Bound execution and recover interrupted workflows

Task execution is time-bounded and recovery state survives worker crashes, so an interrupted update or site rename can resume safely.