flow: durable agentic workflow — HITL pause + per-tool-call checkpointing

Context (from the gap audit — architectural, human-led, NOT for autonomous auto-merge)

flow/ is close on the deterministic axis (it checkpoints and resumes without replaying completed steps) but not yet a first-class durable agentic workflow — the convergence leg Dapr-Agents leads with, and the thing Mu had to hand-roll (agent/flows.go).

Two gaps make an agent loop non-durable:

• No human-in-the-loop pause — flow/steps.go:107 has no waiting state; a step needing external input must block the process or fail. No Resume(runID, injectedInput).
• The agent's dynamic loop is opaque to checkpointing — flow/steps.go:269 (Dispatch)/flow.go:306 (callAgent): a whole Agent.Chat turn is one flow step, so a crash mid-turn replays every tool call. The durable unit is a fixed step list, not the agent's pausable per-tool-call loop.
• Secondary: flow/loop.go:82 Loop not per-iteration checkpointed; steps.go:457 at-least-once (duplicate side effects on resume) not exactly-once; :158 no run leasing for multi-replica.

Why human-led

This is a core primitive design touching the agent↔flow seam, exactly-once semantics, and multi-replica leasing — architectural, ambiguous, and high-blast-radius. It should be designed 1:1, not auto-built. Mu is the reference deployment to validate it against.

Rough shape (to be designed, not prescriptive)

• A waiting/suspended run status + an await-input step signal that checkpoints and returns cleanly; Resume(ctx, runID, input) feeds it into State.
• Make the agent tool loop emit durable checkpoints per tool call (agent writes step records into the same Run), so resume re-enters at the last completed tool call.
• Idempotency keys per step (exactly-once) and a store CAS/lease on the run record (multi-replica).

Discuss the approach here before implementation.