@signalridge/pi-workflows 1.2.1 → 1.3.1

package/src/journal.ts

@@ -1,27 +1,47 @@
+/**
+ * journal.ts — durable journal for script-based workflow runs (schema v3).
+ *
+ * A script run is journaled as an ordered event stream in the session entry
+ * store. `run_created` carries the raw script, its hash, and its parsed meta
+ * (the runtime re-derives call indexes from the script itself, so no task
+ * array is persisted). Each completed `agent()`/`checkpoint()` call journals a
+ * `call_result` keyed by its lexical call index; a resume rebuilds the
+ * runtime's `resumeJournal` map from these entries and replays the longest
+ * unchanged prefix.
+ *
+ * The atomic recovery machinery (run/terminal/attempt recovery with generation
+ * rotations, quarantine of malformed runs, stale-generation rejection) is
+ * preserved from the declarative journal and re-keyed to call indexes, because
+ * interrupted managed spawns still need generation rotation on restore.
+ *
+ * Schema v2 runs (declarative DAG journals) are quarantined rather than
+ * replayed — the event shapes are incompatible and a script run must not
+ * inherit DAG bookkeeping.
+ */
+
 import { createHash } from "node:crypto";
 import type { ManagedOwner } from "@signalridge/pi-subagents-protocol";
-import { validateWorkflow, type WorkflowDefinition } from "./schema.js";
-import {
-  canTransitionTask,
-  canTransitionWorkflow,
-  isTerminalTask,
-  type TaskStatus,
-  type WorkflowStatus,
-} from "./state-machine.js";
+import type { WorkflowMeta } from "./runtime.js";
 
 export const JOURNAL_ENTRY_TYPE = "pi-workflows:journal";
-export const JOURNAL_SCHEMA_VERSION = 2;
-export const JOURNAL_LEGACY_SCHEMA_VERSION = 1;
-export type JournalSchemaVersion = 1 | 2;
+export const JOURNAL_SCHEMA_VERSION = 3;
+/** Schema v2 (declarative DAG) and v1 are quarantined on replay, not migrated. */
+export const JOURNAL_LEGACY_SCHEMA_VERSION = 2;
+export type JournalSchemaVersion = 2 | 3;
 export const JOURNAL_TEXT_LIMIT = 8_000;
+export const JOURNAL_SCRIPT_LIMIT = 200_000;
 export const JOURNAL_ERROR_LIMIT = 2_000;
 export const JOURNAL_ID_LIMIT = 256;
 export const JOURNAL_TIMESTAMP_LIMIT = 8_640_000_000_000_000;
-export const JOURNAL_RECOVERY_ID_PREFIX = "r1-";
+export const JOURNAL_RECOVERY_ID_PREFIX = "r3-";
 export const JOURNAL_RECOVERY_ID_LIMIT = JOURNAL_RECOVERY_ID_PREFIX.length + 64;
 /** Maximum number of distinct atomic recoveries retained while replaying one run. */
 export const JOURNAL_RECOVERY_SEEN_LIMIT = 4_096;
-const RECOVERY_ID_PATTERN = /^r1-[0-9a-f]{64}$/;
+/** A script run may issue up to 1000 agent()/checkpoint() calls. */
+export const JOURNAL_CALL_LIMIT = 1_000;
+/** One atomic recovery event may rotate every active call in a run. */
+export const JOURNAL_RECOVERY_NODE_LIMIT = JOURNAL_CALL_LIMIT;
+const RECOVERY_ID_PATTERN = /^r3-[0-9a-f]{64}$/;
 
 export class StaleJournalGenerationError extends Error {
   constructor(message: string) {
@@ -30,80 +50,90 @@ export class StaleJournalGenerationError extends Error {
   }
 }
 
+export type WorkflowStatus =
+  | "pending"
+  | "running"
+  | "pausing"
+  | "paused"
+  | "stopping"
+  | "completed"
+  | "failed"
+  | "stopped"
+  | "interrupted";
+
+export type CallStatus = "running" | "completed" | "failed" | "stopped";
+
 const WORKFLOW_STATUS_VALUES = new Set<WorkflowStatus>([
   "pending",
   "running",
   "pausing",
   "paused",
-  "synthesizing",
   "stopping",
   "completed",
   "failed",
   "stopped",
   "interrupted",
 ]);
-const TASK_STATUS_VALUES = new Set<TaskStatus>([
-  "pending",
-  "ready",
-  "dispatching",
-  "queued",
-  "running",
-  "completed",
-  "failed",
-  "stopped",
-  "blocked",
-]);
+const CALL_STATUS_VALUES = new Set<CallStatus>(["running", "completed", "failed", "stopped"]);
 const JOURNAL_KINDS = new Set([
   "run_created",
+  "run_revision",
+  "run_removed",
   "workflow_transition",
   "run_recovery",
   "terminal_recovery",
   "attempt_recovery",
-  "task_transition",
-  "task_attempt",
-  "task_result",
-  "task_compacted",
-  "synthesis_result",
+  "call_transition",
+  "call_attempt",
+  "call_result",
 ]);
 
-/** One atomic recovery event may rotate every active node in a run. */
-export const JOURNAL_RECOVERY_NODE_LIMIT = 129; // 128 tasks plus synthesis
-const JOURNAL_GENERATION_LIMIT = 1_000_000;
 export type WorkflowOwner = ManagedOwner;
 
-export interface WorkflowTaskResult {
+/** A completed agent()/checkpoint() call, journaled for resume replay. */
+export interface CallResult {
   status: "completed" | "failed" | "stopped";
   agentId?: string;
   attemptId?: string;
-  text?: string;
+  /** The JSON-serializable call result (text for plain agents, parsed value for schema agents). */
+  result?: unknown;
   error?: string;
-  /** Persisted output transcript pointer, when pi-subagents provided one. */
   outputFile?: string;
-  /** Total input + output token count, when lifecycle accounting provided it. */
   tokenCount?: number;
   compactionCount: number;
-  truncated?: boolean;
   updatedAt: number;
 }
 
-export interface WorkflowRun {
+export interface ScriptRun {
   runId: string;
   schemaVersion: number;
-  definition: WorkflowDefinition;
+  script: string;
+  scriptHash: string;
+  meta: WorkflowMeta;
+  /** Number of the latest edited-script revision. */
+  revision?: number;
+  /** Toolset marker persisted across resume (e.g. "web-research" for deep-research). */
+  toolset?: string;
+  /** Frozen run params — persisted so resume after restore keeps original budget/scale. */
+  frozenMaxAgents?: number;
+  frozenConcurrency?: number;
+  frozenAgentRetries?: number;
+  frozenTokenBudget?: number | null;
+  frozenAgentTimeoutMs?: number | null;
+  frozenExcludeTools?: string[];
   status: WorkflowStatus;
-  taskStatus: Record<string, TaskStatus>;
+  /** Call index → status. Absent entries were never dispatched (replayed or skipped). */
+  callStatus: Record<string, CallStatus>;
   agentIds: Record<string, string>;
-  /** Monotonic per-node attempt generation; completed facts are never reset. */
+  /** Monotonic per-call attempt generation; completed facts are never reset. */
   attempts: Record<string, number>;
   attemptIds: Record<string, string>;
-  /** True when the journal carries generation-specific owner IDs. */
   attemptTracking?: boolean;
-  taskResults: Record<string, WorkflowTaskResult>;
+  /** Call index → journaled result (the resume journal source). */
+  callResults: Record<string, CallResult>;
   compactions: Record<string, number>;
   startedAt: number;
   updatedAt: number;
-  synthesisAgentId?: string;
-  synthesisResult?: WorkflowTaskResult;
   error?: string;
   nonResumable?: boolean;
   /** Terminal cleanup intent while active agents settle. */
@@ -116,14 +146,9 @@ interface JournalBase {
   timestamp: number;
 }
 
-/** State that was observed immediately before an atomic recovery rotation. */
-export type RecoverySourceStatus = TaskStatus | "synthesizing";
+/** State observed immediately before an atomic recovery rotation. */
+export type RecoverySourceStatus = CallStatus | "running";
 
-/**
- * A generation rotation is self-contained: replay can clear the superseded
- * attempt and make the new attempt ready without relying on a following
- * task_transition entry.
- */
 export interface RecoveryRotation {
   nodeId: string;
   sourceAttemptId: string;
@@ -138,7 +163,7 @@ export interface RecoveryRotation {
 export interface RecoveryTerminalResult {
   nodeId: string;
   attemptId: string;
-  result: WorkflowTaskResult;
+  result: CallResult;
   owner: WorkflowOwner;
 }
 
@@ -153,11 +178,7 @@ export interface RunRecoveryEvent extends JournalBase {
   legacyMigration?: true;
   timestamp: number;
 }
-/**
- * A terminal-intent recovery is one durable state transition. It settles every
- * unresolved node before publishing the final workflow outcome, so replay never
- * has to infer a terminal state from a prefix of result/transition events.
- */
+
 export interface TerminalRecoveryEvent extends JournalBase {
   kind: "terminal_recovery";
   status: "failed" | "stopped";
@@ -182,10 +203,29 @@ export interface AttemptRecoveryEvent extends JournalBase {
 export type JournalEvent =
   | (JournalBase & {
       kind: "run_created";
-      definition: WorkflowDefinition;
+      script: string;
+      scriptHash: string;
+      meta: WorkflowMeta;
+      toolset?: string;
+      frozenMaxAgents?: number;
+      frozenConcurrency?: number;
+      frozenAgentRetries?: number;
+      frozenTokenBudget?: number | null;
+      frozenAgentTimeoutMs?: number | null;
+      frozenExcludeTools?: string[];
       attempts?: Record<string, number>;
       attemptIds?: Record<string, string>;
     })
+  | (JournalBase & {
+      kind: "run_revision";
+      revision: number;
+      script: string;
+      scriptHash: string;
+      meta: WorkflowMeta;
+    })
+  | (JournalBase & {
+      kind: "run_removed";
+    })
   | (JournalBase & {
       kind: "workflow_transition";
       status: WorkflowStatus;
@@ -196,37 +236,28 @@ export type JournalEvent =
   | TerminalRecoveryEvent
   | AttemptRecoveryEvent
   | (JournalBase & {
-      kind: "task_transition";
+      kind: "call_transition";
       nodeId: string;
-      status: TaskStatus;
+      status: CallStatus;
       agentId?: string;
       attemptId?: string;
       owner?: WorkflowOwner;
     })
   | (JournalBase & {
-      kind: "task_attempt";
+      kind: "call_attempt";
       nodeId: string;
       attemptId: string;
       generation: number;
       owner?: WorkflowOwner;
     })
   | (JournalBase & {
-      kind: "task_result";
+      kind: "call_result";
       nodeId: string;
-      result: WorkflowTaskResult;
-      attemptId?: string;
-      owner?: WorkflowOwner;
-    })
-  | (JournalBase & {
-      kind: "task_compacted";
-      nodeId: string;
-      compactionCount: number;
-      attemptId?: string;
-      owner?: WorkflowOwner;
-    })
-  | (JournalBase & {
-      kind: "synthesis_result";
-      result: WorkflowTaskResult;
+      result: CallResult;
+      /** Stable hash of the call inputs (prompt/model/tier/phase/schema). */
+      callHash?: string;
+      /** Store write delta to replay additively on resume. */
+      storeDelta?: Record<string, unknown>;
       attemptId?: string;
       owner?: WorkflowOwner;
     });
@@ -242,7 +273,6 @@ export interface SessionEntryLike {
 }
 
 export interface ReplayJournalOptions {
-  /** Called at most once for malformed/forged/future journal data. */
   onInvalid?: (diagnostic: string) => void;
 }
 
@@ -259,817 +289,308 @@ function boundedString(value: unknown, label: string, limit: number): string {
 
 function validTimestamp(value: unknown, label: string): number {
   if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > JOURNAL_TIMESTAMP_LIMIT) {
-    throw new Error(`${label} is invalid`);
+    throw new Error(`${label} timestamp is invalid`);
   }
   return value;
 }
 
-function assertKeys(value: Record<string, unknown>, allowed: readonly string[], label: string): void {
-  const accepted = new Set(allowed);
-  for (const key of Object.keys(value)) {
-    if (!accepted.has(key)) throw new Error(`${label} contains unsupported field "${key}"`);
+function parseCallIndex(value: unknown, label: string): string {
+  const index = boundedString(value, label, JOURNAL_ID_LIMIT);
+  if (!/^(?:0|[1-9]\d*)$/u.test(index) || Number(index) >= JOURNAL_CALL_LIMIT) {
+    throw new Error(`${label} is not a valid call index`);
   }
+  return index;
 }
 
-export type RecoveryIdInput =
-  | (Pick<RunRecoveryEvent, "runId" | "status" | "branchGeneration" | "rotations" | "terminalResults"> & {
-      kind?: "run_recovery";
-    })
-  | Pick<
-      TerminalRecoveryEvent,
-      | "kind"
-      | "runId"
-      | "status"
-      | "terminalIntent"
-      | "branchGeneration"
-      | "terminalResults"
-      | "blockedNodeIds"
-      | "error"
-    >;
-
-function canonicalJson(value: unknown): string {
-  if (value === null) return "null";
-  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
-  if (isRecord(value)) {
-    return `{${Object.keys(value)
-      .sort()
-      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
-      .join(",")}}`;
+function parseMeta(raw: unknown): WorkflowMeta {
+  if (!isRecord(raw)) throw new Error("meta is invalid");
+  const name = boundedString(raw.name, "meta.name", 512);
+  const description = boundedString(raw.description, "meta.description", 100_000);
+  const meta: WorkflowMeta = { name, description };
+  if (raw.model !== undefined) meta.model = boundedString(raw.model, "meta.model", 512);
+  if (raw.phases !== undefined) {
+    if (!Array.isArray(raw.phases)) throw new Error("meta.phases must be an array");
+    meta.phases = raw.phases.map((phase, i) => {
+      if (!isRecord(phase) || typeof phase.title !== "string" || phase.title.length === 0) {
+        throw new Error(`meta.phases[${i}].title is invalid`);
+      }
+      const out: NonNullable<WorkflowMeta["phases"]>[number] = { title: phase.title.slice(0, 512) };
+      if (phase.detail !== undefined) out.detail = String(phase.detail).slice(0, 2_000);
+      if (phase.model !== undefined) out.model = String(phase.model).slice(0, 512);
+      return out;
+    });
   }
-  throw new Error("recovery semantic payload contains an unsupported value");
+  return meta;
 }
 
-function digestCanonical(value: unknown): string {
-  return createHash("sha256").update(canonicalJson(value), "utf8").digest("hex");
-}
-
-function compareStrings(left: string, right: string): number {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
-function sortedRecoveryRotations(rotations: readonly RecoveryRotation[]): RecoveryRotation[] {
-  return [...rotations].sort((left, right) => {
-    const nodeOrder = compareStrings(left.nodeId, right.nodeId);
-    if (nodeOrder !== 0) return nodeOrder;
-    const attemptOrder = compareStrings(left.sourceAttemptId, right.sourceAttemptId);
-    if (attemptOrder !== 0) return attemptOrder;
-    return left.sourceGeneration - right.sourceGeneration;
-  });
-}
-
-function sortedRecoveryTerminals(terminals: readonly RecoveryTerminalResult[]): RecoveryTerminalResult[] {
-  return [...terminals].sort((left, right) => {
-    const nodeOrder = compareStrings(left.nodeId, right.nodeId);
-    if (nodeOrder !== 0) return nodeOrder;
-    return compareStrings(left.attemptId, right.attemptId);
-  });
-}
-
-function recoverySemanticPayload(event: RecoveryIdInput): Record<string, unknown> {
-  if ("kind" in event && event.kind === "terminal_recovery") {
-    return {
-      blockedNodeIds: [...event.blockedNodeIds].sort(compareStrings),
-      branchGeneration: event.branchGeneration,
-      ...(event.error === undefined ? {} : { error: event.error }),
-      kind: event.kind,
-      runId: event.runId,
-      schemaVersion: JOURNAL_SCHEMA_VERSION,
-      status: event.status,
-      terminalIntent: event.terminalIntent,
-      terminalResults: sortedRecoveryTerminals(event.terminalResults),
-    };
+function parseResult(raw: unknown, label: string): CallResult {
+  if (!isRecord(raw)) throw new Error(`${label} is invalid`);
+  const status = raw.status;
+  if (status !== "completed" && status !== "failed" && status !== "stopped") {
+    throw new Error(`${label} status is invalid`);
   }
-  return {
-    branchGeneration: event.branchGeneration,
-    kind: "run_recovery",
-    rotations: sortedRecoveryRotations(event.rotations),
-    runId: event.runId,
-    schemaVersion: JOURNAL_SCHEMA_VERSION,
-    status: event.status,
-    terminalResults: sortedRecoveryTerminals(event.terminalResults ?? []),
-  };
-}
-
-/** Bounded digest of all normalized semantic fields, excluding timestamp and migration metadata. */
-export function recoverySemanticFingerprint(event: RecoveryIdInput): string {
-  return `s1-${digestCanonical(recoverySemanticPayload(event))}`;
-}
-
-/**
- * Derive the durable recovery identity from bounded source/target metadata.
- * Terminal recovery includes the complete terminal fact set because it is the
- * state transition, not merely a generation rotation.
- */
-export function deriveRecoveryId(event: RecoveryIdInput): string {
-  if ("kind" in event && event.kind === "terminal_recovery") {
-    return `${JOURNAL_RECOVERY_ID_PREFIX}${digestCanonical({
-      blockedNodeIds: [...event.blockedNodeIds].sort(compareStrings),
-      branchNamespace: event.branchGeneration,
-      ...(event.error === undefined ? {} : { error: event.error }),
-      runId: event.runId,
-      status: event.status,
-      terminalIntent: event.terminalIntent,
-      terminalResults: sortedRecoveryTerminals(event.terminalResults),
-      version: 1,
-    })}`;
+  const compactionCount = raw.compactionCount;
+  if (typeof compactionCount !== "number" || !Number.isInteger(compactionCount) || compactionCount < 0) {
+    throw new Error(`${label} compactionCount is invalid`);
   }
-  const rotations = sortedRecoveryRotations(event.rotations);
-  const terminals = sortedRecoveryTerminals(event.terminalResults ?? []);
-  const identity = {
-    branchNamespace: event.branchGeneration,
-    runId: event.runId,
-    sources: rotations.map((rotation) => ({
-      nodeId: rotation.nodeId,
-      sourceAttemptId: rotation.sourceAttemptId,
-      sourceGeneration: rotation.sourceGeneration,
-      sourceStatus: rotation.sourceStatus,
-      ...(rotation.supersededAgentId === undefined ? {} : { supersededAgentId: rotation.supersededAgentId }),
-    })),
-    status: event.status,
-    targets: rotations.map((rotation) => ({
-      nodeId: rotation.nodeId,
-      attemptId: rotation.attemptId,
-      generation: rotation.generation,
-      owner: rotation.owner,
-      ...(rotation.supersededAgentId === undefined ? {} : { supersededAgentId: rotation.supersededAgentId }),
-    })),
-    terminalNodes: terminals.map((terminal) => ({
-      nodeId: terminal.nodeId,
-      attemptId: terminal.attemptId,
-      status: terminal.result.status,
-      ...(terminal.result.agentId === undefined ? {} : { agentId: terminal.result.agentId }),
-      ...(terminal.result.outputFile === undefined ? {} : { outputFile: terminal.result.outputFile }),
-      ...(terminal.result.tokenCount === undefined ? {} : { tokenCount: terminal.result.tokenCount }),
-      compactionCount: terminal.result.compactionCount,
-      ...(terminal.result.truncated === undefined ? {} : { truncated: terminal.result.truncated }),
-    })),
-    version: 1,
+  const updatedAt = validTimestamp(raw.updatedAt, label);
+  const result: CallResult = {
+    status,
+    compactionCount,
+    updatedAt,
+    ...(raw.agentId === undefined ? {} : { agentId: boundedString(raw.agentId, `${label}.agentId`, JOURNAL_ID_LIMIT) }),
+    ...(raw.attemptId === undefined
+      ? {}
+      : { attemptId: boundedString(raw.attemptId, `${label}.attemptId`, JOURNAL_ID_LIMIT) }),
+    ...(raw.result === undefined ? {} : { result: raw.result }),
+    ...(raw.error === undefined ? {} : { error: boundedString(raw.error, `${label}.error`, JOURNAL_ERROR_LIMIT) }),
+    ...(raw.outputFile === undefined
+      ? {}
+      : { outputFile: boundedString(raw.outputFile, `${label}.outputFile`, JOURNAL_ID_LIMIT) }),
+    ...(raw.tokenCount === undefined
+      ? {}
+      : {
+          tokenCount: (() => {
+            if (typeof raw.tokenCount !== "number" || !Number.isInteger(raw.tokenCount) || raw.tokenCount < 0) {
+              throw new Error(`${label}.tokenCount is invalid`);
+            }
+            return raw.tokenCount;
+          })(),
+        }),
   };
-  return `${JOURNAL_RECOVERY_ID_PREFIX}${digestCanonical(identity)}`;
+  return result;
 }
 
-function parseRecoveryId(value: unknown, label: string): string {
-  const recoveryId = boundedString(value, label, JOURNAL_RECOVERY_ID_LIMIT);
-  if (!RECOVERY_ID_PATTERN.test(recoveryId)) throw new Error(`${label} has an invalid format`);
-  return recoveryId;
-}
-function parseOwner(value: unknown, runId: string, nodeId: string): WorkflowOwner {
-  if (!isRecord(value)) throw new Error("owner must be an object");
-  assertKeys(value, ["extension", "runId", "nodeId", "attemptId"], "owner");
-  const extension = boundedString(value.extension, "owner.extension", 64);
-  const ownerRunId = boundedString(value.runId, "owner.runId", JOURNAL_ID_LIMIT);
-  const ownerNodeId = boundedString(value.nodeId, "owner.nodeId", JOURNAL_ID_LIMIT);
-  const attemptId =
-    value.attemptId === undefined ? undefined : boundedString(value.attemptId, "owner.attemptId", JOURNAL_ID_LIMIT);
-  if (extension !== "pi-workflows" || ownerRunId !== runId || ownerNodeId !== nodeId) {
-    throw new Error("journal owner does not match its workflow node");
+function parseOwner(raw: unknown, runId: string, nodeId: string): WorkflowOwner {
+  if (!isRecord(raw) || raw.extension !== "pi-workflows") throw new Error("journal owner is invalid");
+  const ownerRunId = boundedString(raw.runId, "owner.runId", JOURNAL_ID_LIMIT);
+  const ownerNodeId = boundedString(raw.nodeId, "owner.nodeId", JOURNAL_ID_LIMIT);
+  if (ownerRunId !== runId || ownerNodeId !== nodeId) {
+    throw new Error("journal owner does not match its event");
   }
   return {
     extension: "pi-workflows",
     runId: ownerRunId,
     nodeId: ownerNodeId,
-    ...(attemptId ? { attemptId } : {}),
-  };
-}
-
-function parseResult(value: unknown, label: string): WorkflowTaskResult {
-  if (!isRecord(value)) throw new Error(`${label} must be an object`);
-  assertKeys(
-    value,
-    [
-      "status",
-      "agentId",
-      "attemptId",
-      "text",
-      "error",
-      "outputFile",
-      "tokenCount",
-      "compactionCount",
-      "truncated",
-      "updatedAt",
-    ],
-    label,
-  );
-  const status = value.status;
-  if (status !== "completed" && status !== "failed" && status !== "stopped") {
-    throw new Error(`${label}.status is invalid`);
-  }
-  const compactionCount = value.compactionCount;
-  if (typeof compactionCount !== "number" || !Number.isInteger(compactionCount) || compactionCount < 0) {
-    throw new Error(`${label}.compactionCount is invalid`);
-  }
-  const tokenCount = value.tokenCount;
-  if (tokenCount !== undefined && (typeof tokenCount !== "number" || !Number.isInteger(tokenCount) || tokenCount < 0)) {
-    throw new Error(`${label}.tokenCount is invalid`);
-  }
-  if (value.truncated !== undefined && typeof value.truncated !== "boolean") {
-    throw new Error(`${label}.truncated is invalid`);
-  }
-  return {
-    status,
-    ...(value.agentId === undefined
-      ? {}
-      : { agentId: boundedString(value.agentId, `${label}.agentId`, JOURNAL_ID_LIMIT) }),
-    ...(value.attemptId === undefined
-      ? {}
-      : { attemptId: boundedString(value.attemptId, `${label}.attemptId`, JOURNAL_ID_LIMIT) }),
-    ...(value.text === undefined ? {} : { text: boundedString(value.text, `${label}.text`, JOURNAL_TEXT_LIMIT + 32) }),
-    ...(value.error === undefined
-      ? {}
-      : { error: boundedString(value.error, `${label}.error`, JOURNAL_ERROR_LIMIT + 32) }),
-    ...(value.outputFile === undefined
+    ...(raw.attemptId === undefined
       ? {}
-      : { outputFile: boundedString(value.outputFile, `${label}.outputFile`, JOURNAL_ID_LIMIT) }),
-    ...(tokenCount === undefined ? {} : { tokenCount }),
-    compactionCount,
-    ...(value.truncated === undefined ? {} : { truncated: value.truncated }),
-    updatedAt: validTimestamp(value.updatedAt, `${label}.updatedAt`),
+      : { attemptId: boundedString(raw.attemptId, "owner.attemptId", JOURNAL_ID_LIMIT) }),
   };
 }
 
-function taskNodeIds(run: WorkflowRun): Set<string> {
-  return new Set([...run.definition.tasks.map((task) => task.id), "__synthesis__"]);
-}
-
-function parseAttemptMap(value: unknown, definition: WorkflowDefinition, label: string): Record<string, number> {
-  if (!isRecord(value)) throw new Error(`${label} must be an object`);
-  const allowed = new Set([...definition.tasks.map((task) => task.id), "__synthesis__"]);
-  const result: Record<string, number> = {};
-  for (const [nodeId, generation] of Object.entries(value)) {
-    if (!allowed.has(nodeId)) throw new Error(`${label} contains an unknown node`);
-    if (typeof generation !== "number" || !Number.isInteger(generation) || generation < 1 || generation > 1_000_000) {
-      throw new Error(`${label}.${nodeId} is invalid`);
+function parseAttemptMap(raw: unknown, label: string): Record<string, number> {
+  if (!isRecord(raw)) throw new Error(`${label} is invalid`);
+  const out: Record<string, number> = {};
+  for (const [nodeId, generation] of Object.entries(raw)) {
+    parseCallIndex(nodeId, `${label} key`);
+    if (typeof generation !== "number" || !Number.isInteger(generation) || generation < 1) {
+      throw new Error(`${label}.${nodeId} generation is invalid`);
     }
-    result[nodeId] = generation;
+    out[nodeId] = generation;
   }
-  return result;
+  return out;
 }
 
-function parseAttemptIdMap(value: unknown, definition: WorkflowDefinition, label: string): Record<string, string> {
-  if (!isRecord(value)) throw new Error(`${label} must be an object`);
-  const allowed = new Set([...definition.tasks.map((task) => task.id), "__synthesis__"]);
-  const result: Record<string, string> = {};
-  for (const [nodeId, attemptId] of Object.entries(value)) {
-    if (!allowed.has(nodeId)) throw new Error(`${label} contains an unknown node`);
-    result[nodeId] = boundedString(attemptId, `${label}.${nodeId}`, JOURNAL_ID_LIMIT);
+function parseAttemptIdMap(raw: unknown, label: string): Record<string, string> {
+  if (!isRecord(raw)) throw new Error(`${label} is invalid`);
+  const out: Record<string, string> = {};
+  for (const [nodeId, attemptId] of Object.entries(raw)) {
+    parseCallIndex(nodeId, `${label} key`);
+    out[nodeId] = boundedString(attemptId, `${label}.${nodeId}`, JOURNAL_ID_LIMIT);
   }
-  return result;
+  return out;
 }
 
-function parseBranchGeneration(value: unknown, label: string): number {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
-    throw new Error(`${label} is invalid`);
-  }
-  return value;
+function defaultAttemptId(runId: string, nodeId: string, generation = 1): string {
+  return `${runId}/${nodeId}/attempt-${generation}`;
 }
 
-function recoverableTaskStatus(status: TaskStatus): boolean {
-  return (
-    status === "pending" ||
-    status === "ready" ||
-    status === "dispatching" ||
-    status === "queued" ||
-    status === "running"
-  );
-}
-
-function activeTaskStatus(status: TaskStatus): boolean {
-  return status === "dispatching" || status === "queued" || status === "running";
-}
-
-function parseRecoveryRotationShape(
-  value: unknown,
-  runId: string,
-  nodes: ReadonlySet<string>,
-  label: string,
-): RecoveryRotation {
-  if (!isRecord(value)) throw new Error(`${label} must be an object`);
-  assertKeys(
-    value,
-    [
-      "nodeId",
-      "sourceAttemptId",
-      "sourceGeneration",
-      "sourceStatus",
-      "attemptId",
-      "generation",
-      "owner",
-      "supersededAgentId",
-    ],
-    label,
-  );
-  const nodeId = boundedString(value.nodeId, `${label}.nodeId`, JOURNAL_ID_LIMIT);
-  if (!nodes.has(nodeId)) throw new Error(`${label}.nodeId references an unknown node`);
-  const sourceAttemptId = boundedString(value.sourceAttemptId, `${label}.sourceAttemptId`, JOURNAL_ID_LIMIT);
-  const sourceGeneration = value.sourceGeneration;
-  if (
-    typeof sourceGeneration !== "number" ||
-    !Number.isInteger(sourceGeneration) ||
-    sourceGeneration < 1 ||
-    sourceGeneration > JOURNAL_GENERATION_LIMIT
-  ) {
-    throw new Error(`${label}.sourceGeneration is invalid`);
-  }
-  const sourceStatus = value.sourceStatus;
-  if (nodeId === "__synthesis__") {
-    if (sourceStatus !== "synthesizing") throw new Error(`${label}.sourceStatus is invalid for synthesis`);
-  } else if (typeof sourceStatus !== "string" || !TASK_STATUS_VALUES.has(sourceStatus as TaskStatus)) {
-    throw new Error(`${label}.sourceStatus is invalid`);
+function parseRotation(raw: unknown, runId: string): RecoveryRotation {
+  if (!isRecord(raw)) throw new Error("recovery rotation is invalid");
+  const nodeId = parseCallIndex(raw.nodeId, "rotation.nodeId");
+  const sourceAttemptId = boundedString(raw.sourceAttemptId, "rotation.sourceAttemptId", JOURNAL_ID_LIMIT);
+  const sourceGeneration = raw.sourceGeneration;
+  if (typeof sourceGeneration !== "number" || !Number.isInteger(sourceGeneration) || sourceGeneration < 1) {
+    throw new Error("rotation.sourceGeneration is invalid");
   }
-  const generation = value.generation;
+  const sourceStatus = raw.sourceStatus;
   if (
-    typeof generation !== "number" ||
-    !Number.isInteger(generation) ||
-    generation !== sourceGeneration + 1 ||
-    generation > JOURNAL_GENERATION_LIMIT
+    sourceStatus !== "running" &&
+    sourceStatus !== "completed" &&
+    sourceStatus !== "failed" &&
+    sourceStatus !== "stopped"
   ) {
-    throw new Error(`${label}.generation is invalid or not the next generation`);
+    throw new Error("rotation.sourceStatus is invalid");
   }
-  const attemptId = boundedString(value.attemptId, `${label}.attemptId`, JOURNAL_ID_LIMIT);
-  const expectedAttemptId = `${runId}/${nodeId}/attempt-${generation}`;
-  if (attemptId !== expectedAttemptId) throw new Error(`${label}.attemptId does not match its generation`);
-  const owner = parseOwner(value.owner, runId, nodeId);
-  if (owner.attemptId !== attemptId) throw new Error(`${label}.owner must identify the new attempt`);
-  const supersededAgentId =
-    value.supersededAgentId === undefined
-      ? undefined
-      : boundedString(value.supersededAgentId, `${label}.supersededAgentId`, JOURNAL_ID_LIMIT);
+  const attemptId = boundedString(raw.attemptId, "rotation.attemptId", JOURNAL_ID_LIMIT);
+  const generation = raw.generation;
+  if (typeof generation !== "number" || !Number.isInteger(generation) || generation < 1) {
+    throw new Error("rotation.generation is invalid");
+  }
+  if (generation <= sourceGeneration) throw new Error("rotation generation must exceed its source");
+  const owner = parseOwner(raw.owner, runId, nodeId);
+  if (owner.attemptId !== attemptId) throw new Error("rotation owner does not match its attempt");
   return {
     nodeId,
     sourceAttemptId,
     sourceGeneration,
-    sourceStatus: sourceStatus as RecoverySourceStatus,
+    sourceStatus,
     attemptId,
     generation,
     owner,
-    ...(supersededAgentId === undefined ? {} : { supersededAgentId }),
+    ...(raw.supersededAgentId === undefined
+      ? {}
+      : { supersededAgentId: boundedString(raw.supersededAgentId, "rotation.supersededAgentId", JOURNAL_ID_LIMIT) }),
   };
 }
 
-function parseRecoveryRotation(
-  value: unknown,
-  run: WorkflowRun,
-  label: string,
-  allowInterruptedSynthesis = false,
-): RecoveryRotation {
-  const rotation = parseRecoveryRotationShape(value, run.runId, taskNodeIds(run), label);
-  const { nodeId, sourceAttemptId, sourceGeneration, sourceStatus } = rotation;
-  if (run.attemptIds[nodeId] !== sourceAttemptId) {
-    throw new Error(`${label}.sourceAttemptId does not match the current attempt`);
-  }
-  if (run.attempts[nodeId] !== sourceGeneration) {
-    throw new Error(`${label}.sourceGeneration does not match the current generation`);
-  }
-  if (nodeId === "__synthesis__") {
-    const synthesisSourceAllowed =
-      run.status === "synthesizing" || (allowInterruptedSynthesis && run.status === "interrupted");
-    if (sourceStatus !== "synthesizing" || !synthesisSourceAllowed) {
-      throw new Error(`${label}.sourceStatus is invalid for synthesis`);
-    }
-  } else {
-    const taskStatus = run.taskStatus[nodeId];
-    if (taskStatus !== sourceStatus || !recoverableTaskStatus(taskStatus)) {
-      throw new Error(`${label}.sourceStatus does not match the current task`);
-    }
-  }
-  return rotation;
-}
-
-function parseRecoveryRotationsShape(
-  raw: unknown,
-  runId: string,
-  nodes: ReadonlySet<string>,
-  terminalNodes: ReadonlySet<string> = new Set(),
-): RecoveryRotation[] {
-  if (!Array.isArray(raw)) throw new Error("journal recovery rotations must be an array");
-  if (raw.length > JOURNAL_RECOVERY_NODE_LIMIT) throw new Error("journal recovery has too many rotations");
-  const seen = new Set<string>();
-  return raw.map((value, index) => {
-    const rotation = parseRecoveryRotationShape(value, runId, nodes, `rotations[${index}]`);
-    if (seen.has(rotation.nodeId)) throw new Error("journal recovery contains duplicate node rotations");
-    if (terminalNodes.has(rotation.nodeId)) throw new Error("journal recovery both settles and rotates a node");
-    seen.add(rotation.nodeId);
-    return rotation;
-  });
+function parseTerminalResult(raw: unknown, runId: string): RecoveryTerminalResult {
+  if (!isRecord(raw)) throw new Error("recovery terminal result is invalid");
+  const nodeId = parseCallIndex(raw.nodeId, "terminal.nodeId");
+  const attemptId = boundedString(raw.attemptId, "terminal.attemptId", JOURNAL_ID_LIMIT);
+  const result = parseResult(raw.result, "terminal.result");
+  const owner = parseOwner(raw.owner, runId, nodeId);
+  if (owner.attemptId !== attemptId) throw new Error("terminal owner does not match its attempt");
+  return { nodeId, attemptId, result, owner };
 }
 
-function parseRecoveryRotations(
-  raw: unknown,
-  run: WorkflowRun,
-  terminalNodes: ReadonlySet<string> = new Set(),
-): RecoveryRotation[] {
-  if (!Array.isArray(raw)) throw new Error("journal recovery rotations must be an array");
-  if (raw.length > JOURNAL_RECOVERY_NODE_LIMIT) throw new Error("journal recovery has too many rotations");
-  const seen = new Set<string>();
-  const rotations = raw.map((value, index) => {
-    const rotation = parseRecoveryRotation(value, run, `rotations[${index}]`);
-    if (seen.has(rotation.nodeId)) throw new Error("journal recovery contains duplicate node rotations");
-    if (terminalNodes.has(rotation.nodeId)) throw new Error("journal recovery both settles and rotates a node");
-    seen.add(rotation.nodeId);
-    return rotation;
-  });
-  for (const task of run.definition.tasks) {
-    if (!activeTaskStatus(run.taskStatus[task.id]) || terminalNodes.has(task.id)) continue;
-    if (!seen.has(task.id)) throw new Error(`journal recovery omits active task ${task.id}`);
+function parseRunRecovery(raw: Record<string, unknown>, run: ScriptRun, timestamp: number): RunRecoveryEvent {
+  if (raw.status !== "interrupted") throw new Error("run recovery status is invalid");
+  if (typeof raw.branchGeneration !== "number" || !Number.isInteger(raw.branchGeneration) || raw.branchGeneration < 0) {
+    throw new Error("run recovery branchGeneration is invalid");
   }
-  if (
-    run.status === "synthesizing" &&
-    !run.synthesisResult &&
-    !terminalNodes.has("__synthesis__") &&
-    !seen.has("__synthesis__")
-  ) {
-    throw new Error("journal recovery omits active synthesis");
-  }
-  return rotations;
-}
-
-function parseRecoveryTerminalResultShape(
-  value: unknown,
-  runId: string,
-  nodes: ReadonlySet<string>,
-  label: string,
-): RecoveryTerminalResult {
-  if (!isRecord(value)) throw new Error(`${label} must be an object`);
-  assertKeys(value, ["nodeId", "attemptId", "result", "owner"], label);
-  const nodeId = boundedString(value.nodeId, `${label}.nodeId`, JOURNAL_ID_LIMIT);
-  if (!nodes.has(nodeId)) throw new Error("journal recovery terminal result references an unknown node");
-  const attemptId = boundedString(value.attemptId, `${label}.attemptId`, JOURNAL_ID_LIMIT);
-  const owner = parseOwner(value.owner, runId, nodeId);
-  if (owner.attemptId !== attemptId) throw new Error("journal recovery terminal result owner is invalid");
-  const parsed = parseResult(value.result, `${label}.result`);
-  if (parsed.attemptId !== undefined && parsed.attemptId !== attemptId) {
-    throw new Error("journal recovery terminal result payload references a superseded attempt");
+  if (!Array.isArray(raw.rotations) || raw.rotations.length > JOURNAL_RECOVERY_NODE_LIMIT) {
+    throw new Error("run recovery rotations are invalid");
   }
+  const rotations = raw.rotations.map((rotation) => parseRotation(rotation, run.runId));
+  const terminalResults =
+    raw.terminalResults === undefined
+      ? undefined
+      : (() => {
+          if (!Array.isArray(raw.terminalResults)) throw new Error("run recovery terminalResults is invalid");
+          return raw.terminalResults.map((terminal) => parseTerminalResult(terminal, run.runId));
+        })();
+  const recoveryId = boundedString(raw.recoveryId, "recoveryId", JOURNAL_RECOVERY_ID_LIMIT);
+  if (!RECOVERY_ID_PATTERN.test(recoveryId)) throw new Error("recoveryId is malformed");
   return {
-    nodeId,
-    attemptId,
-    result: parsed.attemptId === undefined ? { ...parsed, attemptId } : parsed,
-    owner,
+    kind: "run_recovery",
+    schemaVersion: JOURNAL_SCHEMA_VERSION,
+    runId: run.runId,
+    status: "interrupted",
+    branchGeneration: raw.branchGeneration,
+    rotations,
+    ...(terminalResults === undefined || terminalResults.length === 0 ? {} : { terminalResults }),
+    recoveryId,
+    timestamp,
   };
 }
 
-function parseRecoveryTerminalResultShapes(
-  raw: unknown,
-  runId: string,
-  nodes: ReadonlySet<string>,
-): RecoveryTerminalResult[] {
-  if (raw === undefined) return [];
-  if (!Array.isArray(raw)) throw new Error("journal recovery terminal results must be an array");
-  if (raw.length > JOURNAL_RECOVERY_NODE_LIMIT) throw new Error("journal recovery has too many terminal results");
-  const seen = new Set<string>();
-  return raw.map((value, index) => {
-    const terminal = parseRecoveryTerminalResultShape(value, runId, nodes, `terminalResults[${index}]`);
-    if (seen.has(terminal.nodeId)) throw new Error("journal recovery contains duplicate terminal results");
-    seen.add(terminal.nodeId);
-    return terminal;
-  });
-}
-
-function parseRecoveryTerminalResults(raw: unknown, run: WorkflowRun): RecoveryTerminalResult[] {
-  const terminals = parseRecoveryTerminalResultShapes(raw, run.runId, taskNodeIds(run));
-  for (const terminal of terminals) {
-    const currentStatus = terminal.nodeId === "__synthesis__" ? undefined : run.taskStatus[terminal.nodeId];
-    if (terminal.nodeId === "__synthesis__" && run.synthesisResult) {
-      throw new Error("journal recovery terminal result references settled synthesis");
-    }
-    if (currentStatus !== undefined && isTerminalTask(currentStatus)) {
-      throw new Error("journal recovery terminal result references a settled task");
-    }
-    if (terminal.attemptId !== run.attemptIds[terminal.nodeId]) {
-      throw new Error("journal recovery terminal result references a superseded attempt");
-    }
-  }
-  return terminals;
-}
-
-function parseRunRecovery(raw: Record<string, unknown>, run: WorkflowRun, timestamp: number): RunRecoveryEvent {
-  if (raw.schemaVersion !== JOURNAL_SCHEMA_VERSION) throw new Error("run recovery schema version is unsupported");
-  assertKeys(
-    raw,
-    [
-      "kind",
-      "schemaVersion",
-      "runId",
-      "status",
-      "branchGeneration",
-      "rotations",
-      "terminalResults",
-      "recoveryId",
-      "legacyMigration",
-      "timestamp",
-    ],
-    "run recovery",
-  );
-  if (raw.legacyMigration !== undefined && raw.legacyMigration !== true) {
-    throw new Error("run recovery legacy migration marker is invalid");
+function parseTerminalRecovery(raw: Record<string, unknown>, run: ScriptRun, timestamp: number): TerminalRecoveryEvent {
+  if (raw.status !== "failed" && raw.status !== "stopped") throw new Error("terminal recovery status is invalid");
+  if (raw.terminalIntent !== "failure" && raw.terminalIntent !== "stop") {
+    throw new Error("terminal recovery intent is invalid");
   }
-  if (run.status === "interrupted" || !["running", "pausing", "synthesizing", "stopping"].includes(run.status)) {
-    throw new Error(`invalid workflow recovery source state: ${run.status}`);
+  if (typeof raw.branchGeneration !== "number" || !Number.isInteger(raw.branchGeneration) || raw.branchGeneration < 0) {
+    throw new Error("terminal recovery branchGeneration is invalid");
   }
-  if (run.terminalIntent !== undefined) throw new Error("workflow with terminal intent cannot be recovered");
-  if (raw.status !== "interrupted") throw new Error("run recovery status must be interrupted");
-  const branchGeneration = parseBranchGeneration(raw.branchGeneration, "branchGeneration");
-  const terminalResults = parseRecoveryTerminalResults(raw.terminalResults, run);
-  if (Array.isArray(raw.rotations) && raw.rotations.length + terminalResults.length > JOURNAL_RECOVERY_NODE_LIMIT) {
-    throw new Error("journal recovery affects too many nodes");
+  if (!Array.isArray(raw.terminalResults) || raw.terminalResults.length > JOURNAL_RECOVERY_NODE_LIMIT) {
+    throw new Error("terminal recovery terminalResults are invalid");
   }
-  const base = {
-    kind: "run_recovery" as const,
-    schemaVersion: JOURNAL_SCHEMA_VERSION as 2,
-    runId: run.runId,
-    status: "interrupted" as const,
-    branchGeneration,
-    rotations: parseRecoveryRotations(raw.rotations, run, new Set(terminalResults.map((item) => item.nodeId))),
-    ...(terminalResults.length > 0 ? { terminalResults } : {}),
-  };
-  const expectedRecoveryId = deriveRecoveryId(base);
-  const legacyMigration = raw.recoveryId === undefined;
-  const recoveryId = legacyMigration ? expectedRecoveryId : parseRecoveryId(raw.recoveryId, "recoveryId");
-  if (recoveryId !== expectedRecoveryId) {
-    throw new Error("run recovery recoveryId does not match its semantic source and target fields");
+  const terminalResults = raw.terminalResults.map((terminal) => parseTerminalResult(terminal, run.runId));
+  if (!Array.isArray(raw.blockedNodeIds) || raw.blockedNodeIds.length > JOURNAL_RECOVERY_NODE_LIMIT) {
+    throw new Error("terminal recovery blockedNodeIds are invalid");
   }
+  const blockedNodeIds = raw.blockedNodeIds.map((nodeId) => parseCallIndex(nodeId, "blockedNodeId"));
+  const recoveryId = boundedString(raw.recoveryId, "recoveryId", JOURNAL_RECOVERY_ID_LIMIT);
+  if (!RECOVERY_ID_PATTERN.test(recoveryId)) throw new Error("recoveryId is malformed");
   return {
-    ...base,
+    kind: "terminal_recovery",
+    schemaVersion: JOURNAL_SCHEMA_VERSION,
+    runId: run.runId,
+    status: raw.status,
+    terminalIntent: raw.terminalIntent,
+    branchGeneration: raw.branchGeneration,
+    terminalResults,
+    blockedNodeIds,
+    ...(raw.error === undefined
+      ? {}
+      : { error: boundedString(raw.error, "terminal recovery error", JOURNAL_ERROR_LIMIT) }),
     recoveryId,
-    ...(legacyMigration ? { legacyMigration: true } : {}),
     timestamp,
   };
 }
 
-function parseDuplicateRunRecovery(raw: Record<string, unknown>, run: WorkflowRun): RunRecoveryEvent {
-  if (raw.schemaVersion !== JOURNAL_SCHEMA_VERSION) throw new Error("run recovery schema version is unsupported");
-  assertKeys(
-    raw,
-    [
-      "kind",
-      "schemaVersion",
-      "runId",
-      "status",
-      "branchGeneration",
-      "rotations",
-      "terminalResults",
-      "recoveryId",
-      "legacyMigration",
-      "timestamp",
-    ],
-    "run recovery duplicate",
-  );
-  if (raw.legacyMigration !== undefined && raw.legacyMigration !== true) {
-    throw new Error("run recovery legacy migration marker is invalid");
-  }
-  const runId = boundedString(raw.runId, "runId", JOURNAL_ID_LIMIT);
-  if (runId !== run.runId) throw new Error("run recovery duplicate references a different run");
-  if (raw.status !== "interrupted") throw new Error("run recovery status must be interrupted");
-  const branchGeneration = parseBranchGeneration(raw.branchGeneration, "branchGeneration");
-  const nodes = taskNodeIds(run);
-  const terminalResults = parseRecoveryTerminalResultShapes(raw.terminalResults, runId, nodes);
-  if (Array.isArray(raw.rotations) && raw.rotations.length + terminalResults.length > JOURNAL_RECOVERY_NODE_LIMIT) {
-    throw new Error("journal recovery affects too many nodes");
-  }
-  const base: RecoveryIdInput = {
-    kind: "run_recovery" as const,
-    runId,
-    status: "interrupted",
-    branchGeneration,
-    rotations: parseRecoveryRotationsShape(
-      raw.rotations,
-      runId,
-      nodes,
-      new Set(terminalResults.map((item) => item.nodeId)),
-    ),
-    ...(terminalResults.length > 0 ? { terminalResults } : {}),
-  };
-  const expectedRecoveryId = deriveRecoveryId(base);
-  const legacyMigration = raw.recoveryId === undefined;
-  const recoveryId = legacyMigration ? expectedRecoveryId : parseRecoveryId(raw.recoveryId, "recoveryId");
-  if (recoveryId !== expectedRecoveryId) {
-    throw new Error("run recovery recoveryId does not match its semantic source and target fields");
+function parseAttemptRecovery(raw: Record<string, unknown>, run: ScriptRun, timestamp: number): AttemptRecoveryEvent {
+  if (typeof raw.branchGeneration !== "number" || !Number.isInteger(raw.branchGeneration) || raw.branchGeneration < 0) {
+    throw new Error("attempt recovery branchGeneration is invalid");
   }
+  const rotation = parseRotation(raw.rotation, run.runId);
   return {
-    ...base,
-    kind: "run_recovery",
-    schemaVersion: JOURNAL_SCHEMA_VERSION as 2,
-    recoveryId,
-    ...(legacyMigration ? { legacyMigration: true } : {}),
-    timestamp: validTimestamp(raw.timestamp, "timestamp"),
+    kind: "attempt_recovery",
+    schemaVersion: JOURNAL_SCHEMA_VERSION,
+    runId: run.runId,
+    nodeId: rotation.nodeId,
+    branchGeneration: raw.branchGeneration,
+    rotation,
+    ...(raw.legacyMigration === true ? { legacyMigration: true } : {}),
+    timestamp,
   };
 }
 
-function parseBlockedNodeIds(raw: unknown, nodes: ReadonlySet<string>): string[] {
-  if (!Array.isArray(raw)) throw new Error("terminal recovery blockedNodeIds must be an array");
-  if (raw.length > JOURNAL_RECOVERY_NODE_LIMIT) throw new Error("terminal recovery has too many blocked nodes");
-  const seen = new Set<string>();
-  return raw.map((value, index) => {
-    const nodeId = boundedString(value, `blockedNodeIds[${index}]`, JOURNAL_ID_LIMIT);
-    if (nodeId === "__synthesis__" || !nodes.has(nodeId)) {
-      throw new Error("terminal recovery blockedNodeIds references an unknown task node");
-    }
-    if (seen.has(nodeId)) throw new Error("terminal recovery contains duplicate blocked nodes");
-    seen.add(nodeId);
-    return nodeId;
-  });
+/** Digest of an atomic recovery's semantic content, for duplicate detection. */
+export function recoverySemanticFingerprint(event: RunRecoveryEvent | TerminalRecoveryEvent): string {
+  const { recoveryId: _recoveryId, ...rest } = event;
+  return createHash("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 
-type TerminalRecoveryBase = Omit<TerminalRecoveryEvent, "recoveryId" | "timestamp"> & { recoveryId: string };
-
-function parseTerminalRecoveryBase(
-  raw: Record<string, unknown>,
-  runId: string,
-  nodes: ReadonlySet<string>,
-  label: string,
-): TerminalRecoveryBase {
-  if (raw.schemaVersion !== JOURNAL_SCHEMA_VERSION) throw new Error("terminal recovery schema version is unsupported");
-  assertKeys(
-    raw,
-    [
-      "kind",
-      "schemaVersion",
-      "runId",
-      "status",
-      "terminalIntent",
-      "branchGeneration",
-      "terminalResults",
-      "blockedNodeIds",
-      "error",
-      "recoveryId",
-      "timestamp",
-    ],
-    label,
-  );
-  if (raw.kind !== "terminal_recovery") throw new Error(`${label} kind is invalid`);
-  const parsedRunId = boundedString(raw.runId, `${label}.runId`, JOURNAL_ID_LIMIT);
-  if (parsedRunId !== runId) throw new Error(`${label} references a different workflow run`);
-  const statusValue = raw.status;
-  if (statusValue !== "failed" && statusValue !== "stopped") throw new Error(`${label}.status is invalid`);
-  const status: "failed" | "stopped" = statusValue;
-  const terminalIntentValue = raw.terminalIntent;
-  if (terminalIntentValue !== "failure" && terminalIntentValue !== "stop") {
-    throw new Error(`${label}.terminalIntent is invalid`);
-  }
-  const terminalIntent: "failure" | "stop" = terminalIntentValue;
-  if ((terminalIntent === "failure" && status !== "failed") || (terminalIntent === "stop" && status !== "stopped")) {
-    throw new Error(`${label}.status does not match terminalIntent`);
-  }
-  const branchGeneration = parseBranchGeneration(raw.branchGeneration, `${label}.branchGeneration`);
-  if (!Array.isArray(raw.terminalResults)) throw new Error(`${label}.terminalResults must be an array`);
-  const terminalResults = parseRecoveryTerminalResultShapes(raw.terminalResults, parsedRunId, nodes);
-  const blockedNodeIds = parseBlockedNodeIds(raw.blockedNodeIds, nodes);
-  const affected = new Set<string>();
-  for (const terminal of terminalResults) {
-    if (affected.has(terminal.nodeId)) throw new Error(`${label} settles and blocks the same node`);
-    affected.add(terminal.nodeId);
+function parseDuplicateRunRecovery(raw: Record<string, unknown>, run: ScriptRun): RunRecoveryEvent {
+  if (raw.status !== "interrupted") throw new Error("run recovery status is invalid");
+  if (!Array.isArray(raw.rotations) || raw.rotations.length > JOURNAL_RECOVERY_NODE_LIMIT) {
+    throw new Error("run recovery rotations are invalid");
   }
-  for (const nodeId of blockedNodeIds) {
-    if (affected.has(nodeId)) throw new Error(`${label} settles and blocks the same node`);
-    affected.add(nodeId);
-  }
-  const error = raw.error === undefined ? undefined : boundedString(raw.error, `${label}.error`, JOURNAL_ERROR_LIMIT);
-  const base = {
-    kind: "terminal_recovery" as const,
-    schemaVersion: JOURNAL_SCHEMA_VERSION as 2,
-    runId: parsedRunId,
-    status,
-    terminalIntent,
-    branchGeneration,
-    terminalResults,
-    blockedNodeIds,
-    ...(error === undefined ? {} : { error }),
+  const rotations = raw.rotations.map((rotation) => parseRotation(rotation, run.runId));
+  const terminalResults =
+    raw.terminalResults === undefined
+      ? undefined
+      : (() => {
+          if (!Array.isArray(raw.terminalResults)) throw new Error("run recovery terminalResults is invalid");
+          return raw.terminalResults.map((terminal) => parseTerminalResult(terminal, run.runId));
+        })();
+  return {
+    kind: "run_recovery",
+    schemaVersion: JOURNAL_SCHEMA_VERSION,
+    runId: run.runId,
+    status: "interrupted",
+    branchGeneration: run.updatedAt, // not meaningful for duplicates; fingerprint covers content
+    rotations,
+    ...(terminalResults === undefined || terminalResults.length === 0 ? {} : { terminalResults }),
+    recoveryId: boundedString(raw.recoveryId, "recoveryId", JOURNAL_RECOVERY_ID_LIMIT),
+    timestamp: run.updatedAt,
   };
-  const expectedRecoveryId = deriveRecoveryId(base);
-  const recoveryId = parseRecoveryId(raw.recoveryId, `${label}.recoveryId`);
-  if (recoveryId !== expectedRecoveryId) {
-    throw new Error(`${label}.recoveryId does not match its semantic terminal fields`);
-  }
-  return { ...base, recoveryId };
-}
-
-function parseTerminalRecovery(
-  raw: Record<string, unknown>,
-  run: WorkflowRun,
-  timestamp: number,
-): TerminalRecoveryEvent {
-  const base = parseTerminalRecoveryBase(raw, run.runId, taskNodeIds(run), "terminal recovery");
-  if (run.status !== "stopping" || run.terminalIntent !== base.terminalIntent) {
-    throw new Error(`invalid terminal recovery source state: ${run.status}`);
-  }
-  const terminalNodes = new Set(base.terminalResults.map((terminal) => terminal.nodeId));
-  for (const terminal of base.terminalResults) {
-    if (terminal.nodeId === "__synthesis__") {
-      if (!run.definition.synthesis) throw new Error("terminal recovery references undefined synthesis");
-      if (run.synthesisResult && JSON.stringify(run.synthesisResult) !== JSON.stringify(terminal.result)) {
-        throw new Error("terminal recovery synthesis fact contradicts an existing result");
-      }
-      if (!run.synthesisResult && terminal.attemptId !== run.attemptIds.__synthesis__) {
-        throw new Error("terminal recovery synthesis fact references a superseded attempt");
-      }
-    } else {
-      const existingResult = run.taskResults[terminal.nodeId];
-      if (existingResult && JSON.stringify(existingResult) !== JSON.stringify(terminal.result)) {
-        throw new Error("terminal recovery task fact contradicts an existing result");
-      }
-      if (!existingResult && isTerminalTask(run.taskStatus[terminal.nodeId])) {
-        throw new Error("terminal recovery task fact references a settled task");
-      }
-      if (!existingResult && terminal.attemptId !== run.attemptIds[terminal.nodeId]) {
-        throw new Error("terminal recovery task fact references a superseded attempt");
-      }
-    }
-  }
-  for (const task of run.definition.tasks) {
-    if (isTerminalTask(run.taskStatus[task.id]) || run.taskResults[task.id]) continue;
-    if (!terminalNodes.has(task.id) && !base.blockedNodeIds.includes(task.id)) {
-      throw new Error(`terminal recovery omits unresolved task ${task.id}`);
-    }
-  }
-  const synthesisUnresolved = run.definition.synthesis !== undefined && !run.synthesisResult;
-  if (synthesisUnresolved && !terminalNodes.has("__synthesis__")) {
-    throw new Error("terminal recovery omits unresolved synthesis");
-  }
-  return { ...base, timestamp };
-}
-
-function parseDuplicateTerminalRecovery(raw: Record<string, unknown>, run: WorkflowRun): TerminalRecoveryEvent {
-  const base = parseTerminalRecoveryBase(raw, run.runId, taskNodeIds(run), "terminal recovery duplicate");
-  return { ...base, timestamp: validTimestamp(raw.timestamp, "timestamp") };
 }
 
-function parseAttemptRecovery(raw: Record<string, unknown>, run: WorkflowRun, timestamp: number): AttemptRecoveryEvent {
-  if (raw.schemaVersion !== JOURNAL_SCHEMA_VERSION) throw new Error("attempt recovery schema version is unsupported");
-  assertKeys(
-    raw,
-    ["kind", "schemaVersion", "runId", "nodeId", "branchGeneration", "rotation", "legacyMigration", "timestamp"],
-    "attempt recovery",
-  );
-  const legacyMigration = raw.legacyMigration === true;
-  if (
-    run.terminalIntent !== undefined ||
-    ["completed", "failed", "stopped"].includes(run.status) ||
-    (run.status === "interrupted" && !legacyMigration)
-  ) {
-    throw new Error(`invalid attempt recovery source state: ${run.status}`);
-  }
-  if (raw.legacyMigration !== undefined && raw.legacyMigration !== true) {
-    throw new Error("attempt recovery legacy migration marker is invalid");
+function parseDuplicateTerminalRecovery(raw: Record<string, unknown>, run: ScriptRun): TerminalRecoveryEvent {
+  if (raw.status !== "failed" && raw.status !== "stopped") throw new Error("terminal recovery status is invalid");
+  if (!Array.isArray(raw.terminalResults) || raw.terminalResults.length > JOURNAL_RECOVERY_NODE_LIMIT) {
+    throw new Error("terminal recovery terminalResults are invalid");
   }
-  const branchGeneration = parseBranchGeneration(raw.branchGeneration, "branchGeneration");
-  const nodeId = boundedString(raw.nodeId, "nodeId", JOURNAL_ID_LIMIT);
-  const rotation = parseRecoveryRotation(raw.rotation, run, "rotation", legacyMigration);
-  if (rotation.nodeId !== nodeId) throw new Error("attempt recovery node does not match its rotation");
+  const terminalResults = raw.terminalResults.map((terminal) => parseTerminalResult(terminal, run.runId));
   return {
-    kind: "attempt_recovery",
+    kind: "terminal_recovery",
     schemaVersion: JOURNAL_SCHEMA_VERSION,
     runId: run.runId,
-    nodeId,
-    branchGeneration,
-    rotation,
-    ...(legacyMigration ? { legacyMigration: true } : {}),
-    timestamp,
+    status: raw.status,
+    terminalIntent: raw.terminalIntent === "failure" ? "failure" : "stop",
+    branchGeneration: run.updatedAt,
+    terminalResults,
+    blockedNodeIds: [],
+    recoveryId: boundedString(raw.recoveryId, "recoveryId", JOURNAL_RECOVERY_ID_LIMIT),
+    timestamp: run.updatedAt,
   };
 }
 
-function defaultAttemptId(runId: string, nodeId: string): string {
-  return `${runId}/${nodeId}/attempt-1`;
-}
-
-function parseEvent(raw: unknown, runs: Map<string, WorkflowRun>): JournalEvent {
-  if (!isRecord(raw)) throw new Error("journal event must be an object");
-  assertKeys(
-    raw,
-    [
-      "kind",
-      "schemaVersion",
-      "runId",
-      "definition",
-      "attempts",
-      "attemptIds",
-      "status",
-      "error",
-      "terminalIntent",
-      "nodeId",
-      "agentId",
-      "attemptId",
-      "generation",
-      "owner",
-      "result",
-      "compactionCount",
-      "branchGeneration",
-      "rotations",
-      "rotation",
-      "sourceAttemptId",
-      "sourceGeneration",
-      "sourceStatus",
-      "supersededAgentId",
-      "legacyMigration",
-      "terminalResults",
-      "blockedNodeIds",
-      "recoveryId",
-      "timestamp",
-    ],
-    "journal event",
-  );
+function parseEvent(raw: unknown, runs: Map<string, ScriptRun>): JournalEvent {
+  if (!isRecord(raw)) throw new Error("journal event is not an object");
   if (typeof raw.kind !== "string" || !JOURNAL_KINDS.has(raw.kind)) throw new Error("journal event kind is unknown");
   if (raw.schemaVersion !== JOURNAL_SCHEMA_VERSION && raw.schemaVersion !== JOURNAL_LEGACY_SCHEMA_VERSION) {
     throw new Error("journal schema version is unsupported");
@@ -1079,23 +600,90 @@ function parseEvent(raw: unknown, runs: Map<string, WorkflowRun>): JournalEvent
 
   if (raw.kind === "run_created") {
     if (runs.has(runId)) throw new Error("duplicate workflow run_created event");
-    const definition = validateWorkflow(raw.definition);
+    const script = boundedString(raw.script, "script", JOURNAL_SCRIPT_LIMIT);
+    const scriptHash = boundedString(raw.scriptHash, "scriptHash", 128);
+    const meta = parseMeta(raw.meta);
+    const toolset =
+      raw.toolset === undefined
+        ? undefined
+        : typeof raw.toolset === "string" && raw.toolset.length > 0 && raw.toolset.length <= 64
+          ? raw.toolset
+          : undefined;
+    const frozenMaxAgents =
+      typeof raw.frozenMaxAgents === "number" && Number.isInteger(raw.frozenMaxAgents) && raw.frozenMaxAgents >= 1
+        ? raw.frozenMaxAgents
+        : undefined;
+    const frozenConcurrency =
+      typeof raw.frozenConcurrency === "number" && Number.isInteger(raw.frozenConcurrency) && raw.frozenConcurrency >= 1
+        ? raw.frozenConcurrency
+        : undefined;
+    const frozenAgentRetries =
+      typeof raw.frozenAgentRetries === "number" &&
+      Number.isInteger(raw.frozenAgentRetries) &&
+      raw.frozenAgentRetries >= 0
+        ? raw.frozenAgentRetries
+        : undefined;
+    const frozenTokenBudget =
+      raw.frozenTokenBudget === null
+        ? null
+        : typeof raw.frozenTokenBudget === "number" &&
+            Number.isFinite(raw.frozenTokenBudget) &&
+            raw.frozenTokenBudget >= 1
+          ? raw.frozenTokenBudget
+          : undefined;
+    const frozenAgentTimeoutMs =
+      raw.frozenAgentTimeoutMs === null
+        ? null
+        : typeof raw.frozenAgentTimeoutMs === "number" &&
+            Number.isFinite(raw.frozenAgentTimeoutMs) &&
+            raw.frozenAgentTimeoutMs >= 1
+          ? raw.frozenAgentTimeoutMs
+          : undefined;
+    const frozenExcludeTools =
+      Array.isArray(raw.frozenExcludeTools) && raw.frozenExcludeTools.every((v) => typeof v === "string")
+        ? (raw.frozenExcludeTools as string[])
+        : undefined;
     return {
       kind: "run_created",
       schemaVersion: raw.schemaVersion as JournalSchemaVersion,
       runId,
-      definition,
+      script,
+      scriptHash,
+      meta,
+      ...(toolset ? { toolset } : {}),
+      ...(frozenMaxAgents !== undefined ? { frozenMaxAgents } : {}),
+      ...(frozenConcurrency !== undefined ? { frozenConcurrency } : {}),
+      ...(frozenAgentRetries !== undefined ? { frozenAgentRetries } : {}),
+      ...(frozenTokenBudget !== undefined ? { frozenTokenBudget } : {}),
+      ...(frozenAgentTimeoutMs !== undefined ? { frozenAgentTimeoutMs } : {}),
+      ...(frozenExcludeTools ? { frozenExcludeTools } : {}),
       timestamp,
-      ...(raw.attempts === undefined ? {} : { attempts: parseAttemptMap(raw.attempts, definition, "attempts") }),
-      ...(raw.attemptIds === undefined
-        ? {}
-        : { attemptIds: parseAttemptIdMap(raw.attemptIds, definition, "attemptIds") }),
+      ...(raw.attempts === undefined ? {} : { attempts: parseAttemptMap(raw.attempts, "attempts") }),
+      ...(raw.attemptIds === undefined ? {} : { attemptIds: parseAttemptIdMap(raw.attemptIds, "attemptIds") }),
     };
   }
 
   const run = runs.get(runId);
   if (!run) throw new Error("journal event references an unknown run");
-  const nodes = taskNodeIds(run);
+  if (raw.kind === "run_revision") {
+    const revision = raw.revision;
+    if (typeof revision !== "number" || !Number.isInteger(revision) || revision <= (run.revision ?? 0))
+      throw new Error("workflow revision is invalid or stale");
+    const script = boundedString(raw.script, "revision.script", JOURNAL_SCRIPT_LIMIT);
+    const scriptHash = boundedString(raw.scriptHash, "revision.scriptHash", 128);
+    return {
+      kind: "run_revision",
+      schemaVersion: JOURNAL_SCHEMA_VERSION,
+      runId,
+      revision,
+      script,
+      scriptHash,
+      meta: parseMeta(raw.meta),
+      timestamp,
+    };
+  }
+  if (raw.kind === "run_removed")
+    return { kind: "run_removed", schemaVersion: JOURNAL_SCHEMA_VERSION, runId, timestamp };
   if (raw.kind === "run_recovery") return parseRunRecovery(raw, run, timestamp);
   if (raw.kind === "terminal_recovery") return parseTerminalRecovery(raw, run, timestamp);
   if (raw.kind === "attempt_recovery") return parseAttemptRecovery(raw, run, timestamp);
@@ -1118,63 +706,14 @@ function parseEvent(raw: unknown, runs: Map<string, WorkflowRun>): JournalEvent
     };
   }
 
-  // Terminal workflow outcomes are immutable. A late task/synthesis fact from
-  // the superseded execution is stale, not a reason to quarantine an otherwise
-  // valid run (duplicate workflow transition entries remain replay-compatible).
+  // Terminal workflow outcomes are immutable. A late call fact from the
+  // superseded execution is stale, not a reason to quarantine an otherwise
+  // valid run.
   if (isTerminalWorkflowStatus(run.status) && raw.kind !== "workflow_transition") {
     throw new StaleJournalGenerationError("journal event follows a terminal workflow outcome");
   }
 
-  if (raw.kind === "synthesis_result") {
-    const result = parseResult(raw.result, "synthesis result");
-    const rawAttemptId =
-      raw.attemptId === undefined ? undefined : boundedString(raw.attemptId, "attemptId", JOURNAL_ID_LIMIT);
-    if (rawAttemptId !== undefined && result.attemptId !== undefined && rawAttemptId !== result.attemptId) {
-      throw new StaleJournalGenerationError("synthesis result carries conflicting attempt generations");
-    }
-    const synthesisAttemptId = rawAttemptId ?? result.attemptId ?? run.attemptIds.__synthesis__;
-    const owner = raw.owner === undefined ? undefined : parseOwner(raw.owner, runId, "__synthesis__");
-    const currentAttemptId = run.attemptIds.__synthesis__;
-    if (
-      run.attemptTracking &&
-      (rawAttemptId === undefined ||
-        result.attemptId === undefined ||
-        owner === undefined ||
-        owner.attemptId === undefined)
-    ) {
-      throw new Error("synthesis result is missing a required raw, payload, or owner attemptId");
-    }
-    if (
-      run.attemptTracking &&
-      (rawAttemptId !== result.attemptId ||
-        synthesisAttemptId !== currentAttemptId ||
-        owner?.attemptId !== currentAttemptId)
-    ) {
-      throw new StaleJournalGenerationError("synthesis result references a stale attempt");
-    }
-    if (synthesisAttemptId !== currentAttemptId) {
-      throw new StaleJournalGenerationError("synthesis result references a superseded attempt");
-    }
-    if (owner?.attemptId && currentAttemptId && owner.attemptId !== currentAttemptId) {
-      throw new StaleJournalGenerationError("journal synthesis owner references a superseded attempt");
-    }
-    return {
-      kind: "synthesis_result",
-      schemaVersion: JOURNAL_SCHEMA_VERSION,
-      runId,
-      result: result.attemptId === undefined ? { ...result, attemptId: synthesisAttemptId } : result,
-      attemptId: synthesisAttemptId,
-      timestamp,
-      ...(owner ? { owner } : {}),
-    };
-  }
-
-  const nodeId = boundedString(raw.nodeId, "nodeId", JOURNAL_ID_LIMIT);
-  if (
-    !nodes.has(nodeId) ||
-    (nodeId === "__synthesis__" && raw.kind !== "task_compacted" && raw.kind !== "task_attempt")
-  )
-    throw new Error("journal event references an unknown task node");
+  const nodeId = parseCallIndex(raw.nodeId, "nodeId");
   const owner = raw.owner === undefined ? undefined : parseOwner(raw.owner, runId, nodeId);
   const rawAttemptId =
     raw.attemptId === undefined ? undefined : boundedString(raw.attemptId, "attemptId", JOURNAL_ID_LIMIT);
@@ -1182,27 +721,27 @@ function parseEvent(raw: unknown, runs: Map<string, WorkflowRun>): JournalEvent
   if (run.attemptTracking && (rawAttemptId === undefined || owner === undefined || owner.attemptId === undefined)) {
     throw new Error("journal attempt-aware event is missing a required raw or owner attemptId");
   }
-  if (raw.kind !== "task_attempt" && owner?.attemptId && attemptId && owner.attemptId !== attemptId) {
+  if (raw.kind !== "call_attempt" && owner?.attemptId && attemptId && owner.attemptId !== attemptId) {
     throw new StaleJournalGenerationError("journal owner references a different attempt");
   }
-  if (raw.kind !== "task_attempt" && attemptId !== run.attemptIds[nodeId]) {
+  if (raw.kind !== "call_attempt" && attemptId !== run.attemptIds[nodeId]) {
     throw new StaleJournalGenerationError("journal event references a superseded attempt");
   }
 
-  if (raw.kind === "task_attempt") {
+  if (raw.kind === "call_attempt") {
     const generation = raw.generation;
     if (typeof generation !== "number" || !Number.isInteger(generation) || generation < 1 || generation > 1_000_000) {
-      throw new Error("task attempt generation is invalid");
+      throw new Error("call attempt generation is invalid");
     }
     if (generation <= (run.attempts[nodeId] ?? 0)) {
-      throw new StaleJournalGenerationError("task attempt generation is stale");
+      throw new StaleJournalGenerationError("call attempt generation is stale");
     }
     const expectedAttemptId = `${runId}/${nodeId}/attempt-${generation}`;
     if (attemptId !== expectedAttemptId || owner?.attemptId !== attemptId) {
-      throw new Error("task attempt does not identify its next generation");
+      throw new Error("call attempt does not identify its next generation");
     }
     return {
-      kind: "task_attempt",
+      kind: "call_attempt",
       schemaVersion: JOURNAL_SCHEMA_VERSION,
       runId,
       nodeId,
@@ -1213,20 +752,15 @@ function parseEvent(raw: unknown, runs: Map<string, WorkflowRun>): JournalEvent
     };
   }
 
-  if (raw.kind === "task_transition") {
-    if (!TASK_STATUS_VALUES.has(raw.status as TaskStatus)) throw new Error("task status is unknown");
-    const previous = run.taskStatus[nodeId];
-    const legacyDirectStart = previous === "pending" && raw.status === "running";
-    if (!previous || (!canTransitionTask(previous, raw.status as TaskStatus) && !legacyDirectStart)) {
-      throw new Error(`invalid task transition: ${String(previous)} -> ${String(raw.status)}`);
-    }
+  if (raw.kind === "call_transition") {
+    if (!CALL_STATUS_VALUES.has(raw.status as CallStatus)) throw new Error("call status is unknown");
     const agentId = raw.agentId === undefined ? undefined : boundedString(raw.agentId, "agentId", JOURNAL_ID_LIMIT);
     return {
-      kind: "task_transition",
+      kind: "call_transition",
       schemaVersion: JOURNAL_SCHEMA_VERSION,
       runId,
       nodeId,
-      status: raw.status as TaskStatus,
+      status: raw.status as CallStatus,
       timestamp,
       ...(agentId ? { agentId } : {}),
       ...(attemptId ? { attemptId } : {}),
@@ -1234,40 +768,28 @@ function parseEvent(raw: unknown, runs: Map<string, WorkflowRun>): JournalEvent
     };
   }
 
-  if (raw.kind === "task_compacted") {
-    if (
-      typeof raw.compactionCount !== "number" ||
-      !Number.isInteger(raw.compactionCount) ||
-      raw.compactionCount < 0 ||
-      raw.compactionCount > 1_000_000
-    ) {
-      throw new Error("compaction count is invalid");
-    }
-    return {
-      kind: "task_compacted",
-      schemaVersion: JOURNAL_SCHEMA_VERSION,
-      runId,
-      nodeId,
-      compactionCount: raw.compactionCount,
-      attemptId,
-      timestamp,
-      ...(owner ? { owner } : {}),
-    };
-  }
-
-  const result = parseResult(raw.result, "task result");
+  const result = parseResult(raw.result, "call result");
   if (run.attemptTracking && result.attemptId === undefined) {
-    throw new Error("task result is missing a required payload attemptId");
+    throw new Error("call result is missing a required payload attemptId");
   }
   if (result.attemptId && attemptId && result.attemptId !== attemptId) {
-    throw new StaleJournalGenerationError("task result payload references a superseded attempt");
+    throw new StaleJournalGenerationError("call result payload references a superseded attempt");
   }
   return {
-    kind: "task_result",
+    kind: "call_result",
     schemaVersion: JOURNAL_SCHEMA_VERSION,
     runId,
     nodeId,
     result: result.attemptId === undefined && attemptId ? { ...result, attemptId } : result,
+    ...(raw.callHash === undefined ? {} : { callHash: boundedString(raw.callHash, "callHash", 128) }),
+    ...(raw.storeDelta === undefined
+      ? {}
+      : {
+          storeDelta: (() => {
+            if (!isRecord(raw.storeDelta)) throw new Error("call result storeDelta is invalid");
+            return raw.storeDelta as Record<string, unknown>;
+          })(),
+        }),
     attemptId,
     timestamp,
     ...(owner ? { owner } : {}),
@@ -1288,9 +810,10 @@ export function boundedError(value: unknown): string | undefined {
 export function replayJournal(
   entries: readonly SessionEntryLike[],
   options: ReplayJournalOptions = {},
-): Map<string, WorkflowRun> {
-  const runs = new Map<string, WorkflowRun>();
+): Map<string, ScriptRun> {
+  const runs = new Map<string, ScriptRun>();
   const quarantined = new Set<string>();
+  const removed = new Set<string>();
   /** Recovery identities are scoped to one replayed run and bounded explicitly. */
   const seenRecoveries = new Map<string, Map<string, string>>();
   let reported = false;
@@ -1304,7 +827,19 @@ export function replayJournal(
     const raw = entry.data;
     const rawRunId = isRecord(raw) && typeof raw.runId === "string" ? raw.runId : undefined;
     if (rawRunId && quarantined.has(rawRunId)) continue;
+    if (rawRunId && removed.has(rawRunId)) continue;
     try {
+      if (isRecord(raw) && raw.kind === "run_created" && rawRunId && runs.has(rawRunId)) {
+        const existing = runs.get(rawRunId);
+        if (
+          existing &&
+          existing.script === raw.script &&
+          existing.scriptHash === raw.scriptHash &&
+          JSON.stringify(existing.meta) === JSON.stringify(raw.meta)
+        )
+          continue;
+        throw new Error("conflicting duplicate workflow run_created event");
+      }
       if (
         isRecord(raw) &&
         (raw.kind === "run_recovery" || raw.kind === "terminal_recovery") &&
@@ -1312,7 +847,6 @@ export function replayJournal(
       ) {
         for (const [seenRunId, seen] of seenRecoveries) {
           if (seenRunId === rawRunId || !seen.has(raw.recoveryId)) continue;
-          // A colliding recovery ID belongs to the malformed current entry; keep the previously validated owner intact.
           throw new Error(`recoveryId ${raw.recoveryId} is already owned by workflow run ${seenRunId}`);
         }
       }
@@ -1320,9 +854,6 @@ export function replayJournal(
         const run = runs.get(rawRunId);
         const seen = seenRecoveries.get(rawRunId);
         if (run && seen) {
-          // Parse duplicates without consulting current generation/status: the
-          // first copy already advanced those fields. The normalized semantic
-          // digest still validates every bounded field before accepting a no-op.
           const candidate =
             raw.kind === "run_recovery"
               ? parseDuplicateRunRecovery(raw, run)
@@ -1364,6 +895,9 @@ export function replayJournal(
         continue;
       }
       applyJournalEvent(runs, event);
+      if (event.kind === "run_removed") {
+        removed.add(event.runId);
+      }
     } catch (error: unknown) {
       if (error instanceof StaleJournalGenerationError) continue;
       if (rawRunId) {
@@ -1387,42 +921,29 @@ export function replayJournal(
   return runs;
 }
 
-function applyRecoveryRotation(run: WorkflowRun, rotation: RecoveryRotation): void {
+function applyRecoveryRotation(run: ScriptRun, rotation: RecoveryRotation): void {
   run.attemptTracking = true;
   run.attempts[rotation.nodeId] = rotation.generation;
   run.attemptIds[rotation.nodeId] = rotation.attemptId;
   delete run.agentIds[rotation.nodeId];
-  delete run.taskResults[rotation.nodeId];
+  delete run.callResults[rotation.nodeId];
   run.compactions[rotation.nodeId] = 0;
-  if (rotation.nodeId === "__synthesis__") {
-    run.synthesisAgentId = undefined;
-    run.synthesisResult = undefined;
-  } else {
-    run.taskStatus[rotation.nodeId] = "ready";
-  }
+  run.callStatus[rotation.nodeId] = "running";
 }
 
-function applyRecoveryTerminalResult(run: WorkflowRun, terminal: RecoveryTerminalResult): void {
+function applyRecoveryTerminalResult(run: ScriptRun, terminal: RecoveryTerminalResult): void {
   run.compactions[terminal.nodeId] = Math.max(run.compactions[terminal.nodeId] ?? 0, terminal.result.compactionCount);
-  if (terminal.nodeId === "__synthesis__") {
-    run.synthesisResult = terminal.result;
-    if (terminal.result.agentId) run.synthesisAgentId = terminal.result.agentId;
-  } else {
-    run.taskResults[terminal.nodeId] = terminal.result;
-    run.taskStatus[terminal.nodeId] = terminal.result.status;
-    if (terminal.result.agentId) run.agentIds[terminal.nodeId] = terminal.result.agentId;
-  }
+  run.callResults[terminal.nodeId] = terminal.result;
+  run.callStatus[terminal.nodeId] = terminal.result.status;
+  if (terminal.result.agentId) run.agentIds[terminal.nodeId] = terminal.result.agentId;
 }
 
-export function applyRecoveryTerminalResults(
-  run: WorkflowRun,
-  terminalResults: readonly RecoveryTerminalResult[],
-): void {
+export function applyRecoveryTerminalResults(run: ScriptRun, terminalResults: readonly RecoveryTerminalResult[]): void {
   for (const terminal of terminalResults) applyRecoveryTerminalResult(run, terminal);
 }
 
 /** Apply an already validated atomic recovery event after its append succeeds. */
-export function applyRecoveryEvent(run: WorkflowRun, event: RunRecoveryEvent | AttemptRecoveryEvent): void {
+export function applyRecoveryEvent(run: ScriptRun, event: RunRecoveryEvent | AttemptRecoveryEvent): void {
   if (event.kind === "run_recovery") {
     run.status = "interrupted";
     run.terminalIntent = undefined;
@@ -1434,10 +955,10 @@ export function applyRecoveryEvent(run: WorkflowRun, event: RunRecoveryEvent | A
   run.updatedAt = event.timestamp;
 }
 /** Apply a validated terminal recovery after its durable append succeeds. */
-export function applyTerminalRecoveryEvent(run: WorkflowRun, event: TerminalRecoveryEvent): void {
+export function applyTerminalRecoveryEvent(run: ScriptRun, event: TerminalRecoveryEvent): void {
   for (const terminal of event.terminalResults) applyRecoveryTerminalResult(run, terminal);
   for (const nodeId of event.blockedNodeIds) {
-    if (!isTerminalTask(run.taskStatus[nodeId])) run.taskStatus[nodeId] = "blocked";
+    if (run.callStatus[nodeId] !== "completed") run.callStatus[nodeId] = "stopped";
   }
   run.status = event.status;
   run.terminalIntent = event.terminalIntent;
@@ -1446,29 +967,37 @@ export function applyTerminalRecoveryEvent(run: WorkflowRun, event: TerminalReco
   run.updatedAt = event.timestamp;
 }
 
-function applyJournalEvent(runs: Map<string, WorkflowRun>, event: JournalEvent): void {
+function applyJournalEvent(runs: Map<string, ScriptRun>, event: JournalEvent): void {
   if (event.kind === "run_created") {
-    const taskStatus: Record<string, TaskStatus> = {};
+    const callStatus: Record<string, CallStatus> = {};
     const attempts: Record<string, number> = {};
     const attemptIds: Record<string, string> = {};
-    for (const task of event.definition.tasks) {
-      taskStatus[task.id] = "pending";
-      attempts[task.id] = event.attempts?.[task.id] ?? 1;
-      attemptIds[task.id] = event.attemptIds?.[task.id] ?? defaultAttemptId(event.runId, task.id);
+    for (const nodeId of Object.keys(event.attemptIds ?? {})) {
+      callStatus[nodeId] = "running";
+      attempts[nodeId] = event.attempts?.[nodeId] ?? 1;
+      attemptIds[nodeId] = event.attemptIds?.[nodeId] ?? defaultAttemptId(event.runId, nodeId);
     }
-    attempts.__synthesis__ = event.attempts?.__synthesis__ ?? 1;
-    attemptIds.__synthesis__ = event.attemptIds?.__synthesis__ ?? defaultAttemptId(event.runId, "__synthesis__");
     runs.set(event.runId, {
       runId: event.runId,
       schemaVersion: event.schemaVersion,
-      definition: event.definition,
+      script: event.script,
+      scriptHash: event.scriptHash,
+      meta: event.meta,
+      revision: 0,
+      ...(event.toolset ? { toolset: event.toolset } : {}),
+      ...(event.frozenMaxAgents !== undefined ? { frozenMaxAgents: event.frozenMaxAgents } : {}),
+      ...(event.frozenConcurrency !== undefined ? { frozenConcurrency: event.frozenConcurrency } : {}),
+      ...(event.frozenAgentRetries !== undefined ? { frozenAgentRetries: event.frozenAgentRetries } : {}),
+      ...(event.frozenTokenBudget !== undefined ? { frozenTokenBudget: event.frozenTokenBudget } : {}),
+      ...(event.frozenAgentTimeoutMs !== undefined ? { frozenAgentTimeoutMs: event.frozenAgentTimeoutMs } : {}),
+      ...(event.frozenExcludeTools ? { frozenExcludeTools: event.frozenExcludeTools } : {}),
       status: "pending",
-      taskStatus,
+      callStatus,
       agentIds: {},
       attempts,
       attemptIds,
       attemptTracking: event.attemptIds !== undefined,
-      taskResults: {},
+      callResults: {},
       compactions: {},
       startedAt: event.timestamp,
       updatedAt: event.timestamp,
@@ -1478,8 +1007,18 @@ function applyJournalEvent(runs: Map<string, WorkflowRun>, event: JournalEvent):
 
   const run = runs.get(event.runId);
   if (!run) return;
+  if (event.kind === "run_removed") {
+    runs.delete(event.runId);
+    return;
+  }
   run.updatedAt = event.timestamp;
   switch (event.kind) {
+    case "run_revision":
+      run.revision = event.revision;
+      run.script = event.script;
+      run.scriptHash = event.scriptHash;
+      run.meta = event.meta;
+      break;
     case "workflow_transition":
       run.status = event.status;
       if (event.error !== undefined) run.error = event.error;
@@ -1492,93 +1031,147 @@ function applyJournalEvent(runs: Map<string, WorkflowRun>, event: JournalEvent):
     case "terminal_recovery":
       applyTerminalRecoveryEvent(run, event);
       break;
-    case "task_attempt":
+    case "call_attempt":
       run.attemptTracking = true;
       run.attempts[event.nodeId] = event.generation;
       run.attemptIds[event.nodeId] = event.attemptId;
       delete run.agentIds[event.nodeId];
-      delete run.taskResults[event.nodeId];
-      if (event.nodeId === "__synthesis__") {
-        run.synthesisAgentId = undefined;
-        run.synthesisResult = undefined;
-      } else {
-        run.taskStatus[event.nodeId] = "ready";
-      }
+      delete run.callResults[event.nodeId];
+      run.callStatus[event.nodeId] = "running";
       run.compactions[event.nodeId] = 0;
       break;
-    case "task_transition":
+    case "call_transition":
       if (event.attemptId && event.attemptId !== run.attemptIds[event.nodeId]) {
-        throw new Error("task transition references a superseded attempt");
+        throw new Error("call transition references a superseded attempt");
       }
-      run.taskStatus[event.nodeId] = event.status;
+      run.callStatus[event.nodeId] = event.status;
       if (event.agentId) run.agentIds[event.nodeId] = event.agentId;
       break;
-    case "task_result":
+    case "call_result":
       if (event.attemptId && event.attemptId !== run.attemptIds[event.nodeId]) {
-        throw new Error("task result references a superseded attempt");
+        throw new Error("call result references a superseded attempt");
       }
       if (
-        run.taskResults[event.nodeId] &&
-        JSON.stringify(run.taskResults[event.nodeId]) !== JSON.stringify(event.result)
+        run.callResults[event.nodeId] &&
+        JSON.stringify(run.callResults[event.nodeId]) !== JSON.stringify(event.result)
       ) {
-        throw new Error("contradictory terminal task result");
+        throw new Error("contradictory terminal call result");
       }
-      run.taskResults[event.nodeId] = event.result;
-      run.taskStatus[event.nodeId] = event.result.status;
+      run.callResults[event.nodeId] = event.result;
+      run.callStatus[event.nodeId] = event.result.status;
       run.compactions[event.nodeId] = Math.max(run.compactions[event.nodeId] ?? 0, event.result.compactionCount);
       if (event.result.agentId) run.agentIds[event.nodeId] = event.result.agentId;
       break;
-    case "task_compacted":
-      if (event.attemptId && event.attemptId !== run.attemptIds[event.nodeId]) {
-        throw new Error("compaction references a superseded attempt");
-      }
-      run.compactions[event.nodeId] = event.compactionCount;
-      break;
-    case "synthesis_result":
-      if (run.synthesisResult && JSON.stringify(run.synthesisResult) !== JSON.stringify(event.result)) {
-        throw new Error("contradictory synthesis result");
-      }
-      run.synthesisResult = event.result;
-      run.compactions.__synthesis__ = Math.max(run.compactions.__synthesis__ ?? 0, event.result.compactionCount);
-      if (event.result.agentId) run.synthesisAgentId = event.result.agentId;
-      break;
   }
 }
 
-function validateAggregate(run: WorkflowRun): void {
-  const nodes = [...run.definition.tasks.map((task) => task.id), "__synthesis__"];
-  for (const nodeId of nodes) {
+function validateAggregate(run: ScriptRun): void {
+  for (const nodeId of Object.keys(run.attemptIds)) {
     if (!Number.isInteger(run.attempts[nodeId]) || run.attempts[nodeId] < 1) {
       throw new Error(`missing attempt generation for ${nodeId}`);
     }
     boundedString(run.attemptIds[nodeId], `attemptIds.${nodeId}`, JOURNAL_ID_LIMIT);
   }
   if (isTerminalWorkflowStatus(run.status)) {
-    const statuses = Object.values(run.taskStatus);
+    const statuses = Object.values(run.callStatus);
     if (run.status === "completed" && statuses.some((status) => status !== "completed")) {
-      throw new Error("completed workflow has non-completed tasks");
+      throw new Error("completed workflow has non-completed calls");
     }
-    if (run.status === "stopped" && statuses.some((status) => !isTerminalTask(status))) {
-      throw new Error("stopped workflow has active tasks");
-    }
-    if (run.status === "failed" && statuses.some((status) => !isTerminalTask(status))) {
-      throw new Error("failed workflow has active tasks");
-    }
-    if (run.status === "failed" || run.status === "stopped") {
-      if (run.synthesisAgentId && !run.synthesisResult) {
-        throw new Error(`${run.status} workflow has an active synthesis agent`);
-      }
+    if (
+      run.status === "stopped" &&
+      statuses.some((status) => status !== "completed" && status !== "stopped" && status !== "failed")
+    ) {
+      throw new Error("stopped workflow has active calls");
     }
   }
-  if (run.synthesisResult && Object.values(run.taskStatus).some((status) => !isTerminalTask(status))) {
-    throw new Error("synthesis settled before workflow tasks");
-  }
 }
 
 function isTerminalWorkflowStatus(status: WorkflowStatus): boolean {
   return status === "completed" || status === "failed" || status === "stopped";
 }
 
-export function snapshotRun(run: WorkflowRun): WorkflowRun {
-  return JSON.parse(JSON.stringify(run)) as WorkflowRun;
+function canTransitionWorkflow(previous: WorkflowStatus, next: WorkflowStatus): boolean {
+  if (previous === next) return true;
+  switch (previous) {
+    case "pending":
+      return next === "running" || next === "stopping";
+    case "running":
+      return (
+        next === "pausing" ||
+        next === "paused" ||
+        next === "stopping" ||
+        next === "interrupted" ||
+        next === "completed" ||
+        next === "failed"
+      );
+    case "pausing":
+      return next === "paused" || next === "stopping";
+    case "paused":
+      return next === "running" || next === "stopping";
+    case "interrupted":
+      return next === "running" || next === "stopping";
+    case "stopping":
+      return next === "stopped" || next === "failed" || next === "interrupted";
+    default:
+      return false;
+  }
+}
+
+export function snapshotRun(run: ScriptRun): ScriptRun {
+  return JSON.parse(JSON.stringify(run)) as ScriptRun;
+}
+
+/**
+ * Build the runtime's resume journal from raw session entries.
+ *
+ * The runtime keys its cache by `${runId}:${callIndex}` (the same namespacing
+ * the store deltas use), so a nested workflow() call with its own runId can
+ * never replay the parent's entry. Every `call_result` event that carries a
+ * `callHash` is a replayable agent()/checkpoint() fact; entries without a hash
+ * (legacy or malformed) are skipped rather than quarantined — a resume must
+ * tolerate a foreign or partial journal and simply re-run the misses live.
+ */
+export function buildResumeJournal(
+  entries: readonly SessionEntryLike[],
+): Map<string, { index: number; runId?: string; hash: string; result: unknown; storeDelta?: Record<string, unknown> }> {
+  const journal = new Map<
+    string,
+    { index: number; runId?: string; hash: string; result: unknown; storeDelta?: Record<string, unknown> }
+  >();
+  for (const entry of entries) {
+    if (entry.type !== "custom" || entry.customType !== JOURNAL_ENTRY_TYPE) continue;
+    const raw = entry.data;
+    if (!isRecord(raw) || raw.kind !== "call_result" || typeof raw.callHash !== "string") continue;
+    if (raw.schemaVersion !== JOURNAL_SCHEMA_VERSION) continue;
+    const runId = boundedString(raw.runId, "runId", JOURNAL_ID_LIMIT);
+    let nodeId: string;
+    try {
+      nodeId = parseCallIndex(raw.nodeId, "nodeId");
+    } catch {
+      continue;
+    }
+    const result = isRecord(raw.result) ? raw.result : undefined;
+    // Failed/stopped lifecycle facts are diagnostic history, not successful
+    // replay values. Replaying them as `undefined` would silently skip a call
+    // and bypass the runtime's retry/error policy.
+    if (result?.status !== "completed" || !Object.hasOwn(result, "result")) continue;
+    journal.set(`${runId}:${nodeId}`, {
+      index: Number(nodeId),
+      runId,
+      hash: raw.callHash,
+      result: result.result,
+      ...(isRecord(raw.storeDelta) && Object.keys(raw.storeDelta).length > 0
+        ? { storeDelta: raw.storeDelta as Record<string, unknown> }
+        : {}),
+    });
+  }
+  return journal;
+}
+
+/** Derive a stable recovery id from a recovery event's content. */
+export function deriveRecoveryId(event: { runId: string; rotations: unknown[]; timestamp: number }): string {
+  const digest = createHash("sha256")
+    .update(JSON.stringify({ runId: event.runId, rotations: event.rotations, timestamp: event.timestamp }))
+    .digest("hex");
+  return `${JOURNAL_RECOVERY_ID_PREFIX}${digest}`;
 }