From d31d1b460c30fd9f081b348de80cf57eb5fe5c8b Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:01:13 +0000
Subject: [PATCH 1/9] Server parity: embedded v2 history import fixture,
 recorded from published 2.11.1

POST /api/workflows/import/embedded-v2 from bundles built out of real
published exports (a completed run with an activity, timer, signal, memo and
search attributes; a terminated run; a running run): the request gates, body
shapes, a dry run, an import, idempotent and conflicting repeats, integrity
and signature refusals, each eligibility rule, request normalization before
the checksum, bare bundles, a failed write, non-terminal imports, and the
imported run through describe, runs, history and list. Recorded three times,
identical. Two published defects are bounded: the importer finds runs and
instances in every namespace, so a bundle imported elsewhere answers
already_imported and an import takes over an instance of another namespace.
---
 .github/workflows/server-parity.yml           |    4 +-
 .../conformance/server-parity/contract.mjs    |    3 +
 scripts/conformance/server-parity/probe.php   |    6 +
 .../workflow-import-contract.mjs              |   44 +
 .../server-parity/workflow-import-probe.php   |  348 +
 .../ServerParity/workflow-import.json         | 9086 +++++++++++++++++
 .../workflow-import-observation.json          | 6674 ++++++++++++
 ...ServerParityWorkflowImportContractTest.mjs |   96 +
 8 files changed, 16260 insertions(+), 1 deletion(-)
 create mode 100644 scripts/conformance/server-parity/workflow-import-contract.mjs
 create mode 100644 scripts/conformance/server-parity/workflow-import-probe.php
 create mode 100644 tests/Fixtures/ServerParity/workflow-import.json
 create mode 100644 tests/Fixtures/ServerParityExpected/workflow-import-observation.json
 create mode 100644 tests/Unit/ServerParityWorkflowImportContractTest.mjs

diff --git a/.github/workflows/server-parity.yml b/.github/workflows/server-parity.yml
index 9960470e7..ac9285b2b 100644
--- a/.github/workflows/server-parity.yml
+++ b/.github/workflows/server-parity.yml
@@ -36,6 +36,7 @@ on:
       - tests/Unit/ServerParityOperatorMetricsContractTest.mjs
       - tests/Unit/ServerParityActivityLeaseRenewalContractTest.mjs
       - tests/Unit/ServerParityServiceCatalogContractTest.mjs
+      - tests/Unit/ServerParityWorkflowImportContractTest.mjs
       - tests/Unit/ServerParitySystemMetricsContractTest.mjs
       - tests/Unit/ServerParityOperatorDashboardTypesContractTest.mjs
       - tests/Unit/ServerParityPrometheusMetricsContractTest.mjs
@@ -92,6 +93,7 @@ on:
       - tests/Unit/ServerParityOperatorMetricsContractTest.mjs
       - tests/Unit/ServerParityActivityLeaseRenewalContractTest.mjs
       - tests/Unit/ServerParityServiceCatalogContractTest.mjs
+      - tests/Unit/ServerParityWorkflowImportContractTest.mjs
       - tests/Unit/ServerParitySystemMetricsContractTest.mjs
       - tests/Unit/ServerParityOperatorDashboardTypesContractTest.mjs
       - tests/Unit/ServerParityPrometheusMetricsContractTest.mjs
@@ -1529,7 +1531,7 @@ jobs:
             -e COMPOSER_HOME=/tmp/composer -v "$PWD:/source" -w /source "$image" \
             install --working-dir=scripts/conformance/server-parity --no-interaction --no-progress
           docker run --rm --user=1000:1000 --entrypoint node -v "$PWD:/source:ro" -w /source \
-            "$image" --test tests/Unit/ServerParityRunnerTest.mjs tests/Unit/ServerParityCooperativeContractTest.mjs tests/Unit/ServerParityChildCancellationContractTest.mjs tests/Unit/ServerParityScheduleContractTest.mjs tests/Unit/ServerParityVisibilityContractTest.mjs tests/Unit/ServerParityAdmissionContractTest.mjs tests/Unit/ServerParityRoleTokenContractTest.mjs tests/Unit/ServerParityWorkerDeregistrationContractTest.mjs tests/Unit/ServerParitySearchAttributeContractTest.mjs tests/Unit/ServerParityWorkerListingContractTest.mjs tests/Unit/ServerParityWorkerReplacementContractTest.mjs tests/Unit/ServerParityPatchDeploymentContractTest.mjs tests/Unit/ServerParityWaitingHistoryContractTest.mjs tests/Unit/ServerParityTaskRetryContractTest.mjs tests/Unit/ServerParityPublishedPatchContractTest.mjs tests/Unit/ServerParityPublishedPatchTransportTest.mjs tests/Unit/ServerParityRecordFileTest.mjs tests/Unit/ServerParityLateWorkflowCompletionContractTest.mjs tests/Unit/ServerParityStorageTestContractTest.mjs tests/Unit/ServerParitySchedulePoliciesContractTest.mjs tests/Unit/ServerParitySignalsBeforeWorkerContractTest.mjs tests/Unit/ServerParityScheduleCatalogContractTest.mjs tests/Unit/ServerParityOperatorMetricsContractTest.mjs tests/Unit/ServerParityActivityLeaseRenewalContractTest.mjs tests/Unit/ServerParityServiceCatalogContractTest.mjs tests/Unit/ServerParitySystemMetricsContractTest.mjs tests/Unit/ServerParityOperatorDashboardTypesContractTest.mjs tests/Unit/ServerParityPrometheusMetricsContractTest.mjs tests/Unit/ServerParityPayloadCleanupContractTest.mjs tests/Unit/ServerParityRepairPassContractTest.mjs tests/Unit/ServerParityClusterInfoContractTest.mjs tests/Unit/ServerParityNamespaceDeleteContractTest.mjs > parity-evidence/comparator-tests.txt
+            "$image" --test tests/Unit/ServerParityRunnerTest.mjs tests/Unit/ServerParityCooperativeContractTest.mjs tests/Unit/ServerParityChildCancellationContractTest.mjs tests/Unit/ServerParityScheduleContractTest.mjs tests/Unit/ServerParityVisibilityContractTest.mjs tests/Unit/ServerParityAdmissionContractTest.mjs tests/Unit/ServerParityRoleTokenContractTest.mjs tests/Unit/ServerParityWorkerDeregistrationContractTest.mjs tests/Unit/ServerParitySearchAttributeContractTest.mjs tests/Unit/ServerParityWorkerListingContractTest.mjs tests/Unit/ServerParityWorkerReplacementContractTest.mjs tests/Unit/ServerParityPatchDeploymentContractTest.mjs tests/Unit/ServerParityWaitingHistoryContractTest.mjs tests/Unit/ServerParityTaskRetryContractTest.mjs tests/Unit/ServerParityPublishedPatchContractTest.mjs tests/Unit/ServerParityPublishedPatchTransportTest.mjs tests/Unit/ServerParityRecordFileTest.mjs tests/Unit/ServerParityLateWorkflowCompletionContractTest.mjs tests/Unit/ServerParityStorageTestContractTest.mjs tests/Unit/ServerParitySchedulePoliciesContractTest.mjs tests/Unit/ServerParitySignalsBeforeWorkerContractTest.mjs tests/Unit/ServerParityScheduleCatalogContractTest.mjs tests/Unit/ServerParityOperatorMetricsContractTest.mjs tests/Unit/ServerParityActivityLeaseRenewalContractTest.mjs tests/Unit/ServerParityServiceCatalogContractTest.mjs tests/Unit/ServerParityWorkflowImportContractTest.mjs tests/Unit/ServerParitySystemMetricsContractTest.mjs tests/Unit/ServerParityOperatorDashboardTypesContractTest.mjs tests/Unit/ServerParityPrometheusMetricsContractTest.mjs tests/Unit/ServerParityPayloadCleanupContractTest.mjs tests/Unit/ServerParityRepairPassContractTest.mjs tests/Unit/ServerParityClusterInfoContractTest.mjs tests/Unit/ServerParityNamespaceDeleteContractTest.mjs > parity-evidence/comparator-tests.txt
           docker run --rm --user=1000:1000 --cpus=1 --memory=256m --memory-swap=256m \
             --network=none --entrypoint node -v "$PWD:/source:ro" -w /source \
             "$image" --test tests/Unit/ServerParityCodecDeadlineLoadTest.mjs > parity-evidence/codec-load-tests.txt
diff --git a/scripts/conformance/server-parity/contract.mjs b/scripts/conformance/server-parity/contract.mjs
index 69b947698..0d3bc1be4 100644
--- a/scripts/conformance/server-parity/contract.mjs
+++ b/scripts/conformance/server-parity/contract.mjs
@@ -14,6 +14,7 @@ import {checkSearchAttributes} from './search-attribute-contract.mjs';
 import {checkStorageTest} from './storage-test-contract.mjs';
 import {checkActivityLeaseRenewal} from './activity-lease-renewal-contract.mjs';
 import {checkServiceCatalog} from './service-catalog-contract.mjs';
+import {checkWorkflowImport} from './workflow-import-contract.mjs';
 import {checkSystemMetrics} from './system-metrics-contract.mjs';
 import {checkOperatorDashboardTypes} from './operator-dashboard-types-contract.mjs';
 import {checkPrometheusMetrics} from './prometheus-metrics-contract.mjs';
@@ -152,6 +153,7 @@ export function checkObservation(fixture, observation, workflowId, artifacts) {
   const storageTest = fixture.storage_test ? checkStorageTest(fixture, observation, workflowId) : null;
   const activityLeaseRenewal = fixture.activity_lease_renewal ? checkActivityLeaseRenewal(fixture, observation, workflowId) : null;
   const serviceCatalog = fixture.service_catalog ? checkServiceCatalog(fixture, observation, workflowId) : null;
+  const workflowImport = fixture.workflow_import ? checkWorkflowImport(fixture, observation, workflowId) : null;
   const systemMetrics = fixture.system_metrics ? checkSystemMetrics(fixture, observation, workflowId) : null;
   const operatorDashboardTypes = fixture.operator_dashboard_types ? checkOperatorDashboardTypes(fixture, observation, workflowId) : null;
   const prometheusMetrics = fixture.prometheus_metrics ? checkPrometheusMetrics(fixture, observation, workflowId) : null;
@@ -707,6 +709,7 @@ export function checkObservation(fixture, observation, workflowId, artifacts) {
     ...(storageTest ? {storage_test: storageTest} : {}),
     ...(activityLeaseRenewal ? {activity_lease_renewal: activityLeaseRenewal} : {}),
     ...(serviceCatalog ? {service_catalog: serviceCatalog} : {}),
+    ...(workflowImport ? {workflow_import: workflowImport} : {}),
     ...(systemMetrics ? {system_metrics: systemMetrics} : {}),
     ...(operatorDashboardTypes ? {operator_dashboard_types: operatorDashboardTypes} : {}),
     ...(prometheusMetrics ? {prometheus_metrics: prometheusMetrics} : {}),
diff --git a/scripts/conformance/server-parity/probe.php b/scripts/conformance/server-parity/probe.php
index 4df73a65f..e8da666f4 100644
--- a/scripts/conformance/server-parity/probe.php
+++ b/scripts/conformance/server-parity/probe.php
@@ -432,6 +432,7 @@ function httpObservation(array $fixture, string $workflowId, string $namespace,
     $storageTest = isset($fixture['storage_test']) ? finishHttpStorageTest($client, $fixture, $workflowId, $url) : null;
     $activityLeaseRenewal = isset($fixture['activity_lease_renewal']) ? finishHttpActivityLeaseRenewal($client, $fixture, $workflowId, $url) : null;
     $serviceCatalog = isset($fixture['service_catalog']) ? finishHttpServiceCatalog($client, $fixture, $workflowId, $url) : null;
+    $workflowImport = isset($fixture['workflow_import']) ? finishHttpWorkflowImport($client, $fixture, $workflowId, $url) : null;
     $systemMetrics = isset($fixture['system_metrics']) ? finishHttpSystemMetrics($client, $fixture, $workflowId, $url) : null;
     $operatorDashboardTypes = isset($fixture['operator_dashboard_types']) ? finishHttpOperatorDashboardTypes($client, $fixture, $workflowId, $url) : null;
     $prometheusMetrics = isset($fixture['prometheus_metrics']) ? finishHttpPrometheusMetrics($client, $fixture, $workflowId, $url) : null;
@@ -540,6 +541,7 @@ function httpObservation(array $fixture, string $workflowId, string $namespace,
         'storage_test' => $storageTest,
         'activity_lease_renewal' => $activityLeaseRenewal,
         'service_catalog' => $serviceCatalog,
+        'workflow_import' => $workflowImport,
         'system_metrics' => $systemMetrics,
         'operator_dashboard_types' => $operatorDashboardTypes,
         'prometheus_metrics' => $prometheusMetrics,
@@ -852,6 +854,7 @@ function embeddedObservation(array $fixture, string $workflowId, string $namespa
     require __DIR__.'/storage-test-probe.php';
     require __DIR__.'/activity-lease-renewal-probe.php';
     require __DIR__.'/service-catalog-probe.php';
+    require __DIR__.'/workflow-import-probe.php';
     require __DIR__.'/system-metrics-probe.php';
     require __DIR__.'/operator-dashboard-types-probe.php';
     require __DIR__.'/prometheus-metrics-probe.php';
@@ -1023,6 +1026,9 @@ function embeddedObservation(array $fixture, string $workflowId, string $namespa
     if ($mode === 'embedded' && isset($fixture['service_catalog'])) {
         $observation['service_catalog'] = ['applicable' => false, 'reason' => 'embedded_has_no_http_service_catalog'];
     }
+    if ($mode === 'embedded' && isset($fixture['workflow_import'])) {
+        $observation['workflow_import'] = ['applicable' => false, 'reason' => 'embedded_has_no_http_workflow_import'];
+    }
     if ($mode === 'embedded' && isset($fixture['system_metrics'])) {
         $observation['system_metrics'] = ['applicable' => false, 'reason' => 'embedded_has_no_http_metrics'];
     }
diff --git a/scripts/conformance/server-parity/workflow-import-contract.mjs b/scripts/conformance/server-parity/workflow-import-contract.mjs
new file mode 100644
index 000000000..02db4c5ac
--- /dev/null
+++ b/scripts/conformance/server-parity/workflow-import-contract.mjs
@@ -0,0 +1,44 @@
+import assert from 'node:assert/strict';
+
+// Reviewed history import (EmbeddedV2ImportController), recorded against
+// published Server 2.11.1. The fixture's `expected` holds the whole
+// normalized observation, with the probe's workflow prefix as `{id}`, bundle
+// identities, checksums and signatures as `{<label>.<token>}` labels, and
+// generated import ids, import times and raw database messages as
+// placeholders. Every step compares exactly.
+//
+// Published defect boundaries (fixture `published_defects`): the importer
+// looks runs and instances up in every namespace, so a bundle already
+// imported elsewhere answers already_imported, and a run is attached to an
+// instance of another namespace, taking over its current run. At those
+// steps the published answers, as a set, or the isolated answers in
+// `expected` are accepted; nothing else is relaxed.
+export function checkWorkflowImport(fixture, observation, workflowId) {
+  const state = observation.workflow_import;
+  const projection = {scope: 'workflow_import'};
+  assert.ok(state && typeof state === 'object', 'actual workflow import observation');
+  if (observation.mode === 'embedded') {
+    assert.deepStrictEqual(state, {applicable: false, reason: 'embedded_has_no_http_workflow_import'},
+      'embedded workflow import explicitly inapplicable');
+    return projection;
+  }
+  const definition = fixture.workflow_import;
+  const actual = JSON.parse(JSON.stringify(state).replaceAll(workflowId, '{id}'));
+  for (const defect of Object.values(definition.published_defects)) {
+    const steps = Object.keys(defect.published);
+    let published = true;
+    try {
+      for (const step of steps) assert.deepStrictEqual(actual[step], defect.published[step]);
+    } catch {
+      published = false;
+    }
+    if (published) {
+      for (const step of steps) actual[step] = definition.expected[step];
+    }
+  }
+  for (const [step, expected] of Object.entries(definition.expected)) {
+    assert.deepStrictEqual(actual[step], expected, `workflow import ${step}`);
+  }
+  assert.deepStrictEqual(Object.keys(actual).sort(), Object.keys(definition.expected).sort(), 'workflow import steps');
+  return projection;
+}
diff --git a/scripts/conformance/server-parity/workflow-import-probe.php b/scripts/conformance/server-parity/workflow-import-probe.php
new file mode 100644
index 000000000..23f043e7d
--- /dev/null
+++ b/scripts/conformance/server-parity/workflow-import-probe.php
@@ -0,0 +1,348 @@
+<?php
+
+declare(strict_types=1);
+
+use DurableWorkflow\Client;
+use GuzzleHttp\Client as WorkflowImportHttp;
+use GuzzleHttp\HandlerStack;
+
+// History import (POST /api/workflows/import/embedded-v2) over raw HTTP in
+// fresh namespaces: the request gates, the body shapes, a dry run, an
+// import, idempotent and conflicting repeats, integrity and signature
+// refusals, the eligibility rules, request normalization, a write failure,
+// non-terminal imports, a cross-namespace instance, and the imported run
+// through describe, runs, history and list.
+//
+// Bundles come from the fixture's templates, which are real published
+// exports with every ULID as an order-preserving token. Each label gets its
+// own fixed-length ids, so the store never sees a prefix-dependent length,
+// and the probe computes the canonical checksum and signature itself. Run
+// identities, checksums and signatures are recorded as labels; generated
+// import ids, import times and raw database messages as placeholders.
+function finishHttpWorkflowImport(Client $admin, array $fixture, string $workflowId, string $url): array
+{
+    $definition = $fixture['workflow_import'];
+    $namespace = strtolower($workflowId.'-imp');
+    $alt = strtolower($workflowId.'-alt');
+    $admin->createNamespace($namespace, 'workflow import λ', 30);
+    $admin->createNamespace($alt, 'workflow import alt', 30);
+    $token = getenv('DW_PARITY_TOKEN') ?: null;
+    $stack = HandlerStack::create();
+    $stack->push(LockPressurePollRetries::middleware(), 'lock_pressure_poll_retry');
+    $http = new WorkflowImportHttp(['base_uri' => rtrim($url, '/'), 'http_errors' => false,
+        'connect_timeout' => 1, 'timeout' => 30, 'handler' => $stack]);
+
+    // One raw request. Options: namespace, auth (false drops the token),
+    // version (a header value, or false to drop it), raw (a literal body)
+    // with content_type, and headers (response headers to record).
+    $raw = static function (string $method, string $path, mixed $body = null, array $options = []) use ($http, $token, $namespace): array {
+        $version = array_key_exists('version', $options) ? $options['version'] : '2';
+        $headers = array_filter(['Authorization' => ($options['auth'] ?? true) && $token !== null ? 'Bearer '.$token : null,
+            'Accept' => 'application/json', 'X-Namespace' => $options['namespace'] ?? $namespace,
+            'X-Durable-Workflow-Control-Plane-Version' => $version === false ? null : $version], static fn ($value) => $value !== null);
+        $request = ['headers' => $headers];
+        if (array_key_exists('raw', $options)) {
+            $request['headers']['Content-Type'] = $options['content_type'] ?? 'application/json';
+            $request['body'] = $options['raw'];
+        } elseif ($body !== null) {
+            $request['json'] = $body;
+        }
+        $response = $http->request($method, $path, $request);
+        $recorded = ['status' => $response->getStatusCode(), 'response' => json_decode((string) $response->getBody(), true)];
+        foreach ($options['headers'] ?? [] as $name) {
+            $recorded['headers'][$name] = $response->getHeaderLine($name);
+        }
+
+        return $recorded;
+    };
+    $ok = static function (array $recorded, int $status, string $operation): array {
+        if ($recorded['status'] !== $status) {
+            throw new RuntimeException('Workflow import '.$operation.': '.json_encode($recorded));
+        }
+
+        return $recorded['response'];
+    };
+
+    // PHP's canonical form (BundleIntegrityVerifier::canonicalJson): lists
+    // keep their order, maps are key-sorted as strings, and the top-level
+    // integrity block is excluded.
+    $canonicalize = static function (mixed $value) use (&$canonicalize): mixed {
+        if (! is_array($value)) {
+            return $value;
+        }
+        if (array_is_list($value)) {
+            return array_map($canonicalize, $value);
+        }
+        $sorted = [];
+        foreach ($value as $key => $item) {
+            $sorted[$key] = $canonicalize($item);
+        }
+        ksort($sorted, SORT_STRING);
+
+        return $sorted;
+    };
+    $canonical = static fn (array $bundle): string => json_encode($canonicalize(array_diff_key($bundle, ['integrity' => true])),
+        JSON_UNESCAPED_SLASHES | JSON_PRESERVE_ZERO_FRACTION | JSON_THROW_ON_ERROR);
+    // Laravel's global TrimStrings (Str::trim) and ConvertEmptyStringsToNull,
+    // which rewrite every string of a JSON request before the importer sees it.
+    $invisible = '\x{0009}\x{0020}\x{00A0}\x{00AD}\x{034F}\x{061C}\x{115F}\x{1160}\x{17B4}\x{17B5}\x{180E}\x{2000}\x{2001}\x{2002}\x{2003}\x{2004}\x{2005}\x{2006}\x{2007}\x{2008}\x{2009}\x{200A}\x{200B}\x{200C}\x{200D}\x{200E}\x{200F}\x{202F}\x{205F}\x{2060}\x{2061}\x{2062}\x{2063}\x{2064}\x{2065}\x{206A}\x{206B}\x{206C}\x{206D}\x{206E}\x{206F}\x{3000}\x{2800}\x{3164}\x{FEFF}\x{FFA0}\x{1D159}\x{1D173}\x{1D174}\x{1D175}\x{1D176}\x{1D177}\x{1D178}\x{1D179}\x{1D17A}\x{E0020}';
+    $space = '[\s'.$invisible." \n\r\t\v\0".']';
+    $normalize = static function (mixed $value) use (&$normalize, $space): mixed {
+        if (is_array($value)) {
+            return array_map($normalize, $value);
+        }
+        if (! is_string($value)) {
+            return $value;
+        }
+        $value = preg_replace('~^'.$space.'+|'.$space.'(?<!'.$space.$space.')'.$space.'*+$~u', '', $value) ?? trim($value);
+
+        return $value === '' ? null : $value;
+    };
+
+    // Labels for every run-specific identity, in order of first use.
+    $labels = [];
+    $labelIndex = [];
+    $hash = hash('sha256', $workflowId);
+    $instanceFor = static function (string $label) use (&$labelIndex, $hash): string {
+        $labelIndex[$label] ??= count($labelIndex) + 1;
+
+        return sprintf('wi-%02d-%s', $labelIndex[$label], substr($hash, 0, 16));
+    };
+    // A bundle from template $template for label $label. Options:
+    // instance_of (another label's instance id), mutate (before the
+    // checksum), sign (an HMAC key), checksum_raw (checksum the bundle as
+    // sent, not as the server normalizes it), tamper (after the checksum).
+    $bundle = static function (string $template, string $label, array $options = []) use ($definition, &$labels, &$labelIndex, $hash, $instanceFor, $canonical, $normalize): array {
+        $instance = $instanceFor($options['instance_of'] ?? $label);
+        $instanceFor($label);
+        $index = $labelIndex[$label];
+        $tokens = ['{instance}' => $instance];
+        $text = json_encode($definition['bundles'][$template], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
+        preg_match_all('/\{([uU]):(\d+)\}/', $text, $matches, PREG_SET_ORDER);
+        foreach ($matches as [$token, $case, $rank]) {
+            $id = sprintf('0%02d%s%013d', $index, substr($hash, 16, 10), (int) $rank);
+            $tokens[$token] = $case === 'U' ? strtoupper($id) : $id;
+            $labels[$tokens[$token]] = '{'.$label.'.'.$case.$rank.'}';
+        }
+        $labels[$instance] = '{'.($options['instance_of'] ?? $label).'.instance}';
+        $document = json_decode(strtr($text, $tokens), true, 512, JSON_THROW_ON_ERROR);
+        $labels[$document['workflow']['run_id']] = '{'.$label.'.run}';
+        if (isset($options['mutate'])) {
+            $options['mutate']($document);
+        }
+        $signed = ($options['checksum_raw'] ?? false) ? $document : $normalize($document);
+        $checksum = hash('sha256', $canonical($signed));
+        $document['integrity'] = ['canonicalization' => 'json-recursive-ksort-v1', 'checksum_algorithm' => 'sha256',
+            'checksum' => $checksum, 'signature_algorithm' => null, 'signature' => null, 'key_id' => null];
+        $labels[$checksum] = '{'.$label.'.checksum}';
+        if (isset($options['sign'])) {
+            $signature = hash_hmac('sha256', $canonical($signed), $options['sign']);
+            $document['integrity'] = [...$document['integrity'], 'signature_algorithm' => 'hmac-sha256',
+                'signature' => $signature, 'key_id' => 'parity-key-1'];
+            $labels[$signature] = '{'.$label.'.signature}';
+        }
+        if (isset($options['tamper'])) {
+            $options['tamper']($document);
+        }
+        // What the server recomputes from the normalized document it receives.
+        $actual = hash('sha256', $canonical($normalize($document)));
+        $labels[$actual] ??= '{'.$label.'.recomputed}';
+
+        return $document;
+    };
+    // An import report, with generated import ids, import times and raw
+    // database messages as placeholders. Values in any other form stay.
+    $report = static function (array $recorded): array {
+        $body = $recorded['response'];
+        if (is_array($body)) {
+            if (is_string($body['imported_at'] ?? null) && preg_match('/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{6}Z$/', $body['imported_at'])) {
+                $body['imported_at'] = '{imported_at}';
+            }
+            if (is_string($body['import_id'] ?? null) && preg_match('/^[0-9A-HJKMNP-TV-Z]{26}$/', $body['import_id'])) {
+                $body['import_id'] = '{generated_ulid}';
+            }
+            foreach ($body['eligibility']['errors'] ?? [] as $index => $error) {
+                if (($error['rule'] ?? null) === 'target.write_failed' && is_string($error['message'] ?? null)) {
+                    $body['eligibility']['errors'][$index]['message'] = '{database_message}';
+                }
+            }
+        }
+
+        return ['status' => $recorded['status'], 'response' => $body] + array_intersect_key($recorded, ['headers' => true]);
+    };
+    // The published SQLite reference shares its file with its maintenance
+    // loop, and its importer reports a refused lock upgrade as a write
+    // failure. Nothing was committed, so only that refusal is retried, and
+    // each retry is reported on stderr.
+    $embedded = static function (mixed $body, array $options = []) use ($raw, $report): array {
+        for ($attempt = 1; ; $attempt++) {
+            $recorded = $raw('POST', '/api/workflows/import/embedded-v2', $body, $options);
+            $errors = $recorded['response']['eligibility']['errors'] ?? [];
+            $last = is_array($errors) && $errors !== [] ? $errors[array_key_last($errors)] : null;
+            if ($attempt >= 10 || $recorded['status'] !== 422 || ($last['rule'] ?? null) !== 'target.write_failed'
+                || ! str_contains((string) ($last['message'] ?? ''), 'database is locked')) {
+                return $report($recorded);
+            }
+            fwrite(STDERR, json_encode(['workflow_import_lock_retry' => $attempt], JSON_THROW_ON_ERROR).PHP_EOL);
+            usleep(250_000);
+        }
+    };
+    $state = ['applicable' => true, 'namespace' => $namespace, 'alternate_namespace' => $alt];
+
+    // Gates, before the controller.
+    $state['gate_unauthenticated'] = $embedded([], ['auth' => false]);
+    $state['gate_missing_version'] = $embedded([], ['version' => false]);
+    $state['gate_unsupported_version'] = $embedded([], ['version' => '3']);
+    $state['gate_unknown_namespace'] = $embedded([], ['namespace' => $workflowId.'-missing']);
+    $state['gate_text_plain'] = $embedded(null, ['raw' => 'bundle', 'content_type' => 'text/plain']);
+    $state['gate_malformed_json'] = $embedded(null, ['raw' => '{bad']);
+
+    // Body shapes: an empty bundle is refused before the importer; anything
+    // else that is not {"bundle": {...}} is imported as the bundle itself.
+    $state['shape_empty_object'] = $embedded(null, ['raw' => '{}']);
+    $state['shape_empty_list'] = $embedded(null, ['raw' => '[]']);
+    $state['shape_empty_bundle'] = $embedded(null, ['raw' => '{"bundle":{}}']);
+    $state['shape_bundle_list'] = $embedded(null, ['raw' => '{"bundle":[]}']);
+    $state['shape_null'] = $embedded(null, ['raw' => 'null']);
+    $state['shape_options_only'] = $embedded(['dry_run' => true]);
+    $state['shape_bundle_string'] = $embedded(['bundle' => 'not a bundle', 'import_id' => 'x']);
+
+    // A dry run, the import, and idempotent repeats. import_id plays no part
+    // in idempotency.
+    $rich = $bundle('rich', 'rich');
+    $state['dry_run'] = $embedded(['bundle' => $rich, 'dry_run' => true], ['headers' => ['X-Durable-Workflow-Control-Plane-Version']]);
+    $state['import'] = $embedded(['bundle' => $rich, 'import_id' => '  imp-1  '], ['headers' => ['X-Durable-Workflow-Control-Plane-Version']]);
+    $state['duplicate'] = $embedded(['bundle' => $rich, 'import_id' => 'imp-2']);
+    $state['duplicate_dry_run'] = $embedded(['bundle' => $rich, 'dry_run' => 'yes']);
+    // The same bundle offered to another namespace, which holds no such run.
+    $state['duplicate_other_namespace'] = $embedded(['bundle' => $rich], ['namespace' => $alt]);
+    $state['other_namespace_list'] = $raw('GET', '/api/workflows', null, ['namespace' => $alt]);
+    // The same run id from another bundle, then the probe's own native run.
+    $state['conflict_changed_bundle'] = $embedded(['bundle' => $bundle('rich', 'rich', ['mutate' => static function (array &$document): void {
+        $document['dedupe_key'] = 'changed';
+    }])]);
+    $main = $ok($raw('GET', '/api/workflows/'.rawurlencode($workflowId), null, ['namespace' => 'default']), 200, 'main describe');
+    $labels[$main['run_id']] = '{main.run}';
+    $state['conflict_native_run'] = $embedded(['bundle' => $bundle('rich', 'native-run', ['mutate' => static function (array &$document) use ($main): void {
+        $document['workflow']['run_id'] = $main['run_id'];
+    }]), 'dry_run' => true]);
+
+    // Integrity and signatures. No signing key is configured on the target.
+    $state['tampered'] = $embedded(['bundle' => $bundle('rich', 'tampered', ['tamper' => static function (array &$document): void {
+        $document['workflow']['business_key'] = 'bk-tampered';
+    }])]);
+    $state['signature_required_unsigned'] = $embedded(['bundle' => $bundle('rich', 'unsigned'), 'require_signature' => true]);
+    $state['signature_required_no_key'] = $embedded(['bundle' => $bundle('rich', 'signed-no-key', ['sign' => 'k1']), 'require_signature' => true]);
+    $state['signature_wrong_key'] = $embedded(['bundle' => $bundle('rich', 'signed-wrong-key', ['sign' => 'k1']),
+        'signing_key' => 'wrong', 'require_signature' => '1']);
+    $state['signature_verified'] = $embedded(['bundle' => $bundle('rich', 'signed', ['sign' => 'k1']), 'signing_key' => ' k1 ']);
+    $state['signature_required_yes_no_key'] = $embedded(['bundle' => $bundle('rich', 'signed-yes', ['sign' => 'k1']),
+        'require_signature' => 'yes', 'signing_key' => '   ']);
+
+    // Eligibility, each rule on its own.
+    $state['terminal_history_incomplete'] = $embedded(['bundle' => $bundle('terminated', 'incomplete', ['mutate' => static function (array &$document): void {
+        $document['history_complete'] = false;
+    }])]);
+    $state['status_unsupported'] = $embedded(['bundle' => $bundle('rich', 'bogus-status', ['mutate' => static function (array &$document): void {
+        $document['workflow']['status'] = 'bogus';
+    }])]);
+    $state['identity_missing'] = $embedded(['bundle' => $bundle('rich', 'no-identity', ['mutate' => static function (array &$document): void {
+        unset($document['workflow']['instance_id'], $document['workflow']['run_id']);
+    }])]);
+    $state['source_runtime_unsupported'] = $embedded(['bundle' => $bundle('rich', 'standalone', ['mutate' => static function (array &$document): void {
+        $document['workflow']['source_runtime'] = 'standalone_server';
+    }])]);
+    $state['payload_codec_unsupported'] = $embedded(['bundle' => $bundle('rich', 'json-codec', ['mutate' => static function (array &$document): void {
+        $document['payloads']['codec'] = 'json';
+        $document['commands'][0]['payload_codec'] = 'json';
+        $document['signals'][0]['payload_codec'] = 5;
+        $document['payload_manifest']['entries'][1]['codec'] = 'json';
+    }])]);
+    $state['memo_projection_mismatch'] = $embedded(['bundle' => $bundle('rich', 'memo-mismatch', ['mutate' => static function (array &$document): void {
+        $document['workflow']['memo']['note'] = 'edited';
+    }])]);
+    $state['leased_task'] = $embedded(['bundle' => $bundle('rich', 'leased', ['mutate' => static function (array &$document): void {
+        $document['tasks'][1]['status'] = 'leased';
+        $document['activities'][0]['attempts'][0]['status'] = 'running';
+    }])]);
+    $state['running_attempt'] = $embedded(['bundle' => $bundle('rich', 'running-attempt', ['mutate' => static function (array &$document): void {
+        $document['activities'][0]['attempts'][0]['status'] = 'running';
+    }])]);
+    // Real exports list redacted paths as strings, which the redaction rule
+    // never sees; only a non-scalar path element is refused.
+    $state['redaction_string_paths'] = $embedded(['bundle' => $bundle('rich', 'redacted-strings', ['mutate' => static function (array &$document): void {
+        $document['redaction'] = ['applied' => true, 'policy' => 'parity', 'paths' => ['payloads.arguments.data']];
+    }]), 'dry_run' => true]);
+    $state['redaction_object_paths'] = $embedded(['bundle' => $bundle('rich', 'redacted-objects', ['mutate' => static function (array &$document): void {
+        $document['redaction'] = ['applied' => true, 'policy' => 'parity', 'paths' => [['path' => 'payloads.arguments.data']]];
+    }]), 'dry_run' => true]);
+    $state['redaction_applied_without_paths'] = $embedded(['bundle' => $bundle('rich', 'redacted-empty', ['mutate' => static function (array &$document): void {
+        $document['redaction'] = ['applied' => true, 'policy' => 'parity', 'paths' => []];
+    }]), 'dry_run' => true]);
+
+    // Request normalization: the server trims every string and turns empty
+    // strings into null before verifying, so only a checksum over that form
+    // verifies.
+    $edges = static function (array &$document): void {
+        $document['workflow']['business_key'] = '  bk-normalized  ';
+        $document['workflow']['archive_reason'] = '';
+    };
+    $state['normalized_checksum'] = $embedded(['bundle' => $bundle('rich', 'normalized', ['mutate' => $edges])]);
+    $state['unnormalized_checksum'] = $embedded(['bundle' => $bundle('rich', 'unnormalized', ['mutate' => $edges, 'checksum_raw' => true])]);
+
+    // A bare bundle imports with default options; options beside it become
+    // part of the bundle and break its checksum.
+    $state['bare_bundle'] = $embedded($bundle('rich', 'bare'));
+    $state['bare_bundle_with_option'] = $embedded($bundle('rich', 'bare-option', ['tamper' => static function (array &$document): void {
+        $document['dry_run'] = true;
+    }]));
+
+    // A timestamp the importer cannot parse fails the write; nothing stays.
+    $state['write_failed'] = $embedded(['bundle' => $bundle('rich', 'bad-time', ['mutate' => static function (array &$document): void {
+        $document['workflow']['started_at'] = 'not a time';
+    }])]);
+    $state['write_failed_describe'] = $raw('GET', '/api/workflows/'.$instanceFor('bad-time'));
+
+    // Terminated and non-terminal runs.
+    // "no" is false, and a non-string import_id is ignored for a generated one.
+    $state['terminated'] = $embedded(['bundle' => $bundle('terminated', 'terminated'), 'dry_run' => 'no', 'import_id' => 12345]);
+    $state['non_terminal_not_current'] = $embedded(['bundle' => $bundle('running', 'not-current', ['mutate' => static function (array &$document): void {
+        $document['workflow']['is_current_run'] = false;
+    }])]);
+    $state['running'] = $embedded(['bundle' => $bundle('running', 'running')]);
+    // The imported ready task keeps its exported dispatch time, so it is
+    // overdue at once; a repair pass may redispatch it before this read.
+    $running = $raw('GET', '/api/workflows/'.$instanceFor('running'));
+    $ready = ['Workflow task ready but dispatch is overdue', 'Workflow task ready'];
+    if (in_array($running['response']['wait_reason'] ?? null, $ready, true)) {
+        $running['response']['wait_reason'] = '{workflow_task_ready}';
+    }
+    if (in_array($running['response']['control_plane']['wait_reason'] ?? null, $ready, true)) {
+        $running['response']['control_plane']['wait_reason'] = '{workflow_task_ready}';
+    }
+    $state['running_describe'] = $running;
+
+    // The imported run reads like the exported one.
+    $instance = $instanceFor('rich');
+    $runId = $rich['workflow']['run_id'];
+    $state['read_describe'] = $raw('GET', '/api/workflows/'.$instance);
+    $state['read_runs'] = $raw('GET', '/api/workflows/'.$instance.'/runs');
+    $state['read_run'] = $raw('GET', '/api/workflows/'.$instance.'/runs/'.$runId);
+    $state['read_history'] = $raw('GET', '/api/workflows/'.$instance.'/runs/'.$runId.'/history');
+    $state['read_terminated_history'] = $raw('GET', '/api/workflows/'.$instanceFor('terminated').'/runs/'
+        .$bundle('terminated', 'terminated')['workflow']['run_id'].'/history');
+    $state['read_list'] = $raw('GET', '/api/workflows?status=completed');
+
+    // A run of an instance that belongs to another namespace.
+    $state['attach_source'] = $embedded(['bundle' => $bundle('terminated', 'attach-source')], ['namespace' => $alt]);
+    $before = $raw('GET', '/api/workflows/'.$instanceFor('attach-source'), null, ['namespace' => $alt]);
+    $state['attach'] = $embedded(['bundle' => $bundle('terminated', 'attach', ['instance_of' => 'attach-source', 'mutate' => static function (array &$document): void {
+        $document['workflow']['run_number'] = 2;
+    }])]);
+    $state['attach_source_describe_before'] = $before;
+    $state['attach_source_describe_after'] = $raw('GET', '/api/workflows/'.$instanceFor('attach-source'), null, ['namespace' => $alt]);
+    $state['attach_describe'] = $raw('GET', '/api/workflows/'.$instanceFor('attach-source'));
+
+    return json_decode(strtr(json_encode($state, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR), $labels),
+        true, 512, JSON_THROW_ON_ERROR);
+}
diff --git a/tests/Fixtures/ServerParity/workflow-import.json b/tests/Fixtures/ServerParity/workflow-import.json
new file mode 100644
index 000000000..2a3abc143
--- /dev/null
+++ b/tests/Fixtures/ServerParity/workflow-import.json
@@ -0,0 +1,9086 @@
+{
+  "schema": "durable-workflow.server-parity-fixture/v1",
+  "id": "workflow-import",
+  "review_state": "reviewed",
+  "workflow_type": "parity.v1.echo",
+  "input": {
+    "message": "workflow import λ",
+    "count": 9007199254740993,
+    "optional": null
+  },
+  "typed_value": {
+    "type": "map",
+    "value": {
+      "message": {
+        "type": "string",
+        "value": "workflow import λ"
+      },
+      "count": {
+        "type": "int64",
+        "value": "9007199254740993"
+      },
+      "optional": {
+        "type": "null",
+        "value": null
+      }
+    }
+  },
+  "activity": false,
+  "expected_events": [
+    "StartAccepted",
+    "WorkflowStarted",
+    "WorkflowCompleted"
+  ],
+  "workflow_import": {
+    "bundles": {
+      "rich": {
+        "schema": "durable-workflow.v2.history-export",
+        "schema_version": 2,
+        "exported_at": "2026-10-24T14:47:03.896027Z",
+        "dedupe_key": "{u:1}:12:2026-10-24T14:47:03.778604Z",
+        "history_complete": true,
+        "workflow": {
+          "instance_id": "{instance}",
+          "run_id": "{u:1}",
+          "run_number": 1,
+          "is_current_run": true,
+          "current_run_id": "{u:1}",
+          "current_run_source": "run_order_fallback",
+          "workflow_type": "parity.rich",
+          "workflow_class": "parity.rich",
+          "source_runtime": "embedded",
+          "source_process_class": "server_http_node",
+          "business_key": "bk-rich",
+          "visibility_labels": [],
+          "memo": {
+            "n": 3,
+            "note": "λ rich"
+          },
+          "memo_payload": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNw4EAm4EBghub3RlCg7OuyByaWNoAA=="
+          },
+          "search_attributes": {
+            "CustomerId": "cust-λ",
+            "Tier": 2
+          },
+          "status": "completed",
+          "status_bucket": "completed",
+          "closed_reason": "completed",
+          "archived_at": null,
+          "archive_command_id": null,
+          "archive_reason": null,
+          "compatibility": null,
+          "connection": null,
+          "queue": "q-rich",
+          "last_history_sequence": 12,
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "last_progress_at": "2026-10-24T14:47:03.778604Z"
+        },
+        "payloads": {
+          "codec": "avro",
+          "arguments": {
+            "available": true,
+            "data": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "output": {
+            "available": true,
+            "codec": "avro",
+            "data": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          }
+        },
+        "history_events": [
+          {
+            "id": "{u:3}",
+            "sequence": 1,
+            "type": "StartAccepted",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:2}",
+            "recorded_at": "2026-10-24T14:46:59.967125Z",
+            "payload": {
+              "workflow_command_id": "{u:2}",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "workflow_class": "parity.rich",
+              "workflow_type": "parity.rich",
+              "business_key": "bk-rich",
+              "visibility_labels": null,
+              "memo": {
+                "note": "λ rich",
+                "n": 3
+              },
+              "search_attributes": {
+                "CustomerId": "cust-λ",
+                "Tier": 2
+              },
+              "outcome": "started_new",
+              "command": {
+                "id": "{u:2}",
+                "sequence": 1,
+                "type": "start",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows",
+                "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                "request_fingerprint": "sha256:9c9eaf04b60868e676065d1796f72d8bd18838b46353d302ab6f9ce7c54ea1ea",
+                "status": "accepted",
+                "outcome": "started_new",
+                "accepted_at": "2026-10-24T14:46:59.960583Z",
+                "applied_at": "2026-10-24T14:46:59.960589Z"
+              }
+            }
+          },
+          {
+            "id": "{u:4}",
+            "sequence": 2,
+            "type": "WorkflowStarted",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:2}",
+            "recorded_at": "2026-10-24T14:46:59.974840Z",
+            "payload": {
+              "workflow_class": "parity.rich",
+              "workflow_type": "parity.rich",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "workflow_command_id": "{u:2}",
+              "business_key": "bk-rich",
+              "memo": {
+                "note": "λ rich",
+                "n": 3
+              },
+              "search_attributes": {
+                "CustomerId": "cust-λ",
+                "Tier": 2
+              },
+              "command": {
+                "id": "{u:2}",
+                "sequence": 1,
+                "type": "start",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows",
+                "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                "request_fingerprint": "sha256:9c9eaf04b60868e676065d1796f72d8bd18838b46353d302ab6f9ce7c54ea1ea",
+                "status": "accepted",
+                "outcome": "started_new",
+                "accepted_at": "2026-10-24T14:46:59.960583Z",
+                "applied_at": "2026-10-24T14:46:59.960589Z"
+              },
+              "declared_queries": [],
+              "declared_query_contracts": [],
+              "declared_signals": [
+                "go"
+              ],
+              "declared_signal_contracts": [
+                {
+                  "name": "go",
+                  "parameters": []
+                }
+              ],
+              "declared_updates": [],
+              "declared_update_contracts": [],
+              "declared_entry_method": "handle",
+              "declared_entry_mode": "canonical",
+              "declared_entry_declaring_class": "external:parity.rich"
+            }
+          },
+          {
+            "id": "{u:7}",
+            "sequence": 3,
+            "type": "ActivityScheduled",
+            "workflow_task_id": "{u:5}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:00.313979Z",
+            "payload": {
+              "activity_execution_id": "{u:6}",
+              "activity_class": "parity.act",
+              "activity_type": "parity.act",
+              "sequence": 1,
+              "activity": {
+                "id": "{u:6}",
+                "idempotency_key": "{u:6}",
+                "sequence": 1,
+                "type": "parity.act",
+                "class": "parity.act",
+                "local_activity": false,
+                "status": "pending",
+                "payload_codec": "avro",
+                "attempt_count": 0,
+                "queue": "q-rich",
+                "created_at": "2026-10-24T14:47:00.306185Z",
+                "arguments": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "task": {
+                "id": "{u:5}",
+                "type": "workflow",
+                "status": "leased",
+                "available_at": "2026-10-24T14:46:59.977678Z",
+                "leased_at": "2026-10-24T14:47:00.117197Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:48:00.117111Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich",
+                "last_dispatch_attempt_at": "2026-10-24T14:46:59.997376Z",
+                "last_dispatched_at": "2026-10-24T14:46:59.997376Z"
+              }
+            }
+          },
+          {
+            "id": "{u:10}",
+            "sequence": 4,
+            "type": "ActivityStarted",
+            "workflow_task_id": "{u:8}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:00.548205Z",
+            "payload": {
+              "activity_execution_id": "{u:6}",
+              "activity_attempt_id": "{U:9}",
+              "activity_class": "parity.act",
+              "activity_type": "parity.act",
+              "sequence": 1,
+              "attempt_number": 1,
+              "activity": {
+                "id": "{u:6}",
+                "idempotency_key": "{u:6}",
+                "sequence": 1,
+                "type": "parity.act",
+                "class": "parity.act",
+                "local_activity": false,
+                "attempt_id": "{U:9}",
+                "status": "running",
+                "payload_codec": "avro",
+                "attempt_count": 1,
+                "queue": "q-rich",
+                "created_at": "2026-10-24T14:47:00.306185Z",
+                "started_at": "2026-10-24T14:47:00.543703Z",
+                "arguments": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "task": {
+                "id": "{u:8}",
+                "type": "activity",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:00.317243Z",
+                "leased_at": "2026-10-24T14:47:00.543703Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:52:00.543817Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich"
+              }
+            }
+          },
+          {
+            "id": "{u:11}",
+            "sequence": 5,
+            "type": "ActivityCompleted",
+            "workflow_task_id": "{u:8}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:00.678013Z",
+            "payload": {
+              "activity_execution_id": "{u:6}",
+              "activity_attempt_id": "{U:9}",
+              "activity_class": "parity.act",
+              "activity_type": "parity.act",
+              "sequence": 1,
+              "attempt_number": 1,
+              "result": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+              "payload_codec": "avro",
+              "activity": {
+                "id": "{u:6}",
+                "idempotency_key": "{u:6}",
+                "sequence": 1,
+                "type": "parity.act",
+                "class": "parity.act",
+                "local_activity": false,
+                "attempt_id": "{U:9}",
+                "status": "completed",
+                "payload_codec": "avro",
+                "attempt_count": 1,
+                "queue": "q-rich",
+                "created_at": "2026-10-24T14:47:00.306185Z",
+                "started_at": "2026-10-24T14:47:00.543703Z",
+                "closed_at": "2026-10-24T14:47:00.676908Z",
+                "arguments": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+                "result": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "task": {
+                "id": "{u:8}",
+                "type": "activity",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:00.317243Z",
+                "leased_at": "2026-10-24T14:47:00.543703Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:52:00.543817Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich"
+              }
+            }
+          },
+          {
+            "id": "{u:14}",
+            "sequence": 6,
+            "type": "TimerScheduled",
+            "workflow_task_id": "{u:12}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:00.950363Z",
+            "payload": {
+              "timer_id": "{u:13}",
+              "sequence": 2,
+              "delay_seconds": 1,
+              "fire_at": "2026-10-24T14:47:01.949279Z",
+              "task": {
+                "id": "{u:12}",
+                "type": "workflow",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:00.683997Z",
+                "leased_at": "2026-10-24T14:47:00.813533Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:48:00.813492Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich",
+                "last_dispatch_attempt_at": "2026-10-24T14:47:00.717460Z",
+                "last_dispatched_at": "2026-10-24T14:47:00.717460Z"
+              }
+            }
+          },
+          {
+            "id": "{u:16}",
+            "sequence": 7,
+            "type": "TimerFired",
+            "workflow_task_id": "{u:15}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:03.177823Z",
+            "payload": {
+              "timer_id": "{u:13}",
+              "sequence": 2,
+              "delay_seconds": 1,
+              "fire_at": "2026-10-24T14:47:01.949279Z",
+              "fired_at": "2026-10-24T14:47:03.176920Z",
+              "task": {
+                "id": "{u:15}",
+                "type": "timer",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:01.949279Z",
+                "leased_at": "2026-10-24T14:47:03.145194Z",
+                "lease_owner": "{u:15}",
+                "lease_expires_at": "2026-10-24T14:48:03.145206Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich"
+              }
+            }
+          },
+          {
+            "id": "{u:19}",
+            "sequence": 8,
+            "type": "SignalWaitOpened",
+            "workflow_task_id": "{u:17}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:03.335861Z",
+            "payload": {
+              "signal_name": "go",
+              "signal_wait_id": "{U:18}",
+              "sequence": 3,
+              "task": {
+                "id": "{u:17}",
+                "type": "workflow",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:03.180548Z",
+                "leased_at": "2026-10-24T14:47:03.228522Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:48:03.228482Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich",
+                "last_dispatch_attempt_at": "2026-10-24T14:47:03.202748Z",
+                "last_dispatched_at": "2026-10-24T14:47:03.202748Z"
+              }
+            }
+          },
+          {
+            "id": "{u:22}",
+            "sequence": 9,
+            "type": "SignalReceived",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:20}",
+            "recorded_at": "2026-10-24T14:47:03.479854Z",
+            "payload": {
+              "workflow_command_id": "{u:20}",
+              "signal_id": "{u:21}",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "signal_name": "go",
+              "signal_wait_id": "{U:18}",
+              "arguments": "wwHioz3/VYAiNwwA",
+              "payload_codec": "avro",
+              "command": {
+                "id": "{u:20}",
+                "sequence": 2,
+                "message_sequence": 1,
+                "type": "signal",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "target_name": "go",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNw4GCG5hbWUKBGdvEmFyZ3VtZW50cwwAInZhbGlkYXRpb25fZXJyb3JzDAAA",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows/{instance}/signal/go",
+                "request_route_name": "generated::1UDj0wPOAwpiUqm5",
+                "request_fingerprint": "sha256:42c656099216d66c82aed9d3b85b92c4845c7dea1a6baab85e2cc4f8313045ee",
+                "status": "accepted",
+                "outcome": "signal_received",
+                "accepted_at": "2026-10-24T14:47:03.476022Z"
+              }
+            }
+          },
+          {
+            "id": "{u:24}",
+            "sequence": 10,
+            "type": "MessageCursorAdvanced",
+            "workflow_task_id": "{u:23}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:03.770214Z",
+            "payload": {
+              "stream_key": "instance:{instance}",
+              "previous_position": 0,
+              "new_position": 1,
+              "task": {
+                "id": "{u:23}",
+                "type": "workflow",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:03.485571Z",
+                "leased_at": "2026-10-24T14:47:03.638294Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich",
+                "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+                "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+              }
+            }
+          },
+          {
+            "id": "{u:25}",
+            "sequence": 11,
+            "type": "SignalApplied",
+            "workflow_task_id": "{u:23}",
+            "workflow_command_id": "{u:20}",
+            "recorded_at": "2026-10-24T14:47:03.773614Z",
+            "payload": {
+              "workflow_command_id": "{u:20}",
+              "signal_id": "{u:21}",
+              "signal_name": "go",
+              "signal_wait_id": "{U:18}",
+              "sequence": 3,
+              "value": "wwHioz3/VYAiNwIB",
+              "task": {
+                "id": "{u:23}",
+                "type": "workflow",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:03.485571Z",
+                "leased_at": "2026-10-24T14:47:03.638294Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich",
+                "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+                "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+              },
+              "command": {
+                "id": "{u:20}",
+                "sequence": 2,
+                "message_sequence": 1,
+                "type": "signal",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "target_name": "go",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNw4GCG5hbWUKBGdvEmFyZ3VtZW50cwwAInZhbGlkYXRpb25fZXJyb3JzDAAA",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows/{instance}/signal/go",
+                "request_route_name": "generated::1UDj0wPOAwpiUqm5",
+                "request_fingerprint": "sha256:42c656099216d66c82aed9d3b85b92c4845c7dea1a6baab85e2cc4f8313045ee",
+                "status": "accepted",
+                "outcome": "signal_received",
+                "accepted_at": "2026-10-24T14:47:03.476022Z",
+                "applied_at": "2026-10-24T14:47:03.768522Z"
+              }
+            }
+          },
+          {
+            "id": "{u:26}",
+            "sequence": 12,
+            "type": "WorkflowCompleted",
+            "workflow_task_id": "{u:23}",
+            "workflow_command_id": null,
+            "recorded_at": "2026-10-24T14:47:03.778604Z",
+            "payload": {
+              "output": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+              "payload_codec": "avro",
+              "task": {
+                "id": "{u:23}",
+                "type": "workflow",
+                "status": "leased",
+                "available_at": "2026-10-24T14:47:03.485571Z",
+                "leased_at": "2026-10-24T14:47:03.638294Z",
+                "lease_owner": "w-rich",
+                "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+                "attempt_count": 1,
+                "repair_count": 0,
+                "connection": "sqlite",
+                "queue": "q-rich",
+                "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+                "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+              },
+              "command": {
+                "type": "complete_workflow",
+                "source": "worker_protocol",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin"
+              }
+            }
+          }
+        ],
+        "commands": [
+          {
+            "id": "{u:2}",
+            "sequence": 1,
+            "message_sequence": null,
+            "type": "start",
+            "target_scope": "instance",
+            "requested_run_id": null,
+            "resolved_run_id": "{u:1}",
+            "target_name": null,
+            "payload_codec": "avro",
+            "payload": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+            "source": "control_plane",
+            "context": {
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              }
+            },
+            "caller_label": "Standalone Server",
+            "principal_type": "auth:token",
+            "principal_id": "legacy-token",
+            "principal_label": "Admin",
+            "auth_status": "authorized",
+            "auth_method": "token",
+            "request_method": "POST",
+            "request_path": "/api/workflows",
+            "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+            "request_fingerprint": "sha256:9c9eaf04b60868e676065d1796f72d8bd18838b46353d302ab6f9ce7c54ea1ea",
+            "request_id": null,
+            "correlation_id": null,
+            "status": "accepted",
+            "outcome": "started_new",
+            "reason": null,
+            "rejection_reason": null,
+            "validation_errors": [],
+            "accepted_at": "2026-10-24T14:46:59.960583Z",
+            "applied_at": "2026-10-24T14:46:59.960589Z",
+            "rejected_at": null
+          },
+          {
+            "id": "{u:20}",
+            "sequence": 2,
+            "message_sequence": 1,
+            "type": "signal",
+            "target_scope": "instance",
+            "requested_run_id": null,
+            "resolved_run_id": "{u:1}",
+            "target_name": "go",
+            "payload_codec": "avro",
+            "payload": "wwHioz3/VYAiNw4GCG5hbWUKBGdvEmFyZ3VtZW50cwwAInZhbGlkYXRpb25fZXJyb3JzDAAA",
+            "source": "control_plane",
+            "context": {
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              }
+            },
+            "caller_label": "Standalone Server",
+            "principal_type": "auth:token",
+            "principal_id": "legacy-token",
+            "principal_label": "Admin",
+            "auth_status": "authorized",
+            "auth_method": "token",
+            "request_method": "POST",
+            "request_path": "/api/workflows/{instance}/signal/go",
+            "request_route_name": "generated::1UDj0wPOAwpiUqm5",
+            "request_fingerprint": "sha256:42c656099216d66c82aed9d3b85b92c4845c7dea1a6baab85e2cc4f8313045ee",
+            "request_id": null,
+            "correlation_id": null,
+            "status": "accepted",
+            "outcome": "signal_received",
+            "reason": null,
+            "rejection_reason": null,
+            "validation_errors": [],
+            "accepted_at": "2026-10-24T14:47:03.476022Z",
+            "applied_at": "2026-10-24T14:47:03.768522Z",
+            "rejected_at": null
+          }
+        ],
+        "signals": [
+          {
+            "id": "{u:21}",
+            "command_id": "{u:20}",
+            "command_sequence": 2,
+            "workflow_sequence": 3,
+            "name": "go",
+            "signal_wait_id": "{U:18}",
+            "target_scope": "instance",
+            "requested_run_id": null,
+            "resolved_run_id": "{u:1}",
+            "status": "applied",
+            "outcome": "signal_received",
+            "rejection_reason": null,
+            "validation_errors": [],
+            "received_at": "2026-10-24T14:47:03.476022Z",
+            "applied_at": "2026-10-24T14:47:03.768522Z",
+            "rejected_at": null,
+            "closed_at": "2026-10-24T14:47:03.768522Z",
+            "payload_codec": "avro",
+            "arguments": "wwHioz3/VYAiNwwA"
+          }
+        ],
+        "updates": [],
+        "tasks": [
+          {
+            "id": "{u:5}",
+            "type": "workflow",
+            "status": "completed",
+            "payload": {
+              "_server_workflow_claim": {
+                "worker_id": "w-rich",
+                "namespace": "imp-src",
+                "routing_revision": "1980345bd2456a70af6a4ed3f12f330ba20f8367",
+                "process_identity": [],
+                "updated_at": "1792853219.000000",
+                "last_heartbeat_at": "1792853219.000000",
+                "registration_id": 1,
+                "registration_incarnation": "088a3074e310a74d44a5d1cb0031c00d6a254880794371c439e16539f2bb776f",
+                "runtime": "python",
+                "sdk_version": null,
+                "build_id": null,
+                "protocol_version": "1.20",
+                "capabilities": [],
+                "task_id": "{u:5}",
+                "run_id": "{u:1}",
+                "lease_owner": "w-rich",
+                "attempt": 1
+              }
+            },
+            "connection": null,
+            "queue": "q-rich",
+            "compatibility": null,
+            "attempt_count": 1,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:46:59.977678Z",
+            "leased_at": "2026-10-24T14:47:00.117197Z",
+            "lease_owner": "w-rich",
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": "2026-10-24T14:46:59.997376Z",
+            "last_dispatched_at": "2026-10-24T14:46:59.997376Z",
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:46:59.978334Z"
+          },
+          {
+            "id": "{u:8}",
+            "type": "activity",
+            "status": "completed",
+            "payload": {
+              "activity_execution_id": "{u:6}",
+              "_server_workflow_claim": {
+                "worker_id": "w-rich",
+                "namespace": "imp-src",
+                "routing_revision": "1980345bd2456a70af6a4ed3f12f330ba20f8367",
+                "process_identity": [],
+                "updated_at": "1792853219.000000",
+                "last_heartbeat_at": "1792853219.000000",
+                "registration_id": 1,
+                "registration_incarnation": "088a3074e310a74d44a5d1cb0031c00d6a254880794371c439e16539f2bb776f",
+                "runtime": "python",
+                "sdk_version": null,
+                "build_id": null,
+                "protocol_version": "1.20",
+                "capabilities": [],
+                "task_id": "{u:8}",
+                "run_id": "{u:1}",
+                "lease_owner": "w-rich",
+                "attempt": 1
+              }
+            },
+            "connection": null,
+            "queue": "q-rich",
+            "compatibility": null,
+            "attempt_count": 1,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:47:00.317243Z",
+            "leased_at": "2026-10-24T14:47:00.543703Z",
+            "lease_owner": "w-rich",
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": null,
+            "last_dispatched_at": null,
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:47:00.321177Z"
+          },
+          {
+            "id": "{u:12}",
+            "type": "workflow",
+            "status": "completed",
+            "payload": {
+              "workflow_wait_kind": "activity",
+              "open_wait_id": "activity:{u:6}",
+              "resume_source_kind": "activity_execution",
+              "resume_source_id": "{u:6}",
+              "activity_execution_id": "{u:6}",
+              "activity_attempt_id": "{U:9}",
+              "activity_type": "parity.act",
+              "workflow_sequence": 1,
+              "workflow_event_type": "ActivityCompleted",
+              "_server_workflow_claim": {
+                "worker_id": "w-rich",
+                "namespace": "imp-src",
+                "routing_revision": "1980345bd2456a70af6a4ed3f12f330ba20f8367",
+                "process_identity": [],
+                "updated_at": "1792853219.000000",
+                "last_heartbeat_at": "1792853219.000000",
+                "registration_id": 1,
+                "registration_incarnation": "088a3074e310a74d44a5d1cb0031c00d6a254880794371c439e16539f2bb776f",
+                "runtime": "python",
+                "sdk_version": null,
+                "build_id": null,
+                "protocol_version": "1.20",
+                "capabilities": [],
+                "task_id": "{u:12}",
+                "run_id": "{u:1}",
+                "lease_owner": "w-rich",
+                "attempt": 1
+              }
+            },
+            "connection": null,
+            "queue": "q-rich",
+            "compatibility": null,
+            "attempt_count": 1,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:47:00.683997Z",
+            "leased_at": "2026-10-24T14:47:00.813533Z",
+            "lease_owner": "w-rich",
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": "2026-10-24T14:47:00.717460Z",
+            "last_dispatched_at": "2026-10-24T14:47:00.717460Z",
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:47:00.685587Z"
+          },
+          {
+            "id": "{u:15}",
+            "type": "timer",
+            "status": "completed",
+            "payload": {
+              "timer_id": "{u:13}"
+            },
+            "connection": null,
+            "queue": "q-rich",
+            "compatibility": null,
+            "attempt_count": 1,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:47:01.949279Z",
+            "leased_at": "2026-10-24T14:47:03.145194Z",
+            "lease_owner": "{u:15}",
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": null,
+            "last_dispatched_at": null,
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:47:00.952956Z"
+          },
+          {
+            "id": "{u:17}",
+            "type": "workflow",
+            "status": "completed",
+            "payload": {
+              "workflow_wait_kind": "timer",
+              "open_wait_id": "timer:{u:13}",
+              "resume_source_kind": "timer",
+              "resume_source_id": "{u:13}",
+              "timer_id": "{u:13}",
+              "workflow_sequence": 2,
+              "workflow_event_type": "TimerFired",
+              "_server_workflow_claim": {
+                "worker_id": "w-rich",
+                "namespace": "imp-src",
+                "routing_revision": "1980345bd2456a70af6a4ed3f12f330ba20f8367",
+                "process_identity": [],
+                "updated_at": "1792853219.000000",
+                "last_heartbeat_at": "1792853219.000000",
+                "registration_id": 1,
+                "registration_incarnation": "088a3074e310a74d44a5d1cb0031c00d6a254880794371c439e16539f2bb776f",
+                "runtime": "python",
+                "sdk_version": null,
+                "build_id": null,
+                "protocol_version": "1.20",
+                "capabilities": [],
+                "task_id": "{u:17}",
+                "run_id": "{u:1}",
+                "lease_owner": "w-rich",
+                "attempt": 1
+              }
+            },
+            "connection": null,
+            "queue": "q-rich",
+            "compatibility": null,
+            "attempt_count": 1,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:47:03.180548Z",
+            "leased_at": "2026-10-24T14:47:03.228522Z",
+            "lease_owner": "w-rich",
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": "2026-10-24T14:47:03.202748Z",
+            "last_dispatched_at": "2026-10-24T14:47:03.202748Z",
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:47:03.181106Z"
+          },
+          {
+            "id": "{u:23}",
+            "type": "workflow",
+            "status": "completed",
+            "payload": {
+              "workflow_wait_kind": "signal",
+              "open_wait_id": "signal-application:{u:21}",
+              "resume_source_kind": "workflow_signal",
+              "resume_source_id": "{u:21}",
+              "workflow_signal_id": "{u:21}",
+              "signal_name": "go",
+              "signal_wait_id": "{U:18}",
+              "workflow_command_id": "{u:20}",
+              "_server_workflow_claim": {
+                "worker_id": "w-rich",
+                "namespace": "imp-src",
+                "routing_revision": "1980345bd2456a70af6a4ed3f12f330ba20f8367",
+                "process_identity": [],
+                "updated_at": "1792853219.000000",
+                "last_heartbeat_at": "1792853219.000000",
+                "registration_id": 1,
+                "registration_incarnation": "088a3074e310a74d44a5d1cb0031c00d6a254880794371c439e16539f2bb776f",
+                "runtime": "python",
+                "sdk_version": null,
+                "build_id": null,
+                "protocol_version": "1.20",
+                "capabilities": [],
+                "task_id": "{u:23}",
+                "run_id": "{u:1}",
+                "lease_owner": "w-rich",
+                "attempt": 1
+              }
+            },
+            "connection": null,
+            "queue": "q-rich",
+            "compatibility": null,
+            "attempt_count": 1,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:47:03.485571Z",
+            "leased_at": "2026-10-24T14:47:03.638294Z",
+            "lease_owner": "w-rich",
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+            "last_dispatched_at": "2026-10-24T14:47:03.523261Z",
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:47:03.486157Z"
+          }
+        ],
+        "activities": [
+          {
+            "id": "{u:6}",
+            "idempotency_key": "{u:6}",
+            "sequence": 1,
+            "activity_type": "parity.act",
+            "activity_class": "parity.act",
+            "execution_mode": null,
+            "local_activity": false,
+            "payload_codec": "avro",
+            "status": "completed",
+            "source_status": "completed",
+            "history_authority": "typed_history",
+            "diagnostic_only": false,
+            "history_event_types": [
+              "ActivityScheduled",
+              "ActivityStarted",
+              "ActivityCompleted"
+            ],
+            "history_unsupported_reason": null,
+            "reused_from_run_id": null,
+            "reused_activity_execution_id": null,
+            "reused_recorded_at": null,
+            "row_status": null,
+            "parallel_group_kind": null,
+            "parallel_group_id": null,
+            "parallel_group_base_sequence": null,
+            "parallel_group_size": null,
+            "parallel_group_index": null,
+            "parallel_group_path": [],
+            "connection": null,
+            "queue": "q-rich",
+            "retry_policy": null,
+            "attempt_count": 1,
+            "current_attempt_id": "{U:9}",
+            "current_worker_attempt_id": null,
+            "arguments": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+            "result": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+            "created_at": "2026-10-24T14:47:00.306185Z",
+            "started_at": "2026-10-24T14:47:00.543703Z",
+            "last_heartbeat_at": null,
+            "last_heartbeat_progress": null,
+            "closed_at": "2026-10-24T14:47:00.676908Z",
+            "attempts": [
+              {
+                "id": "{U:9}",
+                "worker_attempt_id": null,
+                "activity_execution_id": "{u:6}",
+                "workflow_task_id": "{u:8}",
+                "attempt_number": 1,
+                "status": "completed",
+                "lease_owner": "w-rich",
+                "started_at": "2026-10-24T14:47:00.548205Z",
+                "last_heartbeat_at": null,
+                "last_heartbeat_progress": null,
+                "lease_expires_at": null,
+                "closed_at": "2026-10-24T14:47:00.678013Z"
+              }
+            ]
+          }
+        ],
+        "timers": [
+          {
+            "id": "{u:13}",
+            "sequence": 2,
+            "status": "fired",
+            "source_status": "fired",
+            "delay_seconds": 1,
+            "fire_at": "2026-10-24T14:47:01.949279Z",
+            "fired_at": "2026-10-24T14:47:03.176920Z",
+            "cancelled_at": null,
+            "created_at": "2026-10-24T14:47:00.950363Z",
+            "timer_kind": null,
+            "condition_wait_id": null,
+            "condition_key": null,
+            "condition_definition_fingerprint": null,
+            "signal_wait_id": null,
+            "signal_name": null,
+            "history_authority": "typed_history",
+            "diagnostic_only": false,
+            "history_event_types": [
+              "TimerScheduled",
+              "TimerFired"
+            ],
+            "history_unsupported_reason": null,
+            "row_status": "fired"
+          }
+        ],
+        "failures": [],
+        "links": {
+          "projection_source": "workflow_run_lineage_entries",
+          "parents": [],
+          "children": []
+        },
+        "redaction": {
+          "applied": false,
+          "policy": null,
+          "paths": []
+        },
+        "codec_schemas": {
+          "avro": {
+            "encoding": "base64-avro-single-object",
+            "framing": "single_object",
+            "magic_hex": "c301",
+            "current_fingerprint": "e2a33dff55802237",
+            "writer_schemas": {
+              "e2a33dff55802237": {
+                "schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+                "fingerprint": "crc64-avro:e2a33dff55802237"
+              }
+            }
+          }
+        },
+        "payload_manifest": {
+          "version": 1,
+          "entries": [
+            {
+              "path": "workflow.memo_payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "payloads.arguments.data",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "payloads.output.data",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "history_events.11.payload.output",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "commands.0.payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "commands.1.payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "signals.0.arguments",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "activities.0.arguments",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "activities.0.result",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            }
+          ]
+        }
+      },
+      "terminated": {
+        "schema": "durable-workflow.v2.history-export",
+        "schema_version": 2,
+        "exported_at": "2026-10-24T14:42:52.181897Z",
+        "dedupe_key": "{u:1}:4:2026-10-24T14:42:51.798314Z",
+        "history_complete": true,
+        "workflow": {
+          "instance_id": "{instance}",
+          "run_id": "{u:1}",
+          "run_number": 1,
+          "is_current_run": true,
+          "current_run_id": "{u:1}",
+          "current_run_source": "run_order_fallback",
+          "workflow_type": "parity.import",
+          "workflow_class": "parity.import",
+          "source_runtime": "embedded",
+          "source_process_class": "server_http_node",
+          "business_key": "bk-1",
+          "visibility_labels": [],
+          "memo": {
+            "note": "λ hello"
+          },
+          "memo_payload": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNw4CCG5vdGUKEM67IGhlbGxvAA=="
+          },
+          "search_attributes": [],
+          "status": "terminated",
+          "status_bucket": "failed",
+          "closed_reason": "terminated",
+          "archived_at": null,
+          "archive_command_id": null,
+          "archive_reason": null,
+          "compatibility": null,
+          "connection": null,
+          "queue": "q-src",
+          "last_history_sequence": 4,
+          "started_at": "2026-10-24T14:42:46.447474Z",
+          "closed_at": "2026-10-24T14:42:51.795895Z",
+          "last_progress_at": "2026-10-24T14:42:51.798314Z"
+        },
+        "payloads": {
+          "codec": "avro",
+          "arguments": {
+            "available": true,
+            "data": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "output": {
+            "available": false,
+            "codec": null,
+            "data": null
+          }
+        },
+        "history_events": [
+          {
+            "id": "{u:3}",
+            "sequence": 1,
+            "type": "StartAccepted",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:2}",
+            "recorded_at": "2026-10-24T14:42:46.471663Z",
+            "payload": {
+              "workflow_command_id": "{u:2}",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "workflow_class": "parity.import",
+              "workflow_type": "parity.import",
+              "business_key": "bk-1",
+              "visibility_labels": null,
+              "memo": {
+                "note": "λ hello"
+              },
+              "search_attributes": null,
+              "outcome": "started_new",
+              "command": {
+                "id": "{u:2}",
+                "sequence": 1,
+                "type": "start",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows",
+                "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                "request_fingerprint": "sha256:7cafb8caeb2d37a7cf562e76766e37df282b0d5790acfaae3249fd12b1e95db4",
+                "status": "accepted",
+                "outcome": "started_new",
+                "accepted_at": "2026-10-24T14:42:46.460769Z",
+                "applied_at": "2026-10-24T14:42:46.460778Z"
+              }
+            }
+          },
+          {
+            "id": "{u:4}",
+            "sequence": 2,
+            "type": "WorkflowStarted",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:2}",
+            "recorded_at": "2026-10-24T14:42:46.484260Z",
+            "payload": {
+              "workflow_class": "parity.import",
+              "workflow_type": "parity.import",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "workflow_command_id": "{u:2}",
+              "business_key": "bk-1",
+              "memo": {
+                "note": "λ hello"
+              },
+              "command": {
+                "id": "{u:2}",
+                "sequence": 1,
+                "type": "start",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows",
+                "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                "request_fingerprint": "sha256:7cafb8caeb2d37a7cf562e76766e37df282b0d5790acfaae3249fd12b1e95db4",
+                "status": "accepted",
+                "outcome": "started_new",
+                "accepted_at": "2026-10-24T14:42:46.460769Z",
+                "applied_at": "2026-10-24T14:42:46.460778Z"
+              }
+            }
+          },
+          {
+            "id": "{u:7}",
+            "sequence": 3,
+            "type": "TerminateRequested",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:6}",
+            "recorded_at": "2026-10-24T14:42:51.788929Z",
+            "payload": {
+              "workflow_command_id": "{u:6}",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "command_type": "terminate",
+              "reason": "parity terminate",
+              "command": {
+                "id": "{u:6}",
+                "sequence": 2,
+                "type": "terminate",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNw4CDHJlYXNvbgogcGFyaXR5IHRlcm1pbmF0ZQA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows/{instance}/terminate",
+                "request_route_name": "generated::9mKRxCklA43Q96fA",
+                "request_fingerprint": "sha256:b92bdf0fc7f27707344cbb3945e695f213155d88f8a136c4f2564a24349f2b72",
+                "status": "accepted",
+                "outcome": "terminated",
+                "accepted_at": "2026-10-24T14:42:51.784635Z"
+              }
+            }
+          },
+          {
+            "id": "{u:9}",
+            "sequence": 4,
+            "type": "WorkflowTerminated",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:6}",
+            "recorded_at": "2026-10-24T14:42:51.798314Z",
+            "payload": {
+              "workflow_command_id": "{u:6}",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "failure_id": "{u:8}",
+              "failure_category": "terminated",
+              "closed_reason": "terminated",
+              "exception_class": "Workflow\\V2\\Exceptions\\WorkflowTerminatedException",
+              "message": "Workflow terminated: parity terminate",
+              "reason": "parity terminate",
+              "command": {
+                "id": "{u:6}",
+                "sequence": 2,
+                "type": "terminate",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNw4CDHJlYXNvbgogcGFyaXR5IHRlcm1pbmF0ZQA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows/{instance}/terminate",
+                "request_route_name": "generated::9mKRxCklA43Q96fA",
+                "request_fingerprint": "sha256:b92bdf0fc7f27707344cbb3945e695f213155d88f8a136c4f2564a24349f2b72",
+                "status": "accepted",
+                "outcome": "terminated",
+                "accepted_at": "2026-10-24T14:42:51.784635Z"
+              }
+            }
+          }
+        ],
+        "commands": [
+          {
+            "id": "{u:2}",
+            "sequence": 1,
+            "message_sequence": null,
+            "type": "start",
+            "target_scope": "instance",
+            "requested_run_id": null,
+            "resolved_run_id": "{u:1}",
+            "target_name": null,
+            "payload_codec": "avro",
+            "payload": "wwHioz3/VYAiNwwCDgICYQQCAAA=",
+            "source": "control_plane",
+            "context": {
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              }
+            },
+            "caller_label": "Standalone Server",
+            "principal_type": "auth:token",
+            "principal_id": "legacy-token",
+            "principal_label": "Admin",
+            "auth_status": "authorized",
+            "auth_method": "token",
+            "request_method": "POST",
+            "request_path": "/api/workflows",
+            "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+            "request_fingerprint": "sha256:7cafb8caeb2d37a7cf562e76766e37df282b0d5790acfaae3249fd12b1e95db4",
+            "request_id": null,
+            "correlation_id": null,
+            "status": "accepted",
+            "outcome": "started_new",
+            "reason": null,
+            "rejection_reason": null,
+            "validation_errors": [],
+            "accepted_at": "2026-10-24T14:42:46.460769Z",
+            "applied_at": "2026-10-24T14:42:46.460778Z",
+            "rejected_at": null
+          },
+          {
+            "id": "{u:6}",
+            "sequence": 2,
+            "message_sequence": null,
+            "type": "terminate",
+            "target_scope": "instance",
+            "requested_run_id": null,
+            "resolved_run_id": "{u:1}",
+            "target_name": null,
+            "payload_codec": "avro",
+            "payload": "wwHioz3/VYAiNw4CDHJlYXNvbgogcGFyaXR5IHRlcm1pbmF0ZQA=",
+            "source": "control_plane",
+            "context": {
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              }
+            },
+            "caller_label": "Standalone Server",
+            "principal_type": "auth:token",
+            "principal_id": "legacy-token",
+            "principal_label": "Admin",
+            "auth_status": "authorized",
+            "auth_method": "token",
+            "request_method": "POST",
+            "request_path": "/api/workflows/{instance}/terminate",
+            "request_route_name": "generated::9mKRxCklA43Q96fA",
+            "request_fingerprint": "sha256:b92bdf0fc7f27707344cbb3945e695f213155d88f8a136c4f2564a24349f2b72",
+            "request_id": null,
+            "correlation_id": null,
+            "status": "accepted",
+            "outcome": "terminated",
+            "reason": "parity terminate",
+            "rejection_reason": null,
+            "validation_errors": [],
+            "accepted_at": "2026-10-24T14:42:51.784635Z",
+            "applied_at": "2026-10-24T14:42:51.808296Z",
+            "rejected_at": null
+          }
+        ],
+        "signals": [],
+        "updates": [],
+        "tasks": [
+          {
+            "id": "{u:5}",
+            "type": "workflow",
+            "status": "cancelled",
+            "payload": [],
+            "connection": null,
+            "queue": "q-src",
+            "compatibility": null,
+            "attempt_count": 0,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:42:46.488666Z",
+            "leased_at": null,
+            "lease_owner": null,
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": "2026-10-24T14:42:46.516163Z",
+            "last_dispatched_at": "2026-10-24T14:42:46.516163Z",
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:42:46.490247Z"
+          }
+        ],
+        "activities": [],
+        "timers": [],
+        "failures": [
+          {
+            "id": "{u:8}",
+            "source_kind": "workflow_run",
+            "source_id": "{u:1}",
+            "propagation_kind": "terminated",
+            "failure_category": "terminated",
+            "non_retryable": false,
+            "handled": false,
+            "history_authority": "typed_history",
+            "diagnostic_only": false,
+            "exception_type": null,
+            "exception_class": "Workflow\\V2\\Exceptions\\WorkflowTerminatedException",
+            "exception_resolved_class": "Workflow\\V2\\Exceptions\\WorkflowTerminatedException",
+            "exception_resolution_source": "recorded_class",
+            "exception_resolution_error": null,
+            "exception_replay_blocked": false,
+            "message": "Workflow terminated: parity terminate",
+            "file": null,
+            "line": 0,
+            "trace_preview": null,
+            "created_at": "2026-10-24T14:42:51.797317Z"
+          }
+        ],
+        "links": {
+          "projection_source": "workflow_run_lineage_entries",
+          "parents": [],
+          "children": []
+        },
+        "redaction": {
+          "applied": false,
+          "policy": null,
+          "paths": []
+        },
+        "codec_schemas": {
+          "avro": {
+            "encoding": "base64-avro-single-object",
+            "framing": "single_object",
+            "magic_hex": "c301",
+            "current_fingerprint": "e2a33dff55802237",
+            "writer_schemas": {
+              "e2a33dff55802237": {
+                "schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+                "fingerprint": "crc64-avro:e2a33dff55802237"
+              }
+            }
+          }
+        },
+        "payload_manifest": {
+          "version": 1,
+          "entries": [
+            {
+              "path": "workflow.memo_payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "payloads.arguments.data",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "payloads.output.data",
+              "codec": "avro",
+              "available": false,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": null,
+              "avro_prefix_hex": null,
+              "writer_schema": null,
+              "writer_schema_fingerprint": null,
+              "diagnostic": "payload_unavailable"
+            },
+            {
+              "path": "commands.0.payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "commands.1.payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            }
+          ]
+        }
+      },
+      "running": {
+        "schema": "durable-workflow.v2.history-export",
+        "schema_version": 2,
+        "exported_at": "2026-10-24T14:46:00.219311Z",
+        "dedupe_key": "{u:1}:2:2026-10-24T14:45:59.846584Z",
+        "history_complete": false,
+        "workflow": {
+          "instance_id": "{instance}",
+          "run_id": "{u:1}",
+          "run_number": 1,
+          "is_current_run": true,
+          "current_run_id": "{u:1}",
+          "current_run_source": "run_order_fallback",
+          "workflow_type": "parity.import",
+          "workflow_class": "parity.import",
+          "source_runtime": "embedded",
+          "source_process_class": "server_http_node",
+          "business_key": "bk-2",
+          "visibility_labels": [],
+          "memo": {
+            "note": "λ running"
+          },
+          "memo_payload": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNw4CCG5vdGUKFM67IHJ1bm5pbmcA"
+          },
+          "search_attributes": [],
+          "status": "pending",
+          "status_bucket": "running",
+          "closed_reason": null,
+          "archived_at": null,
+          "archive_command_id": null,
+          "archive_reason": null,
+          "compatibility": null,
+          "connection": null,
+          "queue": "q-src",
+          "last_history_sequence": 2,
+          "started_at": "2026-10-24T14:45:59.832108Z",
+          "closed_at": null,
+          "last_progress_at": "2026-10-24T14:45:59.846584Z"
+        },
+        "payloads": {
+          "codec": "avro",
+          "arguments": {
+            "available": true,
+            "data": "wwHioz3/VYAiNwwCDgICYQQEAAA="
+          },
+          "output": {
+            "available": false,
+            "codec": null,
+            "data": null
+          }
+        },
+        "history_events": [
+          {
+            "id": "{u:3}",
+            "sequence": 1,
+            "type": "StartAccepted",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:2}",
+            "recorded_at": "2026-10-24T14:45:59.843008Z",
+            "payload": {
+              "workflow_command_id": "{u:2}",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "workflow_class": "parity.import",
+              "workflow_type": "parity.import",
+              "business_key": "bk-2",
+              "visibility_labels": null,
+              "memo": {
+                "note": "λ running"
+              },
+              "search_attributes": null,
+              "outcome": "started_new",
+              "command": {
+                "id": "{u:2}",
+                "sequence": 1,
+                "type": "start",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNwwCDgICYQQEAAA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows",
+                "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                "request_fingerprint": "sha256:6ddbfea8164265756b0e17ede5be821e1cef4f30a3404df1fdebc802eb2403fb",
+                "status": "accepted",
+                "outcome": "started_new",
+                "accepted_at": "2026-10-24T14:45:59.839569Z",
+                "applied_at": "2026-10-24T14:45:59.839574Z"
+              }
+            }
+          },
+          {
+            "id": "{u:4}",
+            "sequence": 2,
+            "type": "WorkflowStarted",
+            "workflow_task_id": null,
+            "workflow_command_id": "{u:2}",
+            "recorded_at": "2026-10-24T14:45:59.846584Z",
+            "payload": {
+              "workflow_class": "parity.import",
+              "workflow_type": "parity.import",
+              "workflow_instance_id": "{instance}",
+              "workflow_run_id": "{u:1}",
+              "workflow_command_id": "{u:2}",
+              "business_key": "bk-2",
+              "memo": {
+                "note": "λ running"
+              },
+              "command": {
+                "id": "{u:2}",
+                "sequence": 1,
+                "type": "start",
+                "target_scope": "instance",
+                "resolved_run_id": "{u:1}",
+                "payload_codec": "avro",
+                "payload": "wwHioz3/VYAiNwwCDgICYQQEAAA=",
+                "source": "control_plane",
+                "context": {
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  }
+                },
+                "caller_label": "Standalone Server",
+                "principal_type": "auth:token",
+                "principal_id": "legacy-token",
+                "principal_label": "Admin",
+                "auth_status": "authorized",
+                "auth_method": "token",
+                "request_method": "POST",
+                "request_path": "/api/workflows",
+                "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                "request_fingerprint": "sha256:6ddbfea8164265756b0e17ede5be821e1cef4f30a3404df1fdebc802eb2403fb",
+                "status": "accepted",
+                "outcome": "started_new",
+                "accepted_at": "2026-10-24T14:45:59.839569Z",
+                "applied_at": "2026-10-24T14:45:59.839574Z"
+              }
+            }
+          }
+        ],
+        "commands": [
+          {
+            "id": "{u:2}",
+            "sequence": 1,
+            "message_sequence": null,
+            "type": "start",
+            "target_scope": "instance",
+            "requested_run_id": null,
+            "resolved_run_id": "{u:1}",
+            "target_name": null,
+            "payload_codec": "avro",
+            "payload": "wwHioz3/VYAiNwwCDgICYQQEAAA=",
+            "source": "control_plane",
+            "context": {
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              }
+            },
+            "caller_label": "Standalone Server",
+            "principal_type": "auth:token",
+            "principal_id": "legacy-token",
+            "principal_label": "Admin",
+            "auth_status": "authorized",
+            "auth_method": "token",
+            "request_method": "POST",
+            "request_path": "/api/workflows",
+            "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+            "request_fingerprint": "sha256:6ddbfea8164265756b0e17ede5be821e1cef4f30a3404df1fdebc802eb2403fb",
+            "request_id": null,
+            "correlation_id": null,
+            "status": "accepted",
+            "outcome": "started_new",
+            "reason": null,
+            "rejection_reason": null,
+            "validation_errors": [],
+            "accepted_at": "2026-10-24T14:45:59.839569Z",
+            "applied_at": "2026-10-24T14:45:59.839574Z",
+            "rejected_at": null
+          }
+        ],
+        "signals": [],
+        "updates": [],
+        "tasks": [
+          {
+            "id": "{u:5}",
+            "type": "workflow",
+            "status": "ready",
+            "payload": [],
+            "connection": null,
+            "queue": "q-src",
+            "compatibility": null,
+            "attempt_count": 0,
+            "repair_count": 0,
+            "available_at": "2026-10-24T14:45:59.849184Z",
+            "leased_at": null,
+            "lease_owner": null,
+            "lease_expires_at": null,
+            "last_dispatch_attempt_at": "2026-10-24T14:45:59.881110Z",
+            "last_dispatched_at": "2026-10-24T14:45:59.881110Z",
+            "last_dispatch_error": null,
+            "last_claim_failed_at": null,
+            "last_claim_error": null,
+            "repair_available_at": null,
+            "created_at": "2026-10-24T14:45:59.849817Z"
+          }
+        ],
+        "activities": [],
+        "timers": [],
+        "failures": [],
+        "links": {
+          "projection_source": "workflow_run_lineage_entries",
+          "parents": [],
+          "children": []
+        },
+        "redaction": {
+          "applied": false,
+          "policy": null,
+          "paths": []
+        },
+        "codec_schemas": {
+          "avro": {
+            "encoding": "base64-avro-single-object",
+            "framing": "single_object",
+            "magic_hex": "c301",
+            "current_fingerprint": "e2a33dff55802237",
+            "writer_schemas": {
+              "e2a33dff55802237": {
+                "schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+                "fingerprint": "crc64-avro:e2a33dff55802237"
+              }
+            }
+          }
+        },
+        "payload_manifest": {
+          "version": 1,
+          "entries": [
+            {
+              "path": "workflow.memo_payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "payloads.arguments.data",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            },
+            {
+              "path": "payloads.output.data",
+              "codec": "avro",
+              "available": false,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": null,
+              "avro_prefix_hex": null,
+              "writer_schema": null,
+              "writer_schema_fingerprint": null,
+              "diagnostic": "payload_unavailable"
+            },
+            {
+              "path": "commands.0.payload",
+              "codec": "avro",
+              "available": true,
+              "redacted": false,
+              "encoding": "base64-avro-single-object",
+              "avro_framing": "single_object",
+              "avro_prefix_hex": "c301",
+              "writer_schema": "{\"type\":\"record\",\"name\":\"Value\",\"namespace\":\"durable_workflow.protocol\",\"fields\":[{\"name\":\"value\",\"type\":[\"null\",{\"type\":\"record\",\"name\":\"BooleanValue\",\"fields\":[{\"name\":\"boolean\",\"type\":\"boolean\"}]},{\"type\":\"record\",\"name\":\"LongValue\",\"fields\":[{\"name\":\"long\",\"type\":\"long\"}]},{\"type\":\"record\",\"name\":\"DoubleValue\",\"fields\":[{\"name\":\"double\",\"type\":\"double\"}]},{\"type\":\"record\",\"name\":\"BytesValue\",\"fields\":[{\"name\":\"bytes\",\"type\":\"bytes\"}]},{\"type\":\"record\",\"name\":\"StringValue\",\"fields\":[{\"name\":\"string\",\"type\":\"string\"}]},{\"type\":\"record\",\"name\":\"ArrayValue\",\"fields\":[{\"name\":\"items\",\"type\":{\"type\":\"array\",\"items\":\"Value\"}}]},{\"type\":\"record\",\"name\":\"MapValue\",\"fields\":[{\"name\":\"entries\",\"type\":{\"type\":\"map\",\"values\":\"Value\"}}]}]}]}",
+              "writer_schema_fingerprint": "crc64-avro:e2a33dff55802237",
+              "diagnostic": null
+            }
+          ]
+        }
+      }
+    },
+    "published_defects": {
+      "cross_namespace_duplicate": {
+        "summary": "EmbeddedV2HistoryImport::existingRunOutcome finds the run in any namespace, so a bundle already imported into another namespace answers 200 already_imported for the requested namespace, which holds no such run. Native refuses it as a run_id conflict.",
+        "published": {
+          "duplicate_other_namespace": {
+            "status": 200,
+            "response": {
+              "schema": "durable-workflow.v2.embedded-v2-import.report",
+              "schema_version": 1,
+              "contract_version": 2,
+              "source": "embedded_v2",
+              "dry_run": false,
+              "workflow": {
+                "instance_id": "{rich.instance}",
+                "run_id": "{rich.run}",
+                "run_number": 1,
+                "workflow_type": "parity.rich",
+                "namespace": "{id}-alt",
+                "status": "completed",
+                "is_current_run": true,
+                "history_complete": true,
+                "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+              },
+              "eligibility": {
+                "eligible": true,
+                "errors": [],
+                "warnings": []
+              },
+              "integrity": {
+                "schema": "durable-workflow.v2.history-bundle-verification",
+                "schema_version": 1,
+                "status": "ok",
+                "bundle": {
+                  "schema": "durable-workflow.v2.history-export",
+                  "schema_version": 2,
+                  "exported_at": "2026-10-24T14:47:03.896027Z",
+                  "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+                  "workflow_run_id": "{rich.run}",
+                  "workflow_instance_id": "{rich.instance}",
+                  "history_event_count": 12
+                },
+                "integrity": {
+                  "present": true,
+                  "canonicalization": "json-recursive-ksort-v1",
+                  "checksum_algorithm": "sha256",
+                  "expected_checksum": "{rich.checksum}",
+                  "recomputed_checksum": "{rich.checksum}",
+                  "checksum_matches": true,
+                  "signature_algorithm": null,
+                  "signature_present": false,
+                  "signature_verified": null,
+                  "key_id": null
+                },
+                "summary": {
+                  "errors": 0,
+                  "warnings": 0,
+                  "info": 0,
+                  "findings_by_rule": []
+                },
+                "findings": []
+              },
+              "rollback": {
+                "mode": "database_transaction",
+                "partial_import_behavior": "no_rows_committed_on_failure"
+              },
+              "status": "already_imported",
+              "rows": {
+                "workflow_instances": 0,
+                "workflow_runs": 0,
+                "workflow_history_events": 0,
+                "workflow_commands": 0,
+                "workflow_signal_records": 0,
+                "workflow_updates": 0,
+                "workflow_tasks": 0,
+                "activity_executions": 0,
+                "activity_attempts": 0,
+                "workflow_run_timers": 0,
+                "workflow_failures": 0,
+                "workflow_links": 0,
+                "workflow_memos": 0,
+                "workflow_search_attributes": 0,
+                "workflow_run_summaries": 0
+              },
+              "control_plane": {
+                "schema": "durable-workflow.v2.control-plane-response",
+                "version": 1,
+                "operation": "import_embedded_v2",
+                "workflow_id": null,
+                "contract": {
+                  "schema": "durable-workflow.v2.control-plane-response.contract",
+                  "version": 1,
+                  "legacy_field_policy": "reject_non_canonical",
+                  "legacy_fields": {
+                    "query": "query_name",
+                    "signal": "signal_name",
+                    "update": "update_name",
+                    "wait_policy": "wait_for"
+                  },
+                  "required_fields": [],
+                  "success_fields": []
+                },
+                "status": "already_imported"
+              }
+            }
+          }
+        }
+      },
+      "cross_namespace_instance_attach": {
+        "summary": "EmbeddedV2HistoryImport::writeBundle finds the workflow instance in any namespace and attaches the imported run to it, so a run imported into one namespace takes over the current run and run count of an instance in another. Native refuses the write and leaves the other namespace unchanged.",
+        "published": {
+          "attach": {
+            "status": 201,
+            "response": {
+              "schema": "durable-workflow.v2.embedded-v2-import.report",
+              "schema_version": 1,
+              "contract_version": 2,
+              "source": "embedded_v2",
+              "dry_run": false,
+              "workflow": {
+                "instance_id": "{attach-source.instance}",
+                "run_id": "{attach.run}",
+                "run_number": 2,
+                "workflow_type": "parity.import",
+                "namespace": "{id}-imp",
+                "status": "terminated",
+                "is_current_run": true,
+                "history_complete": true,
+                "dedupe_key": "{attach.run}:4:2026-10-24T14:42:51.798314Z"
+              },
+              "eligibility": {
+                "eligible": true,
+                "errors": [],
+                "warnings": []
+              },
+              "integrity": {
+                "schema": "durable-workflow.v2.history-bundle-verification",
+                "schema_version": 1,
+                "status": "ok",
+                "bundle": {
+                  "schema": "durable-workflow.v2.history-export",
+                  "schema_version": 2,
+                  "exported_at": "2026-10-24T14:42:52.181897Z",
+                  "dedupe_key": "{attach.run}:4:2026-10-24T14:42:51.798314Z",
+                  "workflow_run_id": "{attach.run}",
+                  "workflow_instance_id": "{attach-source.instance}",
+                  "history_event_count": 4
+                },
+                "integrity": {
+                  "present": true,
+                  "canonicalization": "json-recursive-ksort-v1",
+                  "checksum_algorithm": "sha256",
+                  "expected_checksum": "{attach.checksum}",
+                  "recomputed_checksum": "{attach.checksum}",
+                  "checksum_matches": true,
+                  "signature_algorithm": null,
+                  "signature_present": false,
+                  "signature_verified": null,
+                  "key_id": null
+                },
+                "summary": {
+                  "errors": 0,
+                  "warnings": 0,
+                  "info": 0,
+                  "findings_by_rule": []
+                },
+                "findings": []
+              },
+              "rollback": {
+                "mode": "database_transaction",
+                "partial_import_behavior": "no_rows_committed_on_failure"
+              },
+              "status": "imported",
+              "import_id": "{generated_ulid}",
+              "imported_at": "{imported_at}",
+              "rows": {
+                "workflow_instances": 0,
+                "workflow_runs": 1,
+                "workflow_history_events": 4,
+                "workflow_commands": 2,
+                "workflow_signal_records": 0,
+                "workflow_updates": 0,
+                "workflow_tasks": 1,
+                "activity_executions": 0,
+                "activity_attempts": 0,
+                "workflow_run_timers": 0,
+                "workflow_failures": 1,
+                "workflow_links": 0,
+                "workflow_memos": 1,
+                "workflow_search_attributes": 0,
+                "workflow_run_summaries": 1
+              },
+              "control_plane": {
+                "schema": "durable-workflow.v2.control-plane-response",
+                "version": 1,
+                "operation": "import_embedded_v2",
+                "workflow_id": null,
+                "contract": {
+                  "schema": "durable-workflow.v2.control-plane-response.contract",
+                  "version": 1,
+                  "legacy_field_policy": "reject_non_canonical",
+                  "legacy_fields": {
+                    "query": "query_name",
+                    "signal": "signal_name",
+                    "update": "update_name",
+                    "wait_policy": "wait_for"
+                  },
+                  "required_fields": [],
+                  "success_fields": []
+                },
+                "status": "imported"
+              }
+            }
+          },
+          "attach_source_describe_after": {
+            "status": 200,
+            "response": {
+              "workflow_id": "{attach-source.instance}",
+              "run_id": "{attach-source.run}",
+              "namespace": "{id}-alt",
+              "workflow_type": "parity.import",
+              "business_key": "bk-1",
+              "status": "terminated",
+              "status_bucket": "failed",
+              "is_terminal": true,
+              "closed_reason": "terminated",
+              "task_queue": "q-src",
+              "run_number": 2,
+              "run_count": 2,
+              "is_current_run": true,
+              "continued_from_run_id": null,
+              "resume_step_sequence": null,
+              "recovery_kind": null,
+              "compatibility": null,
+              "compatibility_status": "compatible",
+              "compatibility_supported_in_fleet": true,
+              "compatibility_fleet_reason": null,
+              "payload_codec": "avro",
+              "definition_routing": {
+                "pinning_enabled": true,
+                "worker_pinned": false,
+                "recorded_fingerprint": null,
+                "workflow_type": "parity.import",
+                "task_queue": "q-src",
+                "required_build_id": null,
+                "status": "not_worker_pinned",
+                "blocked": false,
+                "runnable_task": false,
+                "eligible_worker_count": 0,
+                "matching_worker_count": 0,
+                "changed_worker_count": 0,
+                "missing_fingerprint_count": 0,
+                "entry_validation_unavailable_count": 0,
+                "workers": [],
+                "workers_truncated": false,
+                "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+              },
+              "execution_timeout_seconds": null,
+              "run_timeout_seconds": null,
+              "execution_deadline_at": null,
+              "run_deadline_at": null,
+              "input": [
+                {
+                  "a": 1
+                }
+              ],
+              "output": null,
+              "input_envelope": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "output_envelope": null,
+              "payload_previews": {
+                "input_omitted": false,
+                "output_omitted": false,
+                "max_encoded_bytes": 2097152
+              },
+              "started_at": "2026-10-24T14:42:46.447474Z",
+              "closed_at": "2026-10-24T14:42:51.795895Z",
+              "last_progress_at": "2026-10-24T14:42:51+00:00",
+              "wait_kind": null,
+              "wait_reason": null,
+              "memo": {
+                "note": "λ hello"
+              },
+              "search_attributes": [],
+              "actions": {
+                "can_signal": false,
+                "can_query": false,
+                "can_update": false,
+                "can_cancel": false,
+                "can_terminate": false,
+                "can_repair": false,
+                "can_archive": true
+              },
+              "commands_scope": "selected_run",
+              "commands": [
+                {
+                  "id": "{attach-source.u2}",
+                  "sequence": 1,
+                  "type": "start",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{attach-source.run}",
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  },
+                  "status": "accepted",
+                  "outcome": "started_new",
+                  "payload_preview_omitted": false,
+                  "workflow_type": "parity.import",
+                  "workflow_class": "parity.import",
+                  "accepted_at": "2026-10-24T14:42:46.460769Z",
+                  "applied_at": "2026-10-24T14:42:46.460778Z"
+                },
+                {
+                  "id": "{attach-source.u6}",
+                  "sequence": 2,
+                  "type": "terminate",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{attach-source.run}",
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "principal": {
+                    "type": "auth:token",
+                    "id": "legacy-token",
+                    "label": "Admin"
+                  },
+                  "status": "accepted",
+                  "outcome": "terminated",
+                  "reason": "parity terminate",
+                  "payload_preview_omitted": false,
+                  "workflow_type": "parity.import",
+                  "workflow_class": "parity.import",
+                  "accepted_at": "2026-10-24T14:42:51.784635Z",
+                  "applied_at": "2026-10-24T14:42:51.808296Z"
+                }
+              ],
+              "updates_scope": "selected_run",
+              "updates": [],
+              "control_plane": {
+                "schema": "durable-workflow.v2.control-plane-response",
+                "version": 1,
+                "operation": "describe",
+                "workflow_id": "{attach-source.instance}",
+                "contract": {
+                  "schema": "durable-workflow.v2.control-plane-response.contract",
+                  "version": 1,
+                  "legacy_field_policy": "reject_non_canonical",
+                  "legacy_fields": {
+                    "query": "query_name",
+                    "signal": "signal_name",
+                    "update": "update_name",
+                    "wait_policy": "wait_for"
+                  },
+                  "required_fields": [
+                    "workflow_id"
+                  ],
+                  "success_fields": []
+                },
+                "run_id": "{attach-source.run}",
+                "workflow_type": "parity.import",
+                "namespace": "{id}-alt",
+                "business_key": "bk-1",
+                "status": "terminated",
+                "status_bucket": "failed",
+                "is_terminal": true,
+                "task_queue": "q-src",
+                "run_number": 2,
+                "run_count": 2,
+                "is_current_run": true,
+                "compatibility": null,
+                "started_at": "2026-10-24T14:42:46.447474Z",
+                "closed_at": "2026-10-24T14:42:51.795895Z",
+                "last_progress_at": "2026-10-24T14:42:51+00:00",
+                "wait_kind": null,
+                "wait_reason": null
+              }
+            }
+          }
+        }
+      }
+    },
+    "expected": {
+      "applicable": true,
+      "namespace": "{id}-imp",
+      "alternate_namespace": "{id}-alt",
+      "gate_unauthenticated": {
+        "status": 401,
+        "response": {
+          "reason": "unauthorized",
+          "message": "Invalid or missing authentication token.",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "unauthorized",
+            "message": "Invalid or missing authentication token."
+          }
+        }
+      },
+      "gate_missing_version": {
+        "status": 400,
+        "response": {
+          "message": "Missing control-plane version header.",
+          "reason": "missing_control_plane_version",
+          "supported_version": "2",
+          "requested_version": null,
+          "remediation": "Send the X-Durable-Workflow-Control-Plane-Version: 2 header on control-plane requests.",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "missing_control_plane_version",
+            "message": "Missing control-plane version header.",
+            "remediation": "Send the X-Durable-Workflow-Control-Plane-Version: 2 header on control-plane requests."
+          }
+        }
+      },
+      "gate_unsupported_version": {
+        "status": 400,
+        "response": {
+          "message": "Unsupported control-plane version.",
+          "reason": "unsupported_control_plane_version",
+          "supported_version": "2",
+          "requested_version": "3",
+          "remediation": "Client requested control-plane version 3; this server only supports 2. Upgrade the client to a release that targets control-plane 2, or connect to a server that supports 3.",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "unsupported_control_plane_version",
+            "message": "Unsupported control-plane version.",
+            "remediation": "Client requested control-plane version 3; this server only supports 2. Upgrade the client to a release that targets control-plane 2, or connect to a server that supports 3."
+          }
+        }
+      },
+      "gate_unknown_namespace": {
+        "status": 404,
+        "response": {
+          "message": "Namespace '{id}-missing' does not exist.",
+          "reason": "namespace_not_found",
+          "namespace": "{id}-missing",
+          "remediation": "Register the namespace via POST /api/namespaces, or send an X-Namespace header naming an existing namespace.",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "namespace": "{id}-missing",
+            "reason": "namespace_not_found",
+            "message": "Namespace '{id}-missing' does not exist.",
+            "remediation": "Register the namespace via POST /api/namespaces, or send an X-Namespace header naming an existing namespace."
+          }
+        }
+      },
+      "gate_text_plain": {
+        "status": 415,
+        "response": {
+          "message": "Request bodies must use a JSON media type.",
+          "reason": "unsupported_media_type",
+          "accepted_content_types": [
+            "application/json",
+            "application/*+json"
+          ],
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "unsupported_media_type",
+            "message": "Request bodies must use a JSON media type."
+          }
+        }
+      },
+      "gate_malformed_json": {
+        "status": 400,
+        "response": {
+          "message": "Request bodies must contain valid JSON.",
+          "reason": "malformed_json",
+          "json_error": "Syntax error",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "malformed_json",
+            "message": "Request bodies must contain valid JSON."
+          }
+        }
+      },
+      "shape_empty_object": {
+        "status": 422,
+        "response": {
+          "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+          "reason": "invalid_import_bundle",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "invalid_import_bundle",
+            "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+          }
+        }
+      },
+      "shape_empty_list": {
+        "status": 422,
+        "response": {
+          "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+          "reason": "invalid_import_bundle",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "invalid_import_bundle",
+            "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+          }
+        }
+      },
+      "shape_empty_bundle": {
+        "status": 422,
+        "response": {
+          "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+          "reason": "invalid_import_bundle",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "invalid_import_bundle",
+            "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+          }
+        }
+      },
+      "shape_bundle_list": {
+        "status": 422,
+        "response": {
+          "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+          "reason": "invalid_import_bundle",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "invalid_import_bundle",
+            "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+          }
+        }
+      },
+      "shape_null": {
+        "status": 422,
+        "response": {
+          "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+          "reason": "invalid_import_bundle",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "reason": "invalid_import_bundle",
+            "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+          }
+        }
+      },
+      "shape_options_only": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": null,
+            "run_id": null,
+            "run_number": 1,
+            "workflow_type": "imported-workflow",
+            "namespace": "{id}-imp",
+            "status": "running",
+            "is_current_run": false,
+            "history_complete": false,
+            "dedupe_key": null
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              },
+              {
+                "rule": "workflow.instance_id_missing",
+                "message": "Bundle workflow.instance_id is required."
+              },
+              {
+                "rule": "workflow.run_id_missing",
+                "message": "Bundle workflow.run_id is required."
+              },
+              {
+                "rule": "workflow.non_terminal_not_current",
+                "message": "Non-terminal embedded v2 imports must be the current run."
+              },
+              {
+                "rule": "workflow.source_runtime_unsupported",
+                "message": "Bundle workflow.source_runtime must be embedded."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": null,
+              "schema_version": null,
+              "exported_at": null,
+              "dedupe_key": null,
+              "workflow_run_id": null,
+              "workflow_instance_id": null,
+              "history_event_count": 0
+            },
+            "integrity": {
+              "present": false,
+              "canonicalization": null,
+              "checksum_algorithm": null,
+              "expected_checksum": null,
+              "recomputed_checksum": null,
+              "checksum_matches": null,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 21,
+              "warnings": 1,
+              "info": 0,
+              "findings_by_rule": {
+                "bundle.exported_at_missing": 1,
+                "bundle.schema_missing": 1,
+                "bundle.schema_version_missing": 1,
+                "bundle.section_missing": 14,
+                "integrity.missing": 1,
+                "workflow.instance_id_missing": 1,
+                "workflow.memo_payload_missing": 1,
+                "workflow.run_id_missing": 1,
+                "workflow.workflow_type_missing": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "bundle.schema_missing",
+                "severity": "error",
+                "message": "Bundle is missing the schema field.",
+                "path": "schema",
+                "context": []
+              },
+              {
+                "rule": "bundle.schema_version_missing",
+                "severity": "error",
+                "message": "Bundle is missing schema_version.",
+                "path": "schema_version",
+                "context": []
+              },
+              {
+                "rule": "bundle.exported_at_missing",
+                "severity": "warning",
+                "message": "Bundle is missing exported_at; replay reports cannot be ordered without it.",
+                "path": "exported_at",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [workflow].",
+                "path": "workflow",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [payloads].",
+                "path": "payloads",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [history_events].",
+                "path": "history_events",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [commands].",
+                "path": "commands",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [signals].",
+                "path": "signals",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [updates].",
+                "path": "updates",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [tasks].",
+                "path": "tasks",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [activities].",
+                "path": "activities",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [timers].",
+                "path": "timers",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [failures].",
+                "path": "failures",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [links].",
+                "path": "links",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [redaction].",
+                "path": "redaction",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [codec_schemas].",
+                "path": "codec_schemas",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [payload_manifest].",
+                "path": "payload_manifest",
+                "context": []
+              },
+              {
+                "rule": "workflow.run_id_missing",
+                "severity": "error",
+                "message": "Bundle workflow.run_id is required.",
+                "path": "workflow.run_id",
+                "context": []
+              },
+              {
+                "rule": "workflow.instance_id_missing",
+                "severity": "error",
+                "message": "Bundle workflow.instance_id is required.",
+                "path": "workflow.instance_id",
+                "context": []
+              },
+              {
+                "rule": "workflow.workflow_type_missing",
+                "severity": "error",
+                "message": "Bundle workflow.workflow_type is required.",
+                "path": "workflow.workflow_type",
+                "context": []
+              },
+              {
+                "rule": "workflow.memo_payload_missing",
+                "severity": "error",
+                "message": "Bundle workflow.memo_payload must contain the lossless portable Avro memo authority.",
+                "path": "workflow.memo_payload",
+                "context": []
+              },
+              {
+                "rule": "integrity.missing",
+                "severity": "error",
+                "message": "Bundle has no integrity block; offline replay verification cannot vouch for its contents.",
+                "path": "integrity",
+                "context": []
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "shape_bundle_string": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": null,
+            "run_id": null,
+            "run_number": 1,
+            "workflow_type": "imported-workflow",
+            "namespace": "{id}-imp",
+            "status": "running",
+            "is_current_run": false,
+            "history_complete": false,
+            "dedupe_key": null
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              },
+              {
+                "rule": "workflow.instance_id_missing",
+                "message": "Bundle workflow.instance_id is required."
+              },
+              {
+                "rule": "workflow.run_id_missing",
+                "message": "Bundle workflow.run_id is required."
+              },
+              {
+                "rule": "workflow.non_terminal_not_current",
+                "message": "Non-terminal embedded v2 imports must be the current run."
+              },
+              {
+                "rule": "workflow.source_runtime_unsupported",
+                "message": "Bundle workflow.source_runtime must be embedded."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": null,
+              "schema_version": null,
+              "exported_at": null,
+              "dedupe_key": null,
+              "workflow_run_id": null,
+              "workflow_instance_id": null,
+              "history_event_count": 0
+            },
+            "integrity": {
+              "present": false,
+              "canonicalization": null,
+              "checksum_algorithm": null,
+              "expected_checksum": null,
+              "recomputed_checksum": null,
+              "checksum_matches": null,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 21,
+              "warnings": 1,
+              "info": 0,
+              "findings_by_rule": {
+                "bundle.exported_at_missing": 1,
+                "bundle.schema_missing": 1,
+                "bundle.schema_version_missing": 1,
+                "bundle.section_missing": 14,
+                "integrity.missing": 1,
+                "workflow.instance_id_missing": 1,
+                "workflow.memo_payload_missing": 1,
+                "workflow.run_id_missing": 1,
+                "workflow.workflow_type_missing": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "bundle.schema_missing",
+                "severity": "error",
+                "message": "Bundle is missing the schema field.",
+                "path": "schema",
+                "context": []
+              },
+              {
+                "rule": "bundle.schema_version_missing",
+                "severity": "error",
+                "message": "Bundle is missing schema_version.",
+                "path": "schema_version",
+                "context": []
+              },
+              {
+                "rule": "bundle.exported_at_missing",
+                "severity": "warning",
+                "message": "Bundle is missing exported_at; replay reports cannot be ordered without it.",
+                "path": "exported_at",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [workflow].",
+                "path": "workflow",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [payloads].",
+                "path": "payloads",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [history_events].",
+                "path": "history_events",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [commands].",
+                "path": "commands",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [signals].",
+                "path": "signals",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [updates].",
+                "path": "updates",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [tasks].",
+                "path": "tasks",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [activities].",
+                "path": "activities",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [timers].",
+                "path": "timers",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [failures].",
+                "path": "failures",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [links].",
+                "path": "links",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [redaction].",
+                "path": "redaction",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [codec_schemas].",
+                "path": "codec_schemas",
+                "context": []
+              },
+              {
+                "rule": "bundle.section_missing",
+                "severity": "error",
+                "message": "Bundle is missing required section [payload_manifest].",
+                "path": "payload_manifest",
+                "context": []
+              },
+              {
+                "rule": "workflow.run_id_missing",
+                "severity": "error",
+                "message": "Bundle workflow.run_id is required.",
+                "path": "workflow.run_id",
+                "context": []
+              },
+              {
+                "rule": "workflow.instance_id_missing",
+                "severity": "error",
+                "message": "Bundle workflow.instance_id is required.",
+                "path": "workflow.instance_id",
+                "context": []
+              },
+              {
+                "rule": "workflow.workflow_type_missing",
+                "severity": "error",
+                "message": "Bundle workflow.workflow_type is required.",
+                "path": "workflow.workflow_type",
+                "context": []
+              },
+              {
+                "rule": "workflow.memo_payload_missing",
+                "severity": "error",
+                "message": "Bundle workflow.memo_payload must contain the lossless portable Avro memo authority.",
+                "path": "workflow.memo_payload",
+                "context": []
+              },
+              {
+                "rule": "integrity.missing",
+                "severity": "error",
+                "message": "Bundle has no integrity block; offline replay verification cannot vouch for its contents.",
+                "path": "integrity",
+                "context": []
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "dry_run": {
+        "status": 200,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": "{rich.instance}",
+            "run_id": "{rich.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{rich.run}",
+              "workflow_instance_id": "{rich.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{rich.checksum}",
+              "recomputed_checksum": "{rich.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "dry_run",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 12,
+            "workflow_commands": 2,
+            "workflow_signal_records": 1,
+            "workflow_updates": 0,
+            "workflow_tasks": 6,
+            "activity_executions": 1,
+            "activity_attempts": 1,
+            "workflow_run_timers": 1,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "dry_run"
+          }
+        },
+        "headers": {
+          "X-Durable-Workflow-Control-Plane-Version": "2"
+        }
+      },
+      "import": {
+        "status": 201,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{rich.instance}",
+            "run_id": "{rich.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{rich.run}",
+              "workflow_instance_id": "{rich.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{rich.checksum}",
+              "recomputed_checksum": "{rich.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "imported",
+          "import_id": "imp-1",
+          "imported_at": "{imported_at}",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 12,
+            "workflow_commands": 2,
+            "workflow_signal_records": 1,
+            "workflow_updates": 0,
+            "workflow_tasks": 6,
+            "activity_executions": 1,
+            "activity_attempts": 1,
+            "workflow_run_timers": 1,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 2,
+            "workflow_search_attributes": 2,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "imported"
+          }
+        },
+        "headers": {
+          "X-Durable-Workflow-Control-Plane-Version": "2"
+        }
+      },
+      "duplicate": {
+        "status": 200,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{rich.instance}",
+            "run_id": "{rich.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{rich.run}",
+              "workflow_instance_id": "{rich.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{rich.checksum}",
+              "recomputed_checksum": "{rich.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "already_imported",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "already_imported"
+          }
+        }
+      },
+      "duplicate_dry_run": {
+        "status": 200,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": "{rich.instance}",
+            "run_id": "{rich.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{rich.run}",
+              "workflow_instance_id": "{rich.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{rich.checksum}",
+              "recomputed_checksum": "{rich.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "already_imported",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "already_imported"
+          }
+        }
+      },
+      "duplicate_other_namespace": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{rich.instance}",
+            "run_id": "{rich.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-alt",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "target.run_id_conflict",
+                "message": "A workflow run with this run_id already exists and was not imported from the same bundle."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{rich.run}",
+              "workflow_instance_id": "{rich.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{rich.checksum}",
+              "recomputed_checksum": "{rich.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "other_namespace_list": {
+        "status": 200,
+        "response": {
+          "workflows": [],
+          "workflow_count": 0,
+          "next_page_token": null,
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "list",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "workflow_count": 0,
+            "next_page_token": null
+          }
+        }
+      },
+      "conflict_changed_bundle": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{rich.instance}",
+            "run_id": "{rich.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "changed"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "target.run_id_conflict",
+                "message": "A workflow run with this run_id already exists and was not imported from the same bundle."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "changed",
+              "workflow_run_id": "{rich.run}",
+              "workflow_instance_id": "{rich.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{rich.checksum}",
+              "recomputed_checksum": "{rich.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "conflict_native_run": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": "{native-run.instance}",
+            "run_id": "{main.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{native-run.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "target.run_id_conflict",
+                "message": "A workflow run with this run_id already exists and was not imported from the same bundle."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{native-run.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{main.run}",
+              "workflow_instance_id": "{native-run.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{native-run.checksum}",
+              "recomputed_checksum": "{native-run.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "tampered": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{tampered.instance}",
+            "run_id": "{tampered.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{tampered.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{tampered.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{tampered.run}",
+              "workflow_instance_id": "{tampered.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{tampered.checksum}",
+              "recomputed_checksum": "{tampered.recomputed}",
+              "checksum_matches": false,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 1,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": {
+                "integrity.checksum_mismatch": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "integrity.checksum_mismatch",
+                "severity": "error",
+                "message": "Recomputed bundle checksum does not match the recorded checksum; the bundle has been altered after export.",
+                "path": "integrity.checksum",
+                "context": {
+                  "expected": "{tampered.checksum}",
+                  "actual": "{tampered.recomputed}"
+                }
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "signature_required_unsigned": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{unsigned.instance}",
+            "run_id": "{unsigned.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{unsigned.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.signature_required",
+                "message": "A verified history-export signature is required for this import."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{unsigned.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{unsigned.run}",
+              "workflow_instance_id": "{unsigned.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{unsigned.checksum}",
+              "recomputed_checksum": "{unsigned.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "signature_required_no_key": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{signed-no-key.instance}",
+            "run_id": "{signed-no-key.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{signed-no-key.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.signature_required",
+                "message": "A verified history-export signature is required for this import."
+              }
+            ],
+            "warnings": [
+              {
+                "rule": "bundle.integrity_warning",
+                "message": "Bundle integrity verification reported warnings."
+              }
+            ]
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "warning",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{signed-no-key.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{signed-no-key.run}",
+              "workflow_instance_id": "{signed-no-key.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{signed-no-key.checksum}",
+              "recomputed_checksum": "{signed-no-key.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": "hmac-sha256",
+              "signature_present": true,
+              "signature_verified": null,
+              "key_id": "parity-key-1"
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 1,
+              "info": 0,
+              "findings_by_rule": {
+                "integrity.signature_key_unavailable": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "integrity.signature_key_unavailable",
+                "severity": "warning",
+                "message": "Bundle is signed but no verification key is configured; signature was not verified.",
+                "path": "integrity.signature",
+                "context": []
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "signature_wrong_key": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{signed-wrong-key.instance}",
+            "run_id": "{signed-wrong-key.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{signed-wrong-key.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              },
+              {
+                "rule": "bundle.signature_required",
+                "message": "A verified history-export signature is required for this import."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{signed-wrong-key.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{signed-wrong-key.run}",
+              "workflow_instance_id": "{signed-wrong-key.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{signed-wrong-key.checksum}",
+              "recomputed_checksum": "{signed-wrong-key.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": "hmac-sha256",
+              "signature_present": true,
+              "signature_verified": false,
+              "key_id": "parity-key-1"
+            },
+            "summary": {
+              "errors": 1,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": {
+                "integrity.signature_mismatch": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "integrity.signature_mismatch",
+                "severity": "error",
+                "message": "Bundle signature does not match the configured key; treat the bundle as untrusted.",
+                "path": "integrity.signature",
+                "context": {
+                  "key_id": "parity-key-1"
+                }
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "signature_verified": {
+        "status": 201,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{signed.instance}",
+            "run_id": "{signed.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{signed.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{signed.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{signed.run}",
+              "workflow_instance_id": "{signed.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{signed.checksum}",
+              "recomputed_checksum": "{signed.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": "hmac-sha256",
+              "signature_present": true,
+              "signature_verified": true,
+              "key_id": "parity-key-1"
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "imported",
+          "import_id": "{generated_ulid}",
+          "imported_at": "{imported_at}",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 12,
+            "workflow_commands": 2,
+            "workflow_signal_records": 1,
+            "workflow_updates": 0,
+            "workflow_tasks": 6,
+            "activity_executions": 1,
+            "activity_attempts": 1,
+            "workflow_run_timers": 1,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 2,
+            "workflow_search_attributes": 2,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "imported"
+          }
+        }
+      },
+      "signature_required_yes_no_key": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{signed-yes.instance}",
+            "run_id": "{signed-yes.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{signed-yes.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.signature_required",
+                "message": "A verified history-export signature is required for this import."
+              }
+            ],
+            "warnings": [
+              {
+                "rule": "bundle.integrity_warning",
+                "message": "Bundle integrity verification reported warnings."
+              }
+            ]
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "warning",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{signed-yes.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{signed-yes.run}",
+              "workflow_instance_id": "{signed-yes.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{signed-yes.checksum}",
+              "recomputed_checksum": "{signed-yes.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": "hmac-sha256",
+              "signature_present": true,
+              "signature_verified": null,
+              "key_id": "parity-key-1"
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 1,
+              "info": 0,
+              "findings_by_rule": {
+                "integrity.signature_key_unavailable": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "integrity.signature_key_unavailable",
+                "severity": "warning",
+                "message": "Bundle is signed but no verification key is configured; signature was not verified.",
+                "path": "integrity.signature",
+                "context": []
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "terminal_history_incomplete": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{incomplete.instance}",
+            "run_id": "{incomplete.run}",
+            "run_number": 1,
+            "workflow_type": "parity.import",
+            "namespace": "{id}-imp",
+            "status": "terminated",
+            "is_current_run": true,
+            "history_complete": false,
+            "dedupe_key": "{incomplete.run}:4:2026-10-24T14:42:51.798314Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "workflow.terminal_history_incomplete",
+                "message": "Terminal run imports require history_complete=true."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:42:52.181897Z",
+              "dedupe_key": "{incomplete.run}:4:2026-10-24T14:42:51.798314Z",
+              "workflow_run_id": "{incomplete.run}",
+              "workflow_instance_id": "{incomplete.instance}",
+              "history_event_count": 4
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{incomplete.checksum}",
+              "recomputed_checksum": "{incomplete.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "status_unsupported": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{bogus-status.instance}",
+            "run_id": "{bogus-status.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "bogus",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{bogus-status.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "workflow.status_unsupported",
+                "message": "Bundle workflow.status is not a supported v2 run status."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{bogus-status.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{bogus-status.run}",
+              "workflow_instance_id": "{bogus-status.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{bogus-status.checksum}",
+              "recomputed_checksum": "{bogus-status.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "identity_missing": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": null,
+            "run_id": null,
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{no-identity.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              },
+              {
+                "rule": "workflow.instance_id_missing",
+                "message": "Bundle workflow.instance_id is required."
+              },
+              {
+                "rule": "workflow.run_id_missing",
+                "message": "Bundle workflow.run_id is required."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{no-identity.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": null,
+              "workflow_instance_id": null,
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{no-identity.checksum}",
+              "recomputed_checksum": "{no-identity.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 2,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": {
+                "workflow.instance_id_missing": 1,
+                "workflow.run_id_missing": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "workflow.run_id_missing",
+                "severity": "error",
+                "message": "Bundle workflow.run_id is required.",
+                "path": "workflow.run_id",
+                "context": []
+              },
+              {
+                "rule": "workflow.instance_id_missing",
+                "severity": "error",
+                "message": "Bundle workflow.instance_id is required.",
+                "path": "workflow.instance_id",
+                "context": []
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "source_runtime_unsupported": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{standalone.instance}",
+            "run_id": "{standalone.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{standalone.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "workflow.source_runtime_unsupported",
+                "message": "Bundle workflow.source_runtime must be embedded."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{standalone.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{standalone.run}",
+              "workflow_instance_id": "{standalone.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{standalone.checksum}",
+              "recomputed_checksum": "{standalone.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "payload_codec_unsupported": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{json-codec.instance}",
+            "run_id": "{json-codec.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{json-codec.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "payload_codec.unsupported",
+                "message": "Bundle payload codec at [payloads.codec] must be \"avro\"; found \"json\". JSON is only the HTTP document transport and cannot be imported as durable payload data."
+              },
+              {
+                "rule": "payload_codec.unsupported",
+                "message": "Bundle payload codec at [commands.0.payload_codec] must be \"avro\"; found \"json\". JSON is only the HTTP document transport and cannot be imported as durable payload data."
+              },
+              {
+                "rule": "payload_codec.unsupported",
+                "message": "Bundle payload codec at [signals.0.payload_codec] must be \"avro\"; found int. JSON is only the HTTP document transport and cannot be imported as durable payload data."
+              },
+              {
+                "rule": "payload_codec.unsupported",
+                "message": "Bundle payload codec at [payload_manifest.entries.1.codec] must be \"avro\"; found \"json\". JSON is only the HTTP document transport and cannot be imported as durable payload data."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{json-codec.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{json-codec.run}",
+              "workflow_instance_id": "{json-codec.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{json-codec.checksum}",
+              "recomputed_checksum": "{json-codec.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "memo_projection_mismatch": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{memo-mismatch.instance}",
+            "run_id": "{memo-mismatch.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{memo-mismatch.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{memo-mismatch.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{memo-mismatch.run}",
+              "workflow_instance_id": "{memo-mismatch.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{memo-mismatch.checksum}",
+              "recomputed_checksum": "{memo-mismatch.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 1,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": {
+                "workflow.memo_projection_mismatch": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "workflow.memo_projection_mismatch",
+                "severity": "error",
+                "message": "Bundle workflow.memo does not match the JSON-safe projection of workflow.memo_payload.",
+                "path": "workflow.memo",
+                "context": []
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "leased_task": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{leased.instance}",
+            "run_id": "{leased.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{leased.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "tasks.leased_task_present",
+                "message": "Leased workflow or activity tasks must be completed, failed, or released before import."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{leased.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{leased.run}",
+              "workflow_instance_id": "{leased.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{leased.checksum}",
+              "recomputed_checksum": "{leased.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "running_attempt": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{running-attempt.instance}",
+            "run_id": "{running-attempt.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{running-attempt.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "activities.running_attempt_present",
+                "message": "Running activity attempts must be released before import."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{running-attempt.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{running-attempt.run}",
+              "workflow_instance_id": "{running-attempt.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{running-attempt.checksum}",
+              "recomputed_checksum": "{running-attempt.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "redaction_string_paths": {
+        "status": 200,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": "{redacted-strings.instance}",
+            "run_id": "{redacted-strings.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{redacted-strings.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{redacted-strings.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{redacted-strings.run}",
+              "workflow_instance_id": "{redacted-strings.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{redacted-strings.checksum}",
+              "recomputed_checksum": "{redacted-strings.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "dry_run",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 12,
+            "workflow_commands": 2,
+            "workflow_signal_records": 1,
+            "workflow_updates": 0,
+            "workflow_tasks": 6,
+            "activity_executions": 1,
+            "activity_attempts": 1,
+            "workflow_run_timers": 1,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "dry_run"
+          }
+        }
+      },
+      "redaction_object_paths": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": "{redacted-objects.instance}",
+            "run_id": "{redacted-objects.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{redacted-objects.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.redacted_payloads",
+                "message": "Redacted history bundles cannot be imported as server-managed state."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{redacted-objects.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{redacted-objects.run}",
+              "workflow_instance_id": "{redacted-objects.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{redacted-objects.checksum}",
+              "recomputed_checksum": "{redacted-objects.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "redaction_applied_without_paths": {
+        "status": 200,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": "{redacted-empty.instance}",
+            "run_id": "{redacted-empty.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{redacted-empty.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{redacted-empty.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{redacted-empty.run}",
+              "workflow_instance_id": "{redacted-empty.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{redacted-empty.checksum}",
+              "recomputed_checksum": "{redacted-empty.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 1,
+              "findings_by_rule": {
+                "redaction.empty_paths": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "redaction.empty_paths",
+                "severity": "info",
+                "message": "Redaction is marked applied but no paths were redacted; replay-diff diagnostics will treat all payloads as in-scope.",
+                "path": "redaction.paths",
+                "context": []
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "dry_run",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 12,
+            "workflow_commands": 2,
+            "workflow_signal_records": 1,
+            "workflow_updates": 0,
+            "workflow_tasks": 6,
+            "activity_executions": 1,
+            "activity_attempts": 1,
+            "workflow_run_timers": 1,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "dry_run"
+          }
+        }
+      },
+      "normalized_checksum": {
+        "status": 201,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{normalized.instance}",
+            "run_id": "{normalized.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{normalized.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{normalized.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{normalized.run}",
+              "workflow_instance_id": "{normalized.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{normalized.checksum}",
+              "recomputed_checksum": "{normalized.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "imported",
+          "import_id": "{generated_ulid}",
+          "imported_at": "{imported_at}",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 12,
+            "workflow_commands": 2,
+            "workflow_signal_records": 1,
+            "workflow_updates": 0,
+            "workflow_tasks": 6,
+            "activity_executions": 1,
+            "activity_attempts": 1,
+            "workflow_run_timers": 1,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 2,
+            "workflow_search_attributes": 2,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "imported"
+          }
+        }
+      },
+      "unnormalized_checksum": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{unnormalized.instance}",
+            "run_id": "{unnormalized.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{unnormalized.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{unnormalized.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{unnormalized.run}",
+              "workflow_instance_id": "{unnormalized.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{unnormalized.checksum}",
+              "recomputed_checksum": "{unnormalized.recomputed}",
+              "checksum_matches": false,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 1,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": {
+                "integrity.checksum_mismatch": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "integrity.checksum_mismatch",
+                "severity": "error",
+                "message": "Recomputed bundle checksum does not match the recorded checksum; the bundle has been altered after export.",
+                "path": "integrity.checksum",
+                "context": {
+                  "expected": "{unnormalized.checksum}",
+                  "actual": "{unnormalized.recomputed}"
+                }
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "bare_bundle": {
+        "status": 201,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{bare.instance}",
+            "run_id": "{bare.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{bare.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{bare.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{bare.run}",
+              "workflow_instance_id": "{bare.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{bare.checksum}",
+              "recomputed_checksum": "{bare.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "imported",
+          "import_id": "{generated_ulid}",
+          "imported_at": "{imported_at}",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 12,
+            "workflow_commands": 2,
+            "workflow_signal_records": 1,
+            "workflow_updates": 0,
+            "workflow_tasks": 6,
+            "activity_executions": 1,
+            "activity_attempts": 1,
+            "workflow_run_timers": 1,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 2,
+            "workflow_search_attributes": 2,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "imported"
+          }
+        }
+      },
+      "bare_bundle_with_option": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": true,
+          "workflow": {
+            "instance_id": "{bare-option.instance}",
+            "run_id": "{bare-option.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{bare-option.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "bundle.integrity_failed",
+                "message": "Bundle integrity verification failed."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "failed",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{bare-option.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{bare-option.run}",
+              "workflow_instance_id": "{bare-option.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{bare-option.checksum}",
+              "recomputed_checksum": "{bare-option.recomputed}",
+              "checksum_matches": false,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 1,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": {
+                "integrity.checksum_mismatch": 1
+              }
+            },
+            "findings": [
+              {
+                "rule": "integrity.checksum_mismatch",
+                "severity": "error",
+                "message": "Recomputed bundle checksum does not match the recorded checksum; the bundle has been altered after export.",
+                "path": "integrity.checksum",
+                "context": {
+                  "expected": "{bare-option.checksum}",
+                  "actual": "{bare-option.recomputed}"
+                }
+              }
+            ]
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "write_failed": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{bad-time.instance}",
+            "run_id": "{bad-time.run}",
+            "run_number": 1,
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "status": "completed",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{bad-time.run}:12:2026-10-24T14:47:03.778604Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "target.write_failed",
+                "message": "{database_message}"
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:47:03.896027Z",
+              "dedupe_key": "{bad-time.run}:12:2026-10-24T14:47:03.778604Z",
+              "workflow_run_id": "{bad-time.run}",
+              "workflow_instance_id": "{bad-time.instance}",
+              "history_event_count": 12
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{bad-time.checksum}",
+              "recomputed_checksum": "{bad-time.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "write_failed_describe": {
+        "status": 404,
+        "response": {
+          "message": "Workflow not found.",
+          "reason": "instance_not_found",
+          "workflow_id": "{bad-time.instance}",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "describe",
+            "workflow_id": "{bad-time.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": []
+            },
+            "reason": "instance_not_found",
+            "message": "Workflow not found."
+          }
+        }
+      },
+      "terminated": {
+        "status": 201,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{terminated.instance}",
+            "run_id": "{terminated.run}",
+            "run_number": 1,
+            "workflow_type": "parity.import",
+            "namespace": "{id}-imp",
+            "status": "terminated",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{terminated.run}:4:2026-10-24T14:42:51.798314Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:42:52.181897Z",
+              "dedupe_key": "{terminated.run}:4:2026-10-24T14:42:51.798314Z",
+              "workflow_run_id": "{terminated.run}",
+              "workflow_instance_id": "{terminated.instance}",
+              "history_event_count": 4
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{terminated.checksum}",
+              "recomputed_checksum": "{terminated.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "imported",
+          "import_id": "{generated_ulid}",
+          "imported_at": "{imported_at}",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 4,
+            "workflow_commands": 2,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 1,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 1,
+            "workflow_links": 0,
+            "workflow_memos": 1,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "imported"
+          }
+        }
+      },
+      "non_terminal_not_current": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{not-current.instance}",
+            "run_id": "{not-current.run}",
+            "run_number": 1,
+            "workflow_type": "parity.import",
+            "namespace": "{id}-imp",
+            "status": "pending",
+            "is_current_run": false,
+            "history_complete": false,
+            "dedupe_key": "{not-current.run}:2:2026-10-24T14:45:59.846584Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "workflow.non_terminal_not_current",
+                "message": "Non-terminal embedded v2 imports must be the current run."
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:46:00.219311Z",
+              "dedupe_key": "{not-current.run}:2:2026-10-24T14:45:59.846584Z",
+              "workflow_run_id": "{not-current.run}",
+              "workflow_instance_id": "{not-current.instance}",
+              "history_event_count": 2
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{not-current.checksum}",
+              "recomputed_checksum": "{not-current.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "running": {
+        "status": 201,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{running.instance}",
+            "run_id": "{running.run}",
+            "run_number": 1,
+            "workflow_type": "parity.import",
+            "namespace": "{id}-imp",
+            "status": "pending",
+            "is_current_run": true,
+            "history_complete": false,
+            "dedupe_key": "{running.run}:2:2026-10-24T14:45:59.846584Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:46:00.219311Z",
+              "dedupe_key": "{running.run}:2:2026-10-24T14:45:59.846584Z",
+              "workflow_run_id": "{running.run}",
+              "workflow_instance_id": "{running.instance}",
+              "history_event_count": 2
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{running.checksum}",
+              "recomputed_checksum": "{running.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "imported",
+          "import_id": "{generated_ulid}",
+          "imported_at": "{imported_at}",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 2,
+            "workflow_commands": 1,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 1,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 1,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "imported"
+          }
+        }
+      },
+      "running_describe": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{running.instance}",
+          "run_id": "{running.run}",
+          "namespace": "{id}-imp",
+          "workflow_type": "parity.import",
+          "business_key": "bk-2",
+          "status": "pending",
+          "status_bucket": "running",
+          "is_terminal": false,
+          "closed_reason": null,
+          "task_queue": "q-src",
+          "run_number": 1,
+          "run_count": 1,
+          "is_current_run": true,
+          "continued_from_run_id": null,
+          "resume_step_sequence": null,
+          "recovery_kind": null,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "payload_codec": "avro",
+          "definition_routing": {
+            "pinning_enabled": true,
+            "worker_pinned": false,
+            "recorded_fingerprint": null,
+            "workflow_type": "parity.import",
+            "task_queue": "q-src",
+            "required_build_id": null,
+            "status": "not_worker_pinned",
+            "blocked": false,
+            "runnable_task": true,
+            "eligible_worker_count": 0,
+            "matching_worker_count": 0,
+            "changed_worker_count": 0,
+            "missing_fingerprint_count": 0,
+            "entry_validation_unavailable_count": 0,
+            "workers": [],
+            "workers_truncated": false,
+            "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+          },
+          "execution_timeout_seconds": null,
+          "run_timeout_seconds": null,
+          "execution_deadline_at": null,
+          "run_deadline_at": null,
+          "input": [
+            {
+              "a": 2
+            }
+          ],
+          "output": null,
+          "input_envelope": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNwwCDgICYQQEAAA="
+          },
+          "output_envelope": null,
+          "payload_previews": {
+            "input_omitted": false,
+            "output_omitted": false,
+            "max_encoded_bytes": 2097152
+          },
+          "started_at": "2026-10-24T14:45:59.832108Z",
+          "closed_at": null,
+          "last_progress_at": "2026-10-24T14:45:59+00:00",
+          "wait_kind": "workflow-task",
+          "wait_reason": "{workflow_task_ready}",
+          "memo": {
+            "note": "λ running"
+          },
+          "search_attributes": [],
+          "actions": {
+            "can_signal": true,
+            "can_query": false,
+            "can_update": false,
+            "can_cancel": true,
+            "can_terminate": true,
+            "can_repair": true,
+            "can_archive": false
+          },
+          "commands_scope": "selected_run",
+          "commands": [
+            {
+              "id": "{running.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{running.run}",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "started_new",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.import",
+              "workflow_class": "parity.import",
+              "accepted_at": "2026-10-24T14:45:59.839569Z",
+              "applied_at": "2026-10-24T14:45:59.839574Z"
+            }
+          ],
+          "updates_scope": "selected_run",
+          "updates": [],
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "describe",
+            "workflow_id": "{running.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": []
+            },
+            "run_id": "{running.run}",
+            "workflow_type": "parity.import",
+            "namespace": "{id}-imp",
+            "business_key": "bk-2",
+            "status": "pending",
+            "status_bucket": "running",
+            "is_terminal": false,
+            "task_queue": "q-src",
+            "run_number": 1,
+            "run_count": 1,
+            "is_current_run": true,
+            "compatibility": null,
+            "started_at": "2026-10-24T14:45:59.832108Z",
+            "closed_at": null,
+            "last_progress_at": "2026-10-24T14:45:59+00:00",
+            "wait_kind": "workflow-task",
+            "wait_reason": "{workflow_task_ready}"
+          }
+        }
+      },
+      "read_describe": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{rich.instance}",
+          "run_id": "{rich.run}",
+          "namespace": "{id}-imp",
+          "workflow_type": "parity.rich",
+          "business_key": "bk-rich",
+          "status": "completed",
+          "status_bucket": "completed",
+          "is_terminal": true,
+          "closed_reason": "completed",
+          "task_queue": "q-rich",
+          "run_number": 1,
+          "run_count": 1,
+          "is_current_run": true,
+          "continued_from_run_id": null,
+          "resume_step_sequence": null,
+          "recovery_kind": null,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "payload_codec": "avro",
+          "definition_routing": {
+            "pinning_enabled": true,
+            "worker_pinned": false,
+            "recorded_fingerprint": null,
+            "workflow_type": "parity.rich",
+            "task_queue": "q-rich",
+            "required_build_id": null,
+            "status": "not_worker_pinned",
+            "blocked": false,
+            "runnable_task": false,
+            "eligible_worker_count": 0,
+            "matching_worker_count": 0,
+            "changed_worker_count": 0,
+            "missing_fingerprint_count": 0,
+            "entry_validation_unavailable_count": 0,
+            "workers": [],
+            "workers_truncated": false,
+            "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+          },
+          "execution_timeout_seconds": null,
+          "run_timeout_seconds": null,
+          "execution_deadline_at": null,
+          "run_deadline_at": null,
+          "input": [
+            {
+              "a": 1
+            }
+          ],
+          "output": [
+            {
+              "a": 1
+            }
+          ],
+          "input_envelope": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "output_envelope": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "payload_previews": {
+            "input_omitted": false,
+            "output_omitted": false,
+            "max_encoded_bytes": 2097152
+          },
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "last_progress_at": "2026-10-24T14:47:03+00:00",
+          "wait_kind": null,
+          "wait_reason": null,
+          "memo": {
+            "n": 3,
+            "note": "λ rich"
+          },
+          "search_attributes": {
+            "CustomerId": "cust-λ",
+            "Tier": 2
+          },
+          "actions": {
+            "can_signal": false,
+            "can_query": false,
+            "can_update": false,
+            "can_cancel": false,
+            "can_terminate": false,
+            "can_repair": false,
+            "can_archive": true
+          },
+          "commands_scope": "selected_run",
+          "commands": [
+            {
+              "id": "{rich.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "started_new",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.rich",
+              "workflow_class": "parity.rich",
+              "accepted_at": "2026-10-24T14:46:59.960583Z",
+              "applied_at": "2026-10-24T14:46:59.960589Z"
+            },
+            {
+              "id": "{rich.u20}",
+              "sequence": 2,
+              "type": "signal",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "target_name": "go",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "signal_received",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.rich",
+              "workflow_class": "parity.rich",
+              "accepted_at": "2026-10-24T14:47:03.476022Z",
+              "applied_at": "2026-10-24T14:47:03.768522Z"
+            }
+          ],
+          "updates_scope": "selected_run",
+          "updates": [],
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "describe",
+            "workflow_id": "{rich.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": []
+            },
+            "run_id": "{rich.run}",
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "business_key": "bk-rich",
+            "status": "completed",
+            "status_bucket": "completed",
+            "is_terminal": true,
+            "task_queue": "q-rich",
+            "run_number": 1,
+            "run_count": 1,
+            "is_current_run": true,
+            "compatibility": null,
+            "started_at": "2026-10-24T14:46:59.941656Z",
+            "closed_at": "2026-10-24T14:47:03.777577Z",
+            "last_progress_at": "2026-10-24T14:47:03+00:00",
+            "wait_kind": null,
+            "wait_reason": null
+          }
+        }
+      },
+      "read_runs": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{rich.instance}",
+          "run_count": 1,
+          "runs": [
+            {
+              "run_id": "{rich.run}",
+              "run_number": 1,
+              "workflow_type": "parity.rich",
+              "business_key": "bk-rich",
+              "status": "completed",
+              "status_bucket": "completed",
+              "is_terminal": true,
+              "is_current_run": true,
+              "task_queue": "q-rich",
+              "compatibility": null,
+              "compatibility_status": "compatible",
+              "compatibility_supported_in_fleet": true,
+              "compatibility_fleet_reason": null,
+              "started_at": "2026-10-24T14:46:59.941656Z",
+              "closed_at": "2026-10-24T14:47:03.777577Z",
+              "memo": {
+                "n": 3,
+                "note": "λ rich"
+              }
+            }
+          ],
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "list_runs",
+            "workflow_id": "{rich.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": []
+            },
+            "run_count": 1
+          }
+        }
+      },
+      "read_run": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{rich.instance}",
+          "run_id": "{rich.run}",
+          "namespace": "{id}-imp",
+          "workflow_type": "parity.rich",
+          "business_key": "bk-rich",
+          "status": "completed",
+          "status_bucket": "completed",
+          "is_terminal": true,
+          "closed_reason": "completed",
+          "task_queue": "q-rich",
+          "run_number": 1,
+          "run_count": 1,
+          "is_current_run": true,
+          "continued_from_run_id": null,
+          "resume_step_sequence": null,
+          "recovery_kind": null,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "payload_codec": "avro",
+          "definition_routing": {
+            "pinning_enabled": true,
+            "worker_pinned": false,
+            "recorded_fingerprint": null,
+            "workflow_type": "parity.rich",
+            "task_queue": "q-rich",
+            "required_build_id": null,
+            "status": "not_worker_pinned",
+            "blocked": false,
+            "runnable_task": false,
+            "eligible_worker_count": 0,
+            "matching_worker_count": 0,
+            "changed_worker_count": 0,
+            "missing_fingerprint_count": 0,
+            "entry_validation_unavailable_count": 0,
+            "workers": [],
+            "workers_truncated": false,
+            "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+          },
+          "execution_timeout_seconds": null,
+          "run_timeout_seconds": null,
+          "execution_deadline_at": null,
+          "run_deadline_at": null,
+          "input": [
+            {
+              "a": 1
+            }
+          ],
+          "output": [
+            {
+              "a": 1
+            }
+          ],
+          "input_envelope": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "output_envelope": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "payload_previews": {
+            "input_omitted": false,
+            "output_omitted": false,
+            "max_encoded_bytes": 2097152
+          },
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "last_progress_at": "2026-10-24T14:47:03+00:00",
+          "wait_kind": null,
+          "wait_reason": null,
+          "memo": {
+            "n": 3,
+            "note": "λ rich"
+          },
+          "search_attributes": {
+            "CustomerId": "cust-λ",
+            "Tier": 2
+          },
+          "actions": {
+            "can_signal": false,
+            "can_query": false,
+            "can_update": false,
+            "can_cancel": false,
+            "can_terminate": false,
+            "can_repair": false,
+            "can_archive": true
+          },
+          "commands_scope": "selected_run",
+          "commands": [
+            {
+              "id": "{rich.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "started_new",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.rich",
+              "workflow_class": "parity.rich",
+              "accepted_at": "2026-10-24T14:46:59.960583Z",
+              "applied_at": "2026-10-24T14:46:59.960589Z"
+            },
+            {
+              "id": "{rich.u20}",
+              "sequence": 2,
+              "type": "signal",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "target_name": "go",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "signal_received",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.rich",
+              "workflow_class": "parity.rich",
+              "accepted_at": "2026-10-24T14:47:03.476022Z",
+              "applied_at": "2026-10-24T14:47:03.768522Z"
+            }
+          ],
+          "updates_scope": "selected_run",
+          "updates": [],
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "describe_run",
+            "workflow_id": "{rich.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": [
+                "run_id"
+              ],
+              "rejection_fields": [
+                "workflow_id",
+                "run_id",
+                "reason",
+                "message",
+                "retryable",
+                "error_id",
+                "exception"
+              ],
+              "rejection_reasons": [
+                "control_plane_internal_error"
+              ]
+            },
+            "run_id": "{rich.run}",
+            "workflow_type": "parity.rich",
+            "namespace": "{id}-imp",
+            "business_key": "bk-rich",
+            "status": "completed",
+            "status_bucket": "completed",
+            "is_terminal": true,
+            "task_queue": "q-rich",
+            "run_number": 1,
+            "run_count": 1,
+            "is_current_run": true,
+            "compatibility": null,
+            "started_at": "2026-10-24T14:46:59.941656Z",
+            "closed_at": "2026-10-24T14:47:03.777577Z",
+            "last_progress_at": "2026-10-24T14:47:03+00:00",
+            "wait_kind": null,
+            "wait_reason": null
+          }
+        }
+      },
+      "read_history": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{rich.instance}",
+          "run_id": "{rich.run}",
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "events": [
+            {
+              "sequence": 1,
+              "event_type": "StartAccepted",
+              "timestamp": "2026-10-24T14:46:59.967125Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_command_id": "{rich.u2}",
+                "workflow_instance_id": "{rich.instance}",
+                "workflow_run_id": "{rich.run}",
+                "workflow_class": "parity.rich",
+                "workflow_type": "parity.rich",
+                "business_key": "bk-rich",
+                "visibility_labels": null,
+                "memo": {
+                  "note": "λ rich",
+                  "n": 3
+                },
+                "search_attributes": {
+                  "CustomerId": "cust-λ",
+                  "Tier": 2
+                },
+                "outcome": "started_new",
+                "command": {
+                  "id": "{rich.u2}",
+                  "sequence": 1,
+                  "type": "start",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{rich.run}",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows",
+                  "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                  "request_fingerprint": "sha256:9c9eaf04b60868e676065d1796f72d8bd18838b46353d302ab6f9ce7c54ea1ea",
+                  "status": "accepted",
+                  "outcome": "started_new",
+                  "accepted_at": "2026-10-24T14:46:59.960583Z",
+                  "applied_at": "2026-10-24T14:46:59.960589Z"
+                }
+              }
+            },
+            {
+              "sequence": 2,
+              "event_type": "WorkflowStarted",
+              "timestamp": "2026-10-24T14:46:59.974840Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_class": "parity.rich",
+                "workflow_type": "parity.rich",
+                "workflow_instance_id": "{rich.instance}",
+                "workflow_run_id": "{rich.run}",
+                "workflow_command_id": "{rich.u2}",
+                "business_key": "bk-rich",
+                "memo": {
+                  "note": "λ rich",
+                  "n": 3
+                },
+                "search_attributes": {
+                  "CustomerId": "cust-λ",
+                  "Tier": 2
+                },
+                "command": {
+                  "id": "{rich.u2}",
+                  "sequence": 1,
+                  "type": "start",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{rich.run}",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows",
+                  "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                  "request_fingerprint": "sha256:9c9eaf04b60868e676065d1796f72d8bd18838b46353d302ab6f9ce7c54ea1ea",
+                  "status": "accepted",
+                  "outcome": "started_new",
+                  "accepted_at": "2026-10-24T14:46:59.960583Z",
+                  "applied_at": "2026-10-24T14:46:59.960589Z"
+                },
+                "declared_queries": [],
+                "declared_query_contracts": [],
+                "declared_signals": [
+                  "go"
+                ],
+                "declared_signal_contracts": [
+                  {
+                    "name": "go",
+                    "parameters": []
+                  }
+                ],
+                "declared_updates": [],
+                "declared_update_contracts": [],
+                "declared_entry_method": "handle",
+                "declared_entry_mode": "canonical",
+                "declared_entry_declaring_class": "external:parity.rich"
+              }
+            },
+            {
+              "sequence": 3,
+              "event_type": "ActivityScheduled",
+              "timestamp": "2026-10-24T14:47:00.313979Z",
+              "principal": null,
+              "payload": {
+                "activity_execution_id": "{rich.u6}",
+                "activity_class": "parity.act",
+                "activity_type": "parity.act",
+                "sequence": 1,
+                "activity": {
+                  "id": "{rich.u6}",
+                  "idempotency_key": "{rich.u6}",
+                  "sequence": 1,
+                  "type": "parity.act",
+                  "class": "parity.act",
+                  "local_activity": false,
+                  "status": "pending",
+                  "payload_codec": "avro",
+                  "attempt_count": 0,
+                  "queue": "q-rich",
+                  "created_at": "2026-10-24T14:47:00.306185Z",
+                  "arguments": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  }
+                },
+                "task": {
+                  "id": "{rich.u5}",
+                  "type": "workflow",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:46:59.977678Z",
+                  "leased_at": "2026-10-24T14:47:00.117197Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:48:00.117111Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich",
+                  "last_dispatch_attempt_at": "2026-10-24T14:46:59.997376Z",
+                  "last_dispatched_at": "2026-10-24T14:46:59.997376Z"
+                }
+              }
+            },
+            {
+              "sequence": 4,
+              "event_type": "ActivityStarted",
+              "timestamp": "2026-10-24T14:47:00.548205Z",
+              "principal": null,
+              "payload": {
+                "activity_execution_id": "{rich.u6}",
+                "activity_attempt_id": "{rich.U9}",
+                "activity_class": "parity.act",
+                "activity_type": "parity.act",
+                "sequence": 1,
+                "attempt_number": 1,
+                "activity": {
+                  "id": "{rich.u6}",
+                  "idempotency_key": "{rich.u6}",
+                  "sequence": 1,
+                  "type": "parity.act",
+                  "class": "parity.act",
+                  "local_activity": false,
+                  "attempt_id": "{rich.U9}",
+                  "status": "running",
+                  "payload_codec": "avro",
+                  "attempt_count": 1,
+                  "queue": "q-rich",
+                  "created_at": "2026-10-24T14:47:00.306185Z",
+                  "started_at": "2026-10-24T14:47:00.543703Z",
+                  "arguments": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  }
+                },
+                "task": {
+                  "id": "{rich.u8}",
+                  "type": "activity",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:00.317243Z",
+                  "leased_at": "2026-10-24T14:47:00.543703Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:52:00.543817Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich"
+                }
+              }
+            },
+            {
+              "sequence": 5,
+              "event_type": "ActivityCompleted",
+              "timestamp": "2026-10-24T14:47:00.678013Z",
+              "principal": null,
+              "payload": {
+                "activity_execution_id": "{rich.u6}",
+                "activity_attempt_id": "{rich.U9}",
+                "activity_class": "parity.act",
+                "activity_type": "parity.act",
+                "sequence": 1,
+                "attempt_number": 1,
+                "result": {
+                  "codec": "avro",
+                  "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                },
+                "payload_codec": "avro",
+                "activity": {
+                  "id": "{rich.u6}",
+                  "idempotency_key": "{rich.u6}",
+                  "sequence": 1,
+                  "type": "parity.act",
+                  "class": "parity.act",
+                  "local_activity": false,
+                  "attempt_id": "{rich.U9}",
+                  "status": "completed",
+                  "payload_codec": "avro",
+                  "attempt_count": 1,
+                  "queue": "q-rich",
+                  "created_at": "2026-10-24T14:47:00.306185Z",
+                  "started_at": "2026-10-24T14:47:00.543703Z",
+                  "closed_at": "2026-10-24T14:47:00.676908Z",
+                  "arguments": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  },
+                  "result": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  }
+                },
+                "task": {
+                  "id": "{rich.u8}",
+                  "type": "activity",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:00.317243Z",
+                  "leased_at": "2026-10-24T14:47:00.543703Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:52:00.543817Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich"
+                }
+              }
+            },
+            {
+              "sequence": 6,
+              "event_type": "TimerScheduled",
+              "timestamp": "2026-10-24T14:47:00.950363Z",
+              "principal": null,
+              "payload": {
+                "timer_id": "{rich.u13}",
+                "sequence": 2,
+                "delay_seconds": 1,
+                "fire_at": "2026-10-24T14:47:01.949279Z",
+                "task": {
+                  "id": "{rich.u12}",
+                  "type": "workflow",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:00.683997Z",
+                  "leased_at": "2026-10-24T14:47:00.813533Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:48:00.813492Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich",
+                  "last_dispatch_attempt_at": "2026-10-24T14:47:00.717460Z",
+                  "last_dispatched_at": "2026-10-24T14:47:00.717460Z"
+                }
+              }
+            },
+            {
+              "sequence": 7,
+              "event_type": "TimerFired",
+              "timestamp": "2026-10-24T14:47:03.177823Z",
+              "principal": null,
+              "payload": {
+                "timer_id": "{rich.u13}",
+                "sequence": 2,
+                "delay_seconds": 1,
+                "fire_at": "2026-10-24T14:47:01.949279Z",
+                "fired_at": "2026-10-24T14:47:03.176920Z",
+                "task": {
+                  "id": "{rich.u15}",
+                  "type": "timer",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:01.949279Z",
+                  "leased_at": "2026-10-24T14:47:03.145194Z",
+                  "lease_owner": "{rich.u15}",
+                  "lease_expires_at": "2026-10-24T14:48:03.145206Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich"
+                }
+              }
+            },
+            {
+              "sequence": 8,
+              "event_type": "SignalWaitOpened",
+              "timestamp": "2026-10-24T14:47:03.335861Z",
+              "principal": null,
+              "payload": {
+                "signal_name": "go",
+                "signal_wait_id": "{rich.U18}",
+                "sequence": 3,
+                "task": {
+                  "id": "{rich.u17}",
+                  "type": "workflow",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:03.180548Z",
+                  "leased_at": "2026-10-24T14:47:03.228522Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:48:03.228482Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich",
+                  "last_dispatch_attempt_at": "2026-10-24T14:47:03.202748Z",
+                  "last_dispatched_at": "2026-10-24T14:47:03.202748Z"
+                }
+              }
+            },
+            {
+              "sequence": 9,
+              "event_type": "SignalReceived",
+              "timestamp": "2026-10-24T14:47:03.479854Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_command_id": "{rich.u20}",
+                "signal_id": "{rich.u21}",
+                "workflow_instance_id": "{rich.instance}",
+                "workflow_run_id": "{rich.run}",
+                "signal_name": "go",
+                "signal_wait_id": "{rich.U18}",
+                "arguments": {
+                  "codec": "avro",
+                  "blob": "wwHioz3/VYAiNwwA"
+                },
+                "payload_codec": "avro",
+                "command": {
+                  "id": "{rich.u20}",
+                  "sequence": 2,
+                  "message_sequence": 1,
+                  "type": "signal",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{rich.run}",
+                  "target_name": "go",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNw4GCG5hbWUKBGdvEmFyZ3VtZW50cwwAInZhbGlkYXRpb25fZXJyb3JzDAAA"
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows/{rich.instance}/signal/go",
+                  "request_route_name": "generated::1UDj0wPOAwpiUqm5",
+                  "request_fingerprint": "sha256:42c656099216d66c82aed9d3b85b92c4845c7dea1a6baab85e2cc4f8313045ee",
+                  "status": "accepted",
+                  "outcome": "signal_received",
+                  "accepted_at": "2026-10-24T14:47:03.476022Z"
+                }
+              }
+            },
+            {
+              "sequence": 10,
+              "event_type": "MessageCursorAdvanced",
+              "timestamp": "2026-10-24T14:47:03.770214Z",
+              "principal": null,
+              "payload": {
+                "stream_key": "instance:{rich.instance}",
+                "previous_position": 0,
+                "new_position": 1,
+                "task": {
+                  "id": "{rich.u23}",
+                  "type": "workflow",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:03.485571Z",
+                  "leased_at": "2026-10-24T14:47:03.638294Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich",
+                  "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+                  "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+                }
+              }
+            },
+            {
+              "sequence": 11,
+              "event_type": "SignalApplied",
+              "timestamp": "2026-10-24T14:47:03.773614Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_command_id": "{rich.u20}",
+                "signal_id": "{rich.u21}",
+                "signal_name": "go",
+                "signal_wait_id": "{rich.U18}",
+                "sequence": 3,
+                "value": "wwHioz3/VYAiNwIB",
+                "task": {
+                  "id": "{rich.u23}",
+                  "type": "workflow",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:03.485571Z",
+                  "leased_at": "2026-10-24T14:47:03.638294Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich",
+                  "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+                  "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+                },
+                "command": {
+                  "id": "{rich.u20}",
+                  "sequence": 2,
+                  "message_sequence": 1,
+                  "type": "signal",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{rich.run}",
+                  "target_name": "go",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNw4GCG5hbWUKBGdvEmFyZ3VtZW50cwwAInZhbGlkYXRpb25fZXJyb3JzDAAA"
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows/{rich.instance}/signal/go",
+                  "request_route_name": "generated::1UDj0wPOAwpiUqm5",
+                  "request_fingerprint": "sha256:42c656099216d66c82aed9d3b85b92c4845c7dea1a6baab85e2cc4f8313045ee",
+                  "status": "accepted",
+                  "outcome": "signal_received",
+                  "accepted_at": "2026-10-24T14:47:03.476022Z",
+                  "applied_at": "2026-10-24T14:47:03.768522Z"
+                }
+              }
+            },
+            {
+              "sequence": 12,
+              "event_type": "WorkflowCompleted",
+              "timestamp": "2026-10-24T14:47:03.778604Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "output": {
+                  "codec": "avro",
+                  "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                },
+                "payload_codec": "avro",
+                "task": {
+                  "id": "{rich.u23}",
+                  "type": "workflow",
+                  "status": "leased",
+                  "available_at": "2026-10-24T14:47:03.485571Z",
+                  "leased_at": "2026-10-24T14:47:03.638294Z",
+                  "lease_owner": "w-rich",
+                  "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+                  "attempt_count": 1,
+                  "repair_count": 0,
+                  "connection": "sqlite",
+                  "queue": "q-rich",
+                  "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+                  "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+                },
+                "command": {
+                  "type": "complete_workflow",
+                  "source": "worker_protocol",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin"
+                }
+              }
+            }
+          ],
+          "next_page_token": null,
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "history",
+            "workflow_id": "{rich.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id",
+                "run_id"
+              ],
+              "success_fields": [
+                "next_page_token"
+              ],
+              "rejection_fields": [
+                "workflow_id",
+                "run_id",
+                "reason",
+                "message",
+                "retryable",
+                "error_id",
+                "exception"
+              ],
+              "rejection_reasons": [
+                "control_plane_internal_error"
+              ]
+            },
+            "run_id": "{rich.run}",
+            "compatibility": null,
+            "next_page_token": null
+          }
+        }
+      },
+      "read_terminated_history": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{terminated.instance}",
+          "run_id": "{terminated.run}",
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "events": [
+            {
+              "sequence": 1,
+              "event_type": "StartAccepted",
+              "timestamp": "2026-10-24T14:42:46.471663Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_command_id": "{terminated.u2}",
+                "workflow_instance_id": "{terminated.instance}",
+                "workflow_run_id": "{terminated.run}",
+                "workflow_class": "parity.import",
+                "workflow_type": "parity.import",
+                "business_key": "bk-1",
+                "visibility_labels": null,
+                "memo": {
+                  "note": "λ hello"
+                },
+                "search_attributes": null,
+                "outcome": "started_new",
+                "command": {
+                  "id": "{terminated.u2}",
+                  "sequence": 1,
+                  "type": "start",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{terminated.run}",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows",
+                  "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                  "request_fingerprint": "sha256:7cafb8caeb2d37a7cf562e76766e37df282b0d5790acfaae3249fd12b1e95db4",
+                  "status": "accepted",
+                  "outcome": "started_new",
+                  "accepted_at": "2026-10-24T14:42:46.460769Z",
+                  "applied_at": "2026-10-24T14:42:46.460778Z"
+                }
+              }
+            },
+            {
+              "sequence": 2,
+              "event_type": "WorkflowStarted",
+              "timestamp": "2026-10-24T14:42:46.484260Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_class": "parity.import",
+                "workflow_type": "parity.import",
+                "workflow_instance_id": "{terminated.instance}",
+                "workflow_run_id": "{terminated.run}",
+                "workflow_command_id": "{terminated.u2}",
+                "business_key": "bk-1",
+                "memo": {
+                  "note": "λ hello"
+                },
+                "command": {
+                  "id": "{terminated.u2}",
+                  "sequence": 1,
+                  "type": "start",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{terminated.run}",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows",
+                  "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+                  "request_fingerprint": "sha256:7cafb8caeb2d37a7cf562e76766e37df282b0d5790acfaae3249fd12b1e95db4",
+                  "status": "accepted",
+                  "outcome": "started_new",
+                  "accepted_at": "2026-10-24T14:42:46.460769Z",
+                  "applied_at": "2026-10-24T14:42:46.460778Z"
+                }
+              }
+            },
+            {
+              "sequence": 3,
+              "event_type": "TerminateRequested",
+              "timestamp": "2026-10-24T14:42:51.788929Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_command_id": "{terminated.u6}",
+                "workflow_instance_id": "{terminated.instance}",
+                "workflow_run_id": "{terminated.run}",
+                "command_type": "terminate",
+                "reason": "parity terminate",
+                "command": {
+                  "id": "{terminated.u6}",
+                  "sequence": 2,
+                  "type": "terminate",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{terminated.run}",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNw4CDHJlYXNvbgogcGFyaXR5IHRlcm1pbmF0ZQA="
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows/{terminated.instance}/terminate",
+                  "request_route_name": "generated::9mKRxCklA43Q96fA",
+                  "request_fingerprint": "sha256:b92bdf0fc7f27707344cbb3945e695f213155d88f8a136c4f2564a24349f2b72",
+                  "status": "accepted",
+                  "outcome": "terminated",
+                  "accepted_at": "2026-10-24T14:42:51.784635Z"
+                }
+              }
+            },
+            {
+              "sequence": 4,
+              "event_type": "WorkflowTerminated",
+              "timestamp": "2026-10-24T14:42:51.798314Z",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "payload": {
+                "workflow_command_id": "{terminated.u6}",
+                "workflow_instance_id": "{terminated.instance}",
+                "workflow_run_id": "{terminated.run}",
+                "failure_id": "{terminated.u8}",
+                "failure_category": "terminated",
+                "closed_reason": "terminated",
+                "exception_class": "Workflow\\V2\\Exceptions\\WorkflowTerminatedException",
+                "message": "Workflow terminated: parity terminate",
+                "reason": "parity terminate",
+                "command": {
+                  "id": "{terminated.u6}",
+                  "sequence": 2,
+                  "type": "terminate",
+                  "target_scope": "instance",
+                  "resolved_run_id": "{terminated.run}",
+                  "payload_codec": "avro",
+                  "payload": {
+                    "codec": "avro",
+                    "blob": "wwHioz3/VYAiNw4CDHJlYXNvbgogcGFyaXR5IHRlcm1pbmF0ZQA="
+                  },
+                  "source": "control_plane",
+                  "context": {
+                    "principal": {
+                      "type": "auth:token",
+                      "id": "legacy-token",
+                      "label": "Admin"
+                    }
+                  },
+                  "caller_label": "Standalone Server",
+                  "principal_type": "auth:token",
+                  "principal_id": "legacy-token",
+                  "principal_label": "Admin",
+                  "auth_status": "authorized",
+                  "auth_method": "token",
+                  "request_method": "POST",
+                  "request_path": "/api/workflows/{terminated.instance}/terminate",
+                  "request_route_name": "generated::9mKRxCklA43Q96fA",
+                  "request_fingerprint": "sha256:b92bdf0fc7f27707344cbb3945e695f213155d88f8a136c4f2564a24349f2b72",
+                  "status": "accepted",
+                  "outcome": "terminated",
+                  "accepted_at": "2026-10-24T14:42:51.784635Z"
+                }
+              }
+            }
+          ],
+          "next_page_token": null,
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "history",
+            "workflow_id": "{terminated.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id",
+                "run_id"
+              ],
+              "success_fields": [
+                "next_page_token"
+              ],
+              "rejection_fields": [
+                "workflow_id",
+                "run_id",
+                "reason",
+                "message",
+                "retryable",
+                "error_id",
+                "exception"
+              ],
+              "rejection_reasons": [
+                "control_plane_internal_error"
+              ]
+            },
+            "run_id": "{terminated.run}",
+            "compatibility": null,
+            "next_page_token": null
+          }
+        }
+      },
+      "read_list": {
+        "status": 200,
+        "response": {
+          "workflows": [
+            {
+              "workflow_id": "{bare.instance}",
+              "run_id": "{bare.run}",
+              "workflow_type": "parity.rich",
+              "business_key": "bk-rich",
+              "status": "completed",
+              "status_bucket": "completed",
+              "task_queue": "q-rich",
+              "is_terminal": true,
+              "compatibility": null,
+              "compatibility_status": "compatible",
+              "compatibility_supported_in_fleet": true,
+              "compatibility_fleet_reason": null,
+              "started_at": "2026-10-24T14:46:59.941656Z",
+              "closed_at": "2026-10-24T14:47:03.777577Z",
+              "search_attributes": {
+                "CustomerId": "cust-λ",
+                "Tier": 2
+              }
+            },
+            {
+              "workflow_id": "{normalized.instance}",
+              "run_id": "{normalized.run}",
+              "workflow_type": "parity.rich",
+              "business_key": "bk-normalized",
+              "status": "completed",
+              "status_bucket": "completed",
+              "task_queue": "q-rich",
+              "is_terminal": true,
+              "compatibility": null,
+              "compatibility_status": "compatible",
+              "compatibility_supported_in_fleet": true,
+              "compatibility_fleet_reason": null,
+              "started_at": "2026-10-24T14:46:59.941656Z",
+              "closed_at": "2026-10-24T14:47:03.777577Z",
+              "search_attributes": {
+                "CustomerId": "cust-λ",
+                "Tier": 2
+              }
+            },
+            {
+              "workflow_id": "{signed.instance}",
+              "run_id": "{signed.run}",
+              "workflow_type": "parity.rich",
+              "business_key": "bk-rich",
+              "status": "completed",
+              "status_bucket": "completed",
+              "task_queue": "q-rich",
+              "is_terminal": true,
+              "compatibility": null,
+              "compatibility_status": "compatible",
+              "compatibility_supported_in_fleet": true,
+              "compatibility_fleet_reason": null,
+              "started_at": "2026-10-24T14:46:59.941656Z",
+              "closed_at": "2026-10-24T14:47:03.777577Z",
+              "search_attributes": {
+                "CustomerId": "cust-λ",
+                "Tier": 2
+              }
+            },
+            {
+              "workflow_id": "{rich.instance}",
+              "run_id": "{rich.run}",
+              "workflow_type": "parity.rich",
+              "business_key": "bk-rich",
+              "status": "completed",
+              "status_bucket": "completed",
+              "task_queue": "q-rich",
+              "is_terminal": true,
+              "compatibility": null,
+              "compatibility_status": "compatible",
+              "compatibility_supported_in_fleet": true,
+              "compatibility_fleet_reason": null,
+              "started_at": "2026-10-24T14:46:59.941656Z",
+              "closed_at": "2026-10-24T14:47:03.777577Z",
+              "search_attributes": {
+                "CustomerId": "cust-λ",
+                "Tier": 2
+              }
+            }
+          ],
+          "workflow_count": 4,
+          "next_page_token": null,
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "list",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "workflow_count": 4,
+            "next_page_token": null
+          }
+        }
+      },
+      "attach_source": {
+        "status": 201,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{attach-source.instance}",
+            "run_id": "{attach-source.run}",
+            "run_number": 1,
+            "workflow_type": "parity.import",
+            "namespace": "{id}-alt",
+            "status": "terminated",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{attach-source.run}:4:2026-10-24T14:42:51.798314Z"
+          },
+          "eligibility": {
+            "eligible": true,
+            "errors": [],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:42:52.181897Z",
+              "dedupe_key": "{attach-source.run}:4:2026-10-24T14:42:51.798314Z",
+              "workflow_run_id": "{attach-source.run}",
+              "workflow_instance_id": "{attach-source.instance}",
+              "history_event_count": 4
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{attach-source.checksum}",
+              "recomputed_checksum": "{attach-source.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "imported",
+          "import_id": "{generated_ulid}",
+          "imported_at": "{imported_at}",
+          "rows": {
+            "workflow_instances": 1,
+            "workflow_runs": 1,
+            "workflow_history_events": 4,
+            "workflow_commands": 2,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 1,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 1,
+            "workflow_links": 0,
+            "workflow_memos": 1,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 1
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "imported"
+          }
+        }
+      },
+      "attach": {
+        "status": 422,
+        "response": {
+          "schema": "durable-workflow.v2.embedded-v2-import.report",
+          "schema_version": 1,
+          "contract_version": 2,
+          "source": "embedded_v2",
+          "dry_run": false,
+          "workflow": {
+            "instance_id": "{attach-source.instance}",
+            "run_id": "{attach.run}",
+            "run_number": 2,
+            "workflow_type": "parity.import",
+            "namespace": "{id}-imp",
+            "status": "terminated",
+            "is_current_run": true,
+            "history_complete": true,
+            "dedupe_key": "{attach.run}:4:2026-10-24T14:42:51.798314Z"
+          },
+          "eligibility": {
+            "eligible": false,
+            "errors": [
+              {
+                "rule": "target.write_failed",
+                "message": "{database_message}"
+              }
+            ],
+            "warnings": []
+          },
+          "integrity": {
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": "ok",
+            "bundle": {
+              "schema": "durable-workflow.v2.history-export",
+              "schema_version": 2,
+              "exported_at": "2026-10-24T14:42:52.181897Z",
+              "dedupe_key": "{attach.run}:4:2026-10-24T14:42:51.798314Z",
+              "workflow_run_id": "{attach.run}",
+              "workflow_instance_id": "{attach-source.instance}",
+              "history_event_count": 4
+            },
+            "integrity": {
+              "present": true,
+              "canonicalization": "json-recursive-ksort-v1",
+              "checksum_algorithm": "sha256",
+              "expected_checksum": "{attach.checksum}",
+              "recomputed_checksum": "{attach.checksum}",
+              "checksum_matches": true,
+              "signature_algorithm": null,
+              "signature_present": false,
+              "signature_verified": null,
+              "key_id": null
+            },
+            "summary": {
+              "errors": 0,
+              "warnings": 0,
+              "info": 0,
+              "findings_by_rule": []
+            },
+            "findings": []
+          },
+          "rollback": {
+            "mode": "database_transaction",
+            "partial_import_behavior": "no_rows_committed_on_failure"
+          },
+          "status": "rejected",
+          "rows": {
+            "workflow_instances": 0,
+            "workflow_runs": 0,
+            "workflow_history_events": 0,
+            "workflow_commands": 0,
+            "workflow_signal_records": 0,
+            "workflow_updates": 0,
+            "workflow_tasks": 0,
+            "activity_executions": 0,
+            "activity_attempts": 0,
+            "workflow_run_timers": 0,
+            "workflow_failures": 0,
+            "workflow_links": 0,
+            "workflow_memos": 0,
+            "workflow_search_attributes": 0,
+            "workflow_run_summaries": 0
+          },
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "import_embedded_v2",
+            "workflow_id": null,
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [],
+              "success_fields": []
+            },
+            "status": "rejected"
+          }
+        }
+      },
+      "attach_source_describe_before": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{attach-source.instance}",
+          "run_id": "{attach-source.run}",
+          "namespace": "{id}-alt",
+          "workflow_type": "parity.import",
+          "business_key": "bk-1",
+          "status": "terminated",
+          "status_bucket": "failed",
+          "is_terminal": true,
+          "closed_reason": "terminated",
+          "task_queue": "q-src",
+          "run_number": 1,
+          "run_count": 1,
+          "is_current_run": true,
+          "continued_from_run_id": null,
+          "resume_step_sequence": null,
+          "recovery_kind": null,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "payload_codec": "avro",
+          "definition_routing": {
+            "pinning_enabled": true,
+            "worker_pinned": false,
+            "recorded_fingerprint": null,
+            "workflow_type": "parity.import",
+            "task_queue": "q-src",
+            "required_build_id": null,
+            "status": "not_worker_pinned",
+            "blocked": false,
+            "runnable_task": false,
+            "eligible_worker_count": 0,
+            "matching_worker_count": 0,
+            "changed_worker_count": 0,
+            "missing_fingerprint_count": 0,
+            "entry_validation_unavailable_count": 0,
+            "workers": [],
+            "workers_truncated": false,
+            "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+          },
+          "execution_timeout_seconds": null,
+          "run_timeout_seconds": null,
+          "execution_deadline_at": null,
+          "run_deadline_at": null,
+          "input": [
+            {
+              "a": 1
+            }
+          ],
+          "output": null,
+          "input_envelope": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "output_envelope": null,
+          "payload_previews": {
+            "input_omitted": false,
+            "output_omitted": false,
+            "max_encoded_bytes": 2097152
+          },
+          "started_at": "2026-10-24T14:42:46.447474Z",
+          "closed_at": "2026-10-24T14:42:51.795895Z",
+          "last_progress_at": "2026-10-24T14:42:51+00:00",
+          "wait_kind": null,
+          "wait_reason": null,
+          "memo": {
+            "note": "λ hello"
+          },
+          "search_attributes": [],
+          "actions": {
+            "can_signal": false,
+            "can_query": false,
+            "can_update": false,
+            "can_cancel": false,
+            "can_terminate": false,
+            "can_repair": false,
+            "can_archive": true
+          },
+          "commands_scope": "selected_run",
+          "commands": [
+            {
+              "id": "{attach-source.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{attach-source.run}",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "started_new",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.import",
+              "workflow_class": "parity.import",
+              "accepted_at": "2026-10-24T14:42:46.460769Z",
+              "applied_at": "2026-10-24T14:42:46.460778Z"
+            },
+            {
+              "id": "{attach-source.u6}",
+              "sequence": 2,
+              "type": "terminate",
+              "target_scope": "instance",
+              "resolved_run_id": "{attach-source.run}",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "terminated",
+              "reason": "parity terminate",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.import",
+              "workflow_class": "parity.import",
+              "accepted_at": "2026-10-24T14:42:51.784635Z",
+              "applied_at": "2026-10-24T14:42:51.808296Z"
+            }
+          ],
+          "updates_scope": "selected_run",
+          "updates": [],
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "describe",
+            "workflow_id": "{attach-source.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": []
+            },
+            "run_id": "{attach-source.run}",
+            "workflow_type": "parity.import",
+            "namespace": "{id}-alt",
+            "business_key": "bk-1",
+            "status": "terminated",
+            "status_bucket": "failed",
+            "is_terminal": true,
+            "task_queue": "q-src",
+            "run_number": 1,
+            "run_count": 1,
+            "is_current_run": true,
+            "compatibility": null,
+            "started_at": "2026-10-24T14:42:46.447474Z",
+            "closed_at": "2026-10-24T14:42:51.795895Z",
+            "last_progress_at": "2026-10-24T14:42:51+00:00",
+            "wait_kind": null,
+            "wait_reason": null
+          }
+        }
+      },
+      "attach_source_describe_after": {
+        "status": 200,
+        "response": {
+          "workflow_id": "{attach-source.instance}",
+          "run_id": "{attach-source.run}",
+          "namespace": "{id}-alt",
+          "workflow_type": "parity.import",
+          "business_key": "bk-1",
+          "status": "terminated",
+          "status_bucket": "failed",
+          "is_terminal": true,
+          "closed_reason": "terminated",
+          "task_queue": "q-src",
+          "run_number": 1,
+          "run_count": 1,
+          "is_current_run": true,
+          "continued_from_run_id": null,
+          "resume_step_sequence": null,
+          "recovery_kind": null,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "payload_codec": "avro",
+          "definition_routing": {
+            "pinning_enabled": true,
+            "worker_pinned": false,
+            "recorded_fingerprint": null,
+            "workflow_type": "parity.import",
+            "task_queue": "q-src",
+            "required_build_id": null,
+            "status": "not_worker_pinned",
+            "blocked": false,
+            "runnable_task": false,
+            "eligible_worker_count": 0,
+            "matching_worker_count": 0,
+            "changed_worker_count": 0,
+            "missing_fingerprint_count": 0,
+            "entry_validation_unavailable_count": 0,
+            "workers": [],
+            "workers_truncated": false,
+            "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+          },
+          "execution_timeout_seconds": null,
+          "run_timeout_seconds": null,
+          "execution_deadline_at": null,
+          "run_deadline_at": null,
+          "input": [
+            {
+              "a": 1
+            }
+          ],
+          "output": null,
+          "input_envelope": {
+            "codec": "avro",
+            "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+          },
+          "output_envelope": null,
+          "payload_previews": {
+            "input_omitted": false,
+            "output_omitted": false,
+            "max_encoded_bytes": 2097152
+          },
+          "started_at": "2026-10-24T14:42:46.447474Z",
+          "closed_at": "2026-10-24T14:42:51.795895Z",
+          "last_progress_at": "2026-10-24T14:42:51+00:00",
+          "wait_kind": null,
+          "wait_reason": null,
+          "memo": {
+            "note": "λ hello"
+          },
+          "search_attributes": [],
+          "actions": {
+            "can_signal": false,
+            "can_query": false,
+            "can_update": false,
+            "can_cancel": false,
+            "can_terminate": false,
+            "can_repair": false,
+            "can_archive": true
+          },
+          "commands_scope": "selected_run",
+          "commands": [
+            {
+              "id": "{attach-source.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{attach-source.run}",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "started_new",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.import",
+              "workflow_class": "parity.import",
+              "accepted_at": "2026-10-24T14:42:46.460769Z",
+              "applied_at": "2026-10-24T14:42:46.460778Z"
+            },
+            {
+              "id": "{attach-source.u6}",
+              "sequence": 2,
+              "type": "terminate",
+              "target_scope": "instance",
+              "resolved_run_id": "{attach-source.run}",
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "principal": {
+                "type": "auth:token",
+                "id": "legacy-token",
+                "label": "Admin"
+              },
+              "status": "accepted",
+              "outcome": "terminated",
+              "reason": "parity terminate",
+              "payload_preview_omitted": false,
+              "workflow_type": "parity.import",
+              "workflow_class": "parity.import",
+              "accepted_at": "2026-10-24T14:42:51.784635Z",
+              "applied_at": "2026-10-24T14:42:51.808296Z"
+            }
+          ],
+          "updates_scope": "selected_run",
+          "updates": [],
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "describe",
+            "workflow_id": "{attach-source.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": []
+            },
+            "run_id": "{attach-source.run}",
+            "workflow_type": "parity.import",
+            "namespace": "{id}-alt",
+            "business_key": "bk-1",
+            "status": "terminated",
+            "status_bucket": "failed",
+            "is_terminal": true,
+            "task_queue": "q-src",
+            "run_number": 1,
+            "run_count": 1,
+            "is_current_run": true,
+            "compatibility": null,
+            "started_at": "2026-10-24T14:42:46.447474Z",
+            "closed_at": "2026-10-24T14:42:51.795895Z",
+            "last_progress_at": "2026-10-24T14:42:51+00:00",
+            "wait_kind": null,
+            "wait_reason": null
+          }
+        }
+      },
+      "attach_describe": {
+        "status": 404,
+        "response": {
+          "message": "Workflow not found.",
+          "reason": "instance_not_found",
+          "workflow_id": "{attach-source.instance}",
+          "control_plane": {
+            "schema": "durable-workflow.v2.control-plane-response",
+            "version": 1,
+            "operation": "describe",
+            "workflow_id": "{attach-source.instance}",
+            "contract": {
+              "schema": "durable-workflow.v2.control-plane-response.contract",
+              "version": 1,
+              "legacy_field_policy": "reject_non_canonical",
+              "legacy_fields": {
+                "query": "query_name",
+                "signal": "signal_name",
+                "update": "update_name",
+                "wait_policy": "wait_for"
+              },
+              "required_fields": [
+                "workflow_id"
+              ],
+              "success_fields": []
+            },
+            "reason": "instance_not_found",
+            "message": "Workflow not found."
+          }
+        }
+      }
+    }
+  },
+  "contract": "History import (POST /api/workflows/import/embedded-v2, EmbeddedV2ImportController) as published Server 2.11.1 serves it, in its own namespaces, from bundles built from the fixture's templates (real published exports, every ULID an order-preserving token, fixed-length ids per label, the canonical checksum and HMAC signature computed by the probe): the authentication, version, namespace, media type and JSON gates; body shapes refused as invalid_import_bundle or imported as the bundle itself; a dry run (200, estimated rows), an import (201, written rows, trimmed import_id), and repeats answered already_imported whatever their import_id; run_id conflicts with another bundle and with a native run; a tampered checksum; signatures required, unverifiable, wrong and verified; each eligibility rule (incomplete terminal history, unsupported status, missing identity, source runtime, payload codecs, memo projection, a leased task, a running attempt, and redaction, whose string paths pass as published); the request's trim and empty-to-null normalization before the checksum; bare bundles; an unparsable time that fails the write and leaves nothing; terminated, running and non-current imports; and the imported run through describe, runs, run, history and list. Bundle identities, checksums and signatures are labels; generated import ids, import times and database messages are placeholders; a ready task's wait reason is either ready form. Two published defects are bounded: the importer finds runs and instances in every namespace, so a bundle imported elsewhere answers already_imported, and an import attaches to and takes over an instance of another namespace. The published answers or the isolated ones (a run_id conflict, a refused write that leaves the other namespace unchanged) are accepted. Embedded applications have no HTTP import."
+}
diff --git a/tests/Fixtures/ServerParityExpected/workflow-import-observation.json b/tests/Fixtures/ServerParityExpected/workflow-import-observation.json
new file mode 100644
index 000000000..f4a684b67
--- /dev/null
+++ b/tests/Fixtures/ServerParityExpected/workflow-import-observation.json
@@ -0,0 +1,6674 @@
+{
+  "applicable": true,
+  "namespace": "pr1-workflow-import-imp",
+  "alternate_namespace": "pr1-workflow-import-alt",
+  "gate_unauthenticated": {
+    "status": 401,
+    "response": {
+      "reason": "unauthorized",
+      "message": "Invalid or missing authentication token.",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "unauthorized",
+        "message": "Invalid or missing authentication token."
+      }
+    }
+  },
+  "gate_missing_version": {
+    "status": 400,
+    "response": {
+      "message": "Missing control-plane version header.",
+      "reason": "missing_control_plane_version",
+      "supported_version": "2",
+      "requested_version": null,
+      "remediation": "Send the X-Durable-Workflow-Control-Plane-Version: 2 header on control-plane requests.",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "missing_control_plane_version",
+        "message": "Missing control-plane version header.",
+        "remediation": "Send the X-Durable-Workflow-Control-Plane-Version: 2 header on control-plane requests."
+      }
+    }
+  },
+  "gate_unsupported_version": {
+    "status": 400,
+    "response": {
+      "message": "Unsupported control-plane version.",
+      "reason": "unsupported_control_plane_version",
+      "supported_version": "2",
+      "requested_version": "3",
+      "remediation": "Client requested control-plane version 3; this server only supports 2. Upgrade the client to a release that targets control-plane 2, or connect to a server that supports 3.",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "unsupported_control_plane_version",
+        "message": "Unsupported control-plane version.",
+        "remediation": "Client requested control-plane version 3; this server only supports 2. Upgrade the client to a release that targets control-plane 2, or connect to a server that supports 3."
+      }
+    }
+  },
+  "gate_unknown_namespace": {
+    "status": 404,
+    "response": {
+      "message": "Namespace 'pr1-workflow-import-missing' does not exist.",
+      "reason": "namespace_not_found",
+      "namespace": "pr1-workflow-import-missing",
+      "remediation": "Register the namespace via POST /api/namespaces, or send an X-Namespace header naming an existing namespace.",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "namespace": "pr1-workflow-import-missing",
+        "reason": "namespace_not_found",
+        "message": "Namespace 'pr1-workflow-import-missing' does not exist.",
+        "remediation": "Register the namespace via POST /api/namespaces, or send an X-Namespace header naming an existing namespace."
+      }
+    }
+  },
+  "gate_text_plain": {
+    "status": 415,
+    "response": {
+      "message": "Request bodies must use a JSON media type.",
+      "reason": "unsupported_media_type",
+      "accepted_content_types": [
+        "application/json",
+        "application/*+json"
+      ],
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "unsupported_media_type",
+        "message": "Request bodies must use a JSON media type."
+      }
+    }
+  },
+  "gate_malformed_json": {
+    "status": 400,
+    "response": {
+      "message": "Request bodies must contain valid JSON.",
+      "reason": "malformed_json",
+      "json_error": "Syntax error",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "malformed_json",
+        "message": "Request bodies must contain valid JSON."
+      }
+    }
+  },
+  "shape_empty_object": {
+    "status": 422,
+    "response": {
+      "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+      "reason": "invalid_import_bundle",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "invalid_import_bundle",
+        "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+      }
+    }
+  },
+  "shape_empty_list": {
+    "status": 422,
+    "response": {
+      "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+      "reason": "invalid_import_bundle",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "invalid_import_bundle",
+        "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+      }
+    }
+  },
+  "shape_empty_bundle": {
+    "status": 422,
+    "response": {
+      "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+      "reason": "invalid_import_bundle",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "invalid_import_bundle",
+        "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+      }
+    }
+  },
+  "shape_bundle_list": {
+    "status": 422,
+    "response": {
+      "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+      "reason": "invalid_import_bundle",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "invalid_import_bundle",
+        "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+      }
+    }
+  },
+  "shape_null": {
+    "status": 422,
+    "response": {
+      "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+      "reason": "invalid_import_bundle",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "reason": "invalid_import_bundle",
+        "message": "Import request body must be a history-export bundle or {\"bundle\": ...}."
+      }
+    }
+  },
+  "shape_options_only": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": null,
+        "run_id": null,
+        "run_number": 1,
+        "workflow_type": "imported-workflow",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "running",
+        "is_current_run": false,
+        "history_complete": false,
+        "dedupe_key": null
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          },
+          {
+            "rule": "workflow.instance_id_missing",
+            "message": "Bundle workflow.instance_id is required."
+          },
+          {
+            "rule": "workflow.run_id_missing",
+            "message": "Bundle workflow.run_id is required."
+          },
+          {
+            "rule": "workflow.non_terminal_not_current",
+            "message": "Non-terminal embedded v2 imports must be the current run."
+          },
+          {
+            "rule": "workflow.source_runtime_unsupported",
+            "message": "Bundle workflow.source_runtime must be embedded."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": null,
+          "schema_version": null,
+          "exported_at": null,
+          "dedupe_key": null,
+          "workflow_run_id": null,
+          "workflow_instance_id": null,
+          "history_event_count": 0
+        },
+        "integrity": {
+          "present": false,
+          "canonicalization": null,
+          "checksum_algorithm": null,
+          "expected_checksum": null,
+          "recomputed_checksum": null,
+          "checksum_matches": null,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 21,
+          "warnings": 1,
+          "info": 0,
+          "findings_by_rule": {
+            "bundle.exported_at_missing": 1,
+            "bundle.schema_missing": 1,
+            "bundle.schema_version_missing": 1,
+            "bundle.section_missing": 14,
+            "integrity.missing": 1,
+            "workflow.instance_id_missing": 1,
+            "workflow.memo_payload_missing": 1,
+            "workflow.run_id_missing": 1,
+            "workflow.workflow_type_missing": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "bundle.schema_missing",
+            "severity": "error",
+            "message": "Bundle is missing the schema field.",
+            "path": "schema",
+            "context": []
+          },
+          {
+            "rule": "bundle.schema_version_missing",
+            "severity": "error",
+            "message": "Bundle is missing schema_version.",
+            "path": "schema_version",
+            "context": []
+          },
+          {
+            "rule": "bundle.exported_at_missing",
+            "severity": "warning",
+            "message": "Bundle is missing exported_at; replay reports cannot be ordered without it.",
+            "path": "exported_at",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [workflow].",
+            "path": "workflow",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [payloads].",
+            "path": "payloads",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [history_events].",
+            "path": "history_events",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [commands].",
+            "path": "commands",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [signals].",
+            "path": "signals",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [updates].",
+            "path": "updates",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [tasks].",
+            "path": "tasks",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [activities].",
+            "path": "activities",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [timers].",
+            "path": "timers",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [failures].",
+            "path": "failures",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [links].",
+            "path": "links",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [redaction].",
+            "path": "redaction",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [codec_schemas].",
+            "path": "codec_schemas",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [payload_manifest].",
+            "path": "payload_manifest",
+            "context": []
+          },
+          {
+            "rule": "workflow.run_id_missing",
+            "severity": "error",
+            "message": "Bundle workflow.run_id is required.",
+            "path": "workflow.run_id",
+            "context": []
+          },
+          {
+            "rule": "workflow.instance_id_missing",
+            "severity": "error",
+            "message": "Bundle workflow.instance_id is required.",
+            "path": "workflow.instance_id",
+            "context": []
+          },
+          {
+            "rule": "workflow.workflow_type_missing",
+            "severity": "error",
+            "message": "Bundle workflow.workflow_type is required.",
+            "path": "workflow.workflow_type",
+            "context": []
+          },
+          {
+            "rule": "workflow.memo_payload_missing",
+            "severity": "error",
+            "message": "Bundle workflow.memo_payload must contain the lossless portable Avro memo authority.",
+            "path": "workflow.memo_payload",
+            "context": []
+          },
+          {
+            "rule": "integrity.missing",
+            "severity": "error",
+            "message": "Bundle has no integrity block; offline replay verification cannot vouch for its contents.",
+            "path": "integrity",
+            "context": []
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "shape_bundle_string": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": null,
+        "run_id": null,
+        "run_number": 1,
+        "workflow_type": "imported-workflow",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "running",
+        "is_current_run": false,
+        "history_complete": false,
+        "dedupe_key": null
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          },
+          {
+            "rule": "workflow.instance_id_missing",
+            "message": "Bundle workflow.instance_id is required."
+          },
+          {
+            "rule": "workflow.run_id_missing",
+            "message": "Bundle workflow.run_id is required."
+          },
+          {
+            "rule": "workflow.non_terminal_not_current",
+            "message": "Non-terminal embedded v2 imports must be the current run."
+          },
+          {
+            "rule": "workflow.source_runtime_unsupported",
+            "message": "Bundle workflow.source_runtime must be embedded."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": null,
+          "schema_version": null,
+          "exported_at": null,
+          "dedupe_key": null,
+          "workflow_run_id": null,
+          "workflow_instance_id": null,
+          "history_event_count": 0
+        },
+        "integrity": {
+          "present": false,
+          "canonicalization": null,
+          "checksum_algorithm": null,
+          "expected_checksum": null,
+          "recomputed_checksum": null,
+          "checksum_matches": null,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 21,
+          "warnings": 1,
+          "info": 0,
+          "findings_by_rule": {
+            "bundle.exported_at_missing": 1,
+            "bundle.schema_missing": 1,
+            "bundle.schema_version_missing": 1,
+            "bundle.section_missing": 14,
+            "integrity.missing": 1,
+            "workflow.instance_id_missing": 1,
+            "workflow.memo_payload_missing": 1,
+            "workflow.run_id_missing": 1,
+            "workflow.workflow_type_missing": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "bundle.schema_missing",
+            "severity": "error",
+            "message": "Bundle is missing the schema field.",
+            "path": "schema",
+            "context": []
+          },
+          {
+            "rule": "bundle.schema_version_missing",
+            "severity": "error",
+            "message": "Bundle is missing schema_version.",
+            "path": "schema_version",
+            "context": []
+          },
+          {
+            "rule": "bundle.exported_at_missing",
+            "severity": "warning",
+            "message": "Bundle is missing exported_at; replay reports cannot be ordered without it.",
+            "path": "exported_at",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [workflow].",
+            "path": "workflow",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [payloads].",
+            "path": "payloads",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [history_events].",
+            "path": "history_events",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [commands].",
+            "path": "commands",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [signals].",
+            "path": "signals",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [updates].",
+            "path": "updates",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [tasks].",
+            "path": "tasks",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [activities].",
+            "path": "activities",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [timers].",
+            "path": "timers",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [failures].",
+            "path": "failures",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [links].",
+            "path": "links",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [redaction].",
+            "path": "redaction",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [codec_schemas].",
+            "path": "codec_schemas",
+            "context": []
+          },
+          {
+            "rule": "bundle.section_missing",
+            "severity": "error",
+            "message": "Bundle is missing required section [payload_manifest].",
+            "path": "payload_manifest",
+            "context": []
+          },
+          {
+            "rule": "workflow.run_id_missing",
+            "severity": "error",
+            "message": "Bundle workflow.run_id is required.",
+            "path": "workflow.run_id",
+            "context": []
+          },
+          {
+            "rule": "workflow.instance_id_missing",
+            "severity": "error",
+            "message": "Bundle workflow.instance_id is required.",
+            "path": "workflow.instance_id",
+            "context": []
+          },
+          {
+            "rule": "workflow.workflow_type_missing",
+            "severity": "error",
+            "message": "Bundle workflow.workflow_type is required.",
+            "path": "workflow.workflow_type",
+            "context": []
+          },
+          {
+            "rule": "workflow.memo_payload_missing",
+            "severity": "error",
+            "message": "Bundle workflow.memo_payload must contain the lossless portable Avro memo authority.",
+            "path": "workflow.memo_payload",
+            "context": []
+          },
+          {
+            "rule": "integrity.missing",
+            "severity": "error",
+            "message": "Bundle has no integrity block; offline replay verification cannot vouch for its contents.",
+            "path": "integrity",
+            "context": []
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "dry_run": {
+    "status": 200,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": "{rich.instance}",
+        "run_id": "{rich.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{rich.run}",
+          "workflow_instance_id": "{rich.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{rich.checksum}",
+          "recomputed_checksum": "{rich.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "dry_run",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 12,
+        "workflow_commands": 2,
+        "workflow_signal_records": 1,
+        "workflow_updates": 0,
+        "workflow_tasks": 6,
+        "activity_executions": 1,
+        "activity_attempts": 1,
+        "workflow_run_timers": 1,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "dry_run"
+      }
+    },
+    "headers": {
+      "X-Durable-Workflow-Control-Plane-Version": "2"
+    }
+  },
+  "import": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{rich.instance}",
+        "run_id": "{rich.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{rich.run}",
+          "workflow_instance_id": "{rich.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{rich.checksum}",
+          "recomputed_checksum": "{rich.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "imp-1",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 12,
+        "workflow_commands": 2,
+        "workflow_signal_records": 1,
+        "workflow_updates": 0,
+        "workflow_tasks": 6,
+        "activity_executions": 1,
+        "activity_attempts": 1,
+        "workflow_run_timers": 1,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 2,
+        "workflow_search_attributes": 2,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    },
+    "headers": {
+      "X-Durable-Workflow-Control-Plane-Version": "2"
+    }
+  },
+  "duplicate": {
+    "status": 200,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{rich.instance}",
+        "run_id": "{rich.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{rich.run}",
+          "workflow_instance_id": "{rich.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{rich.checksum}",
+          "recomputed_checksum": "{rich.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "already_imported",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "already_imported"
+      }
+    }
+  },
+  "duplicate_dry_run": {
+    "status": 200,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": "{rich.instance}",
+        "run_id": "{rich.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{rich.run}",
+          "workflow_instance_id": "{rich.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{rich.checksum}",
+          "recomputed_checksum": "{rich.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "already_imported",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "already_imported"
+      }
+    }
+  },
+  "duplicate_other_namespace": {
+    "status": 200,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{rich.instance}",
+        "run_id": "{rich.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-alt",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{rich.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{rich.run}",
+          "workflow_instance_id": "{rich.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{rich.checksum}",
+          "recomputed_checksum": "{rich.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "already_imported",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "already_imported"
+      }
+    }
+  },
+  "other_namespace_list": {
+    "status": 200,
+    "response": {
+      "workflows": [],
+      "workflow_count": 0,
+      "next_page_token": null,
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "list",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "workflow_count": 0,
+        "next_page_token": null
+      }
+    }
+  },
+  "conflict_changed_bundle": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{rich.instance}",
+        "run_id": "{rich.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "changed"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "target.run_id_conflict",
+            "message": "A workflow run with this run_id already exists and was not imported from the same bundle."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "changed",
+          "workflow_run_id": "{rich.run}",
+          "workflow_instance_id": "{rich.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{rich.checksum}",
+          "recomputed_checksum": "{rich.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "conflict_native_run": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": "{native-run.instance}",
+        "run_id": "{main.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{native-run.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "target.run_id_conflict",
+            "message": "A workflow run with this run_id already exists and was not imported from the same bundle."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{native-run.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{main.run}",
+          "workflow_instance_id": "{native-run.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{native-run.checksum}",
+          "recomputed_checksum": "{native-run.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "tampered": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{tampered.instance}",
+        "run_id": "{tampered.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{tampered.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{tampered.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{tampered.run}",
+          "workflow_instance_id": "{tampered.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{tampered.checksum}",
+          "recomputed_checksum": "{tampered.recomputed}",
+          "checksum_matches": false,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 1,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": {
+            "integrity.checksum_mismatch": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "integrity.checksum_mismatch",
+            "severity": "error",
+            "message": "Recomputed bundle checksum does not match the recorded checksum; the bundle has been altered after export.",
+            "path": "integrity.checksum",
+            "context": {
+              "expected": "{tampered.checksum}",
+              "actual": "{tampered.recomputed}"
+            }
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "signature_required_unsigned": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{unsigned.instance}",
+        "run_id": "{unsigned.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{unsigned.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.signature_required",
+            "message": "A verified history-export signature is required for this import."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{unsigned.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{unsigned.run}",
+          "workflow_instance_id": "{unsigned.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{unsigned.checksum}",
+          "recomputed_checksum": "{unsigned.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "signature_required_no_key": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{signed-no-key.instance}",
+        "run_id": "{signed-no-key.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{signed-no-key.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.signature_required",
+            "message": "A verified history-export signature is required for this import."
+          }
+        ],
+        "warnings": [
+          {
+            "rule": "bundle.integrity_warning",
+            "message": "Bundle integrity verification reported warnings."
+          }
+        ]
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "warning",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{signed-no-key.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{signed-no-key.run}",
+          "workflow_instance_id": "{signed-no-key.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{signed-no-key.checksum}",
+          "recomputed_checksum": "{signed-no-key.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": "hmac-sha256",
+          "signature_present": true,
+          "signature_verified": null,
+          "key_id": "parity-key-1"
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 1,
+          "info": 0,
+          "findings_by_rule": {
+            "integrity.signature_key_unavailable": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "integrity.signature_key_unavailable",
+            "severity": "warning",
+            "message": "Bundle is signed but no verification key is configured; signature was not verified.",
+            "path": "integrity.signature",
+            "context": []
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "signature_wrong_key": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{signed-wrong-key.instance}",
+        "run_id": "{signed-wrong-key.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{signed-wrong-key.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          },
+          {
+            "rule": "bundle.signature_required",
+            "message": "A verified history-export signature is required for this import."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{signed-wrong-key.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{signed-wrong-key.run}",
+          "workflow_instance_id": "{signed-wrong-key.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{signed-wrong-key.checksum}",
+          "recomputed_checksum": "{signed-wrong-key.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": "hmac-sha256",
+          "signature_present": true,
+          "signature_verified": false,
+          "key_id": "parity-key-1"
+        },
+        "summary": {
+          "errors": 1,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": {
+            "integrity.signature_mismatch": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "integrity.signature_mismatch",
+            "severity": "error",
+            "message": "Bundle signature does not match the configured key; treat the bundle as untrusted.",
+            "path": "integrity.signature",
+            "context": {
+              "key_id": "parity-key-1"
+            }
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "signature_verified": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{signed.instance}",
+        "run_id": "{signed.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{signed.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{signed.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{signed.run}",
+          "workflow_instance_id": "{signed.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{signed.checksum}",
+          "recomputed_checksum": "{signed.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": "hmac-sha256",
+          "signature_present": true,
+          "signature_verified": true,
+          "key_id": "parity-key-1"
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "{generated_ulid}",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 12,
+        "workflow_commands": 2,
+        "workflow_signal_records": 1,
+        "workflow_updates": 0,
+        "workflow_tasks": 6,
+        "activity_executions": 1,
+        "activity_attempts": 1,
+        "workflow_run_timers": 1,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 2,
+        "workflow_search_attributes": 2,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    }
+  },
+  "signature_required_yes_no_key": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{signed-yes.instance}",
+        "run_id": "{signed-yes.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{signed-yes.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.signature_required",
+            "message": "A verified history-export signature is required for this import."
+          }
+        ],
+        "warnings": [
+          {
+            "rule": "bundle.integrity_warning",
+            "message": "Bundle integrity verification reported warnings."
+          }
+        ]
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "warning",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{signed-yes.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{signed-yes.run}",
+          "workflow_instance_id": "{signed-yes.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{signed-yes.checksum}",
+          "recomputed_checksum": "{signed-yes.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": "hmac-sha256",
+          "signature_present": true,
+          "signature_verified": null,
+          "key_id": "parity-key-1"
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 1,
+          "info": 0,
+          "findings_by_rule": {
+            "integrity.signature_key_unavailable": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "integrity.signature_key_unavailable",
+            "severity": "warning",
+            "message": "Bundle is signed but no verification key is configured; signature was not verified.",
+            "path": "integrity.signature",
+            "context": []
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "terminal_history_incomplete": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{incomplete.instance}",
+        "run_id": "{incomplete.run}",
+        "run_number": 1,
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "terminated",
+        "is_current_run": true,
+        "history_complete": false,
+        "dedupe_key": "{incomplete.run}:4:2026-10-24T14:42:51.798314Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "workflow.terminal_history_incomplete",
+            "message": "Terminal run imports require history_complete=true."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:42:52.181897Z",
+          "dedupe_key": "{incomplete.run}:4:2026-10-24T14:42:51.798314Z",
+          "workflow_run_id": "{incomplete.run}",
+          "workflow_instance_id": "{incomplete.instance}",
+          "history_event_count": 4
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{incomplete.checksum}",
+          "recomputed_checksum": "{incomplete.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "status_unsupported": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{bogus-status.instance}",
+        "run_id": "{bogus-status.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "bogus",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{bogus-status.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "workflow.status_unsupported",
+            "message": "Bundle workflow.status is not a supported v2 run status."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{bogus-status.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{bogus-status.run}",
+          "workflow_instance_id": "{bogus-status.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{bogus-status.checksum}",
+          "recomputed_checksum": "{bogus-status.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "identity_missing": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": null,
+        "run_id": null,
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{no-identity.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          },
+          {
+            "rule": "workflow.instance_id_missing",
+            "message": "Bundle workflow.instance_id is required."
+          },
+          {
+            "rule": "workflow.run_id_missing",
+            "message": "Bundle workflow.run_id is required."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{no-identity.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": null,
+          "workflow_instance_id": null,
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{no-identity.checksum}",
+          "recomputed_checksum": "{no-identity.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 2,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": {
+            "workflow.instance_id_missing": 1,
+            "workflow.run_id_missing": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "workflow.run_id_missing",
+            "severity": "error",
+            "message": "Bundle workflow.run_id is required.",
+            "path": "workflow.run_id",
+            "context": []
+          },
+          {
+            "rule": "workflow.instance_id_missing",
+            "severity": "error",
+            "message": "Bundle workflow.instance_id is required.",
+            "path": "workflow.instance_id",
+            "context": []
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "source_runtime_unsupported": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{standalone.instance}",
+        "run_id": "{standalone.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{standalone.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "workflow.source_runtime_unsupported",
+            "message": "Bundle workflow.source_runtime must be embedded."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{standalone.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{standalone.run}",
+          "workflow_instance_id": "{standalone.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{standalone.checksum}",
+          "recomputed_checksum": "{standalone.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "payload_codec_unsupported": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{json-codec.instance}",
+        "run_id": "{json-codec.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{json-codec.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "payload_codec.unsupported",
+            "message": "Bundle payload codec at [payloads.codec] must be \"avro\"; found \"json\". JSON is only the HTTP document transport and cannot be imported as durable payload data."
+          },
+          {
+            "rule": "payload_codec.unsupported",
+            "message": "Bundle payload codec at [commands.0.payload_codec] must be \"avro\"; found \"json\". JSON is only the HTTP document transport and cannot be imported as durable payload data."
+          },
+          {
+            "rule": "payload_codec.unsupported",
+            "message": "Bundle payload codec at [signals.0.payload_codec] must be \"avro\"; found int. JSON is only the HTTP document transport and cannot be imported as durable payload data."
+          },
+          {
+            "rule": "payload_codec.unsupported",
+            "message": "Bundle payload codec at [payload_manifest.entries.1.codec] must be \"avro\"; found \"json\". JSON is only the HTTP document transport and cannot be imported as durable payload data."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{json-codec.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{json-codec.run}",
+          "workflow_instance_id": "{json-codec.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{json-codec.checksum}",
+          "recomputed_checksum": "{json-codec.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "memo_projection_mismatch": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{memo-mismatch.instance}",
+        "run_id": "{memo-mismatch.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{memo-mismatch.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{memo-mismatch.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{memo-mismatch.run}",
+          "workflow_instance_id": "{memo-mismatch.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{memo-mismatch.checksum}",
+          "recomputed_checksum": "{memo-mismatch.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 1,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": {
+            "workflow.memo_projection_mismatch": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "workflow.memo_projection_mismatch",
+            "severity": "error",
+            "message": "Bundle workflow.memo does not match the JSON-safe projection of workflow.memo_payload.",
+            "path": "workflow.memo",
+            "context": []
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "leased_task": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{leased.instance}",
+        "run_id": "{leased.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{leased.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "tasks.leased_task_present",
+            "message": "Leased workflow or activity tasks must be completed, failed, or released before import."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{leased.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{leased.run}",
+          "workflow_instance_id": "{leased.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{leased.checksum}",
+          "recomputed_checksum": "{leased.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "running_attempt": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{running-attempt.instance}",
+        "run_id": "{running-attempt.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{running-attempt.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "activities.running_attempt_present",
+            "message": "Running activity attempts must be released before import."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{running-attempt.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{running-attempt.run}",
+          "workflow_instance_id": "{running-attempt.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{running-attempt.checksum}",
+          "recomputed_checksum": "{running-attempt.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "redaction_string_paths": {
+    "status": 200,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": "{redacted-strings.instance}",
+        "run_id": "{redacted-strings.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{redacted-strings.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{redacted-strings.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{redacted-strings.run}",
+          "workflow_instance_id": "{redacted-strings.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{redacted-strings.checksum}",
+          "recomputed_checksum": "{redacted-strings.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "dry_run",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 12,
+        "workflow_commands": 2,
+        "workflow_signal_records": 1,
+        "workflow_updates": 0,
+        "workflow_tasks": 6,
+        "activity_executions": 1,
+        "activity_attempts": 1,
+        "workflow_run_timers": 1,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "dry_run"
+      }
+    }
+  },
+  "redaction_object_paths": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": "{redacted-objects.instance}",
+        "run_id": "{redacted-objects.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{redacted-objects.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.redacted_payloads",
+            "message": "Redacted history bundles cannot be imported as server-managed state."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{redacted-objects.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{redacted-objects.run}",
+          "workflow_instance_id": "{redacted-objects.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{redacted-objects.checksum}",
+          "recomputed_checksum": "{redacted-objects.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "redaction_applied_without_paths": {
+    "status": 200,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": "{redacted-empty.instance}",
+        "run_id": "{redacted-empty.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{redacted-empty.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{redacted-empty.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{redacted-empty.run}",
+          "workflow_instance_id": "{redacted-empty.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{redacted-empty.checksum}",
+          "recomputed_checksum": "{redacted-empty.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 1,
+          "findings_by_rule": {
+            "redaction.empty_paths": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "redaction.empty_paths",
+            "severity": "info",
+            "message": "Redaction is marked applied but no paths were redacted; replay-diff diagnostics will treat all payloads as in-scope.",
+            "path": "redaction.paths",
+            "context": []
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "dry_run",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 12,
+        "workflow_commands": 2,
+        "workflow_signal_records": 1,
+        "workflow_updates": 0,
+        "workflow_tasks": 6,
+        "activity_executions": 1,
+        "activity_attempts": 1,
+        "workflow_run_timers": 1,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "dry_run"
+      }
+    }
+  },
+  "normalized_checksum": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{normalized.instance}",
+        "run_id": "{normalized.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{normalized.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{normalized.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{normalized.run}",
+          "workflow_instance_id": "{normalized.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{normalized.checksum}",
+          "recomputed_checksum": "{normalized.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "{generated_ulid}",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 12,
+        "workflow_commands": 2,
+        "workflow_signal_records": 1,
+        "workflow_updates": 0,
+        "workflow_tasks": 6,
+        "activity_executions": 1,
+        "activity_attempts": 1,
+        "workflow_run_timers": 1,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 2,
+        "workflow_search_attributes": 2,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    }
+  },
+  "unnormalized_checksum": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{unnormalized.instance}",
+        "run_id": "{unnormalized.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{unnormalized.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{unnormalized.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{unnormalized.run}",
+          "workflow_instance_id": "{unnormalized.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{unnormalized.checksum}",
+          "recomputed_checksum": "{unnormalized.recomputed}",
+          "checksum_matches": false,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 1,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": {
+            "integrity.checksum_mismatch": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "integrity.checksum_mismatch",
+            "severity": "error",
+            "message": "Recomputed bundle checksum does not match the recorded checksum; the bundle has been altered after export.",
+            "path": "integrity.checksum",
+            "context": {
+              "expected": "{unnormalized.checksum}",
+              "actual": "{unnormalized.recomputed}"
+            }
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "bare_bundle": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{bare.instance}",
+        "run_id": "{bare.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{bare.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{bare.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{bare.run}",
+          "workflow_instance_id": "{bare.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{bare.checksum}",
+          "recomputed_checksum": "{bare.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "{generated_ulid}",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 12,
+        "workflow_commands": 2,
+        "workflow_signal_records": 1,
+        "workflow_updates": 0,
+        "workflow_tasks": 6,
+        "activity_executions": 1,
+        "activity_attempts": 1,
+        "workflow_run_timers": 1,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 2,
+        "workflow_search_attributes": 2,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    }
+  },
+  "bare_bundle_with_option": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": true,
+      "workflow": {
+        "instance_id": "{bare-option.instance}",
+        "run_id": "{bare-option.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{bare-option.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "bundle.integrity_failed",
+            "message": "Bundle integrity verification failed."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "failed",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{bare-option.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{bare-option.run}",
+          "workflow_instance_id": "{bare-option.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{bare-option.checksum}",
+          "recomputed_checksum": "{bare-option.recomputed}",
+          "checksum_matches": false,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 1,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": {
+            "integrity.checksum_mismatch": 1
+          }
+        },
+        "findings": [
+          {
+            "rule": "integrity.checksum_mismatch",
+            "severity": "error",
+            "message": "Recomputed bundle checksum does not match the recorded checksum; the bundle has been altered after export.",
+            "path": "integrity.checksum",
+            "context": {
+              "expected": "{bare-option.checksum}",
+              "actual": "{bare-option.recomputed}"
+            }
+          }
+        ]
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "write_failed": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{bad-time.instance}",
+        "run_id": "{bad-time.run}",
+        "run_number": 1,
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "completed",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{bad-time.run}:12:2026-10-24T14:47:03.778604Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "target.write_failed",
+            "message": "{database_message}"
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:47:03.896027Z",
+          "dedupe_key": "{bad-time.run}:12:2026-10-24T14:47:03.778604Z",
+          "workflow_run_id": "{bad-time.run}",
+          "workflow_instance_id": "{bad-time.instance}",
+          "history_event_count": 12
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{bad-time.checksum}",
+          "recomputed_checksum": "{bad-time.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "write_failed_describe": {
+    "status": 404,
+    "response": {
+      "message": "Workflow not found.",
+      "reason": "instance_not_found",
+      "workflow_id": "{bad-time.instance}",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "describe",
+        "workflow_id": "{bad-time.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": []
+        },
+        "reason": "instance_not_found",
+        "message": "Workflow not found."
+      }
+    }
+  },
+  "terminated": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{terminated.instance}",
+        "run_id": "{terminated.run}",
+        "run_number": 1,
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "terminated",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{terminated.run}:4:2026-10-24T14:42:51.798314Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:42:52.181897Z",
+          "dedupe_key": "{terminated.run}:4:2026-10-24T14:42:51.798314Z",
+          "workflow_run_id": "{terminated.run}",
+          "workflow_instance_id": "{terminated.instance}",
+          "history_event_count": 4
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{terminated.checksum}",
+          "recomputed_checksum": "{terminated.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "{generated_ulid}",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 4,
+        "workflow_commands": 2,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 1,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 1,
+        "workflow_links": 0,
+        "workflow_memos": 1,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    }
+  },
+  "non_terminal_not_current": {
+    "status": 422,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{not-current.instance}",
+        "run_id": "{not-current.run}",
+        "run_number": 1,
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "pending",
+        "is_current_run": false,
+        "history_complete": false,
+        "dedupe_key": "{not-current.run}:2:2026-10-24T14:45:59.846584Z"
+      },
+      "eligibility": {
+        "eligible": false,
+        "errors": [
+          {
+            "rule": "workflow.non_terminal_not_current",
+            "message": "Non-terminal embedded v2 imports must be the current run."
+          }
+        ],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:46:00.219311Z",
+          "dedupe_key": "{not-current.run}:2:2026-10-24T14:45:59.846584Z",
+          "workflow_run_id": "{not-current.run}",
+          "workflow_instance_id": "{not-current.instance}",
+          "history_event_count": 2
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{not-current.checksum}",
+          "recomputed_checksum": "{not-current.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "rejected",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 0,
+        "workflow_history_events": 0,
+        "workflow_commands": 0,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 0,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 0,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 0
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "rejected"
+      }
+    }
+  },
+  "running": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{running.instance}",
+        "run_id": "{running.run}",
+        "run_number": 1,
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "pending",
+        "is_current_run": true,
+        "history_complete": false,
+        "dedupe_key": "{running.run}:2:2026-10-24T14:45:59.846584Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:46:00.219311Z",
+          "dedupe_key": "{running.run}:2:2026-10-24T14:45:59.846584Z",
+          "workflow_run_id": "{running.run}",
+          "workflow_instance_id": "{running.instance}",
+          "history_event_count": 2
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{running.checksum}",
+          "recomputed_checksum": "{running.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "{generated_ulid}",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 2,
+        "workflow_commands": 1,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 1,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 0,
+        "workflow_links": 0,
+        "workflow_memos": 1,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    }
+  },
+  "running_describe": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{running.instance}",
+      "run_id": "{running.run}",
+      "namespace": "pr1-workflow-import-imp",
+      "workflow_type": "parity.import",
+      "business_key": "bk-2",
+      "status": "pending",
+      "status_bucket": "running",
+      "is_terminal": false,
+      "closed_reason": null,
+      "task_queue": "q-src",
+      "run_number": 1,
+      "run_count": 1,
+      "is_current_run": true,
+      "continued_from_run_id": null,
+      "resume_step_sequence": null,
+      "recovery_kind": null,
+      "compatibility": null,
+      "compatibility_status": "compatible",
+      "compatibility_supported_in_fleet": true,
+      "compatibility_fleet_reason": null,
+      "payload_codec": "avro",
+      "definition_routing": {
+        "pinning_enabled": true,
+        "worker_pinned": false,
+        "recorded_fingerprint": null,
+        "workflow_type": "parity.import",
+        "task_queue": "q-src",
+        "required_build_id": null,
+        "status": "not_worker_pinned",
+        "blocked": false,
+        "runnable_task": true,
+        "eligible_worker_count": 0,
+        "matching_worker_count": 0,
+        "changed_worker_count": 0,
+        "missing_fingerprint_count": 0,
+        "entry_validation_unavailable_count": 0,
+        "workers": [],
+        "workers_truncated": false,
+        "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+      },
+      "execution_timeout_seconds": null,
+      "run_timeout_seconds": null,
+      "execution_deadline_at": null,
+      "run_deadline_at": null,
+      "input": [
+        {
+          "a": 2
+        }
+      ],
+      "output": null,
+      "input_envelope": {
+        "codec": "avro",
+        "blob": "wwHioz3/VYAiNwwCDgICYQQEAAA="
+      },
+      "output_envelope": null,
+      "payload_previews": {
+        "input_omitted": false,
+        "output_omitted": false,
+        "max_encoded_bytes": 2097152
+      },
+      "started_at": "2026-10-24T14:45:59.832108Z",
+      "closed_at": null,
+      "last_progress_at": "2026-10-24T14:45:59+00:00",
+      "wait_kind": "workflow-task",
+      "wait_reason": "{workflow_task_ready}",
+      "memo": {
+        "note": "λ running"
+      },
+      "search_attributes": [],
+      "actions": {
+        "can_signal": true,
+        "can_query": false,
+        "can_update": false,
+        "can_cancel": true,
+        "can_terminate": true,
+        "can_repair": true,
+        "can_archive": false
+      },
+      "commands_scope": "selected_run",
+      "commands": [
+        {
+          "id": "{running.u2}",
+          "sequence": 1,
+          "type": "start",
+          "target_scope": "instance",
+          "resolved_run_id": "{running.run}",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "started_new",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.import",
+          "workflow_class": "parity.import",
+          "accepted_at": "2026-10-24T14:45:59.839569Z",
+          "applied_at": "2026-10-24T14:45:59.839574Z"
+        }
+      ],
+      "updates_scope": "selected_run",
+      "updates": [],
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "describe",
+        "workflow_id": "{running.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": []
+        },
+        "run_id": "{running.run}",
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-imp",
+        "business_key": "bk-2",
+        "status": "pending",
+        "status_bucket": "running",
+        "is_terminal": false,
+        "task_queue": "q-src",
+        "run_number": 1,
+        "run_count": 1,
+        "is_current_run": true,
+        "compatibility": null,
+        "started_at": "2026-10-24T14:45:59.832108Z",
+        "closed_at": null,
+        "last_progress_at": "2026-10-24T14:45:59+00:00",
+        "wait_kind": "workflow-task",
+        "wait_reason": "{workflow_task_ready}"
+      }
+    }
+  },
+  "read_describe": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{rich.instance}",
+      "run_id": "{rich.run}",
+      "namespace": "pr1-workflow-import-imp",
+      "workflow_type": "parity.rich",
+      "business_key": "bk-rich",
+      "status": "completed",
+      "status_bucket": "completed",
+      "is_terminal": true,
+      "closed_reason": "completed",
+      "task_queue": "q-rich",
+      "run_number": 1,
+      "run_count": 1,
+      "is_current_run": true,
+      "continued_from_run_id": null,
+      "resume_step_sequence": null,
+      "recovery_kind": null,
+      "compatibility": null,
+      "compatibility_status": "compatible",
+      "compatibility_supported_in_fleet": true,
+      "compatibility_fleet_reason": null,
+      "payload_codec": "avro",
+      "definition_routing": {
+        "pinning_enabled": true,
+        "worker_pinned": false,
+        "recorded_fingerprint": null,
+        "workflow_type": "parity.rich",
+        "task_queue": "q-rich",
+        "required_build_id": null,
+        "status": "not_worker_pinned",
+        "blocked": false,
+        "runnable_task": false,
+        "eligible_worker_count": 0,
+        "matching_worker_count": 0,
+        "changed_worker_count": 0,
+        "missing_fingerprint_count": 0,
+        "entry_validation_unavailable_count": 0,
+        "workers": [],
+        "workers_truncated": false,
+        "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+      },
+      "execution_timeout_seconds": null,
+      "run_timeout_seconds": null,
+      "execution_deadline_at": null,
+      "run_deadline_at": null,
+      "input": [
+        {
+          "a": 1
+        }
+      ],
+      "output": [
+        {
+          "a": 1
+        }
+      ],
+      "input_envelope": {
+        "codec": "avro",
+        "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+      },
+      "output_envelope": {
+        "codec": "avro",
+        "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+      },
+      "payload_previews": {
+        "input_omitted": false,
+        "output_omitted": false,
+        "max_encoded_bytes": 2097152
+      },
+      "started_at": "2026-10-24T14:46:59.941656Z",
+      "closed_at": "2026-10-24T14:47:03.777577Z",
+      "last_progress_at": "2026-10-24T14:47:03+00:00",
+      "wait_kind": null,
+      "wait_reason": null,
+      "memo": {
+        "n": 3,
+        "note": "λ rich"
+      },
+      "search_attributes": {
+        "CustomerId": "cust-λ",
+        "Tier": 2
+      },
+      "actions": {
+        "can_signal": false,
+        "can_query": false,
+        "can_update": false,
+        "can_cancel": false,
+        "can_terminate": false,
+        "can_repair": false,
+        "can_archive": true
+      },
+      "commands_scope": "selected_run",
+      "commands": [
+        {
+          "id": "{rich.u2}",
+          "sequence": 1,
+          "type": "start",
+          "target_scope": "instance",
+          "resolved_run_id": "{rich.run}",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "started_new",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.rich",
+          "workflow_class": "parity.rich",
+          "accepted_at": "2026-10-24T14:46:59.960583Z",
+          "applied_at": "2026-10-24T14:46:59.960589Z"
+        },
+        {
+          "id": "{rich.u20}",
+          "sequence": 2,
+          "type": "signal",
+          "target_scope": "instance",
+          "resolved_run_id": "{rich.run}",
+          "target_name": "go",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "signal_received",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.rich",
+          "workflow_class": "parity.rich",
+          "accepted_at": "2026-10-24T14:47:03.476022Z",
+          "applied_at": "2026-10-24T14:47:03.768522Z"
+        }
+      ],
+      "updates_scope": "selected_run",
+      "updates": [],
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "describe",
+        "workflow_id": "{rich.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": []
+        },
+        "run_id": "{rich.run}",
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "business_key": "bk-rich",
+        "status": "completed",
+        "status_bucket": "completed",
+        "is_terminal": true,
+        "task_queue": "q-rich",
+        "run_number": 1,
+        "run_count": 1,
+        "is_current_run": true,
+        "compatibility": null,
+        "started_at": "2026-10-24T14:46:59.941656Z",
+        "closed_at": "2026-10-24T14:47:03.777577Z",
+        "last_progress_at": "2026-10-24T14:47:03+00:00",
+        "wait_kind": null,
+        "wait_reason": null
+      }
+    }
+  },
+  "read_runs": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{rich.instance}",
+      "run_count": 1,
+      "runs": [
+        {
+          "run_id": "{rich.run}",
+          "run_number": 1,
+          "workflow_type": "parity.rich",
+          "business_key": "bk-rich",
+          "status": "completed",
+          "status_bucket": "completed",
+          "is_terminal": true,
+          "is_current_run": true,
+          "task_queue": "q-rich",
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "memo": {
+            "n": 3,
+            "note": "λ rich"
+          }
+        }
+      ],
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "list_runs",
+        "workflow_id": "{rich.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": []
+        },
+        "run_count": 1
+      }
+    }
+  },
+  "read_run": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{rich.instance}",
+      "run_id": "{rich.run}",
+      "namespace": "pr1-workflow-import-imp",
+      "workflow_type": "parity.rich",
+      "business_key": "bk-rich",
+      "status": "completed",
+      "status_bucket": "completed",
+      "is_terminal": true,
+      "closed_reason": "completed",
+      "task_queue": "q-rich",
+      "run_number": 1,
+      "run_count": 1,
+      "is_current_run": true,
+      "continued_from_run_id": null,
+      "resume_step_sequence": null,
+      "recovery_kind": null,
+      "compatibility": null,
+      "compatibility_status": "compatible",
+      "compatibility_supported_in_fleet": true,
+      "compatibility_fleet_reason": null,
+      "payload_codec": "avro",
+      "definition_routing": {
+        "pinning_enabled": true,
+        "worker_pinned": false,
+        "recorded_fingerprint": null,
+        "workflow_type": "parity.rich",
+        "task_queue": "q-rich",
+        "required_build_id": null,
+        "status": "not_worker_pinned",
+        "blocked": false,
+        "runnable_task": false,
+        "eligible_worker_count": 0,
+        "matching_worker_count": 0,
+        "changed_worker_count": 0,
+        "missing_fingerprint_count": 0,
+        "entry_validation_unavailable_count": 0,
+        "workers": [],
+        "workers_truncated": false,
+        "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+      },
+      "execution_timeout_seconds": null,
+      "run_timeout_seconds": null,
+      "execution_deadline_at": null,
+      "run_deadline_at": null,
+      "input": [
+        {
+          "a": 1
+        }
+      ],
+      "output": [
+        {
+          "a": 1
+        }
+      ],
+      "input_envelope": {
+        "codec": "avro",
+        "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+      },
+      "output_envelope": {
+        "codec": "avro",
+        "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+      },
+      "payload_previews": {
+        "input_omitted": false,
+        "output_omitted": false,
+        "max_encoded_bytes": 2097152
+      },
+      "started_at": "2026-10-24T14:46:59.941656Z",
+      "closed_at": "2026-10-24T14:47:03.777577Z",
+      "last_progress_at": "2026-10-24T14:47:03+00:00",
+      "wait_kind": null,
+      "wait_reason": null,
+      "memo": {
+        "n": 3,
+        "note": "λ rich"
+      },
+      "search_attributes": {
+        "CustomerId": "cust-λ",
+        "Tier": 2
+      },
+      "actions": {
+        "can_signal": false,
+        "can_query": false,
+        "can_update": false,
+        "can_cancel": false,
+        "can_terminate": false,
+        "can_repair": false,
+        "can_archive": true
+      },
+      "commands_scope": "selected_run",
+      "commands": [
+        {
+          "id": "{rich.u2}",
+          "sequence": 1,
+          "type": "start",
+          "target_scope": "instance",
+          "resolved_run_id": "{rich.run}",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "started_new",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.rich",
+          "workflow_class": "parity.rich",
+          "accepted_at": "2026-10-24T14:46:59.960583Z",
+          "applied_at": "2026-10-24T14:46:59.960589Z"
+        },
+        {
+          "id": "{rich.u20}",
+          "sequence": 2,
+          "type": "signal",
+          "target_scope": "instance",
+          "resolved_run_id": "{rich.run}",
+          "target_name": "go",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "signal_received",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.rich",
+          "workflow_class": "parity.rich",
+          "accepted_at": "2026-10-24T14:47:03.476022Z",
+          "applied_at": "2026-10-24T14:47:03.768522Z"
+        }
+      ],
+      "updates_scope": "selected_run",
+      "updates": [],
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "describe_run",
+        "workflow_id": "{rich.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": [
+            "run_id"
+          ],
+          "rejection_fields": [
+            "workflow_id",
+            "run_id",
+            "reason",
+            "message",
+            "retryable",
+            "error_id",
+            "exception"
+          ],
+          "rejection_reasons": [
+            "control_plane_internal_error"
+          ]
+        },
+        "run_id": "{rich.run}",
+        "workflow_type": "parity.rich",
+        "namespace": "pr1-workflow-import-imp",
+        "business_key": "bk-rich",
+        "status": "completed",
+        "status_bucket": "completed",
+        "is_terminal": true,
+        "task_queue": "q-rich",
+        "run_number": 1,
+        "run_count": 1,
+        "is_current_run": true,
+        "compatibility": null,
+        "started_at": "2026-10-24T14:46:59.941656Z",
+        "closed_at": "2026-10-24T14:47:03.777577Z",
+        "last_progress_at": "2026-10-24T14:47:03+00:00",
+        "wait_kind": null,
+        "wait_reason": null
+      }
+    }
+  },
+  "read_history": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{rich.instance}",
+      "run_id": "{rich.run}",
+      "compatibility": null,
+      "compatibility_status": "compatible",
+      "compatibility_supported_in_fleet": true,
+      "compatibility_fleet_reason": null,
+      "events": [
+        {
+          "sequence": 1,
+          "event_type": "StartAccepted",
+          "timestamp": "2026-10-24T14:46:59.967125Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_command_id": "{rich.u2}",
+            "workflow_instance_id": "{rich.instance}",
+            "workflow_run_id": "{rich.run}",
+            "workflow_class": "parity.rich",
+            "workflow_type": "parity.rich",
+            "business_key": "bk-rich",
+            "visibility_labels": null,
+            "memo": {
+              "note": "λ rich",
+              "n": 3
+            },
+            "search_attributes": {
+              "CustomerId": "cust-λ",
+              "Tier": 2
+            },
+            "outcome": "started_new",
+            "command": {
+              "id": "{rich.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows",
+              "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+              "request_fingerprint": "sha256:9c9eaf04b60868e676065d1796f72d8bd18838b46353d302ab6f9ce7c54ea1ea",
+              "status": "accepted",
+              "outcome": "started_new",
+              "accepted_at": "2026-10-24T14:46:59.960583Z",
+              "applied_at": "2026-10-24T14:46:59.960589Z"
+            }
+          }
+        },
+        {
+          "sequence": 2,
+          "event_type": "WorkflowStarted",
+          "timestamp": "2026-10-24T14:46:59.974840Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_class": "parity.rich",
+            "workflow_type": "parity.rich",
+            "workflow_instance_id": "{rich.instance}",
+            "workflow_run_id": "{rich.run}",
+            "workflow_command_id": "{rich.u2}",
+            "business_key": "bk-rich",
+            "memo": {
+              "note": "λ rich",
+              "n": 3
+            },
+            "search_attributes": {
+              "CustomerId": "cust-λ",
+              "Tier": 2
+            },
+            "command": {
+              "id": "{rich.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows",
+              "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+              "request_fingerprint": "sha256:9c9eaf04b60868e676065d1796f72d8bd18838b46353d302ab6f9ce7c54ea1ea",
+              "status": "accepted",
+              "outcome": "started_new",
+              "accepted_at": "2026-10-24T14:46:59.960583Z",
+              "applied_at": "2026-10-24T14:46:59.960589Z"
+            },
+            "declared_queries": [],
+            "declared_query_contracts": [],
+            "declared_signals": [
+              "go"
+            ],
+            "declared_signal_contracts": [
+              {
+                "name": "go",
+                "parameters": []
+              }
+            ],
+            "declared_updates": [],
+            "declared_update_contracts": [],
+            "declared_entry_method": "handle",
+            "declared_entry_mode": "canonical",
+            "declared_entry_declaring_class": "external:parity.rich"
+          }
+        },
+        {
+          "sequence": 3,
+          "event_type": "ActivityScheduled",
+          "timestamp": "2026-10-24T14:47:00.313979Z",
+          "principal": null,
+          "payload": {
+            "activity_execution_id": "{rich.u6}",
+            "activity_class": "parity.act",
+            "activity_type": "parity.act",
+            "sequence": 1,
+            "activity": {
+              "id": "{rich.u6}",
+              "idempotency_key": "{rich.u6}",
+              "sequence": 1,
+              "type": "parity.act",
+              "class": "parity.act",
+              "local_activity": false,
+              "status": "pending",
+              "payload_codec": "avro",
+              "attempt_count": 0,
+              "queue": "q-rich",
+              "created_at": "2026-10-24T14:47:00.306185Z",
+              "arguments": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              }
+            },
+            "task": {
+              "id": "{rich.u5}",
+              "type": "workflow",
+              "status": "leased",
+              "available_at": "2026-10-24T14:46:59.977678Z",
+              "leased_at": "2026-10-24T14:47:00.117197Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:48:00.117111Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich",
+              "last_dispatch_attempt_at": "2026-10-24T14:46:59.997376Z",
+              "last_dispatched_at": "2026-10-24T14:46:59.997376Z"
+            }
+          }
+        },
+        {
+          "sequence": 4,
+          "event_type": "ActivityStarted",
+          "timestamp": "2026-10-24T14:47:00.548205Z",
+          "principal": null,
+          "payload": {
+            "activity_execution_id": "{rich.u6}",
+            "activity_attempt_id": "{rich.U9}",
+            "activity_class": "parity.act",
+            "activity_type": "parity.act",
+            "sequence": 1,
+            "attempt_number": 1,
+            "activity": {
+              "id": "{rich.u6}",
+              "idempotency_key": "{rich.u6}",
+              "sequence": 1,
+              "type": "parity.act",
+              "class": "parity.act",
+              "local_activity": false,
+              "attempt_id": "{rich.U9}",
+              "status": "running",
+              "payload_codec": "avro",
+              "attempt_count": 1,
+              "queue": "q-rich",
+              "created_at": "2026-10-24T14:47:00.306185Z",
+              "started_at": "2026-10-24T14:47:00.543703Z",
+              "arguments": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              }
+            },
+            "task": {
+              "id": "{rich.u8}",
+              "type": "activity",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:00.317243Z",
+              "leased_at": "2026-10-24T14:47:00.543703Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:52:00.543817Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich"
+            }
+          }
+        },
+        {
+          "sequence": 5,
+          "event_type": "ActivityCompleted",
+          "timestamp": "2026-10-24T14:47:00.678013Z",
+          "principal": null,
+          "payload": {
+            "activity_execution_id": "{rich.u6}",
+            "activity_attempt_id": "{rich.U9}",
+            "activity_class": "parity.act",
+            "activity_type": "parity.act",
+            "sequence": 1,
+            "attempt_number": 1,
+            "result": {
+              "codec": "avro",
+              "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+            },
+            "payload_codec": "avro",
+            "activity": {
+              "id": "{rich.u6}",
+              "idempotency_key": "{rich.u6}",
+              "sequence": 1,
+              "type": "parity.act",
+              "class": "parity.act",
+              "local_activity": false,
+              "attempt_id": "{rich.U9}",
+              "status": "completed",
+              "payload_codec": "avro",
+              "attempt_count": 1,
+              "queue": "q-rich",
+              "created_at": "2026-10-24T14:47:00.306185Z",
+              "started_at": "2026-10-24T14:47:00.543703Z",
+              "closed_at": "2026-10-24T14:47:00.676908Z",
+              "arguments": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "result": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              }
+            },
+            "task": {
+              "id": "{rich.u8}",
+              "type": "activity",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:00.317243Z",
+              "leased_at": "2026-10-24T14:47:00.543703Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:52:00.543817Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich"
+            }
+          }
+        },
+        {
+          "sequence": 6,
+          "event_type": "TimerScheduled",
+          "timestamp": "2026-10-24T14:47:00.950363Z",
+          "principal": null,
+          "payload": {
+            "timer_id": "{rich.u13}",
+            "sequence": 2,
+            "delay_seconds": 1,
+            "fire_at": "2026-10-24T14:47:01.949279Z",
+            "task": {
+              "id": "{rich.u12}",
+              "type": "workflow",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:00.683997Z",
+              "leased_at": "2026-10-24T14:47:00.813533Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:48:00.813492Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich",
+              "last_dispatch_attempt_at": "2026-10-24T14:47:00.717460Z",
+              "last_dispatched_at": "2026-10-24T14:47:00.717460Z"
+            }
+          }
+        },
+        {
+          "sequence": 7,
+          "event_type": "TimerFired",
+          "timestamp": "2026-10-24T14:47:03.177823Z",
+          "principal": null,
+          "payload": {
+            "timer_id": "{rich.u13}",
+            "sequence": 2,
+            "delay_seconds": 1,
+            "fire_at": "2026-10-24T14:47:01.949279Z",
+            "fired_at": "2026-10-24T14:47:03.176920Z",
+            "task": {
+              "id": "{rich.u15}",
+              "type": "timer",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:01.949279Z",
+              "leased_at": "2026-10-24T14:47:03.145194Z",
+              "lease_owner": "{rich.u15}",
+              "lease_expires_at": "2026-10-24T14:48:03.145206Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich"
+            }
+          }
+        },
+        {
+          "sequence": 8,
+          "event_type": "SignalWaitOpened",
+          "timestamp": "2026-10-24T14:47:03.335861Z",
+          "principal": null,
+          "payload": {
+            "signal_name": "go",
+            "signal_wait_id": "{rich.U18}",
+            "sequence": 3,
+            "task": {
+              "id": "{rich.u17}",
+              "type": "workflow",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:03.180548Z",
+              "leased_at": "2026-10-24T14:47:03.228522Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:48:03.228482Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich",
+              "last_dispatch_attempt_at": "2026-10-24T14:47:03.202748Z",
+              "last_dispatched_at": "2026-10-24T14:47:03.202748Z"
+            }
+          }
+        },
+        {
+          "sequence": 9,
+          "event_type": "SignalReceived",
+          "timestamp": "2026-10-24T14:47:03.479854Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_command_id": "{rich.u20}",
+            "signal_id": "{rich.u21}",
+            "workflow_instance_id": "{rich.instance}",
+            "workflow_run_id": "{rich.run}",
+            "signal_name": "go",
+            "signal_wait_id": "{rich.U18}",
+            "arguments": {
+              "codec": "avro",
+              "blob": "wwHioz3/VYAiNwwA"
+            },
+            "payload_codec": "avro",
+            "command": {
+              "id": "{rich.u20}",
+              "sequence": 2,
+              "message_sequence": 1,
+              "type": "signal",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "target_name": "go",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNw4GCG5hbWUKBGdvEmFyZ3VtZW50cwwAInZhbGlkYXRpb25fZXJyb3JzDAAA"
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows/{rich.instance}/signal/go",
+              "request_route_name": "generated::1UDj0wPOAwpiUqm5",
+              "request_fingerprint": "sha256:42c656099216d66c82aed9d3b85b92c4845c7dea1a6baab85e2cc4f8313045ee",
+              "status": "accepted",
+              "outcome": "signal_received",
+              "accepted_at": "2026-10-24T14:47:03.476022Z"
+            }
+          }
+        },
+        {
+          "sequence": 10,
+          "event_type": "MessageCursorAdvanced",
+          "timestamp": "2026-10-24T14:47:03.770214Z",
+          "principal": null,
+          "payload": {
+            "stream_key": "instance:{rich.instance}",
+            "previous_position": 0,
+            "new_position": 1,
+            "task": {
+              "id": "{rich.u23}",
+              "type": "workflow",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:03.485571Z",
+              "leased_at": "2026-10-24T14:47:03.638294Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich",
+              "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+              "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+            }
+          }
+        },
+        {
+          "sequence": 11,
+          "event_type": "SignalApplied",
+          "timestamp": "2026-10-24T14:47:03.773614Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_command_id": "{rich.u20}",
+            "signal_id": "{rich.u21}",
+            "signal_name": "go",
+            "signal_wait_id": "{rich.U18}",
+            "sequence": 3,
+            "value": "wwHioz3/VYAiNwIB",
+            "task": {
+              "id": "{rich.u23}",
+              "type": "workflow",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:03.485571Z",
+              "leased_at": "2026-10-24T14:47:03.638294Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich",
+              "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+              "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+            },
+            "command": {
+              "id": "{rich.u20}",
+              "sequence": 2,
+              "message_sequence": 1,
+              "type": "signal",
+              "target_scope": "instance",
+              "resolved_run_id": "{rich.run}",
+              "target_name": "go",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNw4GCG5hbWUKBGdvEmFyZ3VtZW50cwwAInZhbGlkYXRpb25fZXJyb3JzDAAA"
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows/{rich.instance}/signal/go",
+              "request_route_name": "generated::1UDj0wPOAwpiUqm5",
+              "request_fingerprint": "sha256:42c656099216d66c82aed9d3b85b92c4845c7dea1a6baab85e2cc4f8313045ee",
+              "status": "accepted",
+              "outcome": "signal_received",
+              "accepted_at": "2026-10-24T14:47:03.476022Z",
+              "applied_at": "2026-10-24T14:47:03.768522Z"
+            }
+          }
+        },
+        {
+          "sequence": 12,
+          "event_type": "WorkflowCompleted",
+          "timestamp": "2026-10-24T14:47:03.778604Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "output": {
+              "codec": "avro",
+              "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+            },
+            "payload_codec": "avro",
+            "task": {
+              "id": "{rich.u23}",
+              "type": "workflow",
+              "status": "leased",
+              "available_at": "2026-10-24T14:47:03.485571Z",
+              "leased_at": "2026-10-24T14:47:03.638294Z",
+              "lease_owner": "w-rich",
+              "lease_expires_at": "2026-10-24T14:48:03.638245Z",
+              "attempt_count": 1,
+              "repair_count": 0,
+              "connection": "sqlite",
+              "queue": "q-rich",
+              "last_dispatch_attempt_at": "2026-10-24T14:47:03.523261Z",
+              "last_dispatched_at": "2026-10-24T14:47:03.523261Z"
+            },
+            "command": {
+              "type": "complete_workflow",
+              "source": "worker_protocol",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin"
+            }
+          }
+        }
+      ],
+      "next_page_token": null,
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "history",
+        "workflow_id": "{rich.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id",
+            "run_id"
+          ],
+          "success_fields": [
+            "next_page_token"
+          ],
+          "rejection_fields": [
+            "workflow_id",
+            "run_id",
+            "reason",
+            "message",
+            "retryable",
+            "error_id",
+            "exception"
+          ],
+          "rejection_reasons": [
+            "control_plane_internal_error"
+          ]
+        },
+        "run_id": "{rich.run}",
+        "compatibility": null,
+        "next_page_token": null
+      }
+    }
+  },
+  "read_terminated_history": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{terminated.instance}",
+      "run_id": "{terminated.run}",
+      "compatibility": null,
+      "compatibility_status": "compatible",
+      "compatibility_supported_in_fleet": true,
+      "compatibility_fleet_reason": null,
+      "events": [
+        {
+          "sequence": 1,
+          "event_type": "StartAccepted",
+          "timestamp": "2026-10-24T14:42:46.471663Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_command_id": "{terminated.u2}",
+            "workflow_instance_id": "{terminated.instance}",
+            "workflow_run_id": "{terminated.run}",
+            "workflow_class": "parity.import",
+            "workflow_type": "parity.import",
+            "business_key": "bk-1",
+            "visibility_labels": null,
+            "memo": {
+              "note": "λ hello"
+            },
+            "search_attributes": null,
+            "outcome": "started_new",
+            "command": {
+              "id": "{terminated.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{terminated.run}",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows",
+              "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+              "request_fingerprint": "sha256:7cafb8caeb2d37a7cf562e76766e37df282b0d5790acfaae3249fd12b1e95db4",
+              "status": "accepted",
+              "outcome": "started_new",
+              "accepted_at": "2026-10-24T14:42:46.460769Z",
+              "applied_at": "2026-10-24T14:42:46.460778Z"
+            }
+          }
+        },
+        {
+          "sequence": 2,
+          "event_type": "WorkflowStarted",
+          "timestamp": "2026-10-24T14:42:46.484260Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_class": "parity.import",
+            "workflow_type": "parity.import",
+            "workflow_instance_id": "{terminated.instance}",
+            "workflow_run_id": "{terminated.run}",
+            "workflow_command_id": "{terminated.u2}",
+            "business_key": "bk-1",
+            "memo": {
+              "note": "λ hello"
+            },
+            "command": {
+              "id": "{terminated.u2}",
+              "sequence": 1,
+              "type": "start",
+              "target_scope": "instance",
+              "resolved_run_id": "{terminated.run}",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows",
+              "request_route_name": "generated::4Es3mx7XcNqGD6Dd",
+              "request_fingerprint": "sha256:7cafb8caeb2d37a7cf562e76766e37df282b0d5790acfaae3249fd12b1e95db4",
+              "status": "accepted",
+              "outcome": "started_new",
+              "accepted_at": "2026-10-24T14:42:46.460769Z",
+              "applied_at": "2026-10-24T14:42:46.460778Z"
+            }
+          }
+        },
+        {
+          "sequence": 3,
+          "event_type": "TerminateRequested",
+          "timestamp": "2026-10-24T14:42:51.788929Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_command_id": "{terminated.u6}",
+            "workflow_instance_id": "{terminated.instance}",
+            "workflow_run_id": "{terminated.run}",
+            "command_type": "terminate",
+            "reason": "parity terminate",
+            "command": {
+              "id": "{terminated.u6}",
+              "sequence": 2,
+              "type": "terminate",
+              "target_scope": "instance",
+              "resolved_run_id": "{terminated.run}",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNw4CDHJlYXNvbgogcGFyaXR5IHRlcm1pbmF0ZQA="
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows/{terminated.instance}/terminate",
+              "request_route_name": "generated::9mKRxCklA43Q96fA",
+              "request_fingerprint": "sha256:b92bdf0fc7f27707344cbb3945e695f213155d88f8a136c4f2564a24349f2b72",
+              "status": "accepted",
+              "outcome": "terminated",
+              "accepted_at": "2026-10-24T14:42:51.784635Z"
+            }
+          }
+        },
+        {
+          "sequence": 4,
+          "event_type": "WorkflowTerminated",
+          "timestamp": "2026-10-24T14:42:51.798314Z",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "payload": {
+            "workflow_command_id": "{terminated.u6}",
+            "workflow_instance_id": "{terminated.instance}",
+            "workflow_run_id": "{terminated.run}",
+            "failure_id": "{terminated.u8}",
+            "failure_category": "terminated",
+            "closed_reason": "terminated",
+            "exception_class": "Workflow\\V2\\Exceptions\\WorkflowTerminatedException",
+            "message": "Workflow terminated: parity terminate",
+            "reason": "parity terminate",
+            "command": {
+              "id": "{terminated.u6}",
+              "sequence": 2,
+              "type": "terminate",
+              "target_scope": "instance",
+              "resolved_run_id": "{terminated.run}",
+              "payload_codec": "avro",
+              "payload": {
+                "codec": "avro",
+                "blob": "wwHioz3/VYAiNw4CDHJlYXNvbgogcGFyaXR5IHRlcm1pbmF0ZQA="
+              },
+              "source": "control_plane",
+              "context": {
+                "principal": {
+                  "type": "auth:token",
+                  "id": "legacy-token",
+                  "label": "Admin"
+                }
+              },
+              "caller_label": "Standalone Server",
+              "principal_type": "auth:token",
+              "principal_id": "legacy-token",
+              "principal_label": "Admin",
+              "auth_status": "authorized",
+              "auth_method": "token",
+              "request_method": "POST",
+              "request_path": "/api/workflows/{terminated.instance}/terminate",
+              "request_route_name": "generated::9mKRxCklA43Q96fA",
+              "request_fingerprint": "sha256:b92bdf0fc7f27707344cbb3945e695f213155d88f8a136c4f2564a24349f2b72",
+              "status": "accepted",
+              "outcome": "terminated",
+              "accepted_at": "2026-10-24T14:42:51.784635Z"
+            }
+          }
+        }
+      ],
+      "next_page_token": null,
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "history",
+        "workflow_id": "{terminated.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id",
+            "run_id"
+          ],
+          "success_fields": [
+            "next_page_token"
+          ],
+          "rejection_fields": [
+            "workflow_id",
+            "run_id",
+            "reason",
+            "message",
+            "retryable",
+            "error_id",
+            "exception"
+          ],
+          "rejection_reasons": [
+            "control_plane_internal_error"
+          ]
+        },
+        "run_id": "{terminated.run}",
+        "compatibility": null,
+        "next_page_token": null
+      }
+    }
+  },
+  "read_list": {
+    "status": 200,
+    "response": {
+      "workflows": [
+        {
+          "workflow_id": "{bare.instance}",
+          "run_id": "{bare.run}",
+          "workflow_type": "parity.rich",
+          "business_key": "bk-rich",
+          "status": "completed",
+          "status_bucket": "completed",
+          "task_queue": "q-rich",
+          "is_terminal": true,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "search_attributes": {
+            "CustomerId": "cust-λ",
+            "Tier": 2
+          }
+        },
+        {
+          "workflow_id": "{normalized.instance}",
+          "run_id": "{normalized.run}",
+          "workflow_type": "parity.rich",
+          "business_key": "bk-normalized",
+          "status": "completed",
+          "status_bucket": "completed",
+          "task_queue": "q-rich",
+          "is_terminal": true,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "search_attributes": {
+            "CustomerId": "cust-λ",
+            "Tier": 2
+          }
+        },
+        {
+          "workflow_id": "{signed.instance}",
+          "run_id": "{signed.run}",
+          "workflow_type": "parity.rich",
+          "business_key": "bk-rich",
+          "status": "completed",
+          "status_bucket": "completed",
+          "task_queue": "q-rich",
+          "is_terminal": true,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "search_attributes": {
+            "CustomerId": "cust-λ",
+            "Tier": 2
+          }
+        },
+        {
+          "workflow_id": "{rich.instance}",
+          "run_id": "{rich.run}",
+          "workflow_type": "parity.rich",
+          "business_key": "bk-rich",
+          "status": "completed",
+          "status_bucket": "completed",
+          "task_queue": "q-rich",
+          "is_terminal": true,
+          "compatibility": null,
+          "compatibility_status": "compatible",
+          "compatibility_supported_in_fleet": true,
+          "compatibility_fleet_reason": null,
+          "started_at": "2026-10-24T14:46:59.941656Z",
+          "closed_at": "2026-10-24T14:47:03.777577Z",
+          "search_attributes": {
+            "CustomerId": "cust-λ",
+            "Tier": 2
+          }
+        }
+      ],
+      "workflow_count": 4,
+      "next_page_token": null,
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "list",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "workflow_count": 4,
+        "next_page_token": null
+      }
+    }
+  },
+  "attach_source": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{attach-source.instance}",
+        "run_id": "{attach-source.run}",
+        "run_number": 1,
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-alt",
+        "status": "terminated",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{attach-source.run}:4:2026-10-24T14:42:51.798314Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:42:52.181897Z",
+          "dedupe_key": "{attach-source.run}:4:2026-10-24T14:42:51.798314Z",
+          "workflow_run_id": "{attach-source.run}",
+          "workflow_instance_id": "{attach-source.instance}",
+          "history_event_count": 4
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{attach-source.checksum}",
+          "recomputed_checksum": "{attach-source.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "{generated_ulid}",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 1,
+        "workflow_runs": 1,
+        "workflow_history_events": 4,
+        "workflow_commands": 2,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 1,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 1,
+        "workflow_links": 0,
+        "workflow_memos": 1,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    }
+  },
+  "attach": {
+    "status": 201,
+    "response": {
+      "schema": "durable-workflow.v2.embedded-v2-import.report",
+      "schema_version": 1,
+      "contract_version": 2,
+      "source": "embedded_v2",
+      "dry_run": false,
+      "workflow": {
+        "instance_id": "{attach-source.instance}",
+        "run_id": "{attach.run}",
+        "run_number": 2,
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-imp",
+        "status": "terminated",
+        "is_current_run": true,
+        "history_complete": true,
+        "dedupe_key": "{attach.run}:4:2026-10-24T14:42:51.798314Z"
+      },
+      "eligibility": {
+        "eligible": true,
+        "errors": [],
+        "warnings": []
+      },
+      "integrity": {
+        "schema": "durable-workflow.v2.history-bundle-verification",
+        "schema_version": 1,
+        "status": "ok",
+        "bundle": {
+          "schema": "durable-workflow.v2.history-export",
+          "schema_version": 2,
+          "exported_at": "2026-10-24T14:42:52.181897Z",
+          "dedupe_key": "{attach.run}:4:2026-10-24T14:42:51.798314Z",
+          "workflow_run_id": "{attach.run}",
+          "workflow_instance_id": "{attach-source.instance}",
+          "history_event_count": 4
+        },
+        "integrity": {
+          "present": true,
+          "canonicalization": "json-recursive-ksort-v1",
+          "checksum_algorithm": "sha256",
+          "expected_checksum": "{attach.checksum}",
+          "recomputed_checksum": "{attach.checksum}",
+          "checksum_matches": true,
+          "signature_algorithm": null,
+          "signature_present": false,
+          "signature_verified": null,
+          "key_id": null
+        },
+        "summary": {
+          "errors": 0,
+          "warnings": 0,
+          "info": 0,
+          "findings_by_rule": []
+        },
+        "findings": []
+      },
+      "rollback": {
+        "mode": "database_transaction",
+        "partial_import_behavior": "no_rows_committed_on_failure"
+      },
+      "status": "imported",
+      "import_id": "{generated_ulid}",
+      "imported_at": "{imported_at}",
+      "rows": {
+        "workflow_instances": 0,
+        "workflow_runs": 1,
+        "workflow_history_events": 4,
+        "workflow_commands": 2,
+        "workflow_signal_records": 0,
+        "workflow_updates": 0,
+        "workflow_tasks": 1,
+        "activity_executions": 0,
+        "activity_attempts": 0,
+        "workflow_run_timers": 0,
+        "workflow_failures": 1,
+        "workflow_links": 0,
+        "workflow_memos": 1,
+        "workflow_search_attributes": 0,
+        "workflow_run_summaries": 1
+      },
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "import_embedded_v2",
+        "workflow_id": null,
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [],
+          "success_fields": []
+        },
+        "status": "imported"
+      }
+    }
+  },
+  "attach_source_describe_before": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{attach-source.instance}",
+      "run_id": "{attach-source.run}",
+      "namespace": "pr1-workflow-import-alt",
+      "workflow_type": "parity.import",
+      "business_key": "bk-1",
+      "status": "terminated",
+      "status_bucket": "failed",
+      "is_terminal": true,
+      "closed_reason": "terminated",
+      "task_queue": "q-src",
+      "run_number": 1,
+      "run_count": 1,
+      "is_current_run": true,
+      "continued_from_run_id": null,
+      "resume_step_sequence": null,
+      "recovery_kind": null,
+      "compatibility": null,
+      "compatibility_status": "compatible",
+      "compatibility_supported_in_fleet": true,
+      "compatibility_fleet_reason": null,
+      "payload_codec": "avro",
+      "definition_routing": {
+        "pinning_enabled": true,
+        "worker_pinned": false,
+        "recorded_fingerprint": null,
+        "workflow_type": "parity.import",
+        "task_queue": "q-src",
+        "required_build_id": null,
+        "status": "not_worker_pinned",
+        "blocked": false,
+        "runnable_task": false,
+        "eligible_worker_count": 0,
+        "matching_worker_count": 0,
+        "changed_worker_count": 0,
+        "missing_fingerprint_count": 0,
+        "entry_validation_unavailable_count": 0,
+        "workers": [],
+        "workers_truncated": false,
+        "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+      },
+      "execution_timeout_seconds": null,
+      "run_timeout_seconds": null,
+      "execution_deadline_at": null,
+      "run_deadline_at": null,
+      "input": [
+        {
+          "a": 1
+        }
+      ],
+      "output": null,
+      "input_envelope": {
+        "codec": "avro",
+        "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+      },
+      "output_envelope": null,
+      "payload_previews": {
+        "input_omitted": false,
+        "output_omitted": false,
+        "max_encoded_bytes": 2097152
+      },
+      "started_at": "2026-10-24T14:42:46.447474Z",
+      "closed_at": "2026-10-24T14:42:51.795895Z",
+      "last_progress_at": "2026-10-24T14:42:51+00:00",
+      "wait_kind": null,
+      "wait_reason": null,
+      "memo": {
+        "note": "λ hello"
+      },
+      "search_attributes": [],
+      "actions": {
+        "can_signal": false,
+        "can_query": false,
+        "can_update": false,
+        "can_cancel": false,
+        "can_terminate": false,
+        "can_repair": false,
+        "can_archive": true
+      },
+      "commands_scope": "selected_run",
+      "commands": [
+        {
+          "id": "{attach-source.u2}",
+          "sequence": 1,
+          "type": "start",
+          "target_scope": "instance",
+          "resolved_run_id": "{attach-source.run}",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "started_new",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.import",
+          "workflow_class": "parity.import",
+          "accepted_at": "2026-10-24T14:42:46.460769Z",
+          "applied_at": "2026-10-24T14:42:46.460778Z"
+        },
+        {
+          "id": "{attach-source.u6}",
+          "sequence": 2,
+          "type": "terminate",
+          "target_scope": "instance",
+          "resolved_run_id": "{attach-source.run}",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "terminated",
+          "reason": "parity terminate",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.import",
+          "workflow_class": "parity.import",
+          "accepted_at": "2026-10-24T14:42:51.784635Z",
+          "applied_at": "2026-10-24T14:42:51.808296Z"
+        }
+      ],
+      "updates_scope": "selected_run",
+      "updates": [],
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "describe",
+        "workflow_id": "{attach-source.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": []
+        },
+        "run_id": "{attach-source.run}",
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-alt",
+        "business_key": "bk-1",
+        "status": "terminated",
+        "status_bucket": "failed",
+        "is_terminal": true,
+        "task_queue": "q-src",
+        "run_number": 1,
+        "run_count": 1,
+        "is_current_run": true,
+        "compatibility": null,
+        "started_at": "2026-10-24T14:42:46.447474Z",
+        "closed_at": "2026-10-24T14:42:51.795895Z",
+        "last_progress_at": "2026-10-24T14:42:51+00:00",
+        "wait_kind": null,
+        "wait_reason": null
+      }
+    }
+  },
+  "attach_source_describe_after": {
+    "status": 200,
+    "response": {
+      "workflow_id": "{attach-source.instance}",
+      "run_id": "{attach-source.run}",
+      "namespace": "pr1-workflow-import-alt",
+      "workflow_type": "parity.import",
+      "business_key": "bk-1",
+      "status": "terminated",
+      "status_bucket": "failed",
+      "is_terminal": true,
+      "closed_reason": "terminated",
+      "task_queue": "q-src",
+      "run_number": 2,
+      "run_count": 2,
+      "is_current_run": true,
+      "continued_from_run_id": null,
+      "resume_step_sequence": null,
+      "recovery_kind": null,
+      "compatibility": null,
+      "compatibility_status": "compatible",
+      "compatibility_supported_in_fleet": true,
+      "compatibility_fleet_reason": null,
+      "payload_codec": "avro",
+      "definition_routing": {
+        "pinning_enabled": true,
+        "worker_pinned": false,
+        "recorded_fingerprint": null,
+        "workflow_type": "parity.import",
+        "task_queue": "q-src",
+        "required_build_id": null,
+        "status": "not_worker_pinned",
+        "blocked": false,
+        "runnable_task": false,
+        "eligible_worker_count": 0,
+        "matching_worker_count": 0,
+        "changed_worker_count": 0,
+        "missing_fingerprint_count": 0,
+        "entry_validation_unavailable_count": 0,
+        "workers": [],
+        "workers_truncated": false,
+        "resolution": "Recorded build, namespace, type and replay-capability guards remain in force."
+      },
+      "execution_timeout_seconds": null,
+      "run_timeout_seconds": null,
+      "execution_deadline_at": null,
+      "run_deadline_at": null,
+      "input": [
+        {
+          "a": 1
+        }
+      ],
+      "output": null,
+      "input_envelope": {
+        "codec": "avro",
+        "blob": "wwHioz3/VYAiNwwCDgICYQQCAAA="
+      },
+      "output_envelope": null,
+      "payload_previews": {
+        "input_omitted": false,
+        "output_omitted": false,
+        "max_encoded_bytes": 2097152
+      },
+      "started_at": "2026-10-24T14:42:46.447474Z",
+      "closed_at": "2026-10-24T14:42:51.795895Z",
+      "last_progress_at": "2026-10-24T14:42:51+00:00",
+      "wait_kind": null,
+      "wait_reason": null,
+      "memo": {
+        "note": "λ hello"
+      },
+      "search_attributes": [],
+      "actions": {
+        "can_signal": false,
+        "can_query": false,
+        "can_update": false,
+        "can_cancel": false,
+        "can_terminate": false,
+        "can_repair": false,
+        "can_archive": true
+      },
+      "commands_scope": "selected_run",
+      "commands": [
+        {
+          "id": "{attach-source.u2}",
+          "sequence": 1,
+          "type": "start",
+          "target_scope": "instance",
+          "resolved_run_id": "{attach-source.run}",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "started_new",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.import",
+          "workflow_class": "parity.import",
+          "accepted_at": "2026-10-24T14:42:46.460769Z",
+          "applied_at": "2026-10-24T14:42:46.460778Z"
+        },
+        {
+          "id": "{attach-source.u6}",
+          "sequence": 2,
+          "type": "terminate",
+          "target_scope": "instance",
+          "resolved_run_id": "{attach-source.run}",
+          "source": "control_plane",
+          "context": {
+            "principal": {
+              "type": "auth:token",
+              "id": "legacy-token",
+              "label": "Admin"
+            }
+          },
+          "principal_type": "auth:token",
+          "principal_id": "legacy-token",
+          "principal_label": "Admin",
+          "principal": {
+            "type": "auth:token",
+            "id": "legacy-token",
+            "label": "Admin"
+          },
+          "status": "accepted",
+          "outcome": "terminated",
+          "reason": "parity terminate",
+          "payload_preview_omitted": false,
+          "workflow_type": "parity.import",
+          "workflow_class": "parity.import",
+          "accepted_at": "2026-10-24T14:42:51.784635Z",
+          "applied_at": "2026-10-24T14:42:51.808296Z"
+        }
+      ],
+      "updates_scope": "selected_run",
+      "updates": [],
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "describe",
+        "workflow_id": "{attach-source.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": []
+        },
+        "run_id": "{attach-source.run}",
+        "workflow_type": "parity.import",
+        "namespace": "pr1-workflow-import-alt",
+        "business_key": "bk-1",
+        "status": "terminated",
+        "status_bucket": "failed",
+        "is_terminal": true,
+        "task_queue": "q-src",
+        "run_number": 2,
+        "run_count": 2,
+        "is_current_run": true,
+        "compatibility": null,
+        "started_at": "2026-10-24T14:42:46.447474Z",
+        "closed_at": "2026-10-24T14:42:51.795895Z",
+        "last_progress_at": "2026-10-24T14:42:51+00:00",
+        "wait_kind": null,
+        "wait_reason": null
+      }
+    }
+  },
+  "attach_describe": {
+    "status": 404,
+    "response": {
+      "message": "Workflow not found.",
+      "reason": "instance_not_found",
+      "workflow_id": "{attach-source.instance}",
+      "control_plane": {
+        "schema": "durable-workflow.v2.control-plane-response",
+        "version": 1,
+        "operation": "describe",
+        "workflow_id": "{attach-source.instance}",
+        "contract": {
+          "schema": "durable-workflow.v2.control-plane-response.contract",
+          "version": 1,
+          "legacy_field_policy": "reject_non_canonical",
+          "legacy_fields": {
+            "query": "query_name",
+            "signal": "signal_name",
+            "update": "update_name",
+            "wait_policy": "wait_for"
+          },
+          "required_fields": [
+            "workflow_id"
+          ],
+          "success_fields": []
+        },
+        "reason": "instance_not_found",
+        "message": "Workflow not found."
+      }
+    }
+  }
+}
diff --git a/tests/Unit/ServerParityWorkflowImportContractTest.mjs b/tests/Unit/ServerParityWorkflowImportContractTest.mjs
new file mode 100644
index 000000000..52d3cb645
--- /dev/null
+++ b/tests/Unit/ServerParityWorkflowImportContractTest.mjs
@@ -0,0 +1,96 @@
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import test from 'node:test';
+import {checkWorkflowImport} from '../../scripts/conformance/server-parity/workflow-import-contract.mjs';
+
+const fixture = JSON.parse(readFileSync(new URL('../Fixtures/ServerParity/workflow-import.json', import.meta.url)));
+// The observation published Server 2.11.1 returned for this fixture.
+const recorded = JSON.parse(readFileSync(
+  new URL('../Fixtures/ServerParityExpected/workflow-import-observation.json', import.meta.url)));
+const id = 'pr1-workflow-import';
+const observation = (change = () => {}, base = recorded) => {
+  const state = structuredClone(base);
+  change(state);
+  return {mode: 'http', workflow_import: state};
+};
+const check = state => checkWorkflowImport(fixture, state, id);
+// The isolated answers: no namespace sees or changes another's runs.
+const intended = JSON.parse(JSON.stringify(fixture.workflow_import.expected).replaceAll('{id}', id));
+
+test('the published 2.11.1 recording satisfies the contract', () => {
+  assert.deepStrictEqual(check(observation()), {scope: 'workflow_import'});
+});
+
+test('the isolated cross-namespace answers are accepted too', () => {
+  assert.deepStrictEqual(check(observation(() => {}, intended)), {scope: 'workflow_import'});
+  assert.equal(intended.duplicate_other_namespace.status, 422);
+  assert.deepStrictEqual(intended.duplicate_other_namespace.response.eligibility.errors.map(error => error.rule), ['target.run_id_conflict']);
+  assert.equal(intended.attach.status, 422);
+  assert.deepStrictEqual(intended.attach_source_describe_after, recorded.attach_source_describe_before);
+});
+
+test('embedded applications are explicitly inapplicable', () => {
+  assert.deepStrictEqual(check({mode: 'embedded', workflow_import:
+    {applicable: false, reason: 'embedded_has_no_http_workflow_import'}}), {scope: 'workflow_import'});
+});
+
+const rows = step => step.response.rows;
+for (const [label, change, message] of [
+  // Native answered 501 for the import route before this fixture.
+  ['an unimplemented route', state => {
+    state.import = {status: 501, response: {reason: 'rust_capability_not_implemented'}};
+  }, /workflow import import/],
+  ['only part of the published attach defect', state => {
+    state.attach = structuredClone(intended.attach);
+  }, /workflow import attach_source_describe_after/],
+  ['a cross-namespace duplicate that writes a second run', state => {
+    state.duplicate_other_namespace = structuredClone(state.import);
+  }, /workflow import duplicate_other_namespace/],
+  ['a dry run that estimates memos', state => {
+    rows(state.dry_run).workflow_memos = 2;
+  }, /workflow import dry_run/],
+  ['a repeat with another import_id imported again', state => {
+    state.duplicate = structuredClone(state.signature_verified);
+  }, /workflow import duplicate/],
+  ['an import_id kept with its whitespace', state => {
+    state.import.response.import_id = '  imp-1  ';
+  }, /workflow import import/],
+  ['a dry run of an imported bundle answered dry_run', state => {
+    state.duplicate_dry_run.response.status = 'dry_run';
+  }, /workflow import duplicate_dry_run/],
+  ['a checksum over the request before normalization', state => {
+    state.normalized_checksum = structuredClone(state.unnormalized_checksum);
+  }, /workflow import normalized_checksum/],
+  ['a canonical form that leaves unicode unescaped', state => {
+    const integrity = state.import.response.integrity;
+    integrity.integrity.recomputed_checksum = '0'.repeat(64);
+    integrity.integrity.checksum_matches = false;
+  }, /workflow import import/],
+  ['string redaction paths refused', state => {
+    state.redaction_string_paths = structuredClone(state.redaction_object_paths);
+  }, /workflow import redaction_string_paths/],
+  ['identity errors in the verifier order', state => {
+    state.identity_missing.response.eligibility.errors.splice(1, 2,
+      ...state.identity_missing.response.eligibility.errors.slice(1, 3).reverse());
+  }, /workflow import identity_missing/],
+  ['every leased task and running attempt reported', state => {
+    const errors = state.leased_task.response.eligibility.errors;
+    errors.push(...state.running_attempt.response.eligibility.errors);
+  }, /workflow import leased_task/],
+  ['a failed write that leaves the run', state => {
+    state.write_failed_describe = structuredClone(state.read_describe);
+  }, /workflow import write_failed_describe/],
+  ['an unrequired signature reported as required', state => {
+    state.signature_verified = structuredClone(state.signature_required_no_key);
+  }, /workflow import signature_verified/],
+  ['a missing step', state => {
+    delete state.read_history;
+  }, /workflow import read_history/],
+  ['an extra step', state => {
+    state.extra = {status: 200};
+  }, /workflow import steps/],
+]) {
+  test(`the contract refuses ${label}`, () => {
+    assert.throws(() => check(observation(change)), message);
+  });
+}

From 2c99051895e8f18db519c6f2d2bb7f50783b681d Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 00:34:16 +0000
Subject: [PATCH 2/9] Rust #325: import embedded v2 histories like Server
 2.11.1

Native now serves POST /api/workflows/import/embedded-v2 as published
Server 2.11.1 does with Workflow 2.10.2 (EmbeddedV2ImportController and
EmbeddedV2HistoryImport):

- The request is read as PHP reads it: json_decode with PHP's key types,
  order and int/float rules, Laravel's TrimStrings and
  ConvertEmptyStringsToNull, and options from the body, then the query.
- BundleIntegrityVerifier's report keeps PHP's check order, rules,
  messages, paths and contexts. The checksum and HMAC-SHA256 signature are
  computed over PHP's canonical JSON and compared in constant time.
- The eligibility rules, the dry run, idempotent and conflicting repeats,
  and the write of every bundle section run in one transaction. The run's
  summary is projected from the imported rows, with the embedded import's
  engine source.
- The route is admin-only and writes into the requested namespace. A
  bundle counts as already imported only in that namespace; a run id held
  in another namespace is a run_id_conflict, and an instance of another
  namespace is refused rather than taken over. The fixture bounds the
  published cross-namespace answers as defects.
- JSON objects and Avro maps are parsed in linear time; a repeated key
  keeps its first position with the last value, as in PHP.

Two shared reads now match published 2.11.1 for every run, which the
import fixture exposed:

- Describe shows the reason each command's payload records
  (commandReason) when the command was not rejected. Only inline payloads
  up to 8 KiB are read; every writer caps the reason at 1000 characters.
- History reports the run's compatibility, compatibility_status,
  compatibility_supported_in_fleet and compatibility_fleet_reason, as
  HistoryController::show does, and the control plane carries
  compatibility.

Three stale unit expectations are corrected: published PHP's canonical
JSON (JSON_UNESCAPED_SLASHES | JSON_PRESERVE_ZERO_FRACTION) and
json_encode both escape non-ASCII characters and line separators.

Qualified locally: the workflow-import fixture recorded from published
2.11.1 passes against native on SQLite, PostgreSQL 17, MySQL 8.0 and
MariaDB 10.11; every shared fixture passes against native on SQLite; and
the SQLite all-targets suite passes (265 unit, 454 execution).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 rust/src/codec.rs                       |    2 +-
 rust/src/runtime/bundle_verifier.rs     |  765 +++++++++++++
 rust/src/runtime/control_plane.rs       |    6 +-
 rust/src/runtime/execution.rs           |   10 +
 rust/src/runtime/external_resolution.rs |   17 +
 rust/src/runtime/http.rs                |   21 +-
 rust/src/runtime/mod.rs                 |    3 +
 rust/src/runtime/php_value.rs           |  644 +++++++++++
 rust/src/runtime/run_describe.rs        |   33 +-
 rust/src/runtime/store.rs               |   37 +-
 rust/src/runtime/terminal_summary.rs    |   17 +-
 rust/src/runtime/workflow_import.rs     | 1320 +++++++++++++++++++++++
 12 files changed, 2852 insertions(+), 23 deletions(-)
 create mode 100644 rust/src/runtime/bundle_verifier.rs
 create mode 100644 rust/src/runtime/php_value.rs
 create mode 100644 rust/src/runtime/workflow_import.rs

diff --git a/rust/src/codec.rs b/rust/src/codec.rs
index e4480854f..c32bcc913 100644
--- a/rust/src/codec.rs
+++ b/rust/src/codec.rs
@@ -26,7 +26,7 @@ const PHP_BASE64: GeneralPurpose = GeneralPurpose::new(
 
 /// Decodes a blob as published PHP does: ASCII whitespace is skipped, and
 /// any padding must be exactly what the final quantum needs.
-fn php_base64(blob: &str) -> Result<Vec<u8>, base64::DecodeError> {
+pub(crate) fn php_base64(blob: &str) -> Result<Vec<u8>, base64::DecodeError> {
     let compact: String = blob.chars().filter(|c| !matches!(c, ' ' | '\t' | '\n' | '\r')).collect();
     let unpadded = compact.trim_end_matches('=');
     let padding = compact.len() - unpadded.len();
diff --git a/rust/src/runtime/bundle_verifier.rs b/rust/src/runtime/bundle_verifier.rs
new file mode 100644
index 000000000..95940e9c8
--- /dev/null
+++ b/rust/src/runtime/bundle_verifier.rs
@@ -0,0 +1,765 @@
+//! `BundleIntegrityVerifier` (Workflow 2.10.2, as published Server 2.11.1
+//! ships it): the offline integrity report of a history-export bundle, over
+//! the document PHP decoded and Laravel normalized. Findings keep PHP's check
+//! order, rules, messages, paths and contexts; the checksum and signature are
+//! computed over PHP's canonical JSON.
+use super::history_export::{SCHEMA, VALUE_FINGERPRINT};
+use super::php_value::{CANONICAL, Flags, Key, Php, PhpArray};
+use base64::{Engine, engine::general_purpose::STANDARD};
+use hmac::{Hmac, KeyInit, Mac};
+use serde_json::{Map, Value, json};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeMap;
+
+const SCHEMA_VERSION: i64 = 2;
+const ERROR: &str = "error";
+const WARNING: &str = "warning";
+const INFO: &str = "info";
+
+/// `MemoPayload::KEY_PATTERN`.
+const MEMO_KEY_PATTERN: &str = "^(?!-?[0-9]+$)[A-Za-z0-9_.:-]{1,64}$";
+
+fn string_value(value: Option<&Php>) -> Option<&str> {
+    value.and_then(Php::str).filter(|text| !text.is_empty())
+}
+
+/// The verifier's `intValue`: an integer, or a string that is exactly one.
+fn int_value(value: Option<&Php>) -> Option<i64> {
+    match value? {
+        Php::Int(number) => Some(*number),
+        Php::Str(text) => text.parse::<i64>().ok().filter(|number| number.to_string() == *text),
+        _ => None,
+    }
+}
+
+fn array(value: Option<&Php>) -> Option<&PhpArray> {
+    value.and_then(Php::array)
+}
+
+struct Findings(Vec<Value>);
+
+impl Findings {
+    fn add(&mut self, rule: &str, severity: &str, message: String, path: Option<String>, context: Value) {
+        let context = if context.as_object().is_some_and(Map::is_empty) { json!([]) } else { context };
+        self.0.push(json!({"rule":rule,"severity":severity,"message":message,"path":path,"context":context}));
+    }
+
+    fn error(&mut self, rule: &str, message: impl Into<String>, path: impl Into<String>) {
+        self.add(rule, ERROR, message.into(), Some(path.into()), json!({}));
+    }
+}
+
+/// The verification report and its status.
+pub(super) struct Verification {
+    pub(super) report: Value,
+    pub(super) status: &'static str,
+    /// The decoded memo entries, when `workflow.memo_payload` decoded.
+    pub(super) memo_entries: Option<Vec<(String, Decoded)>>,
+}
+
+/// `BundleIntegrityVerifier::verify`.
+pub(super) fn verify(bundle: &PhpArray, signing_key: Option<&str>, configured_key: Option<&str>) -> Verification {
+    let mut findings = Findings(Vec::new());
+    let root = Php::Array(bundle.clone());
+    check_schema(bundle, &mut findings);
+    check_required_sections(bundle, &mut findings);
+    let memo_entries = check_run_references(&root, &mut findings);
+    check_payload_manifest(&root, &mut findings);
+    check_history_events(&root, &mut findings);
+    check_command_history_consistency(&root, &mut findings);
+    check_redaction(&root, &mut findings);
+    let mut unsigned = bundle.clone();
+    unsigned.remove("integrity");
+    let integrity = check_integrity(bundle.get("integrity"), &unsigned, signing_key.or(configured_key), &mut findings);
+    let summary_bundle = json!({
+        "schema": string_value(bundle.get("schema")),
+        "schema_version": int_value(bundle.get("schema_version")),
+        "exported_at": string_value(bundle.get("exported_at")),
+        "dedupe_key": string_value(bundle.get("dedupe_key")),
+        "workflow_run_id": string_value(root.at(&["workflow", "run_id"])),
+        "workflow_instance_id": string_value(root.at(&["workflow", "instance_id"])),
+        "history_event_count": array(bundle.get("history_events")).map_or(0, PhpArray::len),
+    });
+    let status = if findings.0.iter().any(|finding| finding["severity"] == ERROR) {
+        "failed"
+    } else if findings.0.iter().any(|finding| finding["severity"] == WARNING) {
+        "warning"
+    } else {
+        "ok"
+    };
+    let mut by_rule: BTreeMap<String, i64> = BTreeMap::new();
+    let mut counts = [0i64; 3];
+    for finding in &findings.0 {
+        *by_rule.entry(finding["rule"].as_str().unwrap_or_default().to_owned()).or_default() += 1;
+        match finding["severity"].as_str() {
+            Some(ERROR) => counts[0] += 1,
+            Some(WARNING) => counts[1] += 1,
+            Some(INFO) => counts[2] += 1,
+            _ => {}
+        }
+    }
+    let by_rule = if by_rule.is_empty() { json!([]) } else { json!(by_rule) };
+    Verification {
+        report: json!({
+            "schema": "durable-workflow.v2.history-bundle-verification",
+            "schema_version": 1,
+            "status": status,
+            "bundle": summary_bundle,
+            "integrity": integrity,
+            "summary": {"errors":counts[0],"warnings":counts[1],"info":counts[2],"findings_by_rule":by_rule},
+            "findings": findings.0,
+        }),
+        status,
+        memo_entries,
+    }
+}
+
+fn check_schema(bundle: &PhpArray, findings: &mut Findings) {
+    match string_value(bundle.get("schema")) {
+        None => findings.error("bundle.schema_missing", "Bundle is missing the schema field.", "schema"),
+        Some(schema) if schema != SCHEMA => findings.add("bundle.schema_unexpected", ERROR,
+            format!("Bundle schema [{schema}] does not match expected [{SCHEMA}]."), Some("schema".into()),
+            json!({"expected":SCHEMA,"actual":schema})),
+        Some(_) => {}
+    }
+    match int_value(bundle.get("schema_version")) {
+        None => findings.error("bundle.schema_version_missing", "Bundle is missing schema_version.", "schema_version"),
+        Some(version) if version != SCHEMA_VERSION => findings.add("bundle.schema_version_unsupported", ERROR,
+            format!("Bundle schema_version {version} is not the v2 history-export structural marker ({SCHEMA_VERSION}); the v2 bundle shape is frozen and a different value indicates a parallel primitive that this verifier does not recognize."),
+            Some("schema_version".into()), json!({"expected":SCHEMA_VERSION,"actual":version})),
+        Some(_) => {}
+    }
+    if string_value(bundle.get("exported_at")).is_none() {
+        findings.add("bundle.exported_at_missing", WARNING,
+            "Bundle is missing exported_at; replay reports cannot be ordered without it.".into(), Some("exported_at".into()), json!({}));
+    }
+}
+
+fn check_required_sections(bundle: &PhpArray, findings: &mut Findings) {
+    for (key, shape) in [
+        ("workflow", "object"), ("payloads", "object"), ("history_events", "list"), ("commands", "list"),
+        ("signals", "list"), ("updates", "list"), ("tasks", "list"), ("activities", "list"), ("timers", "list"),
+        ("failures", "list"), ("links", "object"), ("redaction", "object"), ("codec_schemas", "object"),
+        ("payload_manifest", "object"),
+    ] {
+        match bundle.get(key) {
+            None => findings.error("bundle.section_missing", format!("Bundle is missing required section [{key}]."), key),
+            Some(value) if !value.is_array() => {
+                findings.error("bundle.section_invalid", format!("Bundle section [{key}] must be {}.",
+                    if shape == "object" { "an object" } else { "a list" }), key);
+            }
+            Some(_) => {}
+        }
+    }
+}
+
+/// `checkRunReferences`. Returns the decoded memo entries for the writer.
+fn check_run_references(bundle: &Php, findings: &mut Findings) -> Option<Vec<(String, Decoded)>> {
+    let empty = Php::Array(PhpArray::default());
+    let workflow = bundle.get("workflow").filter(|value| value.is_array()).unwrap_or(&empty);
+    if string_value(workflow.get("run_id")).is_none() {
+        findings.error("workflow.run_id_missing", "Bundle workflow.run_id is required.", "workflow.run_id");
+    }
+    if string_value(workflow.get("instance_id")).is_none() {
+        findings.error("workflow.instance_id_missing", "Bundle workflow.instance_id is required.", "workflow.instance_id");
+    }
+    if string_value(workflow.get("workflow_type")).is_none() {
+        findings.error("workflow.workflow_type_missing", "Bundle workflow.workflow_type is required.", "workflow.workflow_type");
+    }
+    let redacted = |path: &str| {
+        array(bundle.at(&["redaction", "paths"]))
+            .is_some_and(|paths| paths.values().any(|value| value.str() == Some(path)))
+    };
+    let (payload_redacted, projection_redacted) = (redacted("workflow.memo_payload"), redacted("workflow.memo"));
+    let mut entries = None;
+    match workflow.get("memo_payload") {
+        _ if payload_redacted => {}
+        Some(Php::Array(payload)) => match decode_entries(payload) {
+            Ok(decoded) => {
+                if !projection_redacted {
+                    let projection = project_entries(&decoded);
+                    if !workflow.get("memo").unwrap_or(&Php::Null).identical(&projection) {
+                        findings.error("workflow.memo_projection_mismatch",
+                            "Bundle workflow.memo does not match the JSON-safe projection of workflow.memo_payload.", "workflow.memo");
+                    }
+                }
+                entries = Some(decoded);
+            }
+            Err(message) => findings.error("workflow.memo_payload_invalid",
+                format!("Bundle workflow.memo_payload is not a valid portable Avro memo map: {message}"), "workflow.memo_payload"),
+        },
+        _ => findings.error("workflow.memo_payload_missing",
+            "Bundle workflow.memo_payload must contain the lossless portable Avro memo authority.", "workflow.memo_payload"),
+    }
+    let last = int_value(workflow.get("last_history_sequence"));
+    let highest = array(bundle.get("history_events")).and_then(|events| {
+        events.values().filter(|event| event.is_array()).filter_map(|event| int_value(event.get("sequence"))).max()
+    });
+    if let (Some(last), Some(highest)) = (last, highest)
+        && last < highest
+    {
+        findings.add("workflow.last_history_sequence_stale", WARNING,
+            format!("Workflow last_history_sequence ({last}) is below the highest recorded event sequence ({highest}); the bundle may be truncated."),
+            Some("workflow.last_history_sequence".into()), json!({"last_history_sequence":last,"highest_history_sequence":highest}));
+    }
+    entries
+}
+
+fn check_payload_manifest(bundle: &Php, findings: &mut Findings) {
+    let Some(manifest) = array(bundle.get("payload_manifest")) else {
+        return;
+    };
+    let schema = crate::codec::VALUE_SCHEMA.trim();
+    let fingerprint = format!("crc64-avro:{VALUE_FINGERPRINT}");
+    if let Some(entries) = array(manifest.get("entries")) {
+        for (index, entry) in &entries.0 {
+            let fallback = format!("payload_manifest.entries[{}]", index.text());
+            let Some(_) = entry.array() else {
+                findings.error("payload_manifest.entry_invalid", "Payload manifest entry must be an object.", fallback);
+                continue;
+            };
+            let path = string_value(entry.get("path")).map_or(fallback, str::to_owned);
+            let codec = string_value(entry.get("codec"));
+            let available = entry.get("available").is_some_and(Php::truthy);
+            let redacted = entry.get("redacted").is_some_and(Php::truthy);
+            let diagnostic = string_value(entry.get("diagnostic"));
+            if codec.is_none() {
+                findings.error("payload_manifest.codec_missing", format!("Payload manifest entry [{path}] is missing codec."), path.clone());
+            }
+            if !redacted && available && diagnostic == Some("payload_missing") {
+                findings.error("payload_manifest.payload_missing",
+                    format!("Manifest reports payload [{path}] available but bundle has no payload bytes."), path.clone());
+            }
+            if codec == Some("avro") && available && !redacted && diagnostic != Some("external_storage_reference") {
+                if string_value(entry.get("avro_framing")).is_none() {
+                    findings.add("payload_manifest.avro_framing_missing", WARNING,
+                        format!("Avro payload [{path}] is missing framing metadata; offline decoders cannot pick a wrapper schema."),
+                        Some(path.clone()), json!({}));
+                }
+                if let (Some(writer), Some(actual)) =
+                    (string_value(entry.get("writer_schema")), string_value(entry.get("writer_schema_fingerprint")))
+                {
+                    let expected = (writer == schema).then(|| fingerprint.clone());
+                    if expected.as_deref() != Some(actual) {
+                        findings.add("payload_manifest.writer_schema_fingerprint_mismatch", ERROR,
+                            format!("Avro payload [{path}] writer_schema_fingerprint disagrees with the embedded schema; offline decoders will reject this entry."),
+                            Some(path.clone()), json!({"expected":expected,"actual":actual}));
+                    }
+                }
+            }
+        }
+    }
+    let Some(codec_schemas) = array(bundle.get("codec_schemas")) else {
+        return;
+    };
+    let Some(avro) = array(codec_schemas.get("avro")) else {
+        return;
+    };
+    let current = string_value(avro.get("current_fingerprint"));
+    let entry = current.and_then(|current| array(avro.get("writer_schemas")).and_then(|schemas| array(schemas.get(current))));
+    match (current, entry) {
+        (Some(current), Some(entry)) if current == VALUE_FINGERPRINT => {
+            let same = |field: &str, expected: &str| entry.get(field).and_then(Php::str) == Some(expected);
+            if !same("schema", schema) || !same("fingerprint", &fingerprint) {
+                findings.error("codec_schemas.value_schema_drift", "Bundled Avro Value schema or fingerprint differs from this runtime.",
+                    format!("codec_schemas.avro.writer_schemas.{current}"));
+            }
+        }
+        _ => findings.error("codec_schemas.value_schema_missing", "Avro codec metadata does not bundle the current Value writer schema.",
+            "codec_schemas.avro.writer_schemas"),
+    }
+}
+
+fn check_history_events(bundle: &Php, findings: &mut Findings) {
+    let Some(events) = array(bundle.get("history_events")) else {
+        return;
+    };
+    let mut previous: Option<i64> = None;
+    let mut seen: BTreeMap<String, String> = BTreeMap::new();
+    for (index, event) in &events.0 {
+        let path = format!("history_events[{}]", index.text());
+        if !event.is_array() {
+            findings.error("history_events.entry_invalid", "History event entry must be an object.", path);
+            continue;
+        }
+        let sequence = int_value(event.get("sequence"));
+        match (sequence, previous) {
+            (None, _) => findings.error("history_events.sequence_missing", "History event is missing sequence.", path.clone()),
+            (Some(sequence), Some(previous)) if sequence <= previous => findings.add("history_events.sequence_not_monotonic", ERROR,
+                format!("History event sequence {sequence} does not advance past previous sequence {previous}."), Some(path.clone()),
+                json!({"sequence":sequence,"previous_sequence":previous})),
+            _ => {}
+        }
+        if sequence.is_some() {
+            previous = sequence;
+        }
+        if string_value(event.get("type")).is_none() {
+            findings.error("history_events.type_missing", "History event is missing type.", path.clone());
+        }
+        if let Some(id) = string_value(event.get("id")) {
+            match seen.get(id) {
+                Some(first) => findings.add("history_events.id_duplicate", ERROR, format!("History event id [{id}] appears more than once."),
+                    Some(path.clone()), json!({"id":id,"first_seen_at":first})),
+                None => {
+                    seen.insert(id.to_owned(), path.clone());
+                }
+            }
+        }
+    }
+}
+
+fn check_command_history_consistency(bundle: &Php, findings: &mut Findings) {
+    let mut referenced: BTreeMap<&str, usize> = BTreeMap::new();
+    if let Some(events) = array(bundle.get("history_events")) {
+        for event in events.values().filter(|event| event.is_array()) {
+            if let Some(command) = string_value(event.get("workflow_command_id")) {
+                *referenced.entry(command).or_default() += 1;
+            }
+        }
+    }
+    let Some(commands) = array(bundle.get("commands")) else {
+        return;
+    };
+    for (index, command) in &commands.0 {
+        let path = format!("commands[{}]", index.text());
+        if !command.is_array() {
+            findings.error("commands.entry_invalid", "Command row must be an object.", path);
+            continue;
+        }
+        let text = |field: &str| string_value(command.get(field));
+        let Some(id) = text("id") else {
+            findings.error("commands.id_missing", "Command row is missing id.", path);
+            continue;
+        };
+        let (status, outcome) = (text("status"), text("outcome"));
+        let settled = matches!(status, Some("applied" | "rejected")) || matches!(outcome, Some("applied" | "rejected"))
+            || text("applied_at").is_some() || text("rejected_at").is_some();
+        if settled && !referenced.contains_key(id) {
+            findings.add("commands.history_event_missing", WARNING,
+                format!("Command [{id}] is settled (status={}, outcome={}) but no history event references it.",
+                    status.unwrap_or("null"), outcome.unwrap_or("null")),
+                Some(path), json!({"command_id":id,"status":status,"outcome":outcome}));
+        }
+    }
+}
+
+fn check_redaction(bundle: &Php, findings: &mut Findings) {
+    let Some(redaction) = array(bundle.get("redaction")) else {
+        return;
+    };
+    let applied = redaction.get("applied").is_some_and(Php::truthy);
+    let empty = array(redaction.get("paths")).is_none_or(PhpArray::is_empty);
+    if applied && empty {
+        findings.add("redaction.empty_paths", INFO,
+            "Redaction is marked applied but no paths were redacted; replay-diff diagnostics will treat all payloads as in-scope.".into(),
+            Some("redaction.paths".into()), json!({}));
+    }
+}
+
+/// `canonicalJson` of the bundle without its integrity block.
+pub(super) fn canonical_json(unsigned: &PhpArray) -> String {
+    Php::Array(unsigned.clone()).canonical().encode(CANONICAL)
+}
+
+pub(super) fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
+}
+
+pub(super) fn hmac(canonical: &str, key: &str) -> String {
+    let mut mac = Hmac::<Sha256>::new_from_slice(key.as_bytes()).expect("HMAC takes any key length");
+    mac.update(canonical.as_bytes());
+    hex(&mac.finalize().into_bytes())
+}
+
+/// `hash_equals`.
+fn equal(left: &str, right: &str) -> bool {
+    use subtle::ConstantTimeEq;
+    left.len() == right.len() && bool::from(left.as_bytes().ct_eq(right.as_bytes()))
+}
+
+fn check_integrity(raw: Option<&Php>, unsigned: &PhpArray, key: Option<&str>, findings: &mut Findings) -> Value {
+    let mut report = json!({"present":false,"canonicalization":null,"checksum_algorithm":null,"expected_checksum":null,
+        "recomputed_checksum":null,"checksum_matches":null,"signature_algorithm":null,"signature_present":false,
+        "signature_verified":null,"key_id":null});
+    let Some(raw) = raw.filter(|raw| raw.is_array()) else {
+        findings.error("integrity.missing", "Bundle has no integrity block; offline replay verification cannot vouch for its contents.", "integrity");
+        return report;
+    };
+    let text = |field: &str| string_value(raw.get(field)).map(str::to_owned);
+    let canonicalization = text("canonicalization");
+    let algorithm = text("checksum_algorithm");
+    let expected = text("checksum");
+    let signature_algorithm = text("signature_algorithm");
+    let signature = text("signature");
+    report["present"] = json!(true);
+    report["canonicalization"] = json!(canonicalization);
+    report["checksum_algorithm"] = json!(algorithm);
+    report["expected_checksum"] = json!(expected);
+    report["signature_algorithm"] = json!(signature_algorithm);
+    report["key_id"] = json!(text("key_id"));
+    report["signature_present"] = json!(signature.is_some());
+    if canonicalization.as_deref() != Some("json-recursive-ksort-v1") {
+        findings.error("integrity.canonicalization_unsupported", format!(
+            "Unsupported canonicalization [{}]; only json-recursive-ksort-v1 is recognized offline.",
+            canonicalization.as_deref().unwrap_or("null")), "integrity.canonicalization");
+        return report;
+    }
+    if algorithm.as_deref() != Some("sha256") {
+        findings.error("integrity.checksum_algorithm_unsupported", format!(
+            "Unsupported checksum algorithm [{}]; only sha256 is recognized.", algorithm.as_deref().unwrap_or("null")),
+            "integrity.checksum_algorithm");
+        return report;
+    }
+    let canonical = canonical_json(unsigned);
+    let recomputed = hex(&Sha256::digest(canonical.as_bytes()));
+    report["recomputed_checksum"] = json!(recomputed);
+    match &expected {
+        None => {
+            findings.error("integrity.checksum_missing", "Integrity block is missing checksum.", "integrity.checksum");
+            report["checksum_matches"] = json!(false);
+        }
+        Some(expected) => {
+            let matches = equal(expected, &recomputed);
+            report["checksum_matches"] = json!(matches);
+            if !matches {
+                findings.add("integrity.checksum_mismatch", ERROR,
+                    "Recomputed bundle checksum does not match the recorded checksum; the bundle has been altered after export.".into(),
+                    Some("integrity.checksum".into()), json!({"expected":expected,"actual":recomputed}));
+            }
+        }
+    }
+    if signature_algorithm.is_none() && signature.is_none() {
+        return report;
+    }
+    if signature_algorithm.as_deref() != Some("hmac-sha256") {
+        findings.error("integrity.signature_algorithm_unsupported", format!(
+            "Unsupported signature algorithm [{}]; only hmac-sha256 is recognized.", signature_algorithm.as_deref().unwrap_or("null")),
+            "integrity.signature_algorithm");
+        return report;
+    }
+    let Some(signature) = signature else {
+        findings.error("integrity.signature_missing", "Integrity block declares a signature_algorithm but carries no signature.", "integrity.signature");
+        return report;
+    };
+    let Some(key) = key else {
+        findings.add("integrity.signature_key_unavailable", WARNING,
+            "Bundle is signed but no verification key is configured; signature was not verified.".into(),
+            Some("integrity.signature".into()), json!({}));
+        return report;
+    };
+    let verified = equal(&hmac(&canonical, key), &signature);
+    report["signature_verified"] = json!(verified);
+    if !verified {
+        findings.add("integrity.signature_mismatch", ERROR,
+            "Bundle signature does not match the configured key; treat the bundle as untrusted.".into(),
+            Some("integrity.signature".into()), json!({"key_id":report["key_id"]}));
+    }
+    report
+}
+
+/// A value `Avro::unserialize` returns for the fixed Value schema: PHP
+/// scalars, bytes, lists, string-keyed maps, and the map adapter PHP uses
+/// for an empty map or one with integer-like keys.
+#[derive(Clone, Debug)]
+pub(super) enum Decoded {
+    Null,
+    Bool(bool),
+    Long(i64),
+    Double(f64),
+    Bytes(Vec<u8>),
+    Str(String),
+    List(Vec<Decoded>),
+    Map(Vec<(String, Decoded)>),
+    MapAdapter(Vec<(String, Decoded)>),
+}
+
+impl Decoded {
+    /// The protocol value, for re-encoding the canonical envelope.
+    pub(super) fn protocol(&self) -> crate::codec::Value {
+        use crate::codec::Value as Wire;
+        match self {
+            Self::Null => Wire::Null,
+            Self::Bool(flag) => Wire::Boolean(*flag),
+            Self::Long(number) => Wire::Long(*number),
+            Self::Double(number) => Wire::Double(*number),
+            Self::Bytes(bytes) => Wire::Bytes(bytes.clone()),
+            Self::Str(text) => Wire::String(text.clone()),
+            Self::List(items) => Wire::Array(items.iter().map(Self::protocol).collect()),
+            Self::Map(pairs) | Self::MapAdapter(pairs) => {
+                Wire::Map(pairs.iter().map(|(key, value)| (key.clone(), value.protocol())).collect())
+            }
+        }
+    }
+
+    /// `AvroValueJsonProjection::project`.
+    pub(super) fn project(&self) -> Php {
+        let list = |items: Vec<Php>| Php::Array(PhpArray(items.into_iter().enumerate().map(|(index, value)| (Key::Int(index as i64), value)).collect()));
+        let map = |pairs: Vec<(&str, Php)>| Php::Array(PhpArray(pairs.into_iter().map(|(key, value)| (Key::of(key), value)).collect()));
+        match self {
+            Self::Null => Php::Null,
+            Self::Bool(flag) => Php::Bool(*flag),
+            Self::Long(number) => Php::Int(*number),
+            Self::Double(number) => Php::Float(*number),
+            Self::Str(text) => Php::Str(text.clone()),
+            Self::Bytes(bytes) => map(vec![("$type", Php::Str("bytes".into())), ("base64", Php::Str(STANDARD.encode(bytes)))]),
+            Self::List(items) => list(items.iter().map(Self::project).collect()),
+            Self::Map(pairs) => map(pairs.iter().map(|(key, value)| (key.as_str(), value.project())).collect()),
+            Self::MapAdapter(pairs) => map(vec![
+                ("$type", Php::Str("map".into())),
+                ("entries", list(pairs.iter().map(|(key, value)| map(vec![("key", Php::Str(key.clone())), ("value", value.project())])).collect())),
+            ]),
+        }
+    }
+}
+
+/// The JSON-safe projection of decoded memo entries.
+pub(super) fn project_entries(entries: &[(String, Decoded)]) -> Php {
+    Php::Array(PhpArray(entries.iter().map(|(key, value)| (Key::of(key), value.project())).collect()))
+}
+
+/// `MemoPayload::decodeEntries`: the entries of a `{codec, blob}` memo map,
+/// or PHP's exception message.
+pub(super) fn decode_entries(envelope: &PhpArray) -> Result<Vec<(String, Decoded)>, String> {
+    let mut keys: Vec<String> = envelope.0.iter().map(|(key, _)| key.text()).collect();
+    keys.sort();
+    let keys_are_strings = envelope.0.iter().all(|(key, _)| matches!(key, Key::Str(_)));
+    if !keys_are_strings || keys != ["blob", "codec"] {
+        return Err("invalid_memo_payload: expected exactly the standard {codec, blob} payload envelope.".into());
+    }
+    match envelope.get("codec") {
+        Some(Php::Str(codec)) if codec.is_empty() || codec == "avro" => {}
+        Some(Php::Str(codec)) => return Err(format!("unsupported_payload_codec: payload codec \"{codec}\" is not supported by Durable Workflow 2.0; use codec=\"avro\" with the fixed Avro Value schema and single-object framing. JSON remains the HTTP document transport, not a workflow payload codec.")),
+        _ => return Err("unsupported_payload_codec: memo payloads require codec \"avro\".".into()),
+    }
+    let Some(blob) = envelope.get("blob").and_then(Php::str).filter(|blob| !blob.is_empty()) else {
+        return Err("invalid_memo_payload: the Avro envelope blob must be a non-empty string.".into());
+    };
+    match unserialize(blob)? {
+        // The decoder already merged repeated keys.
+        Decoded::MapAdapter(pairs) => match pairs.iter().find(|(key, _)| !memo_key(key)) {
+            Some((key, _)) => Err(format!("invalid_memo_key: memo key \"{key}\" does not match the portable key pattern {MEMO_KEY_PATTERN}.")),
+            None => Ok(pairs),
+        },
+        Decoded::Map(pairs) => Ok(pairs),
+        _ => Err("invalid_memo_entries_payload: the Avro memo payload must decode to a string-keyed map.".into()),
+    }
+}
+
+fn memo_key(key: &str) -> bool {
+    let digits = key.strip_prefix('-').unwrap_or(key);
+    let integer_like = !digits.is_empty() && digits.bytes().all(|byte| byte.is_ascii_digit());
+    !integer_like && (1..=64).contains(&key.len()) && key.bytes().all(|byte| byte.is_ascii_alphanumeric() || b"_.:-".contains(&byte))
+}
+
+fn codec_error(detail: &str, remediation: &str) -> String {
+    format!("{detail} Remediation: {remediation}")
+}
+
+/// `Avro::unserialize` for one single-object frame of the Value schema, in
+/// the frame's map order.
+pub(super) fn unserialize(blob: &str) -> Result<Decoded, String> {
+    let malformed = || codec_error("invalid_payload_framing: malformed Avro Value datum.",
+        "Provide one complete datum encoded with the writer schema selected by the single-object fingerprint.");
+    let Ok(bytes) = crate::codec::php_base64(blob) else {
+        let first = blob.chars().next().unwrap_or(' ');
+        return Err(if matches!(first, '{' | '[' | '"' | '-' | 't' | 'f' | 'n' | '0'..='9') {
+            codec_error("invalid_payload_framing: payload bytes look like JSON, not base64-encoded Avro.",
+                "Encode the value with the fixed Avro Value codec; JSON is only the HTTP document transport.")
+        } else {
+            codec_error("invalid_payload_framing: failed to base64-decode Avro payload bytes.",
+                "Avro payloads must be strict base64 containing a c301 single-object frame.")
+        });
+    };
+    if bytes.len() < 10 || !bytes.starts_with(&[0xc3, 0x01]) {
+        return Err(codec_error("invalid_payload_framing: expected Avro single-object magic c301.",
+            "Encode the value with the Durable Workflow 2.0 fixed Avro Value schema and single-object framing; JSON is only the HTTP document transport."));
+    }
+    let fingerprint = hex(&bytes[2..10]);
+    if fingerprint != VALUE_FINGERPRINT {
+        return Err(codec_error(&format!("unsupported_payload_schema: unknown CRC-64-AVRO fingerprint {fingerprint}."),
+            "Upgrade to a runtime that bundles this writer schema; never guess or fall back to JSON."));
+    }
+    let mut reader = Reader { bytes: &bytes[10..], at: 0, truncated: false };
+    let value = reader.value(0);
+    if reader.truncated {
+        return Err(codec_error("invalid_payload_framing: truncated Avro Value datum.",
+            "Provide one complete Avro Value datum after the single-object fingerprint."));
+    }
+    let value = value.ok_or_else(malformed)?;
+    if reader.at != reader.bytes.len() {
+        return Err(codec_error("invalid_payload_framing: trailing bytes after Avro Value datum.",
+            "Provide exactly one Avro Value datum in each single-object frame."));
+    }
+    Ok(value)
+}
+
+struct Reader<'a> {
+    bytes: &'a [u8],
+    at: usize,
+    truncated: bool,
+}
+
+impl Reader<'_> {
+    fn take(&mut self, count: usize) -> Option<&[u8]> {
+        if self.bytes.len() - self.at < count {
+            self.truncated = true;
+            return None;
+        }
+        let slice = &self.bytes[self.at..self.at + count];
+        self.at += count;
+        Some(slice)
+    }
+
+    /// A zig-zag varint of at most ten bytes within int64.
+    fn long(&mut self) -> Option<i64> {
+        let mut raw: u64 = 0;
+        for index in 0..10 {
+            let byte = self.take(1)?[0];
+            if index == 9 && byte > 1 {
+                return None;
+            }
+            raw |= u64::from(byte & 0x7f) << (7 * index);
+            if byte & 0x80 == 0 {
+                return Some((raw >> 1) as i64 ^ -((raw & 1) as i64));
+            }
+        }
+        None
+    }
+
+    fn length(&mut self) -> Option<usize> {
+        usize::try_from(self.long()?).ok()
+    }
+
+    fn string(&mut self) -> Option<String> {
+        let length = self.length()?;
+        String::from_utf8(self.take(length)?.to_vec()).ok()
+    }
+
+    /// Each block of items: a count (negative counts carry a byte size).
+    fn blocks(&mut self, depth: usize, mut item: impl FnMut(&mut Self, usize) -> Option<()>) -> Option<()> {
+        loop {
+            let mut count = self.long()?;
+            if count == 0 {
+                return Some(());
+            }
+            if count < 0 {
+                count = count.checked_neg()?;
+                self.long()?;
+            }
+            for _ in 0..count {
+                item(self, depth + 1)?;
+            }
+        }
+    }
+
+    fn value(&mut self, depth: usize) -> Option<Decoded> {
+        if depth > 512 {
+            return None;
+        }
+        Some(match self.long()? {
+            0 => Decoded::Null,
+            1 => match self.take(1)?[0] {
+                0 => Decoded::Bool(false),
+                1 => Decoded::Bool(true),
+                _ => return None,
+            },
+            2 => Decoded::Long(self.long()?),
+            3 => {
+                let value = f64::from_le_bytes(self.take(8)?.try_into().ok()?);
+                if !value.is_finite() {
+                    return None;
+                }
+                Decoded::Double(value)
+            }
+            4 => {
+                let length = self.length()?;
+                Decoded::Bytes(self.take(length)?.to_vec())
+            }
+            5 => Decoded::Str(self.string()?),
+            6 => {
+                let mut items = Vec::new();
+                self.blocks(depth, |reader, depth| {
+                    items.push(reader.value(depth)?);
+                    Some(())
+                })?;
+                Decoded::List(items)
+            }
+            7 => {
+                // Apache's reader assigns `$items[$key] = $value`: a
+                // repeated key keeps its first position.
+                let mut pairs: Vec<(String, Decoded)> = Vec::new();
+                let mut positions: std::collections::HashMap<String, usize> = std::collections::HashMap::new();
+                self.blocks(depth, |reader, depth| {
+                    let key = reader.string()?;
+                    let value = reader.value(depth)?;
+                    let key = Key::of(&key).text();
+                    match positions.get(&key) {
+                        Some(&index) => pairs[index].1 = value,
+                        None => {
+                            positions.insert(key.clone(), pairs.len());
+                            pairs.push((key, value));
+                        }
+                    }
+                    Some(())
+                })?;
+                if pairs.is_empty() || pairs.iter().any(|(key, _)| matches!(Key::of(key), Key::Int(_))) {
+                    Decoded::MapAdapter(pairs)
+                } else {
+                    Decoded::Map(pairs)
+                }
+            }
+            _ => return None,
+        })
+    }
+}
+
+/// `json_encode` of a memo projection as the Server stores it: with
+/// JSON_PRESERVE_ZERO_FRACTION.
+pub(super) fn stored_projection(value: &Decoded) -> Value {
+    serde_json::from_str(&value.project().encode(Flags { zero_fraction: true, ..Flags::default() })).unwrap_or(Value::Null)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn bundle(text: &str) -> PhpArray {
+        super::super::php_value::request_body(text.as_bytes())
+    }
+
+    #[test]
+    fn an_empty_body_reports_php_s_twenty_two_findings() {
+        let verification = verify(&bundle(r#"{"dry_run":true}"#), None, None);
+        let rules: Vec<&str> = verification.report["findings"].as_array().unwrap().iter().map(|f| f["rule"].as_str().unwrap()).collect();
+        assert_eq!(rules.len(), 22);
+        assert_eq!(&rules[..3], ["bundle.schema_missing", "bundle.schema_version_missing", "bundle.exported_at_missing"]);
+        assert_eq!(&rules[17..], ["workflow.run_id_missing", "workflow.instance_id_missing", "workflow.workflow_type_missing",
+            "workflow.memo_payload_missing", "integrity.missing"]);
+        assert_eq!(verification.status, "failed");
+        assert_eq!(verification.report["summary"]["findings_by_rule"]["bundle.section_missing"], 14);
+    }
+
+    #[test]
+    fn memo_payloads_decode_in_frame_order_and_project() {
+        // {"n": 3, "note": "λ rich"} from a published export.
+        let entries = decode_entries(&bundle(r#"{"codec":"avro","blob":"wwHioz3/VYAiNw4EAm4EBghub3RlCg7OuyByaWNoAA=="}"#)).unwrap();
+        assert_eq!(entries.iter().map(|(key, _)| key.as_str()).collect::<Vec<_>>(), ["n", "note"]);
+        assert_eq!(project_entries(&entries).encode(Flags::default()), r#"{"n":3,"note":"\u03bb rich"}"#);
+        assert!(decode_entries(&bundle(r#"{"codec":"avro"}"#)).unwrap_err().starts_with("invalid_memo_payload"));
+        assert!(decode_entries(&bundle(r#"{"codec":"json","blob":"x"}"#)).unwrap_err().starts_with("unsupported_payload_codec: payload codec \"json\""));
+        assert!(unserialize("{}").unwrap_err().contains("look like JSON"));
+        assert!(unserialize("AAAA").unwrap_err().contains("magic c301"));
+    }
+
+    #[test]
+    fn a_repeated_map_key_keeps_its_first_position() {
+        // {"a": 1, "b": 2, "a": 3} as one Avro Value map block.
+        let mut frame = vec![0xc3, 0x01, 0xe2, 0xa3, 0x3d, 0xff, 0x55, 0x80, 0x22, 0x37];
+        frame.extend([0x0e, 0x06, 0x02, b'a', 0x04, 0x02, 0x02, b'b', 0x04, 0x04, 0x02, b'a', 0x04, 0x06, 0x00]);
+        let Decoded::Map(pairs) = unserialize(&STANDARD.encode(frame)).unwrap() else {
+            panic!("a string-keyed map");
+        };
+        let pairs: Vec<_> = pairs.iter().map(|(key, value)| (key.as_str(), if let Decoded::Long(n) = value { *n } else { -1 })).collect();
+        assert_eq!(pairs, [("a", 3), ("b", 2)]);
+    }
+}
diff --git a/rust/src/runtime/control_plane.rs b/rust/src/runtime/control_plane.rs
index 7d0bfdb6d..8467f7058 100644
--- a/rust/src/runtime/control_plane.rs
+++ b/rust/src/runtime/control_plane.rs
@@ -20,6 +20,7 @@ pub(super) enum Operation<'a> {
     Update(&'a str),
     Signal(&'a str),
     Query(&'a str),
+    ImportEmbeddedV2,
 }
 
 impl Operation<'_> {
@@ -136,6 +137,8 @@ impl Operation<'_> {
                 &["workflow_id", "operation_name", "operation_name_field"],
                 &["outcome"],
             ),
+            // PHP defines no contract for the import, so its defaults apply.
+            Self::ImportEmbeddedV2 => ("import_embedded_v2", &[], &[]),
         };
         let mut metadata = json!({"schema":"durable-workflow.v2.control-plane-response", "version":1,
             "operation":operation, "workflow_id":body.get("workflow_id"),
@@ -301,7 +304,7 @@ impl Operation<'_> {
                  selected_run_not_current configured_workflow_type_invalid v1_projection_read_only \
                  backend_lock_pressure control_plane_internal_error",
             ),
-            Self::List | Self::ListRuns | Self::Describe | Self::Observe | Self::Debug => return None,
+            Self::List | Self::ListRuns | Self::Describe | Self::Observe | Self::Debug | Self::ImportEmbeddedV2 => return None,
         })
     }
 }
@@ -315,6 +318,7 @@ pub(super) async fn admission_response(request: Request, mut body: Value) -> Val
     let path = request.uri().path().to_owned();
     let segments: Vec<_> = path.trim_start_matches('/').split('/').collect();
     let operation = match (request.method().as_str(), segments.as_slice()) {
+        ("POST", ["api", "workflows", "import", "embedded-v2"]) => Operation::ImportEmbeddedV2,
         ("POST", ["api", "workflows"]) => Operation::Start,
         ("POST", ["api", "workflows", _, "signal", name])
         | ("POST", ["api", "workflows", _, "runs", _, "signal", name]) => Operation::Signal(name),
diff --git a/rust/src/runtime/execution.rs b/rust/src/runtime/execution.rs
index a75eadc46..392777ec4 100644
--- a/rust/src/runtime/execution.rs
+++ b/rust/src/runtime/execution.rs
@@ -1401,6 +1401,16 @@ impl Runtime {
     delegate!(heartbeat_activity(task_id: &str, body: Value, protocol: &str) -> Result<Value>);
     delegate!(activity_status(task_id: &str, body: Value, protocol: &str) -> Result<Value>);
     delegate!(renew_activity_lease(task_id: &str, body: Value) -> Result<Value>);
+    delegate!(import_existing_run(run_id: &str) -> Result<Option<super::workflow_import::ExistingRun>>);
+    delegate!(import_write(plan: &super::workflow_import::Plan) -> std::result::Result<super::workflow_import::Rows, String>);
+    /// The namespace this runtime's store serves.
+    pub(crate) fn namespace_name(&self) -> String {
+        match &*self.storage {
+            Storage::Sqlite(store) => store.namespace_name(),
+            Storage::Postgres(store) => store.namespace_name(),
+            Storage::MySql(store) => store.namespace_name(),
+        }
+    }
     pub(crate) async fn fail_activity(&self, task_id: &str, body: Value) -> Result<Value> {
         let (failure, blob) =
             super::activity_failures::prepare_failure(&body, self.signal_codec.clone()).await?;
diff --git a/rust/src/runtime/external_resolution.rs b/rust/src/runtime/external_resolution.rs
index d847fc2ef..eb6b762f6 100644
--- a/rust/src/runtime/external_resolution.rs
+++ b/rust/src/runtime/external_resolution.rs
@@ -37,6 +37,23 @@ impl PreparedExternal {
     }
 }
 
+/// `WorkflowController::oversizedPayloadPreview` over a stored command
+/// payload: an external reference, native's or one PHP stored, whose size is
+/// above `max_payload_bytes`. Only the small reference is read.
+pub(super) fn oversized_reference(payload: &str) -> bool {
+    use base64::{Engine, engine::general_purpose::STANDARD};
+    let size = if let Some(json) = payload.strip_prefix(STORED_PREFIX) {
+        serde_json::from_str::<Value>(json).ok().and_then(|reference| reference["size_bytes"].as_u64())
+    } else if let Some(encoded) = payload.strip_prefix(super::history_presentation::PHP_EXTERNAL_REFERENCE) {
+        STANDARD.decode(encoded).ok()
+            .and_then(|json| serde_json::from_slice::<Value>(&json).ok())
+            .and_then(|envelope| envelope["external_storage"]["size_bytes"].as_u64())
+    } else {
+        None
+    };
+    size.is_some_and(|size| size > super::payload_limits::max_payload_bytes() as u64)
+}
+
 pub(super) fn stored_envelope(blob: &str) -> Option<Value> {
     let value = serde_json::from_str(blob.strip_prefix(STORED_PREFIX)?).ok()?;
     let reference = Reference::validate(&value).ok()?;
diff --git a/rust/src/runtime/http.rs b/rust/src/runtime/http.rs
index 3cc195f41..92d7a1c9d 100644
--- a/rust/src/runtime/http.rs
+++ b/rust/src/runtime/http.rs
@@ -67,6 +67,7 @@ pub fn router(runtime: Runtime) -> Router {
             delete(delete_search_attribute),
         )
         .route("/api/workflows", get(list_workflows).post(start))
+        .route("/api/workflows/import/embedded-v2", post(import_embedded_v2))
         .route("/api/activities", get(list_activities).post(start_activity))
         .route("/api/activities/{activity_id}", get(show_activity))
         .route(
@@ -434,6 +435,8 @@ async fn guard(State(runtime): State<Runtime>, mut request: Request, next: Next)
         || path.starts_with("/api/system/")
         || path == "/api/runtime-credentials"
         || path.starts_with("/api/runtime-credentials/")
+        // History import writes runs into the store; PHP serves it to admins.
+        || path.starts_with("/api/workflows/import/")
     {
         &["admin"]
     } else {
@@ -679,7 +682,8 @@ fn exact_namespace_route(path: &str) -> Option<Allowed> {
         "/api/workflows" | "/api/activities" | "/api/search-attributes" => READ_WRITE,
         // The metrics describe the namespace's own state, read by GET or POST.
         "/api/system/metrics" => READ_WRITE,
-        "/api/external-payloads/v1" | "/api/storage/test" => WRITE,
+        // An import writes into the requested namespace.
+        "/api/external-payloads/v1" | "/api/storage/test" | "/api/workflows/import/embedded-v2" => WRITE,
         "/api/task-queues"
         | "/api/deployments"
         | "/api/workers"
@@ -1026,6 +1030,21 @@ async fn start(
     Ok((status, Json(super::control_plane::Operation::Start.response(result))))
 }
 
+/// `POST /api/workflows/import/embedded-v2`. The controller reads the body
+/// and the query string itself, as Laravel's request input.
+async fn import_embedded_v2(
+    Extension(runtime): Extension<Runtime>,
+    uri: axum::http::Uri,
+    body: axum::body::Bytes,
+) -> Result<(StatusCode, Json<Value>)> {
+    let query: Vec<(String, String)> = uri
+        .query()
+        .map(|query| form_urlencoded::parse(query.as_bytes()).into_owned().collect())
+        .unwrap_or_default();
+    let (status, answer) = runtime.import_embedded_v2(&body, &query).await?;
+    Ok((status, Json(answer)))
+}
+
 /// `POST /api/activities`: a standalone activity in its own host run.
 async fn start_activity(
     Extension(runtime): Extension<Runtime>,
diff --git a/rust/src/runtime/mod.rs b/rust/src/runtime/mod.rs
index a38f42362..22bfa0c56 100644
--- a/rust/src/runtime/mod.rs
+++ b/rust/src/runtime/mod.rs
@@ -35,6 +35,7 @@ mod activity_results;
 mod activity_summary;
 mod all_groups;
 mod backend;
+mod bundle_verifier;
 mod cancellation;
 mod cancellation_cascade;
 mod child_summary;
@@ -80,6 +81,7 @@ mod operator_metrics;
 mod payload_cleanup;
 mod payload_discovery;
 mod payload_limits;
+mod php_value;
 mod poll_readiness;
 pub mod postgres;
 mod previews;
@@ -105,6 +107,7 @@ mod task_queue_build_ids;
 mod task_queues;
 mod query_route;
 mod run_describe;
+mod workflow_import;
 mod workflow_streams;
 mod schedule_list;
 mod schedule_storage;
diff --git a/rust/src/runtime/php_value.rs b/rust/src/runtime/php_value.rs
new file mode 100644
index 000000000..227e2b598
--- /dev/null
+++ b/rust/src/runtime/php_value.rs
@@ -0,0 +1,644 @@
+//! PHP's view of a decoded JSON request: `json_decode($body, true)` gives
+//! ordered arrays whose canonical decimal string keys become integers, with
+//! integers beyond int64 read as floats. Laravel's TrimStrings and
+//! ConvertEmptyStringsToNull then rewrite every string. The history import
+//! verifies, checks and stores exactly that document, so it keeps PHP's
+//! order, key types and int/float distinction rather than serde's maps.
+use super::laravel_validation::laravel_trim;
+
+#[derive(Clone, Debug)]
+pub(super) enum Php {
+    Null,
+    Bool(bool),
+    Int(i64),
+    Float(f64),
+    Str(String),
+    Array(PhpArray),
+}
+
+/// A PHP array key: a canonical decimal integer string is an integer.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub(super) enum Key {
+    Int(i64),
+    Str(String),
+}
+
+impl Key {
+    /// `ZEND_HANDLE_NUMERIC_STR`: `0` or an optionally negative decimal
+    /// without leading zeros that fits in int64 is an integer key.
+    pub(super) fn of(text: &str) -> Self {
+        let digits = text.strip_prefix('-').unwrap_or(text);
+        let canonical = text == "0"
+            || (!digits.is_empty() && !digits.starts_with('0') && digits.bytes().all(|byte| byte.is_ascii_digit()));
+        match canonical.then(|| text.parse::<i64>().ok()).flatten() {
+            Some(number) => Self::Int(number),
+            None => Self::Str(text.to_owned()),
+        }
+    }
+
+    pub(super) fn text(&self) -> String {
+        match self {
+            Self::Int(number) => number.to_string(),
+            Self::Str(text) => text.clone(),
+        }
+    }
+}
+
+/// An ordered PHP array.
+#[derive(Clone, Debug, Default)]
+pub(super) struct PhpArray(pub(super) Vec<(Key, Php)>);
+
+impl PhpArray {
+    pub(super) fn get(&self, key: &str) -> Option<&Php> {
+        let key = Key::of(key);
+        self.0.iter().find(|(candidate, _)| *candidate == key).map(|(_, value)| value)
+    }
+
+    pub(super) fn contains(&self, key: &str) -> bool {
+        self.get(key).is_some()
+    }
+
+    /// `$array[$key] = $value`: an existing key keeps its position.
+    pub(super) fn insert(&mut self, key: Key, value: Php) {
+        match self.0.iter_mut().find(|(candidate, _)| *candidate == key) {
+            Some((_, slot)) => *slot = value,
+            None => self.0.push((key, value)),
+        }
+    }
+
+    pub(super) fn remove(&mut self, key: &str) {
+        let key = Key::of(key);
+        self.0.retain(|(candidate, _)| *candidate != key);
+    }
+
+    /// `array_is_list`.
+    pub(super) fn is_list(&self) -> bool {
+        self.0.iter().enumerate().all(|(index, (key, _))| *key == Key::Int(index as i64))
+    }
+
+    pub(super) fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub(super) fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    pub(super) fn values(&self) -> impl Iterator<Item = &Php> {
+        self.0.iter().map(|(_, value)| value)
+    }
+}
+
+impl Php {
+    pub(super) fn array(&self) -> Option<&PhpArray> {
+        match self {
+            Self::Array(array) => Some(array),
+            _ => None,
+        }
+    }
+
+    pub(super) fn str(&self) -> Option<&str> {
+        match self {
+            Self::Str(text) => Some(text),
+            _ => None,
+        }
+    }
+
+    /// `$value[$key] ?? null` for the named keys PHP code uses: a missing
+    /// key, or a value that is not an array, reads as absent.
+    pub(super) fn get(&self, key: &str) -> Option<&Php> {
+        self.array().and_then(|array| array.get(key))
+    }
+
+    pub(super) fn at(&self, path: &[&str]) -> Option<&Php> {
+        path.iter().try_fold(self, |value, key| value.get(key))
+    }
+
+    pub(super) fn is_array(&self) -> bool {
+        matches!(self, Self::Array(_))
+    }
+
+    /// PHP's `(bool)` cast.
+    pub(super) fn truthy(&self) -> bool {
+        match self {
+            Self::Null => false,
+            Self::Bool(flag) => *flag,
+            Self::Int(number) => *number != 0,
+            Self::Float(number) => *number != 0.0,
+            Self::Str(text) => !(text.is_empty() || text == "0"),
+            Self::Array(array) => !array.is_empty(),
+        }
+    }
+
+    /// `get_debug_type`.
+    pub(super) fn debug_type(&self) -> &'static str {
+        match self {
+            Self::Null => "null",
+            Self::Bool(_) => "bool",
+            Self::Int(_) => "int",
+            Self::Float(_) => "float",
+            Self::Str(_) => "string",
+            Self::Array(_) => "array",
+        }
+    }
+
+    /// Laravel's global TrimStrings and ConvertEmptyStringsToNull, applied to
+    /// every string at any depth (no nested key is excepted).
+    pub(super) fn normalize(&mut self) {
+        match self {
+            Self::Str(text) => {
+                let trimmed = laravel_trim(text);
+                if trimmed.is_empty() {
+                    *self = Self::Null;
+                } else if trimmed.len() != text.len() {
+                    *text = trimmed.to_owned();
+                }
+            }
+            Self::Array(array) => array.0.iter_mut().for_each(|(_, value)| value.normalize()),
+            _ => {}
+        }
+    }
+
+    /// PHP's `===`: the same type and value, arrays with the same keys in
+    /// the same order.
+    pub(super) fn identical(&self, other: &Self) -> bool {
+        match (self, other) {
+            (Self::Null, Self::Null) => true,
+            (Self::Bool(left), Self::Bool(right)) => left == right,
+            (Self::Int(left), Self::Int(right)) => left == right,
+            (Self::Float(left), Self::Float(right)) => left == right,
+            (Self::Str(left), Self::Str(right)) => left == right,
+            (Self::Array(left), Self::Array(right)) => {
+                left.len() == right.len()
+                    && left.0.iter().zip(&right.0).all(|((lk, lv), (rk, rv))| lk == rk && lv.identical(rv))
+            }
+            _ => false,
+        }
+    }
+
+    /// `json_encode` with the given flags.
+    pub(super) fn encode(&self, flags: Flags) -> String {
+        let mut out = String::new();
+        self.write(&mut out, flags);
+        out
+    }
+
+    fn write(&self, out: &mut String, flags: Flags) {
+        match self {
+            Self::Null => out.push_str("null"),
+            Self::Bool(flag) => out.push_str(if *flag { "true" } else { "false" }),
+            Self::Int(number) => out.push_str(&number.to_string()),
+            Self::Float(number) => out.push_str(&float(*number, flags.zero_fraction)),
+            Self::Str(text) => string(out, text, flags),
+            Self::Array(array) if array.is_list() => {
+                out.push('[');
+                for (index, value) in array.values().enumerate() {
+                    if index > 0 {
+                        out.push(',');
+                    }
+                    value.write(out, flags);
+                }
+                out.push(']');
+            }
+            Self::Array(array) => {
+                out.push('{');
+                for (index, (key, value)) in array.0.iter().enumerate() {
+                    if index > 0 {
+                        out.push(',');
+                    }
+                    string(out, &key.text(), flags);
+                    out.push(':');
+                    value.write(out, flags);
+                }
+                out.push('}');
+            }
+        }
+    }
+
+    /// `BundleIntegrityVerifier::canonicalize`: lists keep their order,
+    /// other arrays are key-sorted as strings, recursively.
+    pub(super) fn canonical(&self) -> Self {
+        match self {
+            Self::Array(array) if array.is_list() => {
+                Self::Array(PhpArray(array.0.iter().map(|(key, value)| (key.clone(), value.canonical())).collect()))
+            }
+            Self::Array(array) => {
+                let mut entries: Vec<(Key, Php)> =
+                    array.0.iter().map(|(key, value)| (key.clone(), value.canonical())).collect();
+                entries.sort_by(|(left, _), (right, _)| left.text().cmp(&right.text()));
+                Self::Array(PhpArray(entries))
+            }
+            other => other.clone(),
+        }
+    }
+
+    /// The document PHP stores and reads back for this value through a JSON
+    /// column (`json_encode` without flags, then `json_decode`).
+    pub(super) fn to_json(&self) -> serde_json::Value {
+        serde_json::from_str(&self.encode(Flags::default())).unwrap_or(serde_json::Value::Null)
+    }
+}
+
+/// `json_encode` options. The default escapes slashes and non-ASCII text
+/// and prints integral floats without a fraction, as PHP does.
+#[derive(Clone, Copy, Default)]
+pub(super) struct Flags {
+    pub(super) unescaped_slashes: bool,
+    pub(super) unescaped_unicode: bool,
+    pub(super) zero_fraction: bool,
+}
+
+/// `JSON_UNESCAPED_SLASHES | JSON_PRESERVE_ZERO_FRACTION`, the history
+/// bundle's canonical encoding.
+pub(super) const CANONICAL: Flags = Flags { unescaped_slashes: true, unescaped_unicode: false, zero_fraction: true };
+
+/// PHP's float output under `serialize_precision = -1`: the shortest digits
+/// that read back exactly, in fixed notation unless the decimal point falls
+/// before four leading zeros or after fifteen digits; `.0` is added to an
+/// integral fixed value only with JSON_PRESERVE_ZERO_FRACTION.
+pub(super) fn float(value: f64, zero_fraction: bool) -> String {
+    if value == 0.0 {
+        let sign = if value.is_sign_negative() { "-" } else { "" };
+        return format!("{sign}0{}", if zero_fraction { ".0" } else { "" });
+    }
+    let scientific = format!("{:e}", value.abs());
+    let (mantissa, exponent) = scientific.split_once('e').unwrap_or((&scientific, "0"));
+    let digits = mantissa.replace('.', "");
+    let exponent: i32 = exponent.parse().unwrap_or(0);
+    let point = exponent + 1;
+    let sign = if value.is_sign_negative() { "-" } else { "" };
+    if point < -3 || point > 15 {
+        let mantissa = if digits.len() == 1 { format!("{digits}.0") } else { format!("{}.{}", &digits[..1], &digits[1..]) };
+        format!("{sign}{mantissa}e{}{}", if exponent < 0 { '-' } else { '+' }, exponent.abs())
+    } else if point <= 0 {
+        format!("{sign}0.{}{digits}", "0".repeat((-point) as usize))
+    } else if digits.len() as i32 <= point {
+        let fraction = if zero_fraction { ".0" } else { "" };
+        format!("{sign}{digits}{}{fraction}", "0".repeat((point - digits.len() as i32) as usize))
+    } else {
+        format!("{sign}{}.{}", &digits[..point as usize], &digits[point as usize..])
+    }
+}
+
+fn string(out: &mut String, text: &str, flags: Flags) {
+    out.push('"');
+    for ch in text.chars() {
+        match ch {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '/' if !flags.unescaped_slashes => out.push_str("\\/"),
+            '\u{8}' => out.push_str("\\b"),
+            '\u{c}' => out.push_str("\\f"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            ch if (ch as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", ch as u32)),
+            // Line and paragraph separators stay escaped without
+            // JSON_UNESCAPED_LINE_TERMINATORS.
+            '\u{2028}' | '\u{2029}' => out.push_str(&format!("\\u{:04x}", ch as u32)),
+            ch if (ch as u32) < 0x80 || flags.unescaped_unicode => out.push(ch),
+            ch => {
+                let mut units = [0u16; 2];
+                for unit in ch.encode_utf16(&mut units) {
+                    out.push_str(&format!("\\u{unit:04x}"));
+                }
+            }
+        }
+    }
+    out.push('"');
+}
+
+/// `json_decode($text, true)` with PHP's number and key rules. Floats are
+/// read with Rust's correctly rounded parser, as PHP's `zend_strtod` reads
+/// them. `None` for text that is not one JSON document.
+pub(super) fn decode(text: &[u8]) -> Option<Php> {
+    let mut parser = Parser { bytes: text, at: 0, depth: 0 };
+    let value = parser.value()?;
+    parser.space();
+    (parser.at == parser.bytes.len()).then_some(value)
+}
+
+struct Parser<'a> {
+    bytes: &'a [u8],
+    at: usize,
+    depth: usize,
+}
+
+impl Parser<'_> {
+    fn space(&mut self) {
+        while matches!(self.bytes.get(self.at), Some(b' ' | b'\t' | b'\n' | b'\r')) {
+            self.at += 1;
+        }
+    }
+
+    fn literal(&mut self, word: &[u8], value: Php) -> Option<Php> {
+        self.bytes[self.at..].starts_with(word).then(|| {
+            self.at += word.len();
+            value
+        })
+    }
+
+    fn value(&mut self) -> Option<Php> {
+        self.space();
+        match *self.bytes.get(self.at)? {
+            b'n' => self.literal(b"null", Php::Null),
+            b't' => self.literal(b"true", Php::Bool(true)),
+            b'f' => self.literal(b"false", Php::Bool(false)),
+            b'"' => self.string().map(Php::Str),
+            b'[' => self.nested(|parser| {
+                let mut array = PhpArray::default();
+                parser.space();
+                if parser.bytes.get(parser.at) == Some(&b']') {
+                    parser.at += 1;
+                    return Some(array);
+                }
+                loop {
+                    let value = parser.value()?;
+                    array.0.push((Key::Int(array.0.len() as i64), value));
+                    parser.space();
+                    match parser.bytes.get(parser.at)? {
+                        b',' => parser.at += 1,
+                        b']' => {
+                            parser.at += 1;
+                            return Some(array);
+                        }
+                        _ => return None,
+                    }
+                }
+            }),
+            b'{' => self.nested(|parser| {
+                let mut array = PhpArray::default();
+                // Each key's position, so a large object parses in linear time.
+                let mut positions: std::collections::HashMap<Key, usize> = std::collections::HashMap::new();
+                parser.space();
+                if parser.bytes.get(parser.at) == Some(&b'}') {
+                    parser.at += 1;
+                    return Some(array);
+                }
+                loop {
+                    parser.space();
+                    if parser.bytes.get(parser.at) != Some(&b'"') {
+                        return None;
+                    }
+                    let key = parser.string()?;
+                    parser.space();
+                    if parser.bytes.get(parser.at) != Some(&b':') {
+                        return None;
+                    }
+                    parser.at += 1;
+                    let value = parser.value()?;
+                    // A repeated key replaces the earlier value in place.
+                    let key = Key::of(&key);
+                    match positions.get(&key) {
+                        Some(&index) => array.0[index].1 = value,
+                        None => {
+                            positions.insert(key.clone(), array.0.len());
+                            array.0.push((key, value));
+                        }
+                    }
+                    parser.space();
+                    match parser.bytes.get(parser.at)? {
+                        b',' => parser.at += 1,
+                        b'}' => {
+                            parser.at += 1;
+                            return Some(array);
+                        }
+                        _ => return None,
+                    }
+                }
+            }),
+            _ => self.number(),
+        }
+    }
+
+    /// PHP's default decoding depth is 512.
+    fn nested(&mut self, body: impl FnOnce(&mut Self) -> Option<PhpArray>) -> Option<Php> {
+        self.depth += 1;
+        if self.depth > 512 {
+            return None;
+        }
+        self.at += 1;
+        let array = body(self)?;
+        self.depth -= 1;
+        Some(Php::Array(array))
+    }
+
+    fn number(&mut self) -> Option<Php> {
+        let start = self.at;
+        let digits = |parser: &mut Self| {
+            let begin = parser.at;
+            while parser.bytes.get(parser.at).is_some_and(u8::is_ascii_digit) {
+                parser.at += 1;
+            }
+            parser.at > begin
+        };
+        if self.bytes.get(self.at) == Some(&b'-') {
+            self.at += 1;
+        }
+        let first = *self.bytes.get(self.at)?;
+        if first == b'0' {
+            self.at += 1;
+        } else if !digits(self) {
+            return None;
+        }
+        let mut integral = true;
+        if self.bytes.get(self.at) == Some(&b'.') {
+            self.at += 1;
+            integral = false;
+            if !digits(self) {
+                return None;
+            }
+        }
+        if matches!(self.bytes.get(self.at), Some(b'e' | b'E')) {
+            self.at += 1;
+            integral = false;
+            if matches!(self.bytes.get(self.at), Some(b'+' | b'-')) {
+                self.at += 1;
+            }
+            if !digits(self) {
+                return None;
+            }
+        }
+        let text = std::str::from_utf8(&self.bytes[start..self.at]).ok()?;
+        // An integer beyond int64 decodes as a float.
+        if integral && let Ok(number) = text.parse::<i64>() {
+            return Some(Php::Int(number));
+        }
+        text.parse::<f64>().ok().filter(|value| value.is_finite()).map(Php::Float)
+    }
+
+    fn hex(&mut self) -> Option<u32> {
+        let text = std::str::from_utf8(self.bytes.get(self.at..self.at + 4)?).ok()?;
+        self.at += 4;
+        u32::from_str_radix(text, 16).ok()
+    }
+
+    fn string(&mut self) -> Option<String> {
+        self.at += 1;
+        let mut out = String::new();
+        loop {
+            let start = self.at;
+            while !matches!(self.bytes.get(self.at), Some(b'"' | b'\\') | None) {
+                if self.bytes[self.at] < 0x20 {
+                    return None;
+                }
+                self.at += 1;
+            }
+            out.push_str(std::str::from_utf8(&self.bytes[start..self.at]).ok()?);
+            match *self.bytes.get(self.at)? {
+                b'"' => {
+                    self.at += 1;
+                    return Some(out);
+                }
+                _ => {
+                    self.at += 1;
+                    let escape = *self.bytes.get(self.at)?;
+                    self.at += 1;
+                    match escape {
+                        b'"' => out.push('"'),
+                        b'\\' => out.push('\\'),
+                        b'/' => out.push('/'),
+                        b'b' => out.push('\u{8}'),
+                        b'f' => out.push('\u{c}'),
+                        b'n' => out.push('\n'),
+                        b'r' => out.push('\r'),
+                        b't' => out.push('\t'),
+                        b'u' => {
+                            let unit = self.hex()?;
+                            let code = if (0xd800..0xdc00).contains(&unit) {
+                                // A high surrogate needs its low half.
+                                if self.bytes.get(self.at..self.at + 2) != Some(&b"\\u"[..]) {
+                                    return None;
+                                }
+                                self.at += 2;
+                                let low = self.hex()?;
+                                if !(0xdc00..0xe000).contains(&low) {
+                                    return None;
+                                }
+                                0x10000 + ((unit - 0xd800) << 10) + (low - 0xdc00)
+                            } else if (0xdc00..0xe000).contains(&unit) {
+                                return None;
+                            } else {
+                                unit
+                            };
+                            out.push(char::from_u32(code)?);
+                        }
+                        _ => return None,
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Laravel's `$request->json()`: the body decoded as a PHP array (a scalar
+/// body is cast to a one-element array), then normalized.
+pub(super) fn request_body(bytes: &[u8]) -> PhpArray {
+    let decoded = if bytes.iter().all(u8::is_ascii_whitespace) {
+        Php::Array(PhpArray::default())
+    } else {
+        decode(bytes).unwrap_or(Php::Null)
+    };
+    let mut body = match decoded {
+        Php::Array(array) => array,
+        Php::Null => PhpArray::default(),
+        scalar => PhpArray(vec![(Key::Int(0), scalar)]),
+    };
+    body.0.iter_mut().for_each(|(_, value)| value.normalize());
+    body
+}
+
+/// PHP's `is_numeric` for a string: optional leading whitespace, a sign,
+/// digits with an optional fraction and exponent, optional trailing
+/// whitespace.
+pub(super) fn numeric(text: &str) -> Option<f64> {
+    let trimmed = text.trim_start_matches([' ', '\t', '\n', '\r', '\x0b', '\x0c']).trim_end_matches([' ', '\t', '\n', '\r', '\x0b', '\x0c']);
+    let body = trimmed.strip_prefix(['+', '-']).unwrap_or(trimmed);
+    let (mantissa, exponent) = match body.find(['e', 'E']) {
+        Some(at) => (&body[..at], Some(&body[at + 1..])),
+        None => (body, None),
+    };
+    let (whole, fraction) = mantissa.split_once('.').unwrap_or((mantissa, ""));
+    let digits = |part: &str| part.bytes().all(|byte| byte.is_ascii_digit());
+    if (whole.is_empty() && fraction.is_empty()) || !digits(whole) || !digits(fraction) {
+        return None;
+    }
+    if let Some(exponent) = exponent {
+        let exponent = exponent.strip_prefix(['+', '-']).unwrap_or(exponent);
+        if exponent.is_empty() || !digits(exponent) {
+            return None;
+        }
+    }
+    trimmed.parse::<f64>().ok()
+}
+
+/// PHP's `(int)` cast of a numeric string.
+pub(super) fn int_cast(text: &str) -> Option<i64> {
+    let value = numeric(text)?;
+    let trimmed = text.trim_matches([' ', '\t', '\n', '\r', '\x0b', '\x0c']);
+    if let Ok(number) = trimmed.strip_prefix('+').unwrap_or(trimmed).parse::<i64>() {
+        return Some(number);
+    }
+    // Out-of-range or fractional values truncate; PHP 8 saturates neither,
+    // and an out-of-range float cast is undefined, so refuse it.
+    (value.is_finite() && value.abs() < 9.2e18).then(|| value.trunc() as i64)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn decode(text: &str) -> Php {
+        super::decode(text.as_bytes()).unwrap()
+    }
+
+    #[test]
+    fn decoding_keeps_php_key_types_order_and_numbers() {
+        let value = decode(r#"{"b":1,"0":2,"a":{"x":1},"b":3,"01":4,"-0":5,"-7":6,"big":18446744073709551615}"#);
+        let array = value.array().unwrap();
+        let keys: Vec<Key> = array.0.iter().map(|(key, _)| key.clone()).collect();
+        assert_eq!(keys, [Key::Str("b".into()), Key::Int(0), Key::Str("a".into()), Key::Str("01".into()),
+            Key::Str("-0".into()), Key::Int(-7), Key::Str("big".into())]);
+        assert!(matches!(array.get("b"), Some(Php::Int(3))));
+        assert!(matches!(array.get("big"), Some(Php::Float(_))));
+        assert!(decode("[1,2]").array().unwrap().is_list());
+        assert!(decode(r#"{"0":1,"1":2}"#).array().unwrap().is_list());
+        assert!(!decode(r#"{"1":1,"0":2}"#).array().unwrap().is_list());
+    }
+
+    #[test]
+    fn canonical_encoding_matches_php() {
+        // Published PHP printed {"k":"\u03bb/\u00e9","f":1.0,...} for these values under
+        // JSON_UNESCAPED_SLASHES | JSON_PRESERVE_ZERO_FRACTION, keys in insertion order
+        // (canonicalization sorts them).
+        let value = decode(r#"{"k":"λ/é","f":1.0,"e":1e25,"o":{},"n":["a","b"],"big":18446744073709551615}"#);
+        assert_eq!(value.encode(CANONICAL),
+            r#"{"k":"\u03bb/\u00e9","f":1.0,"e":1.0e+25,"o":[],"n":["a","b"],"big":1.8446744073709552e+19}"#);
+        assert_eq!(value.canonical().encode(CANONICAL),
+            r#"{"big":1.8446744073709552e+19,"e":1.0e+25,"f":1.0,"k":"\u03bb/\u00e9","n":["a","b"],"o":[]}"#);
+        // Sorted keys 0..n-1 encode as a list; string order puts "10" first.
+        assert_eq!(decode(r#"{"1":"a","0":"b"}"#).canonical().encode(CANONICAL), r#"["b","a"]"#);
+        assert_eq!(decode(r#"{"x":{"2":1,"10":2}}"#).canonical().encode(CANONICAL), r#"{"x":{"10":2,"2":1}}"#);
+        // Published PHP printed "a\/b\u0001\u2028\ud83d\ude00" for this value.
+        assert_eq!(decode(r#""a/b\u0001\u2028\ud83d\ude00""#).encode(Flags::default()), r#""a\/b\u0001\u2028\ud83d\ude00""#);
+        assert_eq!(float(1.0, false), "1");
+        assert_eq!(float(-0.0, true), "-0.0");
+        assert_eq!(float(0.1, false), "0.1");
+        assert_eq!(float(1e-7, false), "1.0e-7");
+    }
+
+    #[test]
+    fn requests_are_normalized_like_laravel() {
+        let body = request_body(br#"{"a":"  x  ","b":"   ","c":["",{"d":"\u00a0y"}],"e":5}"#);
+        assert_eq!(Php::Array(body).encode(Flags::default()), r#"{"a":"x","b":null,"c":[null,{"d":"y"}],"e":5}"#);
+        assert_eq!(Php::Array(request_body(b"\"x\"")).encode(Flags::default()), r#"["x"]"#);
+        assert!(request_body(b"null").is_empty());
+        assert!(Php::Int(1).identical(&Php::Int(1)) && !Php::Int(1).identical(&Php::Float(1.0)));
+        assert!(!decode(r#"{"a":1,"b":2}"#).identical(&decode(r#"{"b":2,"a":1}"#)));
+        assert_eq!(numeric(" 12 "), Some(12.0));
+        assert_eq!(numeric("1e3"), Some(1000.0));
+        assert_eq!(numeric("1e"), None);
+        assert_eq!(numeric("."), None);
+        assert_eq!(int_cast("12.9"), Some(12));
+    }
+}
diff --git a/rust/src/runtime/run_describe.rs b/rust/src/runtime/run_describe.rs
index 070e4e364..c71376459 100644
--- a/rust/src/runtime/run_describe.rs
+++ b/rust/src/runtime/run_describe.rs
@@ -218,6 +218,25 @@ where
         Ok(updates)
     }
 
+    /// A run's compatibility marker and whether the live fleet supports it,
+    /// as describe and history report them.
+    pub(super) async fn compatibility_fields(&self, run: &DB::Row) -> Result<Map<String, Value>> {
+        let compatibility = DB::optional_string(run, "compatibility")?;
+        let queue = DB::optional_string(run, "queue")?;
+        let snapshots = self.fleet_snapshots(now()).await?;
+        let (supported, fleet_reason) = super::run_diagnostics::fleet_supports(
+            &snapshots,
+            compatibility.as_deref().map(str::trim).filter(|value| !value.is_empty()),
+            queue.as_deref(),
+        );
+        Ok(Map::from_iter([
+            ("compatibility".into(), json!(compatibility)),
+            ("compatibility_status".into(), json!(if supported { "compatible" } else { "no_compatible_worker" })),
+            ("compatibility_supported_in_fleet".into(), json!(supported)),
+            ("compatibility_fleet_reason".into(), json!(fleet_reason)),
+        ]))
+    }
+
     /// The fields `formatRun` adds for a described run row.
     pub(super) async fn describe_fields(
         &self,
@@ -245,14 +264,7 @@ where
             Some(row) => (DB::optional_string(&row, "wait_kind")?, DB::optional_string(&row, "wait_reason")?),
             None => (None, None),
         };
-        let compatibility = DB::optional_string(run, "compatibility")?;
-        let queue = DB::optional_string(run, "queue")?;
-        let snapshots = self.fleet_snapshots(now()).await?;
-        let (supported, fleet_reason) = super::run_diagnostics::fleet_supports(
-            &snapshots,
-            compatibility.as_deref().map(str::trim).filter(|value| !value.is_empty()),
-            queue.as_deref(),
-        );
+        let compatibility = self.compatibility_fields(run).await?;
         // `canServeQuery`: failed, cancelled and terminated runs refuse
         // queries; others need a registered route.
         let query_servable = current
@@ -268,10 +280,7 @@ where
         if started["recovery_kind"] == "redrive" && started["continued_from_run_id"].is_string() {
             fields.insert("continued_from_run_id".into(), started["continued_from_run_id"].clone());
         }
-        fields.insert("compatibility".into(), json!(compatibility));
-        fields.insert("compatibility_status".into(), json!(if supported { "compatible" } else { "no_compatible_worker" }));
-        fields.insert("compatibility_supported_in_fleet".into(), json!(supported));
-        fields.insert("compatibility_fleet_reason".into(), json!(fleet_reason));
+        fields.extend(compatibility);
         // `ServerWorkflowControlPlane::withDefinitionRouting`.
         let mut tx = self.begin_read().await?;
         let routing = self.definition_inspect(&mut tx, run, None).await?;
diff --git a/rust/src/runtime/store.rs b/rust/src/runtime/store.rs
index edeba7358..9f969a321 100644
--- a/rust/src/runtime/store.rs
+++ b/rust/src/runtime/store.rs
@@ -577,9 +577,10 @@ where
         // refused signals which intentionally have no workflow history event.
         // Select metadata only: large customer payloads are never decoded or
         // copied merely to display the command's target and admission result.
-        let command_rows = Self::query("SELECT c.id,c.command_sequence,c.command_type,c.target_scope,c.requested_workflow_run_id,c.resolved_workflow_run_id,c.source,c.status,c.outcome,c.rejection_reason,c.workflow_type,c.workflow_class,c.accepted_at,c.applied_at,c.rejected_at,c.context,s.signal_name FROM workflow_commands c LEFT JOIN workflow_signal_records s ON s.workflow_command_id=c.id WHERE c.workflow_run_id=$1 AND c.workflow_instance_id=$2 ORDER BY c.command_sequence,c.created_at,c.id")
+        let command_rows = Self::query("SELECT c.id,c.command_sequence,c.command_type,c.target_scope,c.requested_workflow_run_id,c.resolved_workflow_run_id,c.source,c.status,c.outcome,c.rejection_reason,c.workflow_type,c.workflow_class,c.accepted_at,c.applied_at,c.rejected_at,c.context,s.signal_name,CASE WHEN c.payload LIKE 'dw-native-external-payload-v1:%' OR c.payload LIKE 'dw-external-payload:v1:%' THEN c.payload END AS payload_reference,CASE WHEN c.status<>'rejected' AND (c.payload_codec IS NULL OR c.payload_codec='avro') AND LENGTH(c.payload)<=8192 AND c.payload NOT LIKE 'dw-native-external-payload-v1:%' AND c.payload NOT LIKE 'dw-external-payload:v1:%' THEN c.payload END AS reason_payload FROM workflow_commands c LEFT JOIN workflow_signal_records s ON s.workflow_command_id=c.id WHERE c.workflow_run_id=$1 AND c.workflow_instance_id=$2 ORDER BY c.command_sequence,c.created_at,c.id")
             .bind(DB::string(&row, "id")?).bind(workflow_id).fetch_all(&self.pool).await?;
         let mut commands = Vec::with_capacity(command_rows.len());
+        let mut reason_codec = None;
         for command in command_rows {
             let mut public = json!({"id":DB::string(&command,"id")?,"sequence":DB::optional_number(&command,"command_sequence")?,
                 "type":DB::string(&command,"command_type")?,"target_scope":DB::string(&command,"target_scope")?,
@@ -595,6 +596,27 @@ where
             if let Some(context) = DB::optional_document_row(&command, "context")? {
                 fields.extend(super::command_context::described(&context));
             }
+            // `payload_preview_omitted`: an oversized external payload hides
+            // the command's target, as published 2.11 describes it.
+            let omitted = DB::optional_string(&command, "payload_reference")?
+                .as_deref()
+                .is_some_and(super::external_resolution::oversized_reference);
+            if omitted {
+                fields.remove("target_name");
+            }
+            fields.insert("payload_preview_omitted".into(), json!(omitted));
+            // `commandReason()`: a command that was not rejected shows the
+            // reason its payload records. Only small inline payloads are read;
+            // every writer caps the reason at 1000 characters.
+            if let Some(payload) = DB::optional_string(&command, "reason_payload")? {
+                let codec = reason_codec.get_or_insert_with(|| crate::codec::ValueCodec::new().ok());
+                if let Some(Ok(crate::codec::Value::Map(map))) = codec.as_ref().map(|codec| codec.decode(&payload))
+                    && let Some(crate::codec::Value::String(reason)) = map.get("reason")
+                    && !reason.is_empty()
+                {
+                    fields.insert("reason".into(), json!(reason));
+                }
+            }
             fields.retain(|_, value| !value.is_null());
             commands.push(public);
         }
@@ -638,6 +660,11 @@ where
         page_size: i64,
     ) -> Result<Value> {
         self.describe(workflow_id, Some(run_id)).await?;
+        let run = Self::query("SELECT compatibility,queue FROM workflow_runs WHERE id=$1")
+            .bind(run_id)
+            .fetch_one(&self.pool)
+            .await?;
+        let compatibility = self.compatibility_fields(&run).await?;
         let (events, next) =
             Self::history_page(&self.pool, run_id, after_sequence, page_size).await?;
         let public_events: Vec<Value> = events
@@ -648,9 +675,11 @@ where
             "principal": super::history_presentation::principal(&e["payload"]), "payload": e["payload"]})
             })
             .collect();
-        Ok(
-            json!({"workflow_id": workflow_id, "run_id": run_id, "events": public_events, "next_page_token": next}),
-        )
+        // `HistoryController::show` reports the run's compatibility as
+        // describe does.
+        let mut body = json!({"workflow_id": workflow_id, "run_id": run_id, "events": public_events, "next_page_token": next});
+        body.as_object_mut().expect("history object").extend(compatibility);
+        Ok(body)
     }
 
     pub(crate) async fn signal(
diff --git a/rust/src/runtime/terminal_summary.rs b/rust/src/runtime/terminal_summary.rs
index de6c5c065..91c70f8f7 100644
--- a/rust/src/runtime/terminal_summary.rs
+++ b/rust/src/runtime/terminal_summary.rs
@@ -34,11 +34,13 @@ where
             .await?;
         let status = DB::string(&run, "status")?;
         let closed = terminal(&status);
-        // Retention and imported histories need their separately qualified
+        // Retention and v1 projections need their separately qualified
         // counters. Never label a partial scan as a complete stored summary.
-        if DB::optional_instant(&run, "details_pruned_at")?.is_some()
-            || DB::optional_string(&run, "import_source")?.is_some()
-        {
+        // An embedded v2 import is a complete v2 history, projected as PHP's
+        // `RunSummaryProjector` projects it, from the imported rows.
+        let import_source = DB::optional_string(&run, "import_source")?;
+        let embedded_import = import_source.as_deref() == Some(super::workflow_import::IMPORT_SOURCE);
+        if DB::optional_instant(&run, "details_pruned_at")?.is_some() || (import_source.is_some() && !embedded_import) {
             return Ok(());
         }
         // A state outside the qualified producer must not retain an earlier
@@ -130,6 +132,13 @@ where
         if let Some(active) = active {
             Self::write_active_summary_fields(tx, run_id, &active).await?;
         }
+        if embedded_import {
+            Self::query("UPDATE workflow_run_summaries SET engine_source=$1 WHERE id=$2")
+                .bind(super::workflow_import::ENGINE_SOURCE)
+                .bind(run_id)
+                .execute(&mut **tx)
+                .await?;
+        }
         Ok(())
     }
     pub(super) async fn workflow_history_budget(
diff --git a/rust/src/runtime/workflow_import.rs b/rust/src/runtime/workflow_import.rs
new file mode 100644
index 000000000..8807ff85f
--- /dev/null
+++ b/rust/src/runtime/workflow_import.rs
@@ -0,0 +1,1320 @@
+//! `POST /api/workflows/import/embedded-v2`, as published Server 2.11.1
+//! serves it (`EmbeddedV2ImportController` over Workflow 2.10.2's
+//! `EmbeddedV2HistoryImport`): an embedded application's history-export
+//! bundle is verified, checked for eligibility, and written in one
+//! transaction into the request's namespace. The answer is the import
+//! report: 201 imported, 200 already_imported or dry_run, 422 otherwise.
+//!
+//! The bundle is read as PHP reads it: the JSON body decoded into ordered
+//! PHP arrays and normalized by Laravel's TrimStrings and
+//! ConvertEmptyStringsToNull, so the checksum, the dedupe key and every
+//! stored value see the same document PHP's importer sees.
+//!
+//! Two published defects are not copied. PHP looks the run and the instance
+//! up in every namespace, so a bundle imported into another namespace
+//! answers already_imported for a namespace that holds no such run, and an
+//! import attaches its run to another namespace's instance and takes over
+//! its current run. Native counts a run as already imported only in the
+//! requested namespace (elsewhere it is a run_id conflict), and refuses to
+//! write into an instance of another namespace (a failed write, as PHP
+//! itself reports when the run number collides).
+use super::bundle_verifier::{self, Decoded};
+use super::execution::Runtime;
+use super::php_value::{self, Flags, Key, Php, PhpArray};
+use super::store::{id, now};
+use super::{Result, refuse};
+use axum::http::StatusCode;
+use chrono::{DateTime, NaiveDateTime, Utc};
+use serde_json::{Map, Value, json};
+
+pub(super) const IMPORT_SOURCE: &str = "embedded_v2";
+pub(super) const ENGINE_SOURCE: &str = "embedded_v2_import";
+const REPORT_SCHEMA: &str = "durable-workflow.v2.embedded-v2-import.report";
+const CONTRACT_VERSION: i64 = 2;
+const SOURCE_RUNTIME: &str = "embedded";
+
+const RUN_STATUSES: &[&str] = &["pending", "running", "waiting", "cancelled", "terminated", "completed", "failed"];
+const TERMINAL_STATUSES: &[&str] = &["cancelled", "terminated", "completed", "failed"];
+const HISTORY_EVENT_TYPES: &[&str] = &[
+    "StartAccepted", "StartRejected", "WorkflowStarted", "WorkflowContinuedAsNew", "ChildWorkflowScheduled",
+    "ChildCancellationRequested", "ChildCancellationResolved", "ChildRunStarted", "ChildRunCompleted", "ChildRunFailed",
+    "ChildRunCancelled", "ChildRunTerminated", "ServiceCallStarted", "ServiceCallCompleted", "ServiceCallFailed",
+    "ServiceCallCancelled", "ConditionWaitOpened", "ConditionWaitSatisfied", "ConditionWaitTimedOut",
+    "ConditionWaitCancelled", "SignalWaitOpened", "SignalWaitCancelled", "SignalReceived", "SignalApplied",
+    "SignalRejected", "UpdateAccepted", "UpdateRejected", "UpdateApplied", "UpdateCompleted", "RepairRequested",
+    "CancelRequested", "CooperativeCancellationRequested", "CooperativeCancellationDelivered", "CancellationScopeOpened",
+    "CancellationScopeRequested", "CancellationScopeDeliveryPrepared", "CancellationScopeDelivered",
+    "CancellationScopeRequestConflicted", "WorkflowCancelled", "TerminateRequested", "WorkflowTerminated",
+    "ArchiveRequested", "WorkflowArchived", "ActivityScheduled", "ActivityStarted", "ActivityHeartbeatRecorded",
+    "ActivityRetryScheduled", "ActivityCompleted", "ActivityFailed", "ActivityCancelled",
+    "ActivityCancellationAcknowledged", "ActivityTimedOut", "FailureHandled", "SideEffectRecorded",
+    "VersionMarkerRecorded", "TimerScheduled", "TimerFired", "TimerCancelled", "SelectionResolved",
+    "SelectionOperationCancelled", "SearchAttributesUpserted", "MemoUpserted", "WorkflowTimedOut", "WorkflowCompleted",
+    "WorkflowFailed", "ParentClosePolicyApplied", "ParentClosePolicyFailed", "ParentCloseCancellationRequested",
+    "MessageCursorAdvanced", "ScheduleCreated", "SchedulePaused", "ScheduleResumed", "ScheduleUpdated",
+    "ScheduleTriggered", "ScheduleDeleted", "ScheduleTriggerSkipped",
+];
+const COMMAND_TYPES: &[&str] = &["start", "redrive", "signal", "update", "repair", "cancel", "request_cancellation", "terminate", "archive"];
+const COMMAND_STATUSES: &[&str] = &["accepted", "rejected"];
+const COMMAND_OUTCOMES: &[&str] = &[
+    "started_new", "redriven", "returned_existing_active", "rejected_duplicate", "signal_received", "update_completed",
+    "update_failed", "repair_dispatched", "repair_not_needed", "cancelled", "cancellation_requested", "terminated",
+    "archived", "archive_not_needed", "rejected_not_started", "rejected_not_active", "rejected_not_current",
+    "rejected_run_not_closed", "rejected_unknown_signal", "rejected_unknown_update", "rejected_invalid_arguments",
+    "rejected_compatibility_blocked", "rejected_workflow_definition_unavailable",
+];
+const SIGNAL_STATUSES: &[&str] = &["received", "applied", "rejected"];
+const UPDATE_STATUSES: &[&str] = &["accepted", "rejected", "completed", "failed"];
+const TASK_TYPES: &[&str] = &["workflow", "activity", "timer"];
+const TASK_STATUSES: &[&str] = &["ready", "leased", "cancelled", "completed", "failed"];
+const ACTIVITY_STATUSES: &[&str] = &["pending", "running", "cancelled", "completed", "failed"];
+const ATTEMPT_STATUSES: &[&str] = &["running", "completed", "failed", "cancelled", "expired"];
+const TIMER_STATUSES: &[&str] = &["pending", "cancelled", "fired"];
+const FAILURE_CATEGORIES: &[&str] = &[
+    "application", "cancelled", "terminated", "timeout", "activity", "child_workflow", "task_failure", "internal", "structural_limit",
+];
+/// `EmbeddedV2HistoryImport::HISTORY_EVENT_PAYLOAD_FIELDS`.
+const HISTORY_EVENT_PAYLOAD_FIELDS: &[(&str, &[&str])] = &[
+    ("ActivityCompleted", &["result"]),
+    ("ChildRunCompleted", &["output", "result"]),
+    ("MemoUpserted", &["entries", "merged"]),
+    ("ServiceCallStarted", &["request_payload", "response_payload"]),
+    ("ServiceCallCompleted", &["request_payload", "response_payload"]),
+    ("ServiceCallFailed", &["request_payload", "response_payload"]),
+    ("ServiceCallCancelled", &["request_payload", "response_payload"]),
+    ("SideEffectRecorded", &["result"]),
+    ("SignalReceived", &["arguments"]),
+    ("SignalApplied", &["arguments", "value"]),
+    ("UpdateAccepted", &["arguments"]),
+    ("UpdateRejected", &["arguments"]),
+    ("UpdateApplied", &["arguments"]),
+    ("UpdateCompleted", &["result"]),
+    ("WorkflowCompleted", &["output"]),
+];
+const ACTIVITY_SNAPSHOT_EVENT_TYPES: &[&str] = &[
+    "ActivityScheduled", "ActivityStarted", "ActivityHeartbeatRecorded", "ActivityRetryScheduled", "ActivityCompleted",
+    "ActivityFailed", "ActivityCancelled", "ActivityTimedOut",
+];
+const FAILURE_PAYLOAD_EVENT_TYPES: &[&str] = &[
+    "ActivityRetryScheduled", "ActivityFailed", "ChildRunFailed", "ServiceCallFailed", "ServiceCallCancelled",
+    "UpdateCompleted", "WorkflowFailed",
+];
+const SERVICE_CALL_EVENT_TYPES: &[&str] = &["ServiceCallStarted", "ServiceCallCompleted", "ServiceCallFailed", "ServiceCallCancelled"];
+/// `PAYLOAD_ROW_FIELDS`, in the importer's order.
+const PAYLOAD_ROW_FIELDS: &[(&str, &[&str])] = &[
+    ("commands", &["payload"]),
+    ("signals", &["arguments"]),
+    ("updates", &["arguments", "result"]),
+    ("activities", &["arguments", "result"]),
+];
+/// The report's row counts, in PHP's order.
+pub(super) const ROWS: [&str; 15] = [
+    "workflow_instances", "workflow_runs", "workflow_history_events", "workflow_commands", "workflow_signal_records",
+    "workflow_updates", "workflow_tasks", "activity_executions", "activity_attempts", "workflow_run_timers",
+    "workflow_failures", "workflow_links", "workflow_memos", "workflow_search_attributes", "workflow_run_summaries",
+];
+const MEMO_VALUE_LIMIT: usize = 10_240;
+const SEARCH_KEYWORD_LIMIT: usize = 255;
+const SEARCH_STRING_LIMIT: usize = 2048;
+
+pub(crate) type Rows = [i64; 15];
+
+fn rows_json(rows: &Rows) -> Value {
+    Value::Object(ROWS.iter().zip(rows).map(|(name, count)| ((*name).to_owned(), json!(count))).collect())
+}
+
+fn row(name: &str) -> usize {
+    ROWS.iter().position(|candidate| *candidate == name).expect("known row")
+}
+
+// The importer's value coercions.
+
+/// `stringValue`: a non-empty string.
+pub(super) fn text(value: Option<&Php>) -> Option<&str> {
+    value.and_then(Php::str).filter(|text| !text.is_empty())
+}
+
+/// `intValue`: an integer, or a numeric string cast to one.
+pub(super) fn int(value: Option<&Php>) -> Option<i64> {
+    match value? {
+        Php::Int(number) => Some(*number),
+        Php::Str(text) => php_value::int_cast(text),
+        _ => None,
+    }
+}
+
+/// `listValue`: the array elements of an array, in order.
+pub(super) fn list(value: Option<&Php>) -> Vec<&Php> {
+    value.and_then(Php::array).map(|array| array.values().filter(|row| row.is_array()).collect()).unwrap_or_default()
+}
+
+fn array(value: Option<&Php>) -> Option<&PhpArray> {
+    value.and_then(Php::array)
+}
+
+/// `enumString`: a known backing value.
+fn enumerated<'a>(allowed: &[&str], value: Option<&'a Php>) -> Option<&'a str> {
+    text(value).filter(|text| allowed.contains(text))
+}
+
+/// `ulidValue`: a non-empty string of at most 26 bytes.
+fn ulid_value(value: Option<&Php>) -> Option<&str> {
+    text(value).filter(|text| text.len() <= 26)
+}
+
+fn truthy(value: Option<&Php>) -> bool {
+    value.is_some_and(Php::truthy)
+}
+
+fn max_sequence(rows: &[&Php], key: &str) -> i64 {
+    rows.iter().filter_map(|row| int(row.get(key))).fold(0, i64::max)
+}
+
+/// The options PHP's controller reads from the body (or the query string).
+pub(super) struct Options {
+    pub(super) dry_run: bool,
+    pub(super) import_id: Option<String>,
+    pub(super) require_signature: bool,
+    pub(super) signing_key: Option<String>,
+}
+
+/// `$request->boolean($key)`: `filter_var(FILTER_VALIDATE_BOOLEAN)`.
+fn boolean(value: Option<&Php>) -> bool {
+    match value {
+        Some(Php::Bool(flag)) => *flag,
+        Some(Php::Int(number)) => *number == 1,
+        Some(Php::Float(number)) => *number == 1.0,
+        Some(Php::Str(text)) => {
+            let text = text.trim_matches([' ', '\t', '\n', '\r', '\x0b', '\0']).to_ascii_lowercase();
+            matches!(text.as_str(), "1" | "true" | "on" | "yes")
+        }
+        _ => false,
+    }
+}
+
+/// `stringInput`: a string, trimmed, with an empty one absent.
+fn string_input(value: Option<&Php>) -> Option<String> {
+    let text = value?.str()?.trim_matches([' ', '\t', '\n', '\r', '\x0b', '\0']);
+    (!text.is_empty()).then(|| text.to_owned())
+}
+
+const OPTION_KEYS: [&str; 4] = ["dry_run", "import_id", "require_signature", "signing_key"];
+
+/// What the controller decides before the importer runs.
+pub(super) enum Request {
+    /// The 422 `invalid_import_bundle` answer.
+    Invalid,
+    Import(PhpArray, Options),
+}
+
+/// `EmbeddedV2ImportController::store` up to the importer: the bundle is
+/// `bundle` when that is an array, else the whole body; options come from
+/// the body, then the query string (`$request->input`).
+pub(super) fn request(body: &[u8], query: &[(String, String)]) -> Request {
+    let body = php_value::request_body(body);
+    // Only the options are read, so only they are kept; a repeated
+    // parameter's last value wins.
+    let mut query_input = PhpArray::default();
+    for (key, value) in query.iter().filter(|(key, _)| OPTION_KEYS.contains(&key.as_str())) {
+        let mut value = Php::Str(value.clone());
+        value.normalize();
+        query_input.insert(Key::of(key), value);
+    }
+    let input = |key: &str| body.get(key).or_else(|| query_input.get(key));
+    let options = Options {
+        dry_run: boolean(input("dry_run")),
+        import_id: string_input(input("import_id")),
+        require_signature: boolean(input("require_signature")),
+        signing_key: string_input(input("signing_key")),
+    };
+    let bundle = match body.get("bundle") {
+        Some(Php::Array(bundle)) => bundle.clone(),
+        _ => body,
+    };
+    if bundle.is_empty() {
+        return Request::Invalid;
+    }
+    Request::Import(bundle, options)
+}
+
+/// `workflowSummary`: the bundle's workflow with the importer's defaults,
+/// in the request's namespace.
+pub(crate) struct Summary {
+    pub(super) workflow: PhpArray,
+    pub(super) instance_id: Option<String>,
+    pub(super) run_id: Option<String>,
+    pub(super) run_number: i64,
+    pub(super) workflow_type: String,
+    pub(super) workflow_class: String,
+    pub(super) namespace: String,
+    pub(super) status: String,
+}
+
+impl Summary {
+    fn of(bundle: &PhpArray, namespace: &str) -> Self {
+        let workflow = array(bundle.get("workflow")).cloned().unwrap_or_default();
+        let field = |key: &str| text(workflow.get(key)).map(str::to_owned);
+        let workflow_type = field("workflow_type").or_else(|| field("workflow_class")).unwrap_or_else(|| "imported-workflow".into());
+        Self {
+            instance_id: field("instance_id"),
+            run_id: field("run_id"),
+            run_number: int(workflow.get("run_number")).unwrap_or(1),
+            workflow_class: field("workflow_class").unwrap_or_else(|| workflow_type.clone()),
+            workflow_type,
+            namespace: namespace.to_owned(),
+            status: field("status").unwrap_or_else(|| "running".into()),
+            workflow,
+        }
+    }
+
+    fn get(&self, key: &str) -> Option<&Php> {
+        self.workflow.get(key)
+    }
+
+    fn terminal(&self) -> bool {
+        TERMINAL_STATUSES.contains(&self.status.as_str())
+    }
+}
+
+struct Eligibility {
+    errors: Vec<Value>,
+    warnings: Vec<Value>,
+}
+
+impl Eligibility {
+    fn json(&self) -> Value {
+        json!({"eligible": self.errors.is_empty(), "errors": self.errors, "warnings": self.warnings})
+    }
+
+    fn with_error(&self, rule: &str, message: &str) -> Value {
+        let mut errors = self.errors.clone();
+        errors.push(finding(rule, message));
+        json!({"eligible": false, "errors": errors, "warnings": self.warnings})
+    }
+}
+
+fn finding(rule: &str, message: &str) -> Value {
+    json!({"rule": rule, "message": message})
+}
+
+/// `eligibility`, in PHP's order.
+fn eligibility(bundle: &PhpArray, integrity: &str, signature_verified: bool, summary: &Summary, options: &Options) -> Eligibility {
+    let root = Php::Array(bundle.clone());
+    let mut errors = Vec::new();
+    let mut warnings = Vec::new();
+    match integrity {
+        "failed" => errors.push(finding("bundle.integrity_failed", "Bundle integrity verification failed.")),
+        "warning" => warnings.push(finding("bundle.integrity_warning", "Bundle integrity verification reported warnings.")),
+        _ => {}
+    }
+    if options.require_signature && !signature_verified {
+        errors.push(finding("bundle.signature_required", "A verified history-export signature is required for this import."));
+    }
+    if summary.instance_id.is_none() {
+        errors.push(finding("workflow.instance_id_missing", "Bundle workflow.instance_id is required."));
+    }
+    if summary.run_id.is_none() {
+        errors.push(finding("workflow.run_id_missing", "Bundle workflow.run_id is required."));
+    }
+    if !RUN_STATUSES.contains(&summary.status.as_str()) {
+        errors.push(finding("workflow.status_unsupported", "Bundle workflow.status is not a supported v2 run status."));
+    } else if summary.terminal() {
+        if !matches!(bundle.get("history_complete"), Some(Php::Bool(true))) {
+            errors.push(finding("workflow.terminal_history_incomplete", "Terminal run imports require history_complete=true."));
+        }
+    } else if !truthy(summary.get("is_current_run")) {
+        errors.push(finding("workflow.non_terminal_not_current", "Non-terminal embedded v2 imports must be the current run."));
+    }
+    if text(summary.get("source_runtime")) != Some(SOURCE_RUNTIME) {
+        errors.push(finding("workflow.source_runtime_unsupported", "Bundle workflow.source_runtime must be embedded."));
+    }
+    // Only non-scalar path elements count, so exported string paths pass.
+    if !list(root.at(&["redaction", "paths"])).is_empty() {
+        errors.push(finding("bundle.redacted_payloads", "Redacted history bundles cannot be imported as server-managed state."));
+    }
+    reject_unsupported_payload_codecs(&root, &mut errors);
+    reject_open_leases(&root, &mut errors);
+    Eligibility { errors, warnings }
+}
+
+fn reject_payload_codec(codec: Option<&Php>, path: &str, errors: &mut Vec<Value>) {
+    let found = match codec {
+        None | Some(Php::Null) => return,
+        Some(Php::Str(codec)) if codec.is_empty() || codec == "avro" => return,
+        Some(Php::Str(codec)) => format!("\"{codec}\""),
+        Some(other) => other.debug_type().to_owned(),
+    };
+    errors.push(finding("payload_codec.unsupported", &format!(
+        "Bundle payload codec at [{path}] must be \"avro\"; found {found}. JSON is only the HTTP document transport and cannot be imported as durable payload data.")));
+}
+
+fn inspect_payload_envelope(value: Option<&Php>, path: &str, errors: &mut Vec<Value>) {
+    let Some(envelope) = value.and_then(Php::array) else {
+        return;
+    };
+    if envelope.contains("blob") || envelope.contains("external_storage") {
+        reject_payload_codec(envelope.get("codec"), &format!("{path}.codec"), errors);
+    }
+    if let Some(external) = array(envelope.get("external_storage")) {
+        reject_payload_codec(external.get("codec"), &format!("{path}.external_storage.codec"), errors);
+    }
+}
+
+fn inspect_payload_row(row: &Php, path: &str, fields: &[&str], errors: &mut Vec<Value>) {
+    reject_payload_codec(row.get("payload_codec"), &format!("{path}.payload_codec"), errors);
+    for field in fields {
+        inspect_payload_envelope(row.get(field), &format!("{path}.{field}"), errors);
+    }
+}
+
+fn inspect_failure_details(value: Option<&Php>, path: &str, errors: &mut Vec<Value>) {
+    let Some(details) = value.filter(|value| value.is_array()) else {
+        return;
+    };
+    reject_payload_codec(details.get("details_payload_codec"), &format!("{path}.details_payload_codec"), errors);
+    inspect_payload_envelope(details.get("details"), &format!("{path}.details"), errors);
+}
+
+/// `rejectUnsupportedPayloadCodecs`, one finding per offending path in the
+/// importer's walk order.
+fn reject_unsupported_payload_codecs(bundle: &Php, errors: &mut Vec<Value>) {
+    let empty = Php::Array(PhpArray::default());
+    let payloads = bundle.get("payloads").filter(|value| value.is_array()).unwrap_or(&empty);
+    let arguments = payloads.get("arguments").filter(|value| value.is_array()).unwrap_or(&empty);
+    let output = payloads.get("output").filter(|value| value.is_array()).unwrap_or(&empty);
+    reject_payload_codec(payloads.get("codec"), "payloads.codec", errors);
+    reject_payload_codec(output.get("codec"), "payloads.output.codec", errors);
+    inspect_payload_envelope(arguments.get("data"), "payloads.arguments.data", errors);
+    inspect_payload_envelope(output.get("data"), "payloads.output.data", errors);
+    for (section, fields) in PAYLOAD_ROW_FIELDS {
+        for (index, row) in list(bundle.get(section)).into_iter().enumerate() {
+            inspect_payload_row(row, &format!("{section}.{index}"), fields, errors);
+        }
+    }
+    for (index, event) in list(bundle.get("history_events")).into_iter().enumerate() {
+        let kind = text(event.get("type"));
+        let payload = event.get("payload").filter(|value| value.is_array()).unwrap_or(&empty);
+        let path = format!("history_events.{index}.payload");
+        if let Some((_, fields)) = kind.and_then(|kind| HISTORY_EVENT_PAYLOAD_FIELDS.iter().find(|(name, _)| *name == kind)) {
+            inspect_payload_row(payload, &path, fields, errors);
+        }
+        let Some(kind) = kind else {
+            continue;
+        };
+        if ACTIVITY_SNAPSHOT_EVENT_TYPES.contains(&kind)
+            && let Some(activity) = payload.get("activity").filter(|value| value.is_array())
+        {
+            inspect_payload_row(activity, &format!("{path}.activity"), &["arguments", "result", "exception"], errors);
+            inspect_failure_details(activity.get("exception"), &format!("{path}.activity.exception"), errors);
+        }
+        if FAILURE_PAYLOAD_EVENT_TYPES.contains(&kind) {
+            inspect_failure_details(payload.get("exception"), &format!("{path}.exception"), errors);
+        }
+        if SERVICE_CALL_EVENT_TYPES.contains(&kind) {
+            for surface in ["service_call", "response_or_failure_surface"] {
+                let Some(value) = payload.get(surface).filter(|value| value.is_array()) else {
+                    continue;
+                };
+                inspect_payload_row(value, &format!("{path}.{surface}"), &["request_payload", "response_payload"], errors);
+                inspect_failure_details(value.get("exception"), &format!("{path}.{surface}.exception"), errors);
+            }
+        }
+    }
+    let manifest = bundle.get("payload_manifest").filter(|value| value.is_array()).unwrap_or(&empty);
+    for (index, entry) in list(manifest.get("entries")).into_iter().enumerate() {
+        reject_payload_codec(entry.get("codec"), &format!("payload_manifest.entries.{index}.codec"), errors);
+    }
+}
+
+/// `rejectOpenLeases`: the first leased task, else the first running attempt.
+fn reject_open_leases(bundle: &Php, errors: &mut Vec<Value>) {
+    if list(bundle.get("tasks")).iter().any(|task| task.get("status").and_then(Php::str) == Some("leased")) {
+        errors.push(finding("tasks.leased_task_present", "Leased workflow or activity tasks must be completed, failed, or released before import."));
+        return;
+    }
+    let running = list(bundle.get("activities")).iter().any(|activity| {
+        list(activity.get("attempts")).iter().any(|attempt| attempt.get("status").and_then(Php::str) == Some("running"))
+    });
+    if running {
+        errors.push(finding("activities.running_attempt_present", "Running activity attempts must be released before import."));
+    }
+}
+
+/// `estimatedRows`: memos and search attributes are never estimated.
+fn estimated_rows(bundle: &Php) -> Rows {
+    let count = |section: &str| list(bundle.get(section)).len() as i64;
+    let mut rows = [0; 15];
+    rows[row("workflow_instances")] = 1;
+    rows[row("workflow_runs")] = 1;
+    rows[row("workflow_history_events")] = count("history_events");
+    rows[row("workflow_commands")] = count("commands");
+    rows[row("workflow_signal_records")] = count("signals");
+    rows[row("workflow_updates")] = count("updates");
+    rows[row("workflow_tasks")] = count("tasks");
+    rows[row("activity_executions")] = count("activities");
+    rows[row("activity_attempts")] = list(bundle.get("activities")).iter().map(|activity| list(activity.get("attempts")).len() as i64).sum();
+    rows[row("workflow_run_timers")] = count("timers");
+    rows[row("workflow_failures")] = count("failures");
+    let links = bundle.get("links").filter(|value| value.is_array());
+    rows[row("workflow_links")] = links.map_or(0, |links| (list(links.get("parents")).len() + list(links.get("children")).len()) as i64);
+    rows[row("workflow_run_summaries")] = 1;
+    rows
+}
+
+/// Everything decided before the store is read.
+pub(super) struct Prepared {
+    bundle: PhpArray,
+    options: Options,
+    summary: Summary,
+    eligibility: Eligibility,
+    base: Map<String, Value>,
+    memo_entries: Option<Vec<(String, Decoded)>>,
+}
+
+/// The configured `workflows.v2.history_export.signing_key`, trimmed.
+fn configured_signing_key() -> Option<String> {
+    ["DW_V2_HISTORY_EXPORT_SIGNING_KEY", "WORKFLOW_V2_HISTORY_EXPORT_SIGNING_KEY"]
+        .iter()
+        .find_map(|name| std::env::var(name).ok())
+        .map(|value| value.trim().to_owned())
+        .filter(|value| !value.is_empty())
+}
+
+/// Summary, verification, eligibility and the report's base fields.
+pub(super) fn prepare(bundle: PhpArray, options: Options, namespace: &str) -> Prepared {
+    let summary = Summary::of(&bundle, namespace);
+    let configured = configured_signing_key();
+    let verification = bundle_verifier::verify(&bundle, options.signing_key.as_deref(), configured.as_deref());
+    let verified = verification.report["integrity"]["signature_verified"] == json!(true);
+    let eligibility = eligibility(&bundle, verification.status, verified, &summary, &options);
+    let workflow = json!({
+        "instance_id": summary.instance_id,
+        "run_id": summary.run_id,
+        "run_number": summary.run_number,
+        "workflow_type": summary.workflow_type,
+        "namespace": summary.namespace,
+        "status": summary.status,
+        "is_current_run": truthy(summary.get("is_current_run")),
+        "history_complete": truthy(bundle.get("history_complete")),
+        "dedupe_key": text(bundle.get("dedupe_key")),
+    });
+    let mut base = Map::new();
+    base.insert("schema".into(), json!(REPORT_SCHEMA));
+    base.insert("schema_version".into(), json!(1));
+    base.insert("contract_version".into(), json!(CONTRACT_VERSION));
+    base.insert("source".into(), json!(IMPORT_SOURCE));
+    base.insert("dry_run".into(), json!(options.dry_run));
+    base.insert("workflow".into(), workflow);
+    base.insert("eligibility".into(), eligibility.json());
+    base.insert("integrity".into(), verification.report);
+    base.insert("rollback".into(), json!({"mode":"database_transaction","partial_import_behavior":"no_rows_committed_on_failure"}));
+    Prepared { bundle, options, summary, eligibility, base, memo_entries: verification.memo_entries }
+}
+
+fn report(base: &Map<String, Value>, status: &str, eligibility: Option<Value>, rows: &Rows, imported: Option<(&str, &str)>) -> Value {
+    let mut body = base.clone();
+    if let Some(eligibility) = eligibility {
+        body.insert("eligibility".into(), eligibility);
+    }
+    body.insert("status".into(), json!(status));
+    if let Some((import_id, imported_at)) = imported {
+        body.insert("import_id".into(), json!(import_id));
+        body.insert("imported_at".into(), json!(imported_at));
+    }
+    body.insert("rows".into(), rows_json(rows));
+    Value::Object(body)
+}
+
+/// A run with the bundle's run id, wherever it lives.
+pub(crate) struct ExistingRun {
+    pub(super) import_source: Option<String>,
+    pub(super) dedupe_key: Option<String>,
+    pub(super) namespace: Option<String>,
+}
+
+/// One prepared memo row: the stored projection and the canonical envelope.
+pub(crate) struct MemoRow {
+    pub(super) key: String,
+    pub(super) value: Value,
+    pub(super) portable: Value,
+}
+
+/// One typed search attribute row.
+pub(crate) struct AttributeRow {
+    pub(super) key: String,
+    pub(super) value: super::search_attribute_upserts::Typed,
+}
+
+/// The write plan the store executes in one transaction.
+pub(crate) struct Plan {
+    pub(super) bundle: Php,
+    pub(super) summary: Summary,
+    pub(super) import_id: String,
+    pub(super) imported_at: DateTime<Utc>,
+    /// The memo rows, or the importer's exception message.
+    pub(super) memos: std::result::Result<Vec<MemoRow>, String>,
+    /// The search attribute rows, or the importer's exception message.
+    pub(super) attributes: std::result::Result<Vec<AttributeRow>, String>,
+}
+
+/// `writeMemos`' rows from the decoded entries: every non-empty key, its
+/// value re-encoded canonically and projected as the Server stores it.
+fn memo_rows(summary: &Summary, decoded: Option<Vec<(String, Decoded)>>) -> std::result::Result<Vec<MemoRow>, String> {
+    let entries = match decoded {
+        Some(entries) => entries,
+        None => {
+            let Some(payload) = array(summary.get("memo_payload")) else {
+                return Err("workflow.memo_payload must contain the lossless portable memo payload envelope.".into());
+            };
+            bundle_verifier::decode_entries(payload)?
+        }
+    };
+    let codec = crate::codec::ValueCodec::new().map_err(|error| error.to_string())?;
+    let mut rows = Vec::new();
+    for (key, value) in entries {
+        if key.is_empty() {
+            continue;
+        }
+        let blob = codec.encode_ordered(&value.protocol()).map_err(|error| error.to_string())?;
+        let size = crate::codec::php_base64(&blob).map_err(|error| error.to_string())?.len();
+        if size > MEMO_VALUE_LIMIT {
+            return Err(format!("Memo value for key \"{key}\" exceeds maximum size of {MEMO_VALUE_LIMIT} bytes (actual: {size} bytes)"));
+        }
+        rows.push(MemoRow { value: bundle_verifier::stored_projection(&value), portable: json!({"codec":"avro","blob":blob}), key });
+    }
+    Ok(rows)
+}
+
+/// `writeSearchAttributes`' rows: `setTypedValueWithInference` for every
+/// non-empty string key.
+fn attribute_rows(summary: &Summary) -> std::result::Result<Vec<AttributeRow>, String> {
+    use super::search_attribute_upserts::Typed;
+    let Some(attributes) = array(summary.get("search_attributes")) else {
+        return Ok(Vec::new());
+    };
+    let length = |text: &str| text.chars().count();
+    let scalar_text = |value: &Php| -> std::result::Result<String, String> {
+        Ok(match value {
+            Php::Null => String::new(),
+            Php::Str(text) => text.clone(),
+            Php::Bool(true) => "1".into(),
+            Php::Bool(false) => String::new(),
+            Php::Int(number) => number.to_string(),
+            Php::Float(number) => php_value::float(*number, false),
+            Php::Array(_) => return Err("Cannot coerce value to string: array".into()),
+        })
+    };
+    let mut rows = Vec::new();
+    for (key, value) in &attributes.0 {
+        let Key::Str(key) = key else {
+            continue;
+        };
+        if key.is_empty() {
+            continue;
+        }
+        let typed = match value {
+            Php::Bool(flag) => Typed::Bool(*flag),
+            Php::Int(number) => Typed::Int(*number),
+            Php::Float(number) => Typed::Float(*number),
+            Php::Str(text) if length(text) > SEARCH_KEYWORD_LIMIT || text.chars().any(char::is_whitespace) => {
+                if length(text) > SEARCH_STRING_LIMIT {
+                    return Err(format!("Search attribute string value exceeds maximum length ({} > {SEARCH_STRING_LIMIT})", length(text)));
+                }
+                Typed::String(text.clone())
+            }
+            Php::Array(items) => {
+                if !items.is_list() {
+                    return Err("Search attribute keyword_list value must be a list of strings.".into());
+                }
+                let mut list = Vec::new();
+                for item in items.values() {
+                    let Php::Str(item) = item else {
+                        return Err("Search attribute keyword_list entries must be strings.".into());
+                    };
+                    if length(item) > SEARCH_KEYWORD_LIMIT {
+                        return Err(format!("Search attribute keyword_list entry exceeds maximum length ({} > {SEARCH_KEYWORD_LIMIT})", length(item)));
+                    }
+                    list.push(item.clone());
+                }
+                Typed::KeywordList(list)
+            }
+            other => {
+                let keyword = scalar_text(other)?;
+                if length(&keyword) > SEARCH_KEYWORD_LIMIT {
+                    return Err(format!("Search attribute keyword value exceeds maximum length ({} > {SEARCH_KEYWORD_LIMIT})", length(&keyword)));
+                }
+                Typed::Keyword(keyword)
+            }
+        };
+        rows.push(AttributeRow { key: key.clone(), value: typed });
+    }
+    Ok(rows)
+}
+
+/// A parsed bundle time: its wall-clock time in its own offset, which
+/// Eloquent stores for ordinary date columns, and the UTC instant, which the
+/// history recorded-at and archive casts store.
+#[derive(Clone, Copy, Debug)]
+pub(super) struct Stamp {
+    pub(super) wall: DateTime<Utc>,
+    pub(super) utc: DateTime<Utc>,
+}
+
+/// `Carbon::parse` for the times an export carries: RFC 3339 with an offset,
+/// or a date and time without one (read in the UTC application timezone).
+pub(super) fn parse_time(text: &str) -> std::result::Result<Stamp, String> {
+    if let Ok(time) = DateTime::parse_from_rfc3339(text).or_else(|_| DateTime::parse_from_str(text, "%Y-%m-%dT%H:%M:%S%.f%z")) {
+        return Ok(Stamp { wall: time.naive_local().and_utc(), utc: time.with_timezone(&Utc) });
+    }
+    for format in ["%Y-%m-%dT%H:%M:%S%.f", "%Y-%m-%d %H:%M:%S%.f", "%Y-%m-%dT%H:%M", "%Y-%m-%d %H:%M"] {
+        if let Ok(time) = NaiveDateTime::parse_from_str(text, format) {
+            let time = time.and_utc();
+            return Ok(Stamp { wall: time, utc: time });
+        }
+    }
+    if let Ok(date) = chrono::NaiveDate::parse_from_str(text, "%Y-%m-%d") {
+        let time = date.and_hms_opt(0, 0, 0).expect("midnight").and_utc();
+        return Ok(Stamp { wall: time, utc: time });
+    }
+    let first = text.chars().next().unwrap_or(' ');
+    Err(format!("Could not parse '{text}': Failed to parse time string ({text}) at position 0 ({first}): The timezone could not be found in the database"))
+}
+
+/// `timestamp`: a non-empty string parsed, or absent.
+pub(super) fn time(value: Option<&Php>) -> std::result::Result<Option<Stamp>, String> {
+    text(value).map(parse_time).transpose()
+}
+
+/// `payloadRowValue`: a stored payload string, an envelope's blob, or an
+/// external-storage envelope encoded as a stored reference.
+pub(super) fn payload_row_value(value: Option<&Php>) -> std::result::Result<Option<String>, String> {
+    if let Some(text) = text(value) {
+        return Ok(Some(text.to_owned()));
+    }
+    let Some(envelope) = value.and_then(Php::array) else {
+        return Ok(None);
+    };
+    if let Some(blob) = text(envelope.get("blob")) {
+        return Ok(Some(blob.to_owned()));
+    }
+    if envelope.get("external_storage").is_some_and(Php::is_array) {
+        return encode_stored_envelope(envelope).map(Some);
+    }
+    Ok(None)
+}
+
+/// `ExternalPayloads::encodeStoredEnvelope`.
+fn encode_stored_envelope(envelope: &PhpArray) -> std::result::Result<String, String> {
+    use base64::{Engine, engine::general_purpose::STANDARD};
+    let codec = text(envelope.get("codec")).ok_or("External payload envelope codec must be a non-empty string.")?;
+    let reference = array(envelope.get("external_storage")).ok_or("External payload envelope must contain an external_storage object.")?;
+    if reference.get("schema").and_then(Php::str) != Some("durable-workflow.v2.external-payload-reference.v1") {
+        return Err("Unsupported external payload reference schema.".into());
+    }
+    if text(reference.get("uri")).is_none() {
+        return Err("External payload reference URI must be a non-empty string.".into());
+    }
+    let sha = reference.get("sha256").and_then(Php::str).ok_or("External payload reference sha256 must be a hex digest.")?;
+    if sha.len() != 64 || !sha.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err("External payload reference sha256 must be a hex digest.".into());
+    }
+    if !matches!(reference.get("size_bytes"), Some(Php::Int(size)) if *size >= 0) {
+        return Err("External payload reference size_bytes must be a non-negative integer.".into());
+    }
+    let reference_codec = text(reference.get("codec")).ok_or("External payload reference codec must be a non-empty string.")?;
+    let canonical = |codec: &str| -> std::result::Result<(), String> {
+        if codec == "avro" {
+            Ok(())
+        } else {
+            Err(format!("unsupported_payload_codec: payload codec \"{codec}\" is not supported by Durable Workflow 2.0; use codec=\"avro\" with the fixed Avro Value schema and single-object framing. JSON remains the HTTP document transport, not a workflow payload codec."))
+        }
+    };
+    canonical(reference_codec)?;
+    canonical(codec)?;
+    let json = Php::Array(envelope.clone()).canonical().encode(Flags { unescaped_slashes: true, ..Flags::default() });
+    Ok(format!("dw-external-payload:v1:{}", STANDARD.encode(json)))
+}
+
+impl Runtime {
+    /// `EmbeddedV2ImportController::store` once the gates have passed.
+    pub(crate) async fn import_embedded_v2(&self, body: &[u8], query: &[(String, String)]) -> Result<(StatusCode, Value)> {
+        let operation = || super::control_plane::Operation::ImportEmbeddedV2;
+        let (bundle, options) = match request(body, query) {
+            Request::Invalid => {
+                return Ok((StatusCode::UNPROCESSABLE_ENTITY, operation().response(json!({
+                    "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
+                    "reason": "invalid_import_bundle"}))));
+            }
+            Request::Import(bundle, options) => (bundle, options),
+        };
+        let namespace = self.namespace_name();
+        // Canonical JSON, hashing and Avro decoding stay off the async workers.
+        let prepared = tokio::task::spawn_blocking(move || prepare(bundle, options, &namespace))
+            .await
+            .map_err(|_| refuse(StatusCode::SERVICE_UNAVAILABLE, "history_import_unavailable"))?;
+        let empty = [0; 15];
+        let answer = |status: &str, eligibility: Option<Value>, rows: &Rows, imported: Option<(&str, &str)>| {
+            let code = match status {
+                "imported" => StatusCode::CREATED,
+                "already_imported" | "dry_run" => StatusCode::OK,
+                _ => StatusCode::UNPROCESSABLE_ENTITY,
+            };
+            (code, operation().response(report(&prepared.base, status, eligibility, rows, imported)))
+        };
+        if !prepared.eligibility.errors.is_empty() {
+            return Ok(answer("rejected", None, &empty, None));
+        }
+        let run_id = prepared.summary.run_id.clone().unwrap_or_default();
+        let dedupe_key = text(prepared.bundle.get("dedupe_key")).map(str::to_owned);
+        if let Some(existing) = self.import_existing_run(&run_id).await? {
+            let same_bundle = existing.import_source.as_deref() == Some(IMPORT_SOURCE)
+                && existing.dedupe_key.is_some()
+                && existing.dedupe_key == dedupe_key;
+            // A run counts as already imported only in this namespace.
+            if same_bundle && existing.namespace.as_deref() == Some(prepared.summary.namespace.as_str()) {
+                return Ok(answer("already_imported", None, &empty, None));
+            }
+            return Ok(answer("rejected", Some(prepared.eligibility.with_error("target.run_id_conflict",
+                "A workflow run with this run_id already exists and was not imported from the same bundle.")), &empty, None));
+        }
+        let root = Php::Array(prepared.bundle.clone());
+        if prepared.options.dry_run {
+            return Ok(answer("dry_run", None, &estimated_rows(&root), None));
+        }
+        let import_id = prepared.options.import_id.clone().unwrap_or_else(id);
+        let imported_at = now();
+        let memos = memo_rows(&prepared.summary, prepared.memo_entries.clone());
+        let attributes = attribute_rows(&prepared.summary);
+        let Prepared { summary, eligibility, base, .. } = prepared;
+        let plan = Plan { bundle: root, summary, import_id: import_id.clone(), imported_at, memos, attributes };
+        let written = self.import_write(&plan).await;
+        let answer = |status: &str, eligibility: Option<Value>, rows: &Rows, imported: Option<(&str, &str)>| {
+            let code = if status == "imported" { StatusCode::CREATED } else { StatusCode::UNPROCESSABLE_ENTITY };
+            (code, operation().response(report(&base, status, eligibility, rows, imported)))
+        };
+        Ok(match written {
+            Ok(rows) => {
+                let at = super::task_queues::json_time(Some(imported_at));
+                answer("imported", None, &rows, Some((&import_id, at.as_str().unwrap_or_default())))
+            }
+            Err(message) => answer("rejected", Some(eligibility.with_error("target.write_failed", &message)), &empty, None),
+        })
+    }
+}
+
+/// The JSON column value PHP's array cast stores for `arrayValue(x) ?? []`.
+fn document_or_empty(value: Option<&Php>) -> Value {
+    match value {
+        Some(Php::Array(array)) => Php::Array(array.clone()).to_json(),
+        _ => json!([]),
+    }
+}
+
+/// The current time for a row PHP stamps with `now()`.
+fn stamp_now() -> Stamp {
+    let at = now();
+    Stamp { wall: at, utc: at }
+}
+
+fn wall(stamp: Option<Stamp>) -> Option<DateTime<Utc>> {
+    stamp.map(|stamp| stamp.wall)
+}
+
+/// An enum-cast column: PHP's `BackedEnum::from` refuses an unknown value.
+fn cast_enum<'a>(allowed: &[&str], name: &str, value: Option<&'a str>) -> std::result::Result<Option<&'a str>, String> {
+    match value {
+        Some(value) if !allowed.contains(&value) => {
+            Err(format!("\"{value}\" is not a valid backing value for enum Workflow\\V2\\Enums\\{name}"))
+        }
+        other => Ok(other),
+    }
+}
+
+store_methods! {
+    /// The run with this id in any namespace: PHP's lookup is global, and a
+    /// run id is unique across the store.
+    pub(crate) async fn import_existing_run(&self, run_id: &str) -> Result<Option<ExistingRun>> {
+        let Some(row) = Self::query("SELECT import_source,import_dedupe_key,namespace FROM workflow_runs WHERE id=$1")
+            .bind(run_id)
+            .fetch_optional(&self.pool)
+            .await?
+        else {
+            return Ok(None);
+        };
+        Ok(Some(ExistingRun {
+            import_source: DB::optional_string(&row, "import_source")?,
+            dedupe_key: DB::optional_string(&row, "import_dedupe_key")?,
+            namespace: DB::optional_string(&row, "namespace")?,
+        }))
+    }
+
+    pub(crate) fn namespace_name(&self) -> String {
+        self.namespace.as_ref().to_owned()
+    }
+
+    /// `writeBundle` in one transaction: the written row counts, or the
+    /// message of whatever failed (nothing stays).
+    pub(crate) async fn import_write(&self, plan: &Plan) -> std::result::Result<Rows, String> {
+        let mut tx = self.begin().await.map_err(|error| error.to_string())?;
+        let rows = Self::import_rows(&mut tx, plan, self.namespace.as_ref()).await?;
+        let run_id = plan.summary.run_id.as_deref().unwrap_or_default();
+        tx.summary_changed(run_id);
+        tx.commit().await.map_err(|error| error.to_string())?;
+        self.wake.notify_waiters();
+        Ok(rows)
+    }
+
+    async fn import_rows(tx: &mut super::transaction::Transaction<'_, DB>, plan: &Plan, namespace: &str) -> std::result::Result<Rows, String> {
+        let db = |error: sqlx::Error| error.to_string();
+        let mut rows: Rows = [0; 15];
+        let bundle = &plan.bundle;
+        let summary = &plan.summary;
+        let imported = Stamp { wall: plan.imported_at, utc: plan.imported_at };
+        let run_id = summary.run_id.as_deref().unwrap_or_default();
+        let instance_id = summary.instance_id.as_deref().unwrap_or_default();
+        let run_number = summary.run_number;
+        let events = list(bundle.get("history_events"));
+        let commands = list(bundle.get("commands"));
+        let history_sequence = int(summary.get("last_history_sequence")).unwrap_or(0).max(max_sequence(&events, "sequence"));
+        let last_command_sequence = max_sequence(&commands, "sequence");
+        let message_cursor = max_sequence(&commands, "message_sequence");
+        let empty = Php::Array(PhpArray::default());
+        let payloads = bundle.get("payloads").filter(|value| value.is_array());
+        let payload_codec = text(payloads.and_then(|payloads| payloads.get("codec"))).unwrap_or("avro").to_owned();
+        let output = payloads.and_then(|payloads| payloads.get("output")).filter(|value| value.is_array());
+        let output_codec = if matches!(output.and_then(|output| output.get("available")), Some(Php::Bool(true))) {
+            text(output.and_then(|output| output.get("codec")))
+                .or_else(|| output.and_then(|output| output.get("data")).and_then(|data| text(data.get("codec"))))
+                .or_else(|| {
+                    events.iter().rev()
+                        .find(|event| event.get("type").and_then(Php::str) == Some("WorkflowCompleted") && event.get("payload").is_some_and(Php::is_array))
+                        .and_then(|event| text(event.at(&["payload", "payload_codec"])))
+                })
+                .map(str::to_owned)
+        } else {
+            None
+        };
+        // `payloadData`: an available payload's stored value.
+        let payload_data = |key: &str| -> std::result::Result<Option<String>, String> {
+            let payload = payloads.and_then(|payloads| payloads.get(key)).filter(|value| value.is_array());
+            match payload {
+                Some(payload) if matches!(payload.get("available"), Some(Php::Bool(true))) => payload_row_value(payload.get("data")),
+                _ => Ok(None),
+            }
+        };
+        let field = |key: &str| text(summary.get(key));
+        let started = time(summary.get("started_at"))?;
+        let business_key = field("business_key");
+        let visibility = document_or_empty(summary.get("visibility_labels"));
+
+        // The instance, reused only within this namespace.
+        let instance = Self::query("SELECT namespace,current_run_id,run_count,last_message_sequence FROM workflow_instances WHERE id=$1")
+            .bind(instance_id).fetch_optional(&mut **tx).await.map_err(db)?;
+        let (current_run, run_count, last_message) = match &instance {
+            Some(instance) => {
+                let owner = DB::optional_string(instance, "namespace").map_err(|error| error.to_string())?;
+                if owner.as_deref() != Some(namespace) {
+                    return Err(format!("Workflow instance [{instance_id}] belongs to another namespace."));
+                }
+                (DB::optional_string(instance, "current_run_id").map_err(|error| error.to_string())?,
+                    DB::number(instance, "run_count").map_err(|error| error.to_string())?,
+                    DB::number(instance, "last_message_sequence").map_err(|error| error.to_string())?)
+            }
+            None => {
+                Self::query("INSERT INTO workflow_instances(id,workflow_class,workflow_type,namespace,business_key,visibility_labels,memo,current_run_id,run_count,last_message_sequence,started_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,NULL,$8,$9,$10,$11,$12)")
+                    .bind(instance_id).bind(summary.workflow_class.as_str()).bind(summary.workflow_type.as_str()).bind(namespace)
+                    .bind(business_key).bind(DB::document(&visibility)).bind(DB::document(&document_or_empty(summary.get("memo"))))
+                    .bind(run_number).bind(message_cursor).bind(DB::optional_time(wall(started)))
+                    .bind(DB::bind_time(started.unwrap_or(imported).wall)).bind(DB::bind_time(imported.wall))
+                    .execute(&mut **tx).await.map_err(db)?;
+                rows[row("workflow_instances")] += 1;
+                (None, run_number, message_cursor)
+            }
+        };
+
+        let closed = time(summary.get("closed_at"))?;
+        let archived = time(summary.get("archived_at"))?;
+        let progress = time(summary.get("last_progress_at"))?;
+        let arguments = payload_data("arguments")?;
+        let output_data = payload_data("output")?;
+        Self::query("INSERT INTO workflow_runs(id,workflow_instance_id,run_number,workflow_class,workflow_type,namespace,business_key,visibility_labels,status,closed_reason,compatibility,payload_codec,output_payload_codec,arguments,output,connection,queue,last_history_sequence,last_command_sequence,message_cursor_position,started_at,closed_at,archived_at,archive_command_id,archive_reason,last_progress_at,import_source,import_id,import_dedupe_key,import_contract_version,imported_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33)")
+            .bind(run_id).bind(instance_id).bind(run_number).bind(summary.workflow_class.as_str()).bind(summary.workflow_type.as_str())
+            .bind(namespace).bind(business_key).bind(DB::document(&visibility)).bind(summary.status.as_str())
+            .bind(field("closed_reason")).bind(field("compatibility")).bind(payload_codec.as_str()).bind(output_codec.as_deref())
+            .bind(arguments.as_deref()).bind(output_data.as_deref()).bind(field("connection")).bind(field("queue"))
+            .bind(history_sequence).bind(last_command_sequence).bind(message_cursor)
+            .bind(DB::optional_time(wall(started))).bind(DB::optional_time(wall(closed)))
+            .bind(DB::optional_time(archived.map(|stamp| stamp.utc))).bind(field("archive_command_id")).bind(field("archive_reason"))
+            .bind(DB::bind_time(progress.unwrap_or(imported).wall)).bind(IMPORT_SOURCE).bind(plan.import_id.as_str())
+            .bind(text(bundle.get("dedupe_key"))).bind(CONTRACT_VERSION).bind(DB::bind_time(imported.wall))
+            .bind(DB::bind_time(started.unwrap_or(imported).wall)).bind(DB::bind_time(progress.unwrap_or(imported).wall))
+            .execute(&mut **tx).await.map_err(db)?;
+        rows[row("workflow_runs")] += 1;
+
+        // The run becomes current when it says so, or when it closes an
+        // instance with no current run.
+        let current = truthy(summary.get("is_current_run")) || (current_run.is_none() && summary.terminal());
+        Self::query("UPDATE workflow_instances SET current_run_id=$1,run_count=$2,last_message_sequence=$3,updated_at=$4 WHERE id=$5")
+            .bind(if current { Some(run_id) } else { current_run.as_deref() }).bind(run_count.max(run_number))
+            .bind(last_message.max(message_cursor)).bind(DB::bind_time(imported.wall)).bind(instance_id)
+            .execute(&mut **tx).await.map_err(db)?;
+
+        for event in &events {
+            let Some(kind) = enumerated(HISTORY_EVENT_TYPES, event.get("type")) else {
+                continue;
+            };
+            let recorded = time(event.get("recorded_at"))?;
+            let created = recorded.unwrap_or_else(stamp_now);
+            let event_id = text(event.get("id")).map_or_else(id, str::to_owned);
+            Self::query("INSERT INTO workflow_history_events(id,workflow_run_id,sequence,event_type,payload,workflow_task_id,workflow_command_id,recorded_at,recorded_at_utc,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)")
+                .bind(event_id).bind(run_id).bind(int(event.get("sequence")).unwrap_or(0)).bind(kind)
+                .bind(DB::document(&document_or_empty(event.get("payload")))).bind(text(event.get("workflow_task_id")))
+                .bind(text(event.get("workflow_command_id"))).bind(DB::optional_time(recorded.map(|stamp| stamp.utc)))
+                .bind(DB::optional_time(recorded.map(|stamp| stamp.utc))).bind(DB::bind_time(created.wall)).bind(DB::bind_time(created.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_history_events")] += 1;
+        }
+
+        for command in &commands {
+            let (Some(kind), Some(status)) = (enumerated(COMMAND_TYPES, command.get("type")), enumerated(COMMAND_STATUSES, command.get("status"))) else {
+                continue;
+            };
+            let accepted = time(command.get("accepted_at"))?;
+            let applied = time(command.get("applied_at"))?;
+            let rejected = time(command.get("rejected_at"))?;
+            let outcome = cast_enum(COMMAND_OUTCOMES, "CommandOutcome", text(command.get("outcome")))?;
+            let payload = payload_row_value(command.get("payload"))?;
+            let created = accepted.unwrap_or_else(stamp_now);
+            let updated = applied.or(rejected).or(accepted).unwrap_or_else(stamp_now);
+            Self::query("INSERT INTO workflow_commands(id,workflow_instance_id,workflow_run_id,requested_workflow_run_id,resolved_workflow_run_id,command_type,target_scope,source,context,status,outcome,workflow_class,workflow_type,payload_codec,payload,rejection_reason,command_sequence,message_sequence,accepted_at,applied_at,rejected_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23)")
+                .bind(text(command.get("id")).map_or_else(id, str::to_owned)).bind(instance_id).bind(run_id)
+                .bind(text(command.get("requested_run_id"))).bind(text(command.get("resolved_run_id")).unwrap_or(run_id)).bind(kind)
+                .bind(text(command.get("target_scope")).unwrap_or("instance")).bind(text(command.get("source")).unwrap_or("embedded_v2_import"))
+                .bind(DB::document(&document_or_empty(command.get("context")))).bind(status).bind(outcome)
+                .bind(Some(summary.workflow_class.as_str()).filter(|value| !value.is_empty()))
+                .bind(Some(summary.workflow_type.as_str()).filter(|value| !value.is_empty()))
+                .bind(text(command.get("payload_codec"))).bind(payload.as_deref()).bind(text(command.get("rejection_reason")))
+                .bind(DB::optional_integer(int(command.get("sequence")))).bind(DB::optional_integer(int(command.get("message_sequence"))))
+                .bind(DB::optional_time(wall(accepted))).bind(DB::optional_time(wall(applied))).bind(DB::optional_time(wall(rejected)))
+                .bind(DB::bind_time(created.wall)).bind(DB::bind_time(updated.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_commands")] += 1;
+        }
+
+        for signal in list(bundle.get("signals")) {
+            let Some(status) = enumerated(SIGNAL_STATUSES, signal.get("status")) else {
+                continue;
+            };
+            let received = time(signal.get("received_at"))?;
+            let applied = time(signal.get("applied_at"))?;
+            let rejected = time(signal.get("rejected_at"))?;
+            let closed = time(signal.get("closed_at"))?;
+            let outcome = cast_enum(COMMAND_OUTCOMES, "CommandOutcome", text(signal.get("outcome")))?;
+            let arguments = payload_row_value(signal.get("arguments"))?;
+            let created = received.unwrap_or_else(stamp_now);
+            let updated = closed.or(received).unwrap_or_else(stamp_now);
+            Self::query("INSERT INTO workflow_signal_records(id,workflow_command_id,workflow_instance_id,workflow_run_id,target_scope,requested_workflow_run_id,resolved_workflow_run_id,signal_name,signal_wait_id,status,outcome,rejection_reason,validation_errors,command_sequence,workflow_sequence,payload_codec,arguments,received_at,applied_at,rejected_at,closed_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23)")
+                .bind(text(signal.get("id")).map_or_else(id, str::to_owned)).bind(text(signal.get("command_id")).map_or_else(id, str::to_owned))
+                .bind(instance_id).bind(run_id).bind(text(signal.get("target_scope")).unwrap_or("instance"))
+                .bind(text(signal.get("requested_run_id"))).bind(text(signal.get("resolved_run_id")).unwrap_or(run_id))
+                .bind(text(signal.get("name")).unwrap_or("imported-signal")).bind(text(signal.get("signal_wait_id"))).bind(status)
+                .bind(outcome).bind(text(signal.get("rejection_reason"))).bind(DB::document(&document_or_empty(signal.get("validation_errors"))))
+                .bind(DB::optional_integer(int(signal.get("command_sequence")))).bind(DB::optional_integer(int(signal.get("workflow_sequence"))))
+                .bind(text(signal.get("payload_codec"))).bind(arguments.as_deref())
+                .bind(DB::optional_time(wall(received))).bind(DB::optional_time(wall(applied))).bind(DB::optional_time(wall(rejected)))
+                .bind(DB::optional_time(wall(closed))).bind(DB::bind_time(created.wall)).bind(DB::bind_time(updated.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_signal_records")] += 1;
+        }
+
+        for update in list(bundle.get("updates")) {
+            let Some(status) = enumerated(UPDATE_STATUSES, update.get("status")) else {
+                continue;
+            };
+            let accepted = time(update.get("accepted_at"))?;
+            let applied = time(update.get("applied_at"))?;
+            let rejected = time(update.get("rejected_at"))?;
+            let closed = time(update.get("closed_at"))?;
+            let outcome = cast_enum(COMMAND_OUTCOMES, "CommandOutcome", text(update.get("outcome")))?;
+            let arguments = payload_row_value(update.get("arguments"))?;
+            let result = payload_row_value(update.get("result"))?;
+            let created = accepted.unwrap_or_else(stamp_now);
+            let updated = closed.or(accepted).unwrap_or_else(stamp_now);
+            Self::query("INSERT INTO workflow_updates(id,workflow_command_id,workflow_instance_id,workflow_run_id,target_scope,requested_workflow_run_id,resolved_workflow_run_id,update_name,status,outcome,command_sequence,workflow_sequence,payload_codec,arguments,result,validation_errors,rejection_reason,failure_id,accepted_at,applied_at,rejected_at,closed_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24)")
+                .bind(text(update.get("id")).map_or_else(id, str::to_owned)).bind(text(update.get("command_id")).map_or_else(id, str::to_owned))
+                .bind(instance_id).bind(run_id).bind(text(update.get("target_scope")).unwrap_or("instance"))
+                .bind(text(update.get("requested_run_id"))).bind(text(update.get("resolved_run_id")).unwrap_or(run_id))
+                .bind(text(update.get("name")).unwrap_or("imported-update")).bind(status).bind(outcome)
+                .bind(DB::optional_integer(int(update.get("command_sequence")))).bind(DB::optional_integer(int(update.get("workflow_sequence"))))
+                .bind(text(update.get("payload_codec"))).bind(arguments.as_deref()).bind(result.as_deref())
+                .bind(DB::document(&document_or_empty(update.get("validation_errors")))).bind(text(update.get("rejection_reason")))
+                .bind(text(update.get("failure_id"))).bind(DB::optional_time(wall(accepted))).bind(DB::optional_time(wall(applied)))
+                .bind(DB::optional_time(wall(rejected))).bind(DB::optional_time(wall(closed)))
+                .bind(DB::bind_time(created.wall)).bind(DB::bind_time(updated.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_updates")] += 1;
+        }
+
+        for task in list(bundle.get("tasks")) {
+            let (Some(kind), Some(status)) = (enumerated(TASK_TYPES, task.get("type")), enumerated(TASK_STATUSES, task.get("status"))) else {
+                continue;
+            };
+            let available = time(task.get("available_at"))?;
+            let leased = time(task.get("leased_at"))?;
+            let lease_expires = time(task.get("lease_expires_at"))?;
+            let dispatch_attempt = time(task.get("last_dispatch_attempt_at"))?;
+            let dispatched = time(task.get("last_dispatched_at"))?;
+            let claim_failed = time(task.get("last_claim_failed_at"))?;
+            let repair_available = time(task.get("repair_available_at"))?;
+            let created = available.unwrap_or_else(stamp_now);
+            let updated = dispatched.or(available).unwrap_or_else(stamp_now);
+            Self::query("INSERT INTO workflow_tasks(id,workflow_run_id,namespace,task_type,status,payload,connection,queue,compatibility,available_at,leased_at,lease_owner,lease_expires_at,attempt_count,repair_count,last_dispatch_attempt_at,last_dispatched_at,last_dispatch_error,last_claim_failed_at,last_claim_error,repair_available_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23)")
+                .bind(text(task.get("id")).map_or_else(id, str::to_owned)).bind(run_id).bind(namespace).bind(kind).bind(status)
+                .bind(DB::document(&document_or_empty(task.get("payload")))).bind(text(task.get("connection"))).bind(text(task.get("queue")))
+                .bind(text(task.get("compatibility"))).bind(DB::optional_time(wall(available))).bind(DB::optional_time(wall(leased)))
+                .bind(text(task.get("lease_owner"))).bind(DB::optional_time(wall(lease_expires)))
+                .bind(int(task.get("attempt_count")).unwrap_or(0)).bind(int(task.get("repair_count")).unwrap_or(0))
+                .bind(DB::optional_time(wall(dispatch_attempt))).bind(DB::optional_time(wall(dispatched)))
+                .bind(text(task.get("last_dispatch_error"))).bind(DB::optional_time(wall(claim_failed)))
+                .bind(text(task.get("last_claim_error"))).bind(DB::optional_time(wall(repair_available)))
+                .bind(DB::bind_time(created.wall)).bind(DB::bind_time(updated.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_tasks")] += 1;
+        }
+
+        let activities = list(bundle.get("activities"));
+        for activity in &activities {
+            let (Some(activity_id), Some(status)) = (text(activity.get("id")), enumerated(ACTIVITY_STATUSES, activity.get("status"))) else {
+                continue;
+            };
+            let created = time(activity.get("created_at"))?;
+            let started = time(activity.get("started_at"))?;
+            let closed = time(activity.get("closed_at"))?;
+            let heartbeat = time(activity.get("last_heartbeat_at"))?;
+            let class = text(activity.get("activity_class")).or_else(|| text(activity.get("activity_type"))).unwrap_or("imported-activity");
+            let kind = text(activity.get("activity_type")).or_else(|| text(activity.get("activity_class"))).unwrap_or("imported-activity");
+            let arguments = payload_row_value(activity.get("arguments"))?;
+            let result = payload_row_value(activity.get("result"))?;
+            let row_created = created.unwrap_or_else(stamp_now);
+            let row_updated = closed.or(created).unwrap_or_else(stamp_now);
+            Self::query("INSERT INTO activity_executions(id,workflow_run_id,sequence,activity_class,activity_type,status,payload_codec,arguments,result,exception,connection,queue,attempt_count,current_attempt_id,retry_policy,parallel_group_path,started_at,closed_at,last_heartbeat_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)")
+                .bind(activity_id).bind(run_id).bind(int(activity.get("sequence")).unwrap_or(0)).bind(class).bind(kind).bind(status)
+                .bind(text(activity.get("payload_codec")).unwrap_or(payload_codec.as_str())).bind(arguments.as_deref()).bind(result.as_deref())
+                .bind(text(activity.get("exception"))).bind(text(activity.get("connection"))).bind(text(activity.get("queue")))
+                .bind(int(activity.get("attempt_count")).unwrap_or(0)).bind(text(activity.get("current_attempt_id")))
+                .bind(DB::document(&document_or_empty(activity.get("retry_policy"))))
+                .bind(DB::document(&document_or_empty(activity.get("parallel_group_path"))))
+                .bind(DB::optional_time(wall(started))).bind(DB::optional_time(wall(closed))).bind(DB::optional_time(wall(heartbeat)))
+                .bind(DB::bind_time(row_created.wall)).bind(DB::bind_time(row_updated.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("activity_executions")] += 1;
+        }
+
+        for activity in &activities {
+            let Some(activity_id) = text(activity.get("id")) else {
+                continue;
+            };
+            for attempt in list(activity.get("attempts")) {
+                let Some(status) = enumerated(ATTEMPT_STATUSES, attempt.get("status")) else {
+                    continue;
+                };
+                let started = time(attempt.get("started_at"))?.unwrap_or_else(stamp_now);
+                let heartbeat = time(attempt.get("last_heartbeat_at"))?;
+                let lease_expires = time(attempt.get("lease_expires_at"))?;
+                let closed = time(attempt.get("closed_at"))?;
+                Self::query("INSERT INTO activity_attempts(id,workflow_run_id,activity_execution_id,workflow_task_id,worker_attempt_id,attempt_number,status,lease_owner,started_at,last_heartbeat_at,lease_expires_at,closed_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)")
+                    .bind(text(attempt.get("id")).map_or_else(id, str::to_owned)).bind(run_id).bind(activity_id)
+                    .bind(text(attempt.get("workflow_task_id")).or_else(|| text(attempt.get("task_id"))))
+                    .bind(text(attempt.get("worker_attempt_id"))).bind(int(attempt.get("attempt_number")).unwrap_or(1)).bind(status)
+                    .bind(text(attempt.get("lease_owner"))).bind(DB::bind_time(started.wall)).bind(DB::optional_time(wall(heartbeat)))
+                    .bind(DB::optional_time(wall(lease_expires))).bind(DB::optional_time(wall(closed)))
+                    .bind(DB::bind_time(started.wall)).bind(DB::bind_time(closed.unwrap_or(started).wall))
+                    .execute(&mut **tx).await.map_err(db)?;
+                rows[row("activity_attempts")] += 1;
+            }
+        }
+
+        for timer in list(bundle.get("timers")) {
+            let (Some(timer_id), Some(status)) = (text(timer.get("id")), enumerated(TIMER_STATUSES, timer.get("status"))) else {
+                continue;
+            };
+            let created = time(timer.get("created_at"))?;
+            let fire = time(timer.get("fire_at"))?;
+            let fired = time(timer.get("fired_at"))?;
+            let fire_at = fire.or(created).unwrap_or_else(stamp_now);
+            let row_created = created.unwrap_or_else(stamp_now);
+            let row_updated = fired.or(created).unwrap_or_else(stamp_now);
+            Self::query("INSERT INTO workflow_run_timers(id,workflow_run_id,sequence,status,delay_seconds,fire_at,fired_at,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)")
+                .bind(timer_id).bind(run_id).bind(int(timer.get("sequence")).unwrap_or(0)).bind(status)
+                .bind(int(timer.get("delay_seconds")).unwrap_or(0).max(0)).bind(DB::bind_time(fire_at.wall))
+                .bind(DB::optional_time(wall(fired))).bind(DB::bind_time(row_created.wall)).bind(DB::bind_time(row_updated.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_run_timers")] += 1;
+        }
+
+        for failure in list(bundle.get("failures")) {
+            let created = time(failure.get("created_at"))?.unwrap_or_else(stamp_now);
+            let category = cast_enum(FAILURE_CATEGORIES, "FailureCategory", text(failure.get("failure_category")))?;
+            Self::query("INSERT INTO workflow_failures(id,workflow_run_id,source_kind,source_id,propagation_kind,failure_category,non_retryable,handled,exception_class,message,file,line,trace_preview,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,CASE WHEN $7=1 THEN TRUE ELSE FALSE END,CASE WHEN $8=1 THEN TRUE ELSE FALSE END,$9,$10,$11,$12,$13,$14,$15)")
+                .bind(text(failure.get("id")).map_or_else(id, str::to_owned)).bind(run_id)
+                .bind(text(failure.get("source_kind")).unwrap_or("workflow")).bind(text(failure.get("source_id")).unwrap_or(run_id))
+                .bind(text(failure.get("propagation_kind")).unwrap_or("local")).bind(category)
+                .bind(i64::from(truthy(failure.get("non_retryable")))).bind(i64::from(truthy(failure.get("handled"))))
+                .bind(text(failure.get("exception_class")).or_else(|| text(failure.get("exception_type"))).unwrap_or("ImportedWorkflowFailure"))
+                .bind(text(failure.get("message")).unwrap_or("")).bind(text(failure.get("file")).unwrap_or(""))
+                .bind(DB::optional_integer(int(failure.get("line")))).bind(text(failure.get("trace_preview")))
+                .bind(DB::bind_time(created.wall)).bind(DB::bind_time(created.wall))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_failures")] += 1;
+        }
+
+        let links = bundle.get("links").filter(|value| value.is_array()).unwrap_or(&empty);
+        for (side, parent) in [("parents", true), ("children", false)] {
+            for link in list(links.get(side)) {
+                let (other_instance, other_run) = if parent {
+                    (text(link.get("parent_workflow_instance_id")), text(link.get("parent_workflow_run_id")))
+                } else {
+                    (text(link.get("child_workflow_instance_id")), text(link.get("child_workflow_run_id")))
+                };
+                let (Some(other_instance), Some(other_run)) = (other_instance, other_run) else {
+                    continue;
+                };
+                let (parent_instance, parent_run, child_instance, child_run) = if parent {
+                    (other_instance, other_run, instance_id, run_id)
+                } else {
+                    (instance_id, run_id, other_instance, other_run)
+                };
+                let link_id = ulid_value(link.get("id")).map_or_else(id, str::to_owned);
+                let link_type = text(link.get("type")).unwrap_or(if parent { "parent" } else { "child" });
+                let sequence = int(link.get("sequence"));
+                let primary = truthy(link.get("is_primary_parent"));
+                let created = time(link.get("created_at"))?.unwrap_or_else(stamp_now);
+                // A link exported from both its runs is written once; any
+                // other difference fails the import.
+                if let Some(existing) = Self::query("SELECT link_type,sequence,parent_workflow_instance_id,parent_workflow_run_id,child_workflow_instance_id,child_workflow_run_id,CASE WHEN is_primary_parent THEN 1 ELSE 0 END AS primary_flag FROM workflow_links WHERE id=$1")
+                    .bind(link_id.as_str()).fetch_optional(&mut **tx).await.map_err(db)?
+                {
+                    let read = |name: &str| DB::optional_string(&existing, name).map_err(|error| error.to_string());
+                    let checks: [(&str, bool); 7] = [
+                        ("link_type", read("link_type")?.as_deref() == Some(link_type)),
+                        ("sequence", DB::optional_number(&existing, "sequence").map_err(|error| error.to_string())? == sequence),
+                        ("parent_workflow_instance_id", read("parent_workflow_instance_id")?.as_deref() == Some(parent_instance)),
+                        ("parent_workflow_run_id", read("parent_workflow_run_id")?.as_deref() == Some(parent_run)),
+                        ("child_workflow_instance_id", read("child_workflow_instance_id")?.as_deref() == Some(child_instance)),
+                        ("child_workflow_run_id", read("child_workflow_run_id")?.as_deref() == Some(child_run)),
+                        ("is_primary_parent", (DB::number(&existing, "primary_flag").map_err(|error| error.to_string())? != 0) == primary),
+                    ];
+                    if let Some((field, _)) = checks.iter().find(|(_, same)| !same) {
+                        return Err(format!("Imported workflow link [{link_id}] conflicts on [{field}]."));
+                    }
+                    continue;
+                }
+                Self::query("INSERT INTO workflow_links(id,link_type,sequence,parent_workflow_instance_id,parent_workflow_run_id,child_workflow_instance_id,child_workflow_run_id,is_primary_parent,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$7,CASE WHEN $8=1 THEN TRUE ELSE FALSE END,$9,$10)")
+                    .bind(link_id.as_str()).bind(link_type).bind(DB::optional_integer(sequence)).bind(parent_instance).bind(parent_run)
+                    .bind(child_instance).bind(child_run).bind(i64::from(primary))
+                    .bind(DB::bind_time(created.wall)).bind(DB::bind_time(created.wall))
+                    .execute(&mut **tx).await.map_err(db)?;
+                rows[row("workflow_links")] += 1;
+            }
+        }
+
+        let written = now();
+        for memo in plan.memos.as_ref().map_err(Clone::clone)? {
+            Self::query(DB::MEMO_UPSERT)
+                .bind(run_id).bind(instance_id).bind(memo.key.as_str()).bind(DB::document(&memo.value)).bind(history_sequence)
+                .bind(DB::bind_time(written)).bind(DB::bind_time(written)).bind(DB::document(&memo.portable)).bind(history_sequence)
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_memos")] += 1;
+        }
+
+        for attribute in plan.attributes.as_ref().map_err(Clone::clone)? {
+            use super::search_attribute_upserts::Typed;
+            let value = &attribute.value;
+            let text_of = |kind| match value {
+                Typed::String(text) if kind == "string" => Some(text.as_str()),
+                Typed::Keyword(text) if kind == "keyword" => Some(text.as_str()),
+                _ => None,
+            };
+            Self::query(DB::SEARCH_ATTRIBUTE_UPSERT)
+                .bind(run_id).bind(instance_id).bind(attribute.key.as_str()).bind(value.kind())
+                .bind(text_of("string")).bind(text_of("keyword"))
+                .bind(match value {
+                    Typed::KeywordList(items) => Some(DB::document(&json!(items))),
+                    _ => None,
+                })
+                .bind(DB::optional_integer(match value {
+                    Typed::Int(number) => Some(*number),
+                    _ => None,
+                }))
+                .bind(DB::optional_float_value(match value {
+                    Typed::Float(number) => Some(*number),
+                    _ => None,
+                }))
+                .bind(DB::optional_flag(match value {
+                    Typed::Bool(flag) => Some(*flag),
+                    _ => None,
+                }))
+                .bind(DB::optional_time(match value {
+                    Typed::Datetime(time) => Some(*time),
+                    _ => None,
+                }))
+                .bind(history_sequence).bind(DB::bind_time(written)).bind(DB::bind_time(written))
+                .execute(&mut **tx).await.map_err(db)?;
+            rows[row("workflow_search_attributes")] += 1;
+        }
+        rows[row("workflow_run_summaries")] = 1;
+        Ok(rows)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn bundle(text: &str) -> PhpArray {
+        php_value::request_body(text.as_bytes())
+    }
+
+    #[test]
+    fn the_controller_unwraps_bundles_and_reads_options_like_laravel() {
+        assert!(matches!(request(b"{}", &[]), Request::Invalid));
+        assert!(matches!(request(br#"{"bundle":{}}"#, &[]), Request::Invalid));
+        assert!(matches!(request(b"null", &[]), Request::Invalid));
+        let Request::Import(bundle, options) = request(br#"{"bundle":{"a":1},"dry_run":"yes","import_id":"  i-1  ","require_signature":"no","signing_key":" "}"#, &[]) else {
+            panic!("an import");
+        };
+        assert!(bundle.contains("a") && options.dry_run && !options.require_signature);
+        assert_eq!(options.import_id.as_deref(), Some("i-1"));
+        assert_eq!(options.signing_key, None);
+        // A string bundle leaves the whole body as the bundle.
+        let Request::Import(bundle, options) = request(br#"{"bundle":"x","import_id":12345}"#, &[("dry_run".into(), "1".into())]) else {
+            panic!("an import");
+        };
+        assert!(bundle.contains("import_id") && options.dry_run && options.import_id.is_none());
+    }
+
+    #[test]
+    fn eligibility_follows_php_s_order_and_quirks() {
+        let body = bundle(r#"{"workflow":{"status":"completed"},"history_complete":1,"redaction":{"paths":["payloads.arguments.data"]},
+            "payloads":{"codec":"json","output":{"codec":5}},"tasks":[{"status":"leased"}],"activities":[{"attempts":[{"status":"running"}]}]}"#);
+        let summary = Summary::of(&body, "ns");
+        let options = Options { dry_run: false, import_id: None, require_signature: true, signing_key: None };
+        let rules: Vec<String> = eligibility(&body, "warning", false, &summary, &options).errors.iter()
+            .map(|error| error["rule"].as_str().unwrap().to_owned()).collect();
+        assert_eq!(rules, ["bundle.signature_required", "workflow.instance_id_missing", "workflow.run_id_missing",
+            "workflow.terminal_history_incomplete", "workflow.source_runtime_unsupported", "payload_codec.unsupported",
+            "payload_codec.unsupported", "tasks.leased_task_present"]);
+        let messages = eligibility(&body, "ok", true, &summary, &options).errors;
+        assert!(messages[5]["message"].as_str().unwrap().contains("at [payloads.output.codec] must be \"avro\"; found int."));
+        assert_eq!(estimated_rows(&Php::Array(body))[row("workflow_tasks")], 1);
+    }
+
+    #[test]
+    fn times_parse_like_carbon_for_exported_forms() {
+        let stamp = parse_time("2026-10-24T13:00:00.123456+02:00").unwrap();
+        assert_eq!(stamp.wall.to_rfc3339(), "2026-10-24T13:00:00.123456+00:00");
+        assert_eq!(stamp.utc.to_rfc3339(), "2026-10-24T11:00:00.123456+00:00");
+        assert!(parse_time("2026-10-24 13:00:00").is_ok());
+        assert!(parse_time("not a time").unwrap_err().starts_with("Could not parse 'not a time'"));
+    }
+}

From 864cadd28ecf05290b315d9566d1934e48b2352d Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 04:31:42 +0000
Subject: [PATCH 3/9] Rust #325: record the embedded v2 import route as served

The unserved-route list arrived with #745 and still named it, so
route_coverage failed after the merge. Native serves 131 of the 175
published route methods on this branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/rust-server-port.md                            | 11 +++++------
 rust/tests/fixtures/unserved-php-routes.v2.11.1.txt |  1 -
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/docs/rust-server-port.md b/docs/rust-server-port.md
index eec7b7b9b..4d8ecc620 100644
--- a/docs/rust-server-port.md
+++ b/docs/rust-server-port.md
@@ -82,13 +82,12 @@ Updated October 24, 2026.
     ([#737](https://github.com/durable-workflow/server/issues/737)).
 
   No expectation is edited to make native pass.
-- **Parity surface.** Native serves 126 of the 175 API route methods in
-  published 2.11.1's route table. An execution test sends each one through
-  the native router, and the ones still answering
-  `501 rust_capability_not_implemented` must match
+- **Parity surface.** Native serves 131 of the 175 API route methods in
+  published 2.11.1's route table, with message streams, activity
+  cancellation acknowledgement and embedded v2 workflow import. An
+  execution test sends each one through the native router, and the ones
+  still answering `501 rust_capability_not_implemented` must match
   [`unserved-php-routes.v2.11.1.txt`](../rust/tests/fixtures/unserved-php-routes.v2.11.1.txt).
-  The work in review serves 12 more: message streams (3), update validation
-  (3), worker sessions (5) and activity cancellation acknowledgement (1).
 - **Next action.** Land the items above in order, keep porting the unserved
   routes fixture first, and package the native binary into the server image.
 
diff --git a/rust/tests/fixtures/unserved-php-routes.v2.11.1.txt b/rust/tests/fixtures/unserved-php-routes.v2.11.1.txt
index c0a0082ea..e6d5cdccf 100644
--- a/rust/tests/fixtures/unserved-php-routes.v2.11.1.txt
+++ b/rust/tests/fixtures/unserved-php-routes.v2.11.1.txt
@@ -40,7 +40,6 @@ POST /api/worker/workflow-tasks/{taskId}/local-activities/{attemptId}/acknowledg
 POST /api/worker/workflow-tasks/{taskId}/local-activities/{attemptId}/control
 POST /api/worker/workflow-tasks/{taskId}/local-activities/{attemptId}/heartbeat
 POST /api/worker/workflow-tasks/{taskId}/local-activities/{attemptId}/outcome
-POST /api/workflows/import/embedded-v2
 POST /api/workflows/import/waterline-v1
 GET /api/workflows/{workflowId}/nexus-operations
 GET /api/workflows/{workflowId}/runs/{runId}/nexus-operations

From f69f559236979f43435e7a407515b0de8d2dd90e Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:15:21 +0000
Subject: [PATCH 4/9] Rust #325: list only Waterline v1 import as missing

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/rust-server-port.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/rust-server-port.md b/docs/rust-server-port.md
index 6aa7b3cd7..093b02b8d 100644
--- a/docs/rust-server-port.md
+++ b/docs/rust-server-port.md
@@ -147,7 +147,8 @@ any other unknown path or method answers PHP's own 404 or 405
     `poll_request_id` or bind a request id to its task kinds; see
     `docs/rust-server-port-checkpoints/2026-10-23-update-validation.md`.)
 - **Run operations.**
-  - Imports from embedded v2 and Waterline v1.
+  - Waterline v1 import. (Embedded v2 import is served:
+    `POST /api/workflows/import/embedded-v2`.)
 - **Other families.**
   - Message streams are served
     ([checkpoint](rust-server-port-checkpoints/2026-10-23-message-streams.md)),

From 9f94f2b84a079edd128faf20e113a7d15fee8ce8 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:43:07 +0000
Subject: [PATCH 5/9] Rust #325: mark worker sessions and activity cancellation
 acknowledgement served

Both are served on main (worker sessions since #740), but the missing
route list still named them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/rust-server-port.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/rust-server-port.md b/docs/rust-server-port.md
index 093b02b8d..257f1ace9 100644
--- a/docs/rust-server-port.md
+++ b/docs/rust-server-port.md
@@ -133,12 +133,15 @@ any other unknown path or method answers PHP's own 404 or 405
   `repair-pass` fixture; a recovery native does not perform yet is
   reported as its candidate's failure, with 207.
 - **Worker protocol features.**
-  - Worker sessions.
   - Local activities (prepare, checkpoint, recover, heartbeat, control,
     outcome and cancellation acknowledgement).
   - Cancellation scopes.
-  - Activity cancellation acknowledgement. (Lease renewal, from Server 2.11,
-    is served: `POST /api/worker/activity-tasks/{task}/renew-lease`, with the
+  - (Worker sessions are served: create, heartbeat, close, list and detail,
+    with the `worker-sessions` and `worker-session-activities` fixtures.)
+  - (Activity cancellation acknowledgement is served:
+    `POST /api/worker/activity-tasks/{task}/acknowledge-cancellation`, with the
+    `activity-cancellation-acknowledgement` fixture. So is lease renewal, from
+    Server 2.11: `POST /api/worker/activity-tasks/{task}/renew-lease`, with the
     `activity_lease_renewal` capability and the `activity-lease-renewal` fixture.)
   - (Synchronous update validation is served: the validation task poll,
     approve and reject routes, the multiplexed workflow poll with

From 8efdfe04dc4528211cb42a1e1ace1233d31d4e78 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 18:32:12 +0000
Subject: [PATCH 6/9] Rust #325: split the import's two most complex functions

SonarCloud rust:S3776 on #764: check_payload_manifest (31) and
Parser::value (33) exceeded the cognitive complexity limit of 30.

check_manifest_entry now holds one payload manifest entry's checks, in
the same order. Parser::json_list and Parser::json_object hold the JSON
array and object parsing that value() delegated to nested() as closures.
Behavior is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 rust/src/runtime/bundle_verifier.rs |  66 +++++++++-------
 rust/src/runtime/php_value.rs       | 118 +++++++++++++++-------------
 2 files changed, 98 insertions(+), 86 deletions(-)

diff --git a/rust/src/runtime/bundle_verifier.rs b/rust/src/runtime/bundle_verifier.rs
index 95940e9c8..d9e1f74fb 100644
--- a/rust/src/runtime/bundle_verifier.rs
+++ b/rust/src/runtime/bundle_verifier.rs
@@ -214,39 +214,12 @@ fn check_payload_manifest(bundle: &Php, findings: &mut Findings) {
     if let Some(entries) = array(manifest.get("entries")) {
         for (index, entry) in &entries.0 {
             let fallback = format!("payload_manifest.entries[{}]", index.text());
-            let Some(_) = entry.array() else {
+            if entry.array().is_none() {
                 findings.error("payload_manifest.entry_invalid", "Payload manifest entry must be an object.", fallback);
                 continue;
-            };
-            let path = string_value(entry.get("path")).map_or(fallback, str::to_owned);
-            let codec = string_value(entry.get("codec"));
-            let available = entry.get("available").is_some_and(Php::truthy);
-            let redacted = entry.get("redacted").is_some_and(Php::truthy);
-            let diagnostic = string_value(entry.get("diagnostic"));
-            if codec.is_none() {
-                findings.error("payload_manifest.codec_missing", format!("Payload manifest entry [{path}] is missing codec."), path.clone());
-            }
-            if !redacted && available && diagnostic == Some("payload_missing") {
-                findings.error("payload_manifest.payload_missing",
-                    format!("Manifest reports payload [{path}] available but bundle has no payload bytes."), path.clone());
-            }
-            if codec == Some("avro") && available && !redacted && diagnostic != Some("external_storage_reference") {
-                if string_value(entry.get("avro_framing")).is_none() {
-                    findings.add("payload_manifest.avro_framing_missing", WARNING,
-                        format!("Avro payload [{path}] is missing framing metadata; offline decoders cannot pick a wrapper schema."),
-                        Some(path.clone()), json!({}));
-                }
-                if let (Some(writer), Some(actual)) =
-                    (string_value(entry.get("writer_schema")), string_value(entry.get("writer_schema_fingerprint")))
-                {
-                    let expected = (writer == schema).then(|| fingerprint.clone());
-                    if expected.as_deref() != Some(actual) {
-                        findings.add("payload_manifest.writer_schema_fingerprint_mismatch", ERROR,
-                            format!("Avro payload [{path}] writer_schema_fingerprint disagrees with the embedded schema; offline decoders will reject this entry."),
-                            Some(path.clone()), json!({"expected":expected,"actual":actual}));
-                    }
-                }
             }
+            let path = string_value(entry.get("path")).map_or(fallback, str::to_owned);
+            check_manifest_entry(entry, &path, schema, &fingerprint, findings);
         }
     }
     let Some(codec_schemas) = array(bundle.get("codec_schemas")) else {
@@ -270,6 +243,39 @@ fn check_payload_manifest(bundle: &Php, findings: &mut Findings) {
     }
 }
 
+/// One payload manifest entry's codec, availability and Avro framing checks,
+/// in PHP's order.
+fn check_manifest_entry(entry: &Php, path: &str, schema: &str, fingerprint: &str, findings: &mut Findings) {
+    let codec = string_value(entry.get("codec"));
+    let available = entry.get("available").is_some_and(Php::truthy);
+    let redacted = entry.get("redacted").is_some_and(Php::truthy);
+    let diagnostic = string_value(entry.get("diagnostic"));
+    if codec.is_none() {
+        findings.error("payload_manifest.codec_missing", format!("Payload manifest entry [{path}] is missing codec."), path.to_owned());
+    }
+    if !redacted && available && diagnostic == Some("payload_missing") {
+        findings.error("payload_manifest.payload_missing",
+            format!("Manifest reports payload [{path}] available but bundle has no payload bytes."), path.to_owned());
+    }
+    if codec == Some("avro") && available && !redacted && diagnostic != Some("external_storage_reference") {
+        if string_value(entry.get("avro_framing")).is_none() {
+            findings.add("payload_manifest.avro_framing_missing", WARNING,
+                format!("Avro payload [{path}] is missing framing metadata; offline decoders cannot pick a wrapper schema."),
+                Some(path.to_owned()), json!({}));
+        }
+        if let (Some(writer), Some(actual)) =
+            (string_value(entry.get("writer_schema")), string_value(entry.get("writer_schema_fingerprint")))
+        {
+            let expected = (writer == schema).then(|| fingerprint.to_owned());
+            if expected.as_deref() != Some(actual) {
+                findings.add("payload_manifest.writer_schema_fingerprint_mismatch", ERROR,
+                    format!("Avro payload [{path}] writer_schema_fingerprint disagrees with the embedded schema; offline decoders will reject this entry."),
+                    Some(path.to_owned()), json!({"expected":expected,"actual":actual}));
+            }
+        }
+    }
+}
+
 fn check_history_events(bundle: &Php, findings: &mut Findings) {
     let Some(events) = array(bundle.get("history_events")) else {
         return;
diff --git a/rust/src/runtime/php_value.rs b/rust/src/runtime/php_value.rs
index 227e2b598..6a574c41f 100644
--- a/rust/src/runtime/php_value.rs
+++ b/rust/src/runtime/php_value.rs
@@ -345,69 +345,75 @@ impl Parser<'_> {
             b't' => self.literal(b"true", Php::Bool(true)),
             b'f' => self.literal(b"false", Php::Bool(false)),
             b'"' => self.string().map(Php::Str),
-            b'[' => self.nested(|parser| {
-                let mut array = PhpArray::default();
-                parser.space();
-                if parser.bytes.get(parser.at) == Some(&b']') {
+            b'[' => self.nested(Self::json_list),
+            b'{' => self.nested(Self::json_object),
+            _ => self.number(),
+        }
+    }
+
+    /// A JSON array as a PHP list, keys 0..n.
+    fn json_list(parser: &mut Self) -> Option<PhpArray> {
+        let mut array = PhpArray::default();
+        parser.space();
+        if parser.bytes.get(parser.at) == Some(&b']') {
+            parser.at += 1;
+            return Some(array);
+        }
+        loop {
+            let value = parser.value()?;
+            array.0.push((Key::Int(array.0.len() as i64), value));
+            parser.space();
+            match parser.bytes.get(parser.at)? {
+                b',' => parser.at += 1,
+                b']' => {
                     parser.at += 1;
                     return Some(array);
                 }
-                loop {
-                    let value = parser.value()?;
-                    array.0.push((Key::Int(array.0.len() as i64), value));
-                    parser.space();
-                    match parser.bytes.get(parser.at)? {
-                        b',' => parser.at += 1,
-                        b']' => {
-                            parser.at += 1;
-                            return Some(array);
-                        }
-                        _ => return None,
-                    }
+                _ => return None,
+            }
+        }
+    }
+
+    /// A JSON object as a PHP array, keeping each key's first position.
+    fn json_object(parser: &mut Self) -> Option<PhpArray> {
+        let mut array = PhpArray::default();
+        // Each key's position, so a large object parses in linear time.
+        let mut positions: std::collections::HashMap<Key, usize> = std::collections::HashMap::new();
+        parser.space();
+        if parser.bytes.get(parser.at) == Some(&b'}') {
+            parser.at += 1;
+            return Some(array);
+        }
+        loop {
+            parser.space();
+            if parser.bytes.get(parser.at) != Some(&b'"') {
+                return None;
+            }
+            let key = parser.string()?;
+            parser.space();
+            if parser.bytes.get(parser.at) != Some(&b':') {
+                return None;
+            }
+            parser.at += 1;
+            let value = parser.value()?;
+            // A repeated key replaces the earlier value in place.
+            let key = Key::of(&key);
+            match positions.get(&key) {
+                Some(&index) => array.0[index].1 = value,
+                None => {
+                    positions.insert(key.clone(), array.0.len());
+                    array.0.push((key, value));
                 }
-            }),
-            b'{' => self.nested(|parser| {
-                let mut array = PhpArray::default();
-                // Each key's position, so a large object parses in linear time.
-                let mut positions: std::collections::HashMap<Key, usize> = std::collections::HashMap::new();
-                parser.space();
-                if parser.bytes.get(parser.at) == Some(&b'}') {
+            }
+            parser.space();
+            match parser.bytes.get(parser.at)? {
+                b',' => parser.at += 1,
+                b'}' => {
                     parser.at += 1;
                     return Some(array);
                 }
-                loop {
-                    parser.space();
-                    if parser.bytes.get(parser.at) != Some(&b'"') {
-                        return None;
-                    }
-                    let key = parser.string()?;
-                    parser.space();
-                    if parser.bytes.get(parser.at) != Some(&b':') {
-                        return None;
-                    }
-                    parser.at += 1;
-                    let value = parser.value()?;
-                    // A repeated key replaces the earlier value in place.
-                    let key = Key::of(&key);
-                    match positions.get(&key) {
-                        Some(&index) => array.0[index].1 = value,
-                        None => {
-                            positions.insert(key.clone(), array.0.len());
-                            array.0.push((key, value));
-                        }
-                    }
-                    parser.space();
-                    match parser.bytes.get(parser.at)? {
-                        b',' => parser.at += 1,
-                        b'}' => {
-                            parser.at += 1;
-                            return Some(array);
-                        }
-                        _ => return None,
-                    }
-                }
-            }),
-            _ => self.number(),
+                _ => return None,
+            }
         }
     }
 

From 6f109c2c118bf3c3c309eb606631357d5a29e6a4 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 19:31:25 +0000
Subject: [PATCH 7/9] Rust #325: fence embedded v2 imports to their own bundle
 and namespace

Security review of #764 (Server #765): published PHP copies every reference
an import bundle carries, and native copied them too. A bundle imported into
one namespace could link its run to another namespace's run, point its
signals and updates at another workflow's commands (which later application
updates by id), and point its tasks at another run's activities (which a lost
lease settles by id). The signing key was also read from the URL.

Native now refuses such a bundle before writing anything:

- Every copied reference must name a row this import writes, of the expected
  kind: signal and update commands, update failures, event tasks and
  commands, activity attempts and their tasks, task payload references, the
  archive command and activity failure sources (`references.unresolved`).
  Resolved runs must be the imported run (`references.foreign_run`), and a
  link may not name the imported run itself (`references.self_link`).
- In the write transaction, a requested run must be another run of the same
  workflow in this namespace, and a failed update's failure outside the
  bundle must belong to no run.
- A lineage link is written only when its related run exists in this
  namespace and its instance. A related run or instance of another namespace
  fails the import. A related run that exists nowhere yet is not written;
  its own import writes the link once both runs exist, so no stored link can
  later capture a run created elsewhere.
- signing_key is read only from the body or the configured secret; in the
  query string, in any spelling, it is refused with 422 signing_key_in_query
  and never repeated.

Defense in depth for rows no import can now write: signal and update
application join and update their command only within their own instance
(typed 409 signal_command_unavailable / update_command_unavailable instead of
a foreign mutation), the described-command and export joins require the same
instance, history export omits related runs of another namespace, and
lost-lease settlement reads only the task's own run's activity.

tests/execution/workflow_import_fences.rs covers both lineage directions, a
foreign instance, a deferred link a later foreign run never captures, each
foreign row reference, forged signal and update rows at application, worker
and operator 403s against the admin positive control, and the URL signing
key, each against a byte-for-byte export snapshot of the other namespace.
Without the fences and predicates five of the seven fail. Full execution
suites pass on SQLite, PostgreSQL and MySQL (499 each).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/rust-server-port.md                      |   5 +-
 rust/src/runtime/activity_deadlines.rs        |   4 +-
 rust/src/runtime/history_export.rs            |   9 +-
 rust/src/runtime/store.rs                     |  19 +-
 rust/src/runtime/store_record_tests.rs        |   3 +-
 rust/src/runtime/updates.rs                   |  16 +-
 rust/src/runtime/workflow_import.rs           | 394 +++++++++++++++-
 rust/tests/execution.rs                       |   3 +
 .../tests/execution/workflow_import_fences.rs | 442 ++++++++++++++++++
 9 files changed, 863 insertions(+), 32 deletions(-)
 create mode 100644 rust/tests/execution/workflow_import_fences.rs

diff --git a/docs/rust-server-port.md b/docs/rust-server-port.md
index 257f1ace9..1723f93c4 100644
--- a/docs/rust-server-port.md
+++ b/docs/rust-server-port.md
@@ -151,7 +151,10 @@ any other unknown path or method answers PHP's own 404 or 405
     `docs/rust-server-port-checkpoints/2026-10-23-update-validation.md`.)
 - **Run operations.**
   - Waterline v1 import. (Embedded v2 import is served:
-    `POST /api/workflows/import/embedded-v2`.)
+    `POST /api/workflows/import/embedded-v2`. Unlike published PHP, native
+    refuses a bundle whose rows reference rows outside it, links only runs of
+    one namespace, and reads the signing key only from the request body
+    ([#765](https://github.com/durable-workflow/server/issues/765)).)
 - **Other families.**
   - Message streams are served
     ([checkpoint](rust-server-port-checkpoints/2026-10-23-message-streams.md)),
diff --git a/rust/src/runtime/activity_deadlines.rs b/rust/src/runtime/activity_deadlines.rs
index 9d9995d1f..696c89216 100644
--- a/rust/src/runtime/activity_deadlines.rs
+++ b/rust/src/runtime/activity_deadlines.rs
@@ -312,8 +312,10 @@ where
         let (Some(task), Some(execution_id)) = (task, execution_id) else {
             return Ok(Skipped("activity_execution_missing"));
         };
-        let Some(activity) = Self::query("SELECT * FROM activity_executions WHERE id=$1")
+        // Only the task's own run's activity (Server #765).
+        let Some(activity) = Self::query("SELECT * FROM activity_executions WHERE id=$1 AND workflow_run_id=$2")
             .bind(&execution_id)
+            .bind(DB::string(&task, "workflow_run_id")?)
             .fetch_optional(&mut **tx)
             .await?
         else {
diff --git a/rust/src/runtime/history_export.rs b/rust/src/runtime/history_export.rs
index 7cccf3989..8a0238d3a 100644
--- a/rust/src/runtime/history_export.rs
+++ b/rust/src/runtime/history_export.rs
@@ -89,7 +89,7 @@ pub(super) const COMMANDS: &[(&str, Column)] = &[
     ("payload", Text), ("source", Text), ("request_id", Text), ("status", Text), ("outcome", Text), ("rejection_reason", Text),
     ("accepted_at", Time), ("applied_at", Time), ("rejected_at", Time),
 ];
-pub(super) const COMMANDS_SQL: &str = "SELECT c.*,COALESCE(s.signal_name,u.update_name) AS target_name FROM workflow_commands c LEFT JOIN workflow_signal_records s ON s.workflow_command_id=c.id LEFT JOIN workflow_updates u ON u.workflow_command_id=c.id WHERE c.workflow_run_id=$1 ORDER BY c.command_sequence,c.created_at,c.id";
+pub(super) const COMMANDS_SQL: &str = "SELECT c.*,COALESCE(s.signal_name,u.update_name) AS target_name FROM workflow_commands c LEFT JOIN workflow_signal_records s ON s.workflow_command_id=c.id AND s.workflow_instance_id=c.workflow_instance_id LEFT JOIN workflow_updates u ON u.workflow_command_id=c.id AND u.workflow_instance_id=c.workflow_instance_id WHERE c.workflow_run_id=$1 ORDER BY c.command_sequence,c.created_at,c.id";
 pub(super) const SIGNALS: &[(&str, Column)] = &[
     ("id", Text), ("workflow_command_id", Text), ("command_sequence", Int), ("workflow_sequence", Int), ("signal_name", Text),
     ("signal_wait_id", Text), ("target_scope", Text), ("requested_workflow_run_id", Text), ("resolved_workflow_run_id", Text),
@@ -136,8 +136,11 @@ pub(super) const LINKS: &[(&str, Column)] = &[
     ("child_workflow_instance_id", Text), ("child_workflow_run_id", Text), ("is_primary_parent", Flag), ("created_at", Time),
     ("run_number", Int), ("workflow_type", Text), ("workflow_class", Text), ("status", Text), ("closed_reason", Text),
 ];
-pub(super) const PARENTS_SQL: &str = "SELECT l.*,CASE WHEN l.is_primary_parent THEN 1 ELSE 0 END AS is_primary_parent_flag,r.run_number,r.workflow_type,r.workflow_class,r.status,r.closed_reason FROM workflow_links l LEFT JOIN workflow_runs r ON r.id=l.parent_workflow_run_id WHERE l.child_workflow_run_id=$1 ORDER BY l.created_at,l.id";
-pub(super) const CHILDREN_SQL: &str = "SELECT l.*,CASE WHEN l.is_primary_parent THEN 1 ELSE 0 END AS is_primary_parent_flag,r.run_number,r.workflow_type,r.workflow_class,r.status,r.closed_reason FROM workflow_links l LEFT JOIN workflow_runs r ON r.id=l.child_workflow_run_id WHERE l.parent_workflow_run_id=$1 AND l.link_type='continue_as_new' ORDER BY l.created_at,l.id";
+// A related run of another namespace is never exported, whatever a link
+// row says (Server #765); a command's signal or update must share its
+// instance.
+pub(super) const PARENTS_SQL: &str = "SELECT l.*,CASE WHEN l.is_primary_parent THEN 1 ELSE 0 END AS is_primary_parent_flag,r.run_number,r.workflow_type,r.workflow_class,r.status,r.closed_reason FROM workflow_links l LEFT JOIN workflow_runs r ON r.id=l.parent_workflow_run_id WHERE l.child_workflow_run_id=$1 AND (r.id IS NULL OR r.namespace=(SELECT m.namespace FROM workflow_runs m WHERE m.id=l.child_workflow_run_id)) ORDER BY l.created_at,l.id";
+pub(super) const CHILDREN_SQL: &str = "SELECT l.*,CASE WHEN l.is_primary_parent THEN 1 ELSE 0 END AS is_primary_parent_flag,r.run_number,r.workflow_type,r.workflow_class,r.status,r.closed_reason FROM workflow_links l LEFT JOIN workflow_runs r ON r.id=l.child_workflow_run_id WHERE l.parent_workflow_run_id=$1 AND l.link_type='continue_as_new' AND (r.id IS NULL OR r.namespace=(SELECT m.namespace FROM workflow_runs m WHERE m.id=l.parent_workflow_run_id)) ORDER BY l.created_at,l.id";
 
 /// The rows `forRun` reads for one run.
 #[derive(Default)]
diff --git a/rust/src/runtime/store.rs b/rust/src/runtime/store.rs
index 1cf3331e5..964fd1135 100644
--- a/rust/src/runtime/store.rs
+++ b/rust/src/runtime/store.rs
@@ -69,7 +69,7 @@ macro_rules! run_commands_sql {
             $start,
             ") AND NOT (",
             $php,
-            ") THEN c.payload END AS reason_payload FROM workflow_commands c LEFT JOIN workflow_signal_records s ON s.workflow_command_id=c.id WHERE c.workflow_run_id=$1 AND c.workflow_instance_id=$2 ORDER BY c.command_sequence,c.created_at,c.id"
+            ") THEN c.payload END AS reason_payload FROM workflow_commands c LEFT JOIN workflow_signal_records s ON s.workflow_command_id=c.id AND s.workflow_instance_id=c.workflow_instance_id WHERE c.workflow_run_id=$1 AND c.workflow_instance_id=$2 ORDER BY c.command_sequence,c.created_at,c.id"
         )
     };
 }
@@ -1315,8 +1315,10 @@ where
             return Ok(());
         }
         let signal_id = text(&payload, "workflow_signal_id")?;
-        let signal = Self::query("SELECT s.*,c.message_sequence FROM workflow_signal_records s JOIN workflow_commands c ON c.id=s.workflow_command_id WHERE s.id=$1 AND s.workflow_run_id=$2")
-            .bind(signal_id).bind(run_id).fetch_one(&mut **tx).await?;
+        // The signal's own command, never one of another workflow (Server #765).
+        let signal = Self::query("SELECT s.*,c.message_sequence FROM workflow_signal_records s JOIN workflow_commands c ON c.id=s.workflow_command_id AND c.workflow_instance_id=s.workflow_instance_id WHERE s.id=$1 AND s.workflow_run_id=$2")
+            .bind(signal_id).bind(run_id).fetch_optional(&mut **tx).await?
+            .ok_or_else(|| refuse(StatusCode::CONFLICT, "signal_command_unavailable"))?;
         if DB::string(&signal, "status")? != "received" {
             return Err(refuse(StatusCode::CONFLICT, "signal_already_applied"));
         }
@@ -1361,9 +1363,10 @@ where
         .await?;
         let command_id = DB::string(&signal, "workflow_command_id")?;
         let applied_at = now();
-        Self::query("UPDATE workflow_commands SET applied_at=$1 WHERE id=$2")
+        Self::query("UPDATE workflow_commands SET applied_at=$1 WHERE id=$2 AND workflow_instance_id=$3")
             .bind(DB::bind_time(applied_at))
             .bind(&command_id)
+            .bind(DB::string(&signal, "workflow_instance_id")?)
             .execute(&mut **tx)
             .await?;
         // PHP's `applySignal` takes a sequence only from the signal's own
@@ -3922,11 +3925,11 @@ where
         };
         let command_type = DB::optional_string(&row, "command_type")?;
         let target_name = match command_type.as_deref() {
-            Some("signal") => Self::query("SELECT signal_name FROM workflow_signal_records WHERE workflow_command_id=$1")
-                .bind(command_id).fetch_optional(&mut **tx).await?
+            Some("signal") => Self::query("SELECT signal_name FROM workflow_signal_records WHERE workflow_command_id=$1 AND workflow_instance_id=$2")
+                .bind(command_id).bind(DB::string(&row, "workflow_instance_id")?).fetch_optional(&mut **tx).await?
                 .map(|record| DB::optional_string(&record, "signal_name")).transpose()?.flatten(),
-            Some("update") => Self::query("SELECT update_name FROM workflow_updates WHERE workflow_command_id=$1")
-                .bind(command_id).fetch_optional(&mut **tx).await?
+            Some("update") => Self::query("SELECT update_name FROM workflow_updates WHERE workflow_command_id=$1 AND workflow_instance_id=$2")
+                .bind(command_id).bind(DB::string(&row, "workflow_instance_id")?).fetch_optional(&mut **tx).await?
                 .map(|record| DB::optional_string(&record, "update_name")).transpose()?.flatten(),
             _ => None,
         };
diff --git a/rust/src/runtime/store_record_tests.rs b/rust/src/runtime/store_record_tests.rs
index 77a74af42..8431e2745 100644
--- a/rust/src/runtime/store_record_tests.rs
+++ b/rust/src/runtime/store_record_tests.rs
@@ -135,7 +135,8 @@ async fn described_commands_select_no_inline_payload() {
             .await
             .unwrap();
         if let Some(arguments) = arguments {
-            Store::<sqlx::Sqlite>::query("INSERT INTO workflow_signal_records(id,workflow_command_id,signal_name,status,arguments) VALUES ($1,$2,'s','received',$3)")
+            // A signal record shares its command's instance, as every writer stores it.
+            Store::<sqlx::Sqlite>::query("INSERT INTO workflow_signal_records(id,workflow_command_id,workflow_instance_id,signal_name,status,arguments) VALUES ($1,$2,'instance','s','received',$3)")
                 .bind(format!("s-{id}"))
                 .bind(*id)
                 .bind(*arguments)
diff --git a/rust/src/runtime/updates.rs b/rust/src/runtime/updates.rs
index 7a78a7c1b..8699d4ed1 100644
--- a/rust/src/runtime/updates.rs
+++ b/rust/src/runtime/updates.rs
@@ -146,7 +146,8 @@ fn update_argument_errors(contract: &Value, name: &str, values: &[crate::codec::
     }
     Value::Object(errors)
 }
-const UPDATE_ROW: &str = "SELECT u.*,c.workflow_type,c.message_sequence,c.context AS command_context FROM workflow_updates u JOIN workflow_commands c ON c.id=u.workflow_command_id WHERE u.id=$1";
+// An update reads only its own workflow's command (Server #765).
+const UPDATE_ROW: &str = "SELECT u.*,c.workflow_type,c.message_sequence,c.context AS command_context FROM workflow_updates u JOIN workflow_commands c ON c.id=u.workflow_command_id AND c.workflow_instance_id=u.workflow_instance_id WHERE u.id=$1";
 
 #[derive(Clone, Copy)]
 enum UpdateLookup {
@@ -414,7 +415,7 @@ where
             return Ok((status, validation_response(failure, wait_for, context.as_ref(), name)));
         }
         let existing = if let Some(request_id) = request_id {
-            Self::query("SELECT u.id,u.update_name,u.workflow_run_id FROM workflow_updates u JOIN workflow_commands c ON c.id=u.workflow_command_id WHERE c.workflow_instance_id=$1 AND c.command_type='update' AND c.request_id=$2")
+            Self::query("SELECT u.id,u.update_name,u.workflow_run_id FROM workflow_updates u JOIN workflow_commands c ON c.id=u.workflow_command_id AND c.workflow_instance_id=u.workflow_instance_id WHERE c.workflow_instance_id=$1 AND c.command_type='update' AND c.request_id=$2")
                 .bind(workflow_id).bind(request_id).fetch_optional(&mut *tx).await?
         } else {
             None
@@ -1046,8 +1047,9 @@ where
         let run_id = DB::string(run, "id")?;
         let update = Self::query(UPDATE_ROW)
             .bind(update_id)
-            .fetch_one(&mut **tx)
-            .await?;
+            .fetch_optional(&mut **tx)
+            .await?
+            .ok_or_else(|| refuse(StatusCode::CONFLICT, "update_command_unavailable"))?;
         if DB::string(&update, "workflow_run_id")? != run_id
             || DB::string(&update, "status")? != "accepted"
         {
@@ -1123,10 +1125,11 @@ where
                 .bind(sequence).bind(&failure_id).bind(failure.message).bind(DB::bind_time(closed_at))
                 .bind(DB::bind_time(closed_at)).bind(update_id).execute(&mut **tx).await?;
             Self::query(
-                "UPDATE workflow_commands SET outcome='update_failed',applied_at=$1 WHERE id=$2",
+                "UPDATE workflow_commands SET outcome='update_failed',applied_at=$1 WHERE id=$2 AND workflow_instance_id=$3",
             )
             .bind(DB::bind_time(closed_at))
             .bind(&command_id)
+            .bind(&workflow_id)
             .execute(&mut **tx)
             .await?;
         } else {
@@ -1157,10 +1160,11 @@ where
             Self::query("UPDATE workflow_updates SET status='completed',outcome='update_completed',workflow_sequence=$1,result=$2,applied_at=$3,closed_at=$4 WHERE id=$5")
             .bind(sequence).bind(result).bind(DB::bind_time(applied_at)).bind(DB::bind_time(applied_at)).bind(update_id).execute(&mut **tx).await?;
             Self::query(
-                "UPDATE workflow_commands SET outcome='update_completed',applied_at=$1 WHERE id=$2",
+                "UPDATE workflow_commands SET outcome='update_completed',applied_at=$1 WHERE id=$2 AND workflow_instance_id=$3",
             )
             .bind(DB::bind_time(applied_at))
             .bind(&command_id)
+            .bind(&workflow_id)
             .execute(&mut **tx)
             .await?;
         }
diff --git a/rust/src/runtime/workflow_import.rs b/rust/src/runtime/workflow_import.rs
index 8807ff85f..1f57db814 100644
--- a/rust/src/runtime/workflow_import.rs
+++ b/rust/src/runtime/workflow_import.rs
@@ -10,14 +10,20 @@
 //! ConvertEmptyStringsToNull, so the checksum, the dedupe key and every
 //! stored value see the same document PHP's importer sees.
 //!
-//! Two published defects are not copied. PHP looks the run and the instance
-//! up in every namespace, so a bundle imported into another namespace
-//! answers already_imported for a namespace that holds no such run, and an
-//! import attaches its run to another namespace's instance and takes over
-//! its current run. Native counts a run as already imported only in the
-//! requested namespace (elsewhere it is a run_id conflict), and refuses to
-//! write into an instance of another namespace (a failed write, as PHP
-//! itself reports when the run number collides).
+//! Published defects are not copied (Server #765). PHP looks the run and the
+//! instance up in every namespace, so a bundle imported into another
+//! namespace answers already_imported for a namespace that holds no such
+//! run, and an import attaches its run to another namespace's instance and
+//! takes over its current run. Native counts a run as already imported only
+//! in the requested namespace (elsewhere it is a run_id conflict), and
+//! refuses to write into an instance of another namespace (a failed write,
+//! as PHP itself reports when the run number collides). PHP also copies
+//! every row reference unchecked, so a bundle can point its signals and
+//! updates at another run's commands, its tasks at another run's
+//! activities, and its lineage at another namespace's runs; native refuses
+//! such a bundle (`reject_foreign_references`, `check_store_references`)
+//! and links only runs of one namespace. And native reads the signing key
+//! only from the body, never from the URL.
 use super::bundle_verifier::{self, Decoded};
 use super::execution::Runtime;
 use super::php_value::{self, Flags, Key, Php, PhpArray};
@@ -26,6 +32,7 @@ use super::{Result, refuse};
 use axum::http::StatusCode;
 use chrono::{DateTime, NaiveDateTime, Utc};
 use serde_json::{Map, Value, json};
+use std::collections::{HashMap, HashSet};
 
 pub(super) const IMPORT_SOURCE: &str = "embedded_v2";
 pub(super) const ENGINE_SOURCE: &str = "embedded_v2_import";
@@ -170,7 +177,8 @@ fn max_sequence(rows: &[&Php], key: &str) -> i64 {
     rows.iter().filter_map(|row| int(row.get(key))).fold(0, i64::max)
 }
 
-/// The options PHP's controller reads from the body (or the query string).
+/// The options PHP's controller reads from the body (or the query string,
+/// except the signing key).
 pub(super) struct Options {
     pub(super) dry_run: bool,
     pub(super) import_id: Option<String>,
@@ -198,24 +206,35 @@ fn string_input(value: Option<&Php>) -> Option<String> {
     (!text.is_empty()).then(|| text.to_owned())
 }
 
-const OPTION_KEYS: [&str; 4] = ["dry_run", "import_id", "require_signature", "signing_key"];
+/// The options the query string may carry. The signing key is not one.
+const QUERY_OPTION_KEYS: [&str; 3] = ["dry_run", "import_id", "require_signature"];
 
 /// What the controller decides before the importer runs.
 pub(super) enum Request {
     /// The 422 `invalid_import_bundle` answer.
     Invalid,
+    /// The 422 `signing_key_in_query` answer: a signing key in the URL.
+    KeyInQuery,
     Import(PhpArray, Options),
 }
 
 /// `EmbeddedV2ImportController::store` up to the importer: the bundle is
 /// `bundle` when that is an array, else the whole body; options come from
 /// the body, then the query string (`$request->input`).
+///
+/// Unlike PHP, native reads `signing_key` only from the body and refuses a
+/// request that puts one in the query string (Server #765). Access logs,
+/// tracing and client history keep URLs, and the key verifies the HMAC.
 pub(super) fn request(body: &[u8], query: &[(String, String)]) -> Request {
+    // Any spelling PHP would read as the option (`signing_key[]` too).
+    if query.iter().any(|(key, _)| key.starts_with("signing_key")) {
+        return Request::KeyInQuery;
+    }
     let body = php_value::request_body(body);
     // Only the options are read, so only they are kept; a repeated
     // parameter's last value wins.
     let mut query_input = PhpArray::default();
-    for (key, value) in query.iter().filter(|(key, _)| OPTION_KEYS.contains(&key.as_str())) {
+    for (key, value) in query.iter().filter(|(key, _)| QUERY_OPTION_KEYS.contains(&key.as_str())) {
         let mut value = Php::Str(value.clone());
         value.normalize();
         query_input.insert(Key::of(key), value);
@@ -225,7 +244,7 @@ pub(super) fn request(body: &[u8], query: &[(String, String)]) -> Request {
         dry_run: boolean(input("dry_run")),
         import_id: string_input(input("import_id")),
         require_signature: boolean(input("require_signature")),
-        signing_key: string_input(input("signing_key")),
+        signing_key: string_input(body.get("signing_key")),
     };
     let bundle = match body.get("bundle") {
         Some(Php::Array(bundle)) => bundle.clone(),
@@ -334,6 +353,7 @@ fn eligibility(bundle: &PhpArray, integrity: &str, signature_verified: bool, sum
     }
     reject_unsupported_payload_codecs(&root, &mut errors);
     reject_open_leases(&root, &mut errors);
+    reject_foreign_references(&root, summary, &mut errors);
     Eligibility { errors, warnings }
 }
 
@@ -440,6 +460,254 @@ fn reject_open_leases(bundle: &Php, errors: &mut Vec<Value>) {
     }
 }
 
+/// The ids of the rows the writer imports, selected as it selects them.
+#[derive(Default)]
+struct BundleIds<'a> {
+    /// Each command's id and type.
+    commands: HashMap<&'a str, &'a str>,
+    signals: HashSet<&'a str>,
+    updates: HashSet<&'a str>,
+    tasks: HashSet<&'a str>,
+    activities: HashSet<&'a str>,
+    attempts: HashSet<&'a str>,
+    timers: HashSet<&'a str>,
+    failures: HashSet<&'a str>,
+}
+
+impl<'a> BundleIds<'a> {
+    fn of(bundle: &'a Php) -> Self {
+        let mut ids = Self::default();
+        for command in list(bundle.get("commands")) {
+            if let (Some(kind), Some(_), Some(id)) = (enumerated(COMMAND_TYPES, command.get("type")),
+                enumerated(COMMAND_STATUSES, command.get("status")), text(command.get("id")))
+            {
+                ids.commands.insert(id, kind);
+            }
+        }
+        let collect = |section: &str, written: &dyn Fn(&Php) -> bool| -> HashSet<&'a str> {
+            list(bundle.get(section)).into_iter().filter(|row| written(row)).filter_map(|row| text(row.get("id"))).collect()
+        };
+        ids.signals = collect("signals", &|row| enumerated(SIGNAL_STATUSES, row.get("status")).is_some());
+        ids.updates = collect("updates", &|row| enumerated(UPDATE_STATUSES, row.get("status")).is_some());
+        ids.tasks = collect("tasks", &|row| {
+            enumerated(TASK_TYPES, row.get("type")).is_some() && enumerated(TASK_STATUSES, row.get("status")).is_some()
+        });
+        ids.activities = collect("activities", &|row| enumerated(ACTIVITY_STATUSES, row.get("status")).is_some());
+        ids.timers = collect("timers", &|row| enumerated(TIMER_STATUSES, row.get("status")).is_some());
+        ids.failures = collect("failures", &|_| true);
+        // The writer imports the attempts of every activity with an id.
+        for activity in list(bundle.get("activities")).into_iter().filter(|activity| text(activity.get("id")).is_some()) {
+            for attempt in list(activity.get("attempts")) {
+                if let (Some(_), Some(id)) = (enumerated(ATTEMPT_STATUSES, attempt.get("status")), text(attempt.get("id"))) {
+                    ids.attempts.insert(id);
+                }
+            }
+        }
+        ids
+    }
+}
+
+/// Each imported command, signal and update that requests a run other
+/// than the imported one: its path and that run.
+fn requested_runs<'a>(bundle: &'a Php, run_id: &str) -> Vec<(String, &'a str)> {
+    let mut requested = Vec::new();
+    for (section, statuses) in [("commands", COMMAND_STATUSES), ("signals", SIGNAL_STATUSES), ("updates", UPDATE_STATUSES)] {
+        for (index, row) in list(bundle.get(section)).into_iter().enumerate() {
+            let written = enumerated(statuses, row.get("status")).is_some()
+                && (section != "commands" || enumerated(COMMAND_TYPES, row.get("type")).is_some());
+            if let Some(run) = text(row.get("requested_run_id")).filter(|run| written && *run != run_id) {
+                requested.push((format!("{section}.{index}.requested_run_id"), run));
+            }
+        }
+    }
+    requested
+}
+
+/// The references a task payload carries, each to rows of one kind.
+const TASK_PAYLOAD_REFERENCES: &[(&str, &str)] = &[
+    ("activity_execution_id", "an activity"),
+    ("activity_attempt_id", "an activity attempt"),
+    ("timer_id", "a timer"),
+    ("workflow_signal_id", "a signal"),
+    ("workflow_update_id", "an update"),
+    ("workflow_command_id", "a command"),
+];
+
+/// Native refuses a bundle whose rows point outside the bundle (Server
+/// #765). Published PHP copies every reference unchecked, and the runtime
+/// joins or updates the rows they name: a signal or update applies to its
+/// command by id, a lost activity lease settles the activity its task names,
+/// a lineage row puts a related run into history exports. So each copied
+/// reference must name a row this import writes, of the expected kind. A
+/// requested run may also be another run of the same workflow, and a failed
+/// update a failure no run holds; the write checks those and lineage
+/// against the store. History event payloads are history, not references:
+/// what the runtime resolves from them stays within the run.
+fn reject_foreign_references(bundle: &Php, summary: &Summary, errors: &mut Vec<Value>) {
+    let mut check = References { ids: BundleIds::of(bundle), run_id: summary.run_id.as_deref(), errors };
+    if let Some(id) = text(summary.get("archive_command_id"))
+        && !check.command(id, None)
+    {
+        check.unresolved("workflow.archive_command_id".into(), "a command");
+    }
+    check.history(bundle);
+    check.messages(bundle);
+    check.activities(bundle);
+    check.tasks(bundle);
+    check.failures(bundle);
+    check.links(bundle);
+}
+
+/// One bundle's reference checks and the findings they add.
+struct References<'a, 'e> {
+    ids: BundleIds<'a>,
+    run_id: Option<&'a str>,
+    errors: &'e mut Vec<Value>,
+}
+
+impl References<'_, '_> {
+    fn unresolved(&mut self, path: String, kind: &str) {
+        self.errors.push(finding("references.unresolved", &format!("Bundle {path} must name {kind} in this bundle.")));
+    }
+
+    fn command(&self, id: &str, kind: Option<&str>) -> bool {
+        self.ids.commands.get(id).is_some_and(|found| kind.is_none_or(|kind| *found == kind))
+    }
+
+    /// Whether `id` names a row of the kind a task payload key or a resume
+    /// source kind refers to.
+    fn names(&self, key: &str, id: &str) -> bool {
+        match key {
+            "activity_execution_id" | "activity_execution" => self.ids.activities.contains(id),
+            "activity_attempt_id" => self.ids.attempts.contains(id),
+            "timer_id" | "timer" => self.ids.timers.contains(id),
+            "workflow_signal_id" | "workflow_signal" => self.ids.signals.contains(id),
+            "workflow_update_id" | "workflow_update" => self.ids.updates.contains(id),
+            _ => self.command(id, None),
+        }
+    }
+
+    fn history(&mut self, bundle: &Php) {
+        for (index, event) in list(bundle.get("history_events")).into_iter().enumerate() {
+            if enumerated(HISTORY_EVENT_TYPES, event.get("type")).is_none() {
+                continue;
+            }
+            if text(event.get("workflow_task_id")).is_some_and(|id| !self.ids.tasks.contains(id)) {
+                self.unresolved(format!("history_events.{index}.workflow_task_id"), "a task");
+            }
+            if text(event.get("workflow_command_id")).is_some_and(|id| !self.command(id, None)) {
+                self.unresolved(format!("history_events.{index}.workflow_command_id"), "a command");
+            }
+        }
+    }
+
+    /// Commands, signals and updates resolve to this run, and a signal's or
+    /// update's command is one of this bundle's of its kind.
+    fn messages(&mut self, bundle: &Php) {
+        for (section, statuses, kind) in
+            [("commands", COMMAND_STATUSES, None), ("signals", SIGNAL_STATUSES, Some("signal")), ("updates", UPDATE_STATUSES, Some("update"))]
+        {
+            for (index, row) in list(bundle.get(section)).into_iter().enumerate() {
+                let written = enumerated(statuses, row.get("status")).is_some()
+                    && (kind.is_some() || enumerated(COMMAND_TYPES, row.get("type")).is_some());
+                if !written {
+                    continue;
+                }
+                if text(row.get("resolved_run_id")).is_some_and(|id| Some(id) != self.run_id) {
+                    self.errors.push(finding("references.foreign_run",
+                        &format!("Bundle {section}.{index}.resolved_run_id must name the imported run.")));
+                }
+                if let Some(kind) = kind
+                    && text(row.get("command_id")).is_some_and(|id| !self.command(id, Some(kind)))
+                {
+                    let expected = if kind == "update" { "an update command" } else { "a signal command" };
+                    self.unresolved(format!("{section}.{index}.command_id"), expected);
+                }
+            }
+        }
+    }
+
+    fn activities(&mut self, bundle: &Php) {
+        for (index, activity) in list(bundle.get("activities")).into_iter().enumerate() {
+            if text(activity.get("id")).is_none() {
+                continue;
+            }
+            let attempts: Vec<(usize, &Php)> = list(activity.get("attempts")).into_iter().enumerate()
+                .filter(|(_, attempt)| enumerated(ATTEMPT_STATUSES, attempt.get("status")).is_some())
+                .collect();
+            // The writer imports these attempts even when it skips the activity.
+            if enumerated(ACTIVITY_STATUSES, activity.get("status")).is_none() {
+                if !attempts.is_empty() {
+                    self.unresolved(format!("activities.{index}.attempts"), "attempts of an imported activity");
+                }
+                continue;
+            }
+            let own: HashSet<&str> = attempts.iter().filter_map(|(_, attempt)| text(attempt.get("id"))).collect();
+            if text(activity.get("current_attempt_id")).is_some_and(|id| !own.contains(id)) {
+                self.unresolved(format!("activities.{index}.current_attempt_id"), "one of the activity's own attempts");
+            }
+            for (position, attempt) in attempts {
+                for key in ["workflow_task_id", "task_id"] {
+                    if text(attempt.get(key)).is_some_and(|id| !self.ids.tasks.contains(id)) {
+                        self.unresolved(format!("activities.{index}.attempts.{position}.{key}"), "a task");
+                    }
+                }
+            }
+        }
+    }
+
+    fn tasks(&mut self, bundle: &Php) {
+        for (index, task) in list(bundle.get("tasks")).into_iter().enumerate() {
+            if enumerated(TASK_TYPES, task.get("type")).is_none() || enumerated(TASK_STATUSES, task.get("status")).is_none() {
+                continue;
+            }
+            let Some(payload) = task.get("payload").filter(|payload| payload.is_array()) else {
+                continue;
+            };
+            for (key, kind) in TASK_PAYLOAD_REFERENCES {
+                if text(payload.get(key)).is_some_and(|id| !self.names(key, id)) {
+                    self.unresolved(format!("tasks.{index}.payload.{key}"), kind);
+                }
+            }
+            // A wait's resume source, for the kinds the bundle itself carries.
+            if let (Some(kind @ ("activity_execution" | "timer" | "workflow_signal" | "workflow_update")), Some(id)) =
+                (text(payload.get("resume_source_kind")), text(payload.get("resume_source_id")))
+                && !self.names(kind, id)
+            {
+                self.unresolved(format!("tasks.{index}.payload.resume_source_id"), &format!("the {kind} it resumes"));
+            }
+        }
+    }
+
+    fn failures(&mut self, bundle: &Php) {
+        for (index, failure) in list(bundle.get("failures")).into_iter().enumerate() {
+            if text(failure.get("source_kind")) == Some("activity_execution")
+                && text(failure.get("source_id")).is_some_and(|id| !self.ids.activities.contains(id))
+            {
+                self.unresolved(format!("failures.{index}.source_id"), "an activity");
+            }
+        }
+    }
+
+    /// A link never names the imported run as its own related run; the
+    /// write checks the related run against the store.
+    fn links(&mut self, bundle: &Php) {
+        let Some(run_id) = self.run_id else {
+            return;
+        };
+        let empty = Php::Array(PhpArray::default());
+        let links = bundle.get("links").filter(|value| value.is_array()).unwrap_or(&empty);
+        for (side, other) in [("parents", "parent"), ("children", "child")] {
+            for (index, link) in list(links.get(side)).into_iter().enumerate() {
+                if text(link.get(&format!("{other}_workflow_run_id"))) == Some(run_id) {
+                    self.errors.push(finding("references.self_link",
+                        &format!("Bundle links.{side}.{index} names the imported run as its own {other}.")));
+                }
+            }
+        }
+    }
+}
+
 /// `estimatedRows`: memos and search attributes are never estimated.
 fn estimated_rows(bundle: &Php) -> Rows {
     let count = |section: &str| list(bundle.get(section)).len() as i64;
@@ -745,6 +1013,12 @@ impl Runtime {
                     "message": "Import request body must be a history-export bundle or {\"bundle\": ...}.",
                     "reason": "invalid_import_bundle"}))));
             }
+            // The answer never repeats the key.
+            Request::KeyInQuery => {
+                return Ok((StatusCode::UNPROCESSABLE_ENTITY, operation().response(json!({
+                    "message": "signing_key must be sent in the request body, not in the URL.",
+                    "reason": "signing_key_in_query"}))));
+            }
             Request::Import(bundle, options) => (bundle, options),
         };
         let namespace = self.namespace_name();
@@ -864,6 +1138,89 @@ store_methods! {
         Ok(rows)
     }
 
+    /// The references `reject_foreign_references` leaves to the store. A
+    /// requested run other than the imported one must be another run of the
+    /// same workflow in this namespace, and a failure a failed update names
+    /// outside the bundle must belong to no run (Server #765).
+    async fn check_store_references(
+        tx: &mut super::transaction::Transaction<'_, DB>,
+        bundle: &Php,
+        namespace: &str,
+        run_id: &str,
+        instance_id: &str,
+    ) -> std::result::Result<(), String> {
+        let field = |row: &DB::Row, name: &str| DB::optional_string(row, name).map_err(|error| error.to_string());
+        for (path, requested) in requested_runs(bundle, run_id) {
+            let found = Self::query("SELECT namespace,workflow_instance_id FROM workflow_runs WHERE id=$1")
+                .bind(requested).fetch_optional(&mut **tx).await.map_err(|error| error.to_string())?;
+            let same_workflow = match &found {
+                Some(found) => field(found, "namespace")?.as_deref() == Some(namespace)
+                    && field(found, "workflow_instance_id")?.as_deref() == Some(instance_id),
+                None => false,
+            };
+            if !same_workflow {
+                return Err(format!("Imported {path} is not a run of this workflow in this namespace."));
+            }
+        }
+        Self::check_update_failures(tx, bundle).await
+    }
+
+    /// A failure a failed update names outside the bundle belongs to no run.
+    async fn check_update_failures(
+        tx: &mut super::transaction::Transaction<'_, DB>,
+        bundle: &Php,
+    ) -> std::result::Result<(), String> {
+        let db = |error: sqlx::Error| error.to_string();
+        let failures = BundleIds::of(bundle).failures;
+        for (index, update) in list(bundle.get("updates")).into_iter().enumerate() {
+            if enumerated(UPDATE_STATUSES, update.get("status")).is_none() {
+                continue;
+            }
+            let Some(failure) = text(update.get("failure_id")).filter(|failure| !failures.contains(failure)) else {
+                continue;
+            };
+            if Self::query("SELECT id FROM workflow_failures WHERE id=$1").bind(failure).fetch_optional(&mut **tx).await.map_err(db)?.is_some() {
+                return Err(format!("Imported updates.{index}.failure_id names a failure of another run."));
+            }
+        }
+        Ok(())
+    }
+
+    /// Whether to write a lineage link to this related run now. Native
+    /// links only runs of one namespace (Server #765): a related run or
+    /// instance in another namespace fails the import. A related run that
+    /// does not exist yet is left to its own import, whose bundle carries
+    /// the same link, so no link ever waits for a run that a later import
+    /// could create in another namespace.
+    async fn import_link_endpoint(
+        tx: &mut super::transaction::Transaction<'_, DB>,
+        namespace: &str,
+        link_id: &str,
+        other_instance: &str,
+        other_run: &str,
+    ) -> std::result::Result<bool, String> {
+        let db = |error: sqlx::Error| error.to_string();
+        let field = |row: &DB::Row, name: &str| DB::optional_string(row, name).map_err(|error| error.to_string());
+        if let Some(related) = Self::query("SELECT namespace,workflow_instance_id FROM workflow_runs WHERE id=$1")
+            .bind(other_run).fetch_optional(&mut **tx).await.map_err(db)?
+        {
+            if field(&related, "namespace")?.as_deref() != Some(namespace) {
+                return Err(format!("Imported workflow link [{link_id}] names a run of another namespace."));
+            }
+            if field(&related, "workflow_instance_id")?.as_deref() != Some(other_instance) {
+                return Err(format!("Imported workflow link [{link_id}] names a run outside the instance it names."));
+            }
+            return Ok(true);
+        }
+        if let Some(owner) = Self::query("SELECT namespace FROM workflow_instances WHERE id=$1")
+            .bind(other_instance).fetch_optional(&mut **tx).await.map_err(db)?
+            && field(&owner, "namespace")?.as_deref() != Some(namespace)
+        {
+            return Err(format!("Imported workflow link [{link_id}] names an instance of another namespace."));
+        }
+        Ok(false)
+    }
+
     async fn import_rows(tx: &mut super::transaction::Transaction<'_, DB>, plan: &Plan, namespace: &str) -> std::result::Result<Rows, String> {
         let db = |error: sqlx::Error| error.to_string();
         let mut rows: Rows = [0; 15];
@@ -931,6 +1288,7 @@ store_methods! {
                 (None, run_number, message_cursor)
             }
         };
+        Self::check_store_references(tx, bundle, namespace, run_id, instance_id).await?;
 
         let closed = time(summary.get("closed_at"))?;
         let archived = time(summary.get("archived_at"))?;
@@ -1185,6 +1543,9 @@ store_methods! {
                     (instance_id, run_id, other_instance, other_run)
                 };
                 let link_id = ulid_value(link.get("id")).map_or_else(id, str::to_owned);
+                if !Self::import_link_endpoint(tx, namespace, &link_id, other_instance, other_run).await? {
+                    continue;
+                }
                 let link_type = text(link.get("type")).unwrap_or(if parent { "parent" } else { "child" });
                 let sequence = int(link.get("sequence"));
                 let primary = truthy(link.get("is_primary_parent"));
@@ -1291,6 +1652,15 @@ mod tests {
             panic!("an import");
         };
         assert!(bundle.contains("import_id") && options.dry_run && options.import_id.is_none());
+        // The signing key is read only from the body; in the URL it refuses
+        // the request, in any spelling PHP would read.
+        let Request::Import(_, options) = request(br#"{"bundle":{"a":1},"signing_key":" k1 "}"#, &[("dry_run".into(), "1".into())]) else {
+            panic!("an import");
+        };
+        assert_eq!(options.signing_key.as_deref(), Some("k1"));
+        for key in ["signing_key", "signing_key[]", "signing_key[0]"] {
+            assert!(matches!(request(br#"{"bundle":{"a":1}}"#, &[(key.into(), "k1".into())]), Request::KeyInQuery));
+        }
     }
 
     #[test]
diff --git a/rust/tests/execution.rs b/rust/tests/execution.rs
index d3352e967..8d41575e4 100644
--- a/rust/tests/execution.rs
+++ b/rust/tests/execution.rs
@@ -307,6 +307,9 @@ mod route_coverage;
 #[path = "execution/worker_sessions.rs"]
 mod worker_sessions;
 
+#[path = "execution/workflow_import_fences.rs"]
+mod workflow_import_fences;
+
 enum TestDatabase {
     Sqlite(tempfile::TempDir),
     Postgres {
diff --git a/rust/tests/execution/workflow_import_fences.rs b/rust/tests/execution/workflow_import_fences.rs
new file mode 100644
index 000000000..f7b6773db
--- /dev/null
+++ b/rust/tests/execution/workflow_import_fences.rs
@@ -0,0 +1,442 @@
+//! Server #765: an import into one namespace never reads, links or updates
+//! another namespace's rows; the import route admits only admins; and the
+//! signing key never travels in the URL. Each test runs on the selected
+//! execution backend (SQLite, PostgreSQL or MySQL).
+use super::*;
+use sha2::{Digest, Sha256};
+
+const FIXTURE: &str = include_str!("../../../tests/Fixtures/ServerParity/workflow-import.json");
+const ROUTE: &str = "/api/workflows/import/embedded-v2";
+const CREATED_AT: &str = "2026-10-24T14:45:59.849817Z";
+
+/// PHP's canonical bundle JSON (`json-recursive-ksort-v1` under
+/// `JSON_UNESCAPED_SLASHES`): maps sorted by key, an empty map as `[]`,
+/// and every non-ASCII character as UTF-16 escapes.
+fn canonical(value: &Value) -> String {
+    fn string(text: &str) -> String {
+        let mut out = String::from('"');
+        for character in text.chars() {
+            match character {
+                '"' => out.push_str("\\\""),
+                '\\' => out.push_str("\\\\"),
+                '\u{8}' => out.push_str("\\b"),
+                '\u{c}' => out.push_str("\\f"),
+                '\n' => out.push_str("\\n"),
+                '\r' => out.push_str("\\r"),
+                '\t' => out.push_str("\\t"),
+                character if (character as u32) < 0x20 || (character as u32) > 0x7f => {
+                    let mut units = [0u16; 2];
+                    for unit in character.encode_utf16(&mut units) {
+                        out.push_str(&format!("\\u{unit:04x}"));
+                    }
+                }
+                character => out.push(character),
+            }
+        }
+        out.push('"');
+        out
+    }
+    match value {
+        Value::Object(map) if map.is_empty() => "[]".into(),
+        Value::Object(map) => {
+            let mut keys: Vec<&String> = map.keys().collect();
+            keys.sort();
+            let entries: Vec<String> = keys.iter().map(|key| format!("{}:{}", string(key), canonical(&map[*key]))).collect();
+            format!("{{{}}}", entries.join(","))
+        }
+        Value::Array(items) => format!("[{}]", items.iter().map(canonical).collect::<Vec<_>>().join(",")),
+        Value::String(text) => string(text),
+        other => other.to_string(),
+    }
+}
+
+/// A bundle of the fixture's `template` with fresh identities: each `{u:N}`
+/// label a new lowercase id and each `{U:N}` an uppercase one (unless
+/// `fixed` names it), `{instance}` the given instance, and the checksum
+/// recomputed after `mutate`.
+fn bundle(template: &str, instance: &str, fixed: &[(&str, &str)], mutate: impl FnOnce(&mut Value)) -> Value {
+    let fixture: Value = serde_json::from_str(FIXTURE).unwrap();
+    let text = fixture["workflow_import"]["bundles"][template].to_string();
+    let salt = ulid::Ulid::new().to_string()[..12].to_owned();
+    let label = regex_lite::Regex::new(r"\{([uU]):(\d+)\}|\{instance\}").unwrap();
+    let text = label.replace_all(&text, |found: &regex_lite::Captures| {
+        let whole = &found[0];
+        if whole == "{instance}" {
+            return instance.to_owned();
+        }
+        if let Some((_, to)) = fixed.iter().find(|(from, _)| *from == whole) {
+            return (*to).to_owned();
+        }
+        let id = format!("{salt}{:014}", found[2].parse::<u64>().unwrap());
+        if &found[1] == "U" { id.to_uppercase() } else { id.to_lowercase() }
+    });
+    let mut document: Value = serde_json::from_str(&text).unwrap();
+    mutate(&mut document);
+    document.as_object_mut().unwrap().remove("integrity");
+    let checksum: String = Sha256::digest(canonical(&document).as_bytes()).iter().map(|byte| format!("{byte:02x}")).collect();
+    document["integrity"] = json!({"canonicalization":"json-recursive-ksort-v1","checksum_algorithm":"sha256",
+        "checksum":checksum,"signature_algorithm":null,"signature":null,"key_id":null});
+    document
+}
+
+fn fresh_id() -> String {
+    ulid::Ulid::new().to_string().to_lowercase()
+}
+
+fn run_of(document: &Value) -> String {
+    document["workflow"]["run_id"].as_str().unwrap().to_owned()
+}
+
+/// A lineage entry naming `other` as the related run on `side`.
+fn link(side: &str, other_instance: &str, other_run: &str) -> Value {
+    let other = if side == "parents" { "parent" } else { "child" };
+    let mut entry = json!({"id":fresh_id(),"type":if side == "parents" { "child" } else { "continue_as_new" },
+        "sequence":1,"is_primary_parent":true,"created_at":CREATED_AT});
+    entry[format!("{other}_workflow_instance_id")] = json!(other_instance);
+    entry[format!("{other}_workflow_run_id")] = json!(other_run);
+    entry
+}
+
+async fn import(app: &Router, namespace: &str, document: &Value) -> (StatusCode, Value) {
+    namespaces::scoped(app, namespace, "POST", ROUTE, json!({"bundle": document})).await
+}
+
+/// Everything a namespace shows of one run: its exported bundle, without
+/// the export time and the checksum over it.
+async fn snapshot(app: &Router, namespace: &str, workflow: &str, run: &str) -> Value {
+    let path = format!("/api/workflows/{workflow}/runs/{run}/history/export");
+    let (status, mut export) = namespaces::scoped(app, namespace, "GET", &path, Value::Null).await;
+    assert_eq!(status, StatusCode::OK, "{export}");
+    for key in ["exported_at", "integrity"] {
+        export.as_object_mut().unwrap().remove(key);
+    }
+    export
+}
+
+async fn absent(app: &Router, namespace: &str, workflow: &str, run: &str) {
+    let path = format!("/api/workflows/{workflow}/runs/{run}");
+    let (status, body) = namespaces::scoped(app, namespace, "GET", &path, Value::Null).await;
+    assert_eq!(status, StatusCode::NOT_FOUND, "{body}");
+}
+
+fn refused(report: &Value, rule: &str, text: &str) {
+    assert_eq!(report["status"], "rejected", "{report}");
+    assert!(report["rows"].as_object().unwrap().values().all(|count| count == 0), "{report}");
+    let errors = report["eligibility"]["errors"].as_array().unwrap();
+    assert!(errors.iter().any(|error| error["rule"] == rule && error["message"].as_str().unwrap().contains(text)),
+        "{rule} / {text}: {report}");
+}
+
+impl TestDatabase {
+    /// Rewrites a stored row the way no request can, binding the `$n`
+    /// placeholders in order (as `?` on MySQL).
+    async fn forge(&self, sql: &'static str, binds: &[&str]) -> u64 {
+        match self {
+            Self::Sqlite(dir) => {
+                let pool = sqlx::SqlitePool::connect(&format!("sqlite://{}", dir.path().join("runtime.sqlite").display()))
+                    .await
+                    .unwrap();
+                let mut query = sqlx::query(sql);
+                for bind in binds {
+                    query = query.bind(*bind);
+                }
+                let affected = query.execute(&pool).await.unwrap().rows_affected();
+                pool.close().await;
+                affected
+            }
+            Self::Postgres { options, .. } => {
+                let pool = sqlx::postgres::PgPoolOptions::new().connect_with(options.as_ref().clone()).await.unwrap();
+                let mut query = sqlx::query(sql);
+                for bind in binds {
+                    query = query.bind(*bind);
+                }
+                let affected = query.execute(&pool).await.unwrap().rows_affected();
+                pool.close().await;
+                affected
+            }
+            Self::MySql { options, .. } => {
+                let sql = regex_lite::Regex::new(r"\$\d+").unwrap().replace_all(sql, "?").into_owned();
+                let pool = sqlx::mysql::MySqlPoolOptions::new().connect_with(options.as_ref().clone()).await.unwrap();
+                let mut query = sqlx::query(sqlx::AssertSqlSafe(sql));
+                for bind in binds {
+                    query = query.bind(*bind);
+                }
+                let affected = query.execute(&pool).await.unwrap().rows_affected();
+                pool.close().await;
+                affected
+            }
+        }
+    }
+}
+
+#[tokio::test]
+async fn lineage_into_another_namespace_is_refused_in_both_directions() {
+    let database = TestDatabase::new().await;
+    let app = router(database.open().await.unwrap());
+    namespaces::create(&app, "beta").await;
+    let foreign = namespaces::start_scoped(&app, "beta", "beta-lineage").await;
+    let foreign_run = foreign["run_id"].as_str().unwrap().to_owned();
+    let before = snapshot(&app, "beta", "beta-lineage", &foreign_run).await;
+    // Beta's run as a parent, as a child, and beta's instance with a run
+    // that does not exist yet: each fails the whole import.
+    for (index, (side, other_run, message)) in [
+        ("parents", foreign_run.as_str(), "names a run of another namespace"),
+        ("children", foreign_run.as_str(), "names a run of another namespace"),
+        ("parents", "01ksnotyetimported000000000", "names an instance of another namespace"),
+    ]
+    .into_iter()
+    .enumerate()
+    {
+        let instance = format!("wi-foreign-lineage-{index}");
+        let document = bundle("terminated", &instance, &[], |document| {
+            document["links"][side] = json!([link(side, "beta-lineage", other_run)]);
+        });
+        let (status, report) = import(&app, "default", &document).await;
+        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{report}");
+        refused(&report, "target.write_failed", message);
+        absent(&app, "default", &instance, &run_of(&document)).await;
+    }
+    // The imported run itself as its own parent.
+    let document = bundle("terminated", "wi-self-lineage", &[], |document| {
+        let run = run_of(document);
+        document["links"]["parents"] = json!([link("parents", "wi-self-lineage", &run)]);
+    });
+    let (status, report) = import(&app, "default", &document).await;
+    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{report}");
+    refused(&report, "references.self_link", "names the imported run as its own parent");
+    absent(&app, "default", "wi-self-lineage", &run_of(&document)).await;
+    assert_eq!(snapshot(&app, "beta", "beta-lineage", &foreign_run).await, before);
+}
+
+#[tokio::test]
+async fn lineage_links_only_existing_runs_of_one_namespace() {
+    let database = TestDatabase::new().await;
+    let app = router(database.open().await.unwrap());
+    namespaces::create(&app, "beta").await;
+    // A parent and its child in one namespace: the link is written.
+    let parent = bundle("terminated", "wi-parent", &[], |_| {});
+    let (status, report) = import(&app, "default", &parent).await;
+    assert_eq!(status, StatusCode::CREATED, "{report}");
+    let parent_run = run_of(&parent);
+    let child = bundle("terminated", "wi-child", &[], |document| {
+        document["links"]["parents"] = json!([link("parents", "wi-parent", &parent_run)]);
+    });
+    let (status, report) = import(&app, "default", &child).await;
+    assert_eq!(status, StatusCode::CREATED, "{report}");
+    assert_eq!(report["rows"]["workflow_links"], 1, "{report}");
+    let exported = snapshot(&app, "default", "wi-child", &run_of(&child)).await;
+    assert_eq!(exported["links"]["parents"][0]["parent_workflow_run_id"], json!(parent_run), "{exported}");
+    // A parent no namespace holds yet: the child imports without the link,
+    // which waits for the parent's own import.
+    let pending_run = fresh_id();
+    let orphan = bundle("terminated", "wi-orphan", &[], |document| {
+        document["links"]["parents"] = json!([link("parents", "wi-later-parent", &pending_run)]);
+    });
+    let (status, report) = import(&app, "default", &orphan).await;
+    assert_eq!(status, StatusCode::CREATED, "{report}");
+    assert_eq!(report["rows"]["workflow_links"], 0, "{report}");
+    let orphan_before = snapshot(&app, "default", "wi-orphan", &run_of(&orphan)).await;
+    assert_eq!(orphan_before["links"]["parents"], json!([]), "{orphan_before}");
+    // That run, imported later into another namespace, is never linked.
+    let later = bundle("terminated", "wi-later-parent", &[("{u:1}", pending_run.as_str())], |_| {});
+    let (status, report) = import(&app, "beta", &later).await;
+    assert_eq!(status, StatusCode::CREATED, "{report}");
+    assert_eq!(snapshot(&app, "default", "wi-orphan", &run_of(&orphan)).await, orphan_before);
+    let foreign = snapshot(&app, "beta", "wi-later-parent", &pending_run).await;
+    assert_eq!((foreign["links"]["parents"].clone(), foreign["links"]["children"].clone()), (json!([]), json!([])), "{foreign}");
+}
+
+#[tokio::test]
+async fn foreign_row_references_are_refused_before_anything_is_written() {
+    let database = TestDatabase::new().await;
+    let app = router(database.open().await.unwrap());
+    namespaces::create(&app, "beta").await;
+    let foreign = namespaces::start_scoped(&app, "beta", "beta-rows").await;
+    let foreign_run = foreign["run_id"].as_str().unwrap().to_owned();
+    let terminate = format!("/api/workflows/beta-rows/runs/{foreign_run}/terminate");
+    let (status, body) = namespaces::scoped(&app, "beta", "POST", &terminate, json!({"reason":"fence"})).await;
+    assert!(status.is_success(), "{body}");
+    let before = snapshot(&app, "beta", "beta-rows", &foreign_run).await;
+    let foreign_command = before["commands"][0]["id"].as_str().unwrap().to_owned();
+    let foreign_failure = before["failures"][0]["id"].as_str().expect("termination records a failure").to_owned();
+    type Mutation = Box<dyn Fn(&mut Value)>;
+    let id = |value: &str| json!(value);
+    let command = foreign_command.clone();
+    let update = move |command_id: Value, failure_id: Value| {
+        json!([{"id":fresh_id(),"command_id":command_id,"status":"failed","name":"set","command_sequence":3,
+            "failure_id":failure_id,"accepted_at":CREATED_AT,"closed_at":CREATED_AT}])
+    };
+    let cases: Vec<(&str, Mutation, &str, &str)> = vec![
+        ("signal command", Box::new({ let command = command.clone(); move |d: &mut Value| d["signals"][0]["command_id"] = id(&command) }),
+            "references.unresolved", "signals.0.command_id must name a signal command"),
+        ("update command", Box::new({ let command = command.clone(); move |d: &mut Value| d["updates"] = update(id(&command), Value::Null) }),
+            "references.unresolved", "updates.0.command_id must name an update command"),
+        ("activity task", Box::new({ let command = command.clone(); move |d: &mut Value| d["tasks"][1]["payload"]["activity_execution_id"] = id(&command) }),
+            "references.unresolved", "tasks.1.payload.activity_execution_id must name an activity"),
+        ("current attempt", Box::new({ let command = command.clone(); move |d: &mut Value| d["activities"][0]["current_attempt_id"] = id(&command) }),
+            "references.unresolved", "activities.0.current_attempt_id must name one of the activity's own attempts"),
+        ("event command", Box::new({ let command = command.clone(); move |d: &mut Value| d["history_events"][0]["workflow_command_id"] = id(&command) }),
+            "references.unresolved", "history_events.0.workflow_command_id must name a command"),
+        ("resolved run", Box::new({ let run = foreign_run.clone(); move |d: &mut Value| d["commands"][1]["resolved_run_id"] = id(&run) }),
+            "references.foreign_run", "commands.1.resolved_run_id must name the imported run"),
+        ("requested run", Box::new({ let run = foreign_run.clone(); move |d: &mut Value| d["commands"][1]["requested_run_id"] = id(&run) }),
+            "target.write_failed", "commands.1.requested_run_id is not a run of this workflow in this namespace"),
+        // The bundle's own failed update, naming beta's termination failure.
+        ("update failure", Box::new({ let failure = foreign_failure.clone(); move |d: &mut Value| {
+            let command_id = fresh_id();
+            d["commands"].as_array_mut().unwrap().push(json!({"id":command_id,"sequence":3,"type":"update",
+                "target_scope":"instance","status":"accepted","accepted_at":CREATED_AT}));
+            d["updates"] = update(json!(command_id), id(&failure));
+        } }), "target.write_failed", "updates.0.failure_id names a failure of another run"),
+    ];
+    for (index, (case, mutation, rule, text)) in cases.into_iter().enumerate() {
+        let instance = format!("wi-foreign-rows-{index}");
+        let document = bundle("rich", &instance, &[], |document| mutation(document));
+        let (status, report) = import(&app, "default", &document).await;
+        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{case}: {report}");
+        refused(&report, rule, text);
+        absent(&app, "default", &instance, &run_of(&document)).await;
+    }
+    // The untouched template imports, so each refusal came from its reference.
+    let document = bundle("rich", "wi-foreign-rows-control", &[], |_| {});
+    let (status, report) = import(&app, "default", &document).await;
+    assert_eq!(status, StatusCode::CREATED, "{report}");
+    assert_eq!(snapshot(&app, "beta", "beta-rows", &foreign_run).await, before);
+}
+
+/// Beta's run and its start command, which the forged rows below name.
+/// Beta's run and its accepted, unapplied command of `kind`: the first
+/// message of its run, as the forged row's own command is of its run, so
+/// only the command's workflow tells them apart.
+async fn foreign_target(app: &Router, workflow: &str, kind: &str) -> (String, String, Value) {
+    namespaces::create(app, "beta").await;
+    let int = json!({"name":"value","type":"int","required":true,"variadic":false,"default_available":false,"allows_null":false});
+    let (status, body) = namespaces::scoped(app, "beta", "POST", "/api/worker/register", json!({
+        "worker_id":"beta-worker","task_queue":"test","runtime":"php","supported_workflow_types":["echo"],
+        "supported_activity_types":[],"capabilities":["workflow_updates"],"workflow_command_contracts":{"echo":{
+            "signals":["finish"],"signal_contracts":[{"name":"finish","parameters":[int]}],
+            "updates":["set"],"update_validators":[],"update_contracts":[{"name":"set","parameters":[int]}]}}})).await;
+    assert_eq!(status, StatusCode::CREATED, "{body}");
+    let foreign = namespaces::start_scoped(app, "beta", workflow).await;
+    let run = foreign["run_id"].as_str().unwrap().to_owned();
+    let (status, polled) = namespaces::scoped(app, "beta", "POST", "/api/worker/workflow-tasks/poll",
+        json!({"worker_id":"beta-worker","task_queue":"test","timeout_seconds":0})).await;
+    assert_eq!(status, StatusCode::OK, "{polled}");
+    let task = &polled["task"];
+    let complete = format!("/api/worker/workflow-tasks/{}/complete", task["task_id"].as_str().unwrap());
+    let (status, body) = namespaces::scoped(app, "beta", "POST", &complete,
+        completion(task, json!([{"type":"open_signal_wait","signal_name":"finish"}]))).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    let input = envelope(Payload::Array(vec![Payload::Long(5)]));
+    let (path, body) = match kind {
+        "update" => (format!("/api/workflows/{workflow}/runs/{run}/update/set"), json!({"input":input,"wait_for":"accepted"})),
+        _ => (format!("/api/workflows/{workflow}/runs/{run}/signal/finish"), json!({"input":input})),
+    };
+    let (status, accepted) = namespaces::scoped(app, "beta", "POST", &path, body).await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{accepted}");
+    let before = snapshot(app, "beta", workflow, &run).await;
+    let stored = before["commands"].as_array().unwrap().iter().find(|row| row["type"] == json!(kind)).unwrap().clone();
+    assert_eq!((stored["message_sequence"].clone(), stored["applied_at"].clone()), (json!(1), Value::Null), "{before}");
+    (run, stored["id"].as_str().unwrap().to_owned(), before)
+}
+
+// Defense in depth for rows no import can now write: a signal record that
+// names another namespace's command is refused when it applies, and the
+// foreign command stays as it was.
+#[tokio::test]
+async fn a_signal_never_applies_to_another_namespaces_command() {
+    let database = TestDatabase::new().await;
+    let app = router(database.open().await.unwrap());
+    let (foreign_run, foreign_command, before) = foreign_target(&app, "beta-signal-target", "update").await;
+    update_worker(&app, "forged-signal-worker").await;
+    let started = start(&app, "forged-signal").await;
+    let run = started["run_id"].as_str().unwrap().to_owned();
+    open_update_wait(&app, "forged-signal-worker").await;
+    let path = format!("/api/workflows/forged-signal/runs/{run}/signal/finish");
+    let (status, signal) = request(&app, "POST", &path, json!({"input":envelope(Payload::Array(vec![Payload::Long(7)]))})).await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{signal}");
+    let forged = database.forge("UPDATE workflow_signal_records SET workflow_command_id=$1 WHERE workflow_run_id=$2",
+        &[&foreign_command, &run]).await;
+    assert_eq!(forged, 1);
+    let task = poll(&app, "forged-signal-worker", "workflow").await;
+    assert!(task["workflow_signal_id"].is_string(), "{task}");
+    let (status, refusal) = finish_task(&app, &task, json!([{"type":"complete_workflow","result":envelope(Payload::Long(1))}])).await;
+    assert_eq!(status, StatusCode::CONFLICT, "{refusal}");
+    assert_eq!(refusal["reason"], "signal_command_unavailable", "{refusal}");
+    assert_eq!(snapshot(&app, "beta", "beta-signal-target", &foreign_run).await, before);
+}
+
+#[tokio::test]
+async fn an_update_never_applies_to_another_namespaces_command() {
+    let database = TestDatabase::new().await;
+    let app = router(database.open().await.unwrap());
+    let (foreign_run, foreign_command, before) = foreign_target(&app, "beta-update-target", "signal").await;
+    update_worker(&app, "forged-update-worker").await;
+    let started = start(&app, "forged-update").await;
+    let run = started["run_id"].as_str().unwrap().to_owned();
+    open_update_wait(&app, "forged-update-worker").await;
+    let path = format!("/api/workflows/forged-update/runs/{run}/update/set");
+    let (status, admitted) = request(&app, "POST", &path,
+        json!({"input":envelope(Payload::Array(vec![Payload::Long(7)])),"wait_for":"accepted"})).await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{admitted}");
+    let update_id = admitted["update_id"].as_str().unwrap().to_owned();
+    let forged = database.forge("UPDATE workflow_updates SET workflow_command_id=$1 WHERE id=$2", &[&foreign_command, &update_id]).await;
+    assert_eq!(forged, 1);
+    let task = poll(&app, "forged-update-worker", "workflow").await;
+    assert_eq!(task["workflow_update_id"], json!(update_id), "{task}");
+    let commands = json!([{"type":"complete_update","update_id":update_id,"result":envelope(Payload::Long(1))}]);
+    let (status, refusal) = finish_task(&app, &task, commands).await;
+    assert_eq!(status, StatusCode::CONFLICT, "{refusal}");
+    assert_eq!(refusal["reason"], "update_command_unavailable", "{refusal}");
+    assert_eq!(snapshot(&app, "beta", "beta-update-target", &foreign_run).await, before);
+}
+
+#[tokio::test]
+async fn only_admin_tokens_reach_the_import_controller() {
+    let database = TestDatabase::new().await;
+    let runtime = database.open().await.unwrap();
+    let app = router(runtime.with_role_tokens(
+        Some("worker-token".into()),
+        Some("operator-token".into()),
+        Some("admin-token".into()),
+    ));
+    let document = bundle("terminated", "wi-roles", &[], |_| {});
+    let run = run_of(&document);
+    let describe = format!("/api/workflows/wi-roles/runs/{run}");
+    for token in ["worker-token", "operator-token"] {
+        let (status, _, body) = admission::admission_http(&app, "POST", ROUTE, false, Some(token), Some("2"),
+            Some("default"), json!({"bundle": document})).await;
+        assert_eq!(status, StatusCode::FORBIDDEN, "{token}: {body}");
+        // The guard answered: no import report, nothing written.
+        assert!(body.get("schema").is_none() && body.get("rows").is_none(), "{token}: {body}");
+        let (status, _, body) = admission::admission_http(&app, "GET", &describe, false, Some("admin-token"), Some("2"),
+            Some("default"), Value::Null).await;
+        assert_eq!(status, StatusCode::NOT_FOUND, "{token}: {body}");
+    }
+    let (status, _, report) = admission::admission_http(&app, "POST", ROUTE, false, Some("admin-token"), Some("2"),
+        Some("default"), json!({"bundle": document})).await;
+    assert_eq!(status, StatusCode::CREATED, "{report}");
+    assert_eq!(report["status"], "imported", "{report}");
+}
+
+#[tokio::test]
+async fn the_signing_key_is_refused_in_the_url_and_never_repeated() {
+    const SENTINEL: &str = "sentinel-signing-key-f3a9c1";
+    let database = TestDatabase::new().await;
+    let app = router(database.open().await.unwrap());
+    let document = bundle("terminated", "wi-signing-key", &[], |_| {});
+    let run = run_of(&document);
+    for query in [format!("?signing_key={SENTINEL}"), format!("?dry_run=1&signing_key%5B%5D={SENTINEL}")] {
+        let (status, body) = namespaces::scoped(&app, "default", "POST", &format!("{ROUTE}{query}"),
+            json!({"bundle": document})).await;
+        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{body}");
+        assert_eq!(body["reason"], "signing_key_in_query", "{body}");
+        assert!(!body.to_string().contains(SENTINEL), "{body}");
+        absent(&app, "default", "wi-signing-key", &run).await;
+    }
+    // From the body the key is read, and the report never repeats it.
+    let (status, report) = namespaces::scoped(&app, "default", "POST", ROUTE,
+        json!({"bundle": document, "signing_key": SENTINEL})).await;
+    assert_eq!(status, StatusCode::CREATED, "{report}");
+    assert!(!report.to_string().contains(SENTINEL), "{report}");
+}

From 9ae2934a9580b3b7cb828814503fddbe702aedea Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 20:33:53 +0000
Subject: [PATCH 8/9] Rust #325: import reciprocal parent and child bundles at
 the same moment

General showed on PostgreSQL that published PHP's import, with deferred
links, loses a reciprocal link when parent and child import concurrently:
each sees the other uncommitted and skips it. Native serializes durable
transactions (PostgreSQL's transaction advisory lock, MySQL's ownership row
FOR UPDATE, SQLite's single writer), so the second import sees the first
run committed and writes the link. The new test dispatches both imports
from two runtimes at once and requires both imported with exactly one link.
It passes on SQLite, PostgreSQL and MySQL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../tests/execution/workflow_import_fences.rs | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/rust/tests/execution/workflow_import_fences.rs b/rust/tests/execution/workflow_import_fences.rs
index f7b6773db..840fa4dbd 100644
--- a/rust/tests/execution/workflow_import_fences.rs
+++ b/rust/tests/execution/workflow_import_fences.rs
@@ -246,6 +246,40 @@ async fn lineage_links_only_existing_runs_of_one_namespace() {
     assert_eq!((foreign["links"]["parents"].clone(), foreign["links"]["children"].clone()), (json!([]), json!([])), "{foreign}");
 }
 
+// Two bundles that each carry the same parent/child link, imported at the
+// same moment: native serializes durable transactions, so whichever imports
+// second sees the first run committed and writes the link exactly once.
+#[tokio::test]
+async fn reciprocal_imports_at_the_same_moment_write_their_link_once() {
+    let database = TestDatabase::new().await;
+    let runtime = database.open().await.unwrap();
+    let other = database.open().await.unwrap();
+    let (first, second) = (router(runtime), router(other));
+    let (parent_run, child_run, link_id) = (fresh_id(), fresh_id(), ulid::Ulid::new().to_string());
+    let entry = |side: &str, instance: &str, run: &str| {
+        let mut entry = link(side, instance, run);
+        entry["id"] = json!(link_id);
+        entry["type"] = json!("child");
+        entry
+    };
+    let parent = bundle("terminated", "wi-reciprocal-parent", &[("{u:1}", parent_run.as_str())], |document| {
+        document["links"]["children"] = json!([entry("children", "wi-reciprocal-child", &child_run)]);
+    });
+    let child = bundle("terminated", "wi-reciprocal-child", &[("{u:1}", child_run.as_str())], |document| {
+        document["links"]["parents"] = json!([entry("parents", "wi-reciprocal-parent", &parent_run)]);
+    });
+    let ((parent_status, parent_report), (child_status, child_report)) =
+        tokio::join!(import(&first, "default", &parent), import(&second, "default", &child));
+    assert_eq!(parent_status, StatusCode::CREATED, "{parent_report}");
+    assert_eq!(child_status, StatusCode::CREATED, "{child_report}");
+    let written = parent_report["rows"]["workflow_links"].as_i64().unwrap() + child_report["rows"]["workflow_links"].as_i64().unwrap();
+    assert_eq!(written, 1, "{parent_report} {child_report}");
+    let exported = snapshot(&first, "default", "wi-reciprocal-child", &child_run).await;
+    let parents = exported["links"]["parents"].as_array().unwrap();
+    assert_eq!(parents.len(), 1, "{exported}");
+    assert_eq!((parents[0]["id"].clone(), parents[0]["parent_workflow_run_id"].clone()), (json!(link_id), json!(parent_run)));
+}
+
 #[tokio::test]
 async fn foreign_row_references_are_refused_before_anything_is_written() {
     let database = TestDatabase::new().await;

From ce065ab4b3e3659cf3c6d068ff54fe09c66516d3 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sun, 25 Oct 2026 21:29:38 +0000
Subject: [PATCH 9/9] Rust #325: run the import reference fence after PHP's own
 checks

On 5eea6e2dc the workflow-import corpus differed at conflict_native_run:
the probe renames a bundle's run to an existing native run, and published
PHP answers target.run_id_conflict, but native's reference fence ran inside
eligibility and answered the bundle's commands' resolved runs first. An
ineligible bundle (identity_missing) would likewise have gained reference
findings PHP never reports.

The fence now runs after eligibility and the existing-run check, and before
a dry run or a write, so every answer PHP gives stays PHP's and a crafted
bundle is still refused before anything is written, dry runs included. A new
test pins that order on each backend.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 rust/src/runtime/workflow_import.rs           | 15 +++++++--
 .../tests/execution/workflow_import_fences.rs | 33 +++++++++++++++++++
 2 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/rust/src/runtime/workflow_import.rs b/rust/src/runtime/workflow_import.rs
index 1f57db814..8c036d5a5 100644
--- a/rust/src/runtime/workflow_import.rs
+++ b/rust/src/runtime/workflow_import.rs
@@ -306,8 +306,12 @@ impl Eligibility {
     }
 
     fn with_error(&self, rule: &str, message: &str) -> Value {
+        self.with_errors(vec![finding(rule, message)])
+    }
+
+    fn with_errors(&self, findings: Vec<Value>) -> Value {
         let mut errors = self.errors.clone();
-        errors.push(finding(rule, message));
+        errors.extend(findings);
         json!({"eligible": false, "errors": errors, "warnings": self.warnings})
     }
 }
@@ -353,7 +357,6 @@ fn eligibility(bundle: &PhpArray, integrity: &str, signature_verified: bool, sum
     }
     reject_unsupported_payload_codecs(&root, &mut errors);
     reject_open_leases(&root, &mut errors);
-    reject_foreign_references(&root, summary, &mut errors);
     Eligibility { errors, warnings }
 }
 
@@ -1052,6 +1055,14 @@ impl Runtime {
                 "A workflow run with this run_id already exists and was not imported from the same bundle.")), &empty, None));
         }
         let root = Php::Array(prepared.bundle.clone());
+        // Native's reference fence (Server #765), after PHP's eligibility and
+        // run checks so their answers stay PHP's, and before a dry run or a
+        // write.
+        let mut references = Vec::new();
+        reject_foreign_references(&root, &prepared.summary, &mut references);
+        if !references.is_empty() {
+            return Ok(answer("rejected", Some(prepared.eligibility.with_errors(references)), &empty, None));
+        }
         if prepared.options.dry_run {
             return Ok(answer("dry_run", None, &estimated_rows(&root), None));
         }
diff --git a/rust/tests/execution/workflow_import_fences.rs b/rust/tests/execution/workflow_import_fences.rs
index 840fa4dbd..2bc087512 100644
--- a/rust/tests/execution/workflow_import_fences.rs
+++ b/rust/tests/execution/workflow_import_fences.rs
@@ -280,6 +280,39 @@ async fn reciprocal_imports_at_the_same_moment_write_their_link_once() {
     assert_eq!((parents[0]["id"].clone(), parents[0]["parent_workflow_run_id"].clone()), (json!(link_id), json!(parent_run)));
 }
 
+// PHP's own answers come first: an ineligible bundle reports only its
+// eligibility findings, and a bundle whose run already exists reports the
+// run conflict, whatever its references say. The fence then refuses before a
+// dry run or a write.
+#[tokio::test]
+async fn php_s_eligibility_and_run_checks_answer_before_the_reference_fence() {
+    let database = TestDatabase::new().await;
+    let app = router(database.open().await.unwrap());
+    let existing = bundle("terminated", "wi-existing", &[], |_| {});
+    assert_eq!(import(&app, "default", &existing).await.0, StatusCode::CREATED);
+    let existing_run = run_of(&existing);
+    // The run is renamed to the existing one; every reference still names
+    // the bundle's own run.
+    let colliding = bundle("terminated", "wi-colliding", &[], |document| document["workflow"]["run_id"] = json!(existing_run));
+    let (status, report) = namespaces::scoped(&app, "default", "POST", ROUTE, json!({"bundle": colliding, "dry_run": true})).await;
+    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{report}");
+    let rules: Vec<&str> = report["eligibility"]["errors"].as_array().unwrap().iter().map(|error| error["rule"].as_str().unwrap()).collect();
+    assert_eq!(rules, ["target.run_id_conflict"], "{report}");
+    let anonymous = bundle("terminated", "wi-anonymous", &[], |document| {
+        let workflow = document["workflow"].as_object_mut().unwrap();
+        workflow.remove("instance_id");
+        workflow.remove("run_id");
+    });
+    let (_, report) = import(&app, "default", &anonymous).await;
+    let rules: Vec<&str> = report["eligibility"]["errors"].as_array().unwrap().iter().map(|error| error["rule"].as_str().unwrap()).collect();
+    assert!(rules.contains(&"workflow.run_id_missing") && !rules.iter().any(|rule| rule.starts_with("references.")), "{report}");
+    // A dry run of a bundle the fence refuses is refused too.
+    let crafted = bundle("terminated", "wi-crafted", &[], |document| document["commands"][0]["resolved_run_id"] = json!(existing_run));
+    let (status, report) = namespaces::scoped(&app, "default", "POST", ROUTE, json!({"bundle": crafted, "dry_run": true})).await;
+    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{report}");
+    refused(&report, "references.foreign_run", "commands.0.resolved_run_id must name the imported run");
+}
+
 #[tokio::test]
 async fn foreign_row_references_are_refused_before_anything_is_written() {
     let database = TestDatabase::new().await;