fyflow-orchestration 0.7.0 → 0.8.0

package/dist/node/chunks/{chunk-YVOP3DIN.js → chunk-EUU44PHD.js}

@@ -119,6 +119,14 @@ function regionChainOf(regions, nodeId) {
   }
   return chain.reverse();
 }
+function innermostMapOf(regions, nodeId) {
+  const chain = regionChainOf(regions, nodeId);
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const r = regions.find((x) => x.fanoutId === chain[i]);
+    if (r?.opensWith === "map") return r;
+  }
+  return void 0;
+}
 function sharedRegionDepth(regions, a, b) {
   const ca = regionChainOf(regions, a);
   const cb = regionChainOf(regions, b);
@@ -223,7 +231,11 @@ var SCHEMA_KEYWORDS = [
   "maxLength",
   "items",
   "minItems",
-  "examples"
+  "examples",
+  "title",
+  "description",
+  "readOnly",
+  "writeOnly"
 ];
 var SCHEMA_TYPES = ["object", "array", "string", "number", "integer", "boolean", "null"];
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -265,6 +277,12 @@ function schemaProblem(schema, at = "$") {
   for (const k of ["minLength", "maxLength", "minItems"]) {
     if (s[k] !== void 0 && !isNonNegInt(s[k])) return `${at}.${k}: must be an integer >= 0, got ${JSON.stringify(s[k])}`;
   }
+  for (const k of ["title", "description"]) {
+    if (s[k] !== void 0 && typeof s[k] !== "string") return `${at}.${k}: must be a string \u2014 an annotation that constrains nothing (ADR 0098) \u2014 got ${JSON.stringify(s[k])}`;
+  }
+  for (const k of ["readOnly", "writeOnly"]) {
+    if (s[k] !== void 0 && typeof s[k] !== "boolean") return `${at}.${k}: must be true or false \u2014 an annotation that constrains nothing (ADR 0098) \u2014 got ${JSON.stringify(s[k])}`;
+  }
   if (s.items !== void 0) {
     if (Array.isArray(s.items)) return `${at}.items: the subset admits one schema for every item, not a tuple`;
     const p = schemaProblem(s.items, `${at}.items`);
@@ -341,9 +359,63 @@ function describeFindings(fs) {
   return fs.map((f) => `${f.path} ${f.says}`).join("; ");
 }
 
+// src/definition/condition.ts
+function readKeyPath(value, path) {
+  let v = value;
+  for (const seg of path.split(".")) {
+    if (typeof v !== "object" || v === null) return void 0;
+    const proto = Object.getPrototypeOf(v);
+    if (proto !== Object.prototype && proto !== null) return void 0;
+    if (!Object.prototype.hasOwnProperty.call(v, seg)) return void 0;
+    v = v[seg];
+  }
+  return v;
+}
+function evalLeaf(scope, p, unknownOp) {
+  let v = readKeyPath(scope, p.path);
+  if (v === void 0 && !("default" in p)) return false;
+  if ((v === void 0 || v === null) && "default" in p) v = p.default;
+  if (p.length === true) {
+    if (Array.isArray(v)) v = v.length;
+    else if (typeof v === "string") v = v.length;
+    else return false;
+  }
+  const w = p.value;
+  switch (p.op) {
+    // **Type-STRICT, and it is a departure measured rather than assumed.** Under JS comparison
+    // `{confidence: "0.4"} < 0.5` is true and every `typeof`-guarded predicate in this tree is false;
+    // measured over 1800 contexts, a type-strict form reproduces those three EXACTLY and differs from
+    // `resume.test.ts`'s unguarded `isHigh` on `{score: "9"}`, where the JS body coerces. That is
+    // `FD-V30`'s own argument — *a string `maxRetries` retries by coercion* — one rule over.
+    case "eq":
+      return v === w;
+    case "ne":
+      return v !== w;
+    case "lt":
+      return typeof v === "number" && typeof w === "number" && v < w;
+    case "lte":
+      return typeof v === "number" && typeof w === "number" && v <= w;
+    case "gt":
+      return typeof v === "number" && typeof w === "number" && v > w;
+    case "gte":
+      return typeof v === "number" && typeof w === "number" && v >= w;
+    case "startsWith":
+      return typeof v === "string" && typeof w === "string" && v.startsWith(w);
+    default: {
+      const never = p.op;
+      throw unknownOp(`operator "${String(never)}" is not in the subset; FD-V44 should have caught this at instantiation`);
+    }
+  }
+}
+function evaluateDeclared(when, scope, unknownOp) {
+  if ("all" in when && Array.isArray(when.all)) return when.all.every((m) => evalLeaf(scope, m, unknownOp));
+  if ("any" in when && Array.isArray(when.any)) return when.any.some((m) => evalLeaf(scope, m, unknownOp));
+  return evalLeaf(scope, when, unknownOp);
+}
+
 // src/definition/validate.ts
 var ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
-var KINDS = ["task", "fanout", "map", "join", "end", "gate"];
+var KINDS = ["task", "fanout", "map", "join", "end", "gate", "ask"];
 var ROUTABLE = ["done", "failed"];
 var DOC_KEYS = ["flowId", "version", "entry", "nodes"];
 var NODE_KEYS = {
@@ -365,8 +437,14 @@ var NODE_KEYS = {
   end: { req: ["id", "kind", "outcome"], opt: [] },
   // v0.23 (W92, ADR 0066): a gate names a GATE type and carries settings, as a task names a node type — and
   // nothing else a task carries. `needs` is absent on purpose: a gate hands on what reached it, unchanged.
-  gate: { req: ["id", "kind", "type", "edges"], opt: ["settings"] }
+  gate: { req: ["id", "kind", "type", "edges"], opt: ["settings"] },
+  // v0.42 (W179, ADR 0108, P35 stop-and-ask (a)): an ASK waits for a person. It routes like a task (`edges`,
+  // `FD-V7`), receives what its `needs` composes, carries opaque `settings` a UI reads and an `answerSchema` a
+  // `done` answer is held to — and NONE of the keys a task's worker reads: those six are `FD-V47`'s
+  // (`ASK_REFUSED_KEYS`), refused there by name, so `FD-V17` does not report them a second time.
+  ask: { req: ["id", "kind", "edges"], opt: ["settings", "answerSchema", "needs"] }
 };
+var ASK_REFUSED_KEYS = ["type", "pool", "optional", "retryPolicy", "workerGroups", "transform"];
 var EDGE_KEYS = { req: ["to"], opt: ["on", "when", "needs", "route"] };
 var EDGE_KEYS_DECLARED = [...EDGE_KEYS.req, ...EDGE_KEYS.opt];
 var TASK_KEYS_DECLARED = [...NODE_KEYS.task.req, ...NODE_KEYS.task.opt];
@@ -434,51 +512,110 @@ function keyPathProblem(v) {
   if (KEY_PATH_RE.test(v)) return null;
   return `settings.key ${JSON.stringify(v)} is not a key path \u2014 dot-separated object keys, each [A-Za-z0-9_-]{1,64}; no array index, no wildcard, no expression (a key that must be computed is computed in the task before the gate)`;
 }
-function readKeyPath(value, path) {
-  let v = value;
-  for (const seg of path.split(".")) {
-    if (typeof v !== "object" || v === null) return void 0;
-    const proto = Object.getPrototypeOf(v);
-    if (proto !== Object.prototype && proto !== null) return void 0;
-    if (!Object.prototype.hasOwnProperty.call(v, seg)) return void 0;
-    v = v[seg];
+var GATE_TYPE_KEYS = ["routes", "defaultRoute", "settingsSchema", "keyResolvedRoutes", "routesFor", "settingsProblem", "fn"];
+var STATIC_ROUTE_KEYS = ["routes", "defaultRoute", "keyResolvedRoutes"];
+var ROUTE_SET_KEYS = STATIC_ROUTE_KEYS;
+var GATE_TYPE_OPTIONAL = /* @__PURE__ */ new Set(["settingsSchema", "keyResolvedRoutes", "settingsProblem"]);
+var GATE_TYPE_SHAPE = `{ ${GATE_TYPE_KEYS.map((k) => GATE_TYPE_OPTIONAL.has(k) ? `${k}?` : k).join(", ")} } with its routes declared STATICALLY by routes and defaultRoute (keyResolvedRoutes beside them) or DERIVED by routesFor, exactly one of the two`;
+function describeValue(v) {
+  try {
+    const j = JSON.stringify(v);
+    if (j !== void 0) return j;
+  } catch {
+  }
+  try {
+    return typeof v === "bigint" ? `${v}n` : String(v);
+  } catch {
+    return `an unprintable ${typeof v}`;
   }
-  return v;
 }
-var GATE_TYPE_KEYS = ["routes", "defaultRoute", "settingsSchema", "keyResolvedRoutes", "fn"];
-var GATE_TYPE_OPTIONAL = /* @__PURE__ */ new Set(["settingsSchema", "keyResolvedRoutes"]);
-var GATE_TYPE_SHAPE = `{ ${GATE_TYPE_KEYS.map((k) => GATE_TYPE_OPTIONAL.has(k) ? `${k}?` : k).join(", ")} }`;
-function gateTypeProblem(t) {
-  if (typeof t !== "object" || t === null || Array.isArray(t)) return `a gate type is an object ${GATE_TYPE_SHAPE}, got ${JSON.stringify(t)}`;
-  const o = t;
-  const extra = Object.keys(o).filter((k) => !GATE_TYPE_KEYS.includes(k));
-  if (extra.length) return `it carries ${extra.map((k) => JSON.stringify(k)).join(", ")}, which a gate type does not declare; it is ${GATE_TYPE_SHAPE}`;
-  const routes = o.routes;
-  if (!Array.isArray(routes) || routes.length === 0) return `routes must be a non-empty array of route names, got ${JSON.stringify(routes)}`;
+function describeThrown(e) {
+  try {
+    if (e instanceof Error) return String(e.message);
+  } catch {
+  }
+  return describeValue(e);
+}
+function routeSetProblem(routes, defaultRoute, keyResolvedRoutes) {
+  if (!Array.isArray(routes) || routes.length === 0) return `routes must be a non-empty array of route names, got ${describeValue(routes)}`;
   for (const r of routes) {
-    if (typeof r !== "string" || !ID_RE.test(r)) return `route ${JSON.stringify(r)} is not [A-Za-z0-9_-]{1,64}`;
+    if (typeof r !== "string" || !ID_RE.test(r)) return `route ${describeValue(r)} is not [A-Za-z0-9_-]{1,64}`;
   }
   if (new Set(routes).size !== routes.length) return "routes repeats a route";
-  if (typeof o.defaultRoute !== "string" || !routes.includes(o.defaultRoute)) {
-    return `defaultRoute ${JSON.stringify(o.defaultRoute)} is not one of its routes (${routes.join(", ")}) \u2014 an edge with no route would carry a route the type never returns`;
+  if (typeof defaultRoute !== "string" || !routes.includes(defaultRoute)) {
+    return `defaultRoute ${describeValue(defaultRoute)} is not one of its routes (${routes.join(", ")}) \u2014 an edge with no route would carry a route the type never returns`;
   }
-  if (o.settingsSchema !== void 0) {
-    const p = schemaProblem(o.settingsSchema);
-    if (p !== null) return `its settingsSchema is not in the built-in subset \u2014 ${p}`;
-  }
-  if (o.keyResolvedRoutes !== void 0) {
-    const kr = o.keyResolvedRoutes;
-    if (!Array.isArray(kr)) return `keyResolvedRoutes must be an array of route names, got ${JSON.stringify(kr)}`;
+  if (keyResolvedRoutes !== void 0) {
+    const kr = keyResolvedRoutes;
+    if (!Array.isArray(kr)) return `keyResolvedRoutes must be an array of route names, got ${describeValue(kr)}`;
     for (const r of kr) {
       if (typeof r !== "string" || !routes.includes(r)) {
-        return `keyResolvedRoutes names ${JSON.stringify(r)}, which is not one of its routes (${routes.join(", ")}) \u2014 a guarantee on a route the type never returns applies to nothing`;
+        return `keyResolvedRoutes names ${describeValue(r)}, which is not one of its routes (${routes.join(", ")}) \u2014 a guarantee on a route the type never returns applies to nothing`;
       }
     }
     if (new Set(kr).size !== kr.length) return "keyResolvedRoutes repeats a route";
   }
+  return null;
+}
+function gateTypeProblem(t) {
+  if (typeof t !== "object" || t === null || Array.isArray(t)) return `a gate type is an object ${GATE_TYPE_SHAPE}, got ${describeValue(t)}`;
+  const o = t;
+  const extra = Object.keys(o).filter((k) => !GATE_TYPE_KEYS.includes(k));
+  if (extra.length) return `it carries ${extra.map((k) => describeValue(k)).join(", ")}, which a gate type does not declare; it is ${GATE_TYPE_SHAPE}`;
+  const staticKeys = STATIC_ROUTE_KEYS.filter((k) => o[k] !== void 0);
+  const derived = o.routesFor !== void 0;
+  if (derived && staticKeys.length) {
+    return `it carries routesFor AND ${staticKeys.join(", ")} \u2014 a gate type declares its routes statically or derives them from its gate's settings, exactly one of the two`;
+  }
+  if (!derived && staticKeys.length === 0) {
+    return "it declares its routes neither statically (routes, defaultRoute) nor by routesFor \u2014 a gate type declares exactly one of the two";
+  }
+  if (derived) {
+    if (typeof o.routesFor !== "function") return "routesFor must be a function (settings) => { routes, defaultRoute, keyResolvedRoutes? }";
+  } else {
+    const p = routeSetProblem(o.routes, o.defaultRoute, o.keyResolvedRoutes);
+    if (p !== null) return p;
+  }
+  if (o.settingsSchema !== void 0) {
+    const p = schemaProblem(o.settingsSchema);
+    if (p !== null) return `its settingsSchema is not in the built-in subset \u2014 ${p}`;
+  }
+  if (o.settingsProblem !== void 0 && typeof o.settingsProblem !== "function") return "settingsProblem must be a function (settings) => string | null";
   if (typeof o.fn !== "function") return "fn must be a function (ctx) => route";
   return null;
 }
+function routesOf(type, settings) {
+  let set;
+  if (typeof type.routesFor === "function") {
+    if (typeof settings !== "object" || settings === null || Array.isArray(settings)) {
+      return { problem: `routesFor is asked over settings that are a plain object, got ${describeValue(settings)}` };
+    }
+    let copy;
+    try {
+      copy = structuredClone(settings);
+    } catch (e) {
+      return { problem: `the gate's settings cannot be copied for routesFor \u2014 ${describeThrown(e)}` };
+    }
+    try {
+      set = type.routesFor(copy);
+    } catch (e) {
+      return { problem: `routesFor threw: ${describeThrown(e)}` };
+    }
+    if (typeof set !== "object" || set === null || Array.isArray(set)) {
+      return { problem: `routesFor returned ${describeValue(set)}, which is not { routes, defaultRoute, keyResolvedRoutes? }` };
+    }
+    const extra = Object.keys(set).filter((k) => !ROUTE_SET_KEYS.includes(k));
+    if (extra.length) return { problem: `routesFor returned ${extra.map((k) => describeValue(k)).join(", ")}, which a route set does not declare; it is { routes, defaultRoute, keyResolvedRoutes? }` };
+  } else {
+    set = type;
+  }
+  const s = set;
+  const p = routeSetProblem(s.routes, s.defaultRoute, s.keyResolvedRoutes);
+  if (p !== null) return { problem: typeof type.routesFor === "function" ? `routesFor returned a malformed route set: ${p}` : p };
+  const routes = Object.freeze([...s.routes]);
+  const defaultRoute = s.defaultRoute;
+  return s.keyResolvedRoutes === void 0 ? Object.freeze({ routes, defaultRoute }) : Object.freeze({ routes, defaultRoute, keyResolvedRoutes: Object.freeze([...s.keyResolvedRoutes]) });
+}
 var distinct = Object.freeze({
   routes: Object.freeze(["first", "duplicate", "nokey"]),
   defaultRoute: "first",
@@ -502,7 +639,79 @@ var distinct = Object.freeze({
     return "first";
   }
 });
-var BUILT_IN_GATE_TYPES = Object.freeze({ distinct });
+var UNKNOWN_OP = (message) => new Error(message);
+var ifGate = Object.freeze({
+  routes: Object.freeze(["then", "else"]),
+  defaultRoute: "else",
+  // The KEYS only: the grammar is not the subset's to state (P32 fact 3), and `when`'s TYPE is left to
+  // `settingsProblem` so a bare string gets the grammar's own message rather than the schema's.
+  settingsSchema: Object.freeze({
+    type: "object",
+    required: ["when"],
+    properties: { when: {} },
+    additionalProperties: false
+  }),
+  settingsProblem(settings) {
+    const p = gateConditionProblem(settings.when);
+    return p === null ? null : `${p.message} (${p.rule}'s grammar, which an if gate's condition is held to)`;
+  },
+  fn(ctx) {
+    return evaluateDeclared(ctx.settings.when, { input: ctx.input }, UNKNOWN_OP) ? "then" : "else";
+  }
+});
+var switchGate = Object.freeze({
+  settingsSchema: Object.freeze({
+    type: "object",
+    required: ["key", "cases"],
+    properties: { key: { type: "string", minLength: 1 }, cases: { type: "object" } },
+    additionalProperties: false
+  }),
+  settingsProblem(settings) {
+    const cases = settings.cases;
+    const seen = [];
+    if (Object.keys(cases).length === 0) return 'cases is empty \u2014 a switch with no case routes every value to default, which is "always default" written as a question';
+    for (const name of Object.keys(cases)) {
+      if (!ID_RE.test(name)) return `cases names the case ${JSON.stringify(name)}, which is not [A-Za-z0-9_-]{1,64} \u2014 a case name is a ROUTE name (FD-V16's charset)`;
+      if (name === "default") return 'cases names a case "default", which is the route a key matching no case takes \u2014 the name is reserved';
+      const v = cases[name];
+      if (Array.isArray(v) && v.length === 0) return `cases.${name} is an empty array; a case names a scalar or a non-empty array of scalars \u2014 a case no value can reach is a route no run can take`;
+      for (const x of Array.isArray(v) ? v : [v]) {
+        if (!isScalar(x)) {
+          return `cases.${name} ${Array.isArray(v) ? "holds" : "is"} ${scalarName(x)}; a case names a SCALAR \u2014 null, a boolean, a finite number or a string \u2014 or a non-empty array of them`;
+        }
+        const other = seen.find((s) => s.value === x);
+        if (other !== void 0 && other.name === name) {
+          return `cases.${name} repeats the value ${caseValue(x)} \u2014 a case names each of its values once`;
+        }
+        if (other !== void 0) {
+          if (!Object.is(other.value, x)) {
+            return `the values ${caseValue(other.value)} in case "${other.name}" and ${caseValue(x)} in case "${name}" are one value by === \u2014 a value takes one route`;
+          }
+          return `the value ${caseValue(x)} is named by two cases, "${other.name}" and "${name}" \u2014 a value takes one route (matching is ===, so "1" and 1 are two values)`;
+        }
+        seen.push({ value: x, name });
+      }
+    }
+    return null;
+  },
+  routesFor(settings) {
+    const cases = settings.cases;
+    if (typeof cases !== "object" || cases === null || Array.isArray(cases)) throw new Error(`cases is ${scalarName(cases)}, not an object of case names`);
+    const names = Object.keys(cases);
+    return { routes: [...names, "default"], defaultRoute: "default", keyResolvedRoutes: names };
+  },
+  fn(ctx) {
+    const key = ctx.key;
+    if (key === void 0 || typeof key === "object" && key !== null) return "default";
+    const cases = ctx.settings.cases;
+    for (const name of Object.keys(cases)) {
+      const v = cases[name];
+      if (Array.isArray(v) ? v.some((x) => x === key) : v === key) return name;
+    }
+    return "default";
+  }
+});
+var BUILT_IN_GATE_TYPES = Object.freeze({ distinct, if: ifGate, switch: switchGate });
 function gateTypesOf(x) {
   const out = new Map(Object.entries(BUILT_IN_GATE_TYPES));
   const own3 = x === void 0 ? [] : x instanceof Map ? [...x] : Object.entries(x);
@@ -527,11 +736,23 @@ function predicateShapeOf(o) {
   if (marks.length > 1) return "ambiguous";
   return marks[0];
 }
+var caseValue = (v) => Object.is(v, -0) ? "-0" : JSON.stringify(v);
 var isScalar = (v) => v === null || typeof v === "boolean" || typeof v === "string" || typeof v === "number" && Number.isFinite(v);
 var scalarName = (v) => v === null ? "null" : Array.isArray(v) ? "an array" : typeof v === "number" && !Number.isFinite(v) ? String(v) : typeof v;
 var NUMERIC_OPS = /* @__PURE__ */ new Set(["lt", "lte", "gt", "gte"]);
 var STRING_OPS = /* @__PURE__ */ new Set(["startsWith"]);
-function leafProblem(o, where) {
+var EDGE_SCOPE = {
+  roots: PREDICATE_ROOTS,
+  foreignRoot: () => `which a decision cannot see \u2014 a predicate's roots are ${PREDICATE_ROOTS.map((r) => JSON.stringify(r)).join(" and ")}, and any other first segment would resolve to nothing in silence`,
+  rootAlone: (root) => `and names no value \u2014 ${JSON.stringify(root)} is a container, so a comparison against it could only ever be no match`
+};
+var GATE_CONDITION_ROOTS = ["input"];
+var GATE_SCOPE = {
+  roots: GATE_CONDITION_ROOTS,
+  foreignRoot: () => 'which an if gate cannot see \u2014 its one root is "input", the value that reached the gate; a gate has no outcome and no edge needs, and any other first segment would resolve to nothing in silence',
+  rootAlone: () => "and names no key \u2014 a gate's path names a key INSIDE the value that reached it, as every gate's key path does; a value that must be compared whole is wrapped by the task before the gate"
+};
+function leafProblem(o, where, scope = EDGE_SCOPE) {
   const extra = Object.keys(o).filter((k) => !PREDICATE_LEAF_KEYS.includes(k));
   if (extra.length) {
     return { rule: "FD-V42", message: `${where} carries ${extra.map((k) => JSON.stringify(k)).join(", ")}, which a comparison does not declare; it is { ${PREDICATE_LEAF_KEYS.join(", ")} }` };
@@ -544,11 +765,11 @@ function leafProblem(o, where) {
     return { rule: "FD-V43", message: `${where} path ${JSON.stringify(path)} is not a key path \u2014 dot-separated object keys, each [A-Za-z0-9_-]{1,64}; no array index, no wildcard, no expression` };
   }
   const root = path.split(".")[0];
-  if (!PREDICATE_ROOTS.includes(root)) {
-    return { rule: "FD-V43", message: `${where} path ${JSON.stringify(path)} starts at ${JSON.stringify(root)}, which a decision cannot see \u2014 a predicate's roots are ${PREDICATE_ROOTS.map((r) => JSON.stringify(r)).join(" and ")}, and any other first segment would resolve to nothing in silence` };
+  if (!scope.roots.includes(root)) {
+    return { rule: "FD-V43", message: `${where} path ${JSON.stringify(path)} starts at ${JSON.stringify(root)}, ${scope.foreignRoot(root)}` };
   }
   if (path.split(".").length < 2) {
-    return { rule: "FD-V43", message: `${where} path ${JSON.stringify(path)} is a root alone and names no value \u2014 ${JSON.stringify(root)} is a container, so a comparison against it could only ever be no match` };
+    return { rule: "FD-V43", message: `${where} path ${JSON.stringify(path)} is a root alone ${scope.rootAlone(root)}` };
   }
   const op = o.op;
   if (typeof op !== "string" || !PREDICATE_OPS.includes(op)) {
@@ -604,23 +825,26 @@ function predicateProblem(v) {
     return { rule: "FD-V42", message: `when carries ${Object.keys(o).map((k) => JSON.stringify(k)).join(", ")} and matches more than one shape \u2014 a name, a comparison and a group are told apart by which keys are present, so an object may mark only one` };
   }
   if (shape === "name") {
-    const extra2 = Object.keys(o).filter((k) => !PREDICATE_NAME_KEYS.includes(k));
-    if (extra2.length) return { rule: "FD-V42", message: `when names a predicate and also carries ${extra2.map((k) => JSON.stringify(k)).join(", ")}; the name form is { predicate } and nothing else` };
+    const extra = Object.keys(o).filter((k) => !PREDICATE_NAME_KEYS.includes(k));
+    if (extra.length) return { rule: "FD-V42", message: `when names a predicate and also carries ${extra.map((k) => JSON.stringify(k)).join(", ")}; the name form is { predicate } and nothing else` };
     if (typeof o.predicate !== "string") return { rule: "FD-V42", message: `when predicate is ${scalarName(o.predicate)}; it is the name of a registered predicate` };
     return null;
   }
   if (shape === "leaf") return leafProblem(o, "when");
+  return groupProblem(o, "when", EDGE_SCOPE);
+}
+function groupProblem(o, label, scope) {
   const extra = Object.keys(o).filter((k) => !PREDICATE_GROUP_KEYS.includes(k));
-  if (extra.length) return { rule: "FD-V42", message: `when is a group and also carries ${extra.map((k) => JSON.stringify(k)).join(", ")}; a group is { all } or { any } and nothing else` };
-  if ("all" in o && "any" in o) return { rule: "FD-V45", message: 'when carries both "all" and "any"; a group is one or the other, because a document that says both says neither' };
+  if (extra.length) return { rule: "FD-V42", message: `${label} is a group and also carries ${extra.map((k) => JSON.stringify(k)).join(", ")}; a group is { all } or { any } and nothing else` };
+  if ("all" in o && "any" in o) return { rule: "FD-V45", message: `${label} carries both "all" and "any"; a group is one or the other, because a document that says both says neither` };
   const which = "all" in o ? "all" : "any";
   const members = o[which];
   if (!Array.isArray(members) || members.length === 0) {
-    return { rule: "FD-V45", message: `when ${which} is ${Array.isArray(members) ? "empty" : scalarName(members)}; it is a non-empty array of comparisons \u2014 an empty group is "always true" or "always false" written as a question` };
+    return { rule: "FD-V45", message: `${label} ${which} is ${Array.isArray(members) ? "empty" : scalarName(members)}; it is a non-empty array of comparisons \u2014 an empty group is "always true" or "always false" written as a question` };
   }
   for (let i = 0; i < members.length; i++) {
     const m = members[i];
-    const at = `when ${which}[${i}]`;
+    const at = `${label} ${which}[${i}]`;
     if (typeof m !== "object" || m === null || Array.isArray(m)) {
       return { rule: "FD-V45", message: `${at} is ${scalarName(m)}; a group's members are comparisons` };
     }
@@ -634,11 +858,30 @@ function predicateProblem(v) {
     if (ms === null || ms === "ambiguous") {
       return { rule: "FD-V45", message: `${at} carries ${Object.keys(m).map((k) => JSON.stringify(k)).join(", ") || "no keys"} and is not a comparison` };
     }
-    const p = leafProblem(m, at);
+    const p = leafProblem(m, at, scope);
     if (p) return p;
   }
   return null;
 }
+function gateConditionProblem(v) {
+  const label = "settings.when";
+  if (typeof v !== "object" || v === null || Array.isArray(v)) {
+    return { rule: "FD-V42", message: `${label} is ${scalarName(v)}; it is an object \u2014 a comparison { ${PREDICATE_LEAF_KEYS.join(", ")} } or a flat group { all } or { any }, over the root "input"` };
+  }
+  const o = v;
+  const shape = predicateShapeOf(o);
+  if (shape === null) {
+    return { rule: "FD-V42", message: `${label} carries ${Object.keys(o).map((k) => JSON.stringify(k)).join(", ") || "no keys"} and is neither a comparison { ${PREDICATE_LEAF_KEYS.join(", ")} } nor a flat group { all } or { any }` };
+  }
+  if (shape === "ambiguous") {
+    return { rule: "FD-V42", message: `${label} carries ${Object.keys(o).map((k) => JSON.stringify(k)).join(", ")} and matches more than one shape \u2014 a comparison and a group are told apart by which keys are present, so an object may mark only one` };
+  }
+  if (shape === "name") {
+    return { rule: "FD-V42", message: `${label} names a registered predicate, which an if gate cannot ask \u2014 a predicate is handed a decision's outcome and its edge's needs, and a gate has neither. Write a comparison over "input", or register a gate type of your own` };
+  }
+  if (shape === "leaf") return leafProblem(o, label, GATE_SCOPE);
+  return groupProblem(o, label, GATE_SCOPE);
+}
 function predicateNamesIn(v) {
   if (typeof v !== "object" || v === null || Array.isArray(v)) return [];
   const o = v;
@@ -707,6 +950,8 @@ function aimedReferences(n) {
 }
 function referenceTarget(ref) {
   if (ref === ".") return { form: "self", node: null, conditional: false };
+  if (ref === PAYLOAD_TOKEN) return { form: "payload", node: null, conditional: false };
+  if (ref === ITEM_TOKEN) return { form: "item", node: null, conditional: false };
   if (typeof ref === "string") return aimed(ref, "one");
   if (Array.isArray(ref) && ref.length === 1 && typeof ref[0] === "string") {
     return aimed(ref[0], "all");
@@ -718,6 +963,20 @@ function aimed(s, form) {
   const node = conditional ? s.slice(0, -1) : s;
   return ID_RE.test(node) ? { form, node, conditional } : null;
 }
+var PAYLOAD_TOKEN = "$payload";
+var ITEM_TOKEN = "$item";
+function dollarProblem(ref) {
+  const one = Array.isArray(ref) && ref.length === 1 ? ref[0] : ref;
+  if (typeof one !== "string" || !one.startsWith("$")) return null;
+  const bare = one.endsWith("?") ? one.slice(0, -1) : one;
+  const known = bare === PAYLOAD_TOKEN || bare === ITEM_TOKEN;
+  if (known && Array.isArray(ref)) {
+    return `${JSON.stringify(ref)} is an array form, and there is ONE ${bare === PAYLOAD_TOKEN ? "run payload" : "item per map instance"}: write ${JSON.stringify(bare)}`;
+  }
+  if (known) return `${JSON.stringify(one)} carries "?", and ${JSON.stringify(bare)} is always there: write ${JSON.stringify(bare)} without "?"`;
+  return `${JSON.stringify(ref)} is not a reference: the "$" prefix is reserved, and its references are "$payload" (the run's payload) and "$item" (a map instance's item)`;
+}
+var itemOutside = (site, k, nodeId) => `${site}[${JSON.stringify(k)}] is "$item", and "${nodeId}" is not inside a map instance: name the item where a map's branch receives it ("."), or move this node inside the map`;
 function validateDefinition(doc, registry) {
   const f = [];
   const add = (rule, at, detail) => f.push({ rule, at, detail });
@@ -764,7 +1023,7 @@ function validateDefinition(doc, registry) {
     }
     if (nd?.kind === void 0) continue;
     if (typeof nd.kind !== "string" || !KINDS.includes(nd.kind)) {
-      add("FD-V24", where, `node kind ${JSON.stringify(nd.kind)} is not task|fanout|map|join|end|gate`);
+      add("FD-V24", where, `node kind ${JSON.stringify(nd.kind)} is not task|fanout|map|join|end|gate|ask`);
       continue;
     }
     const spec = NODE_KEYS[nd.kind];
@@ -775,7 +1034,11 @@ function validateDefinition(doc, registry) {
     }
     for (const k of Object.keys(nd)) {
       if (!spec.req.includes(k) && !spec.opt.includes(k)) {
-        add("FD-V17", where, `${nd.kind} node carries undeclared key "${k}"`);
+        if (nd.kind === "ask" && ASK_REFUSED_KEYS.includes(k)) {
+          add("FD-V47", where, k === "transform" ? 'ask node carries "transform", which only a task declares \u2014 a transform is evaluated in a node type\'s worker wrapper (FD-C6) and an ask runs no worker, so nothing would evaluate it; what reaches an ask is composed by its `needs` (P35 decision 6)' : `ask node carries "${k}", which only a task declares \u2014 it is read by a task's worker or its scheduler task, and an ask runs no worker and is never dispatched, so nothing would read it`);
+        } else {
+          add("FD-V17", where, `${nd.kind} node carries undeclared key "${k}"`);
+        }
       }
     }
     if (nd.kind === "task") {
@@ -865,21 +1128,63 @@ function validateDefinition(doc, registry) {
         }
       }
       const settings = nd.settings;
+      let settingsRefused = false;
       if (settings !== void 0 && (typeof settings !== "object" || settings === null || Array.isArray(settings))) {
-        add("FD-V40", where, `settings must be a plain object, got ${JSON.stringify(settings)}`);
+        add("FD-V40", where, `settings must be a plain object, got ${describeValue(settings)}`);
+        settingsRefused = true;
       } else {
         const s = settings ?? {};
         if (Object.prototype.hasOwnProperty.call(s, "key")) {
           const kp = keyPathProblem(s.key);
-          if (kp !== null) add("FD-V40", where, kp);
+          if (kp !== null) {
+            add("FD-V40", where, kp);
+            settingsRefused = true;
+          }
         }
+        let schemaRefused = false;
         if (usable?.settingsSchema !== void 0) {
           const fs = findings(usable.settingsSchema, s);
-          if (fs.length) add("FD-V40", where, `settings ${JSON.stringify(s)} fail gate type "${typeName}"'s settingsSchema: ${describeFindings(fs)}`);
+          if (fs.length) {
+            add("FD-V40", where, `settings ${describeValue(s)} fail gate type "${typeName}"'s settingsSchema: ${describeFindings(fs)}`);
+            schemaRefused = true;
+            settingsRefused = true;
+          }
+        }
+        let uncopyable = false;
+        if (usable !== void 0 && (usable.settingsProblem !== void 0 || typeof usable.routesFor === "function")) {
+          try {
+            structuredClone(s);
+          } catch (e) {
+            add("FD-V40", where, `settings cannot be copied for gate type "${typeName}" \u2014 they must survive structuredClone, as a JSON document's do: ${describeThrown(e)}`);
+            uncopyable = true;
+            settingsRefused = true;
+          }
+        }
+        if (usable?.settingsProblem !== void 0 && !schemaRefused && !uncopyable) {
+          let said;
+          let threw = false;
+          const copy = structuredClone(s);
+          try {
+            said = usable.settingsProblem(copy);
+          } catch (e) {
+            threw = true;
+            add("FD-V39", where, `type "${typeName}"'s settingsProblem threw: ${describeThrown(e)}`);
+          }
+          if (!threw && said !== null) {
+            if (typeof said === "string") {
+              add("FD-V40", where, `settings ${describeValue(s)} fail gate type "${typeName}"'s settingsProblem: ` + (said === "" ? "it returned an EMPTY message \u2014 a refusal with no reason given (null is the pass)" : said));
+            } else add("FD-V39", where, `type "${typeName}"'s settingsProblem returned ${describeValue(said)}, which is neither a message nor null`);
+          }
+          if (threw || said !== null) settingsRefused = true;
         }
       }
-      if (usable !== void 0 && Array.isArray(nd.edges)) {
-        const gate = usable;
+      let routeSet;
+      if (usable !== void 0 && !(typeof usable.routesFor === "function" && settingsRefused)) {
+        routeSet = routesOf(usable, settings ?? {});
+        if ("problem" in routeSet) add("FD-V39", where, `type "${typeName}" resolves no route set for this gate: ${routeSet.problem}`);
+      }
+      if (routeSet !== void 0 && !("problem" in routeSet) && Array.isArray(nd.edges)) {
+        const gate = routeSet;
         const count = new Map(gate.routes.map((r) => [r, 0]));
         nd.edges.forEach((e, i) => {
           if (e === null || typeof e !== "object") return;
@@ -887,7 +1192,7 @@ function validateDefinition(doc, registry) {
           if (r !== void 0 && typeof r !== "string") return;
           const route = r === void 0 ? gate.defaultRoute : r;
           if (!count.has(route)) {
-            add("FD-V41", `${where}#edge${i}`, `route "${route}" is not a route gate type "${typeName}" declares (it declares ${gate.routes.map((x) => `"${x}"`).join(", ")})`);
+            add("FD-V41", `${where}#edge${i}`, `route "${route}" is not one of this gate's routes \u2014 the routes gate type "${typeName}" declares for it are ${gate.routes.map((x) => `"${x}"`).join(", ")}`);
             return;
           }
           count.set(route, count.get(route) + 1);
@@ -895,13 +1200,23 @@ function validateDefinition(doc, registry) {
         for (const [route, n2] of count) {
           const how = route === gate.defaultRoute ? " (the default route \u2014 an edge with no `route` carries it)" : "";
           if (n2 === 0) {
-            add("FD-V41", where, `route "${route}"${how} of gate type "${typeName}" has no edge; every declared route is wired exactly once \u2014 a drop is an edge to an \`end\` node, because a route left unwired would be dropped in silence the day the type grows one`);
+            add("FD-V41", where, `route "${route}"${how} of this gate (gate type "${typeName}") has no edge; every route of the gate is wired exactly once \u2014 a drop is an edge to an \`end\` node, because a route left unwired would be dropped in silence the day the type grows one`);
           } else if (n2 > 1) {
-            add("FD-V41", where, `route "${route}"${how} of gate type "${typeName}" is wired by ${n2} edges; exactly one`);
+            add("FD-V41", where, `route "${route}"${how} of this gate (gate type "${typeName}") is wired by ${n2} edges; exactly one`);
           }
         }
       }
     }
+    if (nd.kind === "ask") {
+      const s = nd.settings;
+      if (s !== void 0 && (typeof s !== "object" || s === null || Array.isArray(s))) {
+        add("FD-V21", where, `ask settings must be a plain object, got ${describeValue(s)}`);
+      }
+      if (nd.answerSchema !== void 0) {
+        const problem = schemaProblem(nd.answerSchema);
+        if (problem !== null) add("FD-V48", where, `answerSchema is not in the built-in schema subset \u2014 ${problem}`);
+      }
+    }
     if (nd.kind === "end") {
       if (nd.edges !== void 0) add("FD-V8", where, "end node has edges");
       if (nd.outcome !== void 0 && typeof nd.outcome !== "string") {
@@ -936,8 +1251,11 @@ function validateDefinition(doc, registry) {
         for (const [k, ref] of Object.entries(nv)) {
           if (!ID_RE.test(k)) add("FD-V26", where, `needs key ${JSON.stringify(k)} is not [A-Za-z0-9_-]{1,64}`);
           const target = referenceTarget(ref);
-          if (target === null) {
-            add("FD-V26", where, `needs[${JSON.stringify(k)}] is ${JSON.stringify(ref)}, which is not "." , a node id with an optional "?" suffix, or a one-element array holding one`);
+          const dollar = target === null ? dollarProblem(ref) : null;
+          if (dollar !== null) {
+            add("FD-V26", where, `needs[${JSON.stringify(k)}]: ${dollar}`);
+          } else if (target === null) {
+            add("FD-V26", where, `needs[${JSON.stringify(k)}] is ${JSON.stringify(ref)}, which is not "." , "$payload", "$item", a node id with an optional "?" suffix, or a one-element array holding one`);
           }
         }
       }
@@ -999,9 +1317,12 @@ function validateDefinition(doc, registry) {
           for (const [k, ref] of Object.entries(nv)) {
             if (!ID_RE.test(k)) add("FD-V26", at, `edge needs key ${JSON.stringify(k)} is not [A-Za-z0-9_-]{1,64}`);
             const target = referenceTarget(ref);
-            if (target === null) {
-              add("FD-V26", at, `edge needs[${JSON.stringify(k)}] is ${JSON.stringify(ref)}, which is not a node id with an optional "?" suffix or a one-element array holding one`);
-            } else if (target.node === null) {
+            const dollar = target === null ? dollarProblem(ref) : null;
+            if (dollar !== null) {
+              add("FD-V26", at, `edge needs[${JSON.stringify(k)}]: ${dollar}`);
+            } else if (target === null) {
+              add("FD-V26", at, `edge needs[${JSON.stringify(k)}] is ${JSON.stringify(ref)}, which is not "$payload", "$item", a node id with an optional "?" suffix or a one-element array holding one`);
+            } else if (target.form === "self") {
               add("FD-V26", at, `edge needs[${JSON.stringify(k)}] is ".", which an EDGE may not use: what a predicate would have received anyway is its node's own outcome, and \`ctx.outcome\` already carries it`);
             }
           }
@@ -1046,18 +1367,18 @@ function validateDefinition(doc, registry) {
   }
   for (const n of nodes) {
     if (typeof n?.id !== "string") continue;
-    if (n.kind === "task") {
+    if (n.kind === "task" || n.kind === "ask") {
       const edges = (Array.isArray(n.edges) ? n.edges : []).filter(
         (e) => e !== null && typeof e === "object"
       );
       if (edges.length === 0) {
-        add("FD-V7", n.id, "task node has no edges");
+        add("FD-V7", n.id, `${n.kind} node has no edges`);
         continue;
       }
       const onOf2 = (e) => Array.isArray(e?.on) && e.on.length ? e.on : ["done"];
       const states = /* @__PURE__ */ new Set();
       for (const e of edges) for (const s of onOf2(e)) states.add(s);
-      if (!states.has("done")) add("FD-V7", n.id, 'no edge of this task node is eligible for "done"');
+      if (!states.has("done")) add("FD-V7", n.id, `no edge of this ${n.kind} node is eligible for "done"`);
       for (const t of states) {
         const eligible = edges.filter((e) => onOf2(e).includes(t));
         const bare = eligible.filter((e) => e.when === void 0);
@@ -1077,8 +1398,8 @@ function validateDefinition(doc, registry) {
     }
   }
   for (const m of maps) {
-    if (typeof m.branch === "string" && g.byId.has(m.branch) && kindOf2(m.branch) !== "task") {
-      add("FD-V25", m.id, `branch "${m.branch}" is a ${kindOf2(m.branch)}, not a task`);
+    if (typeof m.branch === "string" && g.byId.has(m.branch) && kindOf2(m.branch) !== "task" && kindOf2(m.branch) !== "ask") {
+      add("FD-V25", m.id, `branch "${m.branch}" is a ${kindOf2(m.branch)}, not a task or an ask`);
     }
   }
   for (const fan of fanouts) {
@@ -1086,8 +1407,8 @@ function validateDefinition(doc, registry) {
     if (b.length < 2) add("FD-V9", fan.id, `fanout has ${b.length} branches, needs at least 2`);
     if (new Set(b).size !== b.length) add("FD-V9", fan.id, "fanout repeats a branch entry");
     for (const x of b) {
-      if (g.byId.has(x) && kindOf2(x) !== "task") {
-        add("FD-V9", fan.id, `branch entry "${x}" is a ${kindOf2(x)}, not a task`);
+      if (g.byId.has(x) && kindOf2(x) !== "task" && kindOf2(x) !== "ask") {
+        add("FD-V9", fan.id, `branch entry "${x}" is a ${kindOf2(x)}, not a task or an ask`);
       }
     }
   }
@@ -1158,14 +1479,19 @@ function validateDefinition(doc, registry) {
       if (typeof n !== "object" || n === null || typeof n.id !== "string") continue;
       for (const [k, ref, site, at] of aimedReferences(n)) {
         const t = referenceTarget(ref);
-        if (t === null || t.node === null) continue;
+        if (t === null) continue;
+        if (t.form === "item") {
+          if (innermostMapOf(regions, n.id) === void 0) add("FD-V49", at, itemOutside(site, k, n.id));
+          continue;
+        }
+        if (t.form === "self" || t.form === "payload") continue;
         const target = t.node;
         if (!g.byId.has(target)) {
           add("FD-V27", at, `${site}[${JSON.stringify(k)}] names "${target}", which is not a node`);
           continue;
         }
-        if (kindOf2(target) !== "task") {
-          add("FD-V27", at, `${site}[${JSON.stringify(k)}] names "${target}", a ${kindOf2(target)}; only a task produces an output`);
+        if (kindOf2(target) !== "task" && kindOf2(target) !== "ask") {
+          add("FD-V27", at, `${site}[${JSON.stringify(k)}] names "${target}", a ${kindOf2(target)}; only a task or an ask produces an output`);
           continue;
         }
         if (!reachFrom(g, target).has(n.id)) {
@@ -1250,9 +1576,12 @@ var DOCUMENT_KEYS = ["workers", "groups", "nodeTypes", "pools", "predicates", "l
 var WORKER_KEYS = ["url", "configSchema", "settingsSchema", "inputSchema", "outputSchema"];
 var CHECKED_WORKER_SCHEMAS = ["configSchema", "settingsSchema"];
 var NODE_TYPE_DECLARATION_KEYS = ["worker", "inline", "config", "pool", "groups", "retryPolicy", "settings"];
-var POOL_SPEC_KEYS = ["config", "maxThreads", "maxConcurrentTasks", "idleTimeout", "groups", "residentGroups"];
+var POOL_SPEC_KEYS = ["config", "maxThreads", "maxConcurrentTasks", "idleTimeout", "groups", "residentGroups", "cancelGraceMs", "messages"];
+var MESSAGE_OPTION_KEYS = ["flushIntervalMs", "maxBuffered"];
 var DECLARED_POOL_KEYS = POOL_SPEC_KEYS.filter((k) => k !== "config" && k !== "groups");
 var INSTANCE_KEYS = ["type", "config"];
+var POOL_INSTANCE_KEYS = [...INSTANCE_KEYS, "pool"];
+var MAX_TIMER_MS = 2 ** 31 - 1;
 var isPlainObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var hasOwn = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
 var isBuiltInNodeType = (name) => hasOwn(BUILT_IN_NODE_TYPES, name);
@@ -1270,8 +1599,23 @@ function mergeConfig(base, over) {
   if (isPlainObject2(base) && isPlainObject2(over)) return { ...base, ...over };
   return over;
 }
-function nodeTypeFromDeclaration(decl) {
-  const declaredPool = decl.pool ?? {};
+var DECLARATIONS = /* @__PURE__ */ new WeakMap();
+function declarationOf(t) {
+  return isDerivation(t) ? DECLARATIONS.get(t) : t;
+}
+function mergePool(base, over) {
+  if (over === void 0) return base;
+  const out = { ...base };
+  for (const [k, v] of Object.entries(over)) if (v !== void 0) out[k] = v;
+  return out;
+}
+function copyResident(r) {
+  if (Array.isArray(r)) return [...r];
+  if (isPlainObject2(r)) return { ...r };
+  return r;
+}
+function nodeTypeFromDeclaration(decl, over) {
+  const declaredPool = mergePool(decl.pool ?? {}, over);
   const def = {
     worker: decl.worker,
     ...decl.inline !== void 0 ? { inline: decl.inline } : {},
@@ -1283,10 +1627,18 @@ function nodeTypeFromDeclaration(decl) {
       return {
         ...merged !== void 0 ? { config: merged } : {},
         ...declaredPool,
+        // **Every declared pool OBJECT is copied, never aliased** — `messages` and `groups` since W159, and
+        // `residentGroups` since v0.37 (P37 decision 8, ADR 0099 rule 3; it was handed on AS DECLARED until then,
+        // W159's conformity F3), so no two pools' specs share an object and none shares one with the document. A
+        // CLASS derivation's output is handed on as the class returned it — harmless, since the scheduler spreads
+        // `messages` into a fresh object (W159's adequacy F7) and reads `residentGroups` without writing it.
+        ...declaredPool.messages !== void 0 ? { messages: { ...declaredPool.messages } } : {},
+        ...declaredPool.residentGroups !== void 0 ? { residentGroups: copyResident(declaredPool.residentGroups) } : {},
         ...decl.groups !== void 0 ? { groups: [...decl.groups] } : {}
       };
     }
   };
+  DECLARATIONS.set(def, over === void 0 ? decl : { ...decl, pool: declaredPool });
   return def;
 }
 function poolSpecProblem(v) {
@@ -1309,11 +1661,53 @@ function poolSpecProblem(v) {
       for (const [k, c] of Object.entries(r)) if (!(typeof c === "number" && Number.isFinite(c) && c > 0)) return `PoolSpec.residentGroups[${q(k)}] must be a cost > 0, got ${JSON.stringify(c)}`;
     } else return `PoolSpec.residentGroups must be an array of group keys or a { key: cost } record, got ${JSON.stringify(r)}`;
   }
+  if (v.cancelGraceMs !== void 0 && !(typeof v.cancelGraceMs === "number" && v.cancelGraceMs >= 0)) {
+    return `PoolSpec.cancelGraceMs must be a number >= 0 (Infinity: never force), got ${shown(v.cancelGraceMs)}`;
+  }
+  if (v.messages !== void 0) {
+    const m = v.messages;
+    if (!isPlainObject2(m) || !isPlainPrototype(m)) {
+      return `PoolSpec.messages must be a plain object of ${MESSAGE_OPTION_KEYS.join(", ")} \u2014 its prototype Object.prototype or null \u2014 got ${describeNonPlain(m)}`;
+    }
+    for (const k of Object.keys(m)) if (!MESSAGE_OPTION_KEYS.includes(k)) return `PoolSpec.messages carries undeclared key ${q(k)}; it declares ${MESSAGE_OPTION_KEYS.join(", ")}`;
+    if (ownKey(m, "flushIntervalMs") && !(typeof m.flushIntervalMs === "number" && Number.isFinite(m.flushIntervalMs) && m.flushIntervalMs > 0 && m.flushIntervalMs <= MAX_TIMER_MS)) {
+      return `PoolSpec.messages.flushIntervalMs must be a finite number > 0 and at most ${MAX_TIMER_MS} (2^31-1, the longest delay a timer holds \u2014 the scheduler arms setTimeout with it, and a longer one fires at once), got ${shown(m.flushIntervalMs)}`;
+    }
+    if (ownKey(m, "maxBuffered") && !(typeof m.maxBuffered === "number" && Number.isInteger(m.maxBuffered) && m.maxBuffered >= 1)) {
+      return `PoolSpec.messages.maxBuffered must be an integer >= 1, got ${shown(m.maxBuffered)}`;
+    }
+  }
   return null;
 }
+function isPlainPrototype(o) {
+  const proto = Object.getPrototypeOf(o);
+  return proto === Object.prototype || proto === null;
+}
+function ownKey(o, k) {
+  return Object.prototype.propertyIsEnumerable.call(o, k);
+}
+function describeNonPlain(v) {
+  if (Array.isArray(v)) return `an array ${shown(v)}`;
+  if (typeof v === "object" && v !== null) {
+    const proto = Object.getPrototypeOf(v);
+    const name = proto?.constructor?.name;
+    return `an object whose prototype is not Object.prototype${name ? ` (a ${name})` : ""}`;
+  }
+  return shown(v);
+}
+function shown(v) {
+  if (typeof v === "number" || v === void 0) return String(v);
+  try {
+    return JSON.stringify(v) ?? String(v);
+  } catch {
+    return typeof v;
+  }
+}
 function groupsNamedBy(spec) {
-  const resident = spec.residentGroups === void 0 ? [] : Array.isArray(spec.residentGroups) ? [...spec.residentGroups] : Object.keys(spec.residentGroups);
-  return [.../* @__PURE__ */ new Set([...spec.groups ?? [], ...resident])];
+  return [.../* @__PURE__ */ new Set([...spec.groups ?? [], ...residentKeysOf(spec)])];
+}
+function residentKeysOf(spec) {
+  return spec.residentGroups === void 0 ? [] : Array.isArray(spec.residentGroups) ? [...spec.residentGroups] : Object.keys(spec.residentGroups);
 }
 function poolOptionsOf(spec, inline, workerUrl, languages) {
   const { config, groups, ...rest } = spec;
@@ -1371,15 +1765,21 @@ function checkNodeTypeShape(name, t, builtIn = false) {
   }
   if (o.settings !== void 0 && !isPlainObject2(o.settings)) throw new DerivationRefused(at, `node type ${q(at)}.settings must be a plain object of defaults, got ${JSON.stringify(o.settings)}`);
 }
-function derivePool(key, typeName, def, worker, config, groupKeys, refuse) {
+function derivePool(key, typeName, def, worker, config, groupKeys, refuse, pool) {
   const who = key === typeName ? `node type ${q(typeName)}'s default instance` : `pool ${q(key)} (an instance of ${q(typeName)})`;
   if (def.configSchema !== void 0) {
     const fs = findings(def.configSchema, config ?? {});
     if (fs.length) throw new refuse(key, `${who}: config fails the type's configSchema \u2014 ${describeFindings(fs)}`);
   }
+  let derivation = def;
+  if (pool !== void 0) {
+    const declaration = declarationOf(def);
+    if (declaration === void 0) throw new Error(`derivePool: ${who} carries pool options and its type is a class \u2014 the registry's shape check should have refused it`);
+    derivation = nodeTypeFromDeclaration(declaration, pool);
+  }
   let spec;
   try {
-    spec = def.pool(config, key);
+    spec = derivation.pool(config, key);
   } catch (e) {
     throw new DerivationRefused(key, `${who}: the derivation pool() THREW: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -1398,7 +1798,13 @@ function derivePool(key, typeName, def, worker, config, groupKeys, refuse) {
   if (resident > 0 && spec.idleTimeout === 0) {
     throw new DerivationRefused(key, `${who}: residentGroups beside idleTimeout: 0 \u2014 a worker that never idles never releases a resident group, and a second pool contending for it waits for ever (measured on 0.5.2, P18 fact 6); give the pool a positive idleTimeout`);
   }
-  return { key, type: typeName, definition: def, worker, config, spec };
+  return { key, type: typeName, definition: def, worker, config, spec, ...pool !== void 0 ? { pool: copyPool(pool) } : {} };
+}
+function copyPool(p) {
+  const out = mergePool({}, p);
+  if (isPlainObject2(out.messages)) out.messages = { ...out.messages };
+  if (out.residentGroups !== void 0) out.residentGroups = copyResident(out.residentGroups);
+  return out;
 }
 function poolTypeNames(consumer) {
   const own3 = [...consumer].filter((n) => !Object.prototype.hasOwnProperty.call(BUILT_IN_NODE_TYPES, n)).sort();
@@ -1442,11 +1848,21 @@ function checkNodeTypesShape(rawNodeTypes, workers) {
 function checkPoolsShape(rawPools, types) {
   for (const [key, p] of poolsOf(rawPools)) {
     if (!isPlainObject2(p)) throw new UndeclaredKey(key, `pool ${q(key)} is not an object`);
-    noUndeclared("pool", key, p, INSTANCE_KEYS);
+    noUndeclared("pool", key, p, POOL_INSTANCE_KEYS);
     if (types.has(key)) throw new NameCollision(key, `pool ${q(key)} is named as node type ${q(key)} is \u2014 a type's name is its DEFAULT instance's key, so a named instance may not take it` + (isBuiltInNodeType(key) ? ` \u2014 and ${q(key)} is a BUILT-IN node type, so that name is the library's and no registry document declares it` : ""));
     if (typeof p?.type !== "string" || !types.has(p.type)) {
       throw new PoolTypeMissing(key, `pool ${q(key)} names type ${JSON.stringify(p?.type)}, which is not a node type` + poolTypeNames([...types.keys()]));
     }
+    const own3 = p.pool;
+    if (own3 !== void 0) {
+      if (declarationOf(types.get(p.type)) === void 0) {
+        throw new UndeclaredKey(key, `pool ${q(key)} is an instance of CLASS type ${q(p.type)} and carries "pool" \u2014 pool options on an instance are a DOCUMENT type's; a class derives its pool from the instance's config and key, so the knob belongs in its configSchema (ADR 0099)`);
+      }
+      if (!isPlainObject2(own3)) throw new DerivationRefused(key, `pool ${q(key)}: its own pool options must be an object, got ${JSON.stringify(own3)}`);
+      noUndeclared("pool instance pool", key, own3, DECLARED_POOL_KEYS);
+      const problem = poolSpecProblem(own3);
+      if (problem !== null) throw new DerivationRefused(key, `pool ${q(key)}.pool: ${problem}`);
+    }
   }
 }
 function checkGateTypes(x) {
@@ -1526,7 +1942,14 @@ function resolveRegistry(doc, code = {}) {
     const builtIn = builtInEntry === void 0 ? void 0 : isDerivation(builtInEntry) ? builtInEntry : nodeTypeFromDeclaration(builtInEntry);
     const def = (typeof inst.type === "string" ? nodeTypes.get(inst.type) : void 0) ?? builtIn;
     if (def === void 0) throw new Error(`resolveRegistry: pool ${q(key)} reached derivation with no type \u2014 checkRegistryShape should have refused it`);
-    pools.set(key, derivePool(key, inst.type, def, def.worker === void 0 ? void 0 : workers.get(def.worker), inst.config, groupKeys, ConfigRefused));
+    pools.set(key, derivePool(key, inst.type, def, def.worker === void 0 ? void 0 : workers.get(def.worker), inst.config, groupKeys, ConfigRefused, inst.pool));
+  }
+  for (const p of pools.values()) {
+    for (const g of residentKeysOf(p.spec)) {
+      if (groups.get(g)?.type !== "KeyedRateLimitGroup") continue;
+      const who = p.key === p.type ? `node type ${q(p.type)}'s default instance` : `pool ${q(p.key)} (an instance of ${q(p.type)})`;
+      throw new DerivationRefused(p.key, `${who}: the derived pool holds group ${q(g)}, of the built-in type "KeyedRateLimitGroup", in residentGroups \u2014 the scheduler resolves no key for a resident group, so every worker holding it is counted in ONE "" bucket, in silence (Q619). Name ${q(g)} in groups, where each task is counted under its limitKey (FD-R6), or hold a ConcurrentLimitGroup or RateLimitGroup resident`);
+    }
   }
   const predicateNames = doc.predicates ?? [];
   if (!Array.isArray(predicateNames) || predicateNames.some((p) => typeof p !== "string")) throw new UndeclaredKey("predicates", `registry document's predicates must be an array of names, got ${JSON.stringify(predicateNames)}`);
@@ -1672,6 +2095,7 @@ function entryWalk(flow, payload, sampled, choose) {
       out.push({ node: id, value });
       return;
     }
+    if (n.kind === "ask") return;
     seen.add(id);
     if (n.kind === "fanout") for (const b of n.branches) walk(b, value);
     if (n.kind === "gate") for (const e of choose ? choose(n, value) : n.edges ?? []) walk(e.to, value);
@@ -1680,7 +2104,10 @@ function entryWalk(flow, payload, sampled, choose) {
         walk(n.branch, void 0);
         return;
       }
-      const composed = n.needs === void 0 ? value : Object.fromEntries(Object.entries(n.needs).filter(([, r]) => r === ".").map(([k]) => [k, value]));
+      const composed = n.needs === void 0 ? value : Object.fromEntries(Object.entries(n.needs).flatMap(([k, r]) => {
+        const form = referenceTarget(r)?.form;
+        return form === "self" ? [[k, value]] : form === "payload" ? [[k, payload]] : [];
+      }));
       const arr = composed?.[n.over];
       if (Array.isArray(arr)) for (const v of arr) walk(n.branch, v);
     }
@@ -1697,6 +2124,13 @@ var Wiring = class {
   workers;
   types;
   gateTypes;
+  /**
+   * **Each gate's RESOLVED route set, by gate id — or nothing** (ADR 0092 rule 3): `routesOf` over the gate's
+   * type and settings, asked once here. This check does not run the validator first, so an unknown type and a
+   * `routesOf` problem (it is total: a malformed set, a throwing `routesFor`) both leave the gate with NO set — no default
+   * route and no guarantee, the arcs reported as they are, which is what an unknown type always got.
+   */
+  gateRoutes = /* @__PURE__ */ new Map();
   // Explicit fields, never parameter properties: Node's type stripping refuses those (`RT-R9`, `S4`),
   // which is how P18's own sample failed to load (W67's declaration step).
   constructor(flow, workers, types, gateTypes) {
@@ -1708,9 +2142,12 @@ var Wiring = class {
     this.regions = allRegions(this.graph, flow);
     const add = (to, from, kind, route) => this.inbound.set(to, [...this.inbound.get(to) ?? [], { from, kind, route }]);
     for (const n of flow.nodes) {
-      if (n.kind === "task" || n.kind === "join") for (const e of n.edges ?? []) add(e.to, n.id, n.kind === "task" ? "edge" : "join");
+      if (n.kind === "task" || n.kind === "ask" || n.kind === "join") for (const e of n.edges ?? []) add(e.to, n.id, n.kind === "join" ? "join" : "edge");
       if (n.kind === "gate") {
-        const dflt = this.gateTypes.get(n.type)?.defaultRoute;
+        const type = this.gateTypes.get(n.type);
+        const resolved = type === void 0 ? void 0 : routesOf(type, n.settings ?? {});
+        if (resolved !== void 0 && !("problem" in resolved)) this.gateRoutes.set(n.id, resolved);
+        const dflt = this.gateRoutes.get(n.id)?.defaultRoute;
         for (const e of n.edges ?? []) add(e.to, n.id, "gate", e.route ?? dflt);
       }
       if (n.kind === "fanout") for (const b of n.branches) add(b, n.id, "branch");
@@ -1813,8 +2250,16 @@ var Wiring = class {
     if (s === void 0) return { why: `"${nodeId}" (type "${n.type}", worker "${t.worker}") declares no ${kind}` };
     return { schema: s };
   }
-  /** What a task PRODUCES, as an arrival on the arc it sends. */
+  /** What a task — or an ask — PRODUCES, as an arrival on the arc it sends. */
   produced(taskId) {
+    const ask = this.byId.get(taskId);
+    if (ask?.kind === "ask") {
+      if (ask.answerSchema === void 0) return { unchecked: `"${taskId}" is an ask and declares no answerSchema, which is what would hold the person's answer` };
+      const malformed = schemaProblem(ask.answerSchema);
+      if (malformed !== null) return { unchecked: `"${taskId}" is an ask whose answerSchema is not in the built-in subset (FD-V48) \u2014 ${malformed}` };
+      const a = sampleOf(ask.answerSchema);
+      return { schema: ask.answerSchema, sample: { value: a.value, source: a.source } };
+    }
     const { schema, why } = this.schemaOf(taskId, "outputSchema");
     if (schema === void 0) return { unchecked: why };
     const s = sampleOf(schema);
@@ -1833,7 +2278,7 @@ var Wiring = class {
       else if (kind === "gate") {
         const gate = this.byId.get(from);
         const key = this.keyOf(gate);
-        const resolved = key !== "" && route !== void 0 && (this.gateTypes.get(gate.type)?.keyResolvedRoutes ?? []).includes(route);
+        const resolved = key !== "" && route !== void 0 && (this.gateRoutes.get(gate.id)?.keyResolvedRoutes ?? []).includes(route);
         for (const a of this.arrivals(from)) {
           if (!resolved || a.schema === void 0) {
             raw.push({ ...a });
@@ -1849,7 +2294,7 @@ var Wiring = class {
       } else raw.push(this.record(this.byId.get(from)));
     }
     const needs = node?.needs;
-    const out = needs ? raw.map((a) => this.composed(a, needs)) : raw;
+    const out = needs ? raw.map((a) => this.composed(a, needs, nodeId)) : raw;
     this.memo.set(nodeId, out);
     return out;
   }
@@ -1874,7 +2319,7 @@ var Wiring = class {
   /** The node(s) of one branch whose edge reaches the region's join — the value the branch carries in. */
   arrivingAt(region, branch) {
     const members = region.branchOf.get(branch) ?? /* @__PURE__ */ new Set();
-    return [...members].map((id) => this.byId.get(id)).filter((n) => (n.kind === "task" || n.kind === "join" || n.kind === "gate") && (n.edges ?? []).some((e) => e.to === region.joinId));
+    return [...members].map((id) => this.byId.get(id)).filter((n) => (n.kind === "task" || n.kind === "ask" || n.kind === "join" || n.kind === "gate") && (n.edges ?? []).some((e) => e.to === region.joinId));
   }
   /** `JP-R12`'s record for the region a join closes — exact for a fan-out, keyed by minted paths for a map. */
   record(j) {
@@ -1922,8 +2367,24 @@ var Wiring = class {
       sample: { value: sample, source, arity }
     };
   }
+  /**
+   * **What a `"$item"` key composes from: the enclosing map's ITEM arrival** — P38 (i), v0.45. The map is the innermost
+   * one containing `nodeId` (`innermostMapOf`, P38 (c)), and its item is `item()` over the map's OWN arrival — the
+   * `items` sub-schema of what it receives under `over`, with the per-element sample. **One arrival or none at all**: a
+   * map entered from two producers has no single item shape, and an ENTRY map has no arrival (the run's payload, which no
+   * schema declares) — both `unchecked`, never a guessed `fits`.
+   */
+  itemArrival(nodeId) {
+    const m = innermostMapOf(this.regions, nodeId);
+    if (m === void 0) return { unchecked: `"${nodeId}" is inside no map instance (FD-V49)` };
+    const at = this.arrivals(m.fanoutId);
+    if (at.length !== 1) {
+      return { unchecked: `map "${m.fanoutId}" has ${at.length === 0 ? "no arrival \u2014 the run's payload, which no schema declares" : `${at.length} arrivals`}, so no single item shape` };
+    }
+    return this.item(at[0], this.byId.get(m.fanoutId));
+  }
   /** `FD-C1`'s table over one arrival: the object `needs` describes, schema and sample alike. */
-  composed(a, needs) {
+  composed(a, needs, nodeId) {
     const base = { shape: "needs", producer: a.producer, ...a.through ? { through: a.through } : {} };
     if (a.refused !== void 0) return { ...base, refused: a.refused };
     const props = {};
@@ -1932,11 +2393,27 @@ var Wiring = class {
     let source = "example";
     const arity = a.sample?.arity;
     const dot = [];
+    const itemKeys = [];
+    let itemElements;
     for (const [key, ref] of Object.entries(needs)) {
       const t = referenceTarget(ref);
       if (t === null) return { ...base, unchecked: `needs.${key} is not a reference` };
       let schema2, value, src = "example";
-      if (t.node === null) {
+      if (t.form === "payload") return { ...base, unchecked: `needs.${key} is "$payload" \u2014 the run's payload, which no schema declares` };
+      if (t.form === "item") {
+        const it = this.itemArrival(nodeId);
+        if (it.schema === void 0) return { ...base, unchecked: `needs.${key} is "$item", and ${it.unchecked ?? it.refused}` };
+        schema2 = it.schema;
+        src = it.sample?.source ?? "witness";
+        if (it.perItem && it.sample !== void 0) {
+          itemElements = it.sample.value;
+          itemKeys.push(key);
+        } else {
+          const w = sampleOf(it.schema);
+          value = w?.value;
+          src = w?.source ?? "witness";
+        }
+      } else if (t.form === "self") {
         if (a.schema === void 0) return { ...base, unchecked: a.unchecked ?? a.refused ?? `needs.${key} is "." and the edge's value has no schema` };
         schema2 = a.schema;
         value = a.sample?.value;
@@ -1959,7 +2436,16 @@ var Wiring = class {
       const elements = a.sample.value;
       const value = elements.map((el) => {
         const s = { ...sample };
-        for (const k of dot) s[k] = el;
+        for (const k of [...dot, ...itemKeys]) s[k] = el;
+        return s;
+      });
+      return { ...base, perItem: true, schema, sample: { value, source, arity: elements.length } };
+    }
+    if (itemKeys.length > 0 && itemElements !== void 0) {
+      const elements = itemElements;
+      const value = elements.map((el) => {
+        const s = { ...sample };
+        for (const k of itemKeys) s[k] = el;
         return s;
       });
       return { ...base, perItem: true, schema, sample: { value, source, arity: elements.length } };
@@ -1976,8 +2462,7 @@ async function checkWiring(registry, flow, options = {}) {
   for (const node of flow.nodes) {
     if (node.kind !== "task") continue;
     const type = types.get(node.type);
-    const consumer = type?.worker === void 0 ? void 0 : workers.get(type.worker)?.inputSchema;
-    const consumerWhy = !type ? `type "${node.type}" of "${node.id}" is not in the registry` : type.worker === void 0 ? `"${node.id}" is of type "${node.type}", which only TRANSFORMS \u2014 it names no worker, so it declares no inputSchema` : !workers.get(type.worker) ? `worker "${type.worker}" of type "${node.type}" is not in the registry` : consumer === void 0 ? `"${node.id}" (type "${node.type}", worker "${type.worker}") declares no inputSchema` : void 0;
+    const { consumer, consumerWhy } = consumerOf(node, type, workers);
     for (const a of w.arrivals(node.id)) {
       const v = { consumer: node.id, shape: a.shape, producer: a.producer, ...a.through ? { through: a.through } : {}, kind: "unchecked", why: "" };
       if (a.refused !== void 0) {
@@ -2009,57 +2494,8 @@ async function checkWiring(registry, flow, options = {}) {
         continue;
       }
       const sample = { source: a.sample.source, ...a.sample.arity !== void 0 ? { arity: a.sample.arity } : {}, value: a.sample.value };
-      const adapter = languages.get(node.transform.lang);
-      if (adapter === void 0) {
-        v.why = `language "${node.transform.lang}" is not in the registry`;
-        v.sample = sample;
-        verdicts.push(v);
-        continue;
-      }
       const inputs = a.perItem ? a.sample.value : [a.sample.value];
-      if (inputs.length === 0) {
-        v.why = `the sample holds no item to run "${node.id}"'s transform on (arity 0)`;
-        v.sample = sample;
-        verdicts.push(v);
-        continue;
-      }
-      const settings = effectiveSettings(node, type);
-      let results;
-      try {
-        let compile;
-        try {
-          const mod = await import(adapter.worker);
-          if (typeof mod.default === "function") compile = mod.default;
-        } catch (e) {
-          if (options.workerHalf?.[node.transform.lang] === void 0) throw e;
-        }
-        compile ??= options.workerHalf?.[node.transform.lang];
-        if (typeof compile !== "function") throw new Error(`the worker half of language "${node.transform.lang}" has no default export, and none was handed in`);
-        const c = compile(node.transform.expr);
-        results = [];
-        for (const input of inputs) results.push(await c.evaluate(input, settings));
-      } catch (e) {
-        v.kind = "transform-fails";
-        v.why = `the transform threw on the ${sample.source}: ${e instanceof Error ? e.message : String(e)}`;
-        v.sample = { ...sample, result: e instanceof Error ? e.message : String(e) };
-        verdicts.push(v);
-        continue;
-      }
-      sample.result = a.perItem ? results : results[0];
-      v.sample = sample;
-      if (consumer === void 0) {
-        v.why = consumerWhy + " \u2014 the transform ran and nothing holds its result";
-        verdicts.push(v);
-        continue;
-      }
-      const bad = results.map((r, i) => [i, findings(consumer, r)]).find(([, f]) => f.length > 0);
-      if (bad) {
-        v.kind = "transform-fails";
-        v.why = `the transform's result on the ${sample.source}${a.perItem ? ` (item ${bad[0]})` : ""} fails the consumer's inputSchema \u2014 ${describeFindings(bad[1])}`;
-      } else {
-        v.kind = "transform-passes";
-        v.why = `the sample passed \u2014 the ${sample.source}${sample.arity !== void 0 ? ` at arity ${sample.arity}` : ""}, ${inputs.length} evaluation${inputs.length === 1 ? "" : "s"}, every result accepted by the consumer's inputSchema`;
-      }
+      await judgeTransform(v, node, node.transform, type, consumer, consumerWhy, languages, sample, inputs, a.perItem === true, options);
       verdicts.push(v);
     }
   }
@@ -2067,13 +2503,84 @@ async function checkWiring(registry, flow, options = {}) {
   for (const v of verdicts) counts[v.kind]++;
   return { flowId: flow.flowId, verdicts, counts, entry: entryTasks(flow) };
 }
+function consumerOf(node, type, workers) {
+  const consumer = type?.worker === void 0 ? void 0 : workers.get(type.worker)?.inputSchema;
+  const consumerWhy = !type ? `type "${node.type}" of "${node.id}" is not in the registry` : type.worker === void 0 ? `"${node.id}" is of type "${node.type}", which only TRANSFORMS \u2014 it names no worker, so it declares no inputSchema` : !workers.get(type.worker) ? `worker "${type.worker}" of type "${node.type}" is not in the registry` : consumer === void 0 ? `"${node.id}" (type "${node.type}", worker "${type.worker}") declares no inputSchema` : void 0;
+  return { consumer, consumerWhy };
+}
+var sourceWord = (s) => s === "given" ? "given input" : s;
+async function judgeTransform(v, node, transform, type, consumer, consumerWhy, languages, sample, inputs, perItem, options) {
+  const adapter = languages.get(transform.lang);
+  if (adapter === void 0) {
+    v.why = `language "${transform.lang}" is not in the registry`;
+    v.sample = sample;
+    return;
+  }
+  if (inputs.length === 0) {
+    v.why = `the sample holds no item to run "${node.id}"'s transform on (arity 0)`;
+    v.sample = sample;
+    return;
+  }
+  const settings = effectiveSettings(node, type);
+  let results;
+  try {
+    let compile;
+    try {
+      const mod = await import(adapter.worker);
+      if (typeof mod.default === "function") compile = mod.default;
+    } catch (e) {
+      if (options.workerHalf?.[transform.lang] === void 0) throw e;
+    }
+    compile ??= options.workerHalf?.[transform.lang];
+    if (typeof compile !== "function") throw new Error(`the worker half of language "${transform.lang}" has no default export, and none was handed in`);
+    const c = compile(transform.expr);
+    results = [];
+    for (const input of inputs) results.push(await c.evaluate(input, settings));
+  } catch (e) {
+    v.kind = "transform-fails";
+    v.why = `the transform threw on the ${sourceWord(sample.source)}: ${e instanceof Error ? e.message : String(e)}`;
+    v.sample = { ...sample, result: e instanceof Error ? e.message : String(e) };
+    return;
+  }
+  sample.result = perItem ? results : results[0];
+  v.sample = sample;
+  if (consumer === void 0) {
+    v.why = consumerWhy + " \u2014 the transform ran and nothing holds its result";
+    return;
+  }
+  const bad = results.map((r, i) => [i, findings(consumer, r)]).find(([, f]) => f.length > 0);
+  if (bad) {
+    v.kind = "transform-fails";
+    v.why = `the transform's result on the ${sourceWord(sample.source)}${perItem ? ` (item ${bad[0]})` : ""} fails the consumer's inputSchema \u2014 ${describeFindings(bad[1])}`;
+  } else {
+    v.kind = "transform-passes";
+    v.why = `the sample passed \u2014 the ${sourceWord(sample.source)}${sample.arity !== void 0 ? ` at arity ${sample.arity}` : ""}, ${inputs.length} evaluation${inputs.length === 1 ? "" : "s"}, every result accepted by the consumer's inputSchema`;
+  }
+}
+async function givenVerdict(registry, flow, nodeId, input, options = {}) {
+  if (input === void 0) return (await checkWiring(registry, flow, options)).verdicts.filter((v2) => v2.consumer === nodeId);
+  const node = flow.nodes.find((n) => n.id === nodeId);
+  if (node === void 0 || node.kind !== "task") return [];
+  const workers = workersOf(registry.workers);
+  const type = nodeTypesOf(registry.nodeTypes).get(node.type);
+  const { consumer, consumerWhy } = consumerOf(node, type, workers);
+  const v = { consumer: node.id, shape: "given", kind: "unchecked", why: "" };
+  const sample = { source: "given", value: input };
+  if (node.transform === void 0) {
+    v.why = `"${node.id}" has no transform to run the given input through, so nothing is evaluated \u2014 holding one value to the inputSchema is \`findings\`'s question${consumerWhy !== void 0 ? `; and ${consumerWhy}` : ""}`;
+    v.sample = sample;
+    return [v];
+  }
+  await judgeTransform(v, node, node.transform, type, consumer, consumerWhy, languagesOf(registry.languages), sample, [input], false, options);
+  return [v];
+}
 function describeVerdict(v) {
-  const road = v.shape === "edge" ? `${v.producer} -> ${v.consumer}` : v.shape === "branch" ? `${v.producer} -> (${v.through}) -> ${v.consumer}` : v.shape === "item" ? `${v.producer} -> (${v.through}, one item) -> ${v.consumer}` : v.shape === "record" ? `${v.producer} (the record) -> ${v.consumer}` : `${v.producer} -> needs -> ${v.consumer}`;
-  const s = v.sample ? ` [on the ${v.sample.source}${v.sample.arity !== void 0 ? `, arity ${v.sample.arity}` : ""}]` : "";
+  const road = v.shape === "given" ? `(given) -> ${v.consumer}` : v.shape === "edge" ? `${v.producer} -> ${v.consumer}` : v.shape === "branch" ? `${v.producer} -> (${v.through}) -> ${v.consumer}` : v.shape === "item" ? `${v.producer} -> (${v.through}, one item) -> ${v.consumer}` : v.shape === "record" ? `${v.producer} (the record) -> ${v.consumer}` : `${v.producer} -> needs -> ${v.consumer}`;
+  const s = v.sample ? ` [on the ${sourceWord(v.sample.source)}${v.sample.arity !== void 0 ? `, arity ${v.sample.arity}` : ""}]` : "";
   return `${v.kind.padEnd(16)} ${road}: ${v.why}${s}`;
 }
 var VERDICT_KINDS = ["fits", "no", "transform-passes", "transform-fails", "unchecked"];
-var WIRING_SHAPES = ["edge", "branch", "item", "record", "needs"];
+var WIRING_SHAPES = ["edge", "branch", "item", "record", "needs", "given"];
 
 // src/driver/ids.ts
 var SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
@@ -2132,9 +2639,10 @@ function lastRecordFor(log, taskId) {
   }
   return void 0;
 }
-function isSuspended(log, taskId) {
+function isSuspended(log, taskId, asked = false) {
   const last = lastRecordFor(log, taskId);
-  return last?.kind === "outcome" && last.terminalState === "user_action";
+  if (last === void 0) return asked;
+  return last.kind === "outcome" && last.terminalState === "user_action";
 }
 function effectiveOutcome(log, taskId) {
   let settlement = null;
@@ -2144,7 +2652,22 @@ function effectiveOutcome(log, taskId) {
     if (r.kind === "outcome") settlement = r;
     else resolution = r;
   }
-  if (!settlement) return null;
+  if (!settlement) {
+    if (!resolution) return null;
+    return {
+      kind: "outcome",
+      taskId,
+      terminalState: resolution.resolvedAs,
+      result: resolution.result,
+      error: resolution.error,
+      attempts: 0,
+      schedulerTimestamp: null,
+      observedAt: resolution.observedAt,
+      startTime: null,
+      endTime: null,
+      executionTime: null
+    };
+  }
   if (!resolution) return settlement.terminalState === "user_action" ? null : settlement;
   return {
     ...settlement,
@@ -2165,16 +2688,15 @@ var UncloneableResult = class extends Error {
     this.name = "UncloneableResult";
   }
 };
-var TERMINAL = /* @__PURE__ */ new Set(["done", "failed", "user_action"]);
+var TERMINAL = /* @__PURE__ */ new Set(["done", "failed", "user_action", "cancelled"]);
+var SETTLEMENT = /* @__PURE__ */ new Set(["task.completed", "task.failed", "task.user_action", "task.cancelled"]);
 var num = (x) => typeof x === "number" ? x : null;
 function normalizeEvent(eventName, detail, now) {
-  if (eventName === "task.running" || eventName === "task.progress") return null;
+  if (eventName === "task.running" || eventName === "task.progress" || eventName === "task.cancelling") return null;
   const state = detail?.state;
   if (typeof state !== "string" || !TERMINAL.has(state)) return null;
   if (eventName === "task.failed" && state === "user_action") return null;
-  if (eventName !== "task.completed" && eventName !== "task.failed" && eventName !== "task.user_action") {
-    return null;
-  }
+  if (!SETTLEMENT.has(eventName)) return null;
   const terminalState = state;
   let result = null;
   if (terminalState === "done") {
@@ -2205,55 +2727,18 @@ function normalizeEvent(eventName, detail, now) {
 // src/driver/routing.ts
 var NoMatchingEdge = class extends Error {
 };
-function evalLeaf(ctx, p) {
-  let v = readKeyPath(ctx, p.path);
-  if (v === void 0 && !("default" in p)) return false;
-  if ((v === void 0 || v === null) && "default" in p) v = p.default;
-  if (p.length === true) {
-    if (Array.isArray(v)) v = v.length;
-    else if (typeof v === "string") v = v.length;
-    else return false;
-  }
-  const w = p.value;
-  switch (p.op) {
-    // **Type-STRICT, and it is a departure measured rather than assumed.** Under JS comparison
-    // `{confidence: "0.4"} < 0.5` is true and every `typeof`-guarded predicate in this tree is false;
-    // measured over 1800 contexts, a type-strict form reproduces those three EXACTLY and differs from
-    // `resume.test.ts`'s unguarded `isHigh` on `{score: "9"}`, where the JS body coerces. That is
-    // `FD-V30`'s own argument — *a string `maxRetries` retries by coercion* — one rule over.
-    case "eq":
-      return v === w;
-    case "ne":
-      return v !== w;
-    case "lt":
-      return typeof v === "number" && typeof w === "number" && v < w;
-    case "lte":
-      return typeof v === "number" && typeof w === "number" && v <= w;
-    case "gt":
-      return typeof v === "number" && typeof w === "number" && v > w;
-    case "gte":
-      return typeof v === "number" && typeof w === "number" && v >= w;
-    case "startsWith":
-      return typeof v === "string" && typeof w === "string" && v.startsWith(w);
-    default: {
-      const never = p.op;
-      throw new NoMatchingEdge(`operator "${String(never)}" is not in the subset; FD-V44 should have caught this at instantiation`);
-    }
+var UNKNOWN_OP2 = (message) => new NoMatchingEdge(message);
+function evaluateWhen(when, ctx, predicates) {
+  if ("predicate" in when && typeof when.predicate === "string") {
+    const p = predicates.get(when.predicate);
+    if (!p) throw new NoMatchingEdge(`predicate "${when.predicate}" is not registered; FD-V4 should have caught this at instantiation`);
+    return p(ctx);
   }
-}
-function evaluateWhen(when, ctx, predicates) {
-  if ("predicate" in when && typeof when.predicate === "string") {
-    const p = predicates.get(when.predicate);
-    if (!p) throw new NoMatchingEdge(`predicate "${when.predicate}" is not registered; FD-V4 should have caught this at instantiation`);
-    return p(ctx);
-  }
-  if ("all" in when && Array.isArray(when.all)) return when.all.every((m) => evalLeaf(ctx, m));
-  if ("any" in when && Array.isArray(when.any)) return when.any.some((m) => evalLeaf(ctx, m));
-  return evalLeaf(ctx, when);
+  return evaluateDeclared(when, ctx, UNKNOWN_OP2);
 }
 var onOf = (e) => Array.isArray(e.on) && e.on.length ? e.on : ["done"];
 function eligibleEdges(node, terminalState) {
-  if (node.kind !== "task" && node.kind !== "join") return [];
+  if (node.kind !== "task" && node.kind !== "join" && node.kind !== "ask") return [];
   const edges = Array.isArray(node.edges) ? node.edges : [];
   return edges.filter((e) => onOf(e).includes(terminalState));
 }
@@ -2273,9 +2758,15 @@ function selectEdge(node, runId, terminalState, contextFor, predicates) {
   );
 }
 
+// src/driver/events.ts
+var TERMINAL_EVENTS = ["branch.arrived", "branch.exited", "branch.lost"];
+function isTerminalEvent(e) {
+  return TERMINAL_EVENTS.includes(e.type);
+}
+
 // src/driver/driver.ts
 import { FyflowTask } from "fyflow-scheduler";
-var InvalidDefinition = class extends Error {
+var InvalidDefinition = class _InvalidDefinition extends Error {
   /**
    * The rule ids, on the error rather than only in its text, so a caller can act
    * on them.
@@ -2291,6 +2782,25 @@ var InvalidDefinition = class extends Error {
     super(message);
     this.rules = rules;
   }
+  /**
+   * **A definition's findings as the error, built in ONE place** — P34 fact 12, W169. `new Driver` throws it for what
+   * `validateDefinition` found, and `createRuntime`'s `start` and `resume` throw it for what `runtime.check` found (ADR 0096
+   * rule 5), so the two roads cannot drift apart: `rules` is `violatedRules(findings)` — sorted, each once — and the
+   * message is `definition "<flowId>" is invalid: ` then every finding as `<rule> at <at>: <detail>`, `at` reading
+   * `<document>` where a finding has none, joined by `; `. *(Until W169 the two roads each built it inline, the same text
+   * twice.)* `at` is printed as given — a node id, an edge site (`id#edgeN`), or `<document>` for `null`.
+   *
+   * **Its precondition is at least one finding**, and an EMPTY list is refused with a `RangeError` (the conformity reader's
+   * C3): an `InvalidDefinition` naming no defect would read *"is invalid: "* and name nothing. Both callers throw only
+   * when they found something.
+   */
+  static fromFindings(flowId, findings2) {
+    if (findings2.length === 0) throw new RangeError(`InvalidDefinition.fromFindings: definition "${flowId}" has no finding \u2014 an invalid definition names at least one`);
+    return new _InvalidDefinition(
+      violatedRules(findings2),
+      `definition "${flowId}" is invalid: ` + findings2.map((f) => `${f.rule} at ${f.at ?? "<document>"}: ${f.detail}`).join("; ")
+    );
+  }
 };
 var DuplicateTaskId = class extends Error {
   constructor(message, options) {
@@ -2319,9 +2829,9 @@ var UndeclaredRoute = class extends Error {
 var BoundaryRefused = class extends Error {
   /** Which boundary refused: the run's payload at `start`, or a person's value at `resolve`. */
   boundary;
-  /** The task node whose worker's schema refused the value. */
+  /** The task node whose worker's schema refused the value — or, at `resolve`, the ASK whose `answerSchema` did (W180). */
   nodeId;
-  /** The suspended task, at `resolve`; `start` has dispatched nothing yet. */
+  /** The suspended task — or parked ask — at `resolve`; `start` has dispatched nothing yet. */
   taskId;
   /** Every way the value failed the schema — `findings`' own list, one line each in `message`. */
   findings;
@@ -2346,10 +2856,20 @@ var NotStarted = class extends Error {
     this.name = "NotStarted";
   }
 };
+var RunControlRefused = class extends Error {
+  control;
+  reason;
+  constructor(control, reason, message) {
+    super(message);
+    this.name = "RunControlRefused";
+    this.control = control;
+    this.reason = reason;
+  }
+};
 var CHECKPOINT_FORMAT = 1;
 var ResumeRefused = class extends Error {
   reason;
-  /** The position `stopped` and `diverged` name; `null` for the three a header decides. */
+  /** The position `halted`, `cancelled` and `diverged` name; `null` for the three a header decides. */
   index;
   constructor(reason, index, message) {
     super(message);
@@ -2396,12 +2916,29 @@ function resumeRefusal(definition, checkpoint, runId) {
       `ResumeRefused (flow): the checkpoint is of flow ${JSON.stringify(h.flowId)} version ${JSON.stringify(h.version)}, and this driver runs "${definition.flowId}" version ${definition.version}. There is no migration (P23 decision 7): a checkpoint resumes against the definition that produced it, and a changed flow is a new version.`
     );
   }
-  const at = cp.events.findIndex((e) => e?.kind === "stopped");
+  const at = cp.events.findIndex((e) => {
+    const k = e?.kind;
+    return k === "halted" || k === "stopped";
+  });
   if (at >= 0) {
+    const e = cp.events[at];
     return new ResumeRefused(
-      "stopped",
+      "halted",
       at,
-      `ResumeRefused (stopped): the stored run was STOPPED \u2014 its element at position ${at} is \`stopped\` (${JSON.stringify(cp.events[at]?.reason)}). A stopped run is not resumable (P23 decision 10): the refusal that stopped it would stop it again, and the one class whose cause never reached the log \u2014 a result OR-R6 refused \u2014 cannot be regenerated at all.`
+      `ResumeRefused (halted): the stored run was HALTED by a refusal \u2014 its element at position ${at} is \`${String(e.kind)}\`${e.kind === "stopped" ? " (the name 0.7.0 wrote for `halted`, ADR 0102)" : ""} (${JSON.stringify(e.reason)}). A halted run is not resumable (P23 decision 10): the refusal that halted it would halt it again, and the one class whose cause never reached the log \u2014 a result OR-R6 refused \u2014 cannot be regenerated at all.`
+    );
+  }
+  const c = cp.events.findIndex((e) => {
+    const x = e;
+    return x?.kind === "cancelRequested" || x?.kind === "outcome" && x.record?.terminalState === "cancelled";
+  });
+  if (c >= 0) {
+    const e = cp.events[c];
+    const what = e?.kind === "cancelRequested" ? `the request of ${JSON.stringify(e.actor)} to cancel it (\`cancelRequested\`)` : `the settlement of ${JSON.stringify(e?.record?.taskId)} as \`cancelled\``;
+    return new ResumeRefused(
+      "cancelled",
+      c,
+      `ResumeRefused (cancelled): the stored run was CANCELLED \u2014 its element at position ${c} is ${what}. A cancelled run is not resumable (ADR 0094 rule 5, ADR 0104): a cancel is its owner\`s act, and a resume would hand the scheduler again what the owner stopped.`
     );
   }
   return null;
@@ -2409,14 +2946,42 @@ function resumeRefusal(definition, checkpoint, runId) {
 function sameData(a, b) {
   if (Object.is(a, b)) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
-  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  const tag = Object.prototype.toString.call(a);
+  if (tag !== Object.prototype.toString.call(b)) return false;
+  if (Array.isArray(a)) {
+    const y = b;
+    return a.length === y.length && a.every((v, i) => sameData(v, y[i]));
+  }
+  if (a instanceof Map || a instanceof Set) {
+    const x = [...a.entries()], y = [...b.entries()];
+    return x.length === y.length && x.every((e, i) => sameData(e[0], y[i][0]) && sameData(e[1], y[i][1]));
+  }
+  if (a instanceof Date) return Object.is(a.getTime(), b.getTime());
+  if (a instanceof RegExp) return String(a) === String(b);
+  if (a instanceof Error) return a.name === b.name && a.message === b.message;
+  if (ArrayBuffer.isView(a) || a instanceof ArrayBuffer) {
+    const bytes = (v) => v instanceof ArrayBuffer ? new Uint8Array(v) : new Uint8Array(v.buffer, v.byteOffset, v.byteLength);
+    const x = bytes(a), y = bytes(b);
+    return x.length === y.length && x.every((v, i) => v === y[i]);
+  }
   const ra = a, rb = b;
   const ka = Object.keys(ra).filter((k) => ra[k] !== void 0);
   const kb = Object.keys(rb).filter((k) => rb[k] !== void 0);
   return ka.length === kb.length && ka.every((k) => Object.hasOwn(rb, k) && sameData(ra[k], rb[k]));
 }
 function isFed(e) {
-  return e.kind === "outcome" || e.kind === "resolution" || e.kind === "resumed";
+  return e.kind === "outcome" || e.kind === "resolution" || e.kind === "resumed" || e.kind === "interrupted" || e.kind === "paused" || e.kind === "unpaused" || e.kind === "attempted";
+}
+function frozenCopy(v) {
+  try {
+    return Object.freeze(cloneValue(v));
+  } catch {
+    return void 0;
+  }
+}
+function attemptNumberOf(detail) {
+  const n = detail?.attemptNumber;
+  return typeof n === "number" && Number.isInteger(n) && n >= 1 ? n : null;
 }
 function describeElement(e) {
   if (e === void 0) return "nothing";
@@ -2460,6 +3025,38 @@ function withIndex(base, mapId, index) {
   next.set(mapId, index);
   return next;
 }
+function itemMaps(def, regions) {
+  const kept = /* @__PURE__ */ new Map();
+  for (const n of def.nodes) {
+    const own3 = Object.values(n.needs ?? {});
+    const onEdges = (n.edges ?? []).flatMap((e) => Object.values(e.needs ?? {}));
+    if (![...own3, ...onEdges].some((r) => referenceTarget(r)?.form === "item")) continue;
+    const m = innermostMapOf(regions, n.id);
+    if (m !== void 0) kept.set(m.fanoutId, false);
+  }
+  const byId = new Map(def.nodes.map((n) => [n.id, n]));
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (id) => {
+    const n = byId.get(id);
+    if (n === void 0 || seen.has(id)) return;
+    seen.add(id);
+    if (n.kind === "map" && n.needs === void 0 && kept.has(id)) kept.set(id, true);
+    if (n.kind === "gate") for (const e of n.edges ?? []) walk(e.to);
+  };
+  walk(def.entry);
+  return kept;
+}
+function itemWithin(kept, regions) {
+  const out = /* @__PURE__ */ new Map();
+  for (const id of kept.keys()) {
+    const m = regions.find((r) => r.fanoutId === id);
+    const branch = m?.branches[0];
+    if (m === void 0 || branch === void 0) continue;
+    const depth = regionChainOf(regions, branch).length;
+    for (const r of regions) if (r !== m && m.members.has(r.fanoutId)) out.set(r.fanoutId, [...out.get(r.fanoutId) ?? [], { map: id, depth }]);
+  }
+  return out;
+}
 function describeRoute(v) {
   if (typeof v === "string") return JSON.stringify(v);
   return `${describeShape(v)} (${String(v)}) \u2014 not a route name`;
@@ -2476,7 +3073,7 @@ function cloneRecord(r) {
 }
 function freezeInput(i) {
   return Object.freeze(
-    i.kind === "outcome" || i.kind === "resolution" ? { ...i, record: Object.freeze(cloneRecord(i.record)) } : i.kind === "region" ? { ...i, event: Object.freeze({ ...i.event }) } : i.kind === "resumed" ? { ...i, taskIds: Object.freeze([...i.taskIds]) } : i.kind === "gated" && i.key !== void 0 ? { ...i, key: Object.freeze(cloneValue(i.key)) } : { ...i }
+    i.kind === "outcome" || i.kind === "resolution" ? { ...i, record: Object.freeze(cloneRecord(i.record)) } : i.kind === "region" ? { ...i, event: Object.freeze({ ...i.event }) } : i.kind === "resumed" ? { ...i, taskIds: Object.freeze([...i.taskIds]) } : i.kind === "gated" && i.key !== void 0 ? { ...i, key: Object.freeze(cloneValue(i.key)) } : i.kind === "asked" ? { ...i, input: Object.freeze(cloneValue(i.input)) } : { ...i }
   );
 }
 var MissingJoinPolicy = class extends Error {
@@ -2489,7 +3086,9 @@ function detailOf(e) {
   return "detail" in e ? e.detail : void 0;
 }
 var defaultCreateTask = (config) => new FyflowTask(config);
-var SETTLEMENT_EVENTS = ["task.completed", "task.failed", "task.user_action"];
+var SETTLEMENT_EVENTS = ["task.completed", "task.failed", "task.user_action", "task.cancelled"];
+var SUBSCRIBED_EVENTS = [...SETTLEMENT_EVENTS, "task.running"];
+var PASS_THROUGH = [["task.message", "onTaskMessage"], ["task.progress", "onTaskProgress"]];
 var Driver = class {
   /**
    * `OR-R7` — nothing outside the inbound API writes to run state. Private, and
@@ -2517,6 +3116,13 @@ var Driver = class {
   graph;
   regions;
   dispatched = /* @__PURE__ */ new Set();
+  /**
+   * **Every ASK this run has reached, by task id** — `RN-R37`, v0.22, W180, ADR 0109: the ids of the `asked` elements
+   * appended, so `RS-R1`'s widened *suspended* (an `asked` element and no record after it) is one lookup rather than a
+   * scan of the input sequence at every `resolve()`, and an ask's id is minted once per path (`ID-R1`'s guard). Ids only —
+   * the kept INPUT lives on the element alone. `dispatched`'s twin for the one node that is never dispatched.
+   */
+  asked = /* @__PURE__ */ new Set();
   now;
   opts;
   def;
@@ -2594,6 +3200,29 @@ var Driver = class {
    * quiescent point (`RN-R10`), not here — ADR 0046 rule 5.
    */
   arrivals = /* @__PURE__ */ new Map();
+  /**
+   * **What a map INSTANCE keeps for `"$item"`** — `RN-R13`'s sixth term since v0.28 (`spec/run-state.md`), P38 (e),
+   * [ADR 0118](../../doc/decisions/0118-a-map-instance-keeps-its-item-while-a-node-of-it-may-still-be-entered.md),
+   * [W191](../../doc/work-items/w191-the-map-instances-item-as-a-reference.md). Two halves, one field:
+   *
+   *   - **`kept`** — decided from the DOCUMENT at construction: the maps whose region holds a `"$item"` reader (a node, or
+   *     an edge of a node, whose innermost containing map is that map — `innermostMapOf`, P38 (c)), and for each whether
+   *     its received value may be the CALLER's own object (`true`: reached from the entry through gates alone, with no
+   *     `needs` — `start()` hands `enter` the value it was called with, as an entry task and an entry ask receive it). A
+   *     map no reader names keeps NOTHING, and a flow declaring no `"$item"` has `kept` empty (P38 decision 2).
+   *   - **`held`** — map id → the instance's branch path → its item. Written by the MAP ARM, where the instance opens —
+   *     by a run and by a resume's replay alike, so a replay REBUILDS it (`RN-R19`; P38's brief: *taken at rest*, never by
+   *     a caller's call) — **BY REFERENCE to the element the map received** (the driver's own: an edge-hop clone, or a
+   *     `needs` composition's per-key copy), and as its OWN copy only where `kept` says that element is the caller's
+   *     (P35 (f)'s reason for `asked.input`). Every READ clones (`JP-R11`), so no node receives the held object.
+   *     **Released when NOTHING of that instance may still be entered** — its own branch terminal (`branch.arrived`,
+   *     `branch.lost` or `branch.exited`, `JP-R5`: one per opened branch) AND no branch of a region NESTED in it still live
+   *     (`within`, `nested`, `ended` — `trackItems`): a nested join a policy fires before its last branch is terminal lets
+   *     the instance's branch arrive while that branch can still read (W191's conformity reader, C1). A suspended node (an
+   *     ask, a parked task) keeps its branch live, and so its item. And at the run-level moments
+   *     `arrivals` is cleared at — a halt, a cancel, a stop, a `cancelled` settlement — because no node is entered after.
+   */
+  items;
   /**
    * **The one run this driver serves** — ADR 0022 rule 1, fixed at construction
    * and never `null`.
@@ -2636,16 +3265,212 @@ var Driver = class {
    * elements a consumer does not already hold ({@link Driver.delivers}).
    */
   replay = null;
-  /** The run has been stopped by a refusal. Nothing dispatches for it again. */
+  /** The run has been HALTED by a refusal (`OR-R10`). Nothing dispatches for it again. */
   failed = false;
   /**
-   * **A resume refused because its replay regenerated a STOP in the lost tail** — `RN-R23`: that driver keeps the
-   * stopped run (its `header`, so a store may take its checkpoint) and still hears NOTHING. `onEvent`'s other test,
+   * **A task of this run settled `cancelled`, so the run is HALTED** — `RN-R28`,
+   * [ADR 0094](../../doc/decisions/0094-a-cancelled-task-is-a-terminal-state-that-routes-no-edge-and-ends-its-run-cancelled.md)
+   * rule 3, W158. Every door `failed` shuts, this shuts — nothing is dispatched or routed for the run again,
+   * a later settlement is appended and routed nowhere, and `resolve()` is refused — and it differs from `failed`
+   * in three things only: no `halted` element is appended (the fold reads the run `cancelled` from the
+   * settlement itself), `onRunFailure` is not called (a cancel is its owner's act, not a defect), and
+   * `hasFailed()` stays false. **Separate rather than `failed` with a reason**, because those three are each
+   * a reader of `failed` that must not fire.
+   */
+  cancelled = false;
+  /**
+   * **A resume refused because its replay regenerated a HALT in the lost tail** — `RN-R23`: that driver keeps the
+   * halted run (its `header`, so a store may take its checkpoint) and still hears NOTHING. `onEvent`'s other test,
    * *started with no header*, cannot see it, because this refusal is the one that keeps its header: until W151 such a
    * driver built by hand appended and delivered a later settlement and reported an unminted id (W151's conformity
-   * reader, finding 6). A driver stopped by `failRun` on a run it started is NOT deaf: `OR-R10` stops routing only.
+   * reader, finding 6). A driver halted by `failRun` on a run it started is NOT deaf: `OR-R10` halts routing only.
+   *
+   * **And a STOPPED driver, since W174** (`RN-R33`, P34 decision 3): a stop sets it with its hold — before the
+   * `interrupted` element, and so BEFORE it sends the first cancel — so no `task.cancelled` of the stop — nor any later settlement — is appended,
+   * routed, delivered or reported, and the log ends with the in-flight set dispatched and unsettled for a resume to
+   * re-dispatch. A replay feeding a stored `interrupted` element does NOT set it: the replay hears nothing anyway.
    */
   deaf = false;
+  /**
+   * **The run's OWNER cancelled it** — `RN-R31`, v0.18, W173,
+   * [ADR 0104](../../doc/decisions/0104-a-run-its-owner-cancels-is-cancelling-until-its-last-task-has-stopped.md). `null`
+   * until `cancel()` is accepted; then what every LATER cancel of a task sends the scheduler — the caller's `reason` and
+   * `graceMs`, each only if given — and, per task id, the promise the scheduler's `cancel` returned for it, which is what
+   * `cancel()`'s own promise waits on. **A halt** (`shut()`), set BEFORE the `cancelRequested` element is appended, so a
+   * consumer's callback on that element already sees the run held. It holds no result: one promise per task STILL
+   * stopping — each dropped as it settles, so none once the run is `cancelled` — and the two option values.
+   */
+  cancelRequest = null;
+  /**
+   * **The run's OWNER stopped it, to resume it elsewhere** — `RN-R33`, v0.19, W174,
+   * [ADR 0105](../../doc/decisions/0105-a-run-its-owner-stops-goes-deaf-before-it-cancels-and-resumes-elsewhere.md). `null`
+   * until `stop()` is accepted; then, as `cancelRequest`'s shape, what every cancel the stop sends carries and one promise
+   * per task STILL stopping, each dropped as it settles — and the `actor`, which the element is appended with.
+   *
+   * **`pending` while the stop has been ACCEPTED and not yet TAKEN**: a stop called MID-STEP — from a callback on the
+   * driver's own step — takes effect when that step ends (`stepping` back to `0`), so the step's routing is all in the log
+   * and none of it is lost to a resume (`RN-R33`, W174). While pending it is the resolver of the promise every call made
+   * before then waits on, `resolve()` and `cancel()` are already refused, and the hold is NOT yet shut; `null` once the
+   * stop is taken, from which moment it IS a halt (`shut()`). `took` is the promise a second call made while pending
+   * waits on. A function and a promise held only until the step ends — `null` both once taken, never at rest.
+   *
+   * **And a REPLAY sets it too**, taken, with no options and nothing stopping, where it feeds a stored `interrupted`
+   * element (`RN-R19`): the stored run was held from that position, so the replay holds there as well, until a fed
+   * `resumed` — or the resume itself, once the replay is over — sets it back to `null`. The stop's deafness is `deaf`'s.
+   */
+  stopRequest = null;
+  /**
+   * **Tasks whose `dispatched` element is appended and which the scheduler has NOT been handed yet** — `RN-R29` (i)'s
+   * window, ADR 0103's inherited hazard, W173. A scheduler's `cancel()` of an id it does not hold resolves `false` and
+   * does nothing, so `cancel()` sends nothing for these: the hand-off site cancels each right AFTER its `addTask` —
+   * `dispatch` for the task in progress, `resume()` for its in-flight set. Empty at rest; at most the one task being
+   * dispatched, or a resume's in-flight set while it is handed back.
+   */
+  unhanded = /* @__PURE__ */ new Set();
+  /**
+   * **How deep the driver is in its OWN step** — `start`, `resume`, `resolve` or a scheduler event, each counting itself
+   * in (`RN-R31`, W173's conformity reader, D-1). `0` at rest. A consumer callback the driver calls mid-step sees a
+   * PREFIX that can read finished while the step is about to dispatch more (`RN-R12`'s quiescent point, P34 fact 3), so
+   * `cancel()` refuses `ended` only at rest: mid-step, *nothing in flight and nothing parked* is not *finished*.
+   */
+  stepping = 0;
+  /**
+   * **The run's OWNER has paused it, and the pause is TAKEN** — `RN-R35`, v0.20, W175,
+   * [ADR 0106](../../doc/decisions/0106-a-run-its-owner-pauses-routes-on-and-holds-every-dispatch-until-unpaused.md):
+   * set when a `paused` element is appended (by `pause()`, or fed to a replay) and cleared when an `unpaused` one is —
+   * so it is always what `RunState.paused` folds to on the driver's own sequence. **Not a halt**: it does not join
+   * `shut()`, because a paused run still routes and still accepts a resolution (ADR 0103's consequence). It is the
+   * dispatch hold's DEFERRED form, at the dispatch door (ADR 0103 rule 6): each dispatch is appended, and held.
+   */
+  paused = false;
+  /**
+   * **Every dispatch the pause HELD, in dispatch order** (`RN-R35`): appended — so the fold reads each `running`, in flight
+   * under `RN-R21` (P34 fact 3) — and NOT handed to the scheduler. An `unpause` hands each on, first held first; a
+   * `cancel` hands each on and cancels it (ADR 0104 rule 7); a `stop` sends nothing for them, so they stay in flight in
+   * the log for a resume to hold again. Empty unless the run is paused — or an unpause's hand-off is under way, while
+   * which a dispatch joins the END of it, so the order holds; or a halt broke that hand-off off, after which nothing is
+   * handed on for the run and what is left here never is. One `createTask` configuration per held task, no result.
+   */
+  pauseHeld = /* @__PURE__ */ new Map();
+  /**
+   * **Pause and unpause calls ACCEPTED mid-step and not yet TAKEN**, in call order (`RN-R35`): a call from a callback on
+   * the driver's own step is taken when that step ends (`stepping` back to `0`, `leaveStep()`), as a stop is (`RN-R33`) —
+   * so its element lands BETWEEN two steps, where a replay can feed it (`RN-R19`). Empty at rest.
+   * **And, since W180, a RESOLUTION given mid-step** — an ask's answer or a parked task's (`RN-R37`, ADR 0109 rule 5, P35's
+   * brief: *an owner element a resume's replay feeds is TAKEN AT REST*): accepted at the call — every refusal already asked — and its resolution
+   * appended when the step ends, in the same call order as the pauses beside it.
+   */
+  pausePending = [];
+  /**
+   * **The highest attempt number RECORDED for each task, by task id** — `RN-R40`, v0.26, W186, P36 (f) and (g): the
+   * number the last `attempted` element for it carried — appended, or fed by a replay. What decides that a `task.running`
+   * repeating a number (a requeue) appends nothing, and what a resume re-hands an in-flight task with as `attemptsSpent`.
+   * One integer per task that ever started an attempt, no result; kept for the life of the run, as `dispatched`'s ids are.
+   */
+  lastAttempt = /* @__PURE__ */ new Map();
+  /**
+   * **`attempted` elements HEARD and not yet appended**, in the order heard (`RN-R40`): a `task.running` arrives on the
+   * driver's OWN step when an inline pool starts the task inside `addTask`, and an element appended there would sit between
+   * two elements of one step — where the replay, which regenerates a step whole, would refuse the checkpoint `diverged`. So
+   * every one is appended when the step ends, BEFORE a pause, an unpause, an answer or a stop pending on that step is taken
+   * (`leaveStep()`): the attempt started before any of them. Empty at rest.
+   */
+  attemptsPending = [];
+  /**
+   * **The dispatch hold is SHUT: a halt is on the run, and the driver dispatches and routes nothing further for it** —
+   * `RN-R29`,
+   * [ADR 0103](../../doc/decisions/0103-every-halt-shares-one-dispatch-hold.md), P34
+   * decisions 5 and 8, W172. **The ONE predicate every halt shares**, read at these doors and no others — `RN-R29`
+   * states the two things it does not hold: before each of `resume()`'s re-dispatches (the maintainer's answer to
+   * W172's S-1), at the head of `enter` (door (a) of [Q605](../../doc/questions/q605.md) — a fan-out's or a map's remaining
+   * branches), at the head of `dispatch`, after a resolution's append and again before its routing (door (b)),
+   * after a settlement's append (`settle`), after a join's `joinSettled` append (`settleJoin`), and at `resolve()`'s
+   * entry. A halt P34 adds — a cancel or a stop — joins this disjunction, and every door follows.
+   *
+   * **A METHOD over the halt flags, never a field of its own**: a second copy of *the run is halted* is a field that
+   * can disagree with `failed` or `cancelled`, and each of those has readers this predicate must not stand in for
+   * (`hasFailed()`, `onRunFailure`). **The replay's hold is the OTHER form and is not this** — it appends a dispatch
+   * and defers handing it on (`RN-R19`), where a shut hold appends nothing; `dispatch` keeps both.
+   *
+   * **A REQUESTED cancel joins it since W173** (`RN-R31`, ADR 0104) — ADR 0103's *a halt P34 adds joins this
+   * disjunction*: from the moment `cancel()` is accepted, every door above holds for the run. **And a STOP since W174**
+   * (`RN-R33`, ADR 0105): from the moment the stop is TAKEN — at once when `stop()` is called at rest, and when the step
+   * ends when it is called mid-step (`stopRequest.pending`) — and, in a replay, from a fed `interrupted` element on.
+   */
+  shut() {
+    return this.failed || this.cancelled || this.cancelRequest !== null || this.stopRequest !== null && this.stopRequest.pending === null;
+  }
+  /**
+   * **What holds a resume's re-dispatch: the hold, EXCEPT a requested cancel** (ADR 0103 rule 7, ADR 0104 rule 7) — read
+   * through `shut()` and never as a second copy of its disjunction (ADR 0103 rule 1; W173's conformity reader, F7), so a
+   * halt W174 adds to `shut()` holds here too. **W174's stop never reaches this loop taken** (`RN-R33`): a stop is taken
+   * at rest, and a stop called on this stack — on the `resumed` element, or in the replay's lost tail — is PENDING until
+   * `resume()` returns, so each task is handed on here and the stop then cancels it; and the replay's own fed stop is
+   * cleared before the loop. A request is the one halt that hands a task on: its tasks are `dispatched` and unsettled,
+   * and only the scheduler can settle them, so each is handed on and cancelled (`handOn`).
+   */
+  holdsResume() {
+    return this.shut() && this.cancelRequest === null;
+  }
+  /**
+   * **The driver's own step ends** — each of `start`, `resume`, `resolve` and a scheduler event counts itself out here.
+   * At rest again, a stop called on that step is TAKEN (`RN-R33`, W174): the step's routing is whole in the log, and
+   * every task it handed on is in flight for the stop to cancel. **And a pause or an unpause called on it** (`RN-R35`,
+   * W175), each in call order and BEFORE the stop — a pause or an unpause after a stop is refused, so any pending one was
+   * called first. Each take is a step of its own and ends here too, so the next pending call is taken after it.
+   * **And a resolution given on the step** (`RN-R37`, W180), in the same queue and the same call order.
+   * **And FIRST, every `attempted` element heard on the step** (`RN-R40`, W186): the attempts started before anything
+   * taken here, and a stop taken before them would leave them unrecorded — the driver deaf — under P36 (h)'s *a stopped
+   * attempt counts*.
+   */
+  leaveStep() {
+    this.stepping -= 1;
+    if (this.stepping === 0 && this.attemptsPending.length > 0) this.takeAttempts();
+    while (this.stepping === 0 && this.pausePending.length > 0) this.takePending(this.pausePending.shift());
+    if (this.stepping === 0 && this.stopRequest !== null && this.stopRequest.pending !== null) this.takeStop();
+  }
+  /**
+   * **Every `attempted` element heard and not yet appended, appended — AT REST, as ONE step of their own** (`RN-R40`,
+   * W186): in the order heard, each BETWEEN two of the driver's steps, where a replay feeds it (`RN-R19`). A step, so a
+   * call a consumer makes from a callback on one — a pause, a stop — is taken after the last of them. **Appended on a
+   * halted run too**, as a settlement is: the scheduler started the attempt whatever the run's routing does. A consumer's
+   * `onFoldInput` THROWING on one HALTS the run, reported once (`OR-R10` v0.19, W184), and the throw reaches whoever is on
+   * the stack — a driver call's caller, or the listener boundary of a scheduler event's step; the elements still pending
+   * behind it are appended by this step's own end, SILENTLY (the run is halted, its failure reported), and so is a throw
+   * on any of them once the run is halted.
+   */
+  takeAttempts() {
+    this.stepping += 1;
+    try {
+      while (this.attemptsPending.length > 0) {
+        const a = this.attemptsPending.shift();
+        const silent = this.failed;
+        try {
+          this.append({ kind: "attempted", taskId: a.taskId, attemptNumber: a.attemptNumber });
+        } catch (e) {
+          if (silent) continue;
+          this.haltOnce(e);
+          throw e;
+        }
+      }
+    } finally {
+      this.leaveStep();
+    }
+  }
+  /**
+   * **The ONE rule for a throw that reaches a driver call's boundary once the call is ACCEPTED** — `OR-R10` v0.19, P35 (k),
+   * P36 (b) and (c), W184: reported ONCE through `onRunFailure` under its own class, and the run HALTED — its `halted`
+   * element appended after the element thrown on — unless the run is already halted, whose halt was reported when it was
+   * raised. `start()`'s treatment since W3, brought to every call: `resolve`, `resume` and `cancel` at their own element,
+   * and EVERY take — a stop's, a pause's, an unpause's, an answer's — at its own element, at rest or at a step's end, so
+   * the FIRST throw halts and a call still pending behind it is dropped by its own halted guard (the readers' C1). The
+   * caller rethrows: the consumer's error reaches it.
+   * A refusal the call raises BEFORE it is accepted — `RunControlRefused`, `BoundaryRefused`, `ResumeRefused`,
+   * `MultipleRuns`, a `DataCloneError` — never reaches this: nothing was appended, and a rejected command halts nothing.
+   */
+  haltOnce(e) {
+    if (!this.failed) this.failRun(e);
+  }
   /** The registry's node types, normalised once (W59; entries the document or the class form since W65). Read at dispatch for the type's retry default and its settings defaults. */
   nodeTypes;
   /** The registry's languages, normalised once (W61). Read at construction only; the driver evaluates nothing. */
@@ -2654,6 +3479,11 @@ var Driver = class {
   workers;
   /** The gate types — the built-ins and the registry's — normalised once (W93). Read where a branch enters a gate, and at `start()` for an ENTRY gate's `FD-R4` target. */
   gateTypes;
+  /**
+   * **Each gate's RESOLVED route set, by gate id** — ADR 0092 rule 3: `routesOf` asked once per gate at
+   * construction, after validation passed, and read by every decision. Never the type's members.
+   */
+  gateRoutes;
   /**
    * **Each gate's MEMORY: one per gate per RUN, the driver's, and never written down** — `RN-R26`,
    * [ADR 0067](../../doc/decisions/0067-a-gate-runs-in-the-driver-its-memory-is-the-drivers-and-its-decision-is-recorded.md),
@@ -2726,25 +3556,35 @@ var Driver = class {
       ...opts.gateTypes !== void 0 ? { gateTypes: opts.gateTypes } : {}
     };
     const findings2 = validateDefinition(definition, registry);
-    if (findings2.length) {
-      throw new InvalidDefinition(
-        violatedRules(findings2),
-        `definition "${definition.flowId}" is invalid: ` + findings2.map((f) => `${f.rule} at ${f.at ?? "<document>"}: ${f.detail}`).join("; ")
-      );
+    if (findings2.length) throw InvalidDefinition.fromFindings(definition.flowId, findings2);
+    const gateRoutes = /* @__PURE__ */ new Map();
+    for (const n of definition.nodes) {
+      if (n.kind !== "gate") continue;
+      const resolved = routesOf(this.gateTypes.get(n.type), n.settings ?? {});
+      if ("problem" in resolved) {
+        throw new InvalidDefinition(["FD-V39"], `gate "${n.id}"'s type "${n.type}" resolved no route set at construction, after validation accepted one \u2014 FD-V39: ${resolved.problem}`);
+      }
+      gateRoutes.set(n.id, resolved);
     }
+    this.gateRoutes = gateRoutes;
     this.def = definition;
     this.opts = opts;
     this.now = opts.now ?? (() => Date.now());
     this.graph = buildGraph(definition);
     this.regions = allRegions(this.graph, definition);
+    const kept = itemMaps(definition, this.regions);
+    this.items = { kept, within: itemWithin(kept, this.regions), held: /* @__PURE__ */ new Map(), nested: /* @__PURE__ */ new Map(), ended: /* @__PURE__ */ new Set() };
     if (this.regions.length > 0 && !opts.joinPolicy) {
       throw new MissingJoinPolicy(
         `definition "${definition.flowId}" has ${this.regions.length} fan-out region(s) and no joinPolicy. Without one every branch would arrive and the join would never fire, which is indistinguishable from the case P1 exists to measure.`
       );
     }
-    for (const name of SETTLEMENT_EVENTS) {
+    for (const name of SUBSCRIBED_EVENTS) {
       opts.scheduler.addEventListener(name, (e) => this.onEvent(name, detailOf(e)));
     }
+    for (const [name, callback] of PASS_THROUGH) {
+      if (opts[callback] !== void 0) opts.scheduler.addEventListener(name, (e) => this.onEvent(name, detailOf(e)));
+    }
   }
   /**
    * Dispatch the entry node for the run this driver was constructed for.
@@ -2771,6 +3611,15 @@ var Driver = class {
    * substitution rather than dropping it.
    */
   start(payload) {
+    this.stepping += 1;
+    try {
+      this.startStep(payload);
+    } finally {
+      this.leaveStep();
+    }
+  }
+  /** `start`'s body — wrapped so the driver knows it is on the stack of its own step (`stepping`, `RN-R31`, W173 D-1). */
+  startStep(payload) {
     const runId = this.runId;
     if (this.started) {
       throw new MultipleRuns(
@@ -2781,11 +3630,12 @@ var Driver = class {
       for (const { node, value } of boundaryTargets(this.def, payload, (g, v) => this.boundaryEdges(g, v))) {
         const n = this.graph.byId.get(node);
         if (!n || n.kind !== "task") continue;
+        if (n.transform !== void 0) continue;
         const type = this.nodeTypes.get(n.type);
         const worker = type?.worker === void 0 ? void 0 : this.workers.get(type.worker);
         const schema = worker?.inputSchema;
         if (schema === void 0) continue;
-        const received = this.compose(n, value, /* @__PURE__ */ new Map());
+        const received = this.compose(n, value, EMPTY_INDICES, payload, () => value);
         const fs = findings(schema, received);
         if (fs.length) {
           throw new BoundaryRefused(
@@ -2799,12 +3649,23 @@ var Driver = class {
       }
     }
     const entryPayload = structuredClone(payload);
-    this.header = { format: CHECKPOINT_FORMAT, runId, flowId: this.def.flowId, version: this.def.version, entryPayload };
+    const header = { format: CHECKPOINT_FORMAT, runId, flowId: this.def.flowId, version: this.def.version, entryPayload };
+    const onHeader = this.opts.onHeader;
+    if (onHeader !== void 0) {
+      this.started = true;
+      try {
+        onHeader(Object.freeze({ ...header, entryPayload: structuredClone(entryPayload) }));
+      } catch (e) {
+        this.started = false;
+        throw e;
+      }
+    }
+    this.header = header;
     this.started = true;
     try {
       this.enter(runId, this.def.entry, payload);
     } catch (e) {
-      this.failRun(e);
+      this.haltOnce(e);
       throw e;
     }
   }
@@ -2819,28 +3680,43 @@ var Driver = class {
    * **In order, and each step is a rule:**
    *   1. **Refuse what the header says** (`RN-R23`) — {@link resumeRefusal}.
    *   2. **REPLAY** (`RN-R19`): enter the entry node with a copy of `header.entryPayload` exactly as
-   *      `start()` enters it, then FEED every stored settlement, resolution and `resumed` element at its
-   *      own position through the routing the listener and `resolve()` use — every dispatch HELD. Every
+   *      `start()` enters it, then FEED every stored settlement, resolution and `resumed` element — and, since
+   *      v0.19 and v0.20, every `interrupted`, `paused` and `unpaused` one, and since v0.26 every `attempted` one — at its own position through the routing the listener and `resolve()` use — every dispatch HELD. Every
    *      other element the replay REGENERATES.
    *   3. **The PREFIX check** (`RN-R20`): each regenerated element at a position the stored events cover
    *      must be the stored one; the first that is not is refused as `diverged`, naming its position, and
    *      so is a replay that ends short. A replay that runs PAST the stored events is the stored run's
    *      lost tail — a checkpoint taken inside `onFoldInput` ends mid-step (ADR 0064) — and it is
    *      DELIVERED, because the consumer does not hold it (`RN-R24`).
-   *   4. **A run the replay STOPS is refused** as `stopped` (P23 decision 10), its tail delivered first.
+   *   4. **A run the replay HALTS is refused** as `halted` (P23 decision 10), its tail delivered first.
    *   5. **Append `resumed`** naming the IN-FLIGHT set — dispatched and never settled, in dispatch order
-   *      (`RN-R21`, `RN-R22`) — and then hand each to the scheduler at the SAME task id.
+   *      (`RN-R21`, `RN-R22`) — and then hand each to the scheduler at the SAME task id, with `attemptsSpent` the highest
+   *      attempt recorded for it where one was (v0.26, W186); or, where the replay
+   *      ends PAUSED (a fed `paused`, no `unpaused` after it), HOLD each again for an unpause (`RN-R35`).
    *
    * **At-least-once, and that is the contract rather than a defect** (P23 decision 6): a task named in
-   * `resumed` may have finished in the process that is gone, and runs again here with a FRESH retry
-   * budget ([Q365](../../doc/questions/q365.md) — measured: a budget of two attempts ran three times
-   * across one kill). A task parked at `user_action` has SETTLED and is not in flight: it stays parked,
+   * `resumed` may have finished in the process that is gone, and runs again here. **Not at a fresh retry budget since
+   * W186** (`RN-R21` v0.26, ADR 0113): it is handed on with `attemptsSpent`, the highest attempt the stored run recorded
+   * for it — the attempt in flight at the kill or the stop counted as spent — so a spent budget runs ONCE more and no more.
+   * *Until W186 it ran at a FRESH budget ([Q365](../../doc/questions/q365.md) — measured: a budget of two attempts ran
+   * three times across one kill).* A task parked at `user_action` has SETTLED and is not in flight: it stays parked,
    * and `resolve()` works on it.
    *
    * @throws MultipleRuns — the driver has already started or resumed a run.
    * @throws ResumeRefused — see {@link ResumeRefusalReason}; the driver is then spent.
+   * @throws the consumer's own error — a callback that threw on the `resumed` element, or on an element the resume's step
+   *   appended after it: the run is HALTED and reported once, and nothing further is handed on (P36 (c), W184).
    */
   resume(checkpoint) {
+    this.stepping += 1;
+    try {
+      this.resumeStep(checkpoint);
+    } finally {
+      this.leaveStep();
+    }
+  }
+  /** `resume`'s body — wrapped so the driver knows it is on the stack of its own step (`stepping`, `RN-R31`, W173 D-1). */
+  resumeStep(checkpoint) {
     if (this.started) {
       throw new MultipleRuns(
         `this driver already started or resumed run "${this.runId}", and resume() is the other door into the SAME run. ID-R3: a Driver serves exactly one run, entered once \u2014 construct a fresh Driver for the checkpoint (runtime.resume does).`
@@ -2869,30 +3745,49 @@ var Driver = class {
     this.replay = null;
     if (this.failed) {
       this.deaf = true;
-      const at = this.inputs.findIndex((e) => e.kind === "stopped");
+      const at = this.inputs.findIndex((e) => e.kind === "halted");
       throw new ResumeRefused(
-        "stopped",
+        "halted",
         at,
-        `ResumeRefused (stopped): replaying run "${this.runId}" regenerated its STOP at position ${at} \u2014 past the ${stored.length} stored element(s), in the tail the store had lost: ${describeElement(this.inputs[at])}. A stopped run is not resumable (P23 decision 10); the tail, \`stopped\` included, has been delivered to onFoldInput so a store can hold it.`
+        `ResumeRefused (halted): replaying run "${this.runId}" regenerated its HALT at position ${at} \u2014 past the ${stored.length} stored element(s), in the tail the store had lost: ${describeElement(this.inputs[at])}. A halted run is not resumable (P23 decision 10); the tail, \`halted\` included, has been delivered to onFoldInput so a store can hold it.`
       );
     }
+    if (this.stopRequest !== null && this.stopRequest.pending === null) this.stopRequest = null;
     const inFlight = this.inFlight();
-    this.append({ kind: "resumed", taskIds: inFlight });
-    try {
+    const holding = this.paused;
+    for (const id of inFlight) {
+      const config = replay.held.get(id);
+      const spent = this.lastAttempt.get(id) ?? 0;
+      if (config !== void 0 && spent > 0) replay.held.set(id, { ...config, attemptsSpent: spent });
+    }
+    if (holding) {
       for (const id of inFlight) {
         const config = replay.held.get(id);
         if (config === void 0) throw new Error(`resume: in-flight task "${id}" has no held dispatch \u2014 this is a defect in the driver`);
-        this.opts.scheduler.addTask((this.opts.createTask ?? defaultCreateTask)(config));
+        this.pauseHeld.set(id, config);
+      }
+    } else {
+      for (const id of inFlight) this.unhanded.add(id);
+    }
+    try {
+      this.append({ kind: "resumed", taskIds: inFlight });
+      for (const id of holding ? [] : inFlight) {
+        if (this.holdsResume()) break;
+        const config = replay.held.get(id);
+        if (config === void 0) throw new Error(`resume: in-flight task "${id}" has no held dispatch \u2014 this is a defect in the driver`);
+        this.handOn(id, config);
       }
     } catch (e) {
-      this.failRun(e);
+      this.haltOnce(e);
       throw e;
+    } finally {
+      this.unhanded.clear();
     }
   }
   /**
    * **The replay** — `RN-R19` and `RN-R20`. Every fed element goes through {@link Driver.feed}, which
-   * turns a refusal routing raises into a `stopped` element exactly as the listener's boundary does
-   * (`OR-R10`), so the replay regenerates a stop where the stored run had one.
+   * turns a refusal routing raises into a `halted` element exactly as the listener's boundary does
+   * (`OR-R10`), so the replay regenerates a halt where the stored run had one.
    */
   replayStored(stored) {
     const replay = this.replay;
@@ -2906,16 +3801,35 @@ var Driver = class {
     }
     if (this.inputs.length < stored.length) throw this.diverged(this.inputs.length, "the replay ended before it");
   }
-  /** One fed element — a settlement, a resolution, or an earlier resume — at stored position `i`. */
+  /** One fed element — a settlement, a resolution, an earlier resume, a stop, a pause, an unpause or an attempt — at stored position `i`. */
   feedOne(e, i) {
     if (e.kind === "resumed") {
       const now = this.inFlight();
       if (!Array.isArray(e.taskIds) || e.taskIds.length !== now.length || e.taskIds.some((t, k) => t !== now[k])) {
         throw this.diverged(i, `in flight in the replay here: ${JSON.stringify(now)}`);
       }
+      this.stopRequest = null;
       this.append({ kind: "resumed", taskIds: [...e.taskIds] });
       return;
     }
+    if (e.kind === "interrupted") {
+      this.feedInterrupted(e);
+      return;
+    }
+    if (e.kind === "paused" || e.kind === "unpaused") {
+      this.paused = e.kind === "paused";
+      this.append({ kind: e.kind, actor: e.actor });
+      return;
+    }
+    if (e.kind === "attempted") {
+      const n = e.attemptNumber;
+      if (typeof e.taskId !== "string" || !this.dispatched.has(e.taskId)) throw this.diverged(i, "the replay never dispatched that task");
+      if (typeof n !== "number" || !Number.isInteger(n) || n < 1) throw this.diverged(i, "its attemptNumber is not a positive integer");
+      if (n <= (this.lastAttempt.get(e.taskId) ?? 0)) throw this.diverged(i, "its attemptNumber does not exceed the one stored before it for that task");
+      this.lastAttempt.set(e.taskId, n);
+      this.append({ kind: "attempted", taskId: e.taskId, attemptNumber: n });
+      return;
+    }
     if (e.kind !== "outcome" && e.kind !== "resolution") return;
     const record = e.record;
     let parts;
@@ -2932,7 +3846,7 @@ var Driver = class {
       this.settle(cloneRecord(record), runId, nodeId, branchPath);
       return;
     }
-    if (!isSuspended(this.log, record.taskId)) throw this.diverged(i, "that task is not parked in the replay");
+    if (!this.parked(record.taskId)) throw this.diverged(i, "that task is not parked in the replay");
     this.appendResolution(cloneRecord(record), nodeId, branchPath);
     this.advance(runId, nodeId, branchPath);
   }
@@ -2979,14 +3893,43 @@ var Driver = class {
    * second resolution is refused like any other. A rejected command, not a run
    * failure: it came from outside and a caller can retry.
    *
+   * **And an ASK's answer** — `RS-R1` v0.18, `RN-R37`, ADR 0109: an ask the run reached and nobody has answered is
+   * suspended too, so the person's answer is this call — `'done'` with the answer as `result`, held to the ask's
+   * `answerSchema` (`FD-R4`), or `'failed'` with an `error`, the person DECLINING, held to nothing. The answer IS the
+   * node's result and routes as a task's settlement does.
+   *
    * @returns `false` when refused. Nothing is appended and the run is unaffected.
    */
   resolve(taskId, resolvedAs, value) {
-    if (!isSuspended(this.log, taskId)) return false;
+    const midStep = this.stepping > 0;
+    this.stepping += 1;
+    try {
+      return this.resolveStep(taskId, resolvedAs, value, midStep);
+    } finally {
+      this.leaveStep();
+    }
+  }
+  /** `resolve`'s body — wrapped so the driver knows it is on the stack of its own step (`stepping`, `RN-R31`, W173 D-1). */
+  resolveStep(taskId, resolvedAs, value, midStep = false) {
+    if (!this.parked(taskId)) return false;
+    if (this.pausePending.some((c) => c.kind === "answer" && c.record.taskId === taskId)) return false;
     const { runId, nodeId, branchPath } = parseTaskId(taskId);
-    if (this.failed) return false;
+    if (this.shut() || this.stopRequest !== null) return false;
     if (resolvedAs === "done" && this.opts.validateBoundaries !== false) {
       const n = this.graph.byId.get(nodeId);
+      if (n?.kind === "ask") {
+        const schema2 = n.answerSchema;
+        const fs = schema2 === void 0 ? [] : findings(schema2, value.result ?? null);
+        if (fs.length) {
+          throw new BoundaryRefused(
+            "resolve",
+            nodeId,
+            taskId,
+            fs,
+            `the answer to "${taskId}" (ask "${nodeId}") does not satisfy the ask's answerSchema \u2014 ${describeFindings(fs)}. FD-R4: a person\`s answer to an ask is held to the schema the ask declares; nothing was appended and the ask is still parked, so answer it again with a conforming value. \`validateBoundaries: false\` turns the check off.`
+          );
+        }
+      }
       const type = n?.kind === "task" ? this.nodeTypes.get(n.type) : void 0;
       const schema = type?.worker === void 0 ? void 0 : this.workers.get(type.worker)?.outputSchema;
       if (schema !== void 0) {
@@ -3002,7 +3945,7 @@ var Driver = class {
         }
       }
     }
-    this.appendResolution({
+    const record = {
       kind: "resolution",
       taskId,
       resolvedAs,
@@ -3010,11 +3953,22 @@ var Driver = class {
       error: resolvedAs === "failed" ? value.error ?? "resolved as failed" : null,
       actor: value.actor,
       observedAt: this.now()
-    }, nodeId, branchPath);
+    };
+    if (midStep) {
+      this.pausePending.push({ kind: "answer", record, runId, nodeId, branchPath });
+      return true;
+    }
+    try {
+      this.appendResolution(record, nodeId, branchPath);
+    } catch (e) {
+      this.haltOnce(e);
+      throw e;
+    }
+    if (this.shut()) return true;
     try {
       this.advance(runId, nodeId, branchPath);
     } catch (e) {
-      this.failRun(e);
+      this.haltOnce(e);
       throw e;
     }
     return true;
@@ -3027,6 +3981,7 @@ var Driver = class {
    */
   appendResolution(record, nodeId, branchPath) {
     this.append({ kind: "resolution", record });
+    if (this.shut()) return;
     const region = this.regionOf(nodeId);
     if (region) {
       this.emit({
@@ -3039,16 +3994,556 @@ var Driver = class {
       });
     }
   }
+  /**
+   * **Cancel the run: hold it, record the request, and ask the scheduler to cancel each task in flight** — `RN-R31`,
+   * `spec/run-state.md` section 13, [ADR 0104](../../doc/decisions/0104-a-run-its-owner-cancels-is-cancelling-until-its-last-task-has-stopped.md),
+   * P34 decision 4 and stop-and-asks (b), (c), (i), (j). **Resolves once every task it cancelled has stopped**; the fold
+   * reads the run `cancelling` until then and `cancelled` after (`RN-R30`), so a runtime's `done` settles after the last
+   * `task.cancelled` from the fold alone.
+   *
+   * **In order, and each step is a rule:**
+   *   1. **Refuse** — {@link RunControlRefused}, before anything is recorded or sent; and a `graceMs` the scheduler
+   *      would throw on is thrown here, as it would be (`TypeError`, `RangeError`).
+   *   2. **Hold** (`RN-R29`): `cancelRequest` is set, so `shut()` is true for every door; every region's collection is
+   *      released, `failRun`'s run-level moment (ADR 0046 rule 3, `JP-R12`) — no join of this run settles again.
+   *   3. **Record** ONE `cancelRequested` element, BEFORE the scheduler is asked for anything.
+   *   4. **Cancel** each task in flight the scheduler holds — `RN-R21`'s set, so a PARKED task, settled already, is sent
+   *      nothing (P34 (i); the scheduler cannot end it, fact 8). A task not yet handed on is cancelled by `handOn` after
+   *      its hand-off (`RN-R29` (i)), and so is each task a PAUSE held (`RN-R35`, P34 (c)). Tasks a worker SPAWNED are
+   *      not this run's (P34 (j)). **In a `finally` around step 3** (`RN-R31` v0.21, P35 decision 4): a consumer's
+   *      `onFoldInput` that throws on the element still has every cancel sent and every held task handed on and
+   *      cancelled — and THEN the run is HALTED and reported once, and the throw reaches the caller (`RN-R31` v0.24,
+   *      `OR-R10` v0.19, P36 (b), W184).
+   *
+   * **A SECOND call** appends nothing and forwards its `graceMs` to each task still stopping — the scheduler's own
+   * escalation — and resolves once those have stopped. It is never refused for the halt its own first call made.
+   *
+   * @throws RunControlRefused — `unsupported`, `not-started`, `halted`, `cancelled` or `ended`; nothing recorded or sent.
+   * @throws TypeError / RangeError — `graceMs` not a number, or negative or `NaN`; nothing recorded or sent.
+   */
+  cancel(options) {
+    const cancelOf = this.opts.scheduler.cancel;
+    if (typeof cancelOf !== "function") {
+      throw new RunControlRefused(
+        "cancel",
+        "unsupported",
+        `RunControlRefused (unsupported): run "${this.runId}"'s scheduler has no cancel(taskId, options) \u2014 SchedulerLike's optional third member (P34 (b), ADR 0104). A FyflowScheduler has one, and a runtime\`s per-run view forwards it; a scheduler double must declare it to cancel a run. Nothing was recorded and nothing was sent.`
+      );
+    }
+    const graceMs = options?.graceMs;
+    if (graceMs !== void 0) {
+      if (typeof graceMs !== "number") throw new TypeError(`cancel: graceMs must be a number of ms, got ${typeof graceMs} \u2014 nothing was recorded`);
+      if (Number.isNaN(graceMs) || graceMs < 0) throw new RangeError(`cancel: graceMs must be 0 or more, got ${graceMs} \u2014 nothing was recorded`);
+    }
+    if (this.header === null) {
+      throw new RunControlRefused(
+        "cancel",
+        "not-started",
+        `RunControlRefused (not-started): driver for run "${this.runId}" holds no run to cancel \u2014 it has not started, or its resume was refused and it is spent (RN-R23). Nothing was recorded and nothing was sent.`
+      );
+    }
+    const req = this.cancelRequest;
+    if (req !== null) {
+      if (graceMs !== void 0) req.graceMs = graceMs;
+      for (const id of this.inFlight()) if (this.handedOn(id)) this.cancelTask(id);
+      const stopping2 = req.stopping;
+      return Promise.resolve().then(() => Promise.all([...stopping2.values()])).then(() => void 0);
+    }
+    if (this.failed) {
+      throw new RunControlRefused(
+        "cancel",
+        "halted",
+        `RunControlRefused (halted): run "${this.runId}" was HALTED by a refusal (OR-R10) \u2014 it routes nothing again, and its outcome is halted. Nothing was recorded and nothing was sent.`
+      );
+    }
+    if (this.cancelled) {
+      throw new RunControlRefused(
+        "cancel",
+        "cancelled",
+        `RunControlRefused (cancelled): run "${this.runId}" was already ended CANCELLED by a task the scheduler cancelled on its own (RN-R28). Cancel a task it still runs by its id. Nothing was recorded and nothing was sent.`
+      );
+    }
+    if (this.stopRequest !== null) {
+      throw new RunControlRefused(
+        "cancel",
+        "interrupted",
+        `RunControlRefused (interrupted): run "${this.runId}" was STOPPED by its owner (RN-R33) \u2014 this driver is deaf to it, and its in-flight tasks are a resume\`s to run again. Resume its checkpoint on another runtime and cancel it there. Nothing was recorded and nothing was sent.`
+      );
+    }
+    const inFlight = this.inFlight();
+    if (this.stepping === 0 && inFlight.length === 0 && !this.hasParked()) {
+      throw new RunControlRefused(
+        "cancel",
+        "ended",
+        `RunControlRefused (ended): run "${this.runId}" has nothing in flight and nothing parked on a person \u2014 it has finished, and a cancel would rewrite its outcome. Nothing was recorded and nothing was sent.`
+      );
+    }
+    const reason = options.reason;
+    const stopping = /* @__PURE__ */ new Map();
+    this.cancelRequest = {
+      ...reason !== void 0 ? { reason } : {},
+      ...graceMs !== void 0 ? { graceMs } : {},
+      stopping
+    };
+    this.arrivals.clear();
+    this.releaseAllItems();
+    const released = new Map(this.pauseHeld);
+    this.pauseHeld.clear();
+    for (const id of released.keys()) this.unhanded.add(id);
+    try {
+      try {
+        this.append({ kind: "cancelRequested", actor: options.actor, reason: reason ?? null });
+      } finally {
+        try {
+          for (const id of this.inFlight()) {
+            const config = released.get(id);
+            if (config !== void 0) this.handOn(id, config);
+            else if (this.handedOn(id)) this.cancelTask(id);
+          }
+        } finally {
+          for (const id of released.keys()) this.unhanded.delete(id);
+        }
+      }
+    } catch (e) {
+      this.haltOnce(e);
+      throw e;
+    }
+    return Promise.resolve().then(() => Promise.all([...stopping.values()])).then(() => void 0);
+  }
+  /**
+   * **Stop the run so that a resume ELSEWHERE can continue it: hold it, record the stop, go DEAF, and only then ask the
+   * scheduler to cancel each task in flight** — `RN-R33`, `spec/run-state.md` section 14,
+   * [ADR 0105](../../doc/decisions/0105-a-run-its-owner-stops-goes-deaf-before-it-cancels-and-resumes-elsewhere.md), P34
+   * decisions 3 and 9 and stop-and-ask (d). **Resolves once every task it cancelled has stopped**; the fold reads the run
+   * `interrupted` from the element on (`RN-R32`), and the log ends with the cancelled tasks dispatched and UNSETTLED —
+   * the in-flight set a resume on another runtime re-dispatches at the same ids (`RN-R21`).
+   *
+   * **In order, and the ORDER is the rule** (P34 decision 3):
+   *   1. **Refuse** — {@link RunControlRefused} with `control: 'stop'`, before anything is recorded or sent: `unsupported`,
+   *      `not-started`, `halted`, `cancelled` (`RN-R28`'s, or a cancel its owner requested — P34 (c)) and `ended` (at
+   *      rest only, as for a cancel); and a `graceMs` the scheduler would throw on is thrown here. From the accepted call
+   *      on, `resolve()` and `cancel()` are refused (P34 decision 9, (c)).
+   *   2. **Hold** (`RN-R29`): the stop is TAKEN, so `shut()` is true for every door, and every region's collection is
+   *      released.
+   *   3. **Go DEAF**: nothing the scheduler fires for this run is heard again — from BEFORE the element, so not even a
+   *      settlement a callback on it provokes — and no `task.cancelled` of the stop is appended.
+   *   4. **Record** ONE `interrupted` element.
+   *   5. **Cancel** each task in flight the scheduler holds — none for a parked task (P34 fact 4), and none for a task a
+   *      PAUSE held, which the scheduler was never handed and which stays in flight for the resume (`RN-R35`).
+   *
+   * **Steps 2-5 are taken at REST** — at once when the call is made at rest, and when the driver's own step ends when it
+   * is made from a callback on that step (`stepping`). A hold taken mid-step would drop the rest of the step's routing
+   * — a fan-out's later branches, a settlement's successor — and a resume re-dispatches only what is IN FLIGHT, so that
+   * work would be lost to the resumed run for good. Taken at rest, the step is whole in the log; the task whose own
+   * `dispatched` element carried the call is handed on in the step and cancelled here (`RN-R29` (i)), and so is a resumed
+   * run's in-flight set, handed back before `resume()` returns.
+   *
+   * **A SECOND call** appends nothing, forwards its `graceMs` to each task still stopping, and resolves as the first does.
+   *
+   * @throws RunControlRefused — `unsupported`, `not-started`, `halted`, `cancelled` or `ended`; nothing recorded or sent.
+   * @throws TypeError / RangeError — `graceMs` not a number, or negative or `NaN`; nothing recorded or sent.
+   */
+  stop(options) {
+    if (typeof this.opts.scheduler.cancel !== "function") {
+      throw new RunControlRefused(
+        "stop",
+        "unsupported",
+        `RunControlRefused (unsupported): run "${this.runId}"'s scheduler has no cancel(taskId, options) \u2014 SchedulerLike's optional third member (P34 (b), ADR 0105). A stop cancels each task in flight, so a scheduler double must declare it to stop a run. Nothing was recorded and nothing was sent.`
+      );
+    }
+    const graceMs = options?.graceMs;
+    if (graceMs !== void 0) {
+      if (typeof graceMs !== "number") throw new TypeError(`stop: graceMs must be a number of ms, got ${typeof graceMs} \u2014 nothing was recorded`);
+      if (Number.isNaN(graceMs) || graceMs < 0) throw new RangeError(`stop: graceMs must be 0 or more, got ${graceMs} \u2014 nothing was recorded`);
+    }
+    if (this.header === null) {
+      throw new RunControlRefused(
+        "stop",
+        "not-started",
+        `RunControlRefused (not-started): driver for run "${this.runId}" holds no run to stop \u2014 it has not started, or its resume was refused and it is spent (RN-R23). Nothing was recorded and nothing was sent.`
+      );
+    }
+    const req = this.stopRequest;
+    if (req !== null) {
+      if (graceMs !== void 0) req.graceMs = graceMs;
+      if (req.pending === null) {
+        for (const id of this.inFlight()) if (this.handedOn(id) && req.stopping.has(id)) this.cancelTask(id);
+        return this.stopSettled(req);
+      }
+      return req.took.then(() => this.stopSettled(req));
+    }
+    if (this.failed) {
+      throw new RunControlRefused(
+        "stop",
+        "halted",
+        `RunControlRefused (halted): run "${this.runId}" was HALTED by a refusal (OR-R10) \u2014 a halted run is not resumable (RN-R23), so there is nothing to stop for a resume elsewhere. Nothing was recorded and nothing was sent.`
+      );
+    }
+    if (this.cancelled || this.cancelRequest !== null) {
+      throw new RunControlRefused(
+        "stop",
+        "cancelled",
+        `RunControlRefused (cancelled): run "${this.runId}" was CANCELLED${this.cancelRequest !== null ? " by its owner (RN-R31)" : " by a task the scheduler cancelled on its own (RN-R28)"} \u2014 a cancelled run is not resumable, so it cannot be stopped to resume it elsewhere (P34 (c)). Nothing was recorded and nothing was sent.`
+      );
+    }
+    if (this.stepping === 0 && this.inFlight().length === 0 && !this.hasParked()) {
+      throw new RunControlRefused(
+        "stop",
+        "ended",
+        `RunControlRefused (ended): run "${this.runId}" has nothing in flight and nothing parked on a person \u2014 it has finished, and there is nothing to resume elsewhere. Nothing was recorded and nothing was sent.`
+      );
+    }
+    const reason = options.reason;
+    let taken;
+    const took = new Promise((r) => {
+      taken = r;
+    });
+    const accepted = {
+      actor: options.actor,
+      ...reason !== void 0 ? { reason } : {},
+      ...graceMs !== void 0 ? { graceMs } : {},
+      stopping: /* @__PURE__ */ new Map(),
+      pending: taken,
+      took
+    };
+    this.stopRequest = accepted;
+    if (this.stepping === 0) this.takeStop();
+    return took.then(() => this.stopSettled(accepted));
+  }
+  /**
+   * **The stop, TAKEN** — `RN-R33` steps 2-5, at rest: from `stop()` itself, or from the end of the driver's own step
+   * when `stop()` was called on it (each step's wrapper calls this when `stepping` returns to `0`).
+   */
+  takeStop() {
+    const req = this.stopRequest;
+    const taken = req.pending;
+    req.pending = null;
+    req.took = null;
+    this.arrivals.clear();
+    this.releaseAllItems();
+    this.deaf = true;
+    const inFlight = this.inFlight().filter((id) => this.handedOn(id));
+    const silent = this.failed;
+    try {
+      try {
+        this.append({ kind: "interrupted", actor: req.actor, reason: req.reason ?? null });
+      } finally {
+        try {
+          for (const id of inFlight) this.cancelTask(id);
+        } finally {
+          taken();
+        }
+      }
+    } catch (e) {
+      if (silent) return;
+      this.haltOnce(e);
+      throw e;
+    }
+  }
+  /** What a stop's promise resolves on once it is taken: a microtask on, every task it sent a cancel to has stopped. */
+  stopSettled(req) {
+    return Promise.resolve().then(() => Promise.all([...req.stopping.values()])).then(() => void 0);
+  }
+  /**
+   * **Pause the run: it routes on, and every dispatch it makes from here is appended and HELD until `unpause()`** —
+   * `RN-R35`, `spec/run-state.md` section 15,
+   * [ADR 0106](../../doc/decisions/0106-a-run-its-owner-pauses-routes-on-and-holds-every-dispatch-until-unpaused.md),
+   * P34 stop-and-ask (e). Tasks already handed to the scheduler run on and settle, and their settlements route as ever; a
+   * person's `resolve()` is accepted. **Not a halt** (`shut()` is untouched): only the scheduler's `addTask` waits. The
+   * fold reads `RunState.paused` and no new outcome — a held task is `dispatched`, so it reads `running` (P34 fact 3).
+   *
+   * **In order**: (1) **refused by name** before anything is recorded — {@link RunControlRefused} with `control: 'pause'`:
+   * `not-started`, `halted`, `cancelled` (`RN-R28`'s or a requested cancel), `interrupted` (a stop, taken or pending),
+   * `paused` (already paused, or a pause called earlier in this step still to be taken — P34 (e): *a second pause is
+   * refused by name*) and `ended` (nothing in flight and nothing parked, at rest only); (2) **TAKEN AT REST** — at once
+   * when called at rest, and when the driver's own step ends when called from a callback on it: the run is paused and ONE
+   * `paused` element is appended, BETWEEN two steps, where a resume's replay can feed it (`RN-R19`). A pause taken
+   * mid-step would land between two elements of one step, and the replay — which regenerates a step whole — would refuse
+   * its checkpoint `diverged` there; so the step a pause is called on finishes unpaused, its dispatches handed on.
+   */
+  pause(options) {
+    this.refuseRunHeld("pause");
+    if (this.pauseWanted()) {
+      throw new RunControlRefused(
+        "pause",
+        "paused",
+        `RunControlRefused (paused): run "${this.runId}" is already paused${this.pausePending.some((c) => c.kind !== "answer") ? " \u2014 by a call earlier in this step, taken when it ends" : ""} (RN-R35, P34 (e)). Unpause it first. Nothing was recorded.`
+      );
+    }
+    if (this.stepping === 0 && this.inFlight().length === 0 && !this.hasParked()) {
+      throw new RunControlRefused(
+        "pause",
+        "ended",
+        `RunControlRefused (ended): run "${this.runId}" has nothing in flight and nothing parked on a person \u2014 it has finished, and there is nothing left to hold. Nothing was recorded.`
+      );
+    }
+    this.pausePending.push({ kind: "paused", actor: options.actor });
+    while (this.stepping === 0 && this.pausePending.length > 0) this.takePending(this.pausePending.shift());
+  }
+  /**
+   * **Unpause the run: record it, then hand every held task to the scheduler in DISPATCH ORDER** — `RN-R35`, ADR 0106,
+   * P34 (e). Refused by name — `control: 'unpause'`: `not-started`, `halted`, `cancelled`, `interrupted` (a stopped
+   * run's held tasks are a resume's: unpause it where it resumes) and `not-paused`. **Never `ended`**: an unpause rewrites
+   * no outcome, so a paused run that finished may still be unpaused. Taken at rest, as a pause is: ONE `unpaused` element,
+   * then the hand-off — each held task's `createTask` and `addTask`, first held first.
+   */
+  unpause(options) {
+    this.refuseRunHeld("unpause");
+    if (!this.pauseWanted()) {
+      throw new RunControlRefused(
+        "unpause",
+        "not-paused",
+        `RunControlRefused (not-paused): run "${this.runId}" is not paused${this.pausePending.some((c) => c.kind !== "answer") ? " \u2014 an unpause earlier in this step already lifts it" : ""} (RN-R35, P34 (e)). Nothing was recorded and nothing was handed on.`
+      );
+    }
+    this.pausePending.push({ kind: "unpaused", actor: options.actor });
+    while (this.stepping === 0 && this.pausePending.length > 0) this.takePending(this.pausePending.shift());
+  }
+  /** The pause the owner has ASKED for: the last call still to be taken, else the pause taken (`RN-R35`). */
+  pauseWanted() {
+    const last = this.pausePending.filter((c) => c.kind !== "answer").at(-1);
+    return last !== void 0 ? last.kind === "paused" : this.paused;
+  }
+  /**
+   * The refusals a pause and an unpause share, in `RN-R35`'s order — each a run that is not this driver's to hold or
+   * release: none started, or the run halted, cancelled or stopped. Thrown before anything is recorded.
+   */
+  refuseRunHeld(control) {
+    if (this.header === null) {
+      throw new RunControlRefused(
+        control,
+        "not-started",
+        `RunControlRefused (not-started): driver for run "${this.runId}" holds no run to ${control} \u2014 it has not started, or its resume was refused and it is spent (RN-R23). Nothing was recorded.`
+      );
+    }
+    if (this.failed) {
+      throw new RunControlRefused(
+        control,
+        "halted",
+        `RunControlRefused (halted): run "${this.runId}" was HALTED by a refusal (OR-R10) \u2014 it dispatches nothing again, so there is nothing to ${control === "pause" ? "hold" : "hand on"}. Nothing was recorded.`
+      );
+    }
+    if (this.cancelled || this.cancelRequest !== null) {
+      throw new RunControlRefused(
+        control,
+        "cancelled",
+        `RunControlRefused (cancelled): run "${this.runId}" was CANCELLED${this.cancelRequest !== null ? " by its owner (RN-R31)" : " by a task the scheduler cancelled on its own (RN-R28)"} \u2014 it dispatches nothing again, so there is nothing to ${control === "pause" ? "hold" : "hand on"}. Nothing was recorded.`
+      );
+    }
+    if (this.stopRequest !== null) {
+      throw new RunControlRefused(
+        control,
+        "interrupted",
+        `RunControlRefused (interrupted): run "${this.runId}" was STOPPED by its owner (RN-R33) \u2014 its in-flight tasks, held ones included, are a resume\`s to run. Resume its checkpoint on another runtime and ${control} it there. Nothing was recorded.`
+      );
+    }
+  }
+  /**
+   * **A pause or an unpause, TAKEN** — `RN-R35`, at rest: from the call itself, or from the end of the driver's own step
+   * (`leaveStep()`). **A step of its own** (`stepping`), so a call a consumer makes from a callback on the element — a
+   * second pause, a stop, a `resolve()` that dispatches — is taken, or routes, as on any step. **A pause** sets the flag
+   * BEFORE its element, so a dispatch a callback on the element causes is held. **An unpause** clears it before its
+   * element and hands the held tasks on AFTER it, in a `finally`: a consumer's `onFoldInput` that throws on the element
+   * still has the element in the log, and the run it says is unpaused is (W174's conformity reader's finding 5, the stop's
+   * lesson) — and then the take HALTS the run itself, reported once (`takePause`, `RN-R35` v0.24, W184), so a call pending
+   * behind it is dropped, and the throw reaches whoever is on the stack: the caller of the call at rest or of the driver
+   * call mid-step, or, on a SCHEDULER EVENT's step, the listener boundary (`onEvent`, P35 (j)). A dispatch a callback on the element causes joins the end
+   * of the held queue (`dispatch`), so the order is the dispatch order still.
+   */
+  takePending(c) {
+    if (c.kind === "answer") this.takeAnswer(c);
+    else this.takePause(c);
+  }
+  /**
+   * **A resolution given mid-step, TAKEN at rest** — `RN-R37`, W180 (the conformity reader's R4; S-4 for every
+   * resolution): a step of its own, so the resolution lands BETWEEN two steps — where a resume's replay FEEDS it
+   * (`RN-R19`) — after the step that parked its node has completed (an ask's `asked` or a task's `user_action`
+   * settlement, and in a region `branch.suspended`). Answered on its own `asked` element and appended
+   * there instead, it sat between two elements of one step, and the replay — which regenerates a step whole — refused the
+   * run's checkpoint `diverged` at it. **Dropped, recording nothing, when the step it was given on HALTED or CANCELLED the
+   * run** (or the node is no longer parked) — `takePause`'s rule: it would be refused were it given now. It routes as
+   * `resolve()` at rest routes: a throw — from routing, or a consumer's on the resolution's own element — HALTS the run
+   * here, reported once, so a call pending behind it is dropped; it then reaches whoever is on the stack: a driver call's
+   * caller, or the listener boundary of a scheduler event's step (`onEvent`, `OR-R10` v0.19, W184).
+   */
+  takeAnswer(c) {
+    if (this.failed || this.cancelled || this.cancelRequest !== null || !this.parked(c.record.taskId)) return;
+    this.stepping += 1;
+    try {
+      try {
+        this.appendResolution(c.record, c.nodeId, c.branchPath);
+        if (this.shut()) return;
+        this.advance(c.runId, c.nodeId, c.branchPath);
+      } catch (e) {
+        this.haltOnce(e);
+        throw e;
+      }
+    } finally {
+      this.leaveStep();
+    }
+  }
+  takePause(p) {
+    if (this.failed || this.cancelled || this.cancelRequest !== null) return;
+    this.stepping += 1;
+    try {
+      try {
+        if (p.kind === "paused") {
+          this.paused = true;
+          this.append({ kind: "paused", actor: p.actor });
+        } else {
+          this.paused = false;
+          try {
+            this.append({ kind: "unpaused", actor: p.actor });
+          } finally {
+            this.drainHeld();
+          }
+        }
+      } catch (e) {
+        this.haltOnce(e);
+        throw e;
+      }
+    } finally {
+      this.leaveStep();
+    }
+  }
+  /**
+   * **The unpause's hand-off**: each held task to the scheduler, first held first (`RN-R35`). Taken out of the hold and
+   * marked `unhanded` before its `addTask`, as a resume's re-dispatch is (`RN-R31`), so a cancel raised inside one
+   * hand-off sends nothing for a task not yet handed — and `handOn` then cancels it. **Held for a HALT** — checked before
+   * each, as a resume's re-dispatch is (`RN-R29` (4), `holdsResume()`): a halt raised inside one hand-off hands nothing
+   * further on, and what is left is never handed. A dispatch made on this stack joins the end of the queue and is handed
+   * on in its turn (the `Map` visits what is added while it is walked). Caller-initiated, so a throw from the scheduler
+   * is reported AND rethrown, `start()`'s and `resume()`'s treatment.
+   */
+  drainHeld() {
+    try {
+      for (const [id, config] of this.pauseHeld) {
+        if (this.holdsResume()) break;
+        this.pauseHeld.delete(id);
+        this.unhanded.add(id);
+        this.handOn(id, config);
+      }
+    } catch (e) {
+      this.failRun(e);
+      throw e;
+    }
+  }
+  /**
+   * Whether the scheduler holds this task — dispatched, not held by a replay, past its `addTask` (`RN-R31`), and not held
+   * by a pause (`RN-R35`, W175): a stop of a paused run cancels only what this says the scheduler holds (ADR 0105's last
+   * consequence), and a cancel hands each held task on before it cancels it.
+   */
+  handedOn(taskId) {
+    return this.replay === null && !this.unhanded.has(taskId) && !this.pauseHeld.has(taskId);
+  }
   // --- the scheduler's side ----------------------------------------------------
   onEvent(name, detail) {
+    this.stepping += 1;
+    try {
+      this.onEventStep(name, detail);
+    } finally {
+      try {
+        this.leaveStep();
+      } catch (e) {
+        try {
+          if (!this.failed) this.failRun(e);
+        } catch {
+        }
+      }
+    }
+  }
+  /** `onEvent`'s body — wrapped so the driver knows it is on the stack of its own step (`stepping`, `RN-R31`, W173 D-1). */
+  onEventStep(name, detail) {
     if (this.deaf || this.started && this.header === null) return;
     try {
       this.onEventOrThrow(name, detail);
     } catch (e) {
-      this.failRun(e);
+      try {
+        this.haltOnce(e);
+      } catch {
+      }
+    }
+  }
+  /**
+   * **A `task.running`: an attempt started** — `RN-R40`, W186, P36 (f). Its id and number are COPIED here, while the
+   * listener runs (`OR-R1`). Recorded only for a task THIS run dispatched, and only when the number EXCEEDS the last one
+   * recorded for it — a requeue repeats its number and appends nothing (the scheduler's own recipe's `max`). **Everything
+   * else is dropped in SILENCE, and none of it is a refusal**: an id that does not parse (a plain task on a shared
+   * scheduler — its SETTLEMENT is what `onUnmintedTask` reports, `ID-R5`), another run's (`ID-R4` tier 1), one this run
+   * never dispatched (its settlement is `ID-R4` tier 2's `UndispatchedTask`), and a detail carrying no positive integer
+   * `attemptNumber` (a scheduler older than the pin, or a double). An attempt start never stops a run by existing. **Queued, not
+   * appended**: {@link Driver.takeAttempts} appends it when the step it was heard on ends — at once, on a scheduler
+   * event's own step; at the step's end when an inline pool fires it inside the driver's `addTask`.
+   */
+  heardRunning(detail) {
+    const taskId = detail?.id;
+    const attemptNumber = attemptNumberOf(detail);
+    if (typeof taskId !== "string" || attemptNumber === null) return;
+    let runId;
+    try {
+      runId = parseTaskId(taskId).runId;
+    } catch (e) {
+      if (e instanceof InvalidTaskId) return;
+      throw e;
     }
+    if (runId !== this.runId || !this.dispatched.has(taskId)) return;
+    if (attemptNumber <= (this.lastAttempt.get(taskId) ?? 0)) return;
+    this.lastAttempt.set(taskId, attemptNumber);
+    this.attemptsPending.push({ taskId, attemptNumber });
   }
-  /** Whether this run has been stopped by a refusal. */
+  /**
+   * **A `task.message` or a `task.progress`: PASSED THROUGH to its callback** — `RN-R42`, W187, P36 (k), ADR 0114. The
+   * task's id is the detail's `taskId` for a message — `task.message` carries no `id` (P36 fact 2) — and its `id` for a
+   * progress report, whose detail is the task spread flat. Handed on only for a task THIS run dispatched (`ID-R4`'s two
+   * tiers, asked SILENTLY, as {@link Driver.heardRunning} asks them): anything else is dropped and is not a refusal. Every
+   * field is COPIED here, while the listener runs (ADR 0007 rule 1, `OR-R1`), and the copy FROZEN (`OR-R7`); a value that
+   * cannot be cloned is handed on `undefined` — the scheduler's own treatment of an uncloneable `emit` (its §6) — so a
+   * pass-through never stops a run by existing. **The consumer's throw is NOT caught here**: it leaves through
+   * `onEventOrThrow` to the listener boundary, which reports it and halts the run (`onUnmintedTask`'s road, `OR-R10`).
+   */
+  heardPassThrough(name, detail) {
+    const isMessage = name === "task.message";
+    const taskId = isMessage ? detail?.taskId : detail?.id;
+    if (typeof taskId !== "string" || detail === void 0) return;
+    let parts;
+    try {
+      parts = parseTaskId(taskId);
+    } catch (e) {
+      if (e instanceof InvalidTaskId) return;
+      throw e;
+    }
+    if (parts.runId !== this.runId || !this.dispatched.has(taskId)) return;
+    const attribution = {
+      runId: parts.runId,
+      nodeId: parts.nodeId,
+      branchPath: parts.branchPath,
+      taskId,
+      flowAttempt: parts.attempt,
+      attemptNumber: attemptNumberOf(detail)
+    };
+    if (isMessage) {
+      const m = {
+        ...attribution,
+        name: detail.name,
+        data: frozenCopy(detail.data),
+        seq: detail.seq,
+        timestamp: detail.timestamp
+      };
+      if (detail.dropped !== void 0) m.dropped = detail.dropped;
+      if (detail.error !== void 0) m.error = detail.error;
+      this.opts.onTaskMessage?.(Object.freeze(m));
+      return;
+    }
+    const p = {
+      ...attribution,
+      progress: detail.progress,
+      message: frozenCopy(detail.message),
+      details: frozenCopy(detail.details),
+      timestamp: detail.timestamp
+    };
+    this.opts.onTaskProgress?.(Object.freeze(p));
+  }
+  /** Whether this run has been HALTED by a refusal (`OR-R10`; its outcome `halted`). */
   hasFailed() {
     return this.failed;
   }
@@ -3057,19 +4552,36 @@ var Driver = class {
     this.failed = true;
     const err = cause instanceof Error ? cause : new Error(String(cause));
     let seq = null;
+    const report = () => {
+      if (this.replay !== null && (seq === null || !this.delivers(seq))) return;
+      this.opts.onRunFailure?.({
+        runId: this.runId,
+        kind: err.constructor?.name ?? "Error",
+        message: err.message,
+        cause
+      });
+    };
     if (!already) {
-      seq = this.append({ kind: "stopped", reason: `${err.constructor?.name ?? "Error"}: ${err.message}` });
-      this.arrivals.clear();
+      try {
+        seq = this.append({ kind: "halted", reason: `${err.constructor?.name ?? "Error"}: ${err.message}` });
+      } finally {
+        this.arrivals.clear();
+        this.releaseAllItems();
+        report();
+      }
+      return;
     }
-    if (this.replay !== null && (seq === null || !this.delivers(seq))) return;
-    this.opts.onRunFailure?.({
-      runId: this.runId,
-      kind: err.constructor?.name ?? "Error",
-      message: err.message,
-      cause
-    });
+    report();
   }
   onEventOrThrow(name, detail) {
+    if (name === "task.running") {
+      this.heardRunning(detail);
+      return;
+    }
+    if (name === "task.message" || name === "task.progress") {
+      this.heardPassThrough(name, detail);
+      return;
+    }
     const taskId = detail?.id;
     let parts;
     try {
@@ -3102,7 +4614,13 @@ var Driver = class {
     const seq = this.append({ kind: "outcome", record });
     const report = this.opts.onNonconformingResult;
     if (report !== void 0 && this.delivers(seq)) this.reportResultSchema(record, nodeId, report);
-    if (this.failed) return;
+    if (this.shut()) return;
+    if (record.terminalState === "cancelled") {
+      this.cancelled = true;
+      this.arrivals.clear();
+      this.releaseAllItems();
+      return;
+    }
     if (record.terminalState === "user_action") {
       const region = this.regionOf(nodeId);
       if (region) {
@@ -3222,9 +4740,10 @@ var Driver = class {
    * through within this turn; only a `task` becomes a scheduler task.
    */
   enter(runId, nodeId, payload, fromBranch = "-", fromRegion, itemIndices = EMPTY_INDICES) {
+    if (this.shut()) return;
     const node = this.graph.byId.get(nodeId);
     if (!node) return;
-    const received = this.compose(node, payload, itemIndices);
+    const received = this.compose(node, payload, itemIndices, this.runPayload(), () => this.itemOf(node.id, itemIndices));
     switch (node.kind) {
       case "task":
         return this.dispatch(runId, node, received, itemIndices);
@@ -3297,6 +4816,12 @@ var Driver = class {
         if (branch === void 0) return;
         const idx = items.map((_v, i) => withIndex(itemIndices, nodeId, i));
         const paths = idx.map((m) => this.pathOf(branch, m));
+        const kept = this.items.kept.get(nodeId);
+        if (kept !== void 0 && items.length > 0) {
+          const byPath = this.items.held.get(nodeId) ?? /* @__PURE__ */ new Map();
+          this.items.held.set(nodeId, byPath);
+          items.forEach((v, i) => byPath.set(paths[i], kept ? cloneValue(v) : v));
+        }
         for (const p of paths) {
           this.emit({
             type: "branch.opened",
@@ -3372,14 +4897,14 @@ var Driver = class {
       case "gate": {
         const decided = this.decideGate(node, received, this.memoryOf(nodeId));
         if ("threw" in decided) throw decided.threw;
-        const type = decided.type;
+        const set = decided.set;
         if (!decided.declared) {
           throw new UndeclaredRoute(
-            `FD-R5 \u2014 run "${runId}" reached gate "${nodeId}" and its type "${node.type}" returned ${describeRoute(decided.route)}, which it does not declare; its routes are ${type.routes.map((r) => JSON.stringify(r)).join(", ")}. A route only running the type reveals cannot be refused at load (FD-V41 wires every DECLARED route), so the run stops here rather than routing nowhere. The type is the CODE registered under that name, not the document.`
+            `FD-R5 \u2014 run "${runId}" reached gate "${nodeId}" and its type "${node.type}" returned ${describeRoute(decided.route)}, which it does not declare; its routes are ${set.routes.map((r) => JSON.stringify(r)).join(", ")}. A route only running the type reveals cannot be refused at load (FD-V41 wires every DECLARED route), so the run halts here rather than routing nowhere. The type is the CODE registered under that name, not the document.`
           );
         }
         const route = decided.route;
-        const edge = gateEdge(node, type.defaultRoute, route);
+        const edge = gateEdge(node, set.defaultRoute, route);
         if (edge === null) {
           throw new InvalidDefinition(["FD-V41"], `gate "${nodeId}" has no edge for route ${JSON.stringify(route)} \u2014 FD-V41 should have refused this definition at construction`);
         }
@@ -3389,6 +4914,12 @@ var Driver = class {
         this.enter(runId, edge.to, received, fromBranch, fromRegion, itemIndices);
         return;
       }
+      // **An ASK PARKS, and nothing is handed to the scheduler** — `RN-R37`, v0.22,
+      // [ADR 0109](../../doc/decisions/0109-an-ask-parks-with-nothing-dispatched-and-its-answer-is-its-result.md),
+      // [W180](../../doc/work-items/w180-asking-and-answering-in-a-run.md), P35 (b)-(f). It replaces ADR 0108 rule 8's
+      // interim refusal at this arm. See `ask()`.
+      case "ask":
+        return this.ask(runId, node, received, itemIndices);
       // **A node kind this driver cannot execute REFUSES rather than returning.**
       // Added by [W32](../../doc/work-items/w32-what-a-map-fanout-is.md) as a
       // declared late exception, after its conformity reader measured what the
@@ -3487,8 +5018,9 @@ var Driver = class {
     } catch (threw) {
       return { threw };
     }
-    const declared = typeof route === "string" && type.routes.includes(route);
-    return { type, route, declared, key: recorded };
+    const set = this.gateRoutes.get(node.id);
+    const declared = typeof route === "string" && set.routes.includes(route);
+    return { set, route, declared, key: recorded };
   }
   /**
    * **`FD-R4`'s road through an ENTRY gate: the edge the run will take, and no other** — W93, Outputs (9).
@@ -3501,7 +5033,7 @@ var Driver = class {
   boundaryEdges(gate, value) {
     const decided = this.decideGate(gate, value, /* @__PURE__ */ new Map());
     if ("threw" in decided || !decided.declared) return [];
-    const edge = gateEdge(gate, decided.type.defaultRoute, decided.route);
+    const edge = gateEdge(gate, decided.set.defaultRoute, decided.route);
     return edge === null ? [] : [edge];
   }
   /**
@@ -3585,21 +5117,32 @@ var Driver = class {
    * the edge carried, so the composed object is the whole payload and what the
    * worker gets is what the document says, character for character.
    *
+   * **`item` is a THUNK, read only for a `"$item"` key** (v0.45, P38 (e)): in a run it reads the instance's held item
+   * (`itemOf`), at `FD-R4` it is the walk's own value — and a node declaring no `"$item"` never asks.
+   *
    * @throws UnresolvedReference — `FD-R3`.
    */
-  compose(node, edgeValue, itemIndices) {
+  compose(node, edgeValue, itemIndices, runPayload, item) {
     const needs = node.needs;
     if (!needs) return edgeValue;
-    const here = this.pathOf(node.id, itemIndices);
-    const produced = this.outputs();
+    let lookup = null;
     const out = {};
     for (const [key, ref] of Object.entries(needs)) {
       const t = referenceTarget(ref);
-      if (t.node === null) {
+      if (t.form === "self") {
         out[key] = cloneValue(edgeValue);
         continue;
       }
-      const v = this.resolveReference(node.id, here, produced, key, t, "needs");
+      if (t.form === "payload") {
+        out[key] = cloneValue(runPayload);
+        continue;
+      }
+      if (t.form === "item") {
+        out[key] = cloneValue(item());
+        continue;
+      }
+      lookup ??= { here: this.pathOf(node.id, itemIndices), produced: this.outputs() };
+      const v = this.resolveReference(node.id, lookup.here, lookup.produced, key, t, "needs");
       if (v !== ABSENT) out[key] = v;
     }
     return out;
@@ -3632,6 +5175,35 @@ var Driver = class {
     }
     return t.form === "all" ? visible.map((e) => cloneValue(e.result)) : cloneValue(visible[0].result);
   }
+  /**
+   * **The value the run ENTERED with — the header's copy** (`RN-R15`, P38 fact 4 and (f)): taken at `start()` from the
+   * caller's payload, or on a resume from the stored header, and held for the life of the run. What a `"$payload"`
+   * reference composes from, in both doors; `FD-R4` hands the caller's own value instead, because it runs before the
+   * header exists. Read only where a node or an edge composes the token — a run declaring none never clones it
+   * (P38 decision 2). The header is set before the first `enter` in both doors, so `null` here is not a run.
+   */
+  runPayload() {
+    return this.header?.entryPayload;
+  }
+  /**
+   * **The item of the map instance `nodeId` is entered in** — `"$item"`'s source in a run (v0.45, P38 (c), (e)): the
+   * innermost map containing the node (`innermostMapOf`, the walk `FD-V49` checked), and the instance its `itemIndices`
+   * name — the branch path that map's branch entry has in it. **By reference to the held item, uncloned**: the caller
+   * clones, per key. Read only where a node or an edge declares `"$item"`.
+   *
+   * **A miss THROWS a plain `Error` naming the invariant**: a node is entered only while its instance is live, and an
+   * instance's item is released only once nothing of it may still be entered (`trackItems`), so a reader with nothing held is a driver
+   * defect — reported as a halt (`OR-R10`) rather than handed `undefined`, which an item may legitimately be.
+   */
+  itemOf(nodeId, itemIndices) {
+    const m = innermostMapOf(this.regions, nodeId);
+    const path = this.pathOf(m.branches[0], itemIndices);
+    const byPath = this.items.held.get(m.fanoutId);
+    if (byPath === void 0 || !byPath.has(path)) {
+      throw new Error(`node "${nodeId}" reads "$item" of map "${m.fanoutId}" instance "${path}", and that instance holds no item \u2014 an instance keeps its item until nothing of it may still be entered (RN-R13, ADR 0118); this is a defect in the driver`);
+    }
+    return byPath.get(path);
+  }
   /**
    * **What a decision sees, beyond its node's outcome** — `FD-C3`, and
    * [ADR 0041](../../doc/decisions/0041-a-decision-sees-its-nodes-outcome-and-whatever-its-own-edge-declares.md).
@@ -3642,7 +5214,10 @@ var Driver = class {
    *
    * **No `"."`, and `FD-V26` refuses it on an edge**: *what this predicate would have
    * received anyway* is `ctx.outcome`, which it already has. So there is no
-   * `edgeValue` parameter here and none is derivable — see the call site.
+   * `edgeValue` parameter here and none is derivable — see the call site. **A
+   * `"$payload"` key needs none either** (v0.44, ADR 0117): it is not derived from what
+   * the NODE received but read from the run's header, `runPayload()` above, its own
+   * copy per key per read.
    *
    * @throws UnresolvedReference — `FD-R3`, from the same expression a node's does.
    */
@@ -3654,6 +5229,17 @@ var Driver = class {
     const out = {};
     for (const [key, ref] of Object.entries(needs)) {
       const t = referenceTarget(ref);
+      if (t.form === "payload") {
+        out[key] = cloneValue(this.runPayload());
+        continue;
+      }
+      if (t.form === "item") {
+        out[key] = cloneValue(this.itemOf(node.id, itemIndices));
+        continue;
+      }
+      if (t.form === "self") {
+        throw new Error(`node "${node.id}"'s edge declares needs[${JSON.stringify(key)}] = ${JSON.stringify(ref)}, which FD-V26 refuses on an edge`);
+      }
       const v = this.resolveReference(node.id, here, produced, key, t, "edge needs");
       if (v !== ABSENT) out[key] = v;
     }
@@ -3668,11 +5254,13 @@ var Driver = class {
    * graph, and there is no longer a carried value that could disagree with it.
    */
   dispatch(runId, node, payload, itemIndices = EMPTY_INDICES) {
+    if (this.shut()) return;
     const taskId = buildTaskId(runId, node.id, branchIndices(this.pathOf(node.id, itemIndices)), 0);
     if (this.dispatched.has(taskId)) {
       throw new DuplicateTaskId(`"${taskId}" was already dispatched in run "${runId}"`);
     }
     this.dispatched.add(taskId);
+    if (this.replay === null) this.unhanded.add(taskId);
     this.append({ kind: "dispatched", taskId });
     const type = this.nodeTypes.get(node.type);
     const retryPolicy = node.retryPolicy ?? type.retryPolicy ?? this.opts.defaultRetryPolicy;
@@ -3688,7 +5276,108 @@ var Driver = class {
       this.replay.held.set(taskId, config);
       return;
     }
-    this.opts.scheduler.addTask((this.opts.createTask ?? defaultCreateTask)(config));
+    if ((this.paused || this.pauseHeld.size > 0) && !this.shut()) {
+      this.pauseHeld.set(taskId, config);
+      this.unhanded.delete(taskId);
+      return;
+    }
+    this.handOn(taskId, config);
+  }
+  /**
+   * **A branch reached an ASK: it parks, keeping what reached it, and NOTHING is handed to the scheduler** — `RN-R37`,
+   * v0.22, [ADR 0109](../../doc/decisions/0109-an-ask-parks-with-nothing-dispatched-and-its-answer-is-its-result.md),
+   * P35 stop-and-asks (b), (c) and (f), decision 5.
+   *
+   *   1. **The hold** (`RN-R29`), as `dispatch`'s: `enter` checked it at its head and `compose` ran consumer code since.
+   *   2. **Its task id** by `spec/task-id.md`'s scheme, attempt `0` — the address a person's answer names. Minted once
+   *      per path: a second `asked` at one id is `ID-R1`'s defect and refused as one (`DuplicateTaskId`), never a
+   *      second park.
+   *   3. **ONE `asked` element**, carrying `received` — what reached the ask, composed through its `needs` — as the
+   *      driver's OWN deep copy: at the entry `received` is the caller's own `start()` payload, and a kept input must not
+   *      move when the caller's object does (P35 (f)). No `dispatched` element, no `createTask`, no `addTask`: the ask is
+   *      never in flight (`RN-R21`), so a stop cancels nothing for it and a resume re-dispatches nothing (P35 fact 5).
+   *   4. **In a region, `branch.suspended`** — what a parked task emits (`settle`'s `user_action` arm): the branch is
+   *      live and its join waits for the person (Q7), which is how an ask in a fan-out holds its join. AFTER the element,
+   *      as the parked task's follows its settlement, and the hold checked between them (`RN-R29`): a consumer's
+   *      callback on `asked` may halt the run, and a halted run emits nothing further. It may also ANSWER the ask: the
+   *      answer is accepted and PENDING until the step ends (reading R4), so the park completes first.
+   *
+   * **During a replay this is how the park is REGENERATED** (`RN-R19`): the element is compared with the stored one,
+   * input and all (`sameData`, `RN-R20`), so a replay that composes a different input is refused `diverged` here.
+   */
+  ask(runId, node, received, itemIndices) {
+    if (this.shut()) return;
+    const branchPath = this.pathOf(node.id, itemIndices);
+    const taskId = buildTaskId(runId, node.id, branchIndices(branchPath), 0);
+    if (this.asked.has(taskId) || this.dispatched.has(taskId)) {
+      throw new DuplicateTaskId(`"${taskId}" was already asked in run "${runId}" \u2014 an ask's id is minted once per path (ID-R1)`);
+    }
+    this.asked.add(taskId);
+    this.append({ kind: "asked", taskId, input: cloneValue(received) });
+    if (this.shut()) return;
+    const region = this.regionOf(node.id);
+    if (region) {
+      this.emit({
+        type: "branch.suspended",
+        regionId: region.fanoutId,
+        regionPath: this.rpathOf(region, itemIndices),
+        branchPath,
+        at: node.id
+      });
+    }
+  }
+  /**
+   * **`RS-R1`'s *suspended*, for one task id** — a dispatched task whose last record is a `user_action` settlement, or,
+   * since v0.18 (`RN-R37`, ADR 0109), an ask this run reached that has no record at all. The FIVE readers of the
+   * predicate read it here: `resolve()`, the replay's fed resolution, and the three `ended` refusals (`hasParked`).
+   */
+  parked(taskId) {
+    return isSuspended(this.log, taskId, this.asked.has(taskId));
+  }
+  /**
+   * **Whether anything in the run waits on a person** — a parked task or an unanswered ask. `cancel`, `stop` and `pause`
+   * refuse a run `ended` only when nothing is in flight and THIS is false: a run whose only live node is a parked ask is
+   * waiting on a person, not finished (P35 fact 5 (iv)). The rest of an ask under run control needs no line of its own:
+   * never dispatched, it is never in flight, so every road reading `inFlight()` passes it by (`RN-R38`, W181).
+   */
+  hasParked() {
+    for (const id of this.dispatched) if (isSuspended(this.log, id)) return true;
+    for (const id of this.asked) if (this.parked(id)) return true;
+    return false;
+  }
+  /**
+   * **Hand one task to the scheduler — and, if the run's owner cancelled it while the task was on its way, cancel it
+   * at once** (`RN-R29` (i), `RN-R31`, ADR 0103's inherited hazard, W173). The ONE place `addTask` is called: by
+   * `dispatch` for the task in progress, and by `resume()` for each task in flight. A cancel raised on this task's own
+   * `dispatched` element — or on a resume's `resumed` element — ran before the scheduler held the id, and sent nothing
+   * for it; this is where that task is cancelled, so it ends with a genuine `task.cancelled` rather than running.
+   */
+  handOn(taskId, config) {
+    try {
+      this.opts.scheduler.addTask((this.opts.createTask ?? defaultCreateTask)(config));
+    } finally {
+      this.unhanded.delete(taskId);
+    }
+    if (this.cancelRequest !== null) this.cancelTask(taskId);
+  }
+  /**
+   * **One task cancelled through the scheduler, with the request's options**, its promise kept for `cancel()` — or,
+   * since W174, `stop()` — to wait on (`RN-R31`, `RN-R33`). Each option is passed only when the caller gave it, so an
+   * absent `graceMs` is the pool's `cancelGraceMs` and not `undefined` read as a value. A cancel and a stop never both
+   * hold — each refuses the other — so the one present is the one whose options these are.
+   */
+  cancelTask(taskId) {
+    const req = this.cancelRequest ?? this.stopRequest;
+    const options = {};
+    if (req.reason !== void 0) options.reason = req.reason;
+    if (req.graceMs !== void 0) options.graceMs = req.graceMs;
+    const p = this.opts.scheduler.cancel(taskId, options);
+    if (!req.stopping.has(taskId)) req.stopping.set(taskId, p);
+    const drop = () => {
+      if (req.stopping.get(taskId) === p) req.stopping.delete(taskId);
+    };
+    p.then(drop, drop);
+    return p;
   }
   /**
    * **A node's `branchPath`, derived from the graph** — `spec/task-id.md` section
@@ -3747,6 +5436,49 @@ var Driver = class {
     this.arrivals.get(fanoutId)?.delete(rp);
     if (this.arrivals.get(fanoutId)?.size === 0) this.arrivals.delete(fanoutId);
   }
+  /**
+   * **The release horizon of what instances keep** — ADR 0118 rule 5. A `branch.opened` of a region nested in a kept map's
+   * instance counts one live branch there; its terminal event uncounts it. The instance's OWN terminal event releases its
+   * item when that count is zero, and otherwise marks it ENDED, released by the nested branch that ends last. O(nesting
+   * depth) per event, and nothing at all where no map keeps (`kept` empty). Run in a replay as in a run, so a resume
+   * rebuilds the counts with the items.
+   */
+  trackItems(e) {
+    const it = this.items;
+    if (it.kept.size === 0) return;
+    const opened = e.type === "branch.opened";
+    const terminal = isTerminalEvent(e);
+    if (!opened && !terminal) return;
+    for (const { map, depth } of it.within.get(e.regionId) ?? []) {
+      const path = e.branchPath.split(".").slice(0, depth).join(".");
+      const k = `${map} ${path}`;
+      const n = (it.nested.get(k) ?? 0) + (opened ? 1 : -1);
+      if (n > 0) {
+        it.nested.set(k, n);
+        continue;
+      }
+      it.nested.delete(k);
+      if (it.ended.has(k)) this.releaseItem(map, path);
+    }
+    if (terminal && it.kept.has(e.regionId)) {
+      if (it.nested.has(`${e.regionId} ${e.branchPath}`)) it.ended.add(`${e.regionId} ${e.branchPath}`);
+      else this.releaseItem(e.regionId, e.branchPath);
+    }
+  }
+  /** **One instance's item, dropped** — and the map's own key with its last instance, as `releaseArrivals` drops a region's. */
+  releaseItem(mapId, branchPath) {
+    this.items.ended.delete(`${mapId} ${branchPath}`);
+    const byPath = this.items.held.get(mapId);
+    if (byPath === void 0) return;
+    byPath.delete(branchPath);
+    if (byPath.size === 0) this.items.held.delete(mapId);
+  }
+  /** **Everything instances keep, dropped** — the run-level moments, where no node of the run is entered again. */
+  releaseAllItems() {
+    this.items.held.clear();
+    this.items.nested.clear();
+    this.items.ended.clear();
+  }
   /** The arrival map for one region, created on first arrival. */
   arrivalsOf(fanoutId, rp) {
     const byPath = this.arrivals.get(fanoutId) ?? /* @__PURE__ */ new Map();
@@ -3902,12 +5634,22 @@ var Driver = class {
     if (this.opts.onFoldInput && this.delivers(seq)) this.opts.onFoldInput(freezeInput(input), seq);
     return seq;
   }
+  /**
+   * **A stored `interrupted` element, fed** (`RN-R19`, `RN-R32`): the replay holds as the stopped run was held — the hold
+   * BEFORE the element, as a stop is taken — and appends the element as stored. Neither `deaf` nor a cancel nor the
+   * collections' release: those were the stopped driver's, and a replay hands a scheduler nothing.
+   */
+  feedInterrupted(e) {
+    this.stopRequest = { actor: e.actor, stopping: /* @__PURE__ */ new Map(), pending: null, took: null };
+    this.append({ kind: "interrupted", actor: e.actor, reason: e.reason ?? null });
+  }
   emit(e) {
     const policy = this.opts.joinPolicy;
     if (policy && this.joinStateHas(e.regionId, e.regionPath)) {
       this.joinStateSet(e.regionId, e.regionPath, policy.step(this.joinStateGet(e.regionId, e.regionPath), e));
     }
     const event = Object.freeze({ ...e });
+    this.trackItems(e);
     const seq = this.append({ kind: "region", event });
     if (this.delivers(seq)) this.opts.onRegionEvent?.(event);
   }
@@ -3978,7 +5720,7 @@ var Driver = class {
       joinId: region.joinId,
       fired: true
     });
-    if (this.failed) return;
+    if (this.shut()) return;
     const collected = collectArrivals(this.arrivals.get(region.fanoutId)?.get(rp));
     this.releaseArrivals(region.fanoutId, rp);
     const join = this.graph.byId.get(region.joinId);
@@ -4118,22 +5860,72 @@ var Driver = class {
 
 // src/fold/run-state.ts
 function emptyState() {
-  return { runId: null, outcome: "running", nodes: {}, regions: {}, pathEnds: [], stoppedBy: null, resumes: [], gated: [] };
+  return {
+    runId: null,
+    outcome: "running",
+    nodes: {},
+    regions: {},
+    pathEnds: [],
+    haltedBy: null,
+    cancelRequest: null,
+    interruption: null,
+    paused: false,
+    resumes: [],
+    gated: []
+  };
 }
 function step(prev, input) {
-  if (input.kind === "stopped") {
-    return { ...prev, stoppedBy: input.reason, outcome: "stopped" };
+  if (input.kind === "halted" || input.kind === "stopped") {
+    return { ...prev, haltedBy: input.reason, outcome: "halted" };
+  }
+  if (input.kind === "cancelRequested") {
+    if (prev.cancelRequest !== null || prev.outcome === "cancelled") return prev;
+    return withOutcome({ ...prev, cancelRequest: { actor: input.actor, reason: input.reason } });
+  }
+  if (input.kind === "interrupted") {
+    if (prev.interruption !== null) return prev;
+    return withOutcome({ ...prev, interruption: { actor: input.actor, reason: input.reason } });
+  }
+  if (input.kind === "paused" || input.kind === "unpaused") {
+    const paused = input.kind === "paused";
+    if (prev.paused === paused) return prev;
+    return { ...prev, paused };
   }
   if (input.kind === "region") {
     return withOutcome(applyRegion(prev, input.event));
   }
   if (input.kind === "dispatched") {
-    const { runId: runId2, nodeId: nodeId2, branchPath: branchPath2 } = parseTaskId(input.taskId);
+    const { runId: runId2, nodeId: nodeId2, branchPath: branchPath2, attempt: attempt2 } = parseTaskId(input.taskId);
     if (prev.nodes[input.taskId]) return prev;
     return withOutcome({
       ...prev,
       runId: prev.runId ?? runId2,
-      nodes: { ...prev.nodes, [input.taskId]: { nodeId: nodeId2, branchPath: branchPath2, state: "running", result: null, error: null } }
+      nodes: {
+        ...prev.nodes,
+        [input.taskId]: { runId: runId2, nodeId: nodeId2, branchPath: branchPath2, flowAttempt: attempt2, attemptNumber: null, state: "running", result: null, error: null }
+      }
+    });
+  }
+  if (input.kind === "asked") {
+    const { runId: runId2, nodeId: nodeId2, branchPath: branchPath2, attempt: attempt2 } = parseTaskId(input.taskId);
+    if (prev.nodes[input.taskId]) return prev;
+    return withOutcome({
+      ...prev,
+      runId: prev.runId ?? runId2,
+      nodes: {
+        ...prev.nodes,
+        [input.taskId]: {
+          runId: runId2,
+          nodeId: nodeId2,
+          branchPath: branchPath2,
+          flowAttempt: attempt2,
+          attemptNumber: null,
+          state: "suspended",
+          result: null,
+          error: null,
+          input: structuredClone(input.input)
+        }
+      }
     });
   }
   if (input.kind === "pathEnded") {
@@ -4147,13 +5939,20 @@ function step(prev, input) {
     });
   }
   if (input.kind === "resumed") {
-    return { ...prev, resumes: [...prev.resumes, [...input.taskIds]] };
+    const resumes = [...prev.resumes, [...input.taskIds]];
+    if (prev.interruption !== null) return withOutcome({ ...prev, interruption: null, resumes });
+    return { ...prev, resumes };
   }
   if (input.kind === "gated") {
     const d = { gateId: input.gateId, branchPath: input.branchPath, route: input.route };
     if (input.key !== void 0) d.key = structuredClone(input.key);
     return { ...prev, gated: [...prev.gated, d] };
   }
+  if (input.kind === "attempted") {
+    const node = prev.nodes[input.taskId];
+    if (node === void 0) return prev;
+    return { ...prev, nodes: { ...prev.nodes, [input.taskId]: { ...node, attemptNumber: input.attemptNumber } } };
+  }
   if (input.kind === "joinSettled") {
     const cur = prev.regions[input.regionId]?.[input.regionPath] ?? emptyRegion();
     return withOutcome({
@@ -4162,13 +5961,17 @@ function step(prev, input) {
     });
   }
   const r = input.record;
-  const { runId, nodeId, branchPath } = parseTaskId(r.taskId);
+  const { runId, nodeId, branchPath, attempt } = parseTaskId(r.taskId);
   const nodes = { ...prev.nodes };
   const existing = nodes[r.taskId];
+  const attemptNumber = existing?.attemptNumber ?? null;
   if (r.kind === "outcome") {
     nodes[r.taskId] = {
+      runId,
       nodeId,
       branchPath,
+      flowAttempt: attempt,
+      attemptNumber,
       // `user_action` is `suspended` at flow level: a resolution resumes it, and
       // calling it terminal is what makes a design drop the fifth state.
       state: r.terminalState === "user_action" ? "suspended" : r.terminalState,
@@ -4177,11 +5980,15 @@ function step(prev, input) {
     };
   } else {
     nodes[r.taskId] = {
+      runId: existing?.runId ?? runId,
       nodeId: existing?.nodeId ?? nodeId,
       branchPath: existing?.branchPath ?? branchPath,
+      flowAttempt: existing?.flowAttempt ?? attempt,
+      attemptNumber,
       state: r.resolvedAs,
       result: r.result,
-      error: r.error
+      error: r.error,
+      ...existing !== void 0 && "input" in existing ? { input: existing.input } : {}
     };
   }
   return withOutcome({ ...prev, runId: prev.runId ?? runId, nodes });
@@ -4220,8 +6027,13 @@ function applyRegion(prev, e) {
   return { ...prev, regions: withRegion(prev.regions, e.regionId, e.regionPath, cur) };
 }
 function withOutcome(s) {
-  if (s.stoppedBy !== null) return { ...s, outcome: "stopped" };
+  if (s.haltedBy !== null) return { ...s, outcome: "halted" };
   const nodes = Object.values(s.nodes);
+  if (s.cancelRequest === null && nodes.some((n) => n.state === "cancelled")) return { ...s, outcome: "cancelled" };
+  if (s.cancelRequest !== null) {
+    return { ...s, outcome: nodes.some((n) => n.state === "running") ? "cancelling" : "cancelled" };
+  }
+  if (s.interruption !== null) return { ...s, outcome: "interrupted" };
   if (nodes.some((n) => n.state === "suspended")) return { ...s, outcome: "awaiting_action" };
   if (nodes.some((n) => n.state === "running")) return { ...s, outcome: "running" };
   const openedNothing = allRegionRuns(s).some((r) => r.opened.length === 0 && r.joined !== true);
@@ -4243,7 +6055,7 @@ function foldLog(log) {
   return fold(log.map((r) => ({ kind: r.kind, record: r })));
 }
 function isTerminal(s) {
-  return s.outcome !== "running" && s.outcome !== "awaiting_action";
+  return s.outcome !== "running" && s.outcome !== "awaiting_action" && s.outcome !== "cancelling";
 }
 function nodeOf(s, taskId) {
   return s.nodes[taskId] ?? null;
@@ -4329,6 +6141,7 @@ export {
   innermostRegionOf,
   branchPathOf,
   regionChainOf,
+  innermostMapOf,
   sharedRegionDepth,
   outputIsVisible,
   branchIndexOf,
@@ -4339,6 +6152,8 @@ export {
   canonical,
   findings,
   describeFindings,
+  readKeyPath,
+  ASK_REFUSED_KEYS,
   EDGE_KEYS_DECLARED,
   TASK_KEYS_DECLARED,
   NODE_KEYS_DECLARED,
@@ -4353,9 +6168,9 @@ export {
   languagesOf,
   KEY_PATH_RE,
   keyPathProblem,
-  readKeyPath,
   GATE_TYPE_KEYS,
   gateTypeProblem,
+  routesOf,
   distinct,
   BUILT_IN_GATE_TYPES,
   gateTypesOf,
@@ -4393,8 +6208,10 @@ export {
   CHECKED_WORKER_SCHEMAS,
   NODE_TYPE_DECLARATION_KEYS,
   POOL_SPEC_KEYS,
+  MESSAGE_OPTION_KEYS,
   DECLARED_POOL_KEYS,
   INSTANCE_KEYS,
+  POOL_INSTANCE_KEYS,
   isDerivation,
   mergeConfig,
   nodeTypeFromDeclaration,
@@ -4410,6 +6227,7 @@ export {
   fits,
   boundaryTargets,
   checkWiring,
+  givenVerdict,
   describeVerdict,
   VERDICT_KINDS,
   WIRING_SHAPES,
@@ -4429,6 +6247,8 @@ export {
   eligibleEdges,
   gateEdge,
   selectEdge,
+  TERMINAL_EVENTS,
+  isTerminalEvent,
   InvalidDefinition,
   DuplicateTaskId,
   UnresolvedMapArity,
@@ -4437,6 +6257,7 @@ export {
   BoundaryRefused,
   MultipleRuns,
   NotStarted,
+  RunControlRefused,
   CHECKPOINT_FORMAT,
   ResumeRefused,
   resumeRefusal,