relay-flow 0.3.7-alpha → 0.3.8-alpha

package/internal/repo/repo.go

@@ -31,8 +31,12 @@ type Repo struct {
 	Path       string
 	TaskConfig config.RawValues
 	TaskSystem task.System
-	Workflows  []WorkflowBinding
-	bindingsMu sync.RWMutex
+	// TaskSystemError is set when local startup construction could not create
+	// a usable adapter. The repo remains visible for diagnostics and repair,
+	// while only workflows referencing it are isolated.
+	TaskSystemError error
+	Workflows       []WorkflowBinding
+	bindingsMu      sync.RWMutex
 }
 
 func (r *Repo) Info() Info {
@@ -95,25 +99,97 @@ func (r *Registry) Remove(name string) {
 // BindWorkflows rebuilds the derived Repo.Workflows index from the given
 // workflows. Each repo that a workflow lists gets a binding with the
 // matcher compiled by that repo's task system. Repos not listed by a
-// workflow keep no binding for it.
+// workflow keep no binding for it. The strict form is used by submission,
+// where a binding error must reject the candidate before it is stored.
 func (r *Registry) BindWorkflows(workflows []*workflow.Workflow) error {
+	_, err := r.bindWorkflows(workflows, false)
+	return err
+}
+
+// BindingIssue identifies a workflow that could not be safely published.
+// Startup uses the isolated form so one invalid workflow does not prevent
+// unrelated workflows from being bound.
+type BindingIssue struct {
+	Workflow *workflow.Workflow
+	Error    error
+}
+
+// BindWorkflowsIsolated rebuilds all bindings while isolating workflows whose
+// referenced repo or matcher cannot be built. The returned issues are
+// diagnostics only; valid workflows are still published atomically.
+func (r *Registry) BindWorkflowsIsolated(workflows []*workflow.Workflow) []BindingIssue {
+	issues, _ := r.bindWorkflows(workflows, true)
+	return issues
+}
+
+func (r *Registry) bindWorkflows(workflows []*workflow.Workflow, isolate bool) ([]BindingIssue, error) {
 	type binding struct {
 		wf    *workflow.Workflow
 		match func(task.Ticket) bool
 	}
 	byRepo := map[string][]binding{}
+	issues := []BindingIssue{}
 	for _, wf := range workflows {
+		if wf == nil || !wf.IsRoutable() {
+			continue
+		}
+		failed := false
 		for _, repoName := range wf.Repos {
 			rp, ok := r.Get(repoName)
 			if !ok {
-				return fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
+				err := fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
+			}
+			if rp.TaskSystem == nil {
+				reason := rp.TaskSystemError
+				if reason == nil {
+					reason = fmt.Errorf("repo %q task system is unavailable", repoName)
+				}
+				err := fmt.Errorf("workflow %q repo %q: task system unavailable: %w", wf.Name, repoName, reason)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
 			}
 			match, err := rp.TaskSystem.CompileFilter(wf.TaskConfig)
 			if err != nil {
-				return fmt.Errorf("workflow %q repo %q: compile filter: %w", wf.Name, repoName, err)
+				err = fmt.Errorf("workflow %q repo %q: compile filter: %w", wf.Name, repoName, err)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
 			}
 			byRepo[repoName] = append(byRepo[repoName], binding{wf: wf, match: match})
 		}
+		if failed {
+			// A workflow is all-or-nothing across its referenced repositories;
+			// never leave a partial route for it.
+			for repoName, binds := range byRepo {
+				filtered := binds[:0]
+				for _, b := range binds {
+					if b.wf != wf {
+						filtered = append(filtered, b)
+					}
+				}
+				if len(filtered) == 0 {
+					delete(byRepo, repoName)
+				} else {
+					byRepo[repoName] = filtered
+				}
+			}
+		}
 	}
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -128,5 +204,5 @@ func (r *Registry) BindWorkflows(workflows []*workflow.Workflow) error {
 		rp.Workflows = next
 		rp.bindingsMu.Unlock()
 	}
-	return nil
+	return issues, nil
 }

package/internal/run/manager.go

@@ -64,10 +64,48 @@ func newerRun(candidate, current Run) bool {
 // missing claimed run, then ensures the durable run with a value snapshot of
 // the workflow.
 func (m *RunManager) EnsureRun(ctx context.Context, rp *repo.Repo, wf *workflow.Workflow, ticket task.Ticket) error {
+	if rp == nil {
+		return fmt.Errorf("ensure run: repository is unavailable")
+	}
+	if rp.TaskSystem == nil {
+		if rp.TaskSystemError != nil {
+			return fmt.Errorf("ensure run repo %q: task system unavailable: %w", rp.Name, rp.TaskSystemError)
+		}
+		return fmt.Errorf("ensure run repo %q: task system unavailable", rp.Name)
+	}
+	if wf == nil {
+		return fmt.Errorf("ensure run repo %q: workflow is unavailable", rp.Name)
+	}
 	if m.Gate != nil {
 		m.Gate.Lock()
 		defer m.Gate.Unlock()
 	}
+	// Poll routing resolves a binding before entering this method. Resolve
+	// the registry again while holding the same lifecycle gate used by submit
+	// and remove so a concurrent replacement cannot create a run from the old
+	// workflow snapshot.
+	if m.Workflows != nil {
+		current, ok := m.Workflows.Get(wf.Name)
+		if !ok {
+			return fmt.Errorf("ensure run repo %q: workflow %q is no longer stored", rp.Name, wf.Name)
+		}
+		wf = current
+	}
+	if !wf.IsRoutable() {
+		return fmt.Errorf("ensure run repo %q: workflow %q is %s and cannot start a new run", rp.Name, wf.Name, wf.Status)
+	}
+	if m.Workflows != nil {
+		targeted := false
+		for _, repoName := range wf.Repos {
+			if repoName == rp.Name {
+				targeted = true
+				break
+			}
+		}
+		if !targeted {
+			return fmt.Errorf("ensure run repo %q: workflow %q no longer targets this repository", rp.Name, wf.Name)
+		}
+	}
 	id := identity.NewRunID(rp.Name, wf.Name, ticket.Key)
 	claimed := false
 	for _, c := range ticket.WorkflowClaims {
@@ -214,6 +252,9 @@ func (m *RunManager) RestartByTicket(ctx context.Context, ticket string) (Run, e
 	if !ok {
 		return Run{}, fmt.Errorf("%w: workflow %q for canceled run %s is no longer stored", ErrRestartConflict, previous.Workflow, previous.ID)
 	}
+	if !wf.IsRoutable() {
+		return Run{}, fmt.Errorf("%w: workflow %q is %s and cannot be restarted", ErrRestartConflict, wf.Name, wf.Status)
+	}
 	bound := false
 	for _, name := range wf.Repos {
 		if name == previous.Repo {

package/internal/run/run_manager_test.go

@@ -259,6 +259,62 @@ func TestDeterministicRunID(t *testing.T) {
 	}
 }
 
+func TestEnsureRunReResolvesWorkflowUnderLifecycleRegistry(t *testing.T) {
+	log := newEventLog()
+	sys := &recordingSystem{log: log}
+	exec := &fakeExecutor{log: log}
+	old := testWorkflow("basicFlow")
+	latest := testWorkflow("basicFlow")
+	latest.Status = workflow.HealthOutdated
+	workflows := &workflow.Registry{}
+	workflows.Replace(latest)
+	m := &run.RunManager{Executor: exec, Runs: &fakeQueries{}, Workflows: workflows}
+	if err := m.EnsureRun(context.Background(), testRepo(sys), old, task.Ticket{Key: "PAY-101"}); err == nil {
+		t.Fatal("EnsureRun used stale routable workflow despite registry replacement")
+	}
+	if len(exec.ensures) != 0 || len(log.all()) != 0 {
+		t.Fatalf("stale workflow caused external work: ensures=%d events=%v", len(exec.ensures), log.all())
+	}
+}
+
+func TestEnsureRunRejectsOutdatedWorkflow(t *testing.T) {
+	log := newEventLog()
+	sys := &recordingSystem{log: log}
+	exec := &fakeExecutor{log: log}
+	wf := testWorkflow("basicFlow")
+	wf.Status = workflow.HealthOutdated
+	m := &run.RunManager{Executor: exec, Runs: &fakeQueries{}}
+	if err := m.EnsureRun(context.Background(), testRepo(sys), wf, task.Ticket{Key: "PAY-101"}); err == nil {
+		t.Fatal("EnsureRun accepted an outdated workflow")
+	}
+	if len(exec.ensures) != 0 || len(log.all()) != 0 {
+		t.Fatalf("outdated workflow caused external work: ensures=%d events=%v", len(exec.ensures), log.all())
+	}
+}
+
+func TestRestartByTicketRejectsOutdatedWorkflow(t *testing.T) {
+	log := newEventLog()
+	sys := &recordingSystem{log: log}
+	exec := &fakeExecutor{log: log}
+	wf := testWorkflow("basicFlow")
+	wf.Status = workflow.HealthOutdated
+	repos := repo.NewRegistry()
+	repos.Replace(testRepo(sys))
+	workflows := &workflow.Registry{}
+	workflows.Replace(wf)
+	m := &run.RunManager{
+		Executor: exec,
+		Runs:     &fakeQueries{byTicket: map[string]run.Run{"PAY-101": {ID: "old", Repo: "payments", Workflow: "basicFlow", Ticket: task.TicketRef{Key: "PAY-101"}, State: run.StateCanceled}}},
+		Repos:    repos, Workflows: workflows,
+	}
+	if _, err := m.RestartByTicket(context.Background(), "PAY-101"); err == nil {
+		t.Fatal("RestartByTicket accepted an outdated workflow")
+	}
+	if len(exec.ensures) != 0 {
+		t.Fatalf("outdated restart ensured %d runs", len(exec.ensures))
+	}
+}
+
 func TestRestartByTicketCreatesNumericFreshAttempt(t *testing.T) {
 	log := newEventLog()
 	sys := &recordingSystem{log: log}

package/internal/server/observability.go

@@ -105,5 +105,5 @@ func BuildWorkflowDetail(wf *workflow.Workflow, runs []run.Run) WorkflowDetail {
 			active++
 		}
 	}
-	return WorkflowDetail{Workflow: wf, Valid: wf != nil, ActiveRuns: active, RecentRuns: recent}
+	return WorkflowDetail{Workflow: wf, Valid: wf != nil && wf.IsRoutable(), ActiveRuns: active, RecentRuns: recent}
 }

package/internal/task/beads/beads.go

@@ -105,6 +105,7 @@ func init() {
 		DefaultConfig:      DefaultConfig,
 		ValidateTextConfig: validateTextConfig,
 		New:                newSystem,
+		NewLocal:           newSystemLocal,
 	})
 }
 
@@ -184,6 +185,14 @@ func (s *system) AgentEnv() map[string]string {
 // workspace must be supplied by repoConfig; a root-level value never satisfies
 // the required repo-scoped key.
 func beadsTaskScopeKey(rootConfig, repoConfig config.RawValues) (string, error) {
+	beadsDir, err := configuredBeadsDir(rootConfig, repoConfig)
+	if err != nil {
+		return "", err
+	}
+	return canonicalBeadsDir(beadsDir)
+}
+
+func configuredBeadsDir(rootConfig, repoConfig config.RawValues) (string, error) {
 	var root Config
 	if err := config.DecodeStrict(rootConfig, &root); err != nil {
 		return "", fmt.Errorf("root task config: %w", err)
@@ -195,7 +204,7 @@ func beadsTaskScopeKey(rootConfig, repoConfig config.RawValues) (string, error)
 	if strings.TrimSpace(repo.BeadsDir) == "" {
 		return "", errors.New("beads task scope requires repo beadsDir")
 	}
-	return canonicalBeadsDir(repo.BeadsDir)
+	return repo.BeadsDir, nil
 }
 
 func canonicalBeadsDir(value string) (string, error) {
@@ -221,9 +230,31 @@ func canonicalBeadsDir(value string) (string, error) {
 	return filepath.Clean(resolved), nil
 }
 
+func localBeadsDir(rootConfig, repoConfig config.RawValues) (string, error) {
+	configured, err := configuredBeadsDir(rootConfig, repoConfig)
+	if err != nil {
+		return "", err
+	}
+	abs, err := filepath.Abs(strings.TrimSpace(configured))
+	if err != nil {
+		return "", fmt.Errorf("resolve beadsDir %q: %w", configured, err)
+	}
+	return filepath.Clean(abs), nil
+}
+
 // newSystem constructs and probes a repo-bound Beads task system. It does not
 // initialize a workspace or start any Beads/Dolt server.
 func newSystem(ctx context.Context, spec task.RepoSpec) (task.System, error) {
+	return newSystemWithProbe(ctx, spec, true)
+}
+
+// newSystemLocal constructs only local Beads state. Probe is intentionally
+// deferred to workflow submission so restart can still expose management APIs.
+func newSystemLocal(ctx context.Context, spec task.RepoSpec) (task.System, error) {
+	return newSystemWithProbe(ctx, spec, false)
+}
+
+func newSystemWithProbe(ctx context.Context, spec task.RepoSpec, probe bool) (task.System, error) {
 	if strings.TrimSpace(spec.Name) == "" {
 		return nil, errors.New("beads: repo name is required")
 	}
@@ -233,7 +264,12 @@ func newSystem(ctx context.Context, spec task.RepoSpec) (task.System, error) {
 	}
 	// Validate the repo-scoped key before merging with root values. This keeps a
 	// root beadsDir from silently satisfying repository registration.
-	beadsDir, err := beadsTaskScopeKey(spec.RootConfig, spec.RepoConfig)
+	var beadsDir string
+	if probe {
+		beadsDir, err = beadsTaskScopeKey(spec.RootConfig, spec.RepoConfig)
+	} else {
+		beadsDir, err = localBeadsDir(spec.RootConfig, spec.RepoConfig)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("beads repo %q: %w", spec.Name, err)
 	}
@@ -246,8 +282,10 @@ func newSystem(ctx context.Context, spec task.RepoSpec) (task.System, error) {
 		return nil, fmt.Errorf("beads repo %q config: %w", spec.Name, err)
 	}
 	cli := bdcli.New(spec.Path, beadsDir)
-	if err := cli.Probe(ctx); err != nil {
-		return nil, fmt.Errorf("beads repo %q probe: %w", spec.Name, err)
+	if probe {
+		if err := cli.Probe(ctx); err != nil {
+			return nil, fmt.Errorf("beads repo %q probe: %w", spec.Name, err)
+		}
 	}
 	return &system{
 		cli:             cli,

package/internal/task/beads/beads_test.go

@@ -16,6 +16,21 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/task/beads/bdcli"
 )
 
+func TestBeadsLocalFactoryDoesNotProbeMissingWorkspace(t *testing.T) {
+	missing := filepath.Join(t.TempDir(), "not-yet-available")
+	sys, err := task.NewLocal(context.Background(), "beads", task.RepoSpec{
+		Name:       "payments",
+		Path:       t.TempDir(),
+		RepoConfig: config.RawValues{"beadsDir": missing},
+	})
+	if err != nil {
+		t.Fatalf("NewLocal returned error for a missing remote workspace: %v", err)
+	}
+	if sys == nil {
+		t.Fatal("NewLocal returned nil task system")
+	}
+}
+
 func TestBeadsFactoryIsRegisteredWithBeadsDirRequirement(t *testing.T) {
 	if !hasString(task.Names(), "beads") {
 		t.Fatalf("task plugins = %v, want beads", task.Names())

package/internal/task/factory.go

@@ -44,7 +44,13 @@ type Factory struct {
 	Auth                 func(context.Context, []string, io.Reader) error
 	DefaultConfig        func() config.RawValues
 	ValidateTextConfig   func(config.RawValues) error
-	New                  func(context.Context, RepoSpec) (System, error)
+	// New constructs a fully validated repo-bound system. It is used by repo
+	// registration, where connectivity must be confirmed immediately.
+	New func(context.Context, RepoSpec) (System, error)
+	// NewLocal constructs only the local adapter state needed for startup. It
+	// must not probe remote services; submission-time validation owns those
+	// checks. Factories without a local constructor retain the old behavior.
+	NewLocal func(context.Context, RepoSpec) (System, error)
 }
 
 var (
@@ -72,16 +78,49 @@ func lookup(name string) (Factory, error) {
 	return f, nil
 }
 
-// New constructs the repo-bound task System for the named plugin.
+// New constructs the repo-bound task System for the named plugin and runs
+// the adapter's immediate connectivity checks.
 func New(ctx context.Context, name string, spec RepoSpec) (System, error) {
 	f, err := lookup(name)
 	if err != nil {
 		return nil, err
 	}
 	spec.RootConfig = config.Merge(defaultConfig(f), spec.RootConfig)
+	if f.New == nil {
+		return nil, fmt.Errorf("task plugin %q has no constructor", name)
+	}
 	return f.New(ctx, spec)
 }
 
+// ValidateLocal reports whether a task plugin provides the local constructor
+// required by normal startup. This is a machine-wide plugin configuration
+// check, not a repo-specific health result.
+func ValidateLocal(name string) error {
+	f, err := lookup(name)
+	if err != nil {
+		return err
+	}
+	if f.NewLocal == nil {
+		return fmt.Errorf("task plugin %q has no local constructor", name)
+	}
+	return nil
+}
+
+// NewLocal constructs the repo-bound task state without remote probes. Every
+// startup-capable task plugin must explicitly provide this seam; falling back
+// to New would silently reintroduce startup connectivity checks.
+func NewLocal(ctx context.Context, name string, spec RepoSpec) (System, error) {
+	f, err := lookup(name)
+	if err != nil {
+		return nil, err
+	}
+	spec.RootConfig = config.Merge(defaultConfig(f), spec.RootConfig)
+	if f.NewLocal == nil {
+		return nil, fmt.Errorf("task plugin %q has no local constructor", name)
+	}
+	return f.NewLocal(ctx, spec)
+}
+
 // Defaults returns a fresh copy of the selected task plugin's root config
 // defaults for relay-flow init.
 func Defaults(name string) (config.RawValues, error) {

package/internal/task/jira/jira.go

@@ -267,31 +267,49 @@ func init() {
 			}
 			return strings.Join([]string{creds.Site, proj, comp}, "/"), nil
 		},
-		Auth: auth,
-		New: func(ctx context.Context, spec task.RepoSpec) (task.System, error) {
-			merged := config.Merge(spec.RootConfig, spec.RepoConfig)
-			var cfg Config
-			if err := config.DecodeStrict(merged, &cfg); err != nil {
-				return nil, fmt.Errorf("jira repo %q config: %w", spec.Name, err)
-			}
-			creds, err := loadCredentialsDefault()
-			if err != nil {
-				return nil, fmt.Errorf("jira credentials: %w", err)
-			}
-			client, err := sharedClient(creds.Site, creds.Email, creds.Token)
-			if err != nil {
-				return nil, err
-			}
-			sys, err := newSystem(ctx, client, spec)
-			if err != nil {
-				return nil, err
-			}
-			sys.currentUser = strings.TrimSpace(creds.Email)
-			return sys, nil
-		},
+		Auth:     auth,
+		New:      newSystemFromCredentials,
+		NewLocal: newSystemLocal,
 	})
 }
 
+func newSystemFromCredentials(ctx context.Context, spec task.RepoSpec) (task.System, error) {
+	creds, err := loadCredentialsDefault()
+	if err != nil {
+		return nil, fmt.Errorf("jira credentials: %w", err)
+	}
+	client, err := sharedClient(creds.Site, creds.Email, creds.Token)
+	if err != nil {
+		return nil, err
+	}
+	sys, err := newSystem(ctx, client, spec)
+	if err != nil {
+		return nil, err
+	}
+	sys.currentUser = strings.TrimSpace(creds.Email)
+	return sys, nil
+}
+
+// newSystemLocal builds a Jira client and typed adapter state without making
+// assignee or status requests. Those remote checks run only while submitting
+// a candidate workflow.
+func newSystemLocal(ctx context.Context, spec task.RepoSpec) (task.System, error) {
+	creds, err := loadCredentialsDefault()
+	if err != nil {
+		return nil, fmt.Errorf("jira credentials: %w", err)
+	}
+	client, err := sharedClient(creds.Site, creds.Email, creds.Token)
+	if err != nil {
+		return nil, err
+	}
+	sys, err := newSystemWithValidation(ctx, client, spec, false)
+	if err != nil {
+		return nil, err
+	}
+	sys.currentUser = strings.TrimSpace(creds.Email)
+	return sys, nil
+}
+
 func sharedClient(site, email, token string) (*jirarest.HTTPClient, error) {
 	key := strings.TrimRight(site, "/") + "\x00" + email
 	clientsMu.Lock()
@@ -321,6 +339,10 @@ type system struct {
 }
 
 func newSystem(ctx context.Context, cli jirarest.Client, spec task.RepoSpec) (*system, error) {
+	return newSystemWithValidation(ctx, cli, spec, true)
+}
+
+func newSystemWithValidation(ctx context.Context, cli jirarest.Client, spec task.RepoSpec, remoteValidation bool) (*system, error) {
 	if spec.Name == "" {
 		return nil, fmt.Errorf("jira: repo name is required")
 	}
@@ -338,7 +360,7 @@ func newSystem(ctx context.Context, cli jirarest.Client, spec task.RepoSpec) (*s
 	if err := validateTemplates(cfg.Templates); err != nil {
 		return nil, fmt.Errorf("jira repo %q taskConfig.templates: %w", spec.Name, err)
 	}
-	if cfg.Assignee != "" {
+	if remoteValidation && cfg.Assignee != "" {
 		if err := cli.ValidateAssignee(ctx, cfg.Project, cfg.Assignee); err != nil {
 			return nil, fmt.Errorf("jira repo %q assignee %q: %w", spec.Name, cfg.Assignee, err)
 		}
@@ -349,11 +371,13 @@ func newSystem(ctx context.Context, cli jirarest.Client, spec task.RepoSpec) (*s
 		base:      merged,
 		effective: cfg,
 	}
-	if err := s.validateTransition(ctx, "repo config", cfg.Project, cfg.Transition); err != nil {
-		return nil, fmt.Errorf("jira repo %q: %w", spec.Name, err)
-	}
-	if err := validateStatusDefaults(ctx, cli, "repo config", cfg.Project, cfg.StatusDefaults); err != nil {
-		return nil, fmt.Errorf("jira repo %q: %w", spec.Name, err)
+	if remoteValidation {
+		if err := s.validateTransition(ctx, "repo config", cfg.Project, cfg.Transition); err != nil {
+			return nil, fmt.Errorf("jira repo %q: %w", spec.Name, err)
+		}
+		if err := validateStatusDefaults(ctx, cli, "repo config", cfg.Project, cfg.StatusDefaults); err != nil {
+			return nil, fmt.Errorf("jira repo %q: %w", spec.Name, err)
+		}
 	}
 	// project/component are required repo keys enforced at registration. Do not
 	// probe conventional lifecycle names here: repository registration stores

package/internal/workflow/service.go

@@ -40,6 +40,11 @@ type Service struct {
 	// task system before storage. The composition root supplies this callback;
 	// keeping it here avoids widening RepoLookup beyond its documented query.
 	ValidateTaskConfig func(context.Context, *Workflow) error
+	// ValidateSubmission performs the workflow-scoped runner, task-system,
+	// harness, and other environment checks that must happen before the
+	// definition is persisted. Startup intentionally does not repeat these
+	// expensive checks for an accepted workflow.
+	ValidateSubmission func(context.Context, *Workflow) error
 }
 
 func NewService(store *Store, active ActiveRuns, repos RepoLookup) *Service {
@@ -89,12 +94,41 @@ func (s *Service) Submit(ctx context.Context, yamlBytes []byte) (*Workflow, erro
 	if active {
 		return nil, fmt.Errorf("workflow %q has active runs; replacement is rejected", wf.Name)
 	}
+	if s.ValidateSubmission != nil {
+		if err := s.ValidateSubmission(ctx, wf); err != nil {
+			return nil, err
+		}
+	}
+	previousFiles, err := s.store.snapshot(wf.Name)
+	if err != nil {
+		return nil, err
+	}
+	previous, hadPrevious := s.reg.Get(wf.Name)
+	wf.MarkHealthy()
 	if err := s.store.Put(wf.Name, yamlBytes); err != nil {
 		return nil, err
 	}
 	s.reg.Replace(wf)
 	if s.Rebind != nil {
 		if err := s.Rebind(); err != nil {
+			// A binding failure is part of submission failure: restore both the
+			// durable pair and the registry entry before returning.
+			restoreErr := s.store.restorePair(wf.Name, previousFiles)
+			if hadPrevious {
+				s.reg.Replace(previous)
+			} else {
+				s.reg.Remove(wf.Name)
+			}
+			if rebindErr := s.Rebind(); rebindErr != nil {
+				if restoreErr == nil {
+					restoreErr = rebindErr
+				} else {
+					restoreErr = fmt.Errorf("restore bindings: %v; restore files: %w", rebindErr, restoreErr)
+				}
+			}
+			if restoreErr != nil {
+				return nil, fmt.Errorf("rebind workflows for %q: %w (rollback failed: %v)", wf.Name, err, restoreErr)
+			}
 			return nil, fmt.Errorf("rebind workflows for %q: %w", wf.Name, err)
 		}
 	}
@@ -115,12 +149,31 @@ func (s *Service) Remove(ctx context.Context, name string) error {
 	if active {
 		return fmt.Errorf("workflow %q has active runs; removal is rejected", name)
 	}
+	previousFiles, err := s.store.snapshot(name)
+	if err != nil {
+		return err
+	}
+	previous, hadPrevious := s.reg.Get(name)
 	if err := s.store.Remove(name); err != nil {
 		return err
 	}
 	s.reg.Remove(name)
 	if s.Rebind != nil {
 		if err := s.Rebind(); err != nil {
+			restoreErr := s.store.restorePair(name, previousFiles)
+			if hadPrevious {
+				s.reg.Replace(previous)
+			}
+			if rebindErr := s.Rebind(); rebindErr != nil {
+				if restoreErr == nil {
+					restoreErr = rebindErr
+				} else {
+					restoreErr = fmt.Errorf("restore bindings: %v; restore files: %w", rebindErr, restoreErr)
+				}
+			}
+			if restoreErr != nil {
+				return fmt.Errorf("rebind workflows after removing %q: %w (rollback failed: %v)", name, err, restoreErr)
+			}
 			return fmt.Errorf("rebind workflows after removing %q: %w", name, err)
 		}
 	}