nx_wflow_engine_capacity_candidate_t278.nx

nx_wflow_engine.nx -- R1 KEYSTONE of the Workflow Automation ladder (/compare/automation census row "Unified multi-step durable workflow engine"). A WORKFLOW = DATA (law: data as data): flow header = `flowid|event-kind|cond(k=v or -)` step row = `flowid|idx|action|channel-or-dash|arg|max-attempts` (idx 1-based, author ascending) An EVENT = `kind~k=v~...~id=EN` (the nx_crm_flow contract). The engine upgrades nx_crm_flow from single-shot in-memory rules to DURABLE EXECUTION (the Temporal model, sovereign): - every transition is ONE appended line in an append-only RUN LEDGER (flock + O_APPEND, torn-free): `WFRUN rid=<evid>.<flowid> flow=<f> step=<n> status=START|ATT|OK|FAILSTEP|FAILED|DONE att=<k>` - state is DERIVED BY REPLAY of the ledger (event-sourced; nothing mutates, history is sacred) - IDEMPOTENT by construction: a (event id, flow) pair with a START line never starts twice -- the dedup survives crashes/restarts (stronger than the in-memory seen[] of nx_crm_flow) - per-step RETRY up to max-attempts; exhausted -> run FAILED at that step, later steps never run - wf_resume: any run with START but neither DONE nor FAILED (a crash mid-flight) is completed from its first non-OK step; already-OK steps are NOT re-executed (proven in the selftest) ACTIONS v1 (in-process, composing the send plane like nx_crm_flow): create-task | send (any nx_send channel, sr_valid-checked at load) | notify | update-field | probe-fail (DIAGNOSTIC: fails while attempt < arg -- the deterministic retry witness; keep it out of production flows). wf_load validates the WHOLE step set up front (unknown action / bad channel / attempts<1 = LOUD -1, nothing half-loaded). Production ledger path suggestion: knowledge/status/wflow_runs.log. R3 CONNECTOR LAYER (exec-organ): a step can run ANY blessed organ as a workflow step, resolved through a GREEN fail-closed catalog (rows `name<TAB>elf<TAB>GREEN`, the tool_allowlist.conf shape; cx[3]=catalog path, 0=exec-organ refused). Child exit 0 = step OK, nonzero = step fail (so per-step retry applies to REAL organ execution). Production catalog: knowledge/wflow/connectors.conf. PURE CORE (no main -- the house pure-core+gate idiom): gates = _hdl_build/nx_wflow_engine_gate (wf_selftest) + _hdl_build/nx_wflow_connect_gate (connector battery). license_tier: ORIGINAL