lua-cli 3.31.0 → 3.32.1

package/dist/index.js

@@ -859,7 +859,6 @@ function luaClientMetricLabels(client2) {
   const canonical2 = parseLuaClientHeader(serializeLuaClientHeader(client2));
   return {
     client_family: canonical2?.app ?? "unknown",
-    client_version: canonical2?.version ?? "unknown",
     client_attribution: canonical2?.attribution ?? "unknown"
   };
 }
@@ -927,6 +926,59 @@ function scheduledTimeKey(scheduledTime) {
 function scheduledWorkflowRunIdForTime(jobId, scheduledTime) {
   return scheduledWorkflowRunId(jobId, scheduledTime);
 }
+function groupCount(re) {
+  let n2 = GROUP_COUNT.get(re);
+  if (n2 === void 0) {
+    n2 = new RegExp(`${re.source}|`, re.flags.replace("g", "")).exec("").length - 1;
+    GROUP_COUNT.set(re, n2);
+  }
+  return n2;
+}
+function applyPatterns(text, patterns) {
+  let out = text;
+  for (const { re, suffix } of patterns) {
+    re.lastIndex = 0;
+    if (!re.test(out)) continue;
+    re.lastIndex = 0;
+    const groups = groupCount(re);
+    out = out.replace(re, (...args2) => {
+      const kept = args2.slice(1, 1 + groups).map((g) => typeof g === "string" ? g : "");
+      if (suffix && kept.length > 0) {
+        const tail = kept[kept.length - 1];
+        return `${kept.slice(0, -1).join("")}${REDACTED_PLACEHOLDER}${tail}`;
+      }
+      return `${kept.join("")}${REDACTED_PLACEHOLDER}`;
+    });
+  }
+  return out;
+}
+function scrubSecretText(text) {
+  if (typeof text !== "string" || text.length < 4) return text;
+  return applyPatterns(applyPatterns(text, SECRET_LITERAL_PATTERNS), SECRET_PAIR_PATTERNS);
+}
+function scrubSecretLines(lines) {
+  return lines.map((l) => typeof l === "string" ? scrubSecretText(l) : l);
+}
+function messageText(value3) {
+  if (typeof value3 === "string") return value3;
+  if (value3 instanceof Error) return value3.message;
+  if (value3 && typeof value3 === "object") {
+    const m = value3.message;
+    if (typeof m === "string") return m;
+    try {
+      return JSON.stringify(value3);
+    } catch {
+      return "";
+    }
+  }
+  return value3 === void 0 || value3 === null ? "" : String(value3);
+}
+function scrubProviderMessage(raw, max = PROVIDER_MESSAGE_MAX_CHARS) {
+  const text = messageText(raw).replace(/\s+/g, " ").trim();
+  if (!text) return void 0;
+  const out = scrubSecretText(text);
+  return out.length > max ? `${out.slice(0, max - 1)}\u2026` : out;
+}
 function isWorkflowAuditEvent(action) {
   return typeof action === "string" && WORKFLOW_AUDIT_EVENTS.includes(action);
 }
@@ -1021,7 +1073,7 @@ ${PREAMBLE}
 
 ${items.join("\n\n")}`;
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE;
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2065,6 +2117,27 @@ This text is who you are for this person. As you learn them, their name, their w
       ...WORKFLOW_RUN_IDLE,
       ...WORKFLOW_RUN_TERMINAL
     ];
+    WORKFLOW_STEP_STATUSES = [
+      "pending",
+      "ready",
+      "waiting",
+      "dispatched",
+      "claimed",
+      "running",
+      "suspended",
+      "cancellation_requested",
+      "completed",
+      "failed",
+      "skipped",
+      "cancelled",
+      "timeout",
+      "reaped"
+    ];
+    WORKFLOW_STEP_IN_FLIGHT = [
+      "claimed",
+      "running",
+      "cancellation_requested"
+    ];
     ARCHIVE_WINDOW_MARGIN_DAYS = 7;
     __name(shouldSkipArchive, "shouldSkipArchive");
     __name2(shouldSkipArchive, "shouldSkipArchive");
@@ -2095,11 +2168,90 @@ This text is who you are for this person. As you learn them, their name, their w
     __name(workflowOrgSlotKey, "workflowOrgSlotKey");
     __name2(workflowOrgSlotKey, "workflowOrgSlotKey");
     WORKFLOW_JOURNAL_PROTOCOL_VERSION = 1;
+    WORKFLOW_CONNECTION_KEY_RE = /^[a-z][a-z0-9_-]{0,63}$/;
     __name(scheduledTimeKey, "scheduledTimeKey");
     __name2(scheduledTimeKey, "scheduledTimeKey");
     __name(scheduledWorkflowRunIdForTime, "scheduledWorkflowRunIdForTime");
     __name2(scheduledWorkflowRunIdForTime, "scheduledWorkflowRunIdForTime");
     WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES = 64 * 1024;
+    REDACTED_PLACEHOLDER = "[REDACTED]";
+    PROVIDER_MESSAGE_MAX_CHARS = 300;
+    SECRET_LITERAL_PATTERNS = [
+      {
+        re: /\b(github_pat_)[A-Za-z0-9_]{16,}/g
+      },
+      {
+        re: /\b(gh[pousr]_)[A-Za-z0-9]{16,}/g
+      },
+      {
+        re: /\b(glpat-)[A-Za-z0-9_-]{16,}/g
+      },
+      {
+        re: /\b(sk-ant-)[A-Za-z0-9_-]{16,}/g
+      },
+      {
+        re: /\b(sk-)(?!ant-)[A-Za-z0-9_-]{20,}/g
+      },
+      {
+        re: /\b(AKIA)[A-Z0-9]{16}\b/g
+      },
+      {
+        re: /\b(xox[abprs]-)[A-Za-z0-9-]{10,}/g
+      },
+      {
+        re: /\b(AIza)[0-9A-Za-z_-]{35}/g
+      },
+      {
+        re: /\b(ya29\.)[A-Za-z0-9_-]{20,}/g
+      },
+      {
+        re: /\b(eyJ)[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+      },
+      {
+        re: /(-----BEGIN [A-Z ]*PRIVATE KEY-----)[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g
+      },
+      // `https://x-access-token:<token>@github.com/…` (the git credential shape the pod scrubbed already)
+      {
+        re: /\b(x-access-token:)[^@\s]+(@)/g,
+        suffix: true
+      }
+    ];
+    SECRET_NAME = "(?:authorization|proxy-authorization|x-api-key|x-wf-[a-z-]*key|x-internal-auth|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|secret|password|passwd|pwd|passphrase|token|credentials?)";
+    SECRET_PAIR_PATTERNS = [
+      // `Authorization: Bearer x`, `x-api-key: x`, `AWS_SECRET_ACCESS_KEY=x`, `SVC_JOB_KEY=x`, `"apiKey": "x"`,
+      // `FOO_TOKEN=x`, `secretKey=x`, `password=x`. Groups: the char before the name, the name, the separator
+      // (with its quotes), the scheme word — all kept; the value goes. A value a literal rule already replaced
+      // (`x-access-token:[REDACTED]@host`) is left alone so the host after it survives.
+      {
+        re: new RegExp(`(^|[^A-Za-z0-9])((?:[A-Za-z0-9-]+[_-])?${SECRET_NAME}|[A-Za-z0-9-]+_key)(["']?\\s*[:=]\\s*["']?)((?:basic\\s+|bearer\\s+|token\\s+)?)(?!\\[REDACTED\\])[^\\s"',;)}&]{4,}`, "gi")
+      },
+      // `?token=x`, `&key=x`, `&X-Amz-Signature=x`, `&sig=x`
+      {
+        re: /([?&](?:token|key|api[_-]?key|apikey|access[_-]?token|id[_-]?token|auth|sig|signature|secret|password|pwd|x-amz-signature|x-amz-credential|x-amz-security-token)=)[^&\s"'#]+/gi
+      },
+      // `mongodb+srv://user:pass@host`, `postgres://user:pass@host`, `https://user:pass@host`
+      {
+        re: /(\/\/[^\s/:@]+:)[^\s/@]+(@)/g,
+        suffix: true
+      },
+      // `Basic <base64>` / `bearer <short token>` (the literal list needs ≥ 16 chars; any case)
+      {
+        re: /\b((?:Basic|Bearer)\s+)(?!\[REDACTED\])[A-Za-z0-9+/=_.-]{8,}/gi
+      }
+    ];
+    GROUP_COUNT = /* @__PURE__ */ new WeakMap();
+    __name(groupCount, "groupCount");
+    __name2(groupCount, "groupCount");
+    __name(applyPatterns, "applyPatterns");
+    __name2(applyPatterns, "applyPatterns");
+    __name(scrubSecretText, "scrubSecretText");
+    __name2(scrubSecretText, "scrubSecretText");
+    __name(scrubSecretLines, "scrubSecretLines");
+    __name2(scrubSecretLines, "scrubSecretLines");
+    __name(messageText, "messageText");
+    __name2(messageText, "messageText");
+    __name(scrubProviderMessage, "scrubProviderMessage");
+    __name2(scrubProviderMessage, "scrubProviderMessage");
     WORKFLOW_AUDIT_EVENTS = [
       // --- definitions / versions / templates (13, 11 §11.11.5) ---
       "workflow.published",
@@ -2719,7 +2871,11 @@ var init_request_credential = __esm({
 // ../workflow-graph/dist/index.mjs
 import { createHash as createHash2 } from "crypto";
 import { z as z6 } from "zod";
+import { z as z22 } from "zod";
 import { createHash as createHash22 } from "crypto";
+function sleepUntilUnsupportedMessage(id) {
+  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+}
 function fillPolicy(node, defaultTimeout) {
   if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
   if (node.timeoutSeconds === void 0) node.timeoutSeconds = node.tier === "job" ? WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS : defaultTimeout;
@@ -2814,6 +2970,12 @@ function withDefaultsFilled(g) {
   out.definition.graph.forEach(fillEntry);
   return out;
 }
+function isConnectionKeyShaped(value22) {
+  return WORKFLOW_CONNECTION_KEY_RE.test(value22) && !CONNECTION_ID_HEX_RE.test(value22);
+}
+function connectionKeyUndeclaredMessage(path23, key) {
+  return `${path23} '${key}' is neither a connection id nor a declared connections[].key \u2014 declare it: connections: [{ key: '${key}', integrationType: '<catalog slug, e.g. github>' }] and it resolves on any agent`;
+}
 function classifyModelProvider(model) {
   const m = (model ?? "").trim().toLowerCase();
   if (!m) return null;
@@ -2916,6 +3078,33 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   if (envelopeWorkspace?.backend && envelopeWorkspace.backend !== "ebs" && opts.policy?.workspaceBackends && !opts.policy.workspaceBackends.includes(envelopeWorkspace.backend)) {
     err("workspace-backend-unavailable", `workspace.backend '${envelopeWorkspace.backend}' is not enabled (LUA_WF_WORKSPACE_BACKENDS = ${opts.policy.workspaceBackends.join(",")}) \u2014 'ebs' is the normative fallback`, "workspace.backend");
   }
+  const declaredKeys = new Set(opts.connectionKeys ?? []);
+  if (g.connections !== void 0 && !Array.isArray(g.connections)) {
+    err("connection-declaration-invalid", "`connections` must be an array of { key, integrationType }", "connections");
+  }
+  (Array.isArray(g.connections) ? g.connections : []).forEach((c, i) => {
+    const path23 = `connections.${i}`;
+    const key = c?.key;
+    const integrationType = c?.integrationType;
+    if (typeof key !== "string" || !WORKFLOW_CONNECTION_KEY_RE.test(key)) {
+      err("connection-declaration-invalid", `connections[${i}].key must match ${WORKFLOW_CONNECTION_KEY_RE}`, `${path23}.key`);
+      return;
+    }
+    if (declaredKeys.has(key)) {
+      err("connection-declaration-invalid", `connections[${i}].key "${key}" is declared twice`, `${path23}.key`);
+      return;
+    }
+    if (typeof integrationType !== "string" || !integrationType.trim()) {
+      err("connection-declaration-invalid", `connections[${i}] ("${key}") needs an integrationType (the catalog slug, e.g. 'github')`, `${path23}.integrationType`);
+      return;
+    }
+    declaredKeys.add(key);
+  });
+  const undeclaredKey = /* @__PURE__ */ __name3((ref) => typeof ref === "string" && !declaredKeys.has(ref) && isConnectionKeyShaped(ref) && opts.connectionIds?.has(ref) !== true, "undeclaredKey");
+  const credentialsRef = envelopeWorkspace?.credentialsRef;
+  if (undeclaredKey(credentialsRef)) {
+    err("connection-key-undeclared", connectionKeyUndeclaredMessage("workspace.credentialsRef", credentialsRef), "workspace.credentialsRef");
+  }
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
@@ -2927,6 +3116,16 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       seen.set(id, path23);
     }
   }, "checkId");
+  const checkPolicyEnums = /* @__PURE__ */ __name3((node, path23) => {
+    const id = singleId(node);
+    const check = /* @__PURE__ */ __name3((member, allowed) => {
+      const value22 = node[member];
+      if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path23}.${member}`, id);
+    }, "check");
+    check("sideEffects", WORKFLOW_SIDE_EFFECTS);
+    check("jobResources", WORKFLOW_JOB_RESOURCES);
+  }, "checkPolicyEnums");
   const checkRetry = /* @__PURE__ */ __name3((node, path23) => {
     const r = node.retry;
     if (!r) return;
@@ -2934,6 +3133,9 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (r.backoff !== void 0 && r.backoff !== "fixed" && r.backoff !== "exponential") {
       err("backoff-invalid", `retry.backoff must be 'fixed' | 'exponential'`, `${path23}.retry.backoff`, id);
     }
+    if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path23}.retry.backoffSeconds`, id);
+    }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
         err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path23}.retry`, id);
@@ -2995,10 +3197,15 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   }, "checkSpecialistRole");
   const checkRequiredConnections = /* @__PURE__ */ __name3((node, path23) => {
     const required = node.requiredConnections;
-    if (!Array.isArray(required) || !opts.connectionIds) return;
-    const unknown = required.filter((c) => typeof c !== "string" || !opts.connectionIds.has(c));
+    if (!Array.isArray(required)) return;
+    const undeclared = required.filter(undeclaredKey);
+    if (undeclared.length) {
+      err("connection-key-undeclared", connectionKeyUndeclaredMessage(`${path23}.requiredConnections`, undeclared[0]) + (undeclared.length > 1 ? ` (also undeclared: ${JSON.stringify(undeclared.slice(1))})` : ""), `${path23}.requiredConnections`, singleId(node));
+    }
+    if (!opts.connectionIds) return;
+    const unknown = required.filter((c) => typeof c !== "string" || !declaredKeys.has(c) && !opts.connectionIds.has(c));
     if (unknown.length) {
-      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are not connections the owner can mount`, `${path23}.requiredConnections`, singleId(node));
+      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path23}.requiredConnections`, singleId(node));
     }
   }, "checkRequiredConnections");
   const checkTier = /* @__PURE__ */ __name3((node, path23) => {
@@ -3084,6 +3291,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       return;
     }
     checkId(singleId(node), path23);
+    checkPolicyEnums(node, path23);
     checkTimeout(node, path23);
     checkTier(node, path23);
     checkRetry(node, path23);
@@ -3150,6 +3358,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       case "sleepUntil": {
         const s = entry;
         checkId(s.id, path23);
+        err("node-type-unsupported-by-engine", sleepUntilUnsupportedMessage(s.id), path23, s.id);
         if (s.date === void 0 === (s.dateFrom === void 0)) {
           err("invalid-envelope", "sleepUntil needs exactly one of `date` | `dateFrom`", path23, s.id);
         }
@@ -3195,7 +3404,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
           err("invalid-envelope", "conditional.predicates must match conditional.steps one-to-one", path23);
         }
         (c.predicates ?? []).forEach((p, j) => {
-          if (!isPredicate(p)) err("closure-predicate", "a conditional predicate must be a LuaPredicate object, not a function", `${path23}.predicates.${j}`);
+          if (!isWellFormedPredicate(p)) err("closure-predicate", "a conditional predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path23}.predicates.${j}`);
         });
         c.steps.forEach((arm, j) => {
           checkArm(arm, `${path23}.steps.${j}`, 1);
@@ -3275,7 +3484,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         if (l.intervalSeconds !== void 0 && (!Number.isInteger(l.intervalSeconds) || l.intervalSeconds < 1 || l.intervalSeconds > caps.maxLoopIntervalSeconds)) {
           err("loop-interval-out-of-range", `loop.intervalSeconds must be an integer in 1..${caps.maxLoopIntervalSeconds}`, `${path23}.intervalSeconds`);
         }
-        if (!isPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a LuaPredicate object, not a function", `${path23}.predicate`);
+        if (!isWellFormedPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path23}.predicate`);
         const bodyType = l.step.type;
         if (bodyType === "mapping") err("container-arm-empty", "a loop body needs a step, not a bare mapping", `${path23}.step`);
         else if (bodyType === "approval" || bodyType === "waitForSignal") err("approval-inside-container", "approval / waitForSignal are top-level only in v1", `${path23}.step`);
@@ -3338,6 +3547,41 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
 function isPredicate(p) {
   return typeof p === "object" && p !== null && typeof p.op === "string" && PREDICATE_OPS.has(p.op);
 }
+function isPathOrLiteral(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  if ("path" in r) return typeof r.path === "string" && r.path.length > 0;
+  return "literal" in r && isPredicateScalar(r.literal);
+}
+function isWellFormedPredicate(p) {
+  if (!isPredicate(p)) return false;
+  const r = p;
+  switch (r.op) {
+    case "eq":
+    case "ne":
+    case "lt":
+    case "lte":
+    case "gt":
+    case "gte":
+      return isPathOrLiteral(r.left) && isPathOrLiteral(r.right);
+    case "in":
+    case "notIn":
+      return isPathOrLiteral(r.value) && Array.isArray(r.set) && r.set.every(isPredicateScalar);
+    case "exists":
+    case "notExists":
+      return typeof r.path === "string" && r.path.length > 0;
+    case "truthy":
+    case "falsy":
+      return isPathOrLiteral(r.value);
+    case "and":
+    case "or":
+      return Array.isArray(r.args) && r.args.every(isWellFormedPredicate);
+    case "not":
+      return isWellFormedPredicate(r.arg);
+    default:
+      return false;
+  }
+}
 function canonicalJson(value22) {
   const seen = /* @__PURE__ */ new WeakSet();
   const encode = /* @__PURE__ */ __name3((v) => {
@@ -3763,13 +4007,13 @@ function parseTemplatePlaceholder(rawExpr) {
     rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
   };
 }
-function traverseMappingPath(root, path23, errorLabel) {
+function traverseMappingPath(root, path23, errorLabel2) {
   if (path23 === "" || path23 === ".") return root;
   const parts = path23.split(".");
   let value22 = root;
   for (const part of parts) {
     if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
-    else throw new WorkflowTemplateError(`Invalid path ${path23} in ${errorLabel}`, path23);
+    else throw new WorkflowTemplateError(`Invalid path ${path23} in ${errorLabel2}`, path23);
   }
   return value22;
 }
@@ -3900,6 +4144,25 @@ function resolveMapping(cfg, ctx) {
     value: result
   };
 }
+function continuedFailureValue(error, killReason) {
+  const code = typeof error?.code === "string" && error.code || typeof killReason === "string" && killReason || CONTINUED_FAILURE_DEFAULT_CODE;
+  const message = typeof error?.message === "string" && error.message ? error.message : code;
+  return {
+    __lua_workflow: CONTINUED_FAILURE_TAG,
+    failed: true,
+    error: {
+      code,
+      message
+    },
+    text: ""
+  };
+}
+function isContinuedFailureValue(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const o = v;
+  const err = o.error;
+  return o.__lua_workflow === CONTINUED_FAILURE_TAG && o.failed === true && o.text === "" && err !== null && typeof err === "object" && typeof err.code === "string" && typeof err.message === "string";
+}
 function lowerContainerArm(mapping, step22) {
   const stepId = nodeIdOf(step22);
   return {
@@ -3997,7 +4260,7 @@ function resolvePlacements(calls) {
     if (!d) {
       issues.push({
         code: "unknown-step-ref",
-        message: `"${ref.ref}" is not declared anywhere in the chain \u2014 declare it with agentStep/specialistStep/toolStep/map(\u2026, { id })`,
+        message: `"${ref.ref}" is not declared anywhere in the chain \u2014 declare it with agentStep/specialistStep/toolStep/map(\u2026, { id })/workflow(\u2026)`,
         callIndex: i,
         stepId: ref.ref
       });
@@ -4049,9 +4312,9 @@ function resolvePlacements(calls) {
   });
   const graph = [];
   const lookup = /* @__PURE__ */ __name3((ref) => {
-    const n = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
-    if (!n || !ref.armMap || n.type === "mapping") return n;
-    return lowerContainerArm(ref.armMap, n);
+    const n2 = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
+    if (!n2 || !ref.armMap || n2.type === "mapping") return n2;
+    return lowerContainerArm(ref.armMap, n2);
   }, "lookup");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -4070,7 +4333,7 @@ function resolvePlacements(calls) {
         return;
       }
       case "parallel": {
-        const steps = call.arms.map(lookup).filter((n) => !!n && n.type !== "mapping");
+        const steps = call.arms.map(lookup).filter((n2) => !!n2 && n2.type !== "mapping");
         const node = {
           type: "parallel",
           steps
@@ -4083,9 +4346,9 @@ function resolvePlacements(calls) {
         const steps = [];
         const predicates = [];
         for (const a of call.arms) {
-          const n = lookup(a.target);
-          if (!n) continue;
-          steps.push(n);
+          const n2 = lookup(a.target);
+          if (!n2) continue;
+          steps.push(n2);
           predicates.push(a.predicate);
         }
         const node = {
@@ -4189,31 +4452,54 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
     graphChanged
   };
 }
+function branchSpecFromConditional(entry) {
+  return {
+    arms: entry.steps.map((arm, i) => ({
+      stepId: branchArmId(arm),
+      predicate: entry.predicates[i]
+    })),
+    ...entry.exclusive === true ? {
+      exclusive: true
+    } : {},
+    ...entry.otherwise ? {
+      otherwise: branchArmId(entry.otherwise)
+    } : {}
+  };
+}
+function selectBranchArms(spec, ctx) {
+  const taken = [];
+  for (const arm of spec.arms) {
+    if (spec.exclusive && taken.length > 0) break;
+    const hit = arm.predicate ? evaluatePredicate(arm.predicate, ctx) : false;
+    if (hit) taken.push(arm.stepId);
+  }
+  if (taken.length === 0 && spec.otherwise) taken.push(spec.otherwise);
+  return taken;
+}
 function replayLedger(g, ledger) {
   const plan = compilePlan(g);
   const rows22 = new Map(ledger.steps.map((r) => [
     r.stepId,
     r
   ]));
-  const stepResults = {};
-  for (const r of ledger.steps) if (r.status === "completed") stepResults[r.stepId] = r.output;
-  const ctx = {
+  const requestContext = {
+    runId: "replay",
+    workflowId: g.definition.id,
+    orgId: "",
+    agentId: "",
+    userId: "",
+    trigger: "sdk",
+    threadId: "replay",
+    depth: 0,
+    startedAt: 0,
+    ...ledger.requestContext
+  };
+  const ctxFor = /* @__PURE__ */ __name3((id) => ({
     initData: ledger.initData,
-    stepResults,
+    stepResults: ancestorResults(plan, id, rows22),
     state: ledger.state ?? {},
-    requestContext: {
-      runId: "replay",
-      workflowId: g.definition.id,
-      orgId: "",
-      agentId: "",
-      userId: "",
-      trigger: "sdk",
-      threadId: "replay",
-      depth: 0,
-      startedAt: 0,
-      ...ledger.requestContext
-    }
-  };
+    requestContext
+  }), "ctxFor");
   const verdicts = [];
   for (const id of plan.order) {
     const node = plan.steps[id];
@@ -4221,17 +4507,7 @@ function replayLedger(g, ledger) {
     if (!recorded || recorded.status === "pending" || recorded.status === "skipped") continue;
     if (node.kind === "branch") {
       const entry = node.entry;
-      const taken = [];
-      entry.steps.forEach((arm, i) => {
-        const pred = entry.predicates[i];
-        const hit = pred ? evaluatePredicate(pred, {
-          initData: ledger.initData,
-          stepResults,
-          state: ledger.state
-        }) : false;
-        if (hit && (!entry.exclusive || taken.length === 0)) taken.push(armId2(arm));
-      });
-      if (taken.length === 0 && entry.otherwise) taken.push(armId2(entry.otherwise));
+      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id));
       const recordedTaken = recorded.taken ?? inferTaken(entry, rows22);
       verdicts.push({
         stepId: id,
@@ -4242,7 +4518,7 @@ function replayLedger(g, ledger) {
       });
     } else if (node.kind === "map" && !id.endsWith(".join") && recorded.status === "completed") {
       const entry = node.entry;
-      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctx);
+      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctxFor(id));
       const local = "error" in resolved ? {
         error: resolved.error,
         key: resolved.key
@@ -4257,7 +4533,7 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "foreach") {
       const entry = node.entry;
       const source = node.dependsOn[0];
-      const items = source ? stepResults[source] : void 0;
+      const items = source ? ctxFor(id).stepResults[source] : void 0;
       const local = Array.isArray(items) ? items.length : void 0;
       const recordedCount = recorded.itemCount ?? countChildren(entry, rows22);
       verdicts.push({
@@ -4274,6 +4550,71 @@ function replayLedger(g, ledger) {
     diverged: verdicts.some((v) => v.diverged)
   };
 }
+function replayResultOf(row2, node) {
+  if (!row2) return void 0;
+  if (row2.status === "completed") return {
+    value: row2.output
+  };
+  if (row2.status === "failed") {
+    const onError = row2.onError ?? node?.entry?.onError;
+    if (onError === "continue") return {
+      value: continuedFailureValue(row2.error, row2.killReason)
+    };
+  }
+  return void 0;
+}
+function ancestorResults(plan, id, rows22) {
+  const out = {};
+  const joinAliased = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const take = /* @__PURE__ */ __name3((rowId) => {
+    const hit = replayResultOf(rows22.get(rowId), plan.steps[rowId]);
+    if (!hit) return void 0;
+    if (!joinAliased.has(rowId)) out[rowId] = hit.value;
+    const entryId = entryOfJoin(rowId);
+    if (entryId) {
+      out[entryId] = hit.value;
+      joinAliased.add(entryId);
+      const entryNode = plan.steps[entryId];
+      if (entryNode?.kind === "foreach") {
+        const body = branchArmId(entryNode.entry.step);
+        out[body] = hit.value;
+        joinAliased.add(body);
+      }
+    }
+    return hit;
+  }, "take");
+  const walk22 = /* @__PURE__ */ __name3((ids) => {
+    for (const dep of ids) {
+      if (seen.has(dep)) continue;
+      seen.add(dep);
+      take(dep);
+      const node = plan.steps[dep] ?? plan.steps[entryOfJoin(dep) ?? ""];
+      if (!node) continue;
+      if (node.kind === "foreach") {
+        const body = branchArmId(node.entry.step);
+        for (const rowId of rows22.keys()) if (rowId.startsWith(`${body}[`)) take(rowId);
+      } else if (node.kind === "loop") {
+        const body = branchArmId(node.entry.step);
+        let best = -1;
+        for (const rowId of rows22.keys()) {
+          if (!rowId.startsWith(`${body}#`)) continue;
+          const n2 = Number(rowId.slice(body.length + 1));
+          if (!Number.isInteger(n2)) continue;
+          const hit = take(rowId);
+          if (!hit) continue;
+          if (n2 > best) {
+            best = n2;
+            out[body] = hit.value;
+          }
+        }
+      }
+      walk22(node.dependsOn);
+    }
+  }, "walk");
+  walk22(plan.steps[id]?.dependsOn ?? []);
+  return out;
+}
 function inferTaken(entry, rows22) {
   const arms = [
     ...entry.steps,
@@ -4281,16 +4622,16 @@ function inferTaken(entry, rows22) {
       entry.otherwise
     ] : []
   ];
-  return arms.map(armId2).filter((id) => {
+  return arms.map(branchArmId).filter((id) => {
     const r = rows22.get(id);
     return r !== void 0 && r.status !== "skipped" && r.status !== "pending";
   });
 }
 function countChildren(entry, rows22) {
-  const body = armId2(entry.step);
-  let n = 0;
-  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n += 1;
-  return n;
+  const body = branchArmId(entry.step);
+  let n2 = 0;
+  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n2 += 1;
+  return n2;
 }
 function isTerminalRunStatus(status) {
   return TERMINAL.has(status);
@@ -4299,19 +4640,48 @@ function pruneUndefined(o) {
   return Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
 }
 function runNextAction(run) {
-  if (isTerminalRunStatus(run.status) || !run.cancel?.requestedAt) return "none";
+  if (isTerminalRunStatus(run.status)) return "none";
+  if (run.status === "suspended" && run.gate?.kind === "budget") return "raise_budget";
+  if (!run.cancel?.requestedAt) return "none";
   const forceAt = run.cancel.forceAfter ?? run.cancel.requestedAt + FORCE_CANCEL_STALE_MS;
   return Date.now() >= forceAt ? "force" : "cancel_again";
 }
+function emptyRunCounts() {
+  const out = {
+    total: 0,
+    inFlight: 0
+  };
+  for (const status of WORKFLOW_STEP_STATUSES) out[status] = 0;
+  return out;
+}
+function runCountsFromStatusTally(tally) {
+  const out = emptyRunCounts();
+  for (const [status, n2] of Object.entries(tally)) {
+    if (!Number.isFinite(n2) || n2 <= 0) continue;
+    out.total += n2;
+    if (WORKFLOW_STEP_STATUSES.includes(status)) out[status] += n2;
+    if (IN_FLIGHT.has(status)) out.inFlight += n2;
+  }
+  return out;
+}
+function runCountsFromStepStatuses(statuses) {
+  const tally = {};
+  for (const s of statuses) tally[s] = (tally[s] ?? 0) + 1;
+  return runCountsFromStatusTally(tally);
+}
 function runCounts(counts) {
+  const c = counts ?? {};
+  const rawInFlight = c.dispatched !== void 0 || c.claimed !== void 0 || c.running !== void 0 || c.cancellation_requested !== void 0;
   return {
-    total: counts?.total ?? 0,
-    completed: counts?.completed ?? 0,
-    failed: counts?.failed ?? 0,
-    skipped: counts?.skipped ?? 0,
-    running: counts?.inFlight ?? 0,
-    suspended: counts?.suspended ?? 0,
-    pending: (counts?.pending ?? 0) + (counts?.ready ?? 0) + (counts?.waiting ?? 0)
+    total: n(c.total),
+    completed: n(c.completed),
+    failed: n(c.failed) + n(c.timeout) + n(c.reaped),
+    skipped: n(c.skipped),
+    // LUA-664: cancelled rows never ran — their own wire bucket, never a failure (the detail's map, verbatim).
+    cancelled: n(c.cancelled),
+    running: rawInFlight ? n(c.dispatched) + n(c.claimed) + n(c.running) + n(c.cancellation_requested) : n(c.inFlight),
+    suspended: n(c.suspended),
+    pending: n(c.pending) + n(c.ready) + n(c.waiting)
   };
 }
 function runUsage(run) {
@@ -4335,7 +4705,7 @@ function runWorkspaceView(ws) {
   if (!ws) return void 0;
   const w = ws;
   return pruneUndefined({
-    kind: w.kind ?? "empty",
+    kind: w.spec?.kind ?? w.kind ?? "empty",
     backend: w.backend,
     status: String(w.status ?? ""),
     branch: w.branch,
@@ -4397,7 +4767,10 @@ function toWorkflowRunSummary(run) {
     eventSeq: run.eventSeq ?? 0,
     cancellable: !isTerminalRunStatus(status),
     nextAction: runNextAction(run),
-    workspace: runWorkspaceView(run.workspace)
+    workspace: runWorkspaceView(run.workspace),
+    // LUA-643: the runs list says a result exists; R4 `fields:'full'` (output-ACL gated, audited) serves it. The
+    // stamped flag is what a list page carries (it projects `output` out); the payload members cover R4's full row.
+    hasOutput: run.hasOutput === true || run.output !== void 0 || run.outputRef !== void 0 ? true : void 0
   });
 }
 function timeZoneSupported(tz) {
@@ -5092,8 +5465,8 @@ function armEntry(arm) {
 }
 function ofEntry(e) {
   if (!e || typeof e !== "object") return ZERO;
-  const n = e;
-  switch (n.type) {
+  const n2 = e;
+  switch (n2.type) {
     case "agent":
       return {
         steps: {
@@ -5126,17 +5499,17 @@ function ofEntry(e) {
         agentCalls: 0
       };
     case "parallel": {
-      const arms = Array.isArray(n.steps) ? n.steps : [];
+      const arms = Array.isArray(n2.steps) ? n2.steps : [];
       return arms.map(armEntry).map(ofEntry).reduce(add, ZERO);
     }
     case "conditional": {
-      const arms = (Array.isArray(n.steps) ? n.steps : []).map(armEntry).map(ofEntry);
+      const arms = (Array.isArray(n2.steps) ? n2.steps : []).map(armEntry).map(ofEntry);
       if (arms.length === 0) return ZERO;
-      const hasOtherwise = n.otherwise !== void 0;
+      const hasOtherwise = n2.otherwise !== void 0;
       const minArm = arms.reduce((a, b) => b.credits.min < a.credits.min ? b : a);
       const maxArm = arms.reduce((a, b) => b.credits.max > a.credits.max ? b : a);
       const summed = arms.reduce(add, ZERO);
-      const max = n.exclusive === true ? maxArm : summed;
+      const max = n2.exclusive === true ? maxArm : summed;
       const min = hasOtherwise ? minArm : {
         ...ZERO
       };
@@ -5153,17 +5526,14 @@ function ofEntry(e) {
       };
     }
     case "foreach": {
-      const body = ofEntry(armEntry(n.step));
-      const opts = n.options ?? {};
-      const cap = typeof opts.maxItems === "number" && opts.maxItems > 0 ? opts.maxItems : 1;
+      const body = ofEntry(armEntry(n2.step));
+      const opts = n2.opts ?? {};
+      const cap = typeof opts.maxItems === "number" && opts.maxItems > 0 ? opts.maxItems : WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS;
       return scale(body, 0, cap);
     }
-    case "loop":
-    case "dowhile":
-    case "dountil": {
-      const body = ofEntry(armEntry(n.step));
-      const opts = n.options ?? {};
-      const cap = typeof opts.maxIterations === "number" && opts.maxIterations > 0 ? opts.maxIterations : 1;
+    case "loop": {
+      const body = ofEntry(armEntry(n2.step));
+      const cap = typeof n2.maxIterations === "number" && n2.maxIterations > 0 ? n2.maxIterations : WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS;
       return scale(body, 1, cap);
     }
     default:
@@ -5194,14 +5564,84 @@ function estimateGraph(envelopeOrGraph) {
     consentCredits: r.credits.max
   };
 }
-var __defProp3, __name3, WORKFLOW_ARM_SUBRUN_ID, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, GRAPH_HASH_PREFIX, WorkflowPlanError, SINGLE_STEP_KINDS, isSingleStep, singleStepId, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, nodeIdOf, armId2, canonical, sortKeys, FORCE_CANCEL_STALE_MS, TERMINAL, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO;
+function* singleStepsOf(entry) {
+  if (!isRecord2(entry)) return;
+  switch (entry.type) {
+    case "step":
+    case "agent":
+    case "tool":
+      yield entry;
+      return;
+    case "workflow":
+      yield entry;
+      if (Array.isArray(entry.graph)) yield* singleStepsOf(entry.graph[1]);
+      return;
+    case "parallel":
+    case "conditional":
+      if (Array.isArray(entry.steps)) for (const arm of entry.steps) yield* singleStepsOf(arm);
+      yield* singleStepsOf(entry.otherwise);
+      return;
+    case "foreach":
+    case "loop":
+      yield* singleStepsOf(entry.step);
+      return;
+    default:
+      return;
+  }
+}
+function entriesOf(graph) {
+  const definition = isRecord2(graph) ? graph.definition : void 0;
+  const entries = isRecord2(definition) ? definition.graph : void 0;
+  return Array.isArray(entries) ? entries : [];
+}
+function inheritTargets(graphs) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const graph of graphs) {
+    for (const entry of entriesOf(graph)) {
+      for (const node of singleStepsOf(entry)) {
+        if (node.type === "workflow" && node.workspace === "inherit" && typeof node.workflowId === "string" && node.workflowId.length > 0) {
+          targets.add(node.workflowId);
+        }
+      }
+    }
+  }
+  return targets;
+}
+function needsInheritedWorkspace(graph) {
+  if (!isRecord2(graph) || graph.workspace !== void 0) return false;
+  for (const entry of entriesOf(graph)) {
+    for (const node of singleStepsOf(entry)) {
+      if (node.workspace !== void 0 && node.workspace !== "inherit") return true;
+    }
+  }
+  return false;
+}
+var __defProp3, __name3, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RESOURCES, SideEffectsSchema, JobResourcesSchema, WORKFLOW_ARM_SUBRUN_ID, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, SINGLE_STEP_KINDS, isSingleStep, singleStepId, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, nodeIdOf, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, IN_FLIGHT, n, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
     init_dist();
+    init_dist();
     __defProp3 = Object.defineProperty;
     __name3 = /* @__PURE__ */ __name((target, value22) => __defProp3(target, "name", { value: value22, configurable: true }), "__name");
+    WORKFLOW_SIDE_EFFECTS = [
+      "none",
+      "external"
+    ];
+    WORKFLOW_JOB_RESOURCES = [
+      "small",
+      "medium",
+      "large"
+    ];
+    SideEffectsSchema = z6.enum(WORKFLOW_SIDE_EFFECTS);
+    JobResourcesSchema = z6.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_ARM_SUBRUN_ID = "$arm";
+    SLEEP_UNTIL_REPLACEMENT = Object.freeze({
+      type: "sleep",
+      duration: 6e4
+    });
+    __name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+    __name3(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
     WORKFLOW_CAPS_DEFAULT = Object.freeze({
       maxParallelArms: 16,
       maxForeachConcurrency: 16,
@@ -5237,6 +5677,11 @@ var init_dist2 = __esm({
     __name3(fillEntry, "fillEntry");
     __name(withDefaultsFilled, "withDefaultsFilled");
     __name3(withDefaultsFilled, "withDefaultsFilled");
+    CONNECTION_ID_HEX_RE = /^[0-9a-f]{24}$/;
+    __name(isConnectionKeyShaped, "isConnectionKeyShaped");
+    __name3(isConnectionKeyShaped, "isConnectionKeyShaped");
+    __name(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
+    __name3(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
     WORKFLOW_JOB_TOOLS = [
       "shell",
       "read",
@@ -5300,6 +5745,11 @@ var init_dist2 = __esm({
     ]);
     __name(isPredicate, "isPredicate");
     __name3(isPredicate, "isPredicate");
+    isPredicateScalar = /* @__PURE__ */ __name3((v) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean", "isPredicateScalar");
+    __name(isPathOrLiteral, "isPathOrLiteral");
+    __name3(isPathOrLiteral, "isPathOrLiteral");
+    __name(isWellFormedPredicate, "isWellFormedPredicate");
+    __name3(isWellFormedPredicate, "isWellFormedPredicate");
     GRAPH_HASH_PREFIX = "sha256-cj1:";
     __name(canonicalJson, "canonicalJson");
     __name3(canonicalJson, "canonicalJson");
@@ -5488,16 +5938,71 @@ var init_dist2 = __esm({
     fromKnowledge = /* @__PURE__ */ __name3((k) => ({
       knowledge: k
     }), "fromKnowledge");
+    CONTINUED_FAILURE_TAG = "continued_failure";
+    CONTINUED_FAILURE_DEFAULT_CODE = "step_failed";
+    CONTINUED_FAILURE_OUTPUT_SCHEMA = Object.freeze({
+      type: "object",
+      properties: {
+        __lua_workflow: {
+          type: "string",
+          const: CONTINUED_FAILURE_TAG
+        },
+        failed: {
+          type: "boolean",
+          const: true
+        },
+        error: {
+          type: "object",
+          properties: {
+            code: {
+              type: "string"
+            },
+            message: {
+              type: "string"
+            }
+          },
+          required: [
+            "code",
+            "message"
+          ]
+        },
+        text: {
+          type: "string",
+          const: ""
+        }
+      },
+      required: [
+        "__lua_workflow",
+        "failed",
+        "error",
+        "text"
+      ]
+    });
+    CONTINUED_FAILURE_LEAF_PATHS = Object.freeze([
+      "failed",
+      "error",
+      "error.code",
+      "error.message",
+      "text"
+    ]);
+    __name(continuedFailureValue, "continuedFailureValue");
+    __name3(continuedFailureValue, "continuedFailureValue");
+    __name(isContinuedFailureValue, "isContinuedFailureValue");
+    __name3(isContinuedFailureValue, "isContinuedFailureValue");
     __name(lowerContainerArm, "lowerContainerArm");
     __name3(lowerContainerArm, "lowerContainerArm");
-    nodeIdOf = /* @__PURE__ */ __name3((n) => n.type === "step" ? n.step.id : n.id, "nodeIdOf");
+    nodeIdOf = /* @__PURE__ */ __name3((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
     __name(entryIds, "entryIds");
     __name3(entryIds, "entryIds");
     __name(resolvePlacements, "resolvePlacements");
     __name3(resolvePlacements, "resolvePlacements");
     __name(seedLedgerFromRun, "seedLedgerFromRun");
     __name3(seedLedgerFromRun, "seedLedgerFromRun");
-    armId2 = /* @__PURE__ */ __name3((arm) => arm.type === "step" ? arm.step.id : arm.id, "armId");
+    branchArmId = /* @__PURE__ */ __name3((arm) => arm.type === "step" ? arm.step.id : arm.id, "branchArmId");
+    __name(branchSpecFromConditional, "branchSpecFromConditional");
+    __name3(branchSpecFromConditional, "branchSpecFromConditional");
+    __name(selectBranchArms, "selectBranchArms");
+    __name3(selectBranchArms, "selectBranchArms");
     canonical = /* @__PURE__ */ __name3((v) => JSON.stringify(sortKeys(v)), "canonical");
     sortKeys = /* @__PURE__ */ __name3((v) => {
       if (Array.isArray(v)) return v.map(sortKeys);
@@ -5511,6 +6016,12 @@ var init_dist2 = __esm({
     }, "sortKeys");
     __name(replayLedger, "replayLedger");
     __name3(replayLedger, "replayLedger");
+    JOIN = ".join";
+    entryOfJoin = /* @__PURE__ */ __name3((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+    __name(replayResultOf, "replayResultOf");
+    __name3(replayResultOf, "replayResultOf");
+    __name(ancestorResults, "ancestorResults");
+    __name3(ancestorResults, "ancestorResults");
     __name(inferTaken, "inferTaken");
     __name3(inferTaken, "inferTaken");
     __name(countChildren, "countChildren");
@@ -5523,6 +6034,14 @@ var init_dist2 = __esm({
     __name3(pruneUndefined, "pruneUndefined");
     __name(runNextAction, "runNextAction");
     __name3(runNextAction, "runNextAction");
+    IN_FLIGHT = new Set(WORKFLOW_STEP_IN_FLIGHT);
+    __name(emptyRunCounts, "emptyRunCounts");
+    __name3(emptyRunCounts, "emptyRunCounts");
+    __name(runCountsFromStatusTally, "runCountsFromStatusTally");
+    __name3(runCountsFromStatusTally, "runCountsFromStatusTally");
+    __name(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+    __name3(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+    n = /* @__PURE__ */ __name3((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
     __name(runCounts, "runCounts");
     __name3(runCounts, "runCounts");
     __name(runUsage, "runUsage");
@@ -5626,54 +6145,54 @@ var init_dist2 = __esm({
     __name3(rebaseItemPointer, "rebaseItemPointer");
     APPROVER_SPEC_MAX_USERS = 20;
     ESCALATION_MAX_HOPS = 3;
-    TemplateBindingSchema = z6.object({
-      template: z6.string().min(1).max(2048)
+    TemplateBindingSchema = z22.object({
+      template: z22.string().min(1).max(2048)
     }).strict();
-    ApproverSpecSchema = z6.union([
-      z6.literal("creator"),
-      z6.literal("org-admins"),
-      z6.object({
-        users: z6.union([
-          z6.array(z6.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
+    ApproverSpecSchema = z22.union([
+      z22.literal("creator"),
+      z22.literal("org-admins"),
+      z22.object({
+        users: z22.union([
+          z22.array(z22.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
           TemplateBindingSchema
         ])
       }).strict(),
-      z6.object({
-        role: z6.union([
-          z6.string().min(1).max(128),
+      z22.object({
+        role: z22.union([
+          z22.string().min(1).max(128),
           TemplateBindingSchema
         ])
       }).strict(),
-      z6.object({
-        group: z6.union([
-          z6.string().min(1).max(128),
+      z22.object({
+        group: z22.union([
+          z22.string().min(1).max(128),
           TemplateBindingSchema
         ])
       }).strict(),
-      z6.object({
-        governance: z6.object({
-          policyId: z6.string().min(1).max(128)
+      z22.object({
+        governance: z22.object({
+          policyId: z22.string().min(1).max(128)
         }).strict()
       }).strict()
     ]);
-    FourEyesSchema = z6.object({
+    FourEyesSchema = z22.object({
       edit: ApproverSpecSchema,
       approve: ApproverSpecSchema
     }).strict();
-    EscalationHopSchema = z6.object({
+    EscalationHopSchema = z22.object({
       escalateTo: ApproverSpecSchema,
-      timeoutHours: z6.number().finite().min(1).max(720)
+      timeoutHours: z22.number().finite().min(1).max(720)
     }).strict();
-    TerminalOutcomeSchema = z6.enum([
+    TerminalOutcomeSchema = z22.enum([
       "deny",
       "cancel-run",
       "fail",
       "continue"
     ]);
-    ApprovalOnTimeoutSchema = z6.union([
+    ApprovalOnTimeoutSchema = z22.union([
       TerminalOutcomeSchema,
       EscalationHopSchema,
-      z6.array(z6.union([
+      z22.array(z22.union([
         TerminalOutcomeSchema,
         EscalationHopSchema
       ])).min(1).max(ESCALATION_MAX_HOPS + 1)
@@ -5726,6 +6245,15 @@ var init_dist2 = __esm({
     __name3(ofEntry, "ofEntry");
     __name(estimateGraph, "estimateGraph");
     __name3(estimateGraph, "estimateGraph");
+    isRecord2 = /* @__PURE__ */ __name3((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
+    __name(singleStepsOf, "singleStepsOf");
+    __name3(singleStepsOf, "singleStepsOf");
+    __name(entriesOf, "entriesOf");
+    __name3(entriesOf, "entriesOf");
+    __name(inheritTargets, "inheritTargets");
+    __name3(inheritTargets, "inheritTargets");
+    __name(needsInheritedWorkspace, "needsInheritedWorkspace");
+    __name3(needsInheritedWorkspace, "needsInheritedWorkspace");
   }
 });
 
@@ -5784,16 +6312,16 @@ function stepNodeOf(s) {
   });
 }
 function materializeEntry(entry, steps) {
-  const single = /* @__PURE__ */ __name((n) => {
-    if (n.type === "step" && steps[n.step.id]) return stepNodeOf(steps[n.step.id]);
-    if (n.type === "workflow" && n.workflowId === WORKFLOW_ARM_SUBRUN_ID && n.graph) return {
-      ...n,
+  const single = /* @__PURE__ */ __name((n2) => {
+    if (n2.type === "step" && steps[n2.step.id]) return stepNodeOf(steps[n2.step.id]);
+    if (n2.type === "workflow" && n2.workflowId === WORKFLOW_ARM_SUBRUN_ID && n2.graph) return {
+      ...n2,
       graph: [
-        n.graph[0],
-        single(n.graph[1])
+        n2.graph[0],
+        single(n2.graph[1])
       ]
     };
-    return n;
+    return n2;
   }, "single");
   switch (entry.type) {
     case "step":
@@ -5838,8 +6366,8 @@ function createWorkflow(cfg) {
     if (v.roles.length > 20 || (v.users?.length ?? 0) > 50) throw new LuaWorkflowBuildError("cap-exceeded", "outputVisibility allows \u2264 20 roles and \u2264 50 users");
   }
   if (cfg.backfillOnEnable?.maxOccurrences !== void 0) {
-    const n = cfg.backfillOnEnable.maxOccurrences;
-    if (!Number.isInteger(n) || n < 1 || n > 200) throw new LuaWorkflowBuildError("invalid-envelope", "backfillOnEnable.maxOccurrences must be an integer in 1..200 (backfill-max-occurrences-out-of-range; the org maxBatchItems twin is checked at publish/R56)");
+    const n2 = cfg.backfillOnEnable.maxOccurrences;
+    if (!Number.isInteger(n2) || n2 < 1 || n2 > 200) throw new LuaWorkflowBuildError("invalid-envelope", "backfillOnEnable.maxOccurrences must be an integer in 1..200 (backfill-max-occurrences-out-of-range; the org maxBatchItems twin is checked at publish/R56)");
   }
   const keys = /* @__PURE__ */ new Set();
   envRefKeys(cfg.schedule, keys);
@@ -6033,7 +6561,7 @@ var init_workflow = __esm({
       getEnvTemplateKeys() {
         return this.built.envTemplateKeys;
       }
-      /** `.workflow(id, ref)` targets by name — `ManifestWorkflow.workflowRefs`. */
+      /** `.workflow(id, ref)` targets by name — `ManifestWorkflow.workflowRefs`; `workspace:'inherit'` marks the inherit children the compiler defers `workspace-not-declared` for. */
       getNestedWorkflowRefs() {
         return this.built.nestedRefs;
       }
@@ -6063,6 +6591,7 @@ var init_workflow = __esm({
         };
         if (cfg.concurrencyPolicy !== void 0) envelope.concurrencyPolicy = cfg.concurrencyPolicy;
         if (cfg.workspace !== void 0) envelope.workspace = cfg.workspace;
+        if (cfg.connections !== void 0) envelope.connections = cfg.connections;
         return withDefaultsFilled(envelope);
       }
     };
@@ -6098,7 +6627,6 @@ var init_workflow = __esm({
         if (this.steps[s.id] && this.steps[s.id] !== s) throw new LuaWorkflowBuildError("duplicate-step-id", `step id "${s.id}" is declared twice`);
         const tier = s.tier ?? (s.workspace ? "job" : void 0);
         if (s.workspace && s.tier !== void 0 && s.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${s.id}": a step mounting a workspace must be tier:'job'`);
-        if (s.workspace && !this.config.workspace) throw new LuaWorkflowBuildError("workspace-not-declared", `"${s.id}" mounts a workspace but createWorkflow declares none`);
         if (s.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${s.id}": jobTools require tier:'job' (job-tools-require-job-tier)`);
         assertTimeout({
           id: s.id,
@@ -6339,13 +6867,20 @@ var init_workflow = __esm({
         }
         const tier = opts.tier ?? (opts.workspace ? "job" : void 0);
         if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id}": a step mounting a workspace must be tier:'job'`);
-        if (opts.workspace && !this.config.workspace) throw new LuaWorkflowBuildError("workspace-not-declared", `"${id}" mounts a workspace but createWorkflow declares none`);
         if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id}": harness is only legal on a tier:'job' agent step`);
         if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
         if (opts.maxTurns !== void 0) {
           if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": maxTurns is only legal on a tier:'job' agent step`);
           if (!Number.isInteger(opts.maxTurns) || opts.maxTurns < 1 || opts.maxTurns > 500) throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": maxTurns must be an integer 1..500`);
         }
+        if (opts.maxMessages !== void 0) {
+          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": maxMessages is only legal on a tier:'job' agent step`);
+          if (!Number.isInteger(opts.maxMessages) || opts.maxMessages < 1 || opts.maxMessages > 5e3) throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": maxMessages must be an integer 1..5000`);
+        }
+        if (opts.maxInputTokens !== void 0) {
+          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": maxInputTokens is only legal on a tier:'job' agent step`);
+          if (!Number.isInteger(opts.maxInputTokens) || opts.maxInputTokens < 1e6 || opts.maxInputTokens > 5e8) throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": maxInputTokens must be an integer 1000000..500000000`);
+        }
         assertTimeout({
           id,
           timeoutSeconds: opts.timeoutSeconds,
@@ -6372,7 +6907,9 @@ var init_workflow = __esm({
           workspace: opts.workspace,
           jobResources: opts.jobResources,
           harness: opts.harness,
-          maxTurns: opts.maxTurns
+          maxTurns: opts.maxTurns,
+          maxMessages: opts.maxMessages,
+          maxInputTokens: opts.maxInputTokens
         });
         return this.push({
           kind: "declare",
@@ -6527,7 +7064,11 @@ var init_workflow = __esm({
         }
         assertNoClosure(input, `workflow("${id}").input`);
         this.recordEnvRefs(input);
-        this.nestedRefs.push({
+        this.nestedRefs.push(opts?.workspace === "inherit" ? {
+          id,
+          name,
+          workspace: "inherit"
+        } : {
           id,
           name
         });
@@ -6539,8 +7080,8 @@ var init_workflow = __esm({
           workspace: opts?.workspace
         });
         return this.push({
-          kind: "entry",
-          entry: node
+          kind: "declare",
+          node
         });
       }
       commit() {
@@ -6550,7 +7091,7 @@ var init_workflow = __esm({
         const { graph, issues } = resolvePlacements(this.calls);
         const fatal = issues[0];
         if (fatal) {
-          const hint = fatal.code === "unknown-step-ref" ? "a string StepRef must name an entry declared by agentStep/specialistStep/toolStep/map(\u2026, { id }) somewhere in the chain \u2014 before OR after the reference" : void 0;
+          const hint = fatal.code === "unknown-step-ref" ? "a string StepRef must name an entry declared by agentStep/specialistStep/toolStep/map(\u2026, { id })/workflow(\u2026) somewhere in the chain \u2014 before OR after the reference" : void 0;
           throw new LuaWorkflowBuildError(fatal.code, fatal.message, hint);
         }
         if (graph.length === 0) throw new LuaWorkflowBuildError("empty-graph", `workflow "${this.config.name}" has no entries`);
@@ -6563,7 +7104,8 @@ var init_workflow = __esm({
         if (graphHasHitl(graph, this.steps) && this.config.budget?.maxDurationSeconds === void 0) {
           this.warnings.push({
             code: "hitl-duration-defaulted",
-            message: `budget.maxDurationSeconds defaulted to ${WORKFLOW_HITL_MAX_DURATION_SECONDS} s (30 d) because the graph contains an approval / waitForSignal / suspend-capable step \u2014 set it explicitly to silence`
+            // LUA-668: names the workflow — two HITL workflows in one project printed two identical lines that read as a duplicate.
+            message: `workflow "${this.config.name}": budget.maxDurationSeconds defaulted to ${WORKFLOW_HITL_MAX_DURATION_SECONDS} s (30 d) because the graph contains an approval / waitForSignal / suspend-capable step \u2014 set it explicitly to silence`
           });
         }
         this.checkScheduleInput();
@@ -12276,7 +12818,7 @@ function findFileLevelImport(node, state3) {
   for (const importDecl of sourceFile.getImportDeclarations()) {
     const defaultImport = importDecl.getDefaultImport();
     const matchesDefault = defaultImport?.getText() === name;
-    const matchesNamed = importDecl.getNamedImports().some((n) => (n.getAliasNode()?.getText() ?? n.getName()) === name);
+    const matchesNamed = importDecl.getNamedImports().some((n2) => (n2.getAliasNode()?.getText() ?? n2.getName()) === name);
     if (!matchesDefault && !matchesNamed) continue;
     const target = loadImportTarget(importDecl, state3, sourceFile.getFilePath());
     if (!target) return void 0;
@@ -13783,13 +14325,13 @@ function rewritePrimitiveSource(metadata, opts) {
     }
   });
   const sf = localProject.createSourceFile(`__rewrite_${metadata.kind}_${metadata.name}.ts`, sourceCode);
-  const isPrimitiveCall = /* @__PURE__ */ __name((n) => {
-    if (Node15.isNewExpression(n)) {
-      const callee = n.getExpression();
+  const isPrimitiveCall = /* @__PURE__ */ __name((n2) => {
+    if (Node15.isNewExpression(n2)) {
+      const callee = n2.getExpression();
       return Node15.isIdentifier(callee) && opts.constructorNames.includes(callee.getText());
     }
-    if (Node15.isCallExpression(n)) {
-      const callee = n.getExpression();
+    if (Node15.isCallExpression(n2)) {
+      const callee = n2.getExpression();
       return Node15.isIdentifier(callee) && opts.defineFunctionName !== void 0 && callee.getText() === opts.defineFunctionName;
     }
     return false;
@@ -13807,9 +14349,9 @@ function rewritePrimitiveSource(metadata, opts) {
     compilerVersion: COMPILER_VERSION
   });
   callNode.replaceWithText(synthesized);
-  sf.forEachDescendant((n) => {
-    if (n === callNode) return;
-    if (isPrimitiveCall(n)) n.replaceWithText("undefined");
+  sf.forEachDescendant((n2) => {
+    if (n2 === callNode) return;
+    if (isPrimitiveCall(n2)) n2.replaceWithText("undefined");
   });
   rewriteCrossFileCallsInSourceFile(sf, opts.crossFileSpecs, opts.sdkBaseClassNames);
   stripLuaCliImports(sf);
@@ -13879,14 +14421,14 @@ function stripSdkExtendsClauses(sf, sdkBaseClassNames, aliasMap, specs) {
     const canonical2 = matchSdkClass(expr.getText());
     if (canonical2) strip(classDecl, canonical2);
   }
-  sf.forEachDescendant((n) => {
-    if (!Node15.isClassExpression(n)) return;
-    const ext = n.getExtends();
+  sf.forEachDescendant((n2) => {
+    if (!Node15.isClassExpression(n2)) return;
+    const ext = n2.getExtends();
     if (!ext) return;
     const expr = ext.getExpression();
     if (!Node15.isIdentifier(expr)) return;
     const canonical2 = matchSdkClass(expr.getText());
-    if (canonical2) strip(n, canonical2);
+    if (canonical2) strip(n2, canonical2);
   });
 }
 function stripDroppedClassMembers(classNode, dropNames) {
@@ -13894,9 +14436,9 @@ function stripDroppedClassMembers(classNode, dropNames) {
     if (dropNames.has(prop.getName())) prop.remove();
   }
   const statements = [];
-  classNode.forEachDescendant((n) => {
-    if (!Node15.isExpressionStatement(n)) return;
-    if (isThisRootedCallTo(n.getExpression(), dropNames)) statements.push(n);
+  classNode.forEachDescendant((n2) => {
+    if (!Node15.isExpressionStatement(n2)) return;
+    if (isThisRootedCallTo(n2.getExpression(), dropNames)) statements.push(n2);
   });
   for (const stmt of statements) stmt.remove();
 }
@@ -13929,13 +14471,13 @@ function stripSuperCallsInConstructors(classNode) {
 }
 function warnRemainingSuperReferences(classNode) {
   const sf = classNode.getSourceFile();
-  classNode.forEachDescendant((n) => {
-    if (n.getKind() !== ts3.SyntaxKind.SuperKeyword) return;
-    const parent = n.getParent();
-    if (parent && Node15.isCallExpression(parent) && parent.getExpression() === n && Node15.isExpressionStatement(parent.getParent())) {
+  classNode.forEachDescendant((n2) => {
+    if (n2.getKind() !== ts3.SyntaxKind.SuperKeyword) return;
+    const parent = n2.getParent();
+    if (parent && Node15.isCallExpression(parent) && parent.getExpression() === n2 && Node15.isExpressionStatement(parent.getParent())) {
       return;
     }
-    const pos = sf.getLineAndColumnAtPos(n.getStart());
+    const pos = sf.getLineAndColumnAtPos(n2.getStart());
     console.warn(formatSarifWarning({
       ruleId: "lua/orphan-super-reference",
       filePath: sf.getFilePath(),
@@ -13979,24 +14521,24 @@ function buildSdkAliasMap(sf, sdkIdentifiers) {
 }
 function findFirstCrossFileSdkCall(sf, specs, aliasMap) {
   let found;
-  sf.forEachDescendant((n) => {
+  sf.forEachDescendant((n2) => {
     if (found) return;
-    if (Node15.isNewExpression(n)) {
-      const callee = n.getExpression();
+    if (Node15.isNewExpression(n2)) {
+      const callee = n2.getExpression();
       if (!Node15.isIdentifier(callee)) return;
       const canonical2 = aliasMap.get(callee.getText()) ?? callee.getText();
       const spec = specs.find((s) => s.classNames.includes(canonical2));
       if (spec) found = {
-        node: n,
+        node: n2,
         spec
       };
-    } else if (Node15.isCallExpression(n)) {
-      const callee = n.getExpression();
+    } else if (Node15.isCallExpression(n2)) {
+      const callee = n2.getExpression();
       if (!Node15.isIdentifier(callee)) return;
       const canonical2 = aliasMap.get(callee.getText()) ?? callee.getText();
       const spec = specs.find((s) => s.defineFunction !== void 0 && s.defineFunction === canonical2);
       if (spec) found = {
-        node: n,
+        node: n2,
         spec
       };
     }
@@ -15020,14 +15562,14 @@ function buildSandboxRequire(opts) {
 function v4ToInt(ip) {
   const parts = ip.split(".");
   if (parts.length !== 4) return null;
-  let n = 0;
+  let n2 = 0;
   for (const p of parts) {
     if (!/^\d{1,3}$/.test(p)) return null;
     const v = Number(p);
     if (v > 255) return null;
-    n = n * 256 + v;
+    n2 = n2 * 256 + v;
   }
-  return n;
+  return n2;
 }
 function range(cidr, klass) {
   const [ip, prefix] = cidr.split("/");
@@ -15037,10 +15579,10 @@ function range(cidr, klass) {
     klass
   };
 }
-function inRange(n, r) {
+function inRange(n2, r) {
   if (r.prefix === 0) return true;
   const shift = 32 - r.prefix;
-  return Math.floor(n / 2 ** shift) === Math.floor(r.base / 2 ** shift);
+  return Math.floor(n2 / 2 ** shift) === Math.floor(r.base / 2 ** shift);
 }
 function mappedV4(address) {
   const m = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(address.trim());
@@ -15049,9 +15591,9 @@ function mappedV4(address) {
 function classifyPrivateAddress(address) {
   const v4 = net.isIPv4(address) ? address : mappedV4(address);
   if (!v4) return null;
-  const n = v4ToInt(v4);
-  if (n === null) return null;
-  for (const r of PRIVATE_RANGES) if (inRange(n, r)) return r.klass;
+  const n2 = v4ToInt(v4);
+  if (n2 === null) return null;
+  for (const r of PRIVATE_RANGES) if (inRange(n2, r)) return r.klass;
   return null;
 }
 function egressDeniedMessage(host) {
@@ -15072,12 +15614,12 @@ function isEgressDeniedError(err) {
 }
 function resolveEgressProbeMs(env = process.env) {
   const raw = env.LUA_SANDBOX_EGRESS_PROBE_MS;
-  const n = raw !== void 0 && raw !== "" ? Number.parseInt(raw, 10) : NaN;
-  return Number.isInteger(n) && n > 0 ? n : EGRESS_PROBE_DEFAULT_MS;
+  const n2 = raw !== void 0 && raw !== "" ? Number.parseInt(raw, 10) : NaN;
+  return Number.isInteger(n2) && n2 > 0 ? n2 : EGRESS_PROBE_DEFAULT_MS;
 }
 function ipv4ToInt(ip) {
   const parts = ip.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
+  if (parts.length !== 4 || parts.some((n2) => Number.isNaN(n2) || n2 < 0 || n2 > 255)) {
     throw new Error(`Invalid IPv4: ${ip}`);
   }
   return (parts[0] << 24 >>> 0) + (parts[1] << 16) + (parts[2] << 8) + parts[3];
@@ -16742,6 +17284,7 @@ function serializeViaVm(bundleCode, opts = {}) {
           ...templateKeys
         ].sort(),
         workflowRefs: (wf?.getNestedWorkflowRefs() ?? []).map((r) => r.name),
+        inheritRefs: inheritRefsOf(wf),
         buildWarnings: wf?.getBuildWarnings() ?? []
       }
     };
@@ -16825,6 +17368,31 @@ function stepRefId(arg) {
   }
   return void 0;
 }
+function workflowRefName(arg) {
+  if (!arg) return void 0;
+  if (Node17.isStringLiteral(arg) || Node17.isNoSubstitutionTemplateLiteral(arg)) return arg.getLiteralText();
+  if (!Node17.isIdentifier(arg)) return void 0;
+  const decl = resolveIdentifier(arg);
+  const init3 = decl && Node17.isVariableDeclaration(decl) ? decl.getInitializer() : decl;
+  if (!init3 || !Node17.isExpression(init3)) return void 0;
+  const root = chainCalls(init3)[0];
+  const cfg = root && [
+    "createWorkflow",
+    "defineWorkflow"
+  ].includes(calleeName(root)) ? root.getArguments()[0] : void 0;
+  return cfg && Node17.isObjectLiteralExpression(cfg) ? extractStringProperty(cfg, "name") : void 0;
+}
+function sketchInheritRefs(calls) {
+  const out = [];
+  for (const call of calls) {
+    if (calleeName(call) !== "workflow") continue;
+    const [, ref, , opts] = call.getArguments();
+    if (!opts || !Node17.isObjectLiteralExpression(opts) || extractStringProperty(opts, "workspace") !== "inherit") continue;
+    const name = workflowRefName(ref);
+    if (name && !out.includes(name)) out.push(name);
+  }
+  return out;
+}
 function callDeclaredIds(call, mapCounter) {
   const name = calleeName(call);
   const args2 = call.getArguments();
@@ -16976,6 +17544,7 @@ function serializeViaAst(sourceFile, exportName) {
       envKeys: [],
       envTemplateKeys: inst?.getEnvTemplateKeys() ?? [],
       workflowRefs: (inst?.getNestedWorkflowRefs() ?? []).map((r) => r.name),
+      inheritRefs: inheritRefsOf(inst),
       buildWarnings: inst?.getBuildWarnings() ?? []
     };
   } catch {
@@ -17021,6 +17590,7 @@ function sketchTopology(sourceFile, exportName, name, description) {
     envKeys: [],
     envTemplateKeys: [],
     workflowRefs: [],
+    inheritRefs: sketchInheritRefs(calls),
     buildWarnings: [],
     partialNodes: [
       ...seen
@@ -17028,47 +17598,49 @@ function sketchTopology(sourceFile, exportName, name, description) {
   };
 }
 function metaOf(node, sources) {
-  const n = node;
-  const id = n.type === "step" ? n.step.id : n.id;
+  const n2 = node;
+  const id = n2.type === "step" ? n2.step.id : n2.id;
   const meta = {
     id,
-    kind: KIND_OF[n.type] ?? n.type
+    kind: KIND_OF[n2.type] ?? n2.type
   };
   const pick = /* @__PURE__ */ __name((k, v) => {
     if (v !== void 0) meta[k] = v;
   }, "pick");
-  pick("timeoutSeconds", n.timeoutSeconds);
-  pick("retry", n.retry);
-  pick("sideEffects", n.sideEffects);
-  pick("onError", n.onError);
-  pick("requiredConnections", n.requiredConnections);
-  pick("resumeTimeoutHours", n.resumeTimeoutHours);
-  pick("onSuspendTimeout", n.onSuspendTimeout);
-  pick("businessHours", n.businessHours);
-  pick("tier", n.tier);
-  pick("harness", n.harness);
-  pick("workspace", n.workspace);
-  pick("jobResources", n.jobResources);
-  pick("maxTurns", n.maxTurns);
-  if (n.type === "step") {
-    const s = n.step;
+  pick("timeoutSeconds", n2.timeoutSeconds);
+  pick("retry", n2.retry);
+  pick("sideEffects", n2.sideEffects);
+  pick("onError", n2.onError);
+  pick("requiredConnections", n2.requiredConnections);
+  pick("resumeTimeoutHours", n2.resumeTimeoutHours);
+  pick("onSuspendTimeout", n2.onSuspendTimeout);
+  pick("businessHours", n2.businessHours);
+  pick("tier", n2.tier);
+  pick("harness", n2.harness);
+  pick("workspace", n2.workspace);
+  pick("jobResources", n2.jobResources);
+  pick("maxTurns", n2.maxTurns);
+  pick("maxMessages", n2.maxMessages);
+  pick("maxInputTokens", n2.maxInputTokens);
+  if (n2.type === "step") {
+    const s = n2.step;
     pick("inputSchema", s.inputSchema);
     pick("outputSchema", s.outputSchema);
     pick("suspendSchema", s.suspendSchema);
     pick("resumeSchema", s.resumeSchema);
   }
-  if (n.type === "agent") {
-    pick("outputSchema", n.outputSchema);
-    const jobTools = n.toolScope?.jobTools;
+  if (n2.type === "agent") {
+    pick("outputSchema", n2.outputSchema);
+    const jobTools = n2.toolScope?.jobTools;
     pick("jobTools", jobTools);
   }
-  if (n.type === "approval") {
-    pick("editedPayloadSchema", n.editedPayloadSchema);
-    pick("itemsPath", n.itemsPath);
-    pick("itemApprover", n.itemApprover);
-    pick("itemTimeout", n.itemTimeout);
+  if (n2.type === "approval") {
+    pick("editedPayloadSchema", n2.editedPayloadSchema);
+    pick("itemsPath", n2.itemsPath);
+    pick("itemApprover", n2.itemApprover);
+    pick("itemTimeout", n2.itemTimeout);
   }
-  if (n.type === "waitForSignal") pick("outputSchema", n.schema);
+  if (n2.type === "waitForSignal") pick("outputSchema", n2.schema);
   const src = sources.get(id);
   if (src) meta.source = src;
   return meta;
@@ -17108,21 +17680,25 @@ function deriveStepMeta(graph, sources) {
   }
   return out;
 }
-function computeDeferred(graph) {
+function computeDeferred(graph, opts = {}) {
   const deferred = /* @__PURE__ */ new Set();
-  const visit = /* @__PURE__ */ __name((n) => {
-    if (n.type === "agent" && n.agentId === "$self") {
+  let mounts = false;
+  const declaredKeys = new Set((graph.connections ?? []).map((c) => c.key));
+  const serverDecides = /* @__PURE__ */ __name((ref) => typeof ref === "string" && !declaredKeys.has(ref) && !isConnectionKeyShaped(ref), "serverDecides");
+  const visit = /* @__PURE__ */ __name((n2) => {
+    if (n2.type === "agent" && n2.agentId === "$self") {
       deferred.add("ephemeral-tools-not-subset");
       deferred.add("ephemeral-specialists-disabled");
-      if (n.role?.ref) deferred.add("role-ref-unknown");
+      if (n2.role?.ref) deferred.add("role-ref-unknown");
     }
-    if (n.tier === "job") {
+    if (n2.workspace !== void 0 && n2.workspace !== "inherit") mounts = true;
+    if (n2.tier === "job") {
       deferred.add("job-tier-disabled");
       deferred.add("job-tier-provider-unsupported");
     }
-    if (Array.isArray(n.requiredConnections) && n.requiredConnections.length > 0) deferred.add("required-connection-unknown");
-    if (n.type === "approval") {
-      const a = n.approver;
+    if (Array.isArray(n2.requiredConnections) && n2.requiredConnections.some(serverDecides)) deferred.add("required-connection-unknown");
+    if (n2.type === "approval") {
+      const a = n2.approver;
       if (a && typeof a === "object") {
         if ("role" in a) deferred.add("approver-role-unknown");
         if ("users" in a) deferred.add("approver-not-member");
@@ -17130,7 +17706,7 @@ function computeDeferred(graph) {
         if ("governance" in a) deferred.add("approver-governance-unavailable");
       }
     }
-    if (n.type === "foreach") deferred.add("foreach-items-exceed-cap");
+    if (n2.type === "foreach") deferred.add("foreach-items-exceed-cap");
   }, "visit");
   for (const entry of graph.definition.graph) {
     visit(entry);
@@ -17142,16 +17718,20 @@ function computeDeferred(graph) {
     ]) if (child) visit(child);
   }
   const ws = graph.workspace;
-  if (ws?.credentialsRef) deferred.add("credentials-ref-unknown");
+  if (serverDecides(ws?.credentialsRef)) deferred.add("credentials-ref-unknown");
   if (ws?.backend && ws.backend !== "ebs") deferred.add("workspace-backend-unavailable");
+  if (opts.mayInherit && !ws && mounts) deferred.add("workspace-not-declared");
   if (graph.budget && graph.budget.maxCredits !== void 0) deferred.add("budget-exceeds-cap");
   return [
     ...deferred
   ].sort();
 }
-function validateGraph(graph) {
+function validateGraph(graph, opts = {}) {
   return validateLuaExtensions(graph, WORKFLOW_CAPS_DEFAULT, {
-    static: true
+    static: true,
+    ...opts.mayInherit ? {
+      mayInherit: true
+    } : {}
   });
 }
 function stampGraphHash(code, graph) {
@@ -17171,7 +17751,32 @@ function toIssues(issues, sources) {
     source: i.stepId ? sources.get(i.stepId) : void 0
   }));
 }
-var NOT_STATIC, isNotStatic, isBuildError, COMMITTED_WORKFLOW_MEMBERS, isCommittedWorkflow, PLATFORM_GLOBALS, calleeName, KIND_OF, GRAPH_HASH_PLACEHOLDER;
+function applyInheritCandidate(d) {
+  if (d.topology === "sketch") return d;
+  const sources = new Map(d.stepMeta.flatMap((m) => m.source ? [
+    [
+      m.id,
+      m.source
+    ]
+  ] : []));
+  const before = new Set(toIssues(d.validation, sources).map(issueKey));
+  const validation = validateGraph(d.graph, {
+    mayInherit: true
+  });
+  return {
+    ...d,
+    mayInherit: true,
+    validation,
+    issues: [
+      ...d.issues.filter((i) => !before.has(issueKey(i))),
+      ...toIssues(validation, sources)
+    ],
+    deferred: computeDeferred(d.graph, {
+      mayInherit: true
+    })
+  };
+}
+var NOT_STATIC, isNotStatic, isBuildError, inheritRefsOf, COMMITTED_WORKFLOW_MEMBERS, isCommittedWorkflow, PLATFORM_GLOBALS, calleeName, KIND_OF, GRAPH_HASH_PLACEHOLDER, issueKey;
 var init_graph_serializer = __esm({
   "src/compiler/utils/graph-serializer.ts"() {
     "use strict";
@@ -17183,6 +17788,7 @@ var init_graph_serializer = __esm({
     NOT_STATIC = "WORKFLOW_GRAPH_NOT_STATIC";
     isNotStatic = /* @__PURE__ */ __name((e) => typeof e === "object" && e !== null && e.code === NOT_STATIC, "isNotStatic");
     isBuildError = /* @__PURE__ */ __name((e) => e instanceof LuaWorkflowBuildError || typeof e === "object" && e !== null && e.name === "LuaWorkflowBuildError" && typeof e.code === "string", "isBuildError");
+    inheritRefsOf = /* @__PURE__ */ __name((wf) => (wf?.getNestedWorkflowRefs() ?? []).filter((r) => r.workspace === "inherit").map((r) => r.name), "inheritRefsOf");
     COMMITTED_WORKFLOW_MEMBERS = [
       "getName",
       "getBuildWarnings",
@@ -17222,6 +17828,8 @@ var init_graph_serializer = __esm({
       return Node17.isPropertyAccessExpression(callee) ? callee.getName() : callee.getText();
     }, "calleeName");
     __name(stepRefId, "stepRefId");
+    __name(workflowRefName, "workflowRefName");
+    __name(sketchInheritRefs, "sketchInheritRefs");
     __name(callDeclaredIds, "callDeclaredIds");
     __name(stampSources, "stampSources");
     __name(collectBuilderCalls, "collectBuilderCalls");
@@ -17245,6 +17853,13 @@ var init_graph_serializer = __esm({
     GRAPH_HASH_PLACEHOLDER = "__LUA_GRAPH_HASH__";
     __name(stampGraphHash, "stampGraphHash");
     __name(toIssues, "toIssues");
+    issueKey = /* @__PURE__ */ __name((i) => [
+      i.code,
+      i.path ?? "",
+      i.stepId ?? "",
+      i.message
+    ].join("\0"), "issueKey");
+    __name(applyInheritCandidate, "applyInheritCandidate");
   }
 });
 
@@ -17352,7 +17967,7 @@ function collectSingleSteps(graph) {
 }
 function collectGraphIds(graph) {
   const ids = [];
-  const idOf = /* @__PURE__ */ __name((n) => n.type === "step" ? n.step.id : n.id, "idOf");
+  const idOf = /* @__PURE__ */ __name((n2) => n2.type === "step" ? n2.step.id : n2.id, "idOf");
   for (const entry of graph.definition.graph) {
     const e = entry;
     const own = idOf(e);
@@ -17698,6 +18313,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
             envKeys: [],
             envTemplateKeys: [],
             workflowRefs: [],
+            inheritRefs: [],
             buildWarnings: []
           };
           issues.push({
@@ -17719,6 +18335,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
             envKeys: [],
             envTemplateKeys: [],
             workflowRefs: [],
+            inheritRefs: [],
             buildWarnings: []
           };
         }
@@ -17761,7 +18378,9 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
             }
           }
         }
-        const validation = tier.topology === "sketch" ? [] : validateGraph(graph);
+        const validation = tier.topology === "sketch" ? [] : validateGraph(graph, {
+          mayInherit: opts.inheritCandidate
+        });
         issues.push(...toIssues(validation, sources));
         const stamped = stampGraphHash(artifact.code, graph);
         const stampedArtifact = {
@@ -17778,12 +18397,38 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
           envTemplateKeys: tier.envTemplateKeys,
           partialNodes: tier.partialNodes,
           workflowRefs: tier.workflowRefs,
+          inheritRefs: tier.inheritRefs,
+          ...opts.inheritCandidate ? {
+            mayInherit: true
+          } : {},
           issues,
-          deferred: computeDeferred(graph),
+          deferred: computeDeferred(graph, {
+            mayInherit: opts.inheritCandidate
+          }),
           artifact: stampedArtifact,
           validation
         };
       }
+      /**
+      * LUA-635 (03 §3.1 table): once every primitive is derived, a workflow that another workflow of the project starts
+      * with `.workflow(…, { workspace: 'inherit' })` is an inherit candidate — its `workspace-not-declared` defers to
+      * createRun (it mounts the parent's volume). The child's own `.commit()` could not know this: it ran at module
+      * evaluation, before any parent existed.
+      */
+      linkGraphs(compiled) {
+        const workflows = compiled.filter((p) => p.kind === PrimitiveKind.WORKFLOW && p.graph);
+        const inheritTargets2 = new Set(workflows.flatMap((p) => p.graph?.inheritRefs ?? []));
+        for (const p of workflows) if (p.graph && inheritTargets2.has(p.name)) p.graph = applyInheritCandidate(p.graph);
+        const sketched = workflows.filter((p) => p.graph?.topology === "sketch").map((p) => p.name);
+        if (sketched.length === 0) return;
+        for (const p of workflows) {
+          if (!p.graph || inheritTargets2.has(p.name)) continue;
+          for (const issue of p.graph.issues) {
+            if (issue.code !== "workspace-not-declared") continue;
+            issue.message += ` \u2014 ${sketched.join(", ")} ${sketched.length === 1 ? "is" : "are"} at sketch topology: a \`.workflow(\u2026, { workspace: 'inherit' })\` there that names this workflow through anything but a string or a createWorkflow({ name }) binding is invisible to the compiler; make that file evaluate statically first, or declare the workspace here`;
+          }
+        }
+      }
       // ===========================================================================
       // MANIFEST — 03 §3.3.3
       // ===========================================================================
@@ -17816,7 +18461,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
         if (!d) throw new Error(`workflow "${compiled.name}" was compiled without a graph derivation`);
         const cfg = d.graph ?? {};
         const config = compiled.metadata.config ?? {};
-        const toolIds = collectSingleSteps(d.graph).filter((n) => n.type === "tool").map((n) => n.toolId);
+        const toolIds = collectSingleSteps(d.graph).filter((n2) => n2.type === "tool").map((n2) => n2.toolId);
         const toolRefs = [
           ...new Set(toolIds)
         ].map((toolId) => allPrimitives?.find((p) => p.kind === "tool" && p.name === toolId)?.name ?? toolId);
@@ -17839,6 +18484,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
           partialNodes: d.partialNodes,
           toolRefs,
           workflowRefs: d.workflowRefs,
+          mayInherit: d.mayInherit,
           budget: cfg.budget,
           concurrencyPolicy: cfg.concurrencyPolicy,
           schedule: config.schedule,
@@ -18838,6 +19484,10 @@ var init_compiler = __esm({
           });
           const CONCURRENCY = 4;
           const compileResults = await this.compileInParallel(allMetadata, CONCURRENCY);
+          const compiled = compileResults.flatMap((r) => "compiled" in r && r.compiled ? [
+            r.compiled
+          ] : []);
+          for (const plugin of pluginRegistry.getAll()) plugin.linkGraphs?.(compiled);
           let graphErrors = 0;
           for (const result of compileResults) {
             if ("error" in result) {
@@ -22511,7 +23161,7 @@ function createWorkflowsRuntime(getApi) {
     }
   };
 }
-var WORKFLOW_START_MAX_WAIT_SECONDS, WORKFLOW_START_CLIENT_DEADLINE_SLACK_MS, CONTROL_UNAVAILABLE_HINT, WorkflowApiError, WORKFLOWS_RUNTIME_MEMBERS, unwrap, assertBoundAgent, unavailable, WorkflowApi;
+var WORKFLOW_START_MAX_WAIT_SECONDS, WORKFLOW_START_CLIENT_DEADLINE_SLACK_MS, CONTROL_UNAVAILABLE_HINT, WorkflowApiError, WORKFLOWS_RUNTIME_MEMBERS, unwrap, assertBoundAgent, pathId, unavailable, WorkflowApi;
 var init_workflow_api_service = __esm({
   "src/api/workflow.api.service.ts"() {
     "use strict";
@@ -22562,6 +23212,7 @@ var init_workflow_api_service = __esm({
         throw new WorkflowApiError("FORBIDDEN", `Workflows.${member}: goals are scoped to the bound agent ${api.agentId}`, 403);
       }
     }, "assertBoundAgent");
+    pathId = /* @__PURE__ */ __name((id) => encodeURIComponent(id), "pathId");
     unavailable = /* @__PURE__ */ __name((member, route) => async () => {
       throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
     }, "unavailable");
@@ -22687,7 +23338,7 @@ var init_workflow_api_service = __esm({
       /** R5 — one step of a run (`?attempt=n` selects from the attempt history). */
       async getRunStep(runId, stepId, options = {}) {
         const qs = options.attempt !== void 0 ? `?attempt=${options.attempt}` : "";
-        return this.httpGet(`${this.runs}/${runId}/steps/${stepId}${qs}`, await this.auth());
+        return this.httpGet(`${this.runs}/${runId}/steps/${pathId(stepId)}${qs}`, await this.auth());
       }
       /** R6 — script-form journal page (404 `NOT_SCRIPT_RUN` for graph runs — IF-16). */
       async getRunJournal(runId, options = {}) {
@@ -22707,7 +23358,7 @@ var init_workflow_api_service = __esm({
       }
       /** R12 — resume a suspended step; the loser of a race gets `{ resumed:false, reason:'already_resumed' }`, never a 4xx. */
       async resumeRun(runId, stepId, data) {
-        return this.httpPost(`${this.runs}/${runId}/steps/${stepId}/resume`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/steps/${pathId(stepId)}/resume`, data, await this.auth());
       }
       /**
       * R36 — re-arm a parked step: a failed row past its retries, a gate-2 park, or a billing hold (the only exit
@@ -22715,15 +23366,15 @@ var init_workflow_api_service = __esm({
       * STEP_NOT_PARKED.
       */
       async retryStep(runId, stepId, data = {}) {
-        return this.httpPost(`${this.runs}/${runId}/steps/${stepId}/retry`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/steps/${pathId(stepId)}/retry`, data, await this.auth());
       }
       /** R13 — resolve an approval (human; `expectedFingerprint` guards against an edited payload — 409 `PAYLOAD_MISMATCH`). */
       async resolveApproval(runId, approvalId, data) {
-        return this.httpPost(`${this.runs}/${runId}/approvals/${approvalId}/resolve`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/approvals/${pathId(approvalId)}/resolve`, data, await this.auth());
       }
       /** R14 — deliver a named signal (`dedupeKey` ⇒ 200 `duplicate:true` on replay). */
       async signalRun(runId, name, data = {}) {
-        return this.httpPost(`${this.runs}/${runId}/signals/${encodeURIComponent(name)}`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/signals/${pathId(name)}`, data, await this.auth());
       }
       /** R31 — `DELETE …/runs/:runId` (`eraseRun`; human principal) → 202 `{ accepted, purgeId }`; 409 `RUN_NOT_TERMINAL { nextAction:'cancel' }`. */
       /** R50 — request an evidence-bundle export (202 `{exportId, status:'pending'}`; 409 `RUN_NOT_TERMINAL` / `EXPORT_IN_PROGRESS`). */
@@ -22780,6 +23431,23 @@ var init_workflow_api_service = __esm({
       async closeGoal(goalId, data = {}) {
         return this.httpPost(`${this.goals}/${encodeURIComponent(goalId)}/close`, data, await this.auth());
       }
+      // ─── Schedules (R4-MF-2 list/get + R28 delete — `/workflows/:agentId/schedules`; LUA-627 stanza) ───
+      /** Schedule tree (09 §9.5 — the write-only R27/R56/R28 family plus the R4-MF-2 read rows). */
+      get schedules() {
+        return `/workflows/${this.agentId}/schedules`;
+      }
+      /** R4-MF-2 — every `Job{kind:'workflow'}` of the agent with the PRO-726 strike fields (`goalId` marks a goal's cadence). */
+      async listSchedules() {
+        return this.httpGet(this.schedules, await this.auth());
+      }
+      /** R4-MF-2 — one schedule row; unknown, cross-agent and non-workflow-kind jobs all 404 `SCHEDULE_NOT_FOUND`. */
+      async getSchedule(jobId) {
+        return this.httpGet(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
+      }
+      /** R28 — delete a schedule Job (404 `SCHEDULE_NOT_FOUND`). The CLI refuses a goal-owned job BEFORE this call (`goal_schedule`). */
+      async deleteSchedule(jobId) {
+        return this.httpDelete(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
+      }
       // ─── Events (R7 — SSE `watch`, WF-204) ───
       /**
       * R7 SSE — `GET …/runs/:runId/events` as a frame stream (`id:<seq>` / `event:<type>` /
@@ -22823,7 +23491,7 @@ var init_workflow_api_service = __esm({
         if (options.attempt !== void 0) query.append("attempt", String(options.attempt));
         if (options.tail !== void 0) query.append("tail", String(options.tail));
         const qs = query.toString();
-        return this.httpGet(`${this.runs}/${runId}/steps/${stepId}/job${qs ? `?${qs}` : ""}`, await this.auth());
+        return this.httpGet(`${this.runs}/${runId}/steps/${pathId(stepId)}/job${qs ? `?${qs}` : ""}`, await this.auth());
       }
     };
   }
@@ -29501,6 +30169,7 @@ init_types();
 init_constants();
 init_workflow_api_service();
 init_artifact_loader();
+init_bundle_upload();
 
 // src/utils/sandbox.ts
 init_dist4();
@@ -29740,7 +30409,7 @@ function matchesEditablePath2(leafPath, editablePaths) {
   });
 }
 __name(matchesEditablePath2, "matchesEditablePath");
-var armId3 = /* @__PURE__ */ __name((arm) => arm.type === "step" ? arm.step.id : arm.id, "armId");
+var armId2 = /* @__PURE__ */ __name((arm) => arm.type === "step" ? arm.step.id : arm.id, "armId");
 var outputSchemaOf = /* @__PURE__ */ __name((entry) => {
   if (!entry) return void 0;
   if (entry.type === "step") return entry.step.outputSchema;
@@ -30254,7 +30923,7 @@ async function runWorkflowLocallyInner(rawOpts) {
       case "workflow": {
         if (single.workflowId === WORKFLOW_ARM_SUBRUN_ID && single.graph) {
           const [armMap, inner] = single.graph;
-          const innerId = armId3(inner);
+          const innerId = armId2(inner);
           const ctx = {
             ...mappingCtx(),
             stepResults: {
@@ -30430,6 +31099,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     const onError = single.onError ?? "fail";
     if (onError === "continue") {
       terminalize(row2, "failed");
+      stepResults[row2.stepId] = continuedFailureValue(row2.error);
       return;
     }
     if (onError === "park") {
@@ -30472,15 +31142,15 @@ async function runWorkflowLocallyInner(rawOpts) {
     entry.steps.forEach((arm, i) => {
       const pred = entry.predicates[i];
       const hit = pred ? evaluatePredicate(pred, ctx) : false;
-      if (hit && (!entry.exclusive || taken.length === 0)) taken.push(armId3(arm));
+      if (hit && (!entry.exclusive || taken.length === 0)) taken.push(armId2(arm));
     });
-    if (taken.length === 0 && entry.otherwise) taken.push(armId3(entry.otherwise));
+    if (taken.length === 0 && entry.otherwise) taken.push(armId2(entry.otherwise));
     const arms = [
       ...entry.steps,
       ...entry.otherwise ? [
         entry.otherwise
       ] : []
-    ].map(armId3);
+    ].map(armId2);
     terminalize(row2, "completed", {
       output: inputFor(row2),
       taken
@@ -30545,7 +31215,7 @@ async function runWorkflowLocallyInner(rawOpts) {
       };
       return;
     }
-    const body = armId3(entry.step);
+    const body = armId2(entry.step);
     const joinId = joinIdOf(row2.stepId);
     const childIds = items.map((_, i) => `${body}[${i}]`);
     const childNode = {
@@ -30590,12 +31260,12 @@ async function runWorkflowLocallyInner(rawOpts) {
     });
   }, "runForeach");
   const runLoop = /* @__PURE__ */ __name(async (row2, entry) => {
-    const body = armId3(entry.step);
+    const body = armId2(entry.step);
     const max = entry.maxIterations ?? 100;
     let last = inputFor(row2);
     row2.status = "running";
-    for (let n = 1; n <= max; n++) {
-      const iterId = `${body}#${n}`;
+    for (let n2 = 1; n2 <= max; n2++) {
+      const iterId = `${body}#${n2}`;
       const iterRow = addRow(iterId, {
         kind: kindOfSingle(entry.step),
         dependsOn: [],
@@ -30627,7 +31297,7 @@ async function runWorkflowLocallyInner(rawOpts) {
         clock += entry.intervalSeconds * 1e3;
         say(`[throttle:${row2.stepId}] kind=loop_interval resumeAt=${new Date(clock).toISOString()}`);
       }
-      if (n === max) {
+      if (n2 === max) {
         row2.error = {
           code: "loop_max_iterations",
           message: `loop ${row2.stepId} hit maxIterations ${max}`
@@ -30740,14 +31410,16 @@ async function runWorkflowLocallyInner(rawOpts) {
       case "loop":
         await runLoop(row2, entry);
         return;
-      case "sleep":
-        clock += entry.duration * 1e3;
-        say(`[${stamp()}] ${row2.stepId} \xB7 sleep ${entry.duration}s (${opts.realTime ? "real time" : "virtual clock"})`);
-        if (opts.realTime) await new Promise((r) => setTimeout(r, entry.duration * 1e3));
+      case "sleep": {
+        const ms = Math.max(0, Number(entry.duration) || 0);
+        clock += ms;
+        say(`[${stamp()}] ${row2.stepId} \xB7 sleep ${formatSleep(ms)} (${opts.realTime ? "real time" : "virtual clock"})`);
+        if (opts.realTime) await new Promise((r) => setTimeout(r, ms));
         terminalize(row2, "completed", {
           output: inputFor(row2)
         });
         return;
+      }
       case "sleepUntil": {
         let until;
         if (entry.date) until = Date.parse(entry.date);
@@ -30984,6 +31656,13 @@ function writeLedger(file, ledger) {
 `);
 }
 __name(writeLedger, "writeLedger");
+function formatSleep(ms) {
+  if (ms < 1e3) return `${ms} ms`;
+  const s = ms / 1e3;
+  const human = s >= 3600 ? `${+(s / 3600).toFixed(2)} h` : s >= 60 ? `${+(s / 60).toFixed(2)} min` : `${+s.toFixed(3)} s`;
+  return `${ms} ms (${human})`;
+}
+__name(formatSleep, "formatSleep");
 function parseKeyedJsonFlag(raw, flag) {
   const eq3 = raw.indexOf("=");
   if (eq3 === -1) throw new WorkflowLocalUsageError("usage", `${flag} expects <id>=@file|<json> (got "${raw}")`);
@@ -31652,7 +32331,11 @@ var WorkflowHandler = class extends BaseVersionedHandler {
       name: wf.name,
       description: wf.description
     });
-    if (!response.success || !response.data?.id) return null;
+    if (!response.success || !response.data?.id) {
+      const hint = workflowNameTakenHint(wf.name, response.error);
+      if (hint) throw new Error(hint);
+      return null;
+    }
     return response.data.id;
   }
   async pushToServer(apiKey, agentId, entityId, pushData) {
@@ -31680,7 +32363,48 @@ var WorkflowHandler = class extends BaseVersionedHandler {
     const primitive = findPrimitive(manifest, name, this.kind);
     if (!primitive) return null;
     if (primitive.form === "script") return this.buildPushData(primitive, void 0);
-    return super.prepareForPush(manifest, name, projectPath, bundleAccumulator);
+    const data = super.prepareForPush(manifest, name, projectPath, bundleAccumulator);
+    if (!data) return null;
+    const tools = this.toolBundlesFor(primitive, manifest, projectPath, bundleAccumulator);
+    return tools.length > 0 ? {
+      ...data,
+      tools
+    } : data;
+  }
+  /**
+  * LUA-656 (03 §3.5.2 / S3-6): every `.toolStep(id, tool)` reference compiles the tool as its own artifact
+  * (`toolRefs[]`), but nothing ever pushed those artifacts — the version landed with `tools: null`, so the
+  * engine's claim could not resolve `toolId` and every static tool step failed `TOOL_REF_UNRESOLVED`
+  * (prod 2026-09-05, kitchen-sink `armB`, 39/39 runs). Each referenced tool rides the version as
+  * `tools[] = {name, code | codeS3Hash}`, through the same accumulator the workflow bundle uses.
+  */
+  toolBundlesFor(wf, manifest, projectPath, bundleAccumulator) {
+    const out = [];
+    for (const toolName of [
+      ...new Set(wf.toolRefs ?? [])
+    ]) {
+      const tool = findPrimitive(manifest, toolName, PrimitiveKind.TOOL);
+      if (!tool) {
+        console.warn(`\u26A0\uFE0F  workflow "${wf.name}" references tool "${toolName}" but the manifest carries no compiled artifact for it \u2014 the engine can only resolve it through the agent's skills (TOOL_REF_UNRESOLVED otherwise)`);
+        continue;
+      }
+      const code = loadArtifact(tool, projectPath);
+      if (bundleAccumulator) {
+        const rawGzip = compressForPushRaw(code);
+        const codeS3Hash = hashBundle(rawGzip);
+        bundleAccumulator.set(codeS3Hash, rawGzip);
+        out.push({
+          name: toolName,
+          codeS3Hash
+        });
+      } else {
+        out.push({
+          name: toolName,
+          code: compressForPush(code)
+        });
+      }
+    }
+    return out;
   }
   buildPushData(primitive, compressedCode, codeS3Hash) {
     const wf = primitive;
@@ -31746,6 +32470,10 @@ var WorkflowHandler = class extends BaseVersionedHandler {
       graph: wf.graph,
       graphHash: wf.graphHash,
       topology: wf.topology,
+      // LUA-650: the compiler's linkGraphs verdict rides the push so the server defers workspace-not-declared too.
+      ...wf.mayInherit ? {
+        mayInherit: true
+      } : {},
       ...wf.schemas ? {
         schemas: wf.schemas
       } : {},
@@ -31757,6 +32485,14 @@ var WorkflowHandler = class extends BaseVersionedHandler {
   }
 };
 var workflowHandler = new WorkflowHandler();
+function workflowNameTakenHint(name, error) {
+  if (error?.code !== "WORKFLOW_NAME_TAKEN") return null;
+  const holder = error.dynamic ? "a chat-composed (dynamic) workflow" : "an existing workflow";
+  const id = error.workflowId ? ` (${error.workflowId})` : "";
+  const see = error.dynamic ? "run `lua workflows list --all` to see it" : "run `lua workflows list` to see it";
+  return `workflow name "${name}" is held by ${holder}${id} \u2014 ${see}. Push does not replace it: rename this workflow, or delete the other one first.`;
+}
+__name(workflowNameTakenHint, "workflowNameTakenHint");
 
 // src/primitives/index.ts
 init_skill_handler();
@@ -31787,6 +32523,7 @@ async function compileCommand(options) {
     const debugMode = options?.debug || process.env.LUA_DEBUG === "true";
     const verboseMode = options?.verbose || debugMode;
     const doSync = options?.sync === true;
+    const doServerSync = options?.serverSync !== false;
     if (debugMode) {
       console.log("\u{1F41B} Debug mode enabled");
     }
@@ -31858,8 +32595,13 @@ async function compileCommand(options) {
     }
     ensureGitignored(rootDir, "dist-v2/", "dist/");
     if (result.warnings.length > 0) {
+      const seen = /* @__PURE__ */ new Set();
       for (const warning of result.warnings) {
-        console.warn(`\u26A0\uFE0F  ${warning.message}`);
+        const key = `${warning.primitive ?? ""}\0${warning.message}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const who = warning.primitive ? `[${warning.kind ? `${warning.kind} ` : ""}${warning.primitive}] ` : "";
+        console.warn(`\u26A0\uFE0F  ${who}${warning.message}`);
       }
     }
     writeProgress("\u{1F504} Syncing YAML with manifest...");
@@ -31869,13 +32611,17 @@ async function compileCommand(options) {
       config = readYamlConfig();
     }
     let apiKey = null;
-    try {
-      apiKey = await resolveRequestCredential();
-    } catch {
+    if (doServerSync) {
+      try {
+        apiKey = await resolveRequestCredential();
+      } catch {
+      }
     }
     let syncConfig = readYamlConfig();
     const agentId = syncConfig?.agent?.agentId;
-    if (apiKey && agentId) {
+    if (!doServerSync) {
+      writeInfo("\u2139\uFE0F  Server sync skipped (offline verb) \u2014 `lua push` when you are ready to publish.");
+    } else if (apiKey && agentId) {
       writeProgress("\u{1F504} Syncing with server...");
       const fetchResults = await Promise.all(syncableHandlers.map((h) => h.fetchServerState(apiKey, agentId)));
       for (let i = 0; i < syncableHandlers.length; i++) {
@@ -31922,7 +32668,7 @@ async function compileCommand(options) {
       verbose_mode: verboseMode,
       sync_enabled: doSync,
       warnings_count: result.warnings.length,
-      server_sync_performed: !!(apiKey && agentId),
+      server_sync_performed: doServerSync && !!(apiKey && agentId),
       backup_out_of_sync: backupOutOfSync
     });
   }, "compilation");
@@ -31981,18 +32727,18 @@ init_analytics();
 
 // src/utils/suggest.ts
 function levenshtein(a, b) {
-  const m = a.length, n = b.length;
+  const m = a.length, n2 = b.length;
   const dp = Array.from({
     length: m + 1
-  }, () => Array(n + 1).fill(0));
+  }, () => Array(n2 + 1).fill(0));
   for (let i = 0; i <= m; i++) dp[i][0] = i;
-  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let j = 0; j <= n2; j++) dp[0][j] = j;
   for (let i = 1; i <= m; i++) {
-    for (let j = 1; j <= n; j++) {
+    for (let j = 1; j <= n2; j++) {
       dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
     }
   }
-  return dp[m][n];
+  return dp[m][n2];
 }
 __name(levenshtein, "levenshtein");
 function suggestClosest(input, candidates) {
@@ -32394,9 +33140,14 @@ var ALIAS_MAP = {
       "archive-runs",
       "workspace",
       "jobs",
-      "job-logs"
+      "job-logs",
+      "goals",
+      "schedules"
     ],
     aliases: lowerKeys({
+      goal: "goals",
+      schedule: "schedules",
+      sched: "schedules",
       ws: "workspace",
       job: "jobs",
       joblogs: "job-logs",
@@ -32426,6 +33177,45 @@ var ALIAS_MAP = {
       follow: "watch"
     })
   },
+  // LUA-627 — the sub-verbs of `lua workflows goals <verb>` / `lua workflows schedules <verb>`.
+  "workflows.goals.action": {
+    canonical: [
+      "list",
+      "get",
+      "create",
+      "pause",
+      "resume",
+      "close"
+    ],
+    aliases: lowerKeys({
+      ls: "list",
+      view: "get",
+      show: "get",
+      info: "get",
+      new: "create",
+      add: "create",
+      set: "create",
+      hold: "pause",
+      stop: "pause",
+      unpause: "resume",
+      continue: "resume",
+      end: "close",
+      finish: "close"
+    })
+  },
+  "workflows.schedules.action": {
+    canonical: [
+      "list",
+      "delete"
+    ],
+    aliases: lowerKeys({
+      ls: "list",
+      rm: "delete",
+      remove: "delete",
+      del: "delete",
+      unschedule: "delete"
+    })
+  },
   "preprocessors.action": preprocessorsAction,
   "postprocessors.action": preprocessorsAction,
   "devices.action": {
@@ -32789,6 +33579,14 @@ init_cli();
 init_command_utils();
 init_artifact_loader();
 init_types();
+
+// src/interfaces/workflows.ts
+function runIdOf(run) {
+  return run.runId ?? run.id ?? "";
+}
+__name(runIdOf, "runIdOf");
+
+// src/commands/workflow-local-run.ts
 init_dist2();
 
 // src/utils/workflow-script-local.ts
@@ -33227,7 +34025,9 @@ async function runWorkflowLocalFromProject(name, flags) {
   }, "say");
   if (!flags.noCompile) {
     say("\u{1F4E6} Compiling code first...");
-    await compileCommand();
+    await compileCommand({
+      serverSync: false
+    });
   }
   const manifest = loadManifest();
   const workflows = getPrimitivesByKind(manifest, PrimitiveKind.WORKFLOW);
@@ -33410,7 +34210,7 @@ async function loadSeedFromRun(runId, wf, apiKey, agentId) {
     }
   }
   return seedLedgerFromRun({
-    id: run.data.id,
+    id: runIdOf(run.data),
     graphHash: run.data.graphHash
   }, rows3, plan, {
     targetGraphHash: wf.graphHash
@@ -36934,6 +37734,19 @@ init_http_client();
 init_dist();
 init_lua_fetch();
 init_request_credential();
+var PLAIN_MARKDOWN_CLIENT_CAPABILITY = "plain-markdown";
+function withPlainMarkdown(chatData) {
+  const declared = Array.isArray(chatData.clientCapabilities) ? chatData.clientCapabilities : [];
+  if (declared.includes(PLAIN_MARKDOWN_CLIENT_CAPABILITY)) return chatData;
+  return {
+    ...chatData,
+    clientCapabilities: [
+      ...declared,
+      PLAIN_MARKDOWN_CLIENT_CAPABILITY
+    ]
+  };
+}
+__name(withPlainMarkdown, "withPlainMarkdown");
 var ChatApi = class extends HttpClient {
   static {
     __name(this, "ChatApi");
@@ -36956,7 +37769,7 @@ var ChatApi = class extends HttpClient {
   * @throws Error if the agent is not found or the chat request fails
   */
   async sendMessage(agentId, chatData) {
-    return this.httpPostCoreDrainRetry(`/chat/generate/${agentId}?channel=dev`, chatData, {});
+    return this.httpPostCoreDrainRetry(`/chat/generate/${agentId}?channel=dev`, withPlainMarkdown(chatData), {});
   }
   /**
   * Streams a message to an agent and receives chunked responses
@@ -36978,7 +37791,7 @@ var ChatApi = class extends HttpClient {
           Authorization: `Bearer ${await bearerFor(this.credential)}`,
           "Content-Type": "application/json"
         },
-        body: JSON.stringify(chatData)
+        body: JSON.stringify(withPlainMarkdown(chatData))
       }), {
         signal: controller.signal
       });
@@ -40968,8 +41781,8 @@ async function doSearch(api) {
     return;
   }
   writeSuccess(`Found ${numbers.length} number(s):`);
-  for (const n of numbers) {
-    console.log(`  ${n.msisdn}  ${n.country ?? ""}  ${n.type ?? ""}  ${smsLabel(n.transport)}  ${n.monthlyCost ?? ""} ${n.currency ?? ""}`);
+  for (const n2 of numbers) {
+    console.log(`  ${n2.msisdn}  ${n2.country ?? ""}  ${n2.type ?? ""}  ${smsLabel(n2.transport)}  ${n2.monthlyCost ?? ""} ${n2.currency ?? ""}`);
   }
 }
 __name(doSearch, "doSearch");
@@ -40995,9 +41808,9 @@ async function doPurchase(api, agentId, orgId, apiKey) {
       // height and silently hides later entries.
       pageSize: 15,
       message: `Pick a number (${numbers.length} available):`,
-      choices: numbers.map((n) => ({
-        name: `${n.msisdn} (${n.country}, ${n.type ?? "\u2014"}) \u2014 ${smsLabel(n.transport)}`,
-        value: n.msisdn
+      choices: numbers.map((n2) => ({
+        name: `${n2.msisdn} (${n2.country}, ${n2.type ?? "\u2014"}) \u2014 ${smsLabel(n2.transport)}`,
+        value: n2.msisdn
       }))
     }
   ]);
@@ -41102,13 +41915,13 @@ async function doList(api, orgId) {
     "Modality",
     "Agent",
     "Voice"
-  ], numbers.map((n) => [
-    n.msisdn,
-    n.country ?? "\u2014",
-    n.status,
-    smsLabel(n.transport),
-    n.agentId ?? "\u2014",
-    n.voiceId ?? "\u2014"
+  ], numbers.map((n2) => [
+    n2.msisdn,
+    n2.country ?? "\u2014",
+    n2.status,
+    smsLabel(n2.transport),
+    n2.agentId ?? "\u2014",
+    n2.voiceId ?? "\u2014"
   ])));
 }
 __name(doList, "doList");
@@ -43872,12 +44685,12 @@ function deriveHints(report) {
   return hints;
 }
 __name(deriveHints, "deriveHints");
-function pad(s, n) {
-  return s.length >= n ? s : s + " ".repeat(n - s.length);
+function pad(s, n2) {
+  return s.length >= n2 ? s : s + " ".repeat(n2 - s.length);
 }
 __name(pad, "pad");
-function truncate2(s, n) {
-  return s.length <= n ? s : s.slice(0, Math.max(0, n - 1)) + "\u2026";
+function truncate2(s, n2) {
+  return s.length <= n2 ? s : s.slice(0, Math.max(0, n2 - 1)) + "\u2026";
 }
 __name(truncate2, "truncate");
 function printJson(report) {
@@ -44947,8 +45760,8 @@ var ACCEPTED_TIMEOUT_MS = 12e4;
 var DEFAULT_LOGS_LIMIT = 20;
 function parseLimitOption(raw) {
   if (raw === void 0 || raw === null || raw === "") return void 0;
-  const n = Number.parseInt(String(raw), 10);
-  return Number.isFinite(n) && n > 0 ? n : void 0;
+  const n2 = Number.parseInt(String(raw), 10);
+  return Number.isFinite(n2) && n2 > 0 ? n2 : void 0;
 }
 __name(parseLimitOption, "parseLimitOption");
 function isLegacyIntegrationAction(action) {
@@ -46895,6 +47708,12 @@ async function executeAction(ctx, action, target, extra, o) {
       return requireRun(runId, "jobs", () => jobsCore(ctx, runId, o));
     case "job-logs":
       return requireRun(runId, "job-logs", () => jobLogsCore(ctx, runId, extra ?? o.step, o));
+    // ── goals <list|get|create|pause|resume|close> (LUA-627 — R57–R62) ──
+    case "goals":
+      return goalsCore(ctx, target, extra, o);
+    // ── schedules <list|delete> (LUA-627 — R4-MF-2 reads, R28 delete; goal-owned rows refuse) ──
+    case "schedules":
+      return schedulesCore(ctx, target, extra, o);
     case "run":
       return WORKFLOW_EXIT.OK;
   }
@@ -46934,6 +47753,11 @@ function apiFailure(ctx, res, verb) {
 }
 __name(apiFailure, "apiFailure");
 async function resolveWorkflow(ctx, nameOrId) {
+  const list = await loadWorkflowList(ctx);
+  return list && pickWorkflow(list, nameOrId);
+}
+__name(resolveWorkflow, "resolveWorkflow");
+async function loadWorkflowList(ctx) {
   const res = await ctx.api.getWorkflows({
     includeDynamic: true
   });
@@ -46941,15 +47765,19 @@ async function resolveWorkflow(ctx, nameOrId) {
     console.error(`\u274C Failed to list workflows: ${res.error?.message ?? "Unknown error"}`);
     return void 0;
   }
-  const wf = res.data.workflows.find((w) => w.name === nameOrId) ?? res.data.workflows.find((w) => w.id === nameOrId);
+  return res.data.workflows;
+}
+__name(loadWorkflowList, "loadWorkflowList");
+function pickWorkflow(list, nameOrId) {
+  const wf = list.find((w) => w.name === nameOrId) ?? list.find((w) => w.id === nameOrId);
   if (!wf) {
     console.error(`\u274C Workflow "${nameOrId}" not found`);
-    const names = res.data.workflows.map((w) => w.name);
+    const names = list.map((w) => w.name);
     if (names.length) console.log(`   Available: ${names.join(", ")}`);
   }
   return wf;
 }
-__name(resolveWorkflow, "resolveWorkflow");
+__name(pickWorkflow, "pickWorkflow");
 var shortHash = /* @__PURE__ */ __name((h) => h ? h.replace(/^sha256-cj1:/, "").slice(0, 12) : "\u2014", "shortHash");
 var when = /* @__PURE__ */ __name((iso) => iso ? new Date(iso).toLocaleString() : "\u2014", "when");
 var clockOf = /* @__PURE__ */ __name((at) => {
@@ -46958,9 +47786,9 @@ var clockOf = /* @__PURE__ */ __name((at) => {
 }, "clockOf");
 var parseIntFlag = /* @__PURE__ */ __name((v, flag) => {
   if (v === void 0) return void 0;
-  const n = Number(v);
-  if (!Number.isFinite(n)) throw new WorkflowLocalUsageError("usage", `${flag}: expected a number (got "${v}")`);
-  return n;
+  const n2 = Number(v);
+  if (!Number.isFinite(n2)) throw new WorkflowLocalUsageError("usage", `${flag}: expected a number (got "${v}")`);
+  return n2;
 }, "parseIntFlag");
 async function listCore(ctx, opts) {
   const res = await ctx.api.getWorkflows({
@@ -46995,9 +47823,27 @@ async function viewCore(ctx, name) {
   if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
   const res = await ctx.api.getWorkflow(wf.id);
   if (!res.success || !res.data) return apiFailure(ctx, res, "view");
-  emitJson(ctx, res);
-  if (ctx.json) return WORKFLOW_EXIT.OK;
   const w = res.data;
+  const goals = await loadGoals(ctx, w.id);
+  const sched = await loadSchedules(ctx, w.id, goals.items);
+  if (ctx.json) {
+    const data = {
+      ...w,
+      schedules: sched.items ?? null,
+      ...sched.error ? {
+        schedulesError: sched.error
+      } : {},
+      goals: goals.items ?? null,
+      ...goals.error ? {
+        goalsError: goals.error
+      } : {}
+    };
+    console.log(JSON.stringify({
+      ...res,
+      data
+    }, null, 2));
+    return WORKFLOW_EXIT.OK;
+  }
   console.log(`
 \u{1F9ED} ${w.name}${w.description ? ` \u2014 ${w.description}` : ""}`);
   console.log(`   Id:      ${w.id}`);
@@ -47011,6 +47857,8 @@ async function viewCore(ctx, name) {
   if (active?.envTemplateKeys?.length) {
     console.log(`   Env overlay: ${active.envTemplateKeys.join(", ")}${active.envOverlayHash ? ` \xB7 ${active.envOverlayHash}` : ""}`);
   }
+  printViewSchedules(sched);
+  printViewGoals(goals);
   printVersions(w.versions ?? [], w.activeVersionId);
   return WORKFLOW_EXIT.OK;
 }
@@ -47047,24 +47895,41 @@ async function versionsCore(ctx, name) {
   return WORKFLOW_EXIT.OK;
 }
 __name(versionsCore, "versionsCore");
-async function deployCore(ctx, name, version) {
-  const wf = await resolveWorkflow(ctx, name);
-  if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
+async function resolveVersionRef(ctx, wf, raw, verb) {
   const versionsRes = await ctx.api.getWorkflowVersions(wf.id);
-  if (!versionsRes.success || !versionsRes.data) return apiFailure(ctx, versionsRes, "deploy");
+  if (!versionsRes.success || !versionsRes.data) return {
+    exit: apiFailure(ctx, versionsRes, verb)
+  };
   const sorted = [
     ...versionsRes.data
   ].sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
   if (sorted.length === 0) {
     console.error(`\u274C "${wf.name}" has no versions \u2014 push one first: lua push workflow`);
-    return WORKFLOW_EXIT.NOT_FOUND;
+    return {
+      exit: WORKFLOW_EXIT.NOT_FOUND
+    };
   }
-  let target = version;
-  if (!target || target.toLowerCase() === "latest") target = sorted[0].version;
-  else if (!sorted.some((v) => v.version === target)) {
-    console.error(`\u274C Version "${target}" not found. Available: ${sorted.slice(0, 5).map((v) => v.version).join(", ")}`);
-    return WORKFLOW_EXIT.NOT_FOUND;
+  if (!raw || raw.toLowerCase() === "latest") return {
+    version: sorted[0]
+  };
+  const hit = sorted.find((v) => v.version === raw) ?? sorted.find((v) => v.id === raw);
+  if (!hit) {
+    console.error(`\u274C Version "${raw}" not found. Available: ${sorted.slice(0, 5).map((v) => v.version).join(", ")}`);
+    return {
+      exit: WORKFLOW_EXIT.NOT_FOUND
+    };
   }
+  return {
+    version: hit
+  };
+}
+__name(resolveVersionRef, "resolveVersionRef");
+async function deployCore(ctx, name, version) {
+  const wf = await resolveWorkflow(ctx, name);
+  if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
+  const ref = await resolveVersionRef(ctx, wf, version, "deploy");
+  if ("exit" in ref) return ref.exit;
+  const target = ref.version.version;
   if (!ctx.json) writeProgress(`\u{1F504} Deploying version ${target} of "${wf.name}"...`);
   const res = await ctx.api.publishWorkflowVersion(wf.id, target);
   if (!res.success) return apiFailure(ctx, res, "deploy");
@@ -47131,6 +47996,12 @@ async function startCore(ctx, name, o) {
     console.error("\u274C --tag: at most 10 tags");
     return WORKFLOW_EXIT.USAGE;
   }
+  let workflowVersionId;
+  if (o.workflowVersion) {
+    const ref = await resolveVersionRef(ctx, wf, o.workflowVersion, "start");
+    if ("exit" in ref) return ref.exit;
+    workflowVersionId = ref.version.id;
+  }
   const res = await ctx.api.startRun({
     workflowId: wf.id,
     input,
@@ -47141,7 +48012,7 @@ async function startCore(ctx, name, o) {
       maxCredits: budgetCredits
     } : void 0,
     waitSeconds,
-    workflowVersionId: o.workflowVersion && o.workflowVersion !== "latest" ? o.workflowVersion : void 0
+    workflowVersionId
   });
   if (!res.success || !res.data) {
     if (res.error?.statusCode === 409 && (res.error.code ?? res.error.error) === "RUNS_IN_FLIGHT") {
@@ -47223,7 +48094,7 @@ async function runsCore(ctx, o) {
     "Correlation",
     "Tags"
   ], runs.map((r) => [
-    r.id,
+    runIdOf(r),
     r.status,
     r.trigger,
     when(r.createdAt),
@@ -47236,6 +48107,30 @@ async function runsCore(ctx, o) {
   return WORKFLOW_EXIT.OK;
 }
 __name(runsCore, "runsCore");
+function formatRunConnections(connections, status) {
+  if (!connections) return void 0;
+  const unresolvedWord = status === "completed" ? "not needed" : "unresolved";
+  const declared = connections.declared ?? [];
+  const resolved = connections.resolved ?? [];
+  if (!declared.length && !resolved.length) return void 0;
+  const byKey = new Map(resolved.map((r) => [
+    r.key,
+    r
+  ]));
+  const keys = [
+    .../* @__PURE__ */ new Set([
+      ...declared.map((d) => d.key),
+      ...resolved.map((r) => r.key)
+    ])
+  ];
+  return keys.map((key) => {
+    const r = byKey.get(key);
+    if (r) return `${key} \u2192 ${r.connectionId} (${r.integrationType}, ${r.scope})`;
+    const d = declared.find((x) => x.key === key);
+    return `${key} \u2192 ${unresolvedWord} (${d?.integrationType ?? "?"})`;
+  }).join(" \xB7 ");
+}
+__name(formatRunConnections, "formatRunConnections");
 async function statusCore(ctx, runId, o) {
   const res = await ctx.api.getRun(runId, o.steps ? {
     fields: "full"
@@ -47249,28 +48144,40 @@ async function statusCore(ctx, runId, o) {
 }
 __name(statusCore, "statusCore");
 function printRun(run, withSteps) {
+  const id = runIdOf(run);
   console.log(`
-\u{1F9ED} Run ${run.id} \xB7 ${run.status}`);
+\u{1F9ED} Run ${id} \xB7 ${run.status}`);
   console.log(`   Workflow: ${run.workflowId} @ ${run.workflowVersionId} (${shortHash(run.graphHash)})`);
   console.log(`   Trigger:  ${run.trigger}${run.correlationKey ? ` \xB7 correlation ${run.correlationKey}` : ""}${run.tags?.length ? ` \xB7 tags ${run.tags.join(",")}` : ""}`);
   console.log(`   Created:  ${when(run.createdAt)}${run.startedAt ? ` \xB7 started ${when(run.startedAt)}` : ""}${run.completedAt ? ` \xB7 completed ${when(run.completedAt)}` : ""}`);
-  if (run.lineageId && run.lineageId !== run.id) console.log(`   Lineage:  ${run.lineageId}`);
+  if (run.lineageId && run.lineageId !== id) console.log(`   Lineage:  ${run.lineageId}`);
   if (run.gate) {
     const kind = run.gate.kind;
     if (kind === "exception") {
       console.log("\n\u26A0\uFE0F  Needs a decision \u2014 the run is parked on an exception gate:");
-      console.log(`   lua workflows retry-step ${run.id} --step <id> \xB7 resolve-step ${run.id} --step <id> --outcome skip|complete|fail \xB7 repair ${run.id}`);
+      console.log(`   lua workflows retry-step ${id} --step <id> \xB7 resolve-step ${id} --step <id> --outcome skip|complete|fail \xB7 repair ${id}`);
     } else if (kind === "budget") {
       console.log("\n\u23F8\uFE0F  Paused \u2014 run budget reached:");
-      console.log(`   lua workflows raise-budget ${run.id} --credits <n>`);
+      console.log(`   lua workflows raise-budget ${id} --credits <n>`);
     } else {
       console.log(`   Gate:     ${kind}${run.gate.reason ? ` (${run.gate.reason})` : ""}${run.gate.since ? ` since ${when(run.gate.since)}` : ""}`);
     }
   }
   if (run.failureReason) console.log(`   Failure:  ${run.failureReason}`);
-  if (run.restricted) console.log("   Outputs:  restricted (outputVisibility) \u2014 output not returned");
-  else if (run.output !== void 0) console.log(`   Output:   ${JSON.stringify(run.output).slice(0, 2e3)}`);
+  const connectionsLine = formatRunConnections(run.connections, run.status);
+  if (connectionsLine) console.log(`   Connections: ${connectionsLine}`);
   const steps = run.steps;
+  if (run.restricted) console.log("   Outputs:  restricted (outputVisibility) \u2014 output not returned");
+  else if (run.output !== void 0 && run.output !== null) {
+    const text = typeof run.outputPreview === "string" ? `${run.outputPreview} (offloaded \u2014 preview)` : JSON.stringify(run.output).slice(0, 2e3);
+    console.log(`   Output:   ${text}`);
+  } else if (run.hasOutput) {
+    console.log(`   Output:   present \u2014 lua workflows status ${run.id} --steps`);
+  } else if (RUN_TERMINAL_STATUSES.has(run.status)) {
+    const last = lastCompletedPreview(steps);
+    console.log(`   Output:   (none${last ? "" : withSteps ? "" : " \u2014 pass --steps for per-step output previews"})`);
+    if (last) console.log(`   Last step output (preview): ${last.stepId} \u2192 ${JSON.stringify(last.output).slice(0, 2e3)}`);
+  }
   if (withSteps) {
     if (!steps?.length) console.log("\n   (no step rows in the response)");
     else {
@@ -47286,12 +48193,69 @@ function printRun(run, withSteps) {
         s.kind ?? "\u2014",
         s.status,
         String(s.attempt ?? ""),
-        s.error?.code ?? ""
+        stepErrorCell(s.error)
       ])));
+      for (const s of steps) {
+        const cause = stepFailureLine(s.error);
+        if (cause) console.log(`   \u2716 ${s.stepId}: ${cause}`);
+        for (const a of s.attempts ?? []) {
+          if (a.status === "completed") continue;
+          const what = stepErrorCell(a.error) || a.killReason || "\u2014";
+          console.log(`   \u21BA ${s.stepId}: attempt ${a.attempt} ${a.status}: ${what}${priorAttemptTail(a)}`);
+        }
+      }
     }
   }
 }
 __name(printRun, "printRun");
+var RUN_TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "cancelled",
+  "abandoned",
+  "timed_out"
+]);
+function lastCompletedPreview(steps) {
+  if (!steps?.length) return void 0;
+  let best;
+  for (const s of steps) {
+    if (s.status !== "completed" || s.preview?.output === void 0) continue;
+    if (!best || (s.completedAt ?? 0) >= (best.completedAt ?? 0)) best = s;
+  }
+  return best ? {
+    stepId: best.stepId,
+    output: best.preview.output
+  } : void 0;
+}
+__name(lastCompletedPreview, "lastCompletedPreview");
+function stepErrorCell(e) {
+  if (!e?.code) return "";
+  return e.reason ? `${e.code} (${e.reason})` : e.code;
+}
+__name(stepErrorCell, "stepErrorCell");
+function priorAttemptTail(a) {
+  const e = a.error;
+  const parts = [
+    e?.providerStatus !== void 0 ? `HTTP ${e.providerStatus}` : void 0,
+    a.podName ? `pod ${a.podName}` : void 0
+  ].filter((p) => !!p);
+  return `${parts.length ? ` \u2014 ${parts.join(" \xB7 ")}` : ""}${e?.providerMessage ? ` \u2014 ${e.providerMessage}` : ""}`;
+}
+__name(priorAttemptTail, "priorAttemptTail");
+function stepFailureLine(e) {
+  if (!e || !e.reason && e.providerStatus === void 0 && !e.providerMessage) return void 0;
+  const b = e.budget;
+  const parts = [
+    e.reason,
+    e.providerStatus !== void 0 ? `HTTP ${e.providerStatus}` : void 0,
+    e.model ? `model ${e.model}` : void 0,
+    e.turnIndex !== void 0 ? `message ${e.turnIndex}${e.assistantTurns !== void 0 ? ` (${e.assistantTurns} replies)` : ""}${b?.maxMessages !== void 0 ? ` of ${b.maxMessages}` : ""}` : void 0,
+    b ? `${b.inputTokens.toLocaleString("en-US")}${b.maxInputTokens !== void 0 ? ` of ${b.maxInputTokens.toLocaleString("en-US")}` : ""} input tokens` : void 0,
+    e.providerRetries ? `${e.providerRetries} provider ${e.providerRetries === 1 ? "retry" : "retries"}` : void 0
+  ].filter((p) => !!p);
+  return `${parts.join(" \xB7 ")}${e.providerMessage ? `${parts.length ? " \u2014 " : ""}${e.providerMessage}` : ""}`;
+}
+__name(stepFailureLine, "stepFailureLine");
 async function watchCore(ctx, runId, o) {
   let afterSeq;
   let timeoutS;
@@ -47342,6 +48306,8 @@ async function watchCore(ctx, runId, o) {
       if (!ctx.json) console.error(`\u2026 reconnecting (Last-Event-ID ${lastEventId ?? "none"})`);
       await new Promise((r) => setTimeout(r, Math.min(5e3, 250 * 2 ** reconnects)));
     }
+  } catch (e) {
+    if (!controller.signal.aborted) throw e;
   } finally {
     if (timer) clearTimeout(timer);
     process.off("SIGINT", onSigint);
@@ -47384,7 +48350,7 @@ function handleWatchFrame(ctx, runId, frame, o, throttled) {
         throttled.set(kind, (throttled.get(kind) ?? 0) + 1);
         if (!ctx.json && !o.events) process.stdout.write(`\r  throttled \xB7 ${[
           ...throttled
-        ].map(([k, n]) => `${k} \xD7${n}`).join(" \xB7 ")}`);
+        ].map(([k, n2]) => `${k} \xD7${n2}`).join(" \xB7 ")}`);
         return void 0;
       }
       if (!ctx.json && !o.events) {
@@ -47455,13 +48421,28 @@ async function resumeCore(ctx, runId, o) {
   const res = await ctx.api.resumeRun(runId, o.step, {
     resumeData
   });
+  const resumeCode = !res.success ? res.error?.code ?? res.error?.error : void 0;
+  const resumeDetail = res.error;
+  if (!ctx.json && res.error?.statusCode === 400 && resumeCode === "RESUME_SCHEMA_INVALID") {
+    console.error(`\u274C resume rejected \u2014 --data does not match the resumeSchema step "${resumeDetail?.stepId ?? o.step}" declares:`);
+    for (const issue of resumeDetail?.issues ?? []) console.error(`   \u2022 ${issue.path || "/"}: ${issue.message ?? "invalid"}`);
+    console.error("   fix the data and resume again (the step is still waiting for input)");
+  } else if (!ctx.json && res.error?.statusCode === 422 && resumeCode === "RESUME_SCHEMA_UNCOMPILABLE") {
+    console.error(`\u274C resume could not be checked \u2014 the resumeSchema step "${resumeDetail?.stepId ?? o.step}" declares does not compile:`);
+    for (const issue of resumeDetail?.issues ?? []) console.error(`   \u2022 ${issue.message ?? "schema does not compile"}`);
+    console.error("   this is a workflow definition defect, not a data problem \u2014 fix the `resumeSchema` on the step in the workflow source, push a new version, then resume again");
+  }
   if (!res.success || !res.data) {
-    if (res.error?.statusCode === 409 && !ctx.json) {
-      const code = res.error.code ?? res.error.error;
+    const code = res.error?.code ?? res.error?.error;
+    if (!ctx.json && res.error?.statusCode === 404 && code === "STEP_NOT_FOUND") {
+      console.error(`\u274C step "${o.step}" does not exist on run ${runId} \u2014 list its steps: lua workflows status ${runId} --steps`);
+    } else if (!ctx.json && res.error?.statusCode === 409) {
       if (code === "approval_requires_human" || code === "APPROVAL_REQUIRES_HUMAN") {
         console.error(`\u274C step "${o.step}" is an approval \u2014 resolve it with: lua workflows approve ${runId} --approval ${o.step} --decision approve`);
       } else if (code === "use_signal_route" || code === "USE_SIGNAL_ROUTE") {
         console.error(`\u274C step "${o.step}" waits for a signal \u2014 deliver it with: lua workflows signal ${runId} <name> --payload '{}'`);
+      } else if (code === "NOT_SUSPENDED") {
+        console.error(`\u274C step "${o.step}" is not suspended${res.error?.status ? ` (it is ${res.error.status})` : ""} \u2014 nothing to resume: lua workflows status ${runId} --steps`);
       }
     }
     return apiFailure(ctx, res, "resume");
@@ -47526,7 +48507,9 @@ async function approveCore(ctx, runId, o) {
   });
   if (!res.success || !res.data) {
     const code = res.error?.code ?? res.error?.error;
-    if (!ctx.json && res.error?.statusCode === 409 && code === "PAYLOAD_MISMATCH") {
+    if (!ctx.json && res.error?.statusCode === 404 && code === "APPROVAL_NOT_FOUND") {
+      console.error(`\u274C approval "${o.approval}" not found on run ${runId} \u2014 pass the pending approval's wfa_\u2026 id: lua workflows status ${runId} --steps --json shows it as the suspended step's suspend.approvalId`);
+    } else if (!ctx.json && res.error?.statusCode === 409 && code === "PAYLOAD_MISMATCH") {
       console.error(`\u274C the payload changed since you looked \u2014 refetch: lua workflows approval-payload ${runId} --approval ${o.approval}`);
     } else if (!ctx.json && res.error?.statusCode === 403 && code === "STEP_UP_REQUIRED") {
       console.error("\u274C approve from the desktop with a fresh login (step-up required)");
@@ -47557,7 +48540,25 @@ async function signalCore(ctx, runId, name, o) {
     payload,
     dedupeKey: o.dedupeKey
   });
-  if (!res.success || !res.data) return apiFailure(ctx, res, "signal");
+  if (!res.success || !res.data) {
+    const code = res.error?.code ?? res.error?.error;
+    if (!ctx.json && res.error?.statusCode === 400 && code === "SIGNAL_SCHEMA_INVALID") {
+      const where = res.error?.stepId ? `step "${res.error.stepId}"` : "the waiting step";
+      console.error(`\u274C signal "${name}" rejected \u2014 the payload does not match the schema ${where} declares:`);
+      for (const issue of res.error?.issues ?? []) {
+        console.error(`   \u2022 ${issue.path || "/"}: ${issue.message ?? "invalid"}`);
+      }
+      console.error("   fix the payload and send it again (a --dedupe-key is not consumed by a rejected signal)");
+    } else if (!ctx.json && res.error?.statusCode === 422 && code === "SIGNAL_SCHEMA_UNCOMPILABLE") {
+      const where = res.error?.stepId ? `step "${res.error.stepId}"` : "the waiting step";
+      console.error(`\u274C signal "${name}" could not be checked \u2014 the schema ${where} declares does not compile:`);
+      for (const issue of res.error?.issues ?? []) {
+        console.error(`   \u2022 ${issue.message ?? "schema does not compile"}`);
+      }
+      console.error(`   this is a workflow definition defect, not a payload problem \u2014 fix the \`schema\` on the waitForSignal node in the workflow source, push a new version, then send the signal again`);
+    }
+    return apiFailure(ctx, res, "signal");
+  }
   emitJson(ctx, res);
   const r = res.data;
   if (!ctx.json) {
@@ -47623,10 +48624,25 @@ async function replayCore(ctx, runId, o) {
   const rows3 = [];
   for (const stepId of plan.order) {
     const step3 = await ctx.api.getRunStep(runId, stepId);
-    if (step3.success && step3.data) rows3.push({
+    if (!step3.success || !step3.data) continue;
+    const error = step3.data.error;
+    const onError = plan.steps[stepId]?.entry?.onError;
+    rows3.push({
       stepId,
       status: step3.data.status,
-      output: step3.data.output
+      output: step3.data.output,
+      ...onError ? {
+        onError
+      } : {},
+      ...error ? {
+        error: {
+          code: error.code,
+          message: error.message
+        }
+      } : {},
+      ...error?.killReason ? {
+        killReason: error.killReason
+      } : {}
     });
   }
   const result = replayLedger(wf.graph, {
@@ -47770,9 +48786,9 @@ function parseSinceFlag(raw, now = Date.now()) {
   if (!raw) return NaN;
   const m = /^(\d+)([dhm])$/i.exec(raw.trim());
   if (m) {
-    const n = Number(m[1]);
+    const n2 = Number(m[1]);
     const unit = m[2].toLowerCase();
-    return now - n * (unit === "d" ? 864e5 : unit === "h" ? 36e5 : 6e4);
+    return now - n2 * (unit === "d" ? 864e5 : unit === "h" ? 36e5 : 6e4);
   }
   return Date.parse(raw);
 }
@@ -47875,7 +48891,11 @@ async function archiveRunsCore(ctx, o) {
   }, "say");
   const sha256 = /* @__PURE__ */ __name((buf) => crypto5.createHash("sha256").update(buf).digest("hex"), "sha256");
   const sleep3 = /* @__PURE__ */ __name((ms) => new Promise((r) => setTimeout(r, ms)), "sleep");
-  const archiveOne = /* @__PURE__ */ __name(async (run) => {
+  const archiveOne = /* @__PURE__ */ __name(async (apiRow) => {
+    const run = {
+      ...apiRow,
+      id: runIdOf(apiRow)
+    };
     const zipFile = path23.join(o.out, `${run.id}.zip`);
     const prior = indexed.get(run.id);
     const completedAt = run.completedAt ? Date.parse(run.completedAt) : NaN;
@@ -48128,6 +49148,9 @@ function printJobHeader(v) {
 \u{1F6E0}  ${v.runId} \xB7 ${v.stepId} \xB7 attempt ${v.attempt} \xB7 ${v.status} \xB7 ${v.phase}${v.jobName ? ` \xB7 ${v.jobName}` : ""}${v.sizeClass ? ` (${v.sizeClass})` : ""}`);
   console.log(`   Segment ${v.segment} of ${v.segmentsTotalMax}${v.checkpoint ? ` \xB7 resumed from the ${Math.round(v.checkpoint.elapsedSeconds / 60)} min checkpoint` : ""}${v.harness ? ` \xB7 ${v.harness}` : ""}${v.podName ? ` \xB7 pod ${v.podName}` : ""}${v.heartbeatAt ? ` \xB7 heartbeat ${ago(v.heartbeatAt)}` : ""}`);
   if (v.error) console.log(`   Error: ${v.error.code}${v.error.killReason ? ` (${v.error.killReason})` : ""} \u2014 ${v.error.message}`);
+  const cause = stepFailureLine(v.error);
+  if (cause) console.log(`   Cause: ${cause}`);
+  if (v.note) console.log(`   Note:  ${v.note}`);
   console.log(`   Logs (${v.logsSource}${v.logs.length ? `, ${v.logs.length} lines` : ""}):`);
 }
 __name(printJobHeader, "printJobHeader");
@@ -48153,6 +49176,14 @@ async function jobLogsCore(ctx, runId, stepId, o) {
       if (res.error?.statusCode === 404 && res.error?.code === "JOB_NOT_FOUND" && !ctx.json) {
         console.error(`\u274C ${stepId} is not a Job-tier step of ${runId} (try: lua workflows jobs ${runId})`);
       }
+      if (res.error?.statusCode === 404 && res.error?.code === "JOB_LOGS_NOT_PERSISTED") {
+        emitJson(ctx, res);
+        if (!ctx.json) {
+          console.error(`\u274C job-logs: ${res.error.message}`);
+          writeInfo(`   lua workflows status ${runId} --steps shows the step error; --attempt <n> reads another attempt.`);
+        }
+        return WORKFLOW_EXIT.NOT_FOUND;
+      }
       return apiFailure(ctx, res, "job-logs");
     }
     const v = res.data;
@@ -48167,7 +49198,7 @@ async function jobLogsCore(ctx, runId, stepId, o) {
     for (const line of v.logs.slice(printed)) console.log(`   ${line}`);
     printed = Math.max(printed, v.logs.length);
     const terminal = TERMINAL2.has(v.status) || /^(completed|failed|cancelled|skipped|reaped|deleted)$/.test(v.status);
-    if (!o.follow || terminal || v.phase === "deleted") {
+    if (!o.follow || terminal || v.attemptFinished || v.phase === "deleted") {
       if (o.follow && !ctx.json) writeInfo(`   \u2014 ${v.status} (${v.phase})`);
       return WORKFLOW_EXIT.OK;
     }
@@ -48175,6 +49206,659 @@ async function jobLogsCore(ctx, runId, stepId, o) {
   }
 }
 __name(jobLogsCore, "jobLogsCore");
+var GOAL_VERBS = [
+  "list",
+  "get",
+  "create",
+  "pause",
+  "resume",
+  "close"
+];
+var SCHEDULE_VERBS = [
+  "list",
+  "delete"
+];
+var GOAL_STATUSES = [
+  "active",
+  "paused",
+  "done",
+  "closed"
+];
+var GOAL_PREDICATE_OPS = [
+  "exists",
+  "truthy",
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte"
+];
+var GOAL_CADENCE_MAX = 5;
+var GOAL_MAX_RUNS_CAP = 100;
+var GOAL_PAGE_LIMIT = 100;
+var GOAL_PAGE_MAX = 50;
+function parseIntegerFlag(v, flag, range2 = {}) {
+  if (v === void 0) return void 0;
+  const text = String(v).trim();
+  if (!/^-?\d+$/.test(text)) throw new WorkflowLocalUsageError("usage", `${flag}: expected an integer (got "${v}")`);
+  const n2 = Number(text);
+  const { min, max } = range2;
+  if (min !== void 0 && n2 < min || max !== void 0 && n2 > max) {
+    const bounds = max !== void 0 ? `${min ?? ""}..${max}` : `\u2265 ${min}`;
+    throw new WorkflowLocalUsageError("usage", `${flag}: expected an integer ${bounds} (got "${v}")`);
+  }
+  return n2;
+}
+__name(parseIntegerFlag, "parseIntegerFlag");
+function goalScheduleRefusal(jobId, goalId) {
+  return `Schedule ${jobId} is the cadence of goal ${goalId} and was NOT removed \u2014 nothing was changed. To stop the goal use \`lua workflows goals pause ${goalId}\` (it can come back) or \`lua workflows goals close ${goalId}\` (final); unscheduling a goal's job is recorded as a failure of the goal, never as stopping it.`;
+}
+__name(goalScheduleRefusal, "goalScheduleRefusal");
+function triggerLabel(t) {
+  if (!t || typeof t !== "object") return "\u2014";
+  if (t.type === "cron") return `cron ${t.expression ?? "?"}${t.timezone ? ` (${t.timezone})` : ""}`;
+  if (t.type === "interval") return `every ${t.seconds ?? "?"}s`;
+  if (t.type === "once") return `once ${t.executeAt ?? "?"}`;
+  return String(t.type ?? "?");
+}
+__name(triggerLabel, "triggerLabel");
+var cadenceLabel = /* @__PURE__ */ __name((cadence) => cadence?.length ? cadence.map((c) => triggerLabel(c)).join(" \xB7 ") : "immediate", "cadenceLabel");
+var judgeLabel = /* @__PURE__ */ __name((judge) => {
+  if (!judge) return "\u2014";
+  if (judge.predicate) {
+    const p = judge.predicate;
+    return `predicate ${p.path} ${p.op}${p.value !== void 0 ? ` ${JSON.stringify(p.value)}` : ""}`;
+  }
+  return `agent ${judge.agentId ?? "?"}${judge.role?.name ? ` (${judge.role.name})` : ""}${judge.schema ? " \xB7 schema" : ""}`;
+}, "judgeLabel");
+var goalStatusLabel = /* @__PURE__ */ __name((g) => `${g.status}${g.pauseReason ? ` (${g.pauseReason})` : ""}`, "goalStatusLabel");
+var verdictLabel = /* @__PURE__ */ __name((v) => v ? `${v.done ? "done" : "continue"}${v.summary ? ` \xB7 ${v.summary.slice(0, 60)}` : ""}` : "\u2014", "verdictLabel");
+var scheduleStatus = /* @__PURE__ */ __name((r) => r.autoDisabled ? "auto-disabled" : r.paused ? "paused" : "active", "scheduleStatus");
+var errorLabel = /* @__PURE__ */ __name((e) => `${e.code ?? e.error ?? e.statusCode ?? "?"} \u2014 ${e.message}`, "errorLabel");
+async function loadGoals(ctx, workflowId) {
+  const items = [];
+  let cursor;
+  for (let page = 0; page < GOAL_PAGE_MAX; page++) {
+    const res = await ctx.api.getGoals({
+      workflowId,
+      cursor,
+      limit: GOAL_PAGE_LIMIT
+    });
+    if (!res.success || !res.data) return {
+      error: res.error ?? {
+        message: "goals unavailable"
+      }
+    };
+    items.push(...res.data.items ?? []);
+    cursor = res.data.nextCursor;
+    if (!cursor) break;
+  }
+  if (cursor) return {
+    error: {
+      code: "GOAL_LIST_TRUNCATED",
+      message: "goal list truncated; ownership cannot be proven"
+    }
+  };
+  return {
+    items
+  };
+}
+__name(loadGoals, "loadGoals");
+async function loadSchedules(ctx, workflowId, goals) {
+  const res = await ctx.api.listSchedules();
+  if (!res.success || !res.data) return {
+    error: res.error ?? {
+      message: "schedules unavailable"
+    }
+  };
+  const byJob = /* @__PURE__ */ new Map();
+  for (const g of goals ?? []) if (g.jobId) byJob.set(g.jobId, g.goalId);
+  const items = (res.data.items ?? []).filter((r) => !workflowId || r.workflowId === workflowId).map((r) => {
+    const goalId = r.goalId ?? byJob.get(r.jobId);
+    return goalId ? {
+      ...r,
+      goalId
+    } : r;
+  });
+  return {
+    items
+  };
+}
+__name(loadSchedules, "loadSchedules");
+function printSchedules(items, names) {
+  if (!items.length) {
+    console.log("   (no schedules)");
+    return;
+  }
+  console.log(renderTable([
+    "Job",
+    "Workflow",
+    "Trigger",
+    "Next",
+    "Last fired",
+    "Status",
+    "Strikes",
+    "Goal"
+  ], items.map((r) => [
+    r.jobId,
+    names?.get(r.workflowId) ?? r.workflowId,
+    (r.trigger ?? []).map(triggerLabel).join(" \xB7 ") || "\u2014",
+    when(r.nextRunAt ?? void 0),
+    when(r.lastFiredAt),
+    scheduleStatus(r),
+    String(r.consecutiveFailures ?? 0),
+    r.goalId ?? "\u2014"
+  ])));
+  const owned = items.filter((r) => r.goalId).length;
+  if (owned) writeInfo(`\u{1F4A1} ${owned} goal-owned schedule(s) \u2014 stop those with lua workflows goals pause|close <goalId>, never schedules delete`);
+}
+__name(printSchedules, "printSchedules");
+function printGoals(items, names) {
+  if (!items.length) {
+    console.log("   (no goals)");
+    return;
+  }
+  const head = [
+    "Goal",
+    ...names ? [
+      "Workflow"
+    ] : [],
+    "Status",
+    "Runs",
+    "Iter",
+    "Judge",
+    "Cadence",
+    "Verdict",
+    "Updated"
+  ];
+  console.log(renderTable(head, items.map((g) => [
+    g.goalId,
+    ...names ? [
+      names.get(g.workflowId) ?? g.workflowId
+    ] : [],
+    goalStatusLabel(g),
+    `${g.runsUsed}/${g.maxRuns}`,
+    String(g.iteration ?? 0),
+    judgeLabel(g.judge),
+    cadenceLabel(g.cadence),
+    verdictLabel(g.verdict),
+    when(g.updatedAt)
+  ])));
+}
+__name(printGoals, "printGoals");
+function printViewSchedules(sched) {
+  if (sched.error) {
+    console.log(`   Schedules: unavailable (${errorLabel(sched.error)})`);
+    return;
+  }
+  const owned = sched.items.filter((r) => r.goalId).length;
+  console.log(`   Schedules: ${sched.items.length ? `${sched.items.length}${owned ? ` (${owned} goal-owned)` : ""}` : "none"}`);
+  if (sched.items.length) {
+    console.log("");
+    printSchedules(sched.items);
+  }
+}
+__name(printViewSchedules, "printViewSchedules");
+function printViewGoals(goals) {
+  if (goals.error) {
+    console.log(`   Goals:     unavailable (${errorLabel(goals.error)})`);
+    return;
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const g of goals.items) counts.set(g.status, (counts.get(g.status) ?? 0) + 1);
+  const summary = goals.items.length ? `${goals.items.length} (${[
+    ...counts
+  ].map(([s, n2]) => `${n2} ${s}`).join(" \xB7 ")})` : "none";
+  console.log(`   Goals:     ${summary}`);
+  if (goals.items.length) {
+    console.log("");
+    printGoals(goals.items);
+  }
+}
+__name(printViewGoals, "printViewGoals");
+function subVerb(group, noun, raw, verbs) {
+  if (!raw) {
+    console.error(`\u274C ${noun}: usage \u2014 lua workflows ${noun} <${verbs.join("|")}> \u2026`);
+    return void 0;
+  }
+  try {
+    return validateOrSuggest(group, raw);
+  } catch (e) {
+    console.error(`\u274C ${e.message}`);
+    return void 0;
+  }
+}
+__name(subVerb, "subVerb");
+function goalFailure(ctx, res, verb, ref) {
+  const err = res.error;
+  const code = err?.code ?? err?.error;
+  const status = err?.statusCode;
+  if (!ctx.json && err) {
+    if (status === 409 && code === "GOAL_NOT_ACTIVE") {
+      const now = err.status ?? "not active";
+      const rule = verb === "goals resume" ? "only a paused goal resumes" : verb === "goals pause" ? "only an active goal pauses" : "a done/closed goal stays closed";
+      console.error(`\u274C goal ${ref ?? ""} is ${now} \u2014 ${rule}`);
+    } else if (status === 409 && code === "GOAL_CAP") {
+      console.error(`\u274C goal cap reached (${err.cap ?? "?"} per agent) \u2014 close or finish one first: lua workflows goals list --status active`);
+    } else if (status === 400 && code === "VALIDATION_FAILED") {
+      const issues = err.issues ?? [];
+      for (const i of issues) console.error(`   ${i.code}${i.path ? ` at ${i.path}` : ""}${i.message ? ` \u2014 ${i.message}` : ""}`);
+    } else if (status === 400 && code === "GOAL_MAX_RUNS_INVALID") {
+      console.error(`\u274C --max-runs must be 1..${GOAL_MAX_RUNS_CAP}`);
+    } else if (status === 400 && code === "WORKFLOW_NOT_ON_AGENT") {
+      console.error(`\u274C that workflow belongs to another agent \u2014 goals are scoped to ${ctx.agentId}`);
+    } else if (status === 409 && code === "GOAL_SCHEDULE") {
+      const goalId = err.goalId ?? "?";
+      console.error(`\u274C GOAL_SCHEDULE: ${goalScheduleRefusal(ref ?? "<jobId>", goalId)}`);
+    }
+  }
+  return apiFailure(ctx, res, verb);
+}
+__name(goalFailure, "goalFailure");
+async function goalsCore(ctx, target, extra, o) {
+  const verb = subVerb("workflows.goals.action", "goals", target, GOAL_VERBS);
+  if (!verb) return WORKFLOW_EXIT.USAGE;
+  if (verb === "list") return goalsListCore(ctx, o, extra);
+  if (verb === "create") return goalsCreateCore(ctx, o, extra);
+  if (!extra) {
+    console.error(`\u274C goals ${verb}: a goal id is required \u2014 lua workflows goals ${verb} <goalId>`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  if (verb === "get") return goalsGetCore(ctx, extra);
+  return goalsControlCore(ctx, verb, extra, o);
+}
+__name(goalsCore, "goalsCore");
+async function goalsListCore(ctx, o, positional) {
+  if (o.status && !GOAL_STATUSES.includes(o.status)) {
+    console.error(`\u274C goals list: --status must be ${GOAL_STATUSES.join("|")} (got "${o.status}")`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  let limit;
+  try {
+    limit = parseIntegerFlag(o.limit, "--limit", {
+      min: 1,
+      max: GOAL_PAGE_LIMIT
+    });
+  } catch (e) {
+    console.error(`\u274C ${e.message}`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  const list = await loadWorkflowList(ctx);
+  if (!list) return WORKFLOW_EXIT.API;
+  const names = new Map(list.map((w) => [
+    w.id,
+    w.name
+  ]));
+  const target = positional ?? o.workflowName ?? o.workflow;
+  let workflowId;
+  if (target) {
+    const wf = pickWorkflow(list, target);
+    if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
+    workflowId = wf.id;
+  }
+  const res = await ctx.api.getGoals({
+    status: o.status,
+    workflowId,
+    cursor: o.cursor,
+    limit
+  });
+  if (!res.success || !res.data) return goalFailure(ctx, res, "goals list");
+  emitJson(ctx, res);
+  if (ctx.json) return WORKFLOW_EXIT.OK;
+  console.log(`
+\u{1F3AF} Goals${target ? ` \u2014 ${names.get(workflowId) ?? target}` : ""}${o.status ? ` \xB7 ${o.status}` : ""}
+`);
+  printGoals(res.data.items ?? [], names);
+  if (res.data.nextCursor) {
+    const flags = `${target ? ` -i ${target}` : ""}${o.status ? ` --status ${o.status}` : ""}${limit !== void 0 ? ` --limit ${limit}` : ""}`;
+    console.log(`
+\u2026 more: lua workflows goals list${flags} --cursor ${res.data.nextCursor}`);
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(goalsListCore, "goalsListCore");
+async function goalsGetCore(ctx, goalId) {
+  const res = await ctx.api.getGoal(goalId);
+  if (!res.success || !res.data) return goalFailure(ctx, res, "goals get", goalId);
+  emitJson(ctx, res);
+  if (!ctx.json) printGoalDetail(res.data);
+  return WORKFLOW_EXIT.OK;
+}
+__name(goalsGetCore, "goalsGetCore");
+function printGoalDetail(g) {
+  console.log(`
+\u{1F3AF} Goal ${g.goalId} \xB7 ${goalStatusLabel(g)}`);
+  console.log(`   Workflow:  ${g.workflowId}${g.workflowVersionId ? ` @ ${g.workflowVersionId}` : ""}`);
+  console.log(`   Objective: ${g.objective}`);
+  console.log(`   Judge:     ${judgeLabel(g.judge)}`);
+  console.log(`   Cadence:   ${cadenceLabel(g.cadence)} \xB7 mode ${g.evaluation?.mode ?? "immediate"}${g.evaluation?.delaySeconds ? ` \xB7 delay ${g.evaluation.delaySeconds}s` : ""}`);
+  console.log(`   Runs:      ${g.runsUsed}/${g.maxRuns} used \xB7 iteration ${g.iteration ?? 0}${g.consecutiveContinues ? ` \xB7 ${g.consecutiveContinues} consecutive continue(s)` : ""}${g.currentRunId ? ` \xB7 current ${g.currentRunId}` : ""}`);
+  if (g.budget?.maxCredits || g.maxTotalCredits) console.log(`   Budget:    ${g.budget?.maxCredits ? `per-run ${g.budget.maxCredits} credits` : ""}${g.budget?.maxCredits && g.maxTotalCredits ? " \xB7 " : ""}${g.maxTotalCredits ? `lineage cap ${g.maxTotalCredits} credits` : ""}`);
+  console.log(`   Schedule:  ${g.jobId ? `${g.jobId} (goal-owned \u2014 stop it with goals pause|close, never schedules delete)` : "none (immediate)"}`);
+  if (g.verdict) console.log(`   Verdict:   ${verdictLabel(g.verdict)}${g.verdict.runId ? ` (run ${g.verdict.runId}${g.verdict.at ? ` at ${when(g.verdict.at)}` : ""})` : ""}`);
+  if (g.input !== void 0) console.log(`   Input:     ${JSON.stringify(g.input).slice(0, 500)}`);
+  console.log(`   Created:   ${when(g.createdAt)} \xB7 updated ${when(g.updatedAt)}${g.doneAt ? ` \xB7 done ${when(g.doneAt)}` : ""}${g.closedBy ? ` \xB7 closed by ${g.closedBy}` : ""}`);
+  console.log("\n\u{1F4DC} Iterations");
+  const runs = g.runs ?? [];
+  if (!runs.length) console.log("   (no iteration runs yet)");
+  else console.log(renderTable([
+    "Run",
+    "Iteration",
+    "Status",
+    "Verdict",
+    "Credits",
+    "Created"
+  ], runs.map((r) => [
+    `${r.runId}${r.purged ? " (purged)" : ""}`,
+    String(r.iteration ?? ""),
+    r.status,
+    verdictLabel(r.verdict),
+    String(r.creditsUsed ?? 0),
+    when(r.createdAt)
+  ])));
+}
+__name(printGoalDetail, "printGoalDetail");
+async function goalsControlCore(ctx, verb, goalId, o) {
+  if (o.note && verb !== "close" && !ctx.json) writeInfo(`\u2139\uFE0F  --note is recorded on close only; ${verb} takes no note`);
+  const res = verb === "pause" ? await ctx.api.pauseGoal(goalId) : verb === "resume" ? await ctx.api.resumeGoal(goalId) : await ctx.api.closeGoal(goalId, o.note ? {
+    note: o.note
+  } : {});
+  if (!res.success || !res.data) return goalFailure(ctx, res, `goals ${verb}`, goalId);
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const g = res.data;
+    const past = verb === "pause" ? "paused" : verb === "resume" ? "resumed" : "closed";
+    writeSuccess(`\u2705 goal ${g.goalId} ${past} \xB7 ${goalStatusLabel(g)} \xB7 runs ${g.runsUsed}/${g.maxRuns}${g.jobId ? ` \xB7 schedule ${g.jobId}` : ""}`);
+    if (verb === "pause") writeInfo(`   the cadence stays with the goal \u2014 resume with: lua workflows goals resume ${g.goalId}`);
+    if (verb === "resume") writeInfo("   no backfill: missed cadence fires are not replayed");
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(goalsControlCore, "goalsControlCore");
+function parseJudgePredicateFlag(raw) {
+  const opList = GOAL_PREDICATE_OPS.join("|");
+  if (raw.startsWith("{") || raw.startsWith("@")) {
+    const obj = parseJsonOrFile(raw, "--judge-predicate");
+    if (!obj || typeof obj !== "object" || typeof obj.path !== "string" || !obj.path || !GOAL_PREDICATE_OPS.includes(String(obj.op))) throw new WorkflowLocalUsageError("usage", `--judge-predicate: expected { path, op: ${opList}, value? }`);
+    return {
+      path: obj.path,
+      op: obj.op,
+      ...obj.value !== void 0 ? {
+        value: obj.value
+      } : {}
+    };
+  }
+  const [path23, op, ...rest] = raw.trim().split(/\s+/);
+  if (!path23 || !op || !GOAL_PREDICATE_OPS.includes(op)) throw new WorkflowLocalUsageError("usage", `--judge-predicate: expected "<path> <op> [value]" with op ${opList} (got "${raw}")`);
+  if (rest.length === 0) return {
+    path: path23,
+    op
+  };
+  const text = rest.join(" ");
+  let value3 = text;
+  try {
+    value3 = JSON.parse(text);
+  } catch {
+  }
+  return {
+    path: path23,
+    op,
+    value: value3
+  };
+}
+__name(parseJudgePredicateFlag, "parseJudgePredicateFlag");
+function parseCadenceFlag(entries, timezone) {
+  const out = [];
+  let bareCron = 0;
+  for (const raw of entries ?? []) {
+    const text = raw.trim();
+    if (!text) continue;
+    if (text.startsWith("{") || text.startsWith("[") || text.startsWith("@")) {
+      const parsed = parseJsonOrFile(text, "--cadence");
+      for (const c of Array.isArray(parsed) ? parsed : [
+        parsed
+      ]) {
+        const slot = c;
+        if (!slot || typeof slot !== "object" || ![
+          "cron",
+          "once",
+          "interval"
+        ].includes(String(slot.type))) throw new WorkflowLocalUsageError("usage", "--cadence: each JSON entry needs type cron|once|interval");
+        out.push(slot);
+      }
+      continue;
+    }
+    if (!/^\S+(\s+\S+){4,5}$/.test(text)) throw new WorkflowLocalUsageError("usage", `--cadence: "${text}" is not a cron expression (5\u20136 fields); pass JSON for once/interval entries`);
+    bareCron += 1;
+    out.push({
+      type: "cron",
+      expression: text,
+      ...timezone ? {
+        timezone
+      } : {}
+    });
+  }
+  if (timezone && bareCron === 0) throw new WorkflowLocalUsageError("usage", '--timezone applies to bare cron cadences only \u2014 put "timezone" inside JSON entries, or pass a cron expression');
+  if (out.length > GOAL_CADENCE_MAX) throw new WorkflowLocalUsageError("usage", `--cadence: at most ${GOAL_CADENCE_MAX} entries (goal-cadence-invalid)`);
+  return out;
+}
+__name(parseCadenceFlag, "parseCadenceFlag");
+async function goalsCreateCore(ctx, o, positional) {
+  const target = positional ?? o.workflowName ?? o.workflow;
+  if (!target) {
+    console.error("\u274C goals create: a workflow is required \u2014 lua workflows goals create <workflow> (or -i <workflow>)");
+    return WORKFLOW_EXIT.USAGE;
+  }
+  if (!o.objective?.trim()) {
+    console.error("\u274C goals create: --objective <text> is required");
+    return WORKFLOW_EXIT.USAGE;
+  }
+  if (o.judgeAgent === "") {
+    console.error("\u274C goals create: --judge-agent is empty \u2014 an unquoted $self is expanded by the shell to nothing; write '$self' (quoted) or self");
+    return WORKFLOW_EXIT.USAGE;
+  }
+  if (!o.judgePredicate && !o.judgeAgent) {
+    console.error("\u274C goals create: one of --judge-predicate <spec> | --judge-agent <agentId|'$self'> is required");
+    return WORKFLOW_EXIT.USAGE;
+  }
+  const usage = /* @__PURE__ */ __name((m) => new WorkflowLocalUsageError("usage", m), "usage");
+  let dto;
+  try {
+    const maxRuns = parseIntegerFlag(o.maxRuns, "--max-runs", {
+      min: 1,
+      max: GOAL_MAX_RUNS_CAP
+    });
+    if (maxRuns === void 0) throw usage(`--max-runs <n> is required (an integer 1..${GOAL_MAX_RUNS_CAP})`);
+    const judge = {
+      agentId: o.judgeAgent === "self" ? "$self" : o.judgeAgent ?? "$self"
+    };
+    if (o.judgePredicate) {
+      if (o.schema || o.judgeRole) throw usage("--judge-predicate is the deterministic judge \u2014 --schema / --judge-role belong to --judge-agent");
+      judge.predicate = parseJudgePredicateFlag(o.judgePredicate);
+    } else {
+      if (o.judgeRole) judge.role = parseJsonOrFile(o.judgeRole, "--judge-role");
+      if (judge.agentId === "$self" && !judge.role) throw usage("--judge-role <json|@file> ({ name, instructions, tools }) is required for a '$self' judge");
+      if (judge.agentId !== "$self" && judge.role) throw usage("--judge-role is only for a $self judge");
+      if (!o.schema) throw usage("--schema <json|@file> is required for an agent judge (a JsonSchema with a boolean `done` at the root)");
+      const schema = parseJsonOrFile(o.schema, "--schema");
+      const done = schema?.properties?.done;
+      if (!schema || typeof schema !== "object" || done?.type !== "boolean") throw usage('--schema: must declare a boolean `done` at the root (properties.done.type === "boolean")');
+      judge.schema = schema;
+    }
+    const cadence = parseCadenceFlag(o.cadence, o.timezone);
+    const input = o.input ? parseJsonOrFile(o.input, "--input") : void 0;
+    const budgetCredits = parseIntegerFlag(o.budgetCredits, "--budget-credits", {
+      min: 1
+    });
+    const maxTotalCredits = parseIntegerFlag(o.maxTotalCredits, "--max-total-credits", {
+      min: 1
+    });
+    dto = {
+      workflowId: "",
+      objective: o.objective.trim(),
+      judge,
+      cadence,
+      evaluation: {
+        mode: cadence.length ? "cadence" : "immediate"
+      },
+      maxRuns,
+      ...budgetCredits !== void 0 ? {
+        budget: {
+          maxCredits: budgetCredits
+        }
+      } : {},
+      ...maxTotalCredits !== void 0 ? {
+        maxTotalCredits
+      } : {},
+      ...input !== void 0 ? {
+        input
+      } : {},
+      ...o.idempotencyKey ? {
+        idempotencyKey: o.idempotencyKey
+      } : {}
+    };
+  } catch (e) {
+    if (e instanceof WorkflowLocalUsageError) {
+      console.error(`\u274C ${e.message}`);
+      return WORKFLOW_EXIT.USAGE;
+    }
+    throw e;
+  }
+  const wf = await resolveWorkflow(ctx, target);
+  if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
+  dto.workflowId = wf.id;
+  if (o.workflowVersion) {
+    const ref = await resolveVersionRef(ctx, wf, o.workflowVersion, "goals create");
+    if ("exit" in ref) return ref.exit;
+    dto.workflowVersionId = ref.version.id;
+  }
+  const res = await ctx.api.createGoal(dto);
+  if (!res.success || !res.data) return goalFailure(ctx, res, "goals create");
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const g = res.data;
+    writeSuccess(`\u2705 goal ${g.goalId} created on "${wf.name}" \xB7 ${goalStatusLabel(g)} \xB7 runs ${g.runsUsed}/${g.maxRuns} \xB7 ${cadenceLabel(g.cadence)}${g.jobId ? ` \xB7 schedule ${g.jobId}` : ""}`);
+    writeHintBlock({
+      headline: "Follow the goal:",
+      lines: [
+        {
+          label: "Get:",
+          command: `lua workflows goals get ${g.goalId}`
+        },
+        {
+          label: "Pause:",
+          command: `lua workflows goals pause ${g.goalId}`
+        }
+      ],
+      when: "success"
+    });
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(goalsCreateCore, "goalsCreateCore");
+async function schedulesCore(ctx, target, extra, o) {
+  const verb = subVerb("workflows.schedules.action", "schedules", target, SCHEDULE_VERBS);
+  if (!verb) return WORKFLOW_EXIT.USAGE;
+  if (verb === "list") return schedulesListCore(ctx, o);
+  if (!extra) {
+    console.error("\u274C schedules delete: a schedule (job) id is required \u2014 lua workflows schedules delete <jobId>");
+    return WORKFLOW_EXIT.USAGE;
+  }
+  return schedulesDeleteCore(ctx, extra, o);
+}
+__name(schedulesCore, "schedulesCore");
+async function schedulesListCore(ctx, o) {
+  const list = await loadWorkflowList(ctx);
+  if (!list) return WORKFLOW_EXIT.API;
+  const names = new Map(list.map((w) => [
+    w.id,
+    w.name
+  ]));
+  const target = o.workflowName ?? o.workflow;
+  let wf;
+  if (target) {
+    wf = pickWorkflow(list, target);
+    if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
+  }
+  const goals = await loadGoals(ctx, wf?.id);
+  const sched = await loadSchedules(ctx, wf?.id, goals.items);
+  if (sched.error) return apiFailure(ctx, {
+    success: false,
+    error: sched.error
+  }, "schedules list");
+  if (ctx.json) {
+    console.log(JSON.stringify({
+      success: true,
+      data: {
+        items: sched.items,
+        ...goals.error ? {
+          goalsError: goals.error
+        } : {}
+      }
+    }, null, 2));
+    return WORKFLOW_EXIT.OK;
+  }
+  console.log(`
+\u{1F4C5} Schedules${wf ? ` \u2014 ${wf.name}` : ""}
+`);
+  if (goals.error) console.error(`\u26A0\uFE0F  goals unavailable (${errorLabel(goals.error)}) \u2014 goal-owned rows may be untagged`);
+  printSchedules(sched.items, names);
+  return WORKFLOW_EXIT.OK;
+}
+__name(schedulesListCore, "schedulesListCore");
+async function schedulesDeleteCore(ctx, jobId, o) {
+  const rowRes = await ctx.api.getSchedule(jobId);
+  if (!rowRes.success || !rowRes.data) return apiFailure(ctx, rowRes, "schedules delete");
+  const row2 = rowRes.data;
+  let goalId = row2.goalId;
+  if (!goalId) {
+    const goals = await loadGoals(ctx, row2.workflowId);
+    if (goals.error) {
+      if (!ctx.json) console.error(`\u274C cannot prove ${jobId} is not a goal's cadence (goals unavailable) \u2014 refusing to delete`);
+      return apiFailure(ctx, {
+        success: false,
+        error: goals.error
+      }, "schedules delete");
+    }
+    goalId = goals.items.find((g) => g.jobId === jobId)?.goalId;
+  }
+  if (goalId) {
+    const message = goalScheduleRefusal(jobId, goalId);
+    if (ctx.json) console.log(JSON.stringify({
+      success: false,
+      error: {
+        code: "goal_schedule",
+        statusCode: 409,
+        message,
+        jobId,
+        goalId
+      }
+    }, null, 2));
+    else console.error(`\u274C goal_schedule: ${message}`);
+    return WORKFLOW_EXIT.API;
+  }
+  if (!o.yes) {
+    const answer = await safePrompt([
+      {
+        type: "confirm",
+        name: "confirm",
+        message: `Delete schedule ${jobId} (${(row2.trigger ?? []).map(triggerLabel).join(" \xB7 ") || "no trigger"}) of workflow ${row2.workflowId}?`,
+        default: false
+      }
+    ]);
+    if (!answer?.confirm) {
+      console.log("Cancelled.");
+      return WORKFLOW_EXIT.OK;
+    }
+  }
+  const res = await ctx.api.deleteSchedule(jobId);
+  if (!res.success) return goalFailure(ctx, res, "schedules delete", jobId);
+  emitJson(ctx, res);
+  if (!ctx.json) writeSuccess(`\u2705 schedule ${jobId} deleted`);
+  return WORKFLOW_EXIT.OK;
+}
+__name(schedulesDeleteCore, "schedulesDeleteCore");
 
 // src/commands/features.ts
 init_cli();
@@ -56841,7 +58525,7 @@ function getProjectToolNames() {
   if (!hasCompilationOutput(process.cwd())) return [];
   try {
     const manifest = loadManifest();
-    return getPrimitivesByKind(manifest, PrimitiveKind.TOOL).map((t) => t.name).filter((n) => typeof n === "string" && n.length > 0).sort();
+    return getPrimitivesByKind(manifest, PrimitiveKind.TOOL).map((t) => t.name).filter((n2) => typeof n2 === "string" && n2.length > 0).sort();
   } catch {
     return [];
   }
@@ -58345,11 +60029,11 @@ init_constants();
 function parseVersion2(arg) {
   if (!arg) throw new Error(`Invalid version "${arg}": must be a positive integer like "3" or "v3".`);
   const stripped = arg.replace(/^v/i, "");
-  const n = Number.parseInt(stripped, 10);
-  if (!Number.isFinite(n) || n <= 0 || String(n) !== stripped) {
+  const n2 = Number.parseInt(stripped, 10);
+  if (!Number.isFinite(n2) || n2 <= 0 || String(n2) !== stripped) {
     throw new Error(`Invalid version "${arg}": must be a positive integer like "3" or "v3".`);
   }
-  return n;
+  return n2;
 }
 __name(parseVersion2, "parseVersion");
 
@@ -59655,13 +61339,15 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, approve, signal, replay)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "Version for deploy/start (or 'latest')").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs: page size").option("--cursor <c>", "runs: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch: give up after s seconds (exit 7)").option("--events", "watch: print raw frames").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/logs: step id").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve: approval id").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip)").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").addHelpText("after", `
+  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, approve, signal, replay)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/goals create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list: page size").option("--cursor <c>", "runs/goals list: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch: give up after s seconds (exit 7)").option("--events", "watch: print raw frames").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/logs: step id").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve: approval id").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip)").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create: cadence entry (repeatable, \u2264 5); none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create: IANA timezone for bare cron cadences").option("--max-runs <n>", "goals create: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").addHelpText("after", `
 Arguments:
   action    list \xB7 view \xB7 versions \xB7 deploy \xB7 activate \xB7 deactivate \xB7 start \xB7 run \xB7 runs \xB7 status \xB7
-            watch \xB7 cancel \xB7 resume \xB7 approve \xB7 signal \xB7 replay \xB7 logs \xB7 delete \xB7 delete-run \xB7
-            env-overlay \xB7 archive-runs \xB7 workspace \xB7 jobs \xB7 job-logs
-  target    workflow name (list/view/versions/deploy/activate/deactivate/start/run/delete) or run id (the rest)
-  extra     signal name (signal <runId> <name>)
+            watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 approve \xB7 signal \xB7 replay \xB7 logs \xB7 delete \xB7 delete-run \xB7
+            env-overlay \xB7 archive-runs \xB7 workspace \xB7 jobs \xB7 job-logs \xB7
+            goals <list|get|create|pause|resume|close> \xB7 schedules <list|delete>
+  target    workflow name (list/view/versions/deploy/activate/deactivate/start/run/delete) or run id (the rest);
+            the sub-verb for goals / schedules
+  extra     signal name (signal <runId> <name>) \xB7 goal id (goals get/pause/resume/close) \xB7 job id (schedules delete)
 
 Exit codes: 0 ok \xB7 1 API failure \xB7 2 usage \xB7 3 not found \xB7 4 run failed \xB7 5 run cancelled \xB7
             6 run gated (consent) \xB7 7 --timeout reached \xB7 8 run parked (exception/budget gate)
@@ -59680,10 +61366,19 @@ Examples:
   $ lua workflows job-logs <runId> build --tail 500 --follow
   $ lua workflows cancel <runId> --reason "wrong input"
   $ lua workflows resume <runId> --step ask --data '{"answer":42}'
+  $ lua workflows retry-step <runId> --step sendEmails --note "vendor back up"
   $ lua workflows approve <runId> --approval reviewDrafts --decision approve
   $ lua workflows signal <runId> review --payload '{"ok":true}'
   $ lua workflows replay <runId> --local
   $ lua workflows deploy outreach -v latest
+  $ lua workflows view outreach --json | jq '.data.schedules, .data.goals'
+  $ lua workflows goals list -i outreach --status active
+  $ lua workflows goals get wfg_1234
+  $ lua workflows goals create -i outreach --objective "Reach 50 signups" --judge-predicate 'output.signups gte 50' \\
+      --cadence '0 9 * * 1' --timezone Europe/London --max-runs 12 --input '{"segment":"trial"}'
+  $ lua workflows goals pause wfg_1234 \xB7 goals resume wfg_1234 \xB7 goals close wfg_1234 --note "shipped"
+  $ lua workflows schedules list -i outreach
+  $ lua workflows schedules delete <jobId> --yes     (a goal's cadence is refused: goal_schedule)
 `).action(workflowsCommand);
   program2.command("features [action]").description("\u{1F3AF} Manage agent features (RAG, webSearch, inquiry, outboundChannels)").option("--feature-name <name>", "Feature name").option("--recipient-scope <scope>", "For configure: outboundChannels recipient scope (current_user | anyone)").addHelpText("after", `
 Arguments: