion
 //#region src/core/constants.ts
 /** The default {@link import('./types.js').WorkflowDefinition.bail} — graceful (continue on a leaf failure). */
 var DEFAULT_BAIL = false;
@@ -183,50 +109,42 @@ var DEFAULT_PHASE_CONCURRENCY = 1024;
 */
 var MAX_TIMER_MS = 2147483647;
 //#endregion
-//#region src/core/errors.ts
+//#region src/core/helpers.ts
 /**
-* An error raised by the workflow runtime.
+* Capture every top-level {@link WorkflowOptions} value exactly once into an owned plain bag.
 *
 * @remarks
-* Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
-* offending node id / status. Raised for an illegal lifecycle transition
-* (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
-* boundary (`RESTORE`), or a refused structural/activity edit (`MUTATION`).
-*/
-var WorkflowError = class extends Error {
-	code;
-	context;
-	constructor(code, message, context) {
-		super(message);
-		this.name = "WorkflowError";
-		this.code = code;
-		if (context !== void 0) this.context = context;
-	}
-};
-/**
-* Narrow an unknown caught value to a {@link WorkflowError}.
+* Direct property reads preserve inherited and non-enumerable option values while preventing
+* accessor-backed caller bags from shifting policy, handlers, hooks, or nested options between
+* construction stages. Nested bags and the functions registry retain their original identities so
+* entity constructors can snapshot keyed child options and live additions can resolve against the
+* same registry.
 *
-* @param value - The value to test (typically a `catch` binding)
-* @returns `true` when `value` is a {@link WorkflowError}
+* @param options - The caller-owned workflow construction options
+* @returns An owned top-level options bag containing the captured values
 *
 * @example
 * ```ts
-* try {
-* 	task.complete('done')
-* } catch (error) {
-* 	if (isWorkflowError(error) && error.code === 'TRANSITION') retry()
-* }
+* const captured = captureWorkflowOptions(options)
+* const workflow = createWorkflow(definition, captured)
 * ```
 */
-function isWorkflowError(value) {
-	try {
-		return value instanceof WorkflowError;
-	} catch {
-		return false;
-	}
+function captureWorkflowOptions(options) {
+	const on = options?.on;
+	const bail = options?.bail;
+	const error = options?.error;
+	const phases = options?.phases;
+	const functions = options?.functions;
+	const silence = options?.silence;
+	return Object.freeze({
+		...on === void 0 ? {} : { on },
+		...bail === void 0 ? {} : { bail },
+		...error === void 0 ? {} : { error },
+		...phases === void 0 ? {} : { phases },
+		...functions === void 0 ? {} : { functions },
+		...silence === void 0 ? {} : { silence }
+	});
 }
-//#endregion
-//#region src/core/helpers.ts
 /**
 * Test whether a {@link LifecycleStatus} is TERMINAL — a node in this state will not
 * transition further.
@@ -750,6 +668,61 @@ function createDeferred() {
 	return Promise.withResolvers();
 }
 /**
+* Schedule one cancellable host operation behind an owned settlement signal.
+*
+* @remarks
+* The completion and failure paths each own an {@link AbortController}; their native composite is
+* linked to the optional caller signal before `start` can arm host work. Scheduler backends attach
+* only to that safe composite, so caller mutation of `addEventListener` or `removeEventListener`
+* cannot strand the operation. The first completion resolves, the first host failure rejects with
+* its exact value, and caller abort rejects with its exact linked reason. Caller abort and host
+* failure cancel an armed handle; synchronous settlement also cancels the handle immediately after
+* `start` returns it. Cancellation is secondary cleanup: if its closure throws, the already-winning
+* completion, exact host failure, or exact caller reason still settles without escape or replacement.
+*
+* @param start - Arm host work and return its cancellation closure
+* @param signal - Optional caller cancellation signal
+* @returns A promise settled exactly once by completion, host failure, or caller abort
+*/
+function scheduleHost(start, signal) {
+	const completion = new AbortController();
+	const failed = new AbortController();
+	let settled;
+	try {
+		settled = linkSignal(AbortSignal.any([completion.signal, failed.signal]), signal);
+	} catch (error) {
+		return Promise.reject(error);
+	}
+	if (settled.aborted) return Promise.reject(settled.reason);
+	return new Promise((resolve, reject) => {
+		let cancel;
+		let hostFailure;
+		settled.addEventListener("abort", () => {
+			if (completion.signal.aborted) {
+				resolve();
+				return;
+			}
+			const reason = failed.signal.aborted ? hostFailure : settled.reason;
+			try {
+				cancel?.();
+			} catch {}
+			reject(reason);
+		}, { once: true });
+		try {
+			cancel = start(() => completion.abort(), (error) => {
+				hostFailure = error;
+				failed.abort();
+			});
+		} catch (error) {
+			hostFailure = error;
+			failed.abort();
+		}
+		if (settled.aborted) try {
+			cancel?.();
+		} catch {}
+	});
+}
+/**
 * Park until `signal` aborts — a promise-parked wait (AGENTS §21), never a timer or
 * busy-loop, that NEVER rejects.
 *
@@ -777,6 +750,113 @@ function parkSignal(signal) {
 	});
 }
 //#endregion
+//#region src/core/Scheduler.ts
+/**
+* The safe cross-environment cooperative-yield default — a {@link SchedulerInterface}
+* built on `setTimeout` / `clearTimeout` alone, so it runs unchanged in both the
+* browser and Node.
+*
+* @remarks
+* - **Cross-environment.** Uses ONLY `setTimeout` / `clearTimeout` — universally
+*   available. It deliberately avoids env-specific fast paths (`setImmediate`,
+*   `scheduler.yield`, `requestAnimationFrame`, `node:timers/promises`,
+*   `MessageChannel`); those belong to the environment backends, built with the
+*   agent loop that consumes them.
+* - **`yield` is a macrotask host-turn, not a microtask.** `yield()` waits on a
+*   `setTimeout(0)`, NOT `queueMicrotask`. A microtask drains before the host
+*   regains control, so it would not actually let pending I/O, timers, or
+*   rendering run — it only defers within the current task. A zero-delay timer is
+*   the correct cross-environment "give the host a turn".
+* - **Abort-aware.** A pending `yield` / `delay` rejects with `signal.reason` exactly.
+*   {@link scheduleHost} links an owned settlement composite to the caller before arming
+*   the timer, so pre-abort schedules nothing, caller signal method mutation is harmless,
+*   cancellation clears the handle, and native first-settlement wins exactly once.
+* - **Priority is accepted but uniform.** `options.priority` is part of the
+*   contract, but a `setTimeout`-based default cannot act on urgency, so it treats
+*   every priority the same. Environment backends honour it.
+* - **Event-free.** A pure functional primitive — no Emitter, no events.
+*
+* @example
+* ```ts
+* const scheduler = new Scheduler()
+* while (!signal.aborted) {
+* 	doSomeWork()
+* 	await scheduler.yield({ signal }) // let the host run between work units
+* }
+* ```
+*/
+var Scheduler = class {
+	/**
+	* Yield control back to the host so other tasks (I/O, timers, rendering) can
+	* run, then resume — a macrotask turn via `setTimeout(0)` (NOT a microtask,
+	* which would resume before the host regains control).
+	*/
+	yield(options) {
+		return this.#sleep(0, options?.signal);
+	}
+	/**
+	* Resume after at least `ms` milliseconds; abort rejects with `signal.reason`.
+	*
+	* @remarks
+	* `ms` should be a non-negative finite number. The primitive stays minimal and
+	* does no validation: it passes `ms` straight to the host `setTimeout`, which
+	* clamps a negative value or `NaN` to ~0 — so an out-of-domain `ms` resolves on
+	* the next host turn rather than throwing.
+	*/
+	delay(ms, options) {
+		return this.#sleep(ms, options?.signal);
+	}
+	#sleep(ms, signal) {
+		return scheduleHost((complete) => {
+			const handle = setTimeout(complete, ms);
+			return () => clearTimeout(handle);
+		}, signal);
+	}
+};
+//#endregion
+//#region src/core/errors.ts
+/**
+* An error raised by the workflow runtime.
+*
+* @remarks
+* Carries a {@link WorkflowErrorCode} and an optional `context` bag naming the
+* offending node id / status. Raised for an illegal lifecycle transition
+* (`TRANSITION`), a structurally invalid {@link import('./types.js').WorkflowSnapshot}
+* boundary (`RESTORE`), or a refused structural/activity edit (`MUTATION`).
+*/
+var WorkflowError = class extends Error {
+	code;
+	context;
+	constructor(code, message, context) {
+		super(message);
+		this.name = "WorkflowError";
+		this.code = code;
+		if (context !== void 0) this.context = context;
+	}
+};
+/**
+* Narrow an unknown caught value to a {@link WorkflowError}.
+*
+* @param value - The value to test (typically a `catch` binding)
+* @returns `true` when `value` is a {@link WorkflowError}
+*
+* @example
+* ```ts
+* try {
+* 	task.complete('done')
+* } catch (error) {
+* 	if (isWorkflowError(error) && error.code === 'TRANSITION') retry()
+* }
+* ```
+*/
+function isWorkflowError(value) {
+	try {
+		return value instanceof WorkflowError;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/core/validators.ts
 /** Test the workflow lifecycle vocabulary. */
 function isLifecycleStatus(value) {
@@ -868,9 +948,17 @@ function isWorkflowSnapshot(value) {
 	const cloned = attempt(() => cloneJSONValue(value));
 	return cloned.success && isOwnedWorkflowSnapshot(cloned.value);
 }
-/** Test that every present behavior reference resolves before dispatch. */
-function hasWorkflowHandlers(snapshot, functions) {
-	for (const phase of snapshot.phases) for (const task of phase.tasks) if (task.run !== void 0 && functions?.[task.run] === void 0) return false;
+function hasWorkflowHandlers(workflow, functions) {
+	if ("destroyed" in workflow) {
+		for (const phase of workflow.phases.phases()) for (const task of phase.tasks.tasks()) if (task.run !== void 0 && !isFunction(task.handler)) return false;
+		return true;
+	}
+	const runs = /* @__PURE__ */ new Set();
+	for (const phase of workflow.phases) for (const task of phase.tasks) {
+		if (task.run === void 0 || runs.has(task.run)) continue;
+		runs.add(task.run);
+		if (!isFunction(functions?.[task.run])) return false;
+	}
 	return true;
 }
 /** Locate the nearest identifiable node for an inconsistent owned snapshot. */
@@ -974,18 +1062,25 @@ function isTaskActivity(value) {
 * Validate and own a workflow snapshot before live construction.
 *
 * @param input - The hostile snapshot boundary
+* @param id - The optional storage key the owned snapshot must match
 * @returns A deeply owned frozen snapshot
+* @throws {WorkflowError} With `RESTORE` when the snapshot is invalid or does not match `id`
 */
-function cloneWorkflowSnapshot(input) {
+function cloneWorkflowSnapshot(input, id) {
+	let cloned;
 	try {
-		const cloned = cloneJSONValue(input);
-		if (!isOwnedWorkflowSnapshot(cloned)) throw new WorkflowError("RESTORE", "workflow snapshot is inconsistent", workflowSnapshotContext(cloned));
-		return cloned;
+		cloned = cloneJSONValue(input);
 	} catch (error) {
 		if (isWorkflowError(error)) throw error;
 		if (isContractError(error)) throw new WorkflowError("RESTORE", `workflow snapshot could not be read safely: ${error.message}`);
 		throw new WorkflowError("RESTORE", "workflow snapshot could not be read safely");
 	}
+	if (!isOwnedWorkflowSnapshot(cloned)) throw new WorkflowError("RESTORE", "workflow snapshot is inconsistent", workflowSnapshotContext(cloned));
+	if (id !== void 0 && cloned.id !== id) throw new WorkflowError("RESTORE", `workflow snapshot '${cloned.id}' does not match storage key '${id}'`, {
+		requested: id,
+		payload: cloned.id
+	});
+	return cloned;
 }
 /**
 * Validate and clone one complete task activity frame.
@@ -1210,7 +1305,8 @@ var phaseUpdateShape = objectShape({
 *   the row `{ id: snapshot.id, snapshot }`.
 * - **`get(id)` resolves the stored snapshot for an id**, narrowing the opaque JSON column back to
 *   a {@link WorkflowSnapshot} ({@link import('../helpers.js').isWorkflowSnapshot} — the AGENTS §14
-*   boundary narrow for an untrusted storage read), or `undefined` if none is stored.
+*   boundary narrow for an untrusted storage read), or `undefined` if none is stored. A present
+*   snapshot whose own id differs from the requested key rejects with normalized `RESTORE` evidence.
 * - **`delete(id)` drops a snapshot by id**; an absent id is a no-op (no throw).
 *
 * UNLIKE the server package's `SessionStoreInterface` there is NO
@@ -1221,7 +1317,8 @@ var phaseUpdateShape = objectShape({
 *
 * @example
 * ```ts
-* import { createDatabaseWorkflowStore, createMemoryDriver, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryDriver } from '@orkestrel/database'
+* import { createDatabaseWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createDatabaseWorkflowStore(createMemoryDriver()) // a durable driver swaps in here
 * const workflow = createWorkflow(definition)
@@ -1242,11 +1339,11 @@ var DatabaseWorkflowStore = class {
 	constructor(table) {
 		this.#table = table;
 	}
-	/** Resolve the persisted snapshot for `id`, narrowing the opaque JSON column back to a `WorkflowSnapshot`. */
+	/** Resolve and key-check the snapshot for `id`, narrowing the opaque column to `WorkflowSnapshot`. */
 	async get(id) {
 		const row = await this.#table.get(id);
 		if (row === void 0) return void 0;
-		return cloneWorkflowSnapshot(row.snapshot);
+		return cloneWorkflowSnapshot(row.snapshot, id);
 	}
 	/** Insert or replace under the snapshot's OWN `id` (no separate id param) — the row is `{ id, snapshot }`. */
 	async set(snapshot) {
@@ -1291,7 +1388,7 @@ var DatabaseWorkflowStore = class {
 *
 * @example
 * ```ts
-* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createMemoryWorkflowStore()
 * const workflow = createWorkflow(definition)
@@ -1380,14 +1477,18 @@ var Task = class {
 		this.#workflow = workflow;
 		this.#recompute = recompute;
 		try {
-			this.#metadata = cloneJSONRecord(options?.metadata ?? metadata);
+			const metadataOption = options?.metadata;
+			this.#metadata = cloneJSONRecord(metadataOption ?? metadata);
 		} catch (error) {
 			if (isContractError(error)) throw new WorkflowError("RESTORE", `task '${context.id}' metadata could not be read safely: ${error.message}`, { task: context.id });
 			throw new WorkflowError("RESTORE", `task '${context.id}' metadata could not be read safely`, { task: context.id });
 		}
+		const on = options?.on;
+		const listenerError = options?.error;
+		const silenceOption = options?.silence;
 		this.#emitter = new Emitter({
-			...options?.on === void 0 ? {} : { on: options.on },
-			...options?.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...listenerError === void 0 ? {} : { error: listenerError }
 		});
 		this.#status = status;
 		this.#result = result;
@@ -1402,7 +1503,7 @@ var Task = class {
 		this.#attempts = attempts;
 		this.#handler = handler;
 		this.#abort = createAbort();
-		this.#silence = resolveTaskSilence(options?.silence, silence);
+		this.#silence = resolveTaskSilence(silenceOption, silence);
 		this.#onSilence = this.#expire.bind(this);
 		this.#liveness = this.#silence === void 0 ? void 0 : createTimeout({
 			ms: this.#silence,
@@ -1760,9 +1861,9 @@ var TaskManager = class {
 *
 * @remarks
 * - **Derived status.** `status` is `#override` when one is in force, else
-*   {@link derivePhaseStatus} over the live tasks' statuses. {@link #recompute} (passed to
+*   {@link derivePhaseStatus} over the live tasks' statuses. `#recompute` (passed to
 *   each child {@link Task}) re-derives on every child transition; a CHANGE emits the matching
-*   event AND escalates to the workflow ({@link #escalate}, the upward step of the cascade).
+*   event AND escalates to the workflow (`#escalate`, the upward step of the cascade).
 * - **Override (AGENTS §10).** `skip` / `stop` FORCE the phase's status (e.g. skipping a whole
 *   phase), overriding the derived value; the override is PERSISTED in the snapshot's own
 *   `override` field and restored DIRECTLY (no divergence guess), so a forced phase round-trips.
@@ -1793,10 +1894,12 @@ var TaskManager = class {
 *   construction path {@link #append} uses at build time, so a live mint and a restored/built
 *   task are wired IDENTICALLY. At construction, the workflow-level
 *   {@link import('../types.js').WorkflowFunctions} registry (threaded from
-*   {@link import('../types.js').WorkflowOptions.functions}) resolves each task's `run` name into
-*   its runtime {@link import('../types.js').TaskInterface.handler} ONCE; a `run` that is omitted
-*   or unregistered resolves to no handler; only an omitted `run` is a no-op, while an
-*   unresolved present name makes the containing tree non-drivable.
+*   {@link import('../types.js').WorkflowOptions.functions}) resolves every unique initial `run`
+*   name ONCE before any task is built; siblings sharing a name receive the exact same captured
+*   runtime {@link import('../types.js').TaskInterface.handler}. A later live {@link add} reads
+*   that name once from the retained registry at its own mint moment. An omitted or unregistered
+*   `run` resolves to no handler; only omission is a no-op, while an unresolved present name makes
+*   the containing tree non-drivable.
 * - **Runtime lifecycle (AGENTS §10).** `pause` / `resume` / `wait` mirror the workflow's own
 *   quartet, scoped to this phase — a driving
 *   {@link import('../types.js').WorkflowRunnerInterface.execute} gates a task's own
@@ -1822,6 +1925,9 @@ var Phase = class {
 	#paused;
 	#gate;
 	constructor(snapshot, workflow, escalate, options, bail, functions, silence) {
+		const on = options?.on;
+		const error = options?.error;
+		const tasks = options?.tasks;
 		this.#id = snapshot.id;
 		this.#name = snapshot.name;
 		if (snapshot.description !== void 0) Object.defineProperty(this, "description", {
@@ -1832,13 +1938,19 @@ var Phase = class {
 		this.#escalateUp = escalate;
 		this.#functions = functions;
 		this.#silence = silence;
+		const handlers = /* @__PURE__ */ new Map();
+		for (const task of snapshot.tasks) if (task.run !== void 0 && !handlers.has(task.run)) handlers.set(task.run, functions?.[task.run]);
 		this.#bail = bail ?? snapshot.bail;
 		this.#concurrency = snapshot.concurrency;
 		this.#emitter = new Emitter({
-			...options?.on === void 0 ? {} : { on: options.on },
-			...options?.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
 		});
-		for (const task of snapshot.tasks) this.#append(task, options);
+		for (const task of snapshot.tasks) {
+			const taskOptions = tasks?.[task.id];
+			const handler = task.run === void 0 ? void 0 : handlers.get(task.run);
+			this.#append(task, taskOptions, handler);
+		}
 		this.#override = snapshot.override;
 		this.#status = this.status;
 		this.#paused = false;
@@ -2020,17 +2132,17 @@ var Phase = class {
 		if (result.success) this.#emitter.emit("add", result.value, at);
 		return result;
 	}
-	#append(task, options) {
-		const created = this.#create(task, options?.tasks?.[task.id]);
+	#append(task, options, handler) {
+		const created = this.#create(task, options, handler);
 		this.#tasks.append(created);
 	}
-	#create(snapshot, options) {
-		const context = buildTaskContext(this.context, snapshot);
-		const handler = snapshot.run === void 0 ? void 0 : this.#functions?.[snapshot.run];
-		return new Task(context, this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.run, snapshot.retries, snapshot.timeout, snapshot.metadata, snapshot.attempts, snapshot.activity, handler, this.#silence);
+	#create(snapshot, options, handler) {
+		return new Task(buildTaskContext(this.context, snapshot), this, this.#workflow, () => this.#recompute(), options, snapshot.status, snapshot.result, snapshot.run, snapshot.retries, snapshot.timeout, snapshot.metadata, snapshot.attempts, snapshot.activity, handler, this.#silence);
 	}
 	#mint(definition) {
-		return this.#create(taskDefinitionToSnapshot(definition), void 0);
+		const snapshot = taskDefinitionToSnapshot(definition);
+		const handler = snapshot.run === void 0 ? void 0 : this.#functions?.[snapshot.run];
+		return this.#create(snapshot, void 0, handler);
 	}
 	#statuses() {
 		return this.#tasks.tasks().map((task) => task.status);
@@ -2125,11 +2237,11 @@ var PhaseManager = class {
 * - **Construction.** Built from a {@link WorkflowSnapshot} (the unified input —
 *   {@link import('./factories.js').createWorkflow} seeds an initial snapshot from a
 *   {@link import('./types.js').WorkflowDefinition}, {@link import('./factories.js').restoreWorkflow}
-*   passes a persisted one). Each child {@link Phase} is wired to escalate to {@link #recompute}.
+*   passes a persisted one). Each child {@link Phase} is wired to escalate to `#recompute`.
 * - **Derived status.** `status` is `#override` when forced, else
 *   {@link deriveWorkflowStatus} over the live phases' statuses feeding `bail`. `failed` is
 *   reachable ONLY under `bail: true` (a single failed task halts the workflow); under
-*   `bail: false` a failed phase folds into `completed`. {@link #recompute} diffs on each phase
+*   `bail: false` a failed phase folds into `completed`. `#recompute` diffs on each phase
 *   change; a CHANGE emits.
 * - **Override (AGENTS §10).** `skip` / `stop` FORCE the status; an executed task-free pending tree
 *   may also be force-completed vacuously. The override is PERSISTED in the snapshot's own
@@ -2178,15 +2290,22 @@ var Workflow = class {
 	#gate;
 	#destroyed;
 	constructor(snapshot, options) {
+		const captured = captureWorkflowOptions(options);
+		const on = captured.on;
+		const bail = captured.bail;
+		const error = captured.error;
+		const phases = captured.phases;
+		const functions = captured.functions;
+		const silence = captured.silence;
 		this.#context = buildWorkflowContext(snapshot);
 		if (snapshot.description !== void 0) Object.defineProperty(this, "description", { value: snapshot.description });
-		this.#bail = options?.bail ?? snapshot.bail;
-		this.#bailOverride = options?.bail;
-		this.#functions = options?.functions;
-		this.#silence = options?.silence;
+		this.#bail = bail ?? snapshot.bail;
+		this.#bailOverride = bail;
+		this.#functions = functions;
+		this.#silence = silence;
 		this.#emitter = new Emitter({
-			...options?.on === void 0 ? {} : { on: options.on },
-			...options?.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
 		});
 		this.#created = snapshot.created;
 		this.#updated = snapshot.updated;
@@ -2194,7 +2313,10 @@ var Workflow = class {
 		this.#paused = false;
 		this.#gate = void 0;
 		this.#destroyed = false;
-		for (const phase of snapshot.phases) this.#append(phase, options);
+		for (const phase of snapshot.phases) {
+			const phaseOptions = phases?.[phase.id];
+			this.#append(phase, phaseOptions);
+		}
 		this.#override = snapshot.override;
 		this.#status = this.status;
 	}
@@ -2386,7 +2508,7 @@ var Workflow = class {
 		return found;
 	}
 	#append(phase, options) {
-		const created = new Phase(phase, this, () => this.#recompute(), options?.phases?.[phase.id], this.#bailOverride, this.#functions, this.#silence);
+		const created = new Phase(phase, this, () => this.#recompute(), options, this.#bailOverride, this.#functions, this.#silence);
 		this.#phases.append(created);
 	}
 	#mint(definition) {
@@ -2418,12 +2540,11 @@ var Workflow = class {
 *   `functions` registry in) and stores it under `definition.id` — an already-present id
 *   OVERWRITES (last write wins). `count` is the map size, `workflow(id)` looks one up,
 *   `workflows()` lists them in insertion order.
-* - **Durable open / save.** `open(id)` returns an already-registered workflow directly; on a
-*   registry MISS with a `store` set it rehydrates through {@link restoreWorkflow} (flowing the
-*   manager's `functions` registry in so the rehydrated tree is RUNNABLE), registers it, and
-*   returns it — lenient (`undefined`) with no store or a store miss. `save(id)` persists a
-*   registered workflow's `snapshot()` to the `store` — lenient (`false`) with no store or an
-*   unknown id.
+* - **Durable open / save.** `open(id)` returns an already-registered workflow directly; same-id
+*   misses share one hydration. A concurrent `add` wins, while `remove` / `clear` invalidate
+*   earlier reads; wrong-key payloads reject with `RESTORE`. `save(id)` captures a registered
+*   workflow's snapshot at invocation and serializes same-id writes without coupling other ids.
+*   Both remain lenient without a store or registered id.
 * - **Removal.** `remove` drops one by id, or a batch (§9.2, array overload FIRST) — `true` when
 *   any was removed. `clear` empties the registry.
 * - **No active pointer.** Unlike its `ConversationManager` / `WorkspaceManager` twins, there is
@@ -2441,6 +2562,12 @@ var Workflow = class {
 */
 var WorkflowManager = class {
 	#workflows = /* @__PURE__ */ new Map();
+	#opens = /* @__PURE__ */ new Map();
+	#saves = /* @__PURE__ */ new Map();
+	#mutations = /* @__PURE__ */ new Map();
+	#additions = /* @__PURE__ */ new Map();
+	#hydrations = /* @__PURE__ */ new Map();
+	#generation = Symbol();
 	#functions;
 	#store;
 	constructor(options) {
@@ -2458,36 +2585,140 @@ var WorkflowManager = class {
 	}
 	add(definition) {
 		const workflow = createWorkflow(definition, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
+		const mutation = this.#invalidate(workflow.id);
+		if (mutation === void 0) this.#additions.delete(workflow.id);
+		else this.#additions.set(workflow.id, mutation);
 		this.#workflows.set(workflow.id, workflow);
 		return workflow;
 	}
-	async open(id) {
+	open(id) {
 		const existing = this.#workflows.get(id);
-		if (existing !== void 0) return existing;
-		if (this.#store === void 0) return void 0;
-		const snapshot = await this.#store.get(id);
-		if (snapshot === void 0) return void 0;
-		const workflow = restoreWorkflow(snapshot, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
-		this.#workflows.set(workflow.id, workflow);
-		return workflow;
-	}
-	async save(id) {
+		if (existing !== void 0) return Promise.resolve(existing);
+		if (this.#store === void 0) return Promise.resolve(void 0);
+		const pending = this.#opens.get(id);
+		if (pending !== void 0) return pending;
+		const mutation = this.#mutations.get(id);
+		const generation = this.#generation;
+		const lease = this.#retain(id);
+		const reservation = Promise.withResolvers();
+		const opening = reservation.promise;
+		this.#opens.set(id, opening);
+		this.#hydrate(id, mutation, generation, lease, this.#store).then(reservation.resolve, reservation.reject);
+		opening.then(() => this.#releaseOpen(id, opening), () => this.#releaseOpen(id, opening));
+		return opening;
+	}
+	save(id) {
 		const workflow = this.#workflows.get(id);
-		if (this.#store === void 0 || workflow === void 0) return false;
-		await this.#store.set(workflow.snapshot());
-		return true;
+		if (this.#store === void 0 || workflow === void 0) return Promise.resolve(false);
+		const snapshot = workflow.snapshot();
+		const previous = this.#saves.get(id);
+		const reservation = Promise.withResolvers();
+		const saving = reservation.promise;
+		this.#saves.set(id, saving);
+		this.#persist(this.#store, previous, snapshot).then(reservation.resolve, reservation.reject);
+		saving.then(() => this.#settle(id, saving), () => this.#settle(id, saving));
+		return saving.then(() => true);
 	}
 	remove(ids) {
 		if (isArray(ids)) {
 			let removed = false;
-			for (const id of ids) if (this.#workflows.delete(id)) removed = true;
+			for (const id of ids) {
+				this.#invalidate(id);
+				this.#additions.delete(id);
+				if (this.#workflows.delete(id)) removed = true;
+			}
 			return removed;
 		}
+		this.#invalidate(ids);
+		this.#additions.delete(ids);
 		return this.#workflows.delete(ids);
 	}
 	clear() {
+		this.#generation = Symbol();
+		this.#mutations.clear();
+		this.#additions.clear();
+		this.#opens.clear();
 		this.#workflows.clear();
 	}
+	async #hydrate(id, mutation, generation, lease, store) {
+		try {
+			const snapshot = await store.get(id);
+			if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+			if (snapshot === void 0) return void 0;
+			let owned;
+			try {
+				owned = cloneWorkflowSnapshot(snapshot, id);
+			} catch (error) {
+				if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+				throw error;
+			}
+			if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+			let workflow;
+			try {
+				workflow = restoreWorkflow(owned, { ...this.#functions === void 0 ? {} : { functions: this.#functions } });
+			} catch (error) {
+				if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+				throw error;
+			}
+			if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+			return this.#register(id, workflow, mutation, generation);
+		} finally {
+			this.#releaseHydration(id, lease);
+		}
+	}
+	#owns(id, mutation, generation) {
+		return this.#generation === generation && this.#mutations.get(id) === mutation;
+	}
+	#resolve(id, generation) {
+		if (this.#generation !== generation) return void 0;
+		const mutation = this.#mutations.get(id);
+		const workflow = this.#workflows.get(id);
+		return workflow !== void 0 && this.#additions.get(id) === mutation ? workflow : void 0;
+	}
+	#register(id, workflow, mutation, generation) {
+		if (!this.#owns(id, mutation, generation)) return this.#resolve(id, generation);
+		this.#workflows.set(id, workflow);
+		return workflow;
+	}
+	async #persist(store, previous, snapshot) {
+		if (previous !== void 0) try {
+			await previous;
+		} catch {}
+		await store.set(snapshot);
+	}
+	#invalidate(id) {
+		this.#opens.delete(id);
+		if (!this.#hydrations.has(id)) {
+			this.#mutations.delete(id);
+			this.#additions.delete(id);
+			return;
+		}
+		const mutation = Symbol();
+		this.#mutations.set(id, mutation);
+		return mutation;
+	}
+	#retain(id) {
+		const lease = Symbol();
+		const hydrations = this.#hydrations.get(id);
+		if (hydrations === void 0) this.#hydrations.set(id, /* @__PURE__ */ new Set([lease]));
+		else hydrations.add(lease);
+		return lease;
+	}
+	#releaseOpen(id, opening) {
+		if (this.#opens.get(id) === opening) this.#opens.delete(id);
+	}
+	#releaseHydration(id, lease) {
+		const hydrations = this.#hydrations.get(id);
+		if (hydrations === void 0) return;
+		hydrations.delete(lease);
+		if (hydrations.size !== 0) return;
+		this.#hydrations.delete(id);
+		this.#mutations.delete(id);
+		this.#additions.delete(id);
+	}
+	#settle(id, saving) {
+		if (this.#saves.get(id) === saving) this.#saves.delete(id);
+	}
 };
 //#endregion
 //#region src/core/Controller.ts
@@ -2606,6 +2837,7 @@ var Runner = class {
 	#order = [];
 	#values = /* @__PURE__ */ new Map();
 	#dispatched = /* @__PURE__ */ new Set();
+	#queued = /* @__PURE__ */ new Set();
 	#count = 0;
 	#drained;
 	#started = false;
@@ -2613,18 +2845,28 @@ var Runner = class {
 	#stopped = false;
 	#stopping = false;
 	#failure;
+	#stopPromise;
+	#abortPromise;
+	#destroyPromise;
 	constructor(options) {
-		this.#handler = options.handler;
-		this.#entries = options.entries;
+		const handler = options.handler;
+		const entries = options.entries;
+		const on = options.on;
+		const error = options.error;
+		const concurrency = options.concurrency;
+		const retries = options.retries;
+		const timeout = options.timeout;
+		this.#handler = handler;
+		this.#entries = entries;
 		this.#emitter = new Emitter({
-			...options.on === void 0 ? {} : { on: options.on },
-			...options.error === void 0 ? {} : { error: options.error }
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
 		});
 		this.#queue = createQueue({
 			handler: this.#dispatch.bind(this),
-			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency },
-			...options.retries === void 0 ? {} : { retries: options.retries },
-			...options.timeout === void 0 ? {} : { timeout: options.timeout }
+			...concurrency === void 0 ? {} : { concurrency },
+			...retries === void 0 ? {} : { retries },
+			...timeout === void 0 ? {} : { timeout }
 		});
 	}
 	get emitter() {
@@ -2666,7 +2908,7 @@ var Runner = class {
 	* ```
 	*/
 	spawn(input) {
-		if (this.#stopped || !this.#running) return void 0;
+		if (!this.#accepts()) return void 0;
 		return this.#launch(input, void 0, true);
 	}
 	async execute(inputs) {
@@ -2674,29 +2916,37 @@ var Runner = class {
 		if (this.#stopped) throw new Error("runner is stopped");
 		this.#started = true;
 		this.#running = true;
-		this.#emitter.emit("start");
-		if (inputs.length === 0) {
-			this.#running = false;
-			this.#emitter.emit("finish", []);
-			return [];
-		}
 		const drained = createDeferred();
 		this.#drained = drained;
-		for (const input of inputs) this.#launch(input);
+		for (const input of inputs) {
+			if (!this.#accepts()) break;
+			this.#launch(input);
+		}
+		this.#emitter.emit("start");
+		if (this.#count === 0) drained.resolve();
 		await drained.promise;
 		this.#running = false;
+		const cleanup = await this.#cleanup();
 		if (this.#failure !== void 0) throw this.#failure.error;
+		if (cleanup !== void 0) throw cleanup.error;
 		const results = this.#collect();
 		this.#emitter.emit("finish", results);
+		const finishing = await this.#cleanup();
+		if (finishing !== void 0) throw finishing.error;
 		return results;
 	}
 	abort(reason) {
-		if (this.#stopped) return;
+		if (this.#abortPromise !== void 0) return this.#abortPromise;
+		const barrier = createDeferred();
+		this.#abortPromise = barrier.promise;
+		barrier.promise.catch(() => {});
 		if (this.#running && this.#failure === void 0) this.#failure = { error: reason === void 0 ? /* @__PURE__ */ new Error("runner aborted") : reason };
 		this.#cancel(reason);
-		this.#queue.abort(reason);
 		this.#stopped = true;
+		const cleanup = this.#queue.abort(reason);
+		this.#settleLifecycle(barrier, cleanup);
 		this.#emitter.emit("abort", reason);
+		return barrier.promise;
 	}
 	/**
 	* Suspend dispatch (AGENTS §10 — resumable): delegates to the backing queue's own
@@ -2734,18 +2984,28 @@ var Runner = class {
 	* dispatched unit's rejection while stopping is still a real failure. Idempotent.
 	*/
 	stop() {
-		if (this.#stopped) return;
+		if (this.#destroyPromise !== void 0) return this.#destroyPromise;
+		if (this.#abortPromise !== void 0) return this.#abortPromise;
+		if (this.#stopPromise !== void 0) return this.#stopPromise;
+		const barrier = createDeferred();
+		this.#stopPromise = barrier.promise;
+		barrier.promise.catch(() => {});
 		this.#stopping = true;
 		this.#stopped = true;
-		this.#queue.stop();
+		const cleanup = this.#queue.stop();
+		this.#settleLifecycle(barrier, cleanup);
+		return barrier.promise;
 	}
 	destroy() {
-		if (this.#stopped) {
-			this.#queue.destroy();
-			return;
-		}
+		if (this.#destroyPromise !== void 0) return this.#destroyPromise;
+		const barrier = createDeferred();
+		this.#destroyPromise = barrier.promise;
+		barrier.promise.catch(() => {});
+		this.#stopped = true;
 		this.abort();
-		this.#queue.destroy();
+		const cleanup = this.#queue.destroy();
+		this.#settleDestroy(barrier, cleanup);
+		return barrier.promise;
 	}
 	#launch(input, parent, announce = parent !== void 0) {
 		const id = crypto.randomUUID();
@@ -2754,14 +3014,24 @@ var Runner = class {
 		this.#order.push(id);
 		this.#count += 1;
 		if (announce) this.#emitter.emit("spawn", id, parent);
-		const promise = this.#queue.enqueue({
-			id,
-			input
-		}, {
-			id,
-			signal: abort.signal,
-			...this.#entries?.(input)
-		});
+		let promise;
+		try {
+			const entry = this.#entries?.(input);
+			const retries = entry?.retries;
+			const timeout = entry?.timeout;
+			this.#queued.add(id);
+			promise = this.#queue.enqueue({
+				id,
+				input
+			}, {
+				id,
+				signal: abort.signal,
+				...retries === void 0 ? {} : { retries },
+				...timeout === void 0 ? {} : { timeout }
+			});
+		} catch (error) {
+			promise = Promise.reject(error);
+		}
 		promise.then((value) => this.#settle(id, {
 			ok: true,
 			value
@@ -2780,14 +3050,14 @@ var Runner = class {
 		return this.#handler(controller);
 	}
 	#spawn(input, parent) {
-		if (!this.#running) throw new Error("spawn is unavailable outside an active run");
+		if (!this.#accepts()) throw new Error("spawn is unavailable outside an active run");
 		return this.#launch(input, parent);
 	}
 	#settle(id, outcome) {
 		if (outcome.ok) {
 			this.#values.set(id, { value: outcome.value });
 			this.#emitter.emit("settle", id);
-		} else if (this.#stopping && !this.#dispatched.has(id)) {} else if (this.#failure === void 0) {
+		} else if (this.#stopping && this.#queued.has(id) && !this.#dispatched.has(id)) {} else if (this.#failure === void 0) {
 			this.#failure = { error: outcome.error };
 			this.#emitter.emit("fail", id, outcome.error);
 			this.abort(outcome.error);
@@ -2803,6 +3073,46 @@ var Runner = class {
 		}
 		return results;
 	}
+	#accepts() {
+		return this.#running && !this.#stopped;
+	}
+	async #cleanup() {
+		const cleanup = this.#destroyPromise ?? this.#abortPromise ?? this.#stopPromise;
+		if (cleanup === void 0) return void 0;
+		try {
+			await cleanup;
+			return;
+		} catch (error) {
+			return { error };
+		}
+	}
+	async #settleLifecycle(barrier, cleanup) {
+		let failure;
+		try {
+			await cleanup;
+		} catch (error) {
+			failure = { error };
+		}
+		await this.#waitDrain();
+		if (failure === void 0) barrier.resolve();
+		else barrier.reject(failure.error);
+	}
+	async #settleDestroy(barrier, cleanup) {
+		let failure;
+		try {
+			await cleanup;
+		} catch (error) {
+			failure = { error };
+		}
+		await this.#waitDrain();
+		this.#emitter.destroy();
+		if (failure === void 0) barrier.resolve();
+		else barrier.reject(failure.error);
+	}
+	async #waitDrain() {
+		if (this.#count === 0) return;
+		await this.#drained?.promise;
+	}
 	#cancel(reason) {
 		for (const abort of this.#aborts.values()) abort.abort(reason);
 	}
@@ -3078,8 +3388,10 @@ var WorkflowPersistence = class {
 			await this.#writing;
 			return;
 		}
-		const writing = this.#drain();
+		const reservation = Promise.withResolvers();
+		const writing = reservation.promise;
 		this.#writing = writing;
+		this.#drain().then(reservation.resolve, reservation.reject);
 		try {
 			await writing;
 		} finally {
@@ -3115,8 +3427,9 @@ var WorkflowPersistence = class {
 * - **Composes, never re-implements.** Per-phase bounded concurrency is one
 *   {@link createRunner} per phase (the substrate {@link RunnerInterface} over the workers
 *   `Queue`); `bail` maps onto that Runner's fail-fast vs settle-all; the run-level abort /
-*   timeout / budget / entity `signal` fold through {@link createAbort} / {@link createTimeout} +
-*   `AbortSignal.any` (exactly as the agent runtime folds its bounds); pacing is the shipped
+*   timeout / budget / entity `signal` fold through the `@orkestrel/abort` signal contract,
+*   {@link createTimeout}, and `AbortSignal.any` (exactly as the agent runtime folds its bounds);
+*   pacing is the shipped
 *   {@link SchedulerInterface}. The runner writes ZERO concurrency / retry / abort logic of
 *   its own — it only sequences phases, dispatches a task's own handler, and drives the live
 *   entity. The workflow layer owns per-task deadlines because timeout settlement must
@@ -3191,34 +3504,46 @@ var WorkflowRunner = class WorkflowRunner {
 	}
 	execute(target, options) {
 		if (this.#isWorkflow(target)) {
+			const signal = options?.signal;
+			const timeout = options?.timeout;
+			const budget = options?.budget;
+			const store = options?.store;
 			this.#acquire(target);
-			return this.#execute(target, options);
+			return this.#execute(target, signal, timeout, budget, store);
 		}
-		const workflow = new Workflow(definitionToSnapshot(target, options?.bail ?? target.bail ?? false), options);
+		const captured = captureWorkflowOptions(options);
+		const signal = options?.signal;
+		const timeout = options?.timeout;
+		const budget = options?.budget;
+		const store = options?.store;
+		const workflow = new Workflow(definitionToSnapshot(target, captured.bail ?? target.bail ?? false), captured);
 		this.#acquire(workflow);
-		return this.#execute(workflow, options);
+		return this.#execute(workflow, signal, timeout, budget, store);
 	}
 	#acquire(workflow) {
 		const tasks = workflow.phases.phases().flatMap((phase) => phase.tasks.tasks());
-		if (!((workflow.status === "pending" || workflow.status === "running") && tasks.every((task) => task.status !== "running") && (tasks.length === 0 || tasks.some((task) => task.status === "pending")) && tasks.every((task) => task.run === void 0 || task.handler !== void 0)) || workflow.destroyed || WorkflowRunner.#executions.has(workflow)) throw new WorkflowError("TRANSITION", `workflow '${workflow.id}' is not drivable`, {
+		if (!((workflow.status === "pending" || workflow.status === "running") && tasks.every((task) => task.status !== "running") && (tasks.length === 0 || tasks.some((task) => task.status === "pending")) && hasWorkflowHandlers(workflow)) || workflow.destroyed || WorkflowRunner.#executions.has(workflow)) throw new WorkflowError("TRANSITION", `workflow '${workflow.id}' is not drivable`, {
 			id: workflow.id,
 			status: workflow.status,
 			destroyed: workflow.destroyed
 		});
 		WorkflowRunner.#executions.add(workflow);
 	}
-	async #execute(workflow, options) {
-		const ms = options?.timeout;
-		const timeout = ms !== void 0 && Number.isFinite(ms) && ms > 0 && ms <= 2147483647 ? createTimeout({ ms }) : void 0;
-		timeout?.start();
-		options?.budget?.start();
-		const runSignal = this.#fold(workflow, options, timeout);
-		const persistence = options?.store === void 0 ? void 0 : new WorkflowPersistence(workflow, options.store);
+	async #execute(workflow, signal, ms, budget, store) {
 		const holder = { runner: void 0 };
-		const onCancel = this.#abortActive.bind(this, holder, runSignal);
-		if (runSignal.aborted) onCancel();
-		else runSignal.addEventListener("abort", onCancel, { once: true });
+		let timeout;
+		let persistence;
+		let runSignal;
+		let onCancel;
 		try {
+			timeout = ms !== void 0 && Number.isFinite(ms) && ms > 0 && ms <= 2147483647 ? createTimeout({ ms }) : void 0;
+			timeout?.start();
+			budget?.start();
+			runSignal = this.#fold(workflow, signal, budget, timeout);
+			persistence = store === void 0 ? void 0 : new WorkflowPersistence(workflow, store);
+			onCancel = this.#abortActive.bind(this, holder, runSignal);
+			if (runSignal.aborted) onCancel();
+			else runSignal.addEventListener("abort", onCancel, { once: true });
 			if (persistence !== void 0 && !await persistence.checkpoint("initial")) {
 				if (this.#stoppable(workflow)) workflow.stop();
 				this.#skipFrom(workflow.phases.phases(), 0);
@@ -3252,11 +3577,7 @@ var WorkflowRunner = class WorkflowRunner {
 				}
 				index += 1;
 				const remaining = workflow.phases.phases();
-				if (index < remaining.length && !this.#cancelled(runSignal)) try {
-					await this.#scheduler.yield({ signal: runSignal });
-				} catch (error) {
-					if (!runSignal.aborted) throw error;
-				}
+				if (index < remaining.length && !this.#cancelled(runSignal)) await this.#pace(runSignal);
 			}
 			if (this.#cancelled(runSignal)) this.#haltFrom(workflow.phases.phases(), 0, workflow, runSignal);
 			else if (this.#completable(workflow)) workflow.complete();
@@ -3276,7 +3597,14 @@ var WorkflowRunner = class WorkflowRunner {
 		} finally {
 			persistence?.detach();
 			timeout?.clear();
-			runSignal.removeEventListener("abort", onCancel);
+			if (runSignal !== void 0 && onCancel !== void 0) runSignal.removeEventListener("abort", onCancel);
+		}
+	}
+	async #pace(signal) {
+		try {
+			await this.#scheduler.yield({ signal });
+		} catch (error) {
+			if (!signal.aborted) throw error;
 		}
 	}
 	async #runPhase(workflow, phase, runSignal, holder, persistence) {
@@ -3304,8 +3632,11 @@ var WorkflowRunner = class WorkflowRunner {
 			} catch {
 				return !this.#cancelled(runSignal);
 			} finally {
-				created.destroy();
-				holder.runner = void 0;
+				try {
+					await created.destroy();
+				} finally {
+					holder.runner = void 0;
+				}
 			}
 		} finally {
 			phase.emitter.off("add", onAdd);
@@ -3516,11 +3847,11 @@ var WorkflowRunner = class WorkflowRunner {
 		if (timeout !== void 0) signals.push(timeout.signal);
 		return AbortSignal.any(signals);
 	}
-	#fold(workflow, options, timeout) {
+	#fold(workflow, signal, budget, timeout) {
 		const signals = [workflow.signal];
-		if (options?.signal !== void 0) signals.push(options.signal);
+		if (signal !== void 0) signals.push(signal);
 		if (timeout !== void 0) signals.push(timeout.signal);
-		if (options?.budget !== void 0) signals.push(options.budget.signal);
+		if (budget !== void 0) signals.push(budget.signal);
 		return signals.length === 1 ? workflow.signal : AbortSignal.any(signals);
 	}
 	#haltFrom(phases, index, workflow, runSignal) {
@@ -3583,7 +3914,7 @@ var WorkflowRunner = class WorkflowRunner {
 *
 * @example
 * ```ts
-* import { createWorkflowContract } from '@src/core'
+* import { createWorkflowContract } from '@orkestrel/workflow'
 *
 * const contract = createWorkflowContract()
 * const definition = contract.generate()       // a valid WorkflowDefinition
@@ -3621,7 +3952,7 @@ function createWorkflowContract() {
 *
 * @example
 * ```ts
-* import { createWorkflow } from '@src/core'
+* import { createWorkflow } from '@orkestrel/workflow'
 *
 * const workflow = createWorkflow(definition, { on: { complete: () => done() } })
 * const phase = workflow.phase('phase-build')
@@ -3629,7 +3960,8 @@ function createWorkflowContract() {
 * ```
 */
 function createWorkflow(definition, options) {
-	return new Workflow(definitionToSnapshot(definition, options?.bail ?? definition.bail ?? false), options);
+	const captured = captureWorkflowOptions(options);
+	return new Workflow(definitionToSnapshot(definition, captured.bail ?? definition.bail ?? false), captured);
 }
 /**
 * Rebuild an equivalent live W-b entity tree from a {@link WorkflowSnapshot} — the
@@ -3657,27 +3989,35 @@ function createWorkflow(definition, options) {
 *
 * @example
 * ```ts
-* import { restoreWorkflow } from '@src/core'
+* import { restoreWorkflow } from '@orkestrel/workflow'
 *
 * const restored = restoreWorkflow(workflow.snapshot()) // bail comes from the snapshot
 * restored.status === workflow.status // true
 * ```
 */
 function restoreWorkflow(snapshot, options) {
-	return new Workflow(cloneWorkflowSnapshot(snapshot), options);
+	const captured = captureWorkflowOptions(options);
+	return new Workflow(cloneWorkflowSnapshot(snapshot), captured);
 }
 /**
 * Rebuild an interrupted workflow at its remaining retry budget.
 *
+* @remarks
+* Each phase captures every unique initial `run` binding once before constructing tasks. Recovery
+* validates those live tasks' captured callable handlers without rereading the registry, while the
+* retained registry identity remains available to resolve future live additions at their mint time.
+*
 * @param snapshot - The hostile persisted snapshot
 * @param options - Runtime handlers and entity options
 * @returns A recoverable live workflow
 */
 function recoverWorkflow(snapshot, options) {
+	const captured = captureWorkflowOptions(options);
 	const owned = cloneWorkflowSnapshot(snapshot);
 	if (owned.override !== void 0 || owned.phases.some((phase) => phase.override !== void 0)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has a terminal override`, { workflow: owned.id });
-	if (!hasWorkflowHandlers(owned, options?.functions)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has an unresolved run`, { workflow: owned.id });
-	return new Workflow(cloneWorkflowSnapshot(recoverWorkflowSnapshot(owned)), options);
+	const workflow = new Workflow(cloneWorkflowSnapshot(recoverWorkflowSnapshot(owned)), captured);
+	if (!hasWorkflowHandlers(workflow)) throw new WorkflowError("RESTORE", `workflow '${owned.id}' has an unresolved run`, { workflow: owned.id });
+	return workflow;
 }
 /**
 * Assert that a {@link WorkflowSnapshot} carries a `boolean` `bail` — at the workflow tier AND
@@ -3709,7 +4049,7 @@ function assertSnapshot(snapshot) {
 *
 * @remarks
 * The snapshot analogue of the server package's `createMemorySessionStore`
-* (and the {@link createMemoryQueueStore} family), but LEANER — there is no idle-TTL, so no
+* (and the `createMemoryQueueStore` family), but LEANER — there is no idle-TTL, so no
 * options bag (AGENTS §21 minimal): a persisted run-state lives until an explicit `delete`. This is
 * the zero-plumbing DEFAULT (a plain `Map`); its driver-pluggable twin is
 * {@link createDatabaseWorkflowStore} (the snapshot as one opaque JSON column over a `databases`
@@ -3721,7 +4061,7 @@ function assertSnapshot(snapshot) {
 *
 * @example
 * ```ts
-* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createMemoryWorkflowStore()
 * const workflow = createWorkflow(definition)
@@ -3741,7 +4081,7 @@ function createMemoryWorkflowStore() {
 * @remarks
 * Builds a one-table database (`snapshots`, keyed by `id`) over the supplied driver, the snapshot
 * held as ONE OPAQUE JSON COLUMN — the column map is `{ id; snapshot }` where `snapshot` is a
-* `rawShape` (a JSON blob), exactly as {@link createDatabaseQueueStore} stores its `input`. The
+* `rawShape` (a JSON blob), exactly as `createDatabaseQueueStore` stores its `input`. The
 * snapshot is already a COMPLETE, self-contained, pure-JSON payload, so storing it whole is lossless
 * AND keeps the row type FLAT — a structured multi-column snapshot table would force the contract to
 * `Infer` the deeply-nested snapshot shape (workflow → phases → tasks → results) and trip TS2589;
@@ -3757,7 +4097,8 @@ function createMemoryWorkflowStore() {
 *
 * @example
 * ```ts
-* import { createDatabaseWorkflowStore, createMemoryDriver, createWorkflow, restoreWorkflow } from '@src/core'
+* import { createMemoryDriver } from '@orkestrel/database'
+* import { createDatabaseWorkflowStore, createWorkflow, restoreWorkflow } from '@orkestrel/workflow'
 *
 * const store = createDatabaseWorkflowStore(createMemoryDriver()) // a durable driver swaps in here
 * const workflow = createWorkflow(definition)
@@ -3808,7 +4149,7 @@ function createDatabaseWorkflowStore(driver = createMemoryDriver()) {
 *
 * @example
 * ```ts
-* import { createWorkflowRunner } from '@src/core'
+* import { createWorkflowRunner } from '@orkestrel/workflow'
 *
 * const runner = createWorkflowRunner()
 * const definition = { id: 'w', name: 'W', phases: [{ id: 'p', name: 'P', tasks: [
@@ -3844,7 +4185,7 @@ function createWorkflowRunner(options) {
 *
 * @example
 * ```ts
-* import { createMemoryWorkflowStore, createWorkflowManager } from '@src/core'
+* import { createMemoryWorkflowStore, createWorkflowManager } from '@orkestrel/workflow'
 *
 * const manager = createWorkflowManager({
 * 	store: createMemoryWorkflowStore(),
@@ -3867,7 +4208,8 @@ function createWorkflowManager(options) {
 * `yield()` gives the host a turn via a zero-delay macrotask (so pending I/O,
 * timers, and rendering actually run — a microtask would not); `delay(ms)` resumes
 * after at least `ms`. Pass `options.signal` to make a pending yield/delay reject
-* with the signal's `reason` on abort (with full timer/listener cleanup).
+* with the signal's exact `reason`; the shared owned-signal lifecycle clears the timer
+* without invoking caller-owned listener methods.
 * `options.priority` is accepted for contract compliance but treated uniformly by
 * this default — environment backends honour it.
 *
@@ -3875,7 +4217,8 @@ function createWorkflowManager(options) {
 *
 * @example
 * ```ts
-* import { createAbort, createScheduler } from '@src/core'
+* import { createAbort } from '@orkestrel/abort'
+* import { createScheduler } from '@orkestrel/workflow'
 *
 * const abort = createAbort()
 * const scheduler = createScheduler()
@@ -3889,7 +4232,7 @@ function createWorkflowManager(options) {
 *
 * @example
 * ```ts
-* import { createScheduler } from '@src/core'
+* import { createScheduler } from '@orkestrel/workflow'
 *
 * // A backoff: wait a growing interval between retries.
 * const scheduler = createScheduler()
@@ -3931,7 +4274,7 @@ function createScheduler() {
 *
 * @example
 * ```ts
-* import { createRunner } from '@src/core'
+* import { createRunner } from '@orkestrel/workflow'
 *
 * // A handler that fans out one sibling per declared unit, then returns its own value.
 * const runner = createRunner<number, number>({
@@ -3950,6 +4293,6 @@ function createRunner(options) {
 	return new Runner(options);
 }
 //#endregion
-export { Controller, DEFAULT_BAIL, DEFAULT_PHASE_CONCURRENCY, DatabaseWorkflowStore, MAX_TIMER_MS, MemoryWorkflowStore, PHASE_STATUSES, Phase, PhaseManager, Runner, Scheduler, TASK_STATUSES, TASK_TRANSITIONS, TERMINAL_TASK_STATUSES, Task, TaskController, TaskManager, WORKFLOW_STATUSES, Workflow, WorkflowError, WorkflowManager, WorkflowPersistence, WorkflowRunner, assertSnapshot, buildPhaseContext, buildTaskContext, buildWorkflowContext, canTransitionTask, cloneTaskActivity, cloneWorkflowSnapshot, collectResults, createDatabaseWorkflowStore, createDeferred, createMemoryWorkflowStore, createRunner, createScheduler, createWorkflow, createWorkflowContract, createWorkflowManager, createWorkflowRunner, definitionToSnapshot, deriveBoundary, derivePhaseStatus, deriveWorkflowStatus, errorToMessage, failure, findFailure, hasWorkflowHandlers, insertEntry, isLifecycleStatus, isOwnedWorkflowSnapshot, isTaskActivity, isTaskActivityInput, isTaskFailure, isTaskResult, isTerminalStatus, isWorkflowError, isWorkflowSnapshot, matchesDescription, moveEntry, parkSignal, phaseDefinitionToSnapshot, phaseShape, phaseUpdateShape, recoverWorkflow, recoverWorkflowSnapshot, resolveTaskSilence, restoreWorkflow, success, taskDefinitionToSnapshot, taskShape, taskUpdateShape, workflowShape, workflowSnapshotContext };
+export { Controller, DEFAULT_BAIL, DEFAULT_PHASE_CONCURRENCY, DatabaseWorkflowStore, MAX_TIMER_MS, MemoryWorkflowStore, PHASE_STATUSES, Phase, PhaseManager, Runner, Scheduler, TASK_STATUSES, TASK_TRANSITIONS, TERMINAL_TASK_STATUSES, Task, TaskController, TaskManager, WORKFLOW_STATUSES, Workflow, WorkflowError, WorkflowManager, WorkflowPersistence, WorkflowRunner, assertSnapshot, buildPhaseContext, buildTaskContext, buildWorkflowContext, canTransitionTask, captureWorkflowOptions, cloneTaskActivity, cloneWorkflowSnapshot, collectResults, createDatabaseWorkflowStore, createDeferred, createMemoryWorkflowStore, createRunner, createScheduler, createWorkflow, createWorkflowContract, createWorkflowManager, createWorkflowRunner, definitionToSnapshot, deriveBoundary, derivePhaseStatus, deriveWorkflowStatus, errorToMessage, failure, findFailure, hasWorkflowHandlers, insertEntry, isLifecycleStatus, isOwnedWorkflowSnapshot, isTaskActivity, isTaskActivityInput, isTaskFailure, isTaskResult, isTerminalStatus, isWorkflowError, isWorkflowSnapshot, matchesDescription, moveEntry, parkSignal, phaseDefinitionToSnapshot, phaseShape, phaseUpdateShape, recoverWorkflow, recoverWorkflowSnapshot, resolveTaskSilence, restoreWorkflow, scheduleHost, success, taskDefinitionToSnapshot, taskShape, taskUpdateShape, workflowShape, workflowSnapshotContext };
 
 //# sourceMappingURL=index.js.map