relay-flow 0.3.7-alpha → 0.3.9-alpha

package/internal/execution/projection/projection.go

@@ -257,24 +257,69 @@ func (p *RunProjection) insertStart(ctx context.Context, s run.Start, now time.T
 }
 
 func (p *RunProjection) updateState(ctx context.Context, id run.ID, state run.State, lastErr string, finished *time.Time) error {
+	_, err := p.updateStateCAS(ctx, id, nil, state, lastErr, finished)
+	return err
+}
+
+// beginCancellation atomically claims cancellation of a nonterminal run. A
+// run already in canceling keeps its original reason; completed/canceled runs
+// are never moved backwards. The returned row is read after the conditional
+// update so concurrent cancel/complete callers observe the winner.
+func (p *RunProjection) beginCancellation(ctx context.Context, id run.ID, reason string) (run.Run, error) {
+	_, err := p.DB.ExecContext(ctx, `
+		UPDATE relay_runs SET state = ?, last_error = ?, updated_at = ?
+		WHERE id = ? AND state NOT IN ('completed', 'canceled', 'canceling')`,
+		string(run.StateCanceling), reason, time.Now().UTC(), string(id))
+	if err != nil {
+		return run.Run{}, err
+	}
+	return p.get(ctx, id)
+}
+
+func (p *RunProjection) updateStateCAS(ctx context.Context, id run.ID, expected *run.State, state run.State, lastErr string, finished *time.Time) (bool, error) {
 	terminal := state == run.StateCompleted || state == run.StateCanceled
 	now := time.Now().UTC()
-	_, err := p.DB.ExecContext(ctx, `
+	query := `
 		UPDATE relay_runs SET state = ?, last_error = ?, updated_at = ?, finished_at = COALESCE(?, finished_at),
 			retry_error = CASE WHEN ? THEN NULL ELSE retry_error END,
 			retry_attempt = CASE WHEN ? THEN NULL ELSE retry_attempt END,
 			next_retry_at = CASE WHEN ? THEN NULL ELSE next_retry_at END
-		WHERE id = ?`,
-		string(state), lastErr, now, finished, terminal, terminal, terminal, string(id))
+		WHERE id = ?`
+	args := []any{
+		string(state), lastErr, now, finished, terminal, terminal, terminal,
+		string(id),
+	}
+	if expected == nil {
+		// Ordinary workflow projection updates are fenced after cancellation or
+		// any terminal state has won. Explicit compare-and-set callers below
+		// are allowed to reconcile a known canceling row to its inspected
+		// terminal engine result.
+		query += ` AND NOT (
+			(state = 'canceling' AND ? NOT IN ('canceling', 'canceled'))
+			OR (state IN ('completed', 'canceled') AND state <> ?)
+		)`
+		args = append(args, string(state), string(state))
+	} else {
+		query += ` AND state = ? AND NOT (state IN ('completed', 'canceled') AND state <> ?)`
+		args = append(args, string(*expected), string(state))
+	}
+	result, err := p.DB.ExecContext(ctx, query, args...)
 	if err != nil {
-		return err
+		return false, err
+	}
+	updated, err := result.RowsAffected()
+	if err != nil {
+		return false, err
+	}
+	if updated != 1 {
+		return false, nil
 	}
 	// Keep the derived timeline useful during retries and cancellation without
 	// making it an execution authority. Identify one active row first; a
 	// repeated terminal update with no active row is a no-op for the timeline.
 	stepStatus := stepStatusForRunState(state)
 	if stepStatus == "" {
-		return nil
+		return true, nil
 	}
 	var sequence int64
 	var startedAt sql.NullTime
@@ -283,14 +328,14 @@ func (p *RunProjection) updateState(ctx context.Context, id run.ID, state run.St
 		WHERE run_id = ? AND status IN ('running', 'waiting', 'blocked')
 		ORDER BY sequence DESC LIMIT 1`, string(id)).Scan(&sequence, &startedAt)
 	if errors.Is(lookupErr, sql.ErrNoRows) {
-		return nil
+		return true, nil
 	}
 	if lookupErr != nil {
 		// relay_run_steps is display/cache data. The authoritative relay_runs
 		// state update above has already succeeded and must not be retried just
 		// because this optional projection is unavailable.
 		slog.Warn("step projection state lookup unavailable", "runID", string(id), "state", state, "error", lookupErr)
-		return nil
+		return true, nil
 	}
 	var stepFinished any
 	if terminal {
@@ -300,7 +345,7 @@ func (p *RunProjection) updateState(ctx context.Context, id run.ID, state run.St
 			stepFinished = now
 		}
 	}
-	result, err := p.DB.ExecContext(ctx, `
+	result, err = p.DB.ExecContext(ctx, `
 		UPDATE relay_run_steps SET status = ?, message = CASE WHEN ? <> '' THEN ? ELSE message END,
 			finished_at = CASE WHEN ? THEN COALESCE(finished_at, ?) ELSE finished_at END
 		WHERE run_id = ? AND sequence = ? AND status IN ('running', 'waiting', 'blocked')`,
@@ -308,11 +353,11 @@ func (p *RunProjection) updateState(ctx context.Context, id run.ID, state run.St
 		string(id), sequence)
 	if err != nil {
 		slog.Warn("step projection state update unavailable", "runID", string(id), "state", state, "error", err)
-		return nil
+		return true, nil
 	}
-	updated, err := result.RowsAffected()
+	updated, err = result.RowsAffected()
 	if err != nil || updated != 1 {
-		return nil
+		return true, nil
 	}
 	if terminal && startedAt.Valid {
 		endAt := now
@@ -327,7 +372,7 @@ func (p *RunProjection) updateState(ctx context.Context, id run.ID, state run.St
 			slog.Warn("step projection duration update unavailable", "runID", string(id), "state", state, "error", durationErr)
 		}
 	}
-	return nil
+	return true, nil
 }
 
 func (p *RunProjection) updateRetry(ctx context.Context, id run.ID, status *run.RetryStatus) error {
@@ -352,12 +397,20 @@ func (p *RunProjection) updateNode(ctx context.Context, id run.ID, state run.Sta
 	}
 	defer tx.Rollback()
 	now := time.Now().UTC()
-	if _, err := tx.ExecContext(ctx, `
+	result, err := tx.ExecContext(ctx, `
 		UPDATE relay_runs SET state = ?, current_node = ?, current_node_visit_id = ?, updated_at = ?
-		WHERE id = ?`,
-		string(state), node, string(visit), now, string(id)); err != nil {
+		WHERE id = ? AND state NOT IN ('canceling', 'completed', 'canceled')`,
+		string(state), node, string(visit), now, string(id))
+	if err != nil {
 		return err
 	}
+	updated, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if updated != 1 {
+		return tx.Commit()
+	}
 	// A revisit changes only the latest visit ID. Reusable terminal/session
 	// identities remain attached to this run/node row.
 	if _, err := tx.ExecContext(ctx, `
@@ -907,6 +960,18 @@ func (p *RunProjection) UpdateState(ctx context.Context, id run.ID, state run.St
 	return p.updateState(ctx, id, state, lastErr, finished)
 }
 
+// BeginCancellation atomically moves a nonterminal run to canceling and
+// returns the persisted row. Existing canceling rows retain their reason.
+func (p *RunProjection) BeginCancellation(ctx context.Context, id run.ID, reason string) (run.Run, error) {
+	return p.beginCancellation(ctx, id, reason)
+}
+
+// UpdateStateIf applies a lifecycle transition only while the row has the
+// expected state. It returns false when another transition won the race.
+func (p *RunProjection) UpdateStateIf(ctx context.Context, id run.ID, expected, state run.State, lastErr string, finished *time.Time) (bool, error) {
+	return p.updateStateCAS(ctx, id, &expected, state, lastErr, finished)
+}
+
 // UpdateRetry updates or clears active retry metadata.
 func (p *RunProjection) UpdateRetry(ctx context.Context, id run.ID, status *run.RetryStatus) error {
 	return p.updateRetry(ctx, id, status)

package/internal/execution/temporal/activities.go

@@ -37,6 +37,12 @@ func (a *Activities) taskSystem(repoName string) (task.System, error) {
 	if !ok {
 		return nil, fmt.Errorf("repo %q is not registered", repoName)
 	}
+	if rp.TaskSystem == nil {
+		if rp.TaskSystemError != nil {
+			return nil, fmt.Errorf("repo %q task system unavailable: %w", repoName, rp.TaskSystemError)
+		}
+		return nil, fmt.Errorf("repo %q task system unavailable", repoName)
+	}
 	return rp.TaskSystem, nil
 }
 

package/internal/execution/temporal/recovery.go

@@ -141,6 +141,10 @@ func listWorkflowExecutions(ctx context.Context, list func(context.Context, *wor
 // ID is described and restored only when Temporal already owns that execution.
 func (e *Engine) reconcileClaimedParents(ctx context.Context, visible map[string]bool) error {
 	for _, rp := range e.deps.Repos.List() {
+		if rp.TaskSystem == nil {
+			slog.Warn("Temporal recovery skipping repository with unavailable task system", "repo", rp.Name, "error", rp.TaskSystemError)
+			continue
+		}
 		tickets, err := rp.TaskSystem.Poll(ctx)
 		if err != nil {
 			return fmt.Errorf("poll repo %q during Temporal recovery: %w", rp.Name, err)

package/internal/harness/opencode/opencode_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/workflow"
 )
 
-const configuredPlugin = "relay-flow-plugin@0.3.7-alpha"
+const configuredPlugin = "relay-flow-plugin@0.3.9-alpha"
 
 func TestBuildCommandArgv(t *testing.T) {
 	t.Setenv("RELAY_FLOW_HOME", "/var/lib/relay-flow-test")

package/internal/harness/opencode/repo_setup.go

@@ -10,7 +10,7 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/config"
 )
 
-const relayFlowPlugin = "relay-flow-plugin@0.3.7-alpha"
+const relayFlowPlugin = "relay-flow-plugin@0.3.9-alpha"
 
 type jsoncToken struct {
 	kind       byte

package/internal/recover/recover.go

@@ -46,6 +46,10 @@ type MailboxSpecFor func(task.System, run.Work, *workflow.Workflow) ([]task.Mail
 // never automatic; database loss is never inferred.
 func FromTaskSystem(ctx context.Context, repoReg *repo.Registry, rnr runner.Runner, runManager *run.RunManager, specsFor MailboxSpecFor) error {
 	for _, rp := range repoReg.List() {
+		if rp.TaskSystem == nil {
+			slog.Warn("recover: skip repository with unavailable task system", "repo", rp.Name, "error", rp.TaskSystemError)
+			continue
+		}
 		tickets, err := rp.TaskSystem.Poll(ctx)
 		if err != nil {
 			return fmt.Errorf("repo %q poll: %w", rp.Name, err)

package/internal/repo/binding_test.go

@@ -0,0 +1,92 @@
+package repo
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/task"
+	"github.com/rajpopat27/relay-flow/internal/workflow"
+)
+
+type bindingTaskSystem struct {
+	task.System
+	compileErr map[string]error
+}
+
+func (s bindingTaskSystem) CompileFilter(values config.RawValues) (func(task.Ticket) bool, error) {
+	if name, ok := values["name"].(string); ok {
+		if err := s.compileErr[name]; err != nil {
+			return nil, err
+		}
+		return func(ticket task.Ticket) bool { return ticket.Key == name }, nil
+	}
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func TestBindWorkflowsIsolatedPublishesHealthyWorkflows(t *testing.T) {
+	system := bindingTaskSystem{compileErr: map[string]error{"bad": errors.New("invalid filter")}}
+	registered := &Repo{Name: "payments", TaskSystem: system}
+	registry := NewRegistry()
+	registry.Replace(registered)
+
+	bad := &workflow.Workflow{Name: "badFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy, TaskConfig: config.RawValues{"name": "bad"}}
+	good := &workflow.Workflow{Name: "goodFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy, TaskConfig: config.RawValues{"name": "good"}}
+	issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{bad, good})
+	if len(issues) != 1 || issues[0].Workflow != bad {
+		t.Fatalf("binding issues = %#v, want only badFlow", issues)
+	}
+	if bad.Status != workflow.HealthBlocked || bad.StatusReason == "" {
+		t.Fatalf("bad workflow status = %q reason=%q", bad.Status, bad.StatusReason)
+	}
+	bindings := registered.Bindings()
+	if len(bindings) != 1 || bindings[0].Workflow != good {
+		t.Fatalf("published bindings = %#v, want only goodFlow", bindings)
+	}
+}
+
+func TestBindWorkflowsIsolatedSkipsOutdatedWorkflow(t *testing.T) {
+	registered := &Repo{Name: "payments", TaskSystem: bindingTaskSystem{}}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	wf := &workflow.Workflow{Name: "editedFlow", Repos: []string{"payments"}, Status: workflow.HealthOutdated}
+	if issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{wf}); len(issues) != 0 {
+		t.Fatalf("outdated workflow binding issues = %#v, want none", issues)
+	}
+	if bindings := registered.Bindings(); len(bindings) != 0 {
+		t.Fatalf("outdated workflow bindings = %#v, want none", bindings)
+	}
+}
+
+func TestBindWorkflowsIsolatedBlocksUnavailableTaskSystem(t *testing.T) {
+	registered := &Repo{Name: "payments", TaskSystemError: errors.New("task service offline")}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	wf := &workflow.Workflow{Name: "paymentsFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy}
+	issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{wf})
+	if len(issues) != 1 || wf.Status != workflow.HealthBlocked || !strings.Contains(wf.StatusReason, "task service offline") {
+		t.Fatalf("unavailable task system issues=%#v status=%q reason=%q", issues, wf.Status, wf.StatusReason)
+	}
+	if bindings := registered.Bindings(); len(bindings) != 0 {
+		t.Fatalf("unavailable repo bindings = %#v, want none", bindings)
+	}
+}
+
+func TestBindWorkflowsIsolatedClearsStaleBindings(t *testing.T) {
+	registered := &Repo{Name: "payments", TaskSystem: bindingTaskSystem{}}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	first := &workflow.Workflow{Name: "firstFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy}
+	if issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{first}); len(issues) != 0 {
+		t.Fatalf("initial binding issues = %#v", issues)
+	}
+	second := &workflow.Workflow{Name: "secondFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy}
+	if issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{second}); len(issues) != 0 {
+		t.Fatalf("replacement binding issues = %#v", issues)
+	}
+	bindings := registered.Bindings()
+	if len(bindings) != 1 || bindings[0].Workflow != second {
+		t.Fatalf("replacement bindings = %#v, want only secondFlow", bindings)
+	}
+}

package/internal/repo/poller.go

@@ -39,6 +39,9 @@ func (p *RepoPoller) Run(ctx context.Context) {
 }
 
 func (p *RepoPoller) poll(ctx context.Context) {
+	if p.Repo == nil || p.Repo.TaskSystem == nil {
+		return
+	}
 	if p.sem != nil {
 		select {
 		case p.sem <- struct{}{}:

package/internal/repo/repo.go

@@ -31,8 +31,12 @@ type Repo struct {
 	Path       string
 	TaskConfig config.RawValues
 	TaskSystem task.System
-	Workflows  []WorkflowBinding
-	bindingsMu sync.RWMutex
+	// TaskSystemError is set when local startup construction could not create
+	// a usable adapter. The repo remains visible for diagnostics and repair,
+	// while only workflows referencing it are isolated.
+	TaskSystemError error
+	Workflows       []WorkflowBinding
+	bindingsMu      sync.RWMutex
 }
 
 func (r *Repo) Info() Info {
@@ -95,25 +99,97 @@ func (r *Registry) Remove(name string) {
 // BindWorkflows rebuilds the derived Repo.Workflows index from the given
 // workflows. Each repo that a workflow lists gets a binding with the
 // matcher compiled by that repo's task system. Repos not listed by a
-// workflow keep no binding for it.
+// workflow keep no binding for it. The strict form is used by submission,
+// where a binding error must reject the candidate before it is stored.
 func (r *Registry) BindWorkflows(workflows []*workflow.Workflow) error {
+	_, err := r.bindWorkflows(workflows, false)
+	return err
+}
+
+// BindingIssue identifies a workflow that could not be safely published.
+// Startup uses the isolated form so one invalid workflow does not prevent
+// unrelated workflows from being bound.
+type BindingIssue struct {
+	Workflow *workflow.Workflow
+	Error    error
+}
+
+// BindWorkflowsIsolated rebuilds all bindings while isolating workflows whose
+// referenced repo or matcher cannot be built. The returned issues are
+// diagnostics only; valid workflows are still published atomically.
+func (r *Registry) BindWorkflowsIsolated(workflows []*workflow.Workflow) []BindingIssue {
+	issues, _ := r.bindWorkflows(workflows, true)
+	return issues
+}
+
+func (r *Registry) bindWorkflows(workflows []*workflow.Workflow, isolate bool) ([]BindingIssue, error) {
 	type binding struct {
 		wf    *workflow.Workflow
 		match func(task.Ticket) bool
 	}
 	byRepo := map[string][]binding{}
+	issues := []BindingIssue{}
 	for _, wf := range workflows {
+		if wf == nil || !wf.IsRoutable() {
+			continue
+		}
+		failed := false
 		for _, repoName := range wf.Repos {
 			rp, ok := r.Get(repoName)
 			if !ok {
-				return fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
+				err := fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
+			}
+			if rp.TaskSystem == nil {
+				reason := rp.TaskSystemError
+				if reason == nil {
+					reason = fmt.Errorf("repo %q task system is unavailable", repoName)
+				}
+				err := fmt.Errorf("workflow %q repo %q: task system unavailable: %w", wf.Name, repoName, reason)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
 			}
 			match, err := rp.TaskSystem.CompileFilter(wf.TaskConfig)
 			if err != nil {
-				return fmt.Errorf("workflow %q repo %q: compile filter: %w", wf.Name, repoName, err)
+				err = fmt.Errorf("workflow %q repo %q: compile filter: %w", wf.Name, repoName, err)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
 			}
 			byRepo[repoName] = append(byRepo[repoName], binding{wf: wf, match: match})
 		}
+		if failed {
+			// A workflow is all-or-nothing across its referenced repositories;
+			// never leave a partial route for it.
+			for repoName, binds := range byRepo {
+				filtered := binds[:0]
+				for _, b := range binds {
+					if b.wf != wf {
+						filtered = append(filtered, b)
+					}
+				}
+				if len(filtered) == 0 {
+					delete(byRepo, repoName)
+				} else {
+					byRepo[repoName] = filtered
+				}
+			}
+		}
 	}
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -128,5 +204,5 @@ func (r *Registry) BindWorkflows(workflows []*workflow.Workflow) error {
 		rp.Workflows = next
 		rp.bindingsMu.Unlock()
 	}
-	return nil
+	return issues, nil
 }

package/internal/run/manager.go

@@ -64,10 +64,48 @@ func newerRun(candidate, current Run) bool {
 // missing claimed run, then ensures the durable run with a value snapshot of
 // the workflow.
 func (m *RunManager) EnsureRun(ctx context.Context, rp *repo.Repo, wf *workflow.Workflow, ticket task.Ticket) error {
+	if rp == nil {
+		return fmt.Errorf("ensure run: repository is unavailable")
+	}
+	if rp.TaskSystem == nil {
+		if rp.TaskSystemError != nil {
+			return fmt.Errorf("ensure run repo %q: task system unavailable: %w", rp.Name, rp.TaskSystemError)
+		}
+		return fmt.Errorf("ensure run repo %q: task system unavailable", rp.Name)
+	}
+	if wf == nil {
+		return fmt.Errorf("ensure run repo %q: workflow is unavailable", rp.Name)
+	}
 	if m.Gate != nil {
 		m.Gate.Lock()
 		defer m.Gate.Unlock()
 	}
+	// Poll routing resolves a binding before entering this method. Resolve
+	// the registry again while holding the same lifecycle gate used by submit
+	// and remove so a concurrent replacement cannot create a run from the old
+	// workflow snapshot.
+	if m.Workflows != nil {
+		current, ok := m.Workflows.Get(wf.Name)
+		if !ok {
+			return fmt.Errorf("ensure run repo %q: workflow %q is no longer stored", rp.Name, wf.Name)
+		}
+		wf = current
+	}
+	if !wf.IsRoutable() {
+		return fmt.Errorf("ensure run repo %q: workflow %q is %s and cannot start a new run", rp.Name, wf.Name, wf.Status)
+	}
+	if m.Workflows != nil {
+		targeted := false
+		for _, repoName := range wf.Repos {
+			if repoName == rp.Name {
+				targeted = true
+				break
+			}
+		}
+		if !targeted {
+			return fmt.Errorf("ensure run repo %q: workflow %q no longer targets this repository", rp.Name, wf.Name)
+		}
+	}
 	id := identity.NewRunID(rp.Name, wf.Name, ticket.Key)
 	claimed := false
 	for _, c := range ticket.WorkflowClaims {
@@ -214,6 +252,9 @@ func (m *RunManager) RestartByTicket(ctx context.Context, ticket string) (Run, e
 	if !ok {
 		return Run{}, fmt.Errorf("%w: workflow %q for canceled run %s is no longer stored", ErrRestartConflict, previous.Workflow, previous.ID)
 	}
+	if !wf.IsRoutable() {
+		return Run{}, fmt.Errorf("%w: workflow %q is %s and cannot be restarted", ErrRestartConflict, wf.Name, wf.Status)
+	}
 	bound := false
 	for _, name := range wf.Repos {
 		if name == previous.Repo {

package/internal/run/run_manager_test.go

@@ -259,6 +259,62 @@ func TestDeterministicRunID(t *testing.T) {
 	}
 }
 
+func TestEnsureRunReResolvesWorkflowUnderLifecycleRegistry(t *testing.T) {
+	log := newEventLog()
+	sys := &recordingSystem{log: log}
+	exec := &fakeExecutor{log: log}
+	old := testWorkflow("basicFlow")
+	latest := testWorkflow("basicFlow")
+	latest.Status = workflow.HealthOutdated
+	workflows := &workflow.Registry{}
+	workflows.Replace(latest)
+	m := &run.RunManager{Executor: exec, Runs: &fakeQueries{}, Workflows: workflows}
+	if err := m.EnsureRun(context.Background(), testRepo(sys), old, task.Ticket{Key: "PAY-101"}); err == nil {
+		t.Fatal("EnsureRun used stale routable workflow despite registry replacement")
+	}
+	if len(exec.ensures) != 0 || len(log.all()) != 0 {
+		t.Fatalf("stale workflow caused external work: ensures=%d events=%v", len(exec.ensures), log.all())
+	}
+}
+
+func TestEnsureRunRejectsOutdatedWorkflow(t *testing.T) {
+	log := newEventLog()
+	sys := &recordingSystem{log: log}
+	exec := &fakeExecutor{log: log}
+	wf := testWorkflow("basicFlow")
+	wf.Status = workflow.HealthOutdated
+	m := &run.RunManager{Executor: exec, Runs: &fakeQueries{}}
+	if err := m.EnsureRun(context.Background(), testRepo(sys), wf, task.Ticket{Key: "PAY-101"}); err == nil {
+		t.Fatal("EnsureRun accepted an outdated workflow")
+	}
+	if len(exec.ensures) != 0 || len(log.all()) != 0 {
+		t.Fatalf("outdated workflow caused external work: ensures=%d events=%v", len(exec.ensures), log.all())
+	}
+}
+
+func TestRestartByTicketRejectsOutdatedWorkflow(t *testing.T) {
+	log := newEventLog()
+	sys := &recordingSystem{log: log}
+	exec := &fakeExecutor{log: log}
+	wf := testWorkflow("basicFlow")
+	wf.Status = workflow.HealthOutdated
+	repos := repo.NewRegistry()
+	repos.Replace(testRepo(sys))
+	workflows := &workflow.Registry{}
+	workflows.Replace(wf)
+	m := &run.RunManager{
+		Executor: exec,
+		Runs:     &fakeQueries{byTicket: map[string]run.Run{"PAY-101": {ID: "old", Repo: "payments", Workflow: "basicFlow", Ticket: task.TicketRef{Key: "PAY-101"}, State: run.StateCanceled}}},
+		Repos:    repos, Workflows: workflows,
+	}
+	if _, err := m.RestartByTicket(context.Background(), "PAY-101"); err == nil {
+		t.Fatal("RestartByTicket accepted an outdated workflow")
+	}
+	if len(exec.ensures) != 0 {
+		t.Fatalf("outdated restart ensured %d runs", len(exec.ensures))
+	}
+}
+
 func TestRestartByTicketCreatesNumericFreshAttempt(t *testing.T) {
 	log := newEventLog()
 	sys := &recordingSystem{log: log}

package/internal/server/observability.go

@@ -105,5 +105,5 @@ func BuildWorkflowDetail(wf *workflow.Workflow, runs []run.Run) WorkflowDetail {
 			active++
 		}
 	}
-	return WorkflowDetail{Workflow: wf, Valid: wf != nil, ActiveRuns: active, RecentRuns: recent}
+	return WorkflowDetail{Workflow: wf, Valid: wf != nil && wf.IsRoutable(), ActiveRuns: active, RecentRuns: recent}
 }

package/internal/task/beads/beads.go

@@ -105,6 +105,7 @@ func init() {
 		DefaultConfig:      DefaultConfig,
 		ValidateTextConfig: validateTextConfig,
 		New:                newSystem,
+		NewLocal:           newSystemLocal,
 	})
 }
 
@@ -184,6 +185,14 @@ func (s *system) AgentEnv() map[string]string {
 // workspace must be supplied by repoConfig; a root-level value never satisfies
 // the required repo-scoped key.
 func beadsTaskScopeKey(rootConfig, repoConfig config.RawValues) (string, error) {
+	beadsDir, err := configuredBeadsDir(rootConfig, repoConfig)
+	if err != nil {
+		return "", err
+	}
+	return canonicalBeadsDir(beadsDir)
+}
+
+func configuredBeadsDir(rootConfig, repoConfig config.RawValues) (string, error) {
 	var root Config
 	if err := config.DecodeStrict(rootConfig, &root); err != nil {
 		return "", fmt.Errorf("root task config: %w", err)
@@ -195,7 +204,7 @@ func beadsTaskScopeKey(rootConfig, repoConfig config.RawValues) (string, error)
 	if strings.TrimSpace(repo.BeadsDir) == "" {
 		return "", errors.New("beads task scope requires repo beadsDir")
 	}
-	return canonicalBeadsDir(repo.BeadsDir)
+	return repo.BeadsDir, nil
 }
 
 func canonicalBeadsDir(value string) (string, error) {
@@ -221,9 +230,31 @@ func canonicalBeadsDir(value string) (string, error) {
 	return filepath.Clean(resolved), nil
 }
 
+func localBeadsDir(rootConfig, repoConfig config.RawValues) (string, error) {
+	configured, err := configuredBeadsDir(rootConfig, repoConfig)
+	if err != nil {
+		return "", err
+	}
+	abs, err := filepath.Abs(strings.TrimSpace(configured))
+	if err != nil {
+		return "", fmt.Errorf("resolve beadsDir %q: %w", configured, err)
+	}
+	return filepath.Clean(abs), nil
+}
+
 // newSystem constructs and probes a repo-bound Beads task system. It does not
 // initialize a workspace or start any Beads/Dolt server.
 func newSystem(ctx context.Context, spec task.RepoSpec) (task.System, error) {
+	return newSystemWithProbe(ctx, spec, true)
+}
+
+// newSystemLocal constructs only local Beads state. Probe is intentionally
+// deferred to workflow submission so restart can still expose management APIs.
+func newSystemLocal(ctx context.Context, spec task.RepoSpec) (task.System, error) {
+	return newSystemWithProbe(ctx, spec, false)
+}
+
+func newSystemWithProbe(ctx context.Context, spec task.RepoSpec, probe bool) (task.System, error) {
 	if strings.TrimSpace(spec.Name) == "" {
 		return nil, errors.New("beads: repo name is required")
 	}
@@ -233,7 +264,12 @@ func newSystem(ctx context.Context, spec task.RepoSpec) (task.System, error) {
 	}
 	// Validate the repo-scoped key before merging with root values. This keeps a
 	// root beadsDir from silently satisfying repository registration.
-	beadsDir, err := beadsTaskScopeKey(spec.RootConfig, spec.RepoConfig)
+	var beadsDir string
+	if probe {
+		beadsDir, err = beadsTaskScopeKey(spec.RootConfig, spec.RepoConfig)
+	} else {
+		beadsDir, err = localBeadsDir(spec.RootConfig, spec.RepoConfig)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("beads repo %q: %w", spec.Name, err)
 	}
@@ -246,8 +282,10 @@ func newSystem(ctx context.Context, spec task.RepoSpec) (task.System, error) {
 		return nil, fmt.Errorf("beads repo %q config: %w", spec.Name, err)
 	}
 	cli := bdcli.New(spec.Path, beadsDir)
-	if err := cli.Probe(ctx); err != nil {
-		return nil, fmt.Errorf("beads repo %q probe: %w", spec.Name, err)
+	if probe {
+		if err := cli.Probe(ctx); err != nil {
+			return nil, fmt.Errorf("beads repo %q probe: %w", spec.Name, err)
+		}
 	}
 	return &system{
 		cli:             cli,