diff --git a/.changeset/retained-serialization-taint.md b/.changeset/retained-serialization-taint.md
new file mode 100644
index 0000000000..c7a79c81ea
--- /dev/null
+++ b/.changeset/retained-serialization-taint.md
@@ -0,0 +1,6 @@
+---
+'@workflow/core': minor
+'workflow': minor
+---
+
+Retained-VM boundaries now accept plain data and standard built-ins (`Map`, `Set`, `Date`, `Error`, typed arrays, `URL`, `Headers`, …) as step inputs. Serialization reads through captured intrinsics and reports when it had to execute workflow code (getters, proxies, custom serializers); only those boundaries fall back to ordinary replay.
diff --git a/biome.json b/biome.json
index 222f843041..009f58f0fd 100644
--- a/biome.json
+++ b/biome.json
@@ -27,7 +27,8 @@
       "!**/.nitro",
       "!**/.output",
       "!**/.tanstack",
-      "!**/routeTree.gen.ts"
+      "!**/routeTree.gen.ts",
+      "!packages/core/src/vendor"
     ],
     "ignoreUnknown": true
   },
diff --git a/docs/content/docs/v5/configuration/runtime-tuning.mdx b/docs/content/docs/v5/configuration/runtime-tuning.mdx
index 9007fb7c2a..4209134853 100644
--- a/docs/content/docs/v5/configuration/runtime-tuning.mdx
+++ b/docs/content/docs/v5/configuration/runtime-tuning.mdx
@@ -81,7 +81,7 @@ For example, a workflow can run a 10-minute inline step even with `WORKFLOW_REPL
 - Default: enabled
 - Keeps the suspended workflow VM alive across inline steps within one invocation, so each iteration of the inline loop appends only the newly written events instead of replaying the whole event log in a fresh VM.
 - Suspensions involving hooks, waits, or attributes — and any replay divergence — always fall back to a full replay.
-- Step inputs of primitive values remain retainable; anything whose serialization could execute workflow code falls back to replay for that boundary. (Support for plain objects, arrays, and standard built-ins lands in a follow-up.)
+- Step inputs made of plain data (objects, arrays, primitives) and standard built-ins (`Map`, `Set`, `Date`, `RegExp`, `Error`, typed arrays, `ArrayBuffer`, `URL`, `Headers`) remain retainable: serialization reads them through captured intrinsics, so patching or polyfilling built-in prototypes does not affect retention. Anything whose serialization executes workflow code — getters, proxies, custom class serializers, step-function closures — falls back to replay for that boundary.
 - Set `0` or `false` to replay from scratch in a fresh VM on every iteration.
 
 ### `WORKFLOW_INLINE_OWNERSHIP`
diff --git a/packages/core/e2e/local-build.test.ts b/packages/core/e2e/local-build.test.ts
index 880a56b8cc..cf415c10be 100644
--- a/packages/core/e2e/local-build.test.ts
+++ b/packages/core/e2e/local-build.test.ts
@@ -79,8 +79,10 @@ async function readFileIfExists(filePath: string): Promise<string | null> {
  * Projects that use the VercelBuildOutputAPIBuilder and produce ESM step bundles.
  */
 const ESM_STEP_BUNDLE_PROJECTS: Record<string, string> = {
+  // Steps are bundled into the combined flow function (there is no separate
+  // step.func in the Build Output API layout).
   example:
-    '.vercel/output/functions/.well-known/workflow/v1/step.func/index.mjs',
+    '.vercel/output/functions/.well-known/workflow/v1/flow.func/index.mjs',
 };
 
 const DIAGNOSTICS_MANIFEST_PATHS: Record<string, string> = {
diff --git a/packages/core/package.json b/packages/core/package.json
index 42ba989369..09fea2b15d 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -85,7 +85,7 @@
     "./_workflow": "./dist/workflow/index.js"
   },
   "scripts": {
-    "build": "genversion --es6 src/version.ts && tsc",
+    "build": "genversion --es6 src/version.ts && tsc && cp src/vendor/devalue/LICENSE src/vendor/devalue/README.md dist/vendor/devalue/",
     "dev": "genversion --es6 src/version.ts && tsc --watch",
     "clean": "tsc --build --clean && rm -rf dist src/version.ts docs ||:",
     "test": "cross-env WORKFLOW_TARGET_WORLD=local vitest run src",
@@ -107,7 +107,6 @@
     "@workflow/world-local": "workspace:*",
     "@workflow/world-vercel": "workspace:*",
     "debug": "4.4.3",
-    "devalue": "5.8.1",
     "ms": "2.1.3",
     "nanoid": "5.1.6",
     "seedrandom": "3.0.5",
diff --git a/packages/core/src/retained-vm-loop.test.ts b/packages/core/src/retained-vm-loop.test.ts
index d24b59bcc2..9ef6630529 100644
--- a/packages/core/src/retained-vm-loop.test.ts
+++ b/packages/core/src/retained-vm-loop.test.ts
@@ -100,6 +100,56 @@ const mixedBatchWorkflow = `const s1 = globalThis[Symbol.for("WORKFLOW_USE_STEP"
   }
   globalThis.__private_workflows = new Map([["workflow", workflow]]);`;
 
+// Map/Date/typed-array arguments serialize through captured host intrinsics
+// (see serialization/operations.ts), so these boundaries stay retainable.
+const builtinArgsWorkflow = `const s1 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s1");
+  const s2 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s2");
+  async function workflow() {
+    const a = await s1({ index: new Map([["k", 1]]), when: new Date(1234) });
+    const b = await s2(new Uint8Array([1, 2, 3]));
+    return a + b;
+  }
+  globalThis.__private_workflows = new Map([["workflow", workflow]]);`;
+
+// The Temporal / core-js pattern: polyfills add new data-valued methods to
+// built-in prototypes and constructor statics. Serialization never reads
+// them, so retention is unaffected.
+const polyfillArgsWorkflow = `const s1 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s1");
+  const s2 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s2");
+  Date.prototype.toTemporalInstant = function () { return "instant"; };
+  Set.prototype.union = function (other) { return new Set([...this, ...other]); };
+  Object.groupBy = function () { return {}; };
+  async function workflow() {
+    const a = await s1(new Date(1234));
+    const b = await s2(new Set([1, 2]));
+    return a + b;
+  }
+  globalThis.__private_workflows = new Map([["workflow", workflow]]);`;
+
+// Replacing a serialization-relevant member (Date.prototype.toISOString)
+// does not affect retention: the Date reducer reads through captured host
+// intrinsics (see serialization/operations.ts), so the patched member never
+// executes and the serialized bytes stay pristine in both modes.
+const patchedDateArgWorkflow = `const s1 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s1");
+  const s2 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s2");
+  Date.prototype.toISOString = function () { return "patched"; };
+  async function workflow() {
+    const a = await s1(new Date(1234));
+    const b = await s2();
+    return a + b;
+  }
+  globalThis.__private_workflows = new Map([["workflow", workflow]]);`;
+
+const patchedDateStringArgWorkflow = `const s1 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s1");
+  const s2 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s2");
+  Date.prototype.toISOString = function () { return "patched"; };
+  async function workflow() {
+    const a = await s1(new Date(1234).toISOString());
+    const b = await s2();
+    return a + b;
+  }
+  globalThis.__private_workflows = new Map([["workflow", workflow]]);`;
+
 // `crypto.subtle.digest` computes synchronously via node:crypto, so a
 // digest-using VM stays quiescent at suspension and remains retainable.
 const digestWorkflow = `const s1 = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("r_s1");
@@ -319,6 +369,42 @@ describe('retained VM through the inline replay loop', () => {
     expect(vmBuilds).toBeGreaterThan(1);
   });
 
+  it('retains boundaries whose args are supported built-ins', async () => {
+    const { vmBuilds, output } = await drive(
+      'wrun_retained_builtins',
+      builtinArgsWorkflow
+    );
+    expect(output).toBeInstanceOf(Uint8Array);
+    expect(vmBuilds).toBe(1);
+  });
+
+  it('retains boundaries when prototypes carry polyfilled data methods', async () => {
+    const { vmBuilds, output } = await drive(
+      'wrun_retained_polyfill',
+      polyfillArgsWorkflow
+    );
+    expect(output).toBeInstanceOf(Uint8Array);
+    expect(vmBuilds).toBe(1);
+  });
+
+  it('retains a Date arg even when a serialization member is replaced', async () => {
+    const { vmBuilds, output } = await drive(
+      'wrun_retained_patched_date',
+      patchedDateArgWorkflow
+    );
+    expect(output).toBeInstanceOf(Uint8Array);
+    expect(vmBuilds).toBe(1);
+  });
+
+  it('retains when the patched type is converted to a string first', async () => {
+    const { vmBuilds, output } = await drive(
+      'wrun_retained_patched_date_string',
+      patchedDateStringArgWorkflow
+    );
+    expect(output).toBeInstanceOf(Uint8Array);
+    expect(vmBuilds).toBe(1);
+  });
+
   it('retains a VM that used the synchronous crypto.subtle.digest', async () => {
     const { vmBuilds, output } = await drive(
       'wrun_retained_digest',
diff --git a/packages/core/src/runtime/suspension-handler.test.ts b/packages/core/src/runtime/suspension-handler.test.ts
index 404caea4d2..7352b01ef8 100644
--- a/packages/core/src/runtime/suspension-handler.test.ts
+++ b/packages/core/src/runtime/suspension-handler.test.ts
@@ -397,3 +397,81 @@ describe('handleSuspension', () => {
     ).toBe(false);
   });
 });
+
+describe('retainedStepInputsSafe (serialization passivity gate)', () => {
+  function stepPending(args: unknown[]) {
+    return new Map([
+      [
+        'step_1',
+        {
+          type: 'step' as const,
+          correlationId: 'step_1',
+          stepName: 'someStep',
+          args,
+        },
+      ],
+    ]);
+  }
+
+  async function runSuspension(args: unknown[]) {
+    const eventsCreate = vi
+      .fn()
+      .mockImplementation(async (_runId, event) => ({ event }));
+    const world = createWorld(eventsCreate);
+    return handleSuspension({
+      suspension: new WorkflowSuspension(stepPending(args), globalThis),
+      world,
+      run,
+    });
+  }
+
+  it('reports safe for plain data and supported built-ins', async () => {
+    const result = await runSuspension([
+      { nested: [{ ok: true }, 'text', 42n], flag: false },
+      new Map([['k', new Set([1])]]),
+      new Date(1700000000000),
+      new Uint8Array([1, 2, 3]),
+      /pattern/gi,
+      new URL('https://example.com/'),
+      new Error('recorded failure'),
+    ]);
+    expect(result.retainedStepInputsSafe).toBe(true);
+  });
+
+  it('reports unsafe when serializing an argument executes a getter', async () => {
+    const value: Record<string, unknown> = {};
+    Object.defineProperty(value, 'lazy', {
+      enumerable: true,
+      get: () => 'computed',
+    });
+    const result = await runSuspension([{ deep: [value] }]);
+    expect(result.retainedStepInputsSafe).toBe(false);
+  });
+
+  it('reports unsafe when an argument is a proxy', async () => {
+    const result = await runSuspension([new Proxy({ a: 1 }, {})]);
+    expect(result.retainedStepInputsSafe).toBe(false);
+  });
+
+  it('still serializes tainted inputs successfully (bytes are unaffected)', async () => {
+    const value: Record<string, unknown> = {};
+    Object.defineProperty(value, 'lazy', {
+      enumerable: true,
+      get: () => 'computed',
+    });
+    const eventsCreate = vi
+      .fn()
+      .mockImplementation(async (_runId, event) => ({ event }));
+    const world = createWorld(eventsCreate);
+    const result = await handleSuspension({
+      suspension: new WorkflowSuspension(stepPending([value]), globalThis),
+      world,
+      run,
+    });
+    expect(result.retainedStepInputsSafe).toBe(false);
+    // The step is still prepared for execution as usual.
+    expect(
+      result.lazyInlineSteps.length + result.createdStepCorrelationIds.size
+    ).toBeGreaterThan(0);
+  });
+});
diff --git a/packages/core/src/runtime/suspension-handler.ts b/packages/core/src/runtime/suspension-handler.ts
index 72f5411f3c..bfbe76ece2 100644
--- a/packages/core/src/runtime/suspension-handler.ts
+++ b/packages/core/src/runtime/suspension-handler.ts
@@ -26,25 +26,13 @@ import type {
   WorkflowSuspension,
 } from '../global.js';
 import { runtimeLogger } from '../logger.js';
+import type { SerializationPassivityReport } from '../serialization/operations.js';
 import { dehydrateStepArguments } from '../serialization.js';
 import * as Attribute from '../telemetry/semantic-conventions.js';
 import { getAbortStreamIdFromToken } from '../util.js';
 import { getMaxInlineSteps } from './constants.js';
 import { type MutableEventLog, withPreconditionRetry } from './helpers.js';
 
-// Serializing a primitive executes no code of any kind. BigInt is excluded:
-// its encoding calls a prototype method. Widened to plain data and standard
-// built-ins by the retained-input walker in a follow-up.
-function isPrimitiveStepArgument(value: unknown): boolean {
-  return (
-    value === null ||
-    value === undefined ||
-    typeof value === 'boolean' ||
-    typeof value === 'number' ||
-    typeof value === 'string'
-  );
-}
-
 export interface SuspensionHandlerParams {
   suspension: WorkflowSuspension;
   world: World;
@@ -134,7 +122,12 @@ export interface SuspensionHandlerResult {
    * durably creating the user's hooks doesn't count as runtime overhead.
    */
   hookCreationMs: number;
-  /** Whether every newly serialized step input was passive retained-VM data. */
+  /**
+   * Whether serializing this suspension's new step inputs was passive (did
+   * not execute workflow-owned code such as getters, proxy traps, or custom
+   * serializers). `false` means the retained VM may have diverged from what
+   * a cold replay would compute, so the caller must demote to replay.
+   */
   retainedStepInputsSafe: boolean;
 }
 
@@ -506,20 +499,18 @@ export async function handleSuspension({
 
   // Serialization always runs through the one ordinary path below, so the
   // durable bytes cannot depend on retention. What retention needs to know is
-  // whether that serialization will execute workflow code (getters, hooks,
-  // patched prototype members) — side effects a cold replay would not repeat.
-  // For now only primitive arguments are provably passive (serializing them
-  // executes no code at all); a follow-up widens this to plain data and the
-  // standard built-ins. If any input in the batch is not provably passive,
-  // the caller demotes the session so the side effects land in a VM that is
-  // about to be discarded, exactly like the pre-retention runtime.
-  const retainedStepInputsSafe = stepItems.every(
-    (item) =>
-      !stepsNeedingCreation.has(item.correlationId) ||
-      (item.thisVal === undefined &&
-        item.closureVars === undefined &&
-        item.args.every(isPrimitiveStepArgument))
-  );
+  // whether that serialization *executed* workflow code (getters, proxy
+  // traps, custom serializers) — side effects a cold replay would not
+  // repeat, since a replay skips dehydration for already-recorded steps.
+  // The hardened stringify operations record exactly that into this report
+  // (see ../serialization/operations.ts); when any input in the batch
+  // taints it, the caller demotes the session so the side effects land in a
+  // VM that is about to be discarded, exactly like the pre-retention
+  // runtime.
+  const passivityReport: SerializationPassivityReport = {
+    tainted: false,
+    reasons: [],
+  };
 
   // Lazy inline start: defer the step_created write for up to
   // `getMaxInlineSteps()` steps the caller will run inline (in parallel). Each
@@ -564,7 +555,8 @@ export async function handleSuspension({
             encryptionKey,
             suspension.globalThis,
             false,
-            compression
+            compression,
+            passivityReport
           );
           // Deferred (lazy) inline step: skip the step_created write — the
           // caller's inline executeStep will send a lazy step_started carrying
@@ -706,6 +698,15 @@ export async function handleSuspension({
   // step_created and re-dispatches, and recovers the run instead of orphaning it.
   await Promise.all(ops);
 
+  // The step-input dehydrations above have settled, so the report is final.
+  const retainedStepInputsSafe = !passivityReport.tainted;
+  if (passivityReport.tainted) {
+    runtimeLogger.debug(
+      'Serializing step inputs executed workflow code; falling back to replay instead of retaining the VM',
+      { workflowRunId: runId, reasons: passivityReport.reasons }
+    );
+  }
+
   // Rebuild the inline batch in deterministic order. `lazyInlineCorrelationIds`
   // is a Set seeded from the ordered first-N slice, so iterating it preserves
   // stepItems order; every id in it was set by the lazy branch above.
diff --git a/packages/core/src/serialization-format.test.ts b/packages/core/src/serialization-format.test.ts
index e81d45e02f..7f456ec7c4 100644
--- a/packages/core/src/serialization-format.test.ts
+++ b/packages/core/src/serialization-format.test.ts
@@ -1,4 +1,4 @@
-import { stringify } from 'devalue';
+import { stringify } from './vendor/devalue/index.js';
 import { describe, expect, it } from 'vitest';
 import {
   ClassInstanceRef,
diff --git a/packages/core/src/serialization-format.ts b/packages/core/src/serialization-format.ts
index c2415961b3..52352d29af 100644
--- a/packages/core/src/serialization-format.ts
+++ b/packages/core/src/serialization-format.ts
@@ -7,7 +7,7 @@
  */
 
 import { getEventDataRefFields } from '@workflow/world';
-import { parse, unflatten } from 'devalue';
+import { parse, unflatten } from './vendor/devalue/index.js';
 
 // ---------------------------------------------------------------------------
 // Format prefix constants and encoding/decoding
diff --git a/packages/core/src/serialization.test.ts b/packages/core/src/serialization.test.ts
index 5c21c55c3c..75a5d21f71 100644
--- a/packages/core/src/serialization.test.ts
+++ b/packages/core/src/serialization.test.ts
@@ -4767,7 +4767,7 @@ describe('getDeserializeStream legacy fallback', () => {
   }
 
   it('should parse legacy newline-delimited devalue text', async () => {
-    const { stringify } = await import('devalue');
+    const { stringify } = await import('./vendor/devalue/index.js');
     const encoder = new TextEncoder();
 
     const line1 = `${stringify({ hello: 'world' })}\n`;
@@ -4781,7 +4781,7 @@ describe('getDeserializeStream legacy fallback', () => {
   });
 
   it('should parse legacy single-line chunks', async () => {
-    const { stringify } = await import('devalue');
+    const { stringify } = await import('./vendor/devalue/index.js');
     const encoder = new TextEncoder();
 
     const chunk1 = encoder.encode(`${stringify('hello')}\n`);
diff --git a/packages/core/src/serialization.ts b/packages/core/src/serialization.ts
index ffd5815d01..4e0f3a100d 100644
--- a/packages/core/src/serialization.ts
+++ b/packages/core/src/serialization.ts
@@ -4,7 +4,6 @@ import {
   WorkflowRuntimeError,
 } from '@workflow/errors';
 import { envNumber } from '@workflow/world';
-import { parse, stringify, unflatten } from 'devalue';
 import { monotonicFactory } from 'ulid';
 import {
   decrypt as aesGcmDecrypt,
@@ -48,6 +47,17 @@ import {
   isEncrypted,
   peekFormatPrefix,
 } from './serialization/format.js';
+// All devalue stringify calls go through the hardened wrapper so the
+// side-effect-free operations (and passivity tainting) apply uniformly —
+// see ./serialization/operations.ts.
+import {
+  capturedIntrinsics,
+  isInstanceOfPrototype,
+  passiveGet,
+  type SerializationPassivityReport,
+  hardenedStringify as stringify,
+  withPassivityReport,
+} from './serialization/operations.js';
 import {
   getClassReducers,
   getClassRevivers,
@@ -87,6 +97,7 @@ import {
 import * as Attr from './telemetry/semantic-conventions.js';
 import { getActiveSpan, getSpanKind, recordElapsedSpan } from './telemetry.js';
 import { getAbortStreamId } from './util.js';
+import { parse, unflatten } from './vendor/devalue/index.js';
 import { WorkflowAbortSignal } from './workflow/abort-controller.js';
 
 // Re-export types and utilities from the modular serialization modules
@@ -1286,9 +1297,31 @@ import type {
  * Base reducers shared across all serialization boundaries.
  * Composes: class + step-function + common reducers from the modular modules.
  */
+/**
+ * Passively resolve `global[name].prototype` for prototype-chain brand
+ * checks (see `isInstanceOfPrototype`). Returns undefined when the binding
+ * is missing or not a function (e.g. the workflow VM's `AbortSignal`, which
+ * is a plain object) — matching how the old `instanceof` predicates guarded
+ * on `typeof global[name] === 'function'`.
+ */
+function resolvePrototype(
+  global: Record<string, any>,
+  name: string
+): object | undefined {
+  const ctor = passiveGet(global, name);
+  if (typeof ctor !== 'function') return undefined;
+  return passiveGet(ctor, 'prototype') as object | undefined;
+}
+
 function getAllBaseReducers(
   global: Record<string, any> = globalThis
 ): Partial<Reducers> {
+  // Resolve the realm's constructors once per reducer set. In the workflow
+  // VM these are custom classes installed by workflow.ts (not host classes),
+  // so brand checks must go through the passed `global`.
+  const RequestPrototype = resolvePrototype(global, 'Request');
+  const ResponsePrototype = resolvePrototype(global, 'Response');
+
   // Class/Instance MUST come before Error so that custom Error subclasses
   // with WORKFLOW_SERIALIZE take precedence (devalue uses first-match-wins).
   return {
@@ -1298,17 +1331,20 @@ function getAllBaseReducers(
     // Request and Response reducers are mode-specific and added by
     // getExternalReducers / getWorkflowReducers / getStepReducers below.
     Request: (value) => {
-      if (!(value instanceof global.Request)) return false;
+      if (!isInstanceOfPrototype(value, RequestPrototype)) return false;
       const data: SerializableSpecial['Request'] = {
-        method: value.method,
-        url: value.url,
-        headers: value.headers,
-        body: value.body,
-        duplex: value.duplex,
+        method: passiveGet(value, 'method') as string,
+        url: passiveGet(value, 'url') as string,
+        headers: passiveGet(value, 'headers') as Headers,
+        body: passiveGet(value, 'body') as ReadableStream | null,
+        duplex: passiveGet(
+          value,
+          'duplex'
+        ) as SerializableSpecial['Request']['duplex'],
       };
-      const responseWritable = value[WEBHOOK_RESPONSE_WRITABLE];
+      const responseWritable = passiveGet(value, WEBHOOK_RESPONSE_WRITABLE);
       if (responseWritable) {
-        data.responseWritable = responseWritable;
+        data.responseWritable = responseWritable as WritableStream;
       }
       // Forward the signal in two cases:
       //   1. Already aborted — preserve aborted=true/reason so the hydrated
@@ -1319,25 +1355,30 @@ function getAllBaseReducers(
       // Plain non-aborted native signals are intentionally dropped (would
       // mint stream infra for every Request, including the auto-generated
       // signal on `new Request(url)`).
+      const signal = passiveGet(value, 'signal') as
+        | (AbortSignal & AbortInternals)
+        | undefined;
       if (
-        value.signal &&
-        (value.signal.aborted ||
-          (value.signal as AbortInternals)[ABORT_STREAM_NAME])
+        signal &&
+        (passiveGet(signal, 'aborted') || passiveGet(signal, ABORT_STREAM_NAME))
       ) {
-        data.signal = value.signal;
+        data.signal = signal;
       }
       return data;
     },
     Response: (value) => {
-      if (!(value instanceof global.Response)) return false;
+      if (!isInstanceOfPrototype(value, ResponsePrototype)) return false;
       return {
-        type: value.type,
-        url: value.url,
-        status: value.status,
-        statusText: value.statusText,
-        headers: value.headers,
-        body: value.body,
-        redirected: value.redirected,
+        type: passiveGet(
+          value,
+          'type'
+        ) as SerializableSpecial['Response']['type'],
+        url: passiveGet(value, 'url') as string,
+        status: passiveGet(value, 'status') as number,
+        statusText: passiveGet(value, 'statusText') as string,
+        headers: passiveGet(value, 'headers') as Headers,
+        body: passiveGet(value, 'body') as ReadableStream | null,
+        redirected: passiveGet(value, 'redirected') as boolean,
       };
     },
   };
@@ -1426,18 +1467,35 @@ function reduceAbortBySymbol(
   signal: { aborted: boolean; reason?: unknown },
   holder: AbortHolder
 ): AbortSerializedData | false {
-  const streamName =
-    holder[ABORT_STREAM_NAME] ?? holder.signal?.[ABORT_STREAM_NAME];
-  const hookToken =
-    holder[ABORT_HOOK_TOKEN] ?? holder.signal?.[ABORT_HOOK_TOKEN];
+  // All reads are passive: the symbols are own data properties on both the
+  // VM's Workflow* classes and reduced natives, and `aborted`/`reason` are
+  // either data properties (VM) or the captured native prototype accessors.
+  // `signal` is the holder itself (AbortSignal reducer) or was already read
+  // passively from the holder (AbortController reducer), so symbol probes on
+  // both cover holder[SYM] ?? holder.signal?.[SYM].
+  const streamName = (passiveGet(holder, ABORT_STREAM_NAME) ??
+    passiveGet(signal as object, ABORT_STREAM_NAME)) as string | undefined;
+  const hookToken = (passiveGet(holder, ABORT_HOOK_TOKEN) ??
+    passiveGet(signal as object, ABORT_HOOK_TOKEN)) as string | undefined;
   if (!streamName) {
     throw new Error('AbortController/AbortSignal stream name is not set');
   }
+  const aborted = passiveGet(
+    signal as object,
+    'aborted',
+    capturedIntrinsics.abortSignalAborted
+  ) as boolean;
   return {
     streamName,
     hookToken: hookToken!,
-    aborted: signal.aborted,
-    reason: signal.aborted ? signal.reason : undefined,
+    aborted,
+    reason: aborted
+      ? passiveGet(
+          signal as object,
+          'reason',
+          capturedIntrinsics.abortSignalReason
+        )
+      : undefined,
   };
 }
 
@@ -1664,37 +1722,45 @@ export function getExternalReducers(
 export function getWorkflowReducers(
   global: Record<string, any> = globalThis
 ): Partial<Reducers> {
+  // In the workflow VM these are custom classes installed by workflow.ts,
+  // so resolve their prototypes from the passed `global` (passively, once).
+  const readableStreamPrototype = resolvePrototype(global, 'ReadableStream');
+  const writableStreamPrototype = resolvePrototype(global, 'WritableStream');
+  const abortControllerPrototype = resolvePrototype(global, 'AbortController');
+  const abortSignalPrototype = resolvePrototype(global, 'AbortSignal');
+
   return {
     ...getAllBaseReducers(global),
 
     // Readable/Writable streams from within the workflow execution environment
     // are simply "handles" that can be passed around to other steps.
     ReadableStream: (value) => {
-      if (!(value instanceof global.ReadableStream)) return false;
+      if (!isInstanceOfPrototype(value, readableStreamPrototype)) return false;
 
       // Check if this is a fake stream storing BodyInit from Request/Response constructor
-      const bodyInit = value[BODY_INIT_SYMBOL];
+      const bodyInit = passiveGet(value, BODY_INIT_SYMBOL);
       if (bodyInit !== undefined) {
         // This is a fake stream - serialize the BodyInit directly
         // devalue will handle serializing strings, Uint8Array, etc.
         return { bodyInit };
       }
 
-      const name = value[STREAM_NAME_SYMBOL];
+      const name = passiveGet(value, STREAM_NAME_SYMBOL) as string | undefined;
       if (!name) {
         throw new WorkflowRuntimeError('ReadableStream `name` is not set');
       }
       const s: SerializableSpecial['ReadableStream'] = { name };
-      const type = value[STREAM_TYPE_SYMBOL];
+      const type = passiveGet(value, STREAM_TYPE_SYMBOL) as 'bytes' | undefined;
       if (type) s.type = type;
-      const framing: ByteStreamFraming | undefined =
-        value[STREAM_FRAMING_SYMBOL];
+      const framing = passiveGet(value, STREAM_FRAMING_SYMBOL) as
+        | ByteStreamFraming
+        | undefined;
       if (framing) s.framing = framing;
       return s;
     },
     WritableStream: (value) => {
-      if (!(value instanceof global.WritableStream)) return false;
-      const name = value[STREAM_NAME_SYMBOL];
+      if (!isInstanceOfPrototype(value, writableStreamPrototype)) return false;
+      const name = passiveGet(value, STREAM_NAME_SYMBOL) as string | undefined;
       if (!name) {
         throw new WorkflowRuntimeError('WritableStream `name` is not set');
       }
@@ -1702,9 +1768,12 @@ export function getWorkflowReducers(
       // When the handle was forwarded from another run (parent → child
       // via `start()`), preserve the foreign runId so the step-side
       // reviver opens the writable against the original stream.
-      const foreignRunId = value[STREAM_SERVER_RUN_ID_SYMBOL];
+      const foreignRunId = passiveGet(value, STREAM_SERVER_RUN_ID_SYMBOL);
       if (typeof foreignRunId === 'string') s.runId = foreignRunId;
-      const foreignDeploymentId = value[STREAM_SERVER_DEPLOYMENT_ID_SYMBOL];
+      const foreignDeploymentId = passiveGet(
+        value,
+        STREAM_SERVER_DEPLOYMENT_ID_SYMBOL
+      );
       if (typeof foreignDeploymentId === 'string') {
         s.deploymentId = foreignDeploymentId;
       }
@@ -1716,26 +1785,44 @@ export function getWorkflowReducers(
     // is a plain object (not a class), so instanceof checks won't work for signals.
     // Detect instances by the presence of the ABORT_STREAM_NAME symbol instead.
     AbortController: (value) => {
-      if (!value || !value.signal) return false;
+      if (
+        value === null ||
+        (typeof value !== 'object' && typeof value !== 'function')
+      ) {
+        return false;
+      }
+      const signal = passiveGet(
+        value,
+        'signal',
+        capturedIntrinsics.abortControllerSignal
+      ) as (AbortSignal & AbortInternals) | undefined;
+      if (!signal) return false;
       const holder = value as AbortController & AbortHolder;
       const hasAbortSymbol =
-        holder[ABORT_STREAM_NAME] ?? holder.signal?.[ABORT_STREAM_NAME];
-      const isNativeAbortController =
-        global.AbortController &&
-        typeof global.AbortController === 'function' &&
-        value instanceof global.AbortController;
+        passiveGet(holder, ABORT_STREAM_NAME) ??
+        passiveGet(signal, ABORT_STREAM_NAME);
+      const isNativeAbortController = isInstanceOfPrototype(
+        value,
+        abortControllerPrototype
+      );
       if (!hasAbortSymbol && !isNativeAbortController) return false;
-      return reduceAbortBySymbol(value.signal, holder);
+      return reduceAbortBySymbol(signal, holder);
     },
     AbortSignal: (value) => {
-      const signal = value as (AbortSignal & AbortInternals) | undefined;
-      const hasAbortSymbol = signal?.[ABORT_STREAM_NAME];
-      const isNativeAbortSignal =
-        global.AbortSignal &&
-        typeof global.AbortSignal === 'function' &&
-        value instanceof global.AbortSignal;
+      if (
+        value === null ||
+        (typeof value !== 'object' && typeof value !== 'function')
+      ) {
+        return false;
+      }
+      const signal = value as AbortSignal & AbortInternals;
+      const hasAbortSymbol = passiveGet(signal, ABORT_STREAM_NAME);
+      const isNativeAbortSignal = isInstanceOfPrototype(
+        value,
+        abortSignalPrototype
+      );
       if (!hasAbortSymbol && !isNativeAbortSignal) return false;
-      return reduceAbortBySymbol(value, value as AbortHolder);
+      return reduceAbortBySymbol(signal, value as AbortHolder);
     },
   };
 }
@@ -3111,19 +3198,31 @@ export async function dehydrateStepArguments(
   key: CryptoKey | undefined,
   global: Record<string, any> = globalThis,
   v1Compat = false,
-  compression = false
+  compression = false,
+  passivityReport?: SerializationPassivityReport
 ): Promise<Uint8Array | unknown> {
+  // Reducer construction resolves prototypes off the workflow global (see
+  // resolvePrototype) before stringify activates the report, so it must run
+  // inside the report scope too — a getter or proxy planted on a global
+  // constructor is value-owned code like any other.
   if (v1Compat) {
-    const str = stringify(value, getWorkflowReducers(global));
+    const reducers = withPassivityReport(passivityReport, () =>
+      getWorkflowReducers(global)
+    );
+    const str = stringify(value, reducers, passivityReport);
     return revive(str);
   }
   try {
     const compressionStats: CompressionStats = {};
+    const extraReducers = withPassivityReport(passivityReport, () =>
+      getStreamAndRequestReducers(getWorkflowReducers(global))
+    );
     const result = await stepModule.serialize(value, key, {
       global,
-      extraReducers: getStreamAndRequestReducers(getWorkflowReducers(global)),
+      extraReducers,
       compression,
       compressionStats,
+      passivityReport,
     });
     await recordCompression(compressionStats, 'serialize');
     return result;
diff --git a/packages/core/src/serialization/byte-corpus.snapshot.json b/packages/core/src/serialization/byte-corpus.snapshot.json
new file mode 100644
index 0000000000..e0ddc38fc2
--- /dev/null
+++ b/packages/core/src/serialization/byte-corpus.snapshot.json
@@ -0,0 +1,60 @@
+{
+  "primitives": "[[1,2,3,4,5,6],null,true,false,\"text\",42,-1.5]",
+  "special numbers": "[[-3,-4,-5,-6]]",
+  "undefined": "-1",
+  "bigint": "[{\"big\":1,\"negative\":3},[\"BigInt\",2],\"42\",[\"BigInt\",4],\"-7\"]",
+  "string escapes": "[[1,2,3,4],\"\\u003Cscript>\",\"line\\nbreak\",\"tab\\there\",\"u2028\\u2028u2029\\u2029\"]",
+  "nested plain object": "[{\"a\":1,\"nested\":2},1,{\"b\":3,\"c\":6},[4,5],2,3,{\"deep\":7},\"yes\"]",
+  "null prototype object": "[[\"null\",\"x\",1],1]",
+  "sparse array": "[[1,-2,2],1,3]",
+  "very sparse array": "[[-7,100,0,1,99,2],1,2]",
+  "repeated references": "[{\"first\":1,\"second\":1},{\"shared\":2},true]",
+  "cyclic object": "[{\"name\":1,\"self\":0},\"cycle\"]",
+  "date": "[[\"Date\",1],\"2023-11-14T22:13:20.000Z\"]",
+  "invalid date": "[[\"Date\",1],\".\"]",
+  "map": "[[\"Map\",1],[2,6],[3,4],\"k\",{\"v\":5},1,[7,8],2,\"two\"]",
+  "set": "[[\"Set\",1],[2,3,4],1,\"two\",{\"three\":5},3]",
+  "nested map in set": "[[\"Set\",1],[2],[\"Map\",3],[4],[5,6],\"inner\",1]",
+  "regexp": "[[\"RegExp\",1],{\"source\":2,\"flags\":3},\"ab+c\",\"gi\"]",
+  "regexp no flags": "[[\"RegExp\",1],{\"source\":2,\"flags\":3},\"plain\",\"\"]",
+  "url": "[[\"URL\",1],\"https://example.com/path?q=1#frag\"]",
+  "url search params": "[[\"URLSearchParams\",1],\"a=1&b=2\"]",
+  "empty url search params": "[[\"URLSearchParams\",1],\".\"]",
+  "headers": "[[\"Headers\",1],[2],[3,4],\"content-type\",\"text/plain\"]",
+  "array buffer": "[[\"ArrayBuffer\",1],\"AQIDBAUGBwg=\"]",
+  "empty array buffer": "[[\"ArrayBuffer\",1],\".\"]",
+  "uint8 array": "[[\"Uint8Array\",1],\"AQID\"]",
+  "uint8 subarray": "[[\"Uint8Array\",1],\"AwQFBg==\"]",
+  "int16 array": "[[\"Int16Array\",1],\"//8CAP3/\"]",
+  "float32 array": "[[\"Float32Array\",1],\"AADAPwAAIMA=\"]",
+  "float64 array": "[[\"Float64Array\",1],\"GC1EVPshCUA=\"]",
+  "bigint64 array": "[[\"BigInt64Array\",1],\"AQAAAAAAAAD+/////////w==\"]",
+  "uint8 clamped array": "[[\"Uint8ClampedArray\",1],\"AP8=\"]",
+  "data view": "[[\"DataView\",1],[\"ArrayBuffer\",2],\"CQgH\"]",
+  "data view subview": "[[\"DataView\",1,1,undefined],[\"ArrayBuffer\",2],\"AQIDBAUGBwg=\"]",
+  "node buffer": "[[\"Uint8Array\",1],\"aGk=\"]",
+  "boxed number": "[[\"Object\",1],42]",
+  "boxed string": "[[\"Object\",1],\"boxed\"]",
+  "boxed boolean": "[[\"Object\",1],false]",
+  "boxed bigint": "[[\"Object\",1],[\"BigInt\",2],\"123\"]",
+  "plain error": "[[\"Error\",1],{\"name\":2,\"message\":3,\"stack\":4},\"Error\",\"boom\",\"Error: boom\\n    at \\u003Ccorpus>\"]",
+  "error subclasses": "[[1,5,9],[\"TypeError\",2],{\"message\":3,\"stack\":4},\"t\",\"TypeError: t\\n    at \\u003Ccorpus>\",[\"RangeError\",6],{\"message\":7,\"stack\":8},\"r\",\"RangeError: r\\n    at \\u003Ccorpus>\",[\"SyntaxError\",10],{\"message\":11,\"stack\":12},\"s\",\"SyntaxError: s\\n    at \\u003Ccorpus>\"]",
+  "error with cause chain": "[[\"Error\",1],{\"name\":2,\"message\":3,\"stack\":4,\"cause\":5},\"Error\",\"outer\",\"Error: outer\\n    at \\u003Ccorpus>\",[\"TypeError\",6],{\"message\":7,\"stack\":8},\"inner\",\"TypeError: inner\\n    at \\u003Ccorpus>\"]",
+  "error with undefined cause": "[[\"Error\",1],{\"name\":2,\"message\":3,\"stack\":4,\"cause\":-1},\"Error\",\"has undefined cause\",\"Error: has undefined cause\\n    at \\u003Ccorpus>\"]",
+  "custom named error": "[[\"Error\",1],{\"name\":2,\"message\":3,\"stack\":4},\"MyCustomError\",\"custom\",\"MyCustomError: custom\\n    at \\u003Ccorpus>\"]",
+  "fatal error": "[[\"FatalError\",1],{\"message\":2,\"stack\":3},\"fatal\",\"FatalError: fatal\\n    at \\u003Ccorpus>\"]",
+  "retryable error": "[[\"RetryableError\",1],{\"message\":2,\"stack\":3,\"retryAfter\":4},\"try again\",\"RetryableError: try again\\n    at \\u003Ccorpus>\",1700000060000]",
+  "aggregate error": "[[\"AggregateError\",1],{\"message\":2,\"stack\":3,\"errors\":4},\"many\",\"AggregateError: many\\n    at \\u003Ccorpus>\",[5],[\"Error\",6],{\"name\":7,\"message\":8,\"stack\":9},\"Error\",\"a\",\"Error: a\\n    at \\u003Ccorpus>\"]",
+  "workflow function reference": "[[\"WorkflowFunction\",1],{\"workflowId\":2},\"workflow//corpus\"]",
+  "class reference": "[[\"Class\",1],{\"classId\":2},\"corpus/Class\"]",
+  "custom serialized instance": "[[\"Instance\",1],{\"classId\":2,\"data\":3},\"corpus/Thing\",{\"label\":4},\"hi\"]",
+  "object with getter": "[{\"plain\":1,\"computed\":2},1,\"from getter\"]",
+  "proxy over plain object": "[{\"wrapped\":1,\"n\":2},true,2]",
+  "step argument envelope": "[{\"args\":1,\"closureVars\":-1,\"thisVal\":-1},[2,6],{\"userId\":3,\"when\":4},\"u_1\",[\"Date\",5],\"2023-11-14T22:13:20.000Z\",3]",
+  "throws: bare function": "Failed to serialize step arguments\n╰▶ hint: Ensure you're passing workflow serializable types. Check the serialization docs to see what's serializable: https://workflow-sdk.dev/docs/foundations/serialization",
+  "throws: symbol": "Failed to serialize step arguments\n╰▶ hint: Ensure you're passing workflow serializable types. Check the serialization docs to see what's serializable: https://workflow-sdk.dev/docs/foundations/serialization",
+  "throws: pojo with symbol keys": "Failed to serialize step arguments\n╰▶ hint: Ensure you're passing workflow serializable types. Check the serialization docs to see what's serializable: https://workflow-sdk.dev/docs/foundations/serialization",
+  "throws: class instance without serializer": "Failed to serialize step arguments\n╰▶ hint: Ensure you're passing workflow serializable types. Check the serialization docs to see what's serializable: https://workflow-sdk.dev/docs/foundations/serialization",
+  "throws: promise (sync stringify)": "Failed to serialize step arguments\n╰▶ hint: Ensure you're passing workflow serializable types. Check the serialization docs to see what's serializable: https://workflow-sdk.dev/docs/foundations/serialization",
+  "throws: proto key": "Failed to serialize step arguments\n╰▶ hint: Ensure you're passing workflow serializable types. Check the serialization docs to see what's serializable: https://workflow-sdk.dev/docs/foundations/serialization"
+}
diff --git a/packages/core/src/serialization/byte-corpus.ts b/packages/core/src/serialization/byte-corpus.ts
new file mode 100644
index 0000000000..9e4162e8b4
--- /dev/null
+++ b/packages/core/src/serialization/byte-corpus.ts
@@ -0,0 +1,233 @@
+/**
+ * Shared corpus for the serialization byte-stability test.
+ *
+ * Each entry builds a value whose serialized devalue string is pinned in
+ * `byte-corpus.snapshot.json`. The snapshot was recorded from the
+ * serialization code as it existed BEFORE the hardened stringify operations
+ * were introduced (see operations.ts), so the accompanying test proves the
+ * hardening did not change a single byte of the wire format.
+ *
+ * Regenerating the snapshot is an explicit act: it means "I intend to change
+ * the wire format". See byte-stability.test.ts for how.
+ */
+
+import { FatalError, RetryableError } from '@workflow/errors';
+import { WORKFLOW_SERIALIZE } from '@workflow/serde';
+
+/** An error with a deterministic stack, safe to pin in a snapshot. */
+function fixedError<T extends Error>(error: T, stack: string): T {
+  error.stack = stack;
+  return error;
+}
+
+export class CorpusSerializableThing {
+  static classId = 'corpus/Thing';
+  static [WORKFLOW_SERIALIZE](instance: CorpusSerializableThing) {
+    return { label: instance.label };
+  }
+  constructor(public label: string) {}
+}
+
+export function buildByteCorpus(): Array<{ name: string; value: unknown }> {
+  const shared = { shared: true };
+  const cyclic: Record<string, unknown> = { name: 'cycle' };
+  cyclic.self = cyclic;
+
+  const buffer = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]).buffer;
+
+  const causeChain = fixedError(
+    new Error('outer', {
+      cause: fixedError(
+        new TypeError('inner'),
+        'TypeError: inner\n    at <corpus>'
+      ),
+    }),
+    'Error: outer\n    at <corpus>'
+  );
+
+  const retryable = fixedError(
+    new RetryableError('try again', {
+      retryAfter: new Date(1_700_000_060_000),
+    }),
+    'RetryableError: try again\n    at <corpus>'
+  );
+
+  const aggregate = fixedError(
+    new AggregateError(
+      [fixedError(new Error('a'), 'Error: a\n    at <corpus>')],
+      'many'
+    ),
+    'AggregateError: many\n    at <corpus>'
+  );
+
+  return [
+    // ---- primitives & special numbers ----
+    { name: 'primitives', value: [null, true, false, 'text', 42, -1.5] },
+    { name: 'special numbers', value: [Number.NaN, Infinity, -Infinity, -0] },
+    { name: 'undefined', value: undefined },
+    { name: 'bigint', value: { big: 42n, negative: -7n } },
+    {
+      name: 'string escapes',
+      value: ['<script>', 'line\nbreak', 'tab\there', 'u2028\u2028u2029\u2029'],
+    },
+    // ---- plain structures ----
+    {
+      name: 'nested plain object',
+      value: { a: 1, nested: { b: [2, 3], c: { deep: 'yes' } } },
+    },
+    {
+      name: 'null prototype object',
+      value: Object.assign(Object.create(null), { x: 1 }),
+    },
+    // biome-ignore lint/suspicious/noSparseArray: sparse encoding is part of the wire format
+    { name: 'sparse array', value: [1, , 3] },
+    {
+      name: 'very sparse array',
+      value: (() => {
+        const arr: number[] = [];
+        arr[0] = 1;
+        arr[99] = 2;
+        return arr;
+      })(),
+    },
+    { name: 'repeated references', value: { first: shared, second: shared } },
+    { name: 'cyclic object', value: cyclic },
+    // ---- built-in value types ----
+    { name: 'date', value: new Date(1_700_000_000_000) },
+    { name: 'invalid date', value: new Date(Number.NaN) },
+    {
+      name: 'map',
+      value: new Map<unknown, unknown>([
+        ['k', { v: 1 }],
+        [2, 'two'],
+      ]),
+    },
+    { name: 'set', value: new Set([1, 'two', { three: 3 }]) },
+    { name: 'nested map in set', value: new Set([new Map([['inner', 1]])]) },
+    { name: 'regexp', value: /ab+c/gi },
+    { name: 'regexp no flags', value: /plain/ },
+    { name: 'url', value: new URL('https://example.com/path?q=1#frag') },
+    { name: 'url search params', value: new URLSearchParams('a=1&b=2') },
+    { name: 'empty url search params', value: new URLSearchParams() },
+    { name: 'headers', value: new Headers([['content-type', 'text/plain']]) },
+    // ---- binary ----
+    { name: 'array buffer', value: buffer },
+    { name: 'empty array buffer', value: new ArrayBuffer(0) },
+    { name: 'uint8 array', value: new Uint8Array([1, 2, 3]) },
+    { name: 'uint8 subarray', value: new Uint8Array(buffer, 2, 4) },
+    { name: 'int16 array', value: new Int16Array([-1, 2, -3]) },
+    { name: 'float32 array', value: new Float32Array([1.5, -2.5]) },
+    { name: 'float64 array', value: new Float64Array([Math.PI]) },
+    { name: 'bigint64 array', value: new BigInt64Array([1n, -2n]) },
+    { name: 'uint8 clamped array', value: new Uint8ClampedArray([0, 255]) },
+    {
+      name: 'data view',
+      value: new DataView(new Uint8Array([9, 8, 7]).buffer),
+    },
+    { name: 'data view subview', value: new DataView(buffer, 1, 4) },
+    { name: 'node buffer', value: Buffer.from([104, 105]) },
+    // ---- boxed primitives (devalue-internal handling) ----
+    { name: 'boxed number', value: new Number(42) },
+    { name: 'boxed string', value: new String('boxed') },
+    { name: 'boxed boolean', value: new Boolean(false) },
+    { name: 'boxed bigint', value: Object(123n) },
+    // ---- errors ----
+    {
+      name: 'plain error',
+      value: fixedError(new Error('boom'), 'Error: boom\n    at <corpus>'),
+    },
+    {
+      name: 'error subclasses',
+      value: [
+        fixedError(new TypeError('t'), 'TypeError: t\n    at <corpus>'),
+        fixedError(new RangeError('r'), 'RangeError: r\n    at <corpus>'),
+        fixedError(new SyntaxError('s'), 'SyntaxError: s\n    at <corpus>'),
+      ],
+    },
+    { name: 'error with cause chain', value: causeChain },
+    {
+      name: 'error with undefined cause',
+      value: fixedError(
+        new Error('has undefined cause', { cause: undefined }),
+        'Error: has undefined cause\n    at <corpus>'
+      ),
+    },
+    {
+      name: 'custom named error',
+      value: fixedError(
+        Object.assign(new Error('custom'), { name: 'MyCustomError' }),
+        'MyCustomError: custom\n    at <corpus>'
+      ),
+    },
+    {
+      name: 'fatal error',
+      value: fixedError(
+        new FatalError('fatal'),
+        'FatalError: fatal\n    at <corpus>'
+      ),
+    },
+    { name: 'retryable error', value: retryable },
+    { name: 'aggregate error', value: aggregate },
+    // ---- workflow-specific shapes ----
+    {
+      name: 'workflow function reference',
+      value: Object.assign(() => {}, { workflowId: 'workflow//corpus' }),
+    },
+    {
+      name: 'class reference',
+      value: Object.assign(function CorpusClass() {}, {
+        classId: 'corpus/Class',
+      }),
+    },
+    {
+      name: 'custom serialized instance',
+      value: new CorpusSerializableThing('hi'),
+    },
+    // ---- values that execute user code during serialization ----
+    // These serialize identically before and after the hardening; the
+    // hardening additionally *reports* them (see the taint tests).
+    {
+      name: 'object with getter',
+      value: {
+        plain: 1,
+        get computed() {
+          return 'from getter';
+        },
+      },
+    },
+    {
+      name: 'proxy over plain object',
+      value: new Proxy({ wrapped: true, n: 2 }, {}),
+    },
+    // ---- step-argument envelope shape (what suspension serializes) ----
+    {
+      name: 'step argument envelope',
+      value: {
+        args: [{ userId: 'u_1', when: new Date(1_700_000_000_000) }, 3],
+        closureVars: undefined,
+        thisVal: undefined,
+      },
+    },
+  ];
+}
+
+/**
+ * Inputs `stringify` must reject — the thrown message is part of the
+ * user-visible contract and is pinned alongside the byte corpus.
+ */
+export function buildThrowingCorpus(): Array<{ name: string; value: unknown }> {
+  return [
+    { name: 'bare function', value: () => {} },
+    { name: 'symbol', value: Symbol('nope') },
+    { name: 'pojo with symbol keys', value: { [Symbol('k')]: 1 } },
+    {
+      name: 'class instance without serializer',
+      value: new (class Widget {})(),
+    },
+    { name: 'promise (sync stringify)', value: Promise.resolve(1) },
+    {
+      name: 'proto key',
+      value: JSON.parse('{"__proto__": {"polluted": true}}'),
+    },
+  ];
+}
diff --git a/packages/core/src/serialization/byte-stability.test.ts b/packages/core/src/serialization/byte-stability.test.ts
new file mode 100644
index 0000000000..deecc741c7
--- /dev/null
+++ b/packages/core/src/serialization/byte-stability.test.ts
@@ -0,0 +1,84 @@
+/**
+ * Wire-format byte stability.
+ *
+ * Pins the exact devalue string produced for a corpus of representative
+ * values against a snapshot recorded BEFORE the hardened stringify
+ * operations existed (see operations.ts). A mismatch here means the wire
+ * format changed: payloads already stored in event logs were written by the
+ * old code, so any drift breaks replay of in-flight runs.
+ *
+ * To intentionally change the wire format, regenerate the snapshot with:
+ *
+ *   RECORD_BYTE_CORPUS=1 pnpm vitest run src/serialization/byte-stability.test.ts
+ *
+ * and justify the change in the PR description.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+import { dehydrateStepArguments } from '../serialization.js';
+import { buildByteCorpus, buildThrowingCorpus } from './byte-corpus.js';
+import { decodeFormatPrefix } from './format.js';
+import { SerializationFormat } from './types.js';
+
+const snapshotPath = fileURLToPath(
+  new URL('./byte-corpus.snapshot.json', import.meta.url)
+);
+
+const recording = process.env.RECORD_BYTE_CORPUS === '1';
+
+/**
+ * Serialize through the real workflow→step boundary path (the one the
+ * suspension handler uses), with encryption and compression off so the
+ * devalue string is recoverable from the format-prefixed payload.
+ */
+async function serializeToDevalueString(value: unknown): Promise<string> {
+  const bytes = (await dehydrateStepArguments(
+    value,
+    'wrun_byte_corpus',
+    undefined,
+    globalThis,
+    false,
+    false
+  )) as Uint8Array;
+  const { format, payload } = decodeFormatPrefix(bytes);
+  expect(format).toBe(SerializationFormat.DEVALUE_V1);
+  return new TextDecoder().decode(payload);
+}
+
+describe('serialization byte stability', () => {
+  it('produces byte-identical devalue strings for the recorded corpus', async () => {
+    const corpus = buildByteCorpus();
+    const actual: Record<string, string> = {};
+    for (const { name, value } of corpus) {
+      actual[name] = await serializeToDevalueString(value);
+    }
+
+    const throwing = buildThrowingCorpus();
+    for (const { name, value } of throwing) {
+      const message = await serializeToDevalueString(value).then(
+        () => {
+          throw new Error(`expected "${name}" to fail serialization`);
+        },
+        (error: unknown) => (error as Error).message
+      );
+      actual[`throws: ${name}`] = message;
+    }
+
+    if (recording) {
+      writeFileSync(snapshotPath, `${JSON.stringify(actual, null, 2)}\n`);
+      return;
+    }
+
+    const recorded: Record<string, string> = JSON.parse(
+      readFileSync(snapshotPath, 'utf8')
+    );
+    // Compare entry-by-entry for readable failures, then in full so added
+    // or removed corpus entries are caught too.
+    for (const [name, expected] of Object.entries(recorded)) {
+      expect(actual[name], name).toBe(expected);
+    }
+    expect(Object.keys(actual).sort()).toEqual(Object.keys(recorded).sort());
+  });
+});
diff --git a/packages/core/src/serialization/codec-devalue.ts b/packages/core/src/serialization/codec-devalue.ts
index 474aa72600..19e780de3d 100644
--- a/packages/core/src/serialization/codec-devalue.ts
+++ b/packages/core/src/serialization/codec-devalue.ts
@@ -10,8 +10,9 @@
  * typed arrays, Map, Set natively).
  */
 
-import { parse, stringify, unflatten } from 'devalue';
+import { parse, unflatten } from '../vendor/devalue/index.js';
 import type { Codec, CodecOptions, SerializationMode } from './codec.js';
+import { hardenedStringify, withPassivityReport } from './operations.js';
 import { getClassReducers, getClassRevivers } from './reducers/class.js';
 import { getCommonReducers, getCommonRevivers } from './reducers/common.js';
 import {
@@ -107,12 +108,12 @@ export const devalueCodec: Codec = {
     mode: SerializationMode,
     options?: CodecOptions
   ): Uint8Array {
-    const reducers = getReducersForMode(
-      mode,
-      options?.global,
-      options?.extraReducers
+    // Reducer construction resolves prototypes off the workflow global, so
+    // it must run inside the report scope (see dehydrateStepArguments).
+    const reducers = withPassivityReport(options?.passivityReport, () =>
+      getReducersForMode(mode, options?.global, options?.extraReducers)
     );
-    const str = stringify(value, reducers);
+    const str = hardenedStringify(value, reducers, options?.passivityReport);
     return encoder.encode(str);
   },
 
diff --git a/packages/core/src/serialization/codec.ts b/packages/core/src/serialization/codec.ts
index 1bba221770..eb0d2183f5 100644
--- a/packages/core/src/serialization/codec.ts
+++ b/packages/core/src/serialization/codec.ts
@@ -15,6 +15,7 @@
  */
 
 import type { CompressionStats } from './compression.js';
+import type { SerializationPassivityReport } from './operations.js';
 import type { FormatPrefix } from './types.js';
 
 /**
@@ -72,6 +73,16 @@ export interface CodecOptions {
    * Used by the dehydrate/hydrate wrappers to emit OTel span attributes.
    */
   compressionStats?: CompressionStats;
+
+  /**
+   * Optional sink recording whether serializing the value executed code
+   * the value's owner controls (getters, proxy traps, custom serializers).
+   * Consulted by the retained-VM suspension path — a tainted serialization
+   * means the retained VM may have diverged from what a cold replay would
+   * compute, so the session must fall back to ordinary replay. See
+   * ./operations.ts.
+   */
+  passivityReport?: SerializationPassivityReport;
 }
 
 export interface Codec {
diff --git a/packages/core/src/serialization/errors.ts b/packages/core/src/serialization/errors.ts
index 7000b49c0e..3bc93bfa51 100644
--- a/packages/core/src/serialization/errors.ts
+++ b/packages/core/src/serialization/errors.ts
@@ -11,8 +11,8 @@
  */
 
 import { RuntimeDecryptionError } from '@workflow/errors';
-import { DevalueError } from 'devalue';
 import { runtimeLogger } from '../logger.js';
+import { DevalueError } from '../vendor/devalue/index.js';
 
 /**
  * Rethrow SDK runtime errors that must not be reframed as
diff --git a/packages/core/src/serialization/operations.test.ts b/packages/core/src/serialization/operations.test.ts
new file mode 100644
index 0000000000..700df8cf79
--- /dev/null
+++ b/packages/core/src/serialization/operations.test.ts
@@ -0,0 +1,631 @@
+import { createContext, runInContext } from 'node:vm';
+import { describe, expect, it, vi } from 'vitest';
+import { dehydrateStepArguments } from '../serialization.js';
+import { stringify } from '../vendor/devalue/index.js';
+import {
+  hardenedStringify,
+  registerRealmSerializationIntrinsics,
+  type SerializationPassivityReport,
+} from './operations.js';
+import { getCommonReducers } from './reducers/common.js';
+
+function freshReport(): SerializationPassivityReport {
+  return { tainted: false, reasons: [] };
+}
+
+/** Stringify with the workflow-relevant reducers and a fresh report. */
+function run(value: unknown): {
+  output: string;
+  report: SerializationPassivityReport;
+} {
+  const report = freshReport();
+  const reducers = getCommonReducers() as Record<string, (value: any) => any>;
+  const output = hardenedStringify(value, reducers, report);
+  return { output, report };
+}
+
+describe('hardenedStringify passivity', () => {
+  describe('admitted (untainted) values', () => {
+    it.each([
+      ['primitives', [1, 'two', true, null, undefined, 3n]],
+      ['plain objects and arrays', { a: [1, { b: 2 }], c: 'x' }],
+      ['sparse array', (() => Object.assign([], { 5: 'x' }))()],
+      ['null-proto object', Object.assign(Object.create(null), { a: 1 })],
+      ['Date', new Date(1700000000000)],
+      ['invalid Date', new Date(Number.NaN)],
+      [
+        'Map',
+        new Map<unknown, unknown>([
+          ['k', 1],
+          [{ o: 1 }, [2]],
+        ]),
+      ],
+      ['Set', new Set([1, 'a', { b: 2 }])],
+      ['RegExp', /ab+c/gi],
+      ['typed arrays', new Uint8Array([1, 2, 3])],
+      ['subarray view', new Uint8Array([1, 2, 3, 4]).subarray(1, 3)],
+      ['DataView', new DataView(new ArrayBuffer(8))],
+      ['ArrayBuffer', new Uint8Array([9, 8]).buffer],
+      ['boxed primitives', [new Number(3), new String('s'), new Boolean(true)]],
+      ['Error', new Error('boom')],
+      ['TypeError with cause', new TypeError('t', { cause: 'c' })],
+      ['AggregateError', new AggregateError([new Error('a')], 'agg')],
+      ['URL', new URL('https://example.com/x?y=1')],
+      ['URLSearchParams', new URLSearchParams('a=1&b=2')],
+      ['empty URLSearchParams', new URLSearchParams()],
+      ['Headers', new Headers({ 'x-a': '1' })],
+      ['DOMException', new DOMException('msg', 'DataError')],
+      [
+        'circular reference',
+        (() => {
+          const o: any = { a: 1 };
+          o.self = o;
+          return o;
+        })(),
+      ],
+    ])('%s serialize without taint', (_name, value) => {
+      const { report } = run(value);
+      expect(report.tainted).toBe(false);
+      expect(report.reasons).toEqual([]);
+    });
+
+    it('produces the same bytes as plain devalue for well-behaved values', () => {
+      const value = {
+        n: 1,
+        s: 'str',
+        d: new Date(1700000000000),
+        m: new Map([['k', [1, 2]]]),
+        set: new Set(['a']),
+        re: /x/g,
+        u8: new Uint8Array([1, 2, 3]),
+        url: new URL('https://example.com/'),
+        err: Object.assign(new Error('e'), { stack: 'fixed' }),
+        nested: { deep: [{ deeper: true }] },
+      };
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      const report = freshReport();
+      expect(hardenedStringify(value, reducers, report)).toBe(
+        stringify(value, reducers)
+      );
+      expect(report.tainted).toBe(false);
+    });
+  });
+
+  describe('tainting values', () => {
+    it('taints on an own getter (and still reads it)', () => {
+      const value: Record<string, unknown> = {};
+      let invoked = 0;
+      Object.defineProperty(value, 'x', {
+        enumerable: true,
+        get() {
+          invoked++;
+          return 42;
+        },
+      });
+      const { output, report } = run(value);
+      expect(report.tainted).toBe(true);
+      expect(report.reasons[0]).toContain('accessor property "x"');
+      expect(invoked).toBe(1);
+      expect(output).toBe(stringify({ x: 42 }));
+    });
+
+    it('taints on a getter nested deep inside a plain structure', () => {
+      const inner: Record<string, unknown> = {};
+      Object.defineProperty(inner, 'lazy', {
+        enumerable: true,
+        get: () => 'v',
+      });
+      const { report } = run({ a: [1, { b: inner }] });
+      expect(report.tainted).toBe(true);
+    });
+
+    it('taints on a proxy', () => {
+      const { report } = run({ p: new Proxy({ a: 1 }, {}) });
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('proxy');
+    });
+
+    it('reads proxy properties through the trap, matching stock bytes', () => {
+      const proxy = new Proxy(
+        { a: 1 },
+        { get: (target, key) => (key === 'a' ? 2 : Reflect.get(target, key)) }
+      );
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      const report = freshReport();
+      const output = hardenedStringify({ p: proxy }, reducers, report);
+      expect(output).toBe(stringify({ p: proxy }, reducers));
+      expect(output).toBe(stringify({ p: { a: 2 } }, reducers));
+      expect(report.tainted).toBe(true);
+    });
+
+    it('taints a tag-spoofed Array-like whose length coerces via valueOf', () => {
+      let coerced = 0;
+      const arrayLike = {
+        [Symbol.toStringTag]: 'Array',
+        length: {
+          valueOf() {
+            coerced++;
+            return 0;
+          },
+        },
+      };
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      const report = freshReport();
+      const output = hardenedStringify(arrayLike, reducers, report);
+      expect(output).toBe(stringify(arrayLike, reducers));
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('Array tag without Array brand');
+      expect(coerced).toBeGreaterThan(0);
+    });
+
+    it('taints on an array getter element', () => {
+      const arr: unknown[] = [1];
+      Object.defineProperty(arr, 1, { enumerable: true, get: () => 2 });
+      const { report, output } = run(arr);
+      expect(report.tainted).toBe(true);
+      expect(output).toBe(stringify([1, 2]));
+    });
+
+    it('taints on a thenable probe hitting a getter', () => {
+      const value: Record<string, unknown> = { a: 1 };
+      Object.defineProperty(value, 'then', {
+        enumerable: false,
+        get: () => undefined,
+      });
+      const { report } = run(value);
+      expect(report.tainted).toBe(true);
+    });
+
+    it('taints on an error with a message getter', () => {
+      const error = new Error('base');
+      Object.defineProperty(error, 'message', { get: () => 'dynamic' });
+      const { report } = run(error);
+      expect(report.tainted).toBe(true);
+    });
+
+    it('taints on a plain-looking object with a Proxy prototype', () => {
+      // A Proxy around Object.prototype passes devalue's is_plain_object
+      // check (through its traps), so stock devalue serializes the object
+      // as plain while the traps run. The hardened objectShape must taint.
+      let trapped = 0;
+      const proto = new Proxy(Object.prototype, {
+        getPrototypeOf(target) {
+          trapped++;
+          return Object.getPrototypeOf(target);
+        },
+      });
+      const value = Object.assign(Object.create(proto), { a: 1 });
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      const report = freshReport();
+      const output = hardenedStringify({ wrapper: value }, reducers, report);
+      expect(output).toBe(stringify({ wrapper: value }, reducers));
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('proxy in prototype chain');
+      expect(trapped).toBeGreaterThan(0);
+    });
+
+    it('taints on an Error with a Proxy in its prototype chain', () => {
+      const error = new TypeError('t');
+      Object.setPrototypeOf(
+        error,
+        new Proxy(TypeError.prototype, {
+          has(target, key) {
+            return Reflect.has(target, key);
+          },
+        })
+      );
+      // Give the error own data props so reducers read it without accessors.
+      Object.defineProperties(error, {
+        name: { value: 'TypeError', enumerable: false },
+        message: { value: 't', enumerable: false },
+        stack: { value: 'fixed', enumerable: false, writable: true },
+      });
+      const { report } = run(error);
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('proxy in prototype chain');
+    });
+
+    it('taints a tag-spoofed Map-like instead of throwing, preserving stock bytes', () => {
+      const mapLike = {
+        [Symbol.toStringTag]: 'Map',
+        *[Symbol.iterator](): Generator<[unknown, unknown]> {
+          yield ['k', 1];
+        },
+      };
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      const report = freshReport();
+      const output = hardenedStringify(mapLike, reducers, report);
+      expect(output).toBe(stringify(mapLike, reducers));
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('Map tag without Map brand');
+    });
+
+    it('throws loudly on proxied Maps and Sets instead of misparsing', () => {
+      // A proxied Map/Set would serialize into devalue's native inline
+      // encoding, which the custom 'Map'/'Set' revivers mangle on parse —
+      // the pre-hardening reducers threw a brand-check TypeError here.
+      expect(() => run(new Proxy(new Map([['k', 1]]), {}))).toThrow(
+        /proxied Map/
+      );
+      expect(() => run(new Proxy(new Set([1]), {}))).toThrow(/proxied Set/);
+    });
+
+    it('taints a tag-spoofed Date-like instead of throwing, preserving stock bytes', () => {
+      const dateLike = {
+        [Symbol.toStringTag]: 'Date',
+        getDate: () => 1,
+        toISOString: () => '2024-01-01T00:00:00.000Z',
+      };
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      const report = freshReport();
+      const output = hardenedStringify(dateLike, reducers, report);
+      expect(output).toBe(stringify(dateLike, reducers));
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('Date tag without Date brand');
+    });
+
+    it('caps and dedupes taint reasons', () => {
+      const mk = (key: string) => {
+        const o: Record<string, unknown> = {};
+        Object.defineProperty(o, key, { enumerable: true, get: () => 1 });
+        return o;
+      };
+      const { report } = run([
+        mk('a'),
+        mk('a'),
+        mk('b'),
+        mk('c'),
+        mk('d'),
+        mk('e'),
+        mk('f'),
+        mk('g'),
+      ]);
+      expect(report.tainted).toBe(true);
+      expect(report.reasons.length).toBeLessThanOrEqual(5);
+      expect(new Set(report.reasons).size).toBe(report.reasons.length);
+    });
+  });
+
+  describe('report scoping', () => {
+    it('does not record anything without a report', () => {
+      const value: Record<string, unknown> = {};
+      Object.defineProperty(value, 'x', { enumerable: true, get: () => 1 });
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      // Must not throw and must serialize identically.
+      expect(hardenedStringify(value, reducers)).toBe(stringify({ x: 1 }));
+    });
+
+    it('restores the outer report after a nested stringify', () => {
+      const outer = freshReport();
+      const reducers = getCommonReducers() as Record<
+        string,
+        (value: any) => any
+      >;
+      const value: Record<string, unknown> = {};
+      Object.defineProperty(value, 'x', {
+        enumerable: true,
+        get() {
+          // Nested serialization with its own report must not leak.
+          const inner = freshReport();
+          hardenedStringify({ plain: true }, reducers, inner);
+          expect(inner.tainted).toBe(false);
+          return 1;
+        },
+      });
+      hardenedStringify(value, reducers, outer);
+      expect(outer.tainted).toBe(true);
+    });
+  });
+
+  describe('patched prototypes (host hardening)', () => {
+    it('serializes a Map without dispatching patched Map iteration', () => {
+      const entries = Map.prototype.entries;
+      let called = false;
+      // biome-ignore lint/suspicious/noGlobalAssign: intentional for the test
+      Map.prototype.entries = function (this: Map<unknown, unknown>) {
+        called = true;
+        return entries.call(this);
+      } as typeof Map.prototype.entries;
+      try {
+        const { report, output } = run(new Map([['k', 1]]));
+        expect(called).toBe(false);
+        expect(report.tainted).toBe(false);
+        expect(output).toBe(
+          stringify(new Map([['k', 1]]), getCommonReducers() as any)
+        );
+      } finally {
+        Map.prototype.entries = entries;
+      }
+    });
+
+    it('serializes a Date without dispatching a patched toISOString', () => {
+      const toISOString = Date.prototype.toISOString;
+      let called = false;
+      Date.prototype.toISOString = function (this: Date) {
+        called = true;
+        return toISOString.call(this);
+      };
+      try {
+        const { report } = run(new Date(1700000000000));
+        expect(called).toBe(false);
+        expect(report.tainted).toBe(false);
+      } finally {
+        Date.prototype.toISOString = toISOString;
+      }
+    });
+
+    it('derives URLSearchParams emptiness natively, ignoring a toString override', () => {
+      const params = new URLSearchParams();
+      let called = 0;
+      Object.defineProperty(params, 'toString', {
+        value: () => {
+          called++;
+          return 'injected=1';
+        },
+      });
+      const { output, report } = run(params);
+      // Serializes as empty (the sentinel), like the pre-hardening
+      // `size === 0` probe — without ever invoking the override.
+      expect(output).toBe(run(new URLSearchParams()).output);
+      expect(called).toBe(0);
+      expect(report.tainted).toBe(false);
+    });
+
+    it('taints and keeps dynamic bytes for nonempty URLSearchParams with overridden toString', () => {
+      const params = new URLSearchParams('a=1');
+      Object.defineProperty(params, 'toString', { value: () => 'x=y' });
+      const { output, report } = run(params);
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('URLSearchParams toString dispatch');
+      expect(output).toBe(run(new URLSearchParams('x=y')).output);
+    });
+
+    it('invokes a URLSearchParams toString conversion getter exactly once', () => {
+      // The probe that selects the native fast path must not perform reads:
+      // a stateful conversion getter has to fire exactly once, from the
+      // single `String(value)` dispatch, like it did pre-hardening.
+      const params = new URLSearchParams('a=1');
+      let reads = 0;
+      Object.defineProperty(params, 'toString', {
+        configurable: true,
+        get() {
+          reads++;
+          return () => 'x=y';
+        },
+      });
+      const { output, report } = run(params);
+      expect(reads).toBe(1);
+      expect(report.tainted).toBe(true);
+      expect(output).toBe(run(new URLSearchParams('x=y')).output);
+    });
+
+    it('serializes RegExp flags without dispatching an own flag getter', () => {
+      const value = /ab+c/gi;
+      let called = false;
+      Object.defineProperty(value, 'global', {
+        get() {
+          called = true;
+          return false; // Lie — internal-slot reads must not see this.
+        },
+      });
+      const { report, output } = run(value);
+      expect(called).toBe(false);
+      expect(report.tainted).toBe(false);
+      expect(output).toBe(
+        stringify(/ab+c/gi, getCommonReducers() as Record<string, any>)
+      );
+    });
+  });
+
+  describe('prototypes patched before module load (pristine-realm captures)', () => {
+    // Module-load captures from the host realm cannot be trusted either:
+    // application code (a polyfill, an instrumentation shim) may patch a
+    // prototype before @workflow/core is imported, and the patch would then
+    // be invoked as "passive" forever. The ECMAScript intrinsics therefore
+    // come from a freshly created VM realm — simulated here by patching
+    // first and only then importing a fresh copy of the module.
+    it('does not dispatch a Map.prototype.entries patched before import', async () => {
+      const original = Map.prototype.entries;
+      const value = () => new Map<unknown, unknown>([['k', 1]]);
+      const expected = stringify(value());
+      let called = 0;
+      Map.prototype.entries = function (this: Map<unknown, unknown>) {
+        called++;
+        return original.call(this);
+      } as typeof Map.prototype.entries;
+      try {
+        vi.resetModules();
+        const fresh = await import('./operations.js');
+        const report = freshReport();
+        expect(fresh.hardenedStringify(value(), {}, report)).toBe(expected);
+        expect(called).toBe(0);
+        expect(report.tainted).toBe(false);
+      } finally {
+        Map.prototype.entries = original;
+        vi.resetModules();
+      }
+    });
+
+    it('does not dispatch a Date.prototype.toISOString patched before import', async () => {
+      const original = Date.prototype.toISOString;
+      const expected = stringify(new Date(1700000000000));
+      let called = 0;
+      Date.prototype.toISOString = function (this: Date) {
+        called++;
+        return original.call(this);
+      };
+      try {
+        vi.resetModules();
+        const fresh = await import('./operations.js');
+        const report = freshReport();
+        expect(
+          fresh.hardenedStringify(new Date(1700000000000), {}, report)
+        ).toBe(expected);
+        expect(called).toBe(0);
+        expect(report.tainted).toBe(false);
+      } finally {
+        Date.prototype.toISOString = original;
+        vi.resetModules();
+      }
+    });
+  });
+
+  describe('error stack reads', () => {
+    it('taints when Error.prepareStackTrace was replaced', () => {
+      const original = Object.getOwnPropertyDescriptor(
+        Error,
+        'prepareStackTrace'
+      );
+      let invoked = false;
+      Error.prepareStackTrace = (_error, _trace) => {
+        invoked = true;
+        return 'formatted';
+      };
+      try {
+        // A fresh error's `stack` is still the engine's lazy accessor;
+        // reading it would execute the replaced formatter.
+        const { report } = run(new Error('lazy'));
+        expect(report.tainted).toBe(true);
+        expect(report.reasons).toContain('Error.prepareStackTrace');
+        expect(invoked).toBe(true);
+      } finally {
+        if (original) {
+          Object.defineProperty(Error, 'prepareStackTrace', original);
+        } else {
+          (Error as { prepareStackTrace?: unknown }).prepareStackTrace =
+            undefined;
+        }
+      }
+    });
+
+    it('allows a registered realm stack getter and taints an unregistered one', () => {
+      const makeRealmError = () => {
+        const context = createContext();
+        const realmGlobal = runInContext('globalThis', context) as object;
+        const error = runInContext('new Error("realm")', context) as Error;
+        return { realmGlobal, error };
+      };
+
+      const unregistered = makeRealmError();
+      {
+        const report = freshReport();
+        hardenedStringify(
+          unregistered.error,
+          getCommonReducers(
+            unregistered.realmGlobal as typeof globalThis
+          ) as Record<string, any>,
+          report
+        );
+        expect(report.tainted).toBe(true);
+        expect(report.reasons).toContain('stack accessor');
+      }
+
+      const registered = makeRealmError();
+      registerRealmSerializationIntrinsics(registered.realmGlobal);
+      {
+        const report = freshReport();
+        hardenedStringify(
+          registered.error,
+          getCommonReducers(
+            registered.realmGlobal as typeof globalThis
+          ) as Record<string, any>,
+          report
+        );
+        expect(report.tainted).toBe(false);
+      }
+    });
+
+    it('taints when a registered realm planted an inherited prepareStackTrace', () => {
+      // The engine resolves Error.prepareStackTrace with an ordinary Get on
+      // the realm's Error constructor, so a formatter inherited from the
+      // realm's Function.prototype is honored too and must read as
+      // "replaced".
+      const context = createContext();
+      const realmGlobal = runInContext('globalThis', context) as object;
+      registerRealmSerializationIntrinsics(realmGlobal);
+      const error = runInContext(
+        'Object.getPrototypeOf(Error).prepareStackTrace = () => "inherited";' +
+          'new Error("realm")',
+        context
+      ) as Error;
+      const report = freshReport();
+      hardenedStringify(
+        error,
+        getCommonReducers(realmGlobal as typeof globalThis) as Record<
+          string,
+          any
+        >,
+        report
+      );
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('Error.prepareStackTrace');
+    });
+
+    it('taints when a registered realm replaced its prepareStackTrace', () => {
+      const context = createContext();
+      const realmGlobal = runInContext('globalThis', context) as object;
+      registerRealmSerializationIntrinsics(realmGlobal);
+      const error = runInContext(
+        'Error.prepareStackTrace = () => "patched"; new Error("realm")',
+        context
+      ) as Error;
+      const report = freshReport();
+      hardenedStringify(
+        error,
+        getCommonReducers(realmGlobal as typeof globalThis) as Record<
+          string,
+          any
+        >,
+        report
+      );
+      expect(report.tainted).toBe(true);
+      expect(report.reasons).toContain('Error.prepareStackTrace');
+    });
+  });
+
+  describe('reducer construction scope', () => {
+    it('taints when reducer construction hits a getter on the workflow global', async () => {
+      const global: Record<string, any> = Object.create(globalThis);
+      let invoked = false;
+      Object.defineProperty(global, 'Request', {
+        get() {
+          invoked = true;
+          return Request;
+        },
+      });
+      const report = freshReport();
+      await dehydrateStepArguments(
+        { plain: 1 },
+        'run_test',
+        undefined,
+        global,
+        false,
+        false,
+        report
+      );
+      expect(invoked).toBe(true);
+      expect(report.tainted).toBe(true);
+    });
+  });
+});
diff --git a/packages/core/src/serialization/operations.ts b/packages/core/src/serialization/operations.ts
new file mode 100644
index 0000000000..6bc55464b5
--- /dev/null
+++ b/packages/core/src/serialization/operations.ts
@@ -0,0 +1,847 @@
+/**
+ * Hardened, side-effect-free stringify operations + passivity tainting.
+ *
+ * Serializing a value with plain devalue can execute code the value's owner
+ * controls: getters and proxy traps fire on property reads, `Object.prototype
+ * .toString` consults (possibly getter-defined) `Symbol.toStringTag`, and
+ * prototype methods like `Date.prototype.toISOString` or
+ * `Map.prototype[Symbol.iterator]` are dispatched dynamically, so a workflow
+ * that patched them would have its code run mid-serialization.
+ *
+ * That matters for retained-VM replay (see runtime/suspension-handler.ts):
+ * a retained workflow VM is only equivalent to a cold replay if serializing
+ * a suspension's step inputs did not execute workflow code — a cold replay
+ * serializes nothing, so any side effect would exist in one timeline and not
+ * the other.
+ *
+ * Two mechanisms, both wired through `hardenedStringify`:
+ *
+ * 1. **Hardening** — every introspection devalue performs goes through the
+ *    `operations` override below, built on captured intrinsics that read
+ *    internal slots (cross-realm safe, immune to prototype patching; the
+ *    ECMAScript ones come from a pristine VM realm so patches applied
+ *    before this module loaded can't hide in them). The reducers in
+ *    ./reducers/ are built the same way (`util.types` brand checks +
+ *    captured originals). For well-behaved values the serialized bytes are
+ *    identical to plain devalue — see byte-stability.test.ts.
+ *
+ * 2. **Tainting** — where behavior preservation *requires* running value-
+ *    owned code (own getters, proxy traps, custom `WORKFLOW_SERIALIZE`
+ *    methods, resource-type reducers like Request/Headers), we run it
+ *    exactly as before but record the fact in the active
+ *    `SerializationPassivityReport`. The suspension handler reads the report
+ *    and demotes the retained session to an ordinary replay, so the side
+ *    effects land in a VM that is about to be discarded — exactly like the
+ *    pre-retention runtime.
+ */
+
+import { types } from 'node:util';
+import { runInNewContext } from 'node:vm';
+import {
+  DevalueError,
+  defaultOperations,
+  stringify,
+} from '../vendor/devalue/index.js';
+
+// ---------------------------------------------------------------------------
+// Passivity taint context
+// ---------------------------------------------------------------------------
+
+/**
+ * Filled in while serializing with `hardenedStringify(value, reducers,
+ * report)`. `tainted` means the serialization executed code the serialized
+ * value's owner controls, so it must not be treated as side-effect free.
+ */
+export interface SerializationPassivityReport {
+  tainted: boolean;
+  /** Human-readable reasons, capped, for logs/telemetry. */
+  reasons: string[];
+}
+
+const MAX_TAINT_REASONS = 5;
+
+/**
+ * The active report. Module-scoped rather than threaded through devalue:
+ * `stringify` is synchronous, and `hardenedStringify` restores the previous
+ * value in `finally`, so concurrent async serializations cannot observe each
+ * other's context.
+ */
+let activeReport: SerializationPassivityReport | null = null;
+
+/** Record that value-owned code ran (or is about to run). */
+export function taintSerialization(reason: string): void {
+  if (!activeReport) return;
+  activeReport.tainted = true;
+  if (
+    activeReport.reasons.length < MAX_TAINT_REASONS &&
+    !activeReport.reasons.includes(reason)
+  ) {
+    activeReport.reasons.push(reason);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Captured intrinsics
+// ---------------------------------------------------------------------------
+// Invoking a captured member must never run code an application can replace.
+// A capture taken from the host realm can't guarantee that: code that ran
+// *before this module loaded* (a polyfill, an instrumentation shim) may
+// already have patched the prototype, and the patch would then be invoked
+// as "passive" forever. So every ECMAScript intrinsic below is captured
+// from a freshly created VM realm that no user code has ever touched. They
+// all read internal slots, so they work on values from any realm (host or
+// workflow VM) and are unaffected by prototype patching in any realm.
+//
+// Host web APIs (URL, URLSearchParams, AbortController/AbortSignal,
+// Headers, DOMException) do not exist in a bare VM realm and are
+// implemented in JavaScript inside Node (so they don't even stringify as
+// native code); there is no patch-proof source for them, and they are
+// captured from the host realm at module load. The residual trust — shared
+// with `util.types` brand checks, the statics the vendored devalue
+// dispatches internally, and an `Error.prepareStackTrace` installed before
+// this module loaded — is that code loaded before @workflow/core has not
+// patched them.
+
+/**
+ * Source realm for ECMAScript intrinsics: a fresh VM realm when available,
+ * the host realm otherwise (environments without a working `node:vm`, where
+ * behavior falls back to plain module-load captures).
+ */
+const pristine: typeof globalThis = (() => {
+  try {
+    return runInNewContext('globalThis');
+  } catch {
+    return globalThis;
+  }
+})();
+
+// Statics this module itself dispatches during passive reads, captured for
+// the same reason as the prototype members: a patched
+// `Object.getPrototypeOf` must not run inside a "passive" helper.
+const getOwnPropertyDescriptor = pristine.Object.getOwnPropertyDescriptor;
+const getPrototypeOf = pristine.Object.getPrototypeOf;
+const reflectGet = pristine.Reflect.get;
+const reflectHas = pristine.Reflect.has;
+const arrayIsArray = pristine.Array.isArray;
+const numberIsNaN = pristine.Number.isNaN;
+
+function protoGetter(prototype: object, name: string | symbol) {
+  // biome-ignore lint/style/noNonNullAssertion: intrinsic accessors always exist
+  return getOwnPropertyDescriptor(prototype, name)!.get!;
+}
+
+const DatePrototype = pristine.Date.prototype;
+const dateGetDate = DatePrototype.getDate;
+const dateGetTime = DatePrototype.getTime;
+const dateToISOString = DatePrototype.toISOString;
+
+const mapEntriesIntrinsic = pristine.Map.prototype.entries;
+const mapIteratorNext = getPrototypeOf(
+  mapEntriesIntrinsic.call(new pristine.Map())
+).next as (this: unknown) => IteratorResult<[unknown, unknown]>;
+const setValuesIntrinsic = pristine.Set.prototype.values;
+const setIteratorNext = getPrototypeOf(
+  setValuesIntrinsic.call(new pristine.Set())
+).next as (this: unknown) => IteratorResult<unknown>;
+
+const regExpSource = protoGetter(pristine.RegExp.prototype, 'source');
+// `RegExp.prototype.flags` is NOT internal-slot-only: the spec has it do
+// ordinary Gets of `global`, `ignoreCase`, … on the receiver, which would
+// dispatch own getters or patched per-flag accessors. Compose the flags
+// string from the individual per-flag getters instead — each of those reads
+// only the [[OriginalFlags]] internal slot. Order matches the spec'd
+// `flags` getter (d g i m s u v y), so output is byte-identical.
+const regExpFlagGetters: ReadonlyArray<
+  [flag: string, get: (this: unknown) => unknown]
+> = (
+  [
+    ['d', 'hasIndices'],
+    ['g', 'global'],
+    ['i', 'ignoreCase'],
+    ['m', 'multiline'],
+    ['s', 'dotAll'],
+    ['u', 'unicode'],
+    ['v', 'unicodeSets'],
+    ['y', 'sticky'],
+  ] as const
+).flatMap(([flag, name]) => {
+  const get = getOwnPropertyDescriptor(pristine.RegExp.prototype, name)?.get;
+  return get ? [[flag, get] as [string, (this: unknown) => unknown]] : [];
+});
+
+/** A RegExp's flags string read purely from internal slots. */
+export function intrinsicRegExpFlags(value: RegExp): string {
+  let flags = '';
+  for (const [flag, get] of regExpFlagGetters) {
+    if (get.call(value)) flags += flag;
+  }
+  return flags;
+}
+
+const typedArrayPrototype = getPrototypeOf(
+  pristine.Uint8Array.prototype
+) as object;
+const typedArrayBuffer = protoGetter(typedArrayPrototype, 'buffer');
+const typedArrayByteOffset = protoGetter(typedArrayPrototype, 'byteOffset');
+const typedArrayByteLength = protoGetter(typedArrayPrototype, 'byteLength');
+const typedArrayLength = protoGetter(typedArrayPrototype, 'length');
+// The %TypedArray% @@toStringTag getter returns the concrete subclass name
+// ('Uint8Array', 'Float32Array', …) from internal slots.
+const typedArrayTag = protoGetter(typedArrayPrototype, Symbol.toStringTag) as (
+  this: unknown
+) => string | undefined;
+
+const dataViewBuffer = protoGetter(pristine.DataView.prototype, 'buffer');
+const dataViewByteOffset = protoGetter(
+  pristine.DataView.prototype,
+  'byteOffset'
+);
+const dataViewByteLength = protoGetter(
+  pristine.DataView.prototype,
+  'byteLength'
+);
+
+const arrayBufferByteLength = protoGetter(
+  pristine.ArrayBuffer.prototype,
+  'byteLength'
+);
+const sharedArrayBufferByteLength =
+  typeof pristine.SharedArrayBuffer === 'function'
+    ? protoGetter(pristine.SharedArrayBuffer.prototype, 'byteLength')
+    : undefined;
+
+const numberValueOf = pristine.Number.prototype.valueOf;
+const stringValueOf = pristine.String.prototype.valueOf;
+const booleanValueOf = pristine.Boolean.prototype.valueOf;
+const bigIntValueOf = pristine.BigInt.prototype.valueOf;
+
+// URL / URLSearchParams / Headers / DOMException are host classes that the
+// workflow VM receives by reference (see vm/index.ts), so instances from
+// either realm carry the host brand and these captured members work on all
+// of them. Captured from the host realm at module load — see the
+// residual-trust note above.
+const urlHref = protoGetter(URL.prototype, 'href');
+const urlSearchParamsToString = URLSearchParams.prototype.toString;
+// Native AbortController/AbortSignal expose `signal` / `aborted` / `reason`
+// as prototype accessors. (The workflow VM's WorkflowAbortController /
+// WorkflowAbortSignal use plain data properties instead, which passiveGet
+// reads without needing an allowed getter.)
+const abortControllerSignal = protoGetter(AbortController.prototype, 'signal');
+const abortSignalAborted = protoGetter(AbortSignal.prototype, 'aborted');
+const abortSignalReason = protoGetter(AbortSignal.prototype, 'reason');
+const headersIteratorIntrinsic = Headers.prototype[Symbol.iterator];
+const headersIteratorNext = getPrototypeOf(new Headers()[Symbol.iterator]())
+  .next as (this: unknown) => IteratorResult<[string, string]>;
+const domExceptionMessage = protoGetter(DOMException.prototype, 'message');
+const domExceptionName = protoGetter(DOMException.prototype, 'name');
+
+export const capturedIntrinsics = {
+  dateGetDate,
+  dateGetTime,
+  dateToISOString,
+  arrayBufferByteLength,
+  typedArrayBuffer,
+  typedArrayByteOffset,
+  typedArrayByteLength,
+  regExpSource,
+  urlHref,
+  urlSearchParamsToString,
+  abortControllerSignal,
+  abortSignalAborted,
+  abortSignalReason,
+  domExceptionMessage,
+  domExceptionName,
+} as const;
+
+// The helpers below collect into local arrays via index assignment rather
+// than `.push`, which would dispatch a patchable Array.prototype method
+// mid-serialization.
+
+/** Materialize a Headers' entries without dispatching on the value. */
+export function intrinsicHeadersEntries(
+  headers: Headers
+): Array<[string, string]> {
+  const iterator = headersIteratorIntrinsic.call(headers);
+  const entries: Array<[string, string]> = [];
+  for (;;) {
+    const result = headersIteratorNext.call(iterator);
+    if (result.done) return entries;
+    entries[entries.length] = result.value;
+  }
+}
+
+/** Materialize a Map's entries without dispatching on the value's realm. */
+export function intrinsicMapEntries(
+  map: Map<unknown, unknown>
+): Array<[unknown, unknown]> {
+  const iterator = mapEntriesIntrinsic.call(map);
+  const entries: Array<[unknown, unknown]> = [];
+  for (;;) {
+    const result = mapIteratorNext.call(iterator);
+    if (result.done) return entries;
+    entries[entries.length] = result.value;
+  }
+}
+
+/** Materialize a Set's values without dispatching on the value's realm. */
+export function intrinsicSetValues(set: Set<unknown>): unknown[] {
+  const iterator = setValuesIntrinsic.call(set);
+  const values: unknown[] = [];
+  for (;;) {
+    const result = setIteratorNext.call(iterator);
+    if (result.done) return values;
+    values[values.length] = result.value;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Passive property access
+// ---------------------------------------------------------------------------
+
+/**
+ * Read `key` from `value` with `value[key]` semantics, but without silently
+ * executing value-owned code: data properties (own or inherited) are read
+ * from their descriptors, and accessor properties taint the report before
+ * being invoked exactly as a plain read would. Proxies taint up front —
+ * every introspection on them is a trap.
+ *
+ * `allowedGetter` marks one accessor as known-passive (a captured host
+ * intrinsic, e.g. `URL.prototype.href`'s getter): if the property resolves
+ * to exactly that getter it is invoked without tainting.
+ */
+export function passiveGet(
+  value: object,
+  key: string | symbol,
+  allowedGetter?: (this: unknown) => unknown
+): unknown {
+  let target: object | null = value;
+  if (types.isProxy(target)) {
+    taintSerialization('proxy');
+    return reflectGet(value, key);
+  }
+  while (target !== null) {
+    const descriptor = getOwnPropertyDescriptor(target, key);
+    if (descriptor !== undefined) {
+      if ('value' in descriptor) return descriptor.value;
+      if (descriptor.get === undefined) return undefined;
+      if (allowedGetter !== undefined && descriptor.get === allowedGetter) {
+        return allowedGetter.call(value);
+      }
+      taintSerialization(`accessor property "${String(key)}"`);
+      return reflectGet(value, key);
+    }
+    target = getPrototypeOf(target);
+    if (target !== null && types.isProxy(target)) {
+      taintSerialization('proxy in prototype chain');
+      return reflectGet(value, key);
+    }
+  }
+  return undefined;
+}
+
+// V8 materializes `error.stack` as an own *accessor* property whose getter
+// is a single engine-provided function shared by every error in a realm.
+// It formats the stack captured at construction time, which is passive —
+// UNLESS that realm's `Error.prepareStackTrace` is set, in which case the
+// getter calls it (arbitrary realm-owned code). So a stack read is allowed
+// untainted only when (a) the own getter is a known engine stack getter for
+// its realm and (b) that realm's `Error.prepareStackTrace` is unset at read
+// time.
+const hostErrorStackGetter = getOwnPropertyDescriptor(
+  new Error(),
+  'stack'
+)?.get;
+
+interface RealmErrorIntrinsics {
+  errorCtor: ErrorConstructor;
+  stackGetter: ((this: unknown) => unknown) | undefined;
+  /**
+   * The realm's `Error.prepareStackTrace` while pristine. Node installs its
+   * own default formatter on every realm, so "unset" is wrong to test for —
+   * what matters is whether realm code *replaced* the pristine value.
+   */
+  initialPrepareStackTrace: unknown;
+}
+
+// A pristine-realm WeakMap so lookups during serialization dispatch pristine
+// prototype methods, not patchable host ones.
+const realmErrorIntrinsics = new pristine.WeakMap() as WeakMap<
+  object,
+  RealmErrorIntrinsics
+>;
+
+/**
+ * The engine resolves `Error.prepareStackTrace` with an ordinary Get on the
+ * realm's Error constructor, so an *inherited* formatter (e.g. planted on
+ * that realm's `Function.prototype`) is honored too. Replicate the lookup
+ * passively: walk own descriptors up the constructor's prototype chain and
+ * return the first data value found. Anything that cannot be read without
+ * running realm code (an accessor, a Proxy on the chain) resolves to a
+ * fresh object, which never matches any captured baseline — the stack read
+ * then taints, which is right, since invoking the engine stack getter would
+ * run that code.
+ */
+function readPrepareStackTrace(ctor: ErrorConstructor): unknown {
+  let node: object | null = ctor;
+  while (node !== null) {
+    if (types.isProxy(node)) return { unreadable: 'proxy' };
+    const descriptor = getOwnPropertyDescriptor(node, 'prepareStackTrace');
+    if (descriptor !== undefined) {
+      if ('value' in descriptor) return descriptor.value;
+      return descriptor;
+    }
+    node = getPrototypeOf(node);
+  }
+  return undefined;
+}
+
+/**
+ * Capture a realm's engine `Error` intrinsics from its global object. MUST
+ * be called while the realm is pristine (before any realm code evaluates):
+ * it constructs `realmGlobal.Error`, so calling it later would run whatever
+ * that binding was replaced with. workflow.ts calls this right after
+ * creating the VM context. Errors from unregistered realms simply taint on
+ * stack reads — a safe fallback, never an unsafe one.
+ */
+export function registerRealmSerializationIntrinsics(
+  realmGlobal: object
+): void {
+  if (realmErrorIntrinsics.has(realmGlobal)) return;
+  const errorCtor = (realmGlobal as { Error?: ErrorConstructor }).Error;
+  if (typeof errorCtor !== 'function') return;
+  const stackGetter = getOwnPropertyDescriptor(
+    new errorCtor('probe'),
+    'stack'
+  )?.get;
+  realmErrorIntrinsics.set(realmGlobal, {
+    errorCtor,
+    stackGetter,
+    initialPrepareStackTrace: readPrepareStackTrace(errorCtor),
+  });
+}
+
+// Register the host realm at module load. Best-effort: an
+// `Error.prepareStackTrace` installed *before* this module loaded becomes
+// the pristine baseline (see the residual-trust note above) — a mismatch in
+// the other direction only ever taints, which is safe.
+registerRealmSerializationIntrinsics(globalThis);
+
+/** Whether realm code replaced the realm's pristine `prepareStackTrace`. */
+function prepareStackTraceReplaced(realm: RealmErrorIntrinsics): boolean {
+  return (
+    readPrepareStackTrace(realm.errorCtor) !== realm.initialPrepareStackTrace
+  );
+}
+
+/**
+ * Read `error.stack` passively, allowing the engine's realm-wide lazy stack
+ * getter (for the host realm and for `global`'s registered realm) without
+ * tainting — unless that realm set `Error.prepareStackTrace`, which the
+ * getter would execute.
+ */
+export function passiveErrorStackRead(
+  error: object,
+  global: object = globalThis
+): unknown {
+  const descriptor = getOwnPropertyDescriptor(error, 'stack');
+  if (descriptor !== undefined) {
+    if ('value' in descriptor) return descriptor.value;
+    if (descriptor.get === undefined) return undefined;
+    let owner: RealmErrorIntrinsics | undefined;
+    if (
+      hostErrorStackGetter !== undefined &&
+      descriptor.get === hostErrorStackGetter
+    ) {
+      owner = realmErrorIntrinsics.get(globalThis);
+    } else {
+      const realm = realmErrorIntrinsics.get(global);
+      if (
+        realm?.stackGetter !== undefined &&
+        descriptor.get === realm.stackGetter
+      ) {
+        owner = realm;
+      }
+    }
+    if (owner !== undefined && !prepareStackTraceReplaced(owner)) {
+      return descriptor.get.call(error);
+    }
+    taintSerialization(
+      owner !== undefined ? 'Error.prepareStackTrace' : 'stack accessor'
+    );
+    return reflectGet(error, 'stack');
+  }
+  return passiveGet(error, 'stack');
+}
+
+/**
+ * `value instanceof C` without dispatching `C[Symbol.hasInstance]`: walks
+ * the value's prototype chain looking for `prototype`. Matches instanceof
+ * for ordinary classes; ignores hasInstance spoofing by design.
+ *
+ * Calling `Object.getPrototypeOf` on a Proxy runs its `getPrototypeOf` trap
+ * (user code), so any Proxy encountered on the chain taints before the walk
+ * touches it. The walk still proceeds — the taint demotes retention, after
+ * which running the trap is as safe as it was pre-retention.
+ */
+export function isInstanceOfPrototype(
+  value: unknown,
+  prototype: object | undefined | null
+): boolean {
+  if (!prototype || value === null || typeof value !== 'object') return false;
+  let node: object = value;
+  for (;;) {
+    if (types.isProxy(node)) {
+      taintSerialization('proxy in prototype chain');
+    }
+    const proto: object | null = getPrototypeOf(node);
+    if (proto === null) return false;
+    if (proto === prototype) return true;
+    node = proto;
+  }
+}
+
+/**
+ * Resolved by `passivePeek` when reading the property would require running
+ * value-owned code (an accessor, or a Proxy anywhere on the chain).
+ */
+export const PEEK_BLOCKED: unique symbol = Symbol('workflow.peekBlocked');
+
+/**
+ * Resolve `key` along `value`'s prototype chain with Get semantics but
+ * without invoking *anything*: a data property resolves to its value, a
+ * missing property to undefined, and anything that would need to run code
+ * to read (accessor property, Proxy on the chain) resolves to
+ * `PEEK_BLOCKED`. Unlike `passiveGet`, this neither taints nor performs the
+ * read — callers use it to choose between a known-passive fast path and a
+ * tainted dynamic dispatch that must run exactly once.
+ */
+export function passivePeek(value: object, key: string | symbol): unknown {
+  let target: object | null = value;
+  while (target !== null) {
+    if (types.isProxy(target)) return PEEK_BLOCKED;
+    const descriptor = getOwnPropertyDescriptor(target, key);
+    if (descriptor !== undefined) {
+      return 'value' in descriptor ? descriptor.value : PEEK_BLOCKED;
+    }
+    target = getPrototypeOf(target);
+  }
+  return undefined;
+}
+
+/**
+ * `key in value` without running a Proxy `has` trap untainted: walks own
+ * descriptors up the prototype chain (same inherited-property semantics as
+ * `in`), tainting and falling back to `Reflect.has` when a Proxy appears.
+ */
+export function passiveHas(value: object, key: string | symbol): boolean {
+  let target: object | null = value;
+  if (types.isProxy(target)) {
+    taintSerialization('proxy');
+    return reflectHas(value, key);
+  }
+  while (target !== null) {
+    if (getOwnPropertyDescriptor(target, key) !== undefined) {
+      return true;
+    }
+    target = getPrototypeOf(target);
+    if (target !== null && types.isProxy(target)) {
+      taintSerialization('proxy in prototype chain');
+      return reflectHas(target, key);
+    }
+  }
+  return false;
+}
+
+// ---------------------------------------------------------------------------
+// Hardened operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Brand-based replacement for devalue's `Object.prototype.toString`-derived
+ * tag. Engine-level checks classify every built-in devalue's tag switch
+ * distinguishes; anything else falls back to a passive `Symbol.toStringTag`
+ * probe that mirrors `Object.prototype.toString` semantics (a string data
+ * property is honored; a non-string or absent tag classifies as
+ * 'Object'/'Function'; an accessor taints and is read like the original).
+ */
+function hardenedTag(value: object): string {
+  if (arrayIsArray(value)) return 'Array';
+  if (types.isDate(value)) return 'Date';
+  if (types.isMap(value)) return 'Map';
+  if (types.isSet(value)) return 'Set';
+  if (types.isRegExp(value)) return 'RegExp';
+  if (types.isTypedArray(value)) {
+    return typedArrayTag.call(value) ?? 'Object';
+  }
+  if (types.isDataView(value)) return 'DataView';
+  if (types.isArrayBuffer(value)) return 'ArrayBuffer';
+  if (types.isSharedArrayBuffer(value)) return 'SharedArrayBuffer';
+  if (types.isNumberObject(value)) return 'Number';
+  if (types.isStringObject(value)) return 'String';
+  if (types.isBooleanObject(value)) return 'Boolean';
+  if (types.isBigIntObject(value)) return 'BigInt';
+  if (types.isPromise(value)) return 'Promise';
+  const tag = passiveGet(value, Symbol.toStringTag);
+  if (typeof tag === 'string') return tag;
+  return typeof value === 'function' ? 'Function' : 'Object';
+}
+
+/**
+ * The `operations` override passed to every `stringify` call. Only the
+ * operations that could execute value-owned code (or dispatch through a
+ * patchable prototype) are replaced; structural ones (`arrayIndices`,
+ * `hasOwnIndex`, …) already use passive engine-level primitives in devalue
+ * itself. (`objectShape` is wrapped only to taint Proxy prototypes.)
+ */
+const hardenedOperations = {
+  typeOf(value: unknown): string {
+    if (value === null) return 'null';
+    const type = typeof value;
+    if (
+      (type === 'object' || type === 'function') &&
+      types.isProxy(value as object)
+    ) {
+      taintSerialization('proxy');
+    }
+    return type;
+  },
+
+  tag: hardenedTag,
+
+  isThenable(value: object): boolean {
+    return typeof passiveGet(value, 'then') === 'function';
+  },
+
+  unbox(value: object): unknown {
+    if (types.isNumberObject(value)) return numberValueOf.call(value);
+    if (types.isStringObject(value)) return stringValueOf.call(value);
+    if (types.isBooleanObject(value)) return booleanValueOf.call(value);
+    if (types.isBigIntObject(value)) return bigIntValueOf.call(value);
+    // Only reachable for a non-boxed object whose Symbol.toStringTag spoofs
+    // 'Number'/'String'/'Boolean'/'BigInt'. Preserve the default behavior
+    // (dispatch valueOf, which the value's owner controls) and taint.
+    taintSerialization('valueOf dispatch');
+    return (value as { valueOf(): unknown }).valueOf();
+  },
+
+  // The tag-dispatched operations below can be reached without the matching
+  // brand: `hardenedTag` falls back to a (data-property) Symbol.toStringTag
+  // probe, so an object *tagged* 'Map'/'Date'/… lands in the corresponding
+  // case just like it does under stock devalue's Object.prototype.toString.
+  // The captured intrinsics would throw a brand-check TypeError on such a
+  // value where stock devalue serialized it dynamically, so each operation
+  // brand-checks first and otherwise taints + preserves the stock behavior.
+
+  dateISO(value: Date): string {
+    if (types.isDate(value)) {
+      return numberIsNaN(dateGetDate.call(value))
+        ? ''
+        : dateToISOString.call(value);
+    }
+    taintSerialization('Date tag without Date brand');
+    return defaultOperations.dateISO(value);
+  },
+
+  toStringValue(value: object): string {
+    // Reachable only for URL/URLSearchParams/Temporal.* tags. Genuine URLs
+    // and URLSearchParams are claimed by reducers before devalue's tag
+    // switch, so whatever lands here stringifies through code its owner can
+    // control (a Temporal polyfill's toString, a spoofed toStringTag).
+    taintSerialization('toString dispatch');
+    return (value as { toString(): string }).toString();
+  },
+
+  regExp(value: RegExp): { source: string; flags: string } {
+    if (types.isRegExp(value)) {
+      return {
+        source: regExpSource.call(value) as string,
+        flags: intrinsicRegExpFlags(value),
+      };
+    }
+    taintSerialization('RegExp tag without RegExp brand');
+    return defaultOperations.regExp(value);
+  },
+
+  setValues(value: Set<unknown>): Iterable<unknown> {
+    if (types.isSet(value)) return intrinsicSetValues(value);
+    // A Proxy over a Set would serialize into devalue's native inline Set
+    // encoding, which the custom 'Set' reviver then mangles on parse. The
+    // pre-hardening reducers threw a brand-check TypeError here — keep the
+    // failure loud.
+    if (types.isProxy(value)) {
+      throw new DevalueError(
+        'Cannot serialize a proxied Set',
+        [],
+        value,
+        value
+      );
+    }
+    taintSerialization('Set tag without Set brand');
+    // Stock behavior: stringify iterates the value itself.
+    return defaultOperations.setValues(value);
+  },
+
+  mapEntries(value: Map<unknown, unknown>): Iterable<[unknown, unknown]> {
+    if (types.isMap(value)) return intrinsicMapEntries(value);
+    // See setValues: a proxied Map must fail loudly, not misparse.
+    if (types.isProxy(value)) {
+      throw new DevalueError(
+        'Cannot serialize a proxied Map',
+        [],
+        value,
+        value
+      );
+    }
+    taintSerialization('Map tag without Map brand');
+    return defaultOperations.mapEntries(value);
+  },
+
+  arrayLength(value: unknown[]): number {
+    if (!arrayIsArray(value)) {
+      // Tag-spoofed 'Array': the serializer loop coerces this length (which
+      // can run an object-valued length's valueOf/Symbol.toPrimitive), so
+      // taint and preserve the stock read.
+      taintSerialization('Array tag without Array brand');
+      return defaultOperations.arrayLength(value);
+    }
+    // On a genuine array `length` is an own (non-configurable) data property.
+    return passiveGet(value, 'length') as number;
+  },
+
+  arrayBuffer(value: ArrayBuffer): ArrayBuffer {
+    if (!types.isArrayBuffer(value) && !types.isSharedArrayBuffer(value)) {
+      // Tag-spoofed 'ArrayBuffer': base64 encoding coerces it through
+      // Uint8Array/Buffer, which can execute value-owned code.
+      taintSerialization('ArrayBuffer tag without ArrayBuffer brand');
+    }
+    return defaultOperations.arrayBuffer(value);
+  },
+
+  viewInfo(value: ArrayBufferView): {
+    buffer: ArrayBufferLike;
+    byteOffset: number;
+    byteLength: number;
+    length?: number;
+    bufferByteLength: number;
+  } {
+    const isDataView = types.isDataView(value);
+    if (!isDataView && !types.isTypedArray(value)) {
+      taintSerialization('view tag without view brand');
+      return defaultOperations.viewInfo(value);
+    }
+    const buffer = (
+      isDataView ? dataViewBuffer.call(value) : typedArrayBuffer.call(value)
+    ) as ArrayBufferLike;
+    const bufferByteLength = (
+      types.isSharedArrayBuffer(buffer)
+        ? // biome-ignore lint/style/noNonNullAssertion: a SharedArrayBuffer-branded value implies the intrinsic exists
+          sharedArrayBufferByteLength!.call(buffer)
+        : arrayBufferByteLength.call(buffer)
+    ) as number;
+    return {
+      buffer,
+      byteOffset: (isDataView
+        ? dataViewByteOffset.call(value)
+        : typedArrayByteOffset.call(value)) as number,
+      byteLength: (isDataView
+        ? dataViewByteLength.call(value)
+        : typedArrayByteLength.call(value)) as number,
+      // Undefined for DataViews, matching `value.length` under the default
+      // operations (the byte format encodes it as-is for subviews).
+      length: isDataView ? undefined : (typedArrayLength.call(value) as number),
+      bufferByteLength,
+    };
+  },
+
+  objectShape(value: object) {
+    // The default implementation reads the value's prototype (and the
+    // prototype's own property names) to detect plain objects. Both run
+    // traps when the *prototype* is a Proxy — the value itself already
+    // taints at typeOf — so taint that case before the default touches it.
+    // Deeper chain members are only read as values, never trapped. Skip the
+    // probe for Proxy values (already tainted): it would run their
+    // getPrototypeOf trap one extra time relative to stock devalue.
+    if (!types.isProxy(value)) {
+      const proto = getPrototypeOf(value);
+      if (proto !== null && types.isProxy(proto)) {
+        taintSerialization('proxy in prototype chain');
+      }
+    }
+    return defaultOperations.objectShape(value);
+  },
+
+  get(value: object, key: string | number): unknown {
+    if (types.isProxy(value)) {
+      // A Proxy's `get` trap may return something other than the target's
+      // descriptor value (stock devalue reads `value[key]` through the
+      // trap). Taint — typeOf already did, but `get` can also be reached
+      // through reducer-produced wrappers — and preserve the stock read.
+      taintSerialization('proxy');
+      return reflectGet(value, key);
+    }
+    // devalue only reads keys it discovered via Object.keys/Object.hasOwn.
+    // Reading own data properties from the descriptor never executes code;
+    // own accessors taint and then run exactly as a plain `value[key]` read
+    // would.
+    const descriptor = getOwnPropertyDescriptor(value, key);
+    if (descriptor !== undefined && 'value' in descriptor) {
+      return descriptor.value;
+    }
+    if (descriptor !== undefined && descriptor.get === undefined) {
+      return undefined;
+    }
+    taintSerialization(`accessor property "${String(key)}"`);
+    return reflectGet(value, key);
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Entry point
+// ---------------------------------------------------------------------------
+
+const stringifyOptions = { operations: hardenedOperations };
+
+/**
+ * `devalue.stringify` with the hardened operations, optionally recording
+ * passivity taint into `report`. Every stringify call in @workflow/core goes
+ * through here so the wire format cannot depend on the caller.
+ *
+ * NOT interchangeable with `withPassivityReport`: called without a `report`,
+ * this deliberately clears any outer report for the duration (a nested
+ * stringify of a different boundary must not taint it), while
+ * `withPassivityReport(undefined, fn)` leaves the outer report active.
+ */
+export function hardenedStringify(
+  value: unknown,
+  reducers: Record<string, (value: any) => any>,
+  report?: SerializationPassivityReport
+): string {
+  const previous = activeReport;
+  activeReport = report ?? null;
+  try {
+    return stringify(value, reducers, stringifyOptions);
+  } finally {
+    activeReport = previous;
+  }
+}
+
+/**
+ * Run `fn` with `report` active so `passiveGet`/`taintSerialization` calls
+ * outside of a `hardenedStringify` invocation still record into it. Needed
+ * around synchronous reducer *construction* (which resolves prototypes off
+ * the workflow global — see `resolvePrototype` in serialization.ts) so a
+ * getter or proxy planted on a global constructor taints the boundary.
+ */
+export function withPassivityReport<T>(
+  report: SerializationPassivityReport | undefined,
+  fn: () => T
+): T {
+  if (report === undefined) return fn();
+  const previous = activeReport;
+  activeReport = report;
+  try {
+    return fn();
+  } finally {
+    activeReport = previous;
+  }
+}
diff --git a/packages/core/src/serialization/reducers/class.ts b/packages/core/src/serialization/reducers/class.ts
index 8a22bc03b9..cf002fb6f1 100644
--- a/packages/core/src/serialization/reducers/class.ts
+++ b/packages/core/src/serialization/reducers/class.ts
@@ -8,6 +8,7 @@
 
 import { WORKFLOW_DESERIALIZE, WORKFLOW_SERIALIZE } from '@workflow/serde';
 import { getSerializationClass } from '../../class-serialization.js';
+import { passiveGet, taintSerialization } from '../operations.js';
 import type { Reducers, Revivers } from '../types.js';
 
 // ---- Reducers ----
@@ -19,25 +20,27 @@ export function getClassReducers(): Partial<Reducers> {
     // over the generic Error serialization (devalue uses first-match-wins).
     Class: (value) => {
       if (typeof value !== 'function') return false;
-      const classId = (value as any).classId;
+      const classId = passiveGet(value, 'classId');
       if (typeof classId !== 'string') return false;
       return { classId };
     },
     Instance: (value) => {
       if (value === null || typeof value !== 'object') return false;
-      const cls = value.constructor;
+      const cls = passiveGet(value, 'constructor');
       if (!cls || typeof cls !== 'function') return false;
 
-      const serialize = cls[WORKFLOW_SERIALIZE];
+      const serialize = passiveGet(cls, WORKFLOW_SERIALIZE);
       if (typeof serialize !== 'function') return false;
 
-      const classId = cls.classId;
+      const classId = passiveGet(cls, 'classId');
       if (typeof classId !== 'string') {
         throw new Error(
-          `Class "${cls.name}" with ${String(WORKFLOW_SERIALIZE)} must have a static "classId" property.`
+          `Class "${passiveGet(cls, 'name')}" with ${String(WORKFLOW_SERIALIZE)} must have a static "classId" property.`
         );
       }
 
+      // The custom serializer is user code by definition.
+      taintSerialization(`WORKFLOW_SERIALIZE for class "${classId}"`);
       const data = serialize.call(cls, value);
       return { classId, data };
     },
diff --git a/packages/core/src/serialization/reducers/common.ts b/packages/core/src/serialization/reducers/common.ts
index 6ad8b773ff..6ea13e0043 100644
--- a/packages/core/src/serialization/reducers/common.ts
+++ b/packages/core/src/serialization/reducers/common.ts
@@ -4,6 +4,15 @@
  * Handles: ArrayBuffer, BigInt, typed arrays, Date, Error, Headers, Map, Set,
  * RegExp, Request, Response, URL, URLSearchParams.
  *
+ * Reducer predicates run on every value that crosses a serialization
+ * boundary, so they (and the payload extraction for the types they claim)
+ * are written to be passive: brand checks via `util.types` (cross-realm
+ * safe, immune to `Symbol.hasInstance` spoofing) and reads via captured
+ * intrinsics / `passiveGet` (see ../operations.ts). Where matching the old
+ * behavior requires running value-owned code (own getters, patched
+ * prototype members), the read taints the active passivity report instead
+ * of being skipped.
+ *
  * Note: Uses Node.js Buffer for base64 encoding/decoding. For environments
  * without Buffer (e.g. QuickJS VM), a polyfill or alternative base64
  * implementation will be needed.
@@ -16,8 +25,23 @@ import {
   RetryableError,
   RuntimeDecryptionError,
 } from '@workflow/errors';
+import {
+  capturedIntrinsics,
+  intrinsicHeadersEntries,
+  intrinsicMapEntries,
+  intrinsicRegExpFlags,
+  intrinsicSetValues,
+  isInstanceOfPrototype,
+  passiveErrorStackRead,
+  passiveGet,
+  passiveHas,
+  passivePeek,
+  taintSerialization,
+} from '../operations.js';
 import type { Reducers, Revivers, SerializableSpecial } from '../types.js';
 
+const bigIntToString = BigInt.prototype.toString;
+
 // ---- Base64 helpers ----
 
 function arrayBufferToBase64(
@@ -33,7 +57,11 @@ function arrayBufferToBase64(
 }
 
 function viewToBase64(value: ArrayBufferView): string {
-  return arrayBufferToBase64(value.buffer, value.byteOffset, value.byteLength);
+  return arrayBufferToBase64(
+    capturedIntrinsics.typedArrayBuffer.call(value) as ArrayBufferLike,
+    capturedIntrinsics.typedArrayByteOffset.call(value) as number,
+    capturedIntrinsics.typedArrayByteLength.call(value) as number
+  );
 }
 
 function reviveArrayBuffer(
@@ -94,13 +122,16 @@ type SimpleErrorSubclassKey = {
  * errors may originate from a different VM context, and `instanceof` fails
  * across VM boundaries since each context has its own Error constructor.
  */
-function reduceErrorBase(value: unknown): BaseErrorPayload | false {
+function reduceErrorBase(
+  value: unknown,
+  global: object
+): BaseErrorPayload | false {
   if (!types.isNativeError(value)) return false;
   const reduced: BaseErrorPayload = {
-    message: value.message,
-    stack: value.stack,
+    message: passiveGet(value, 'message') as string,
+    stack: passiveErrorStackRead(value, global) as string | undefined,
   };
-  if ('cause' in value) reduced.cause = (value as { cause: unknown }).cause;
+  if (passiveHas(value, 'cause')) reduced.cause = passiveGet(value, 'cause');
   return reduced;
 }
 
@@ -124,11 +155,12 @@ function reduceErrorBase(value: unknown): BaseErrorPayload | false {
  */
 function reduceNamedErrorSubclassBase(
   subclassName: string,
-  value: unknown
+  value: unknown,
+  global: object
 ): BaseErrorPayload | false {
   if (!types.isNativeError(value)) return false;
-  if (value.name !== subclassName) return false;
-  return reduceErrorBase(value);
+  if (passiveGet(value, 'name') !== subclassName) return false;
+  return reduceErrorBase(value, global);
 }
 
 /**
@@ -138,10 +170,11 @@ function reduceNamedErrorSubclassBase(
  * fail across VM boundaries.
  */
 function makeErrorSubclassReducer<K extends SimpleErrorSubclassKey>(
-  subclassName: K
+  subclassName: K,
+  global: object
 ) {
   return (value: unknown): SerializableSpecial[K] | false => {
-    const base = reduceNamedErrorSubclassBase(subclassName, value);
+    const base = reduceNamedErrorSubclassBase(subclassName, value, global);
     if (!base) return false;
     return base as SerializableSpecial[K];
   };
@@ -174,17 +207,25 @@ export function getCommonReducers(
 ): Partial<Reducers> {
   return {
     ArrayBuffer: (value) =>
-      value instanceof global.ArrayBuffer &&
-      arrayBufferToBase64(value, 0, value.byteLength),
-    BigInt: (value) => typeof value === 'bigint' && value.toString(),
+      types.isArrayBuffer(value) &&
+      arrayBufferToBase64(
+        value,
+        0,
+        capturedIntrinsics.arrayBufferByteLength.call(value) as number
+      ),
+    BigInt: (value) => typeof value === 'bigint' && bigIntToString.call(value),
     BigInt64Array: (value) =>
-      value instanceof global.BigInt64Array && viewToBase64(value),
+      types.isBigInt64Array(value) && viewToBase64(value),
     BigUint64Array: (value) =>
-      value instanceof global.BigUint64Array && viewToBase64(value),
+      types.isBigUint64Array(value) && viewToBase64(value),
     Date: (value) => {
-      if (!(value instanceof global.Date)) return false;
-      const valid = !Number.isNaN(value.getDate());
-      return valid ? value.toISOString() : '.';
+      if (!types.isDate(value)) return false;
+      const valid = !Number.isNaN(
+        capturedIntrinsics.dateGetDate.call(value) as number
+      );
+      return valid
+        ? (capturedIntrinsics.dateToISOString.call(value) as string)
+        : '.';
     },
     // DOMException is a special case: it `instanceof Error` is true in Node,
     // but `types.isNativeError()` returns FALSE for it, so the generic Error
@@ -194,18 +235,32 @@ export function getCommonReducers(
     // for instances minted in another context).
     DOMException: (value) => {
       if (value === null || typeof value !== 'object') return false;
+      const ctor = passiveGet(value, 'constructor');
       if (
-        (value as { constructor?: { name?: string } }).constructor?.name !==
-        'DOMException'
-      )
+        (ctor === null || typeof ctor !== 'object') &&
+        typeof ctor !== 'function'
+      ) {
         return false;
-      const e = value as Error & { cause?: unknown };
+      }
+      if (passiveGet(ctor as object, 'name') !== 'DOMException') return false;
+      // message/name live as getters on DOMException.prototype; the captured
+      // host getters are allowed since the VM shares the host class.
       const reduced: SerializableSpecial['DOMException'] = {
-        message: e.message,
-        name: e.name,
-        stack: e.stack,
+        message: passiveGet(
+          value,
+          'message',
+          capturedIntrinsics.domExceptionMessage
+        ) as string,
+        name: passiveGet(
+          value,
+          'name',
+          capturedIntrinsics.domExceptionName
+        ) as string,
+        stack: passiveErrorStackRead(value, global) as string | undefined,
       };
-      if ('cause' in e) reduced.cause = e.cause;
+      if (passiveHas(value, 'cause')) {
+        reduced.cause = passiveGet(value, 'cause');
+      }
       return reduced;
     },
     // Error subclass reducers are intentionally placed before the base Error
@@ -213,37 +268,48 @@ export function getCommonReducers(
     // must be checked first so that e.g. a TypeError is serialized as "TypeError"
     // rather than falling through to the generic "Error" reducer.
     // See `makeErrorSubclassReducer` for implementation details.
-    EvalError: makeErrorSubclassReducer('EvalError'),
-    FatalError: makeErrorSubclassReducer('FatalError'),
+    EvalError: makeErrorSubclassReducer('EvalError', global),
+    FatalError: makeErrorSubclassReducer('FatalError', global),
     HookConflictError: (value) => {
-      const base = reduceNamedErrorSubclassBase('HookConflictError', value);
+      const base = reduceNamedErrorSubclassBase(
+        'HookConflictError',
+        value,
+        global
+      );
       if (!base) return false;
-      const error = value as HookConflictError;
       const reduced: SerializableSpecial['HookConflictError'] = {
         ...base,
-        token: error.token,
+        token: passiveGet(value as object, 'token') as string,
       };
-      if (error.conflictingRunId !== undefined) {
-        reduced.conflictingRunId = error.conflictingRunId;
+      const conflictingRunId = passiveGet(value as object, 'conflictingRunId');
+      if (conflictingRunId !== undefined) {
+        reduced.conflictingRunId = conflictingRunId as string;
       }
       return reduced;
     },
-    RangeError: makeErrorSubclassReducer('RangeError'),
-    ReferenceError: makeErrorSubclassReducer('ReferenceError'),
+    RangeError: makeErrorSubclassReducer('RangeError', global),
+    ReferenceError: makeErrorSubclassReducer('ReferenceError', global),
     // RetryableError carries an extra `retryAfter` Date that we serialize as
-    // a numeric epoch timestamp. The Date reducer uses `instanceof global.Date`,
-    // which fails for Dates from a different VM realm; serializing as a
-    // number sidesteps that issue.
+    // a numeric epoch timestamp (kept for wire-format compatibility).
     RetryableError: (value) => {
-      const base = reduceNamedErrorSubclassBase('RetryableError', value);
+      const base = reduceNamedErrorSubclassBase(
+        'RetryableError',
+        value,
+        global
+      );
       if (!base) return false;
-      const retryAfterRaw = (value as RetryableError).retryAfter as unknown;
+      const retryAfterRaw = passiveGet(value as object, 'retryAfter');
       let retryAfter: number;
-      if (
+      if (types.isDate(retryAfterRaw)) {
+        const t = capturedIntrinsics.dateGetTime.call(retryAfterRaw) as number;
+        retryAfter = Number.isNaN(t) ? Date.now() + 1000 : t;
+      } else if (
         retryAfterRaw &&
         typeof retryAfterRaw === 'object' &&
-        typeof (retryAfterRaw as { getTime?: unknown }).getTime === 'function'
+        typeof passiveGet(retryAfterRaw, 'getTime') === 'function'
       ) {
+        // A Date-like object with its own getTime — value-owned code.
+        taintSerialization('RetryableError.retryAfter getTime()');
         const t = (retryAfterRaw as Date).getTime();
         retryAfter = Number.isNaN(t) ? Date.now() + 1000 : t;
       } else if (
@@ -266,29 +332,36 @@ export function getCommonReducers(
     RuntimeDecryptionError: (value) => {
       const base = reduceNamedErrorSubclassBase(
         'RuntimeDecryptionError',
-        value
+        value,
+        global
       );
       if (!base) return false;
       const reduced: SerializableSpecial['RuntimeDecryptionError'] = {
         ...base,
       };
-      const context = (value as RuntimeDecryptionError).context;
+      const context = passiveGet(value as object, 'context') as
+        | RuntimeDecryptionError['context']
+        | undefined;
       if (context !== undefined) {
         reduced.context = context;
       }
       return reduced;
     },
-    SyntaxError: makeErrorSubclassReducer('SyntaxError'),
-    TypeError: makeErrorSubclassReducer('TypeError'),
-    URIError: makeErrorSubclassReducer('URIError'),
+    SyntaxError: makeErrorSubclassReducer('SyntaxError', global),
+    TypeError: makeErrorSubclassReducer('TypeError', global),
+    URIError: makeErrorSubclassReducer('URIError', global),
     // AggregateError is similar to other subclasses but also preserves the
     // `errors` array. We extend the base helper's output here.
     AggregateError: (value) => {
-      const base = reduceNamedErrorSubclassBase('AggregateError', value);
+      const base = reduceNamedErrorSubclassBase(
+        'AggregateError',
+        value,
+        global
+      );
       if (!base) return false;
       return {
         ...base,
-        errors: (value as AggregateError).errors,
+        errors: passiveGet(value as object, 'errors') as unknown[],
       } satisfies SerializableSpecial['AggregateError'];
     },
     // Base Error reducer — catch-all for any Error instance not matched by a
@@ -298,59 +371,101 @@ export function getCommonReducers(
     Error: (value) => {
       if (!types.isNativeError(value)) return false;
       const reduced: SerializableSpecial['Error'] = {
-        name: value.name,
-        message: value.message,
-        stack: value.stack,
+        name: passiveGet(value, 'name') as string,
+        message: passiveGet(value, 'message') as string,
+        stack: passiveErrorStackRead(value, global) as string | undefined,
       };
-      if ('cause' in value) reduced.cause = value.cause;
+      if (passiveHas(value, 'cause')) {
+        reduced.cause = passiveGet(value, 'cause');
+      }
       return reduced;
     },
-    Float32Array: (value) =>
-      value instanceof global.Float32Array && viewToBase64(value),
-    Float64Array: (value) =>
-      value instanceof global.Float64Array && viewToBase64(value),
-    Headers: (value) => value instanceof global.Headers && Array.from(value),
-    Int8Array: (value) =>
-      value instanceof global.Int8Array && viewToBase64(value),
-    Int16Array: (value) =>
-      value instanceof global.Int16Array && viewToBase64(value),
-    Int32Array: (value) =>
-      value instanceof global.Int32Array && viewToBase64(value),
-    Map: (value) => value instanceof global.Map && Array.from(value),
+    Float32Array: (value) => types.isFloat32Array(value) && viewToBase64(value),
+    Float64Array: (value) => types.isFloat64Array(value) && viewToBase64(value),
+    // Headers/URL/URLSearchParams are host classes shared into the workflow
+    // VM by reference (see vm/index.ts), so a prototype-chain check against
+    // the host class brands instances from either realm, and the captured
+    // host members read them without dispatching patchable prototypes.
+    Headers: (value) =>
+      isInstanceOfPrototype(value, Headers.prototype) &&
+      intrinsicHeadersEntries(value as Headers),
+    Int8Array: (value) => types.isInt8Array(value) && viewToBase64(value),
+    Int16Array: (value) => types.isInt16Array(value) && viewToBase64(value),
+    Int32Array: (value) => types.isInt32Array(value) && viewToBase64(value),
+    Map: (value) =>
+      types.isMap(value) && intrinsicMapEntries(value as Map<unknown, unknown>),
     RegExp: (value) =>
-      value instanceof global.RegExp && {
-        source: value.source,
-        flags: value.flags,
+      types.isRegExp(value) && {
+        source: capturedIntrinsics.regExpSource.call(value) as string,
+        flags: intrinsicRegExpFlags(value),
       },
     // Request and Response are intentionally NOT in common reducers.
     // They require mode-specific revivers (stream handling, etc.) and
     // including them here without matching revivers would cause them
     // to deserialize as plain objects.
-    Set: (value) => value instanceof global.Set && Array.from(value),
-    URL: (value) => value instanceof global.URL && value.href,
+    Set: (value) =>
+      types.isSet(value) && intrinsicSetValues(value as Set<unknown>),
+    URL: (value) =>
+      isInstanceOfPrototype(value, URL.prototype) &&
+      (passiveGet(
+        value as object,
+        'href',
+        capturedIntrinsics.urlHref
+      ) as string),
     WorkflowFunction: (value) => {
       // Only match function references with a workflowId property (set by
       // the SWC compiler on workflow functions). Plain { workflowId } objects
       // are NOT matched — this prevents infinite recursion since the reduced
       // form { workflowId } is a plain object, not a function.
       if (typeof value !== 'function') return false;
-      const workflowId = (value as any).workflowId;
+      const workflowId = passiveGet(value, 'workflowId');
       if (typeof workflowId !== 'string') return false;
       return { workflowId };
     },
     URLSearchParams: (value) => {
-      if (!(value instanceof global.URLSearchParams)) return false;
-      if (value.size === 0) return '.';
+      if (!isInstanceOfPrototype(value, URLSearchParams.prototype)) {
+        return false;
+      }
+      // Emptiness must come from the *native* representation: empty params
+      // serialize to the sentinel '.' without ever consulting the value's
+      // own (possibly overridden) toString — the same decision the previous
+      // `size === 0` probe made, minus the `size` getter that older Node 18
+      // releases lack.
+      let nativeString: string;
+      try {
+        nativeString = capturedIntrinsics.urlSearchParamsToString.call(
+          value
+        ) as string;
+      } catch {
+        // Prototype-chain match without the URLSearchParams brand: the
+        // captured toString brand-checks and throws where the previous code
+        // read a (likely missing) `size` and stringified dynamically. Taint
+        // and preserve that behavior.
+        taintSerialization('URLSearchParams tag without brand');
+        return passiveGet(value as object, 'size') === 0 ? '.' : String(value);
+      }
+      if (nativeString === '') return '.';
+      // Nonempty: previous behavior dispatched `String(value)` exactly once.
+      // Take the captured-native result only when a descriptor-level peek
+      // (which invokes nothing) proves the dispatch would resolve to the
+      // captured toString; otherwise taint and dispatch exactly once — a
+      // conversion *getter* must not be invoked by a probe and then again
+      // by `String(value)`.
+      if (
+        passivePeek(value as object, Symbol.toPrimitive) === undefined &&
+        passivePeek(value as object, 'toString') ===
+          capturedIntrinsics.urlSearchParamsToString
+      ) {
+        return nativeString;
+      }
+      taintSerialization('URLSearchParams toString dispatch');
       return String(value);
     },
-    Uint8Array: (value) =>
-      value instanceof global.Uint8Array && viewToBase64(value),
+    Uint8Array: (value) => types.isUint8Array(value) && viewToBase64(value),
     Uint8ClampedArray: (value) =>
-      value instanceof global.Uint8ClampedArray && viewToBase64(value),
-    Uint16Array: (value) =>
-      value instanceof global.Uint16Array && viewToBase64(value),
-    Uint32Array: (value) =>
-      value instanceof global.Uint32Array && viewToBase64(value),
+      types.isUint8ClampedArray(value) && viewToBase64(value),
+    Uint16Array: (value) => types.isUint16Array(value) && viewToBase64(value),
+    Uint32Array: (value) => types.isUint32Array(value) && viewToBase64(value),
   };
 }
 
diff --git a/packages/core/src/serialization/reducers/step-function.ts b/packages/core/src/serialization/reducers/step-function.ts
index 59a2e31ff0..8f92b74d86 100644
--- a/packages/core/src/serialization/reducers/step-function.ts
+++ b/packages/core/src/serialization/reducers/step-function.ts
@@ -18,6 +18,7 @@
  * round trip.
  */
 
+import { passiveGet, passiveHas, taintSerialization } from '../operations.js';
 import type { Reducers, Revivers } from '../types.js';
 
 // ---- Reducer ----
@@ -26,25 +27,32 @@ export function getStepFunctionReducer(): Partial<Reducers> {
   return {
     StepFunction: (value) => {
       if (typeof value !== 'function') return false;
-      const stepId = (value as any).stepId;
+      const stepId = passiveGet(value, 'stepId');
       if (typeof stepId !== 'string') return false;
 
-      const closureVarsFn = (value as any).__closureVarsFn;
-      const closureVars =
-        closureVarsFn && typeof closureVarsFn === 'function'
-          ? closureVarsFn()
-          : undefined;
+      const closureVarsFn = passiveGet(value, '__closureVarsFn');
+      let closureVars: Record<string, any> | undefined;
+      if (closureVarsFn && typeof closureVarsFn === 'function') {
+        // Compiler-generated, but it evaluates expressions in the workflow
+        // bundle's scope — treat it as user code.
+        taintSerialization('step function closure vars');
+        closureVars = closureVarsFn();
+      }
 
       // `__boundThis` / `__boundArgs` are marker properties added by the
       // step proxy's overridden `.bind` (see step.ts) to record the
-      // bound receiver and any prefilled arguments. Use `in` for
-      // `__boundThis` so we round-trip even when the bound `this` is
+      // bound receiver and any prefilled arguments. Use a presence check
+      // for `__boundThis` so we round-trip even when the bound `this` is
       // `undefined`/`null`. `__boundArgs` is only set when the user
       // actually supplied prefilled args, so a missing property means
       // "no prefilled args".
-      const hasBoundThis = '__boundThis' in (value as any);
-      const boundThis = hasBoundThis ? (value as any).__boundThis : undefined;
-      const boundArgs = (value as any).__boundArgs as unknown[] | undefined;
+      const hasBoundThis = passiveHas(value, '__boundThis');
+      const boundThis = hasBoundThis
+        ? passiveGet(value, '__boundThis')
+        : undefined;
+      const boundArgs = passiveGet(value, '__boundArgs') as
+        | unknown[]
+        | undefined;
 
       const payload: {
         stepId: string;
diff --git a/packages/core/src/serialization/serialization.test.ts b/packages/core/src/serialization/serialization.test.ts
index 5443f27d1f..5c6a708a6a 100644
--- a/packages/core/src/serialization/serialization.test.ts
+++ b/packages/core/src/serialization/serialization.test.ts
@@ -966,9 +966,9 @@ describe('devalue codec', () => {
     }
   });
 
-  it('should support deserializeLegacy', () => {
+  it('should support deserializeLegacy', async () => {
     // Simulate legacy data (devalue unflatten format)
-    const { stringify } = require('devalue');
+    const { stringify } = await import('../vendor/devalue/index.js');
     const value = { test: 'legacy' };
     const str = stringify(value);
     // biome-ignore lint/security/noGlobalEval: test
@@ -1131,9 +1131,9 @@ describe('workflow.serialize / workflow.deserialize', () => {
     expect(() => workflow.serialize(fn)).toThrow(/Failed to serialize/);
   });
 
-  it('should deserialize legacy non-binary data', () => {
+  it('should deserialize legacy non-binary data', async () => {
     // Simulate legacy format (devalue unflatten array)
-    const { stringify } = require('devalue');
+    const { stringify } = await import('../vendor/devalue/index.js');
     const value = { hello: 'world' };
     const str = stringify(value);
     // biome-ignore lint/security/noGlobalEval: test
@@ -1222,7 +1222,7 @@ describe('step.serialize / step.deserialize', () => {
   });
 
   it('should deserialize legacy non-binary data', async () => {
-    const { stringify } = require('devalue');
+    const { stringify } = await import('../vendor/devalue/index.js');
     const value = { hello: 'step' };
     const str = stringify(value);
     // biome-ignore lint/security/noGlobalEval: test
diff --git a/packages/core/src/vendor/devalue/LICENSE b/packages/core/src/vendor/devalue/LICENSE
new file mode 100644
index 0000000000..c4e49f8d71
--- /dev/null
+++ b/packages/core/src/vendor/devalue/LICENSE
@@ -0,0 +1,7 @@
+Copyright (c) 2018-19 [these people](https://github.com/rich-harris/devalue/graphs/contributors)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/packages/core/src/vendor/devalue/README.md b/packages/core/src/vendor/devalue/README.md
new file mode 100644
index 0000000000..3cca09acc1
--- /dev/null
+++ b/packages/core/src/vendor/devalue/README.md
@@ -0,0 +1,25 @@
+# Vendored devalue
+
+This is [devalue](https://github.com/sveltejs/devalue) `5.8.1` (MIT, see
+LICENSE) with the pluggable stringify `operations` interface from
+[sveltejs/devalue#172](https://github.com/sveltejs/devalue/pull/172) applied
+on top, reconciled against the 5.8.1 source (the PR is based on a newer
+tree; the merged typed-array/DataView case in `stringify.ts` was ported by
+hand to preserve 5.8.1 behavior exactly).
+
+It is vendored — rather than consumed from npm — because the `operations`
+option is what lets `serialization/operations.ts` harden serialization and
+report passivity taint for retained-VM replay. A stock devalue silently
+ignores the option, so shipping a normal npm dependency would silently
+disable the hardening for package consumers. See
+`serialization/byte-stability.test.ts` for the corpus test proving this copy
+is byte-compatible with stock devalue output for well-behaved values.
+
+Files are the upstream JS renamed to `.ts` with a leading `// @ts-nocheck`
+(they are JSDoc-typed and compile as-is), plus `declare` property
+declarations on `DevalueError` (constructor-assignment inference is a
+JS-file-only TypeScript feature). Upstream's `uneval.ts` is omitted and
+`stringifyAsync` is not re-exported — nothing in @workflow/core uses them.
+Do not edit the vendored files beyond that; apply upstream diffs instead.
+If/when upstream merges and releases the operations interface, this
+directory should be deleted in favor of the npm dependency.
diff --git a/packages/core/src/vendor/devalue/index.ts b/packages/core/src/vendor/devalue/index.ts
new file mode 100644
index 0000000000..5367d456e6
--- /dev/null
+++ b/packages/core/src/vendor/devalue/index.ts
@@ -0,0 +1,5 @@
+// @ts-nocheck
+export { parse, unflatten } from './src/parse.js';
+export { stringify } from './src/stringify.js';
+export { default_operations as defaultOperations } from './src/operations.js';
+export { DevalueError } from './src/utils.js';
diff --git a/packages/core/src/vendor/devalue/src/base64.ts b/packages/core/src/vendor/devalue/src/base64.ts
new file mode 100644
index 0000000000..6d45349d1f
--- /dev/null
+++ b/packages/core/src/vendor/devalue/src/base64.ts
@@ -0,0 +1,61 @@
+// @ts-nocheck
+/* Baseline 2025 runtimes */
+
+/**	@type {(array_buffer: ArrayBuffer) => string} */
+export function encode_native(array_buffer) {
+	return new Uint8Array(array_buffer).toBase64();
+}
+
+/**	@type {(base64: string) => ArrayBuffer} */
+export function decode_native(base64) {
+	return Uint8Array.fromBase64(base64).buffer;
+}
+
+/* Node-compatible runtimes */
+
+/** @type {(array_buffer: ArrayBuffer) => string} */
+export function encode_buffer(array_buffer) {
+	return Buffer.from(array_buffer).toString('base64');
+}
+
+/**	@type {(base64: string) => ArrayBuffer} */
+export function decode_buffer(base64) {
+	return Uint8Array.from(Buffer.from(base64, 'base64')).buffer;
+}
+
+/* Legacy runtimes */
+
+/** @type {(array_buffer: ArrayBuffer) => string} */
+export function encode_legacy(array_buffer) {
+	const array = new Uint8Array(array_buffer);
+	let binary = '';
+
+	// the maximum number of arguments to String.fromCharCode.apply
+	// should be around 0xFFFF in modern engines
+	const chunk_size = 0x8000;
+	for (let i = 0; i < array.length; i += chunk_size) {
+		const chunk = array.subarray(i, i + chunk_size);
+		binary += String.fromCharCode.apply(null, chunk);
+	}
+
+	return btoa(binary);
+}
+
+/**	@type {(base64: string) => ArrayBuffer} */
+export function decode_legacy(base64) {
+	const binary_string = atob(base64);
+	const len = binary_string.length;
+	const array = new Uint8Array(len);
+
+	for (let i = 0; i < len; i++) {
+		array[i] = binary_string.charCodeAt(i);
+	}
+
+	return array.buffer;
+}
+
+const native = typeof Uint8Array.fromBase64 === 'function';
+const buffer = typeof process === 'object' && process.versions?.node !== undefined;
+
+export const encode64 = native ? encode_native : buffer ? encode_buffer : encode_legacy;
+export const decode64 = native ? decode_native : buffer ? decode_buffer : decode_legacy;
diff --git a/packages/core/src/vendor/devalue/src/constants.ts b/packages/core/src/vendor/devalue/src/constants.ts
new file mode 100644
index 0000000000..36413c3bb6
--- /dev/null
+++ b/packages/core/src/vendor/devalue/src/constants.ts
@@ -0,0 +1,13 @@
+// @ts-nocheck
+export const UNDEFINED = -1;
+export const HOLE = -2;
+export const NAN = -3;
+export const POSITIVE_INFINITY = -4;
+export const NEGATIVE_INFINITY = -5;
+export const NEGATIVE_ZERO = -6;
+export const SPARSE = -7;
+
+// The largest valid value for a JavaScript array's `length` property,
+// and the largest valid array index (one less than the max length).
+export const MAX_ARRAY_LEN = 2 ** 32 - 1;
+export const MAX_ARRAY_INDEX = MAX_ARRAY_LEN - 1;
diff --git a/packages/core/src/vendor/devalue/src/operations.ts b/packages/core/src/vendor/devalue/src/operations.ts
new file mode 100644
index 0000000000..565e09834c
--- /dev/null
+++ b/packages/core/src/vendor/devalue/src/operations.ts
@@ -0,0 +1,83 @@
+// @ts-nocheck
+import {
+	enumerable_symbols,
+	get_type,
+	is_plain_object,
+	valid_array_indices
+} from './utils.js';
+
+/** @type {{ kind: 'not-plain' }} */
+const NOT_PLAIN = Object.freeze({ kind: 'not-plain' });
+
+/** @type {{ kind: 'symbol-keys' }} */
+const SYMBOL_KEYS = Object.freeze({ kind: 'symbol-keys' });
+
+/**
+ * The default implementations of every introspection/extraction operation
+ * `stringify` performs on the value being serialized. Each one uses native
+ * JavaScript semantics (property access, iteration, prototype methods, etc).
+ *
+ * Pass overrides via the `operations` option of `stringify`/`stringifyAsync`
+ * to customize how values are inspected — e.g. to serialize values without
+ * triggering getters, proxy traps, or patched prototype methods, or to
+ * serialize values that live in a different JavaScript runtime (a `node:vm`
+ * context, a WASM-hosted engine, a remote process) through handle objects.
+ *
+ * The object is frozen — it is shared by every `stringify` call that does
+ * not override a given operation.
+ *
+ * @type {import('./types.js').StringifyOperations}
+ */
+export const default_operations = Object.freeze({
+	identify: (value) => value,
+
+	typeOf: (value) => (value === null ? 'null' : typeof value),
+
+	primitive: (value) => value,
+
+	tag: (value) => get_type(value),
+
+	isThenable: (value) => typeof value.then === 'function',
+
+	resolveThenable: (value) => Promise.resolve(value),
+
+	unbox: (value) => value.valueOf(),
+
+	dateISO: (value) => (isNaN(value.getDate()) ? '' : value.toISOString()),
+
+	toStringValue: (value) => value.toString(),
+
+	regExp: (value) => ({ source: value.source, flags: value.flags }),
+
+	setValues: (value) => value,
+
+	mapEntries: (value) => value,
+
+	viewInfo: (value) => ({
+		buffer: value.buffer,
+		byteOffset: value.byteOffset,
+		byteLength: value.byteLength,
+		length: value.length,
+		bufferByteLength: value.buffer.byteLength
+	}),
+
+	arrayBuffer: (value) => value,
+
+	arrayLength: (value) => value.length,
+
+	hasOwnIndex: (value, index) => Object.hasOwn(value, index),
+
+	arrayIndices: (value) => valid_array_indices(value),
+
+	objectShape: (value) => {
+		if (!is_plain_object(value)) return NOT_PLAIN;
+		if (enumerable_symbols(value).length > 0) return SYMBOL_KEYS;
+
+		return {
+			kind: Object.getPrototypeOf(value) === null ? 'null-proto' : 'plain',
+			keys: Object.keys(value)
+		};
+	},
+
+	get: (value, key) => value[key]
+});
diff --git a/packages/core/src/vendor/devalue/src/parse.ts b/packages/core/src/vendor/devalue/src/parse.ts
new file mode 100644
index 0000000000..217bb249c2
--- /dev/null
+++ b/packages/core/src/vendor/devalue/src/parse.ts
@@ -0,0 +1,284 @@
+// @ts-nocheck
+import { decode64 } from './base64.js';
+import {
+	HOLE,
+	MAX_ARRAY_INDEX,
+	NAN,
+	NEGATIVE_INFINITY,
+	NEGATIVE_ZERO,
+	POSITIVE_INFINITY,
+	SPARSE,
+	UNDEFINED
+} from './constants.js';
+import { is_valid_array_index, is_valid_array_len } from './utils.js';
+
+/**
+ * Revive a value serialized with `devalue.stringify`
+ * @param {string} serialized
+ * @param {Record<string, (value: any) => any>} [revivers]
+ */
+export function parse(serialized, revivers) {
+	return unflatten(JSON.parse(serialized), revivers);
+}
+
+/**
+ * Revive a value flattened with `devalue.stringify`
+ * @param {number | any[]} parsed
+ * @param {Record<string, (value: any) => any>} [revivers]
+ */
+export function unflatten(parsed, revivers) {
+	if (typeof parsed === 'number') return hydrate(parsed, true);
+
+	if (!Array.isArray(parsed) || parsed.length === 0) {
+		throw new Error('Invalid input');
+	}
+
+	const values = /** @type {any[]} */ (parsed);
+
+	const hydrated = Array(values.length);
+
+	/**
+	 * A set of values currently being hydrated with custom revivers,
+	 * used to detect invalid cyclical dependencies
+	 * @type {Set<number> | null}
+	 */
+	let hydrating = null;
+
+	/**
+	 * @param {number} index
+	 * @returns {any}
+	 */
+	function hydrate(index, standalone = false) {
+		if (index === UNDEFINED) return undefined;
+		if (index === NAN) return NaN;
+		if (index === POSITIVE_INFINITY) return Infinity;
+		if (index === NEGATIVE_INFINITY) return -Infinity;
+		if (index === NEGATIVE_ZERO) return -0;
+
+		if (standalone || typeof index !== 'number') {
+			throw new Error(`Invalid input`);
+		}
+
+		if (index in hydrated) return hydrated[index];
+
+		const value = values[index];
+
+		if (!value || typeof value !== 'object') {
+			hydrated[index] = value;
+		} else if (Array.isArray(value)) {
+			if (typeof value[0] === 'string') {
+				const type = value[0];
+
+				const reviver = revivers && Object.hasOwn(revivers, type) ? revivers[type] : undefined;
+
+				if (reviver) {
+					let i = value[1];
+					if (typeof i !== 'number') {
+						// if it's not a number, it was serialized by a builtin reviver
+						// so we need to munge it into the format expected by a custom reviver
+						i = values.push(value[1]) - 1;
+					}
+
+					hydrating ??= new Set();
+
+					if (hydrating.has(i)) {
+						throw new Error('Invalid circular reference');
+					}
+
+					hydrating.add(i);
+					hydrated[index] = reviver(hydrate(i));
+					hydrating.delete(i);
+
+					return hydrated[index];
+				}
+
+				switch (type) {
+					case 'Date':
+						hydrated[index] = new Date(value[1]);
+						break;
+
+					case 'Set':
+						const set = new Set();
+						hydrated[index] = set;
+						for (let i = 1; i < value.length; i += 1) {
+							set.add(hydrate(value[i]));
+						}
+						break;
+
+					case 'Map':
+						const map = new Map();
+						hydrated[index] = map;
+						for (let i = 1; i < value.length; i += 2) {
+							map.set(hydrate(value[i]), hydrate(value[i + 1]));
+						}
+						break;
+
+					case 'RegExp':
+						hydrated[index] = new RegExp(value[1], value[2]);
+						break;
+
+					case 'Object': {
+						const wrapped_index = value[1];
+
+						if (
+							typeof values[wrapped_index] === 'object' &&
+							values[wrapped_index][0] !== 'BigInt'
+						) {
+							// avoid infinite recusion in case of malformed input
+							throw new Error('Invalid input');
+						}
+
+						hydrated[index] = Object(hydrate(wrapped_index));
+						break;
+					}
+
+					case 'BigInt':
+						hydrated[index] = BigInt(value[1]);
+						break;
+
+					case 'null':
+						const obj = Object.create(null);
+						hydrated[index] = obj;
+						for (let i = 1; i < value.length; i += 2) {
+							if (value[i] === '__proto__') {
+								throw new Error('Cannot parse an object with a `__proto__` property');
+							}
+
+							obj[value[i]] = hydrate(value[i + 1]);
+						}
+						break;
+
+					case 'Int8Array':
+					case 'Uint8Array':
+					case 'Uint8ClampedArray':
+					case 'Int16Array':
+					case 'Uint16Array':
+					case 'Float16Array':
+					case 'Int32Array':
+					case 'Uint32Array':
+					case 'Float32Array':
+					case 'Float64Array':
+					case 'BigInt64Array':
+					case 'BigUint64Array':
+					case 'DataView': {
+						if (values[value[1]][0] !== 'ArrayBuffer') {
+							// without this, if we receive malformed input we could
+							// end up trying to hydrate in a circle or allocate
+							// huge amounts of memory when we call `new TypedArrayConstructor(buffer)`
+							throw new Error('Invalid data');
+						}
+
+						const TypedArrayConstructor = globalThis[type];
+						const buffer = hydrate(value[1]);
+
+						hydrated[index] =
+							value[2] !== undefined
+								? new TypedArrayConstructor(buffer, value[2], value[3])
+								: new TypedArrayConstructor(buffer);
+
+						break;
+					}
+
+					case 'ArrayBuffer': {
+						const base64 = value[1];
+						if (typeof base64 !== 'string') {
+							throw new Error('Invalid ArrayBuffer encoding');
+						}
+						const arraybuffer = decode64(base64);
+						hydrated[index] = arraybuffer;
+						break;
+					}
+
+					case 'Temporal.Duration':
+					case 'Temporal.Instant':
+					case 'Temporal.PlainDate':
+					case 'Temporal.PlainTime':
+					case 'Temporal.PlainDateTime':
+					case 'Temporal.PlainMonthDay':
+					case 'Temporal.PlainYearMonth':
+					case 'Temporal.ZonedDateTime': {
+						const temporalName = type.slice(9);
+						// @ts-expect-error TS doesn't know about Temporal yet
+						hydrated[index] = Temporal[temporalName].from(value[1]);
+						break;
+					}
+
+					case 'URL': {
+						const url = new URL(value[1]);
+						hydrated[index] = url;
+						break;
+					}
+
+					case 'URLSearchParams': {
+						const url = new URLSearchParams(value[1]);
+						hydrated[index] = url;
+						break;
+					}
+
+					default:
+						throw new Error(`Unknown type ${type}`);
+				}
+			} else if (value[0] === SPARSE) {
+				// Sparse array encoding: [SPARSE, length, idx, val, idx, val, ...]
+				const len = value[1];
+
+				if (!is_valid_array_len(len)) {
+					throw new Error('Invalid input');
+				}
+
+				/** @type {any[]} */
+				const array = [];
+				hydrated[index] = array;
+
+				// Setting `array.length = len` (or equivalently calling `new Array(len)`)
+				// on an untrusted `len` is a DoS vector: V8 eagerly allocates a
+				// contiguous backing store for array lengths below ~10^8, so a
+				// small payload with a huge declared length can force arbitrary
+				// memory allocation. Touching the largest-possible index first
+				// forces V8 into dictionary-elements mode, where `length` is
+				// just a number and no contiguous allocation occurs.
+				array[MAX_ARRAY_INDEX] = undefined;
+				delete array[MAX_ARRAY_INDEX];
+
+				for (let i = 2; i < value.length; i += 2) {
+					const idx = value[i];
+
+					if (!is_valid_array_index(idx) || idx >= len) {
+						throw new Error('Invalid input');
+					}
+
+					array[idx] = hydrate(value[i + 1]);
+				}
+
+				array.length = len;
+			} else {
+				const array = new Array(value.length);
+				hydrated[index] = array;
+
+				for (let i = 0; i < value.length; i += 1) {
+					const n = value[i];
+					if (n === HOLE) continue;
+
+					array[i] = hydrate(n);
+				}
+			}
+		} else {
+			/** @type {Record<string, any>} */
+			const object = {};
+			hydrated[index] = object;
+
+			for (const key of Object.keys(value)) {
+				if (key === '__proto__') {
+					throw new Error('Cannot parse an object with a `__proto__` property');
+				}
+
+				const n = value[key];
+				object[key] = hydrate(n);
+			}
+		}
+
+		return hydrated[index];
+	}
+
+	return hydrate(0);
+}
diff --git a/packages/core/src/vendor/devalue/src/stringify.ts b/packages/core/src/vendor/devalue/src/stringify.ts
new file mode 100644
index 0000000000..35dadff5c9
--- /dev/null
+++ b/packages/core/src/vendor/devalue/src/stringify.ts
@@ -0,0 +1,429 @@
+// @ts-nocheck
+import { DevalueError, stringify_key, stringify_string } from './utils.js';
+import {
+	HOLE,
+	NAN,
+	NEGATIVE_INFINITY,
+	NEGATIVE_ZERO,
+	POSITIVE_INFINITY,
+	SPARSE,
+	UNDEFINED
+} from './constants.js';
+import { encode64 } from './base64.js';
+import { default_operations } from './operations.js';
+
+/**
+ * Turn a value into a JSON string that can be parsed with `devalue.parse`
+ * @param {any} value
+ * @param {Record<string, (value: any) => any>} [reducers]
+ * @param {import('./types.js').StringifyOptions} [options]
+ */
+export function stringify(value, reducers, options) {
+	const stringified = run(false, value, reducers, options);
+	return typeof stringified === 'string' ? stringified : `[${stringified.join(',')}]`;
+}
+
+/**
+ * Turn a value into a JSON string that can be parsed with `devalue.parse`
+ * @param {any} value
+ * @param {Record<string, (value: any) => any>} [reducers]
+ * @param {import('./types.js').StringifyOptions} [options]
+ */
+export async function stringifyAsync(value, reducers, options) {
+	const stringified = run(true, value, reducers, options);
+
+	if (typeof stringified === 'string') {
+		return stringified;
+	}
+
+	let out = '[';
+
+	for (let i = 0; i < stringified.length; i += 1) {
+		let value = stringified[i];
+
+		if (typeof value !== 'string') {
+			await value;
+			value = stringified[i];
+
+			if (i === 0 && value < 0) {
+				return `${value}`;
+			}
+		}
+
+		out += value;
+
+		if (i < stringified.length - 1) {
+			out += ',';
+		}
+	}
+
+	out += ']';
+
+	return out;
+}
+
+/**
+ * @param {boolean} async
+ * @param {any} value
+ * @param {Record<string, (value: any) => any>} [reducers]
+ * @param {import('./types.js').StringifyOptions} [options]
+ */
+function run(async, value, reducers, options) {
+	/** @type {import('./types.js').StringifyOperations} */
+	let ops = default_operations;
+
+	if (options?.operations) {
+		ops = { ...default_operations };
+
+		// treat explicitly-`undefined` members like omitted members, so that
+		// programmatically-built overrides can't clobber a default with undefined
+		for (const key of /** @type {(keyof typeof ops)[]} */ (Object.keys(options.operations))) {
+			const fn = options.operations[key];
+			if (fn !== undefined) ops[key] = /** @type {any} */ (fn);
+		}
+	}
+
+	/** @type {any[]} */
+	const stringified = [];
+
+	/** @type {Map<any, number>} */
+	const indexes = new Map();
+
+	/** @type {Array<{ key: string, fn: (value: any) => any }>} */
+	const custom = [];
+	if (reducers) {
+		for (const key of Object.getOwnPropertyNames(reducers)) {
+			custom.push({ key, fn: reducers[key] });
+		}
+	}
+
+	/** @type {string[]} */
+	const keys = [];
+
+	let p = 0;
+
+	/**
+	 * @param {any} thing
+	 * @param {number} [index]
+	 */
+	function flatten(thing, index) {
+		const type = ops.typeOf(thing);
+
+		if (type === 'undefined') return UNDEFINED;
+
+		/** @type {number | undefined} */
+		let number;
+
+		if (type === 'number') {
+			number = /** @type {number} */ (ops.primitive(thing));
+			if (Number.isNaN(number)) return NAN;
+			if (number === Infinity) return POSITIVE_INFINITY;
+			if (number === -Infinity) return NEGATIVE_INFINITY;
+			if (number === 0 && 1 / number < 0) return NEGATIVE_ZERO;
+		}
+
+		const id = ops.identify(thing);
+
+		if (indexes.has(id)) return /** @type {number} */ (indexes.get(id));
+
+		index ??= p++;
+		indexes.set(id, index);
+
+		for (const { key, fn } of custom) {
+			const value = fn(thing);
+			if (value) {
+				stringified[index] = `["${key}",${flatten(value)}]`;
+				return index;
+			}
+		}
+
+		if (type === 'function') {
+			throw new DevalueError(`Cannot stringify a function`, keys, thing, value);
+		} else if (type === 'symbol') {
+			throw new DevalueError(`Cannot stringify a Symbol primitive`, keys, thing, value);
+		}
+
+		/** @type {string | Promise<any>} */
+		let str = '';
+
+		if (type !== 'object') {
+			// 'null' | 'boolean' | 'number' | 'bigint' | 'string'
+			str = stringify_primitive(type === 'number' ? number : ops.primitive(thing));
+		} else if (ops.isThenable(thing)) {
+			if (!async) {
+				throw new DevalueError(
+					`Cannot stringify a Promise or thenable — use stringifyAsync instead`,
+					keys,
+					thing,
+					value
+				);
+			}
+
+			str = Promise.resolve(ops.resolveThenable(thing)).then((value) => {
+				const i = flatten(value, index);
+				if (i < 0) stringified[index] = i;
+			});
+		} else {
+			const tag = ops.tag(thing);
+
+			switch (tag) {
+				case 'Number':
+				case 'String':
+				case 'Boolean':
+				case 'BigInt':
+					str = `["Object",${flatten(ops.unbox(thing))}]`;
+					break;
+
+				case 'Date':
+					str = `["Date","${ops.dateISO(thing)}"]`;
+					break;
+
+				case 'URL':
+					str = `["URL",${stringify_string(ops.toStringValue(thing))}]`;
+					break;
+
+				case 'URLSearchParams':
+					str = `["URLSearchParams",${stringify_string(ops.toStringValue(thing))}]`;
+					break;
+
+				case 'RegExp':
+					const { source, flags } = ops.regExp(thing);
+					str = flags
+						? `["RegExp",${stringify_string(source)},"${flags}"]`
+						: `["RegExp",${stringify_string(source)}]`;
+					break;
+
+				case 'Array': {
+					// For dense arrays (no holes), we iterate normally.
+					// When we encounter the first hole, we call Object.keys
+					// to determine the sparseness, then decide between:
+					//   - HOLE encoding: [-2, val, -2, ...] (default)
+					//   - Sparse encoding: [-7, length, idx, val, ...] (for very sparse arrays)
+					// Only the sparse path avoids iterating every slot, which
+					// is what protects against the DoS of e.g. `arr[1000000] = 1`.
+					let mostly_dense = false;
+
+					const length = ops.arrayLength(thing);
+
+					str = '[';
+
+					for (let i = 0; i < length; i += 1) {
+						if (i > 0) str += ',';
+
+						if (ops.hasOwnIndex(thing, i)) {
+							keys.push(`[${i}]`);
+							str += flatten(ops.get(thing, i));
+							keys.pop();
+						} else if (mostly_dense) {
+							// Use dense encoding. The heuristic guarantees the
+							// array is only mildly sparse, so iterating over every
+							// slot is fine.
+							str += HOLE;
+						} else {
+							// Decide between HOLE encoding and sparse encoding.
+							//
+							// HOLE encoding: each hole is serialized as the HOLE
+							// sentinel (-2). For example, [, "a", ,] becomes
+							// [-2, 0, -2]. Each hole costs 3 chars ("-2" + comma).
+							//
+							// Sparse encoding: lists only populated indices.
+							// For example, [, "a", ,] becomes [-7, 3, 1, 0] — the
+							// -7 sentinel, the array length (3), then index-value
+							// pairs. This avoids paying per-hole, but each element
+							// costs extra chars to write its index.
+							//
+							// The values are the same size either way, so the
+							// choice comes down to structural overhead:
+							//
+							//   HOLE overhead:
+							//     3 chars per hole ("-2" + comma)
+							//     = (L - P) * 3
+							//
+							//   Sparse overhead:
+							//     "-7,"          — 3 chars (sparse sentinel + comma)
+							//     + length + "," — (d + 1) chars (array length + comma)
+							//     + per element: index + "," — (d + 1) chars
+							//     = (4 + d) + P * (d + 1)
+							//
+							// where L is the array length, P is the number of
+							// populated elements, and d is the number of digits
+							// in L (an upper bound on the digits in any index).
+							//
+							// Sparse encoding is cheaper when:
+							//   (4 + d) + P * (d + 1) < (L - P) * 3
+							const populated_keys = ops.arrayIndices(thing);
+							const population = populated_keys.length;
+							const d = String(length).length;
+
+							const hole_cost = (length - population) * 3;
+							const sparse_cost = 4 + d + population * (d + 1);
+
+							if (hole_cost > sparse_cost) {
+								str = '[' + SPARSE + ',' + length;
+								for (let j = 0; j < populated_keys.length; j++) {
+									const key = populated_keys[j];
+									keys.push(`[${key}]`);
+									str += ',' + key + ',' + flatten(ops.get(thing, key));
+									keys.pop();
+								}
+								break;
+							} else {
+								mostly_dense = true;
+								str += HOLE;
+							}
+						}
+					}
+
+					str += ']';
+
+					break;
+				}
+
+				case 'Set':
+					str = '["Set"';
+
+					for (const value of ops.setValues(thing)) {
+						str += `,${flatten(value)}`;
+					}
+
+					str += ']';
+					break;
+
+				case 'Map':
+					str = '["Map"';
+
+					for (const [key, value] of ops.mapEntries(thing)) {
+						const key_type = ops.typeOf(key);
+						const key_is_primitive =
+							key_type !== 'object' && key_type !== 'function' && key_type !== 'symbol';
+						keys.push(
+							`.get(${key_is_primitive ? stringify_primitive(ops.primitive(key)) : '...'})`
+						);
+						str += `,${flatten(key)},${flatten(value)}`;
+						keys.pop();
+					}
+
+					str += ']';
+					break;
+
+				case 'Int8Array':
+				case 'Uint8Array':
+				case 'Uint8ClampedArray':
+				case 'Int16Array':
+				case 'Uint16Array':
+				case 'Float16Array':
+				case 'Int32Array':
+				case 'Uint32Array':
+				case 'Float32Array':
+				case 'Float64Array':
+				case 'BigInt64Array':
+				case 'BigUint64Array':
+				case 'DataView': {
+					const info = ops.viewInfo(thing);
+					str = '["' + tag + '",' + flatten(info.buffer);
+
+					// handle subarrays
+					if (info.byteLength !== info.bufferByteLength) {
+						// to be used with `new TypedArray(buffer, byteOffset, length)`
+						str += `,${info.byteOffset},${info.length}`;
+					}
+
+					str += ']';
+					break;
+				}
+
+				case 'ArrayBuffer': {
+					const base64 = encode64(ops.arrayBuffer(thing));
+
+					str = `["ArrayBuffer","${base64}"]`;
+					break;
+				}
+
+				case 'Temporal.Duration':
+				case 'Temporal.Instant':
+				case 'Temporal.PlainDate':
+				case 'Temporal.PlainTime':
+				case 'Temporal.PlainDateTime':
+				case 'Temporal.PlainMonthDay':
+				case 'Temporal.PlainYearMonth':
+				case 'Temporal.ZonedDateTime':
+					str = `["${tag}",${stringify_string(ops.toStringValue(thing))}]`;
+					break;
+
+				default: {
+					const shape = ops.objectShape(thing);
+
+					if (shape.kind === 'not-plain') {
+						throw new DevalueError(`Cannot stringify arbitrary non-POJOs`, keys, thing, value);
+					}
+
+					if (shape.kind === 'symbol-keys') {
+						throw new DevalueError(`Cannot stringify POJOs with symbolic keys`, keys, thing, value);
+					}
+
+					if (shape.kind === 'null-proto') {
+						str = '["null"';
+						for (const key of shape.keys) {
+							if (key === '__proto__') {
+								throw new DevalueError(
+									`Cannot stringify objects with __proto__ keys`,
+									keys,
+									thing,
+									value
+								);
+							}
+
+							keys.push(stringify_key(key));
+							str += `,${stringify_string(key)},${flatten(ops.get(thing, key))}`;
+							keys.pop();
+						}
+						str += ']';
+					} else {
+						str = '{';
+						let started = false;
+						for (const key of shape.keys) {
+							if (key === '__proto__') {
+								throw new DevalueError(
+									`Cannot stringify objects with __proto__ keys`,
+									keys,
+									thing,
+									value
+								);
+							}
+
+							if (started) str += ',';
+							started = true;
+							keys.push(stringify_key(key));
+							str += `${stringify_string(key)}:${flatten(ops.get(thing, key))}`;
+							keys.pop();
+						}
+						str += '}';
+					}
+				}
+			}
+		}
+
+		stringified[index] = str;
+		return index;
+	}
+
+	const index = flatten(value);
+
+	// special case — value is represented as a negative index
+	if (index < 0) return `${index}`;
+
+	return stringified;
+}
+
+/**
+ * @param {any} thing
+ * @returns {string}
+ */
+function stringify_primitive(thing) {
+	const type = typeof thing;
+	if (type === 'string') return stringify_string(thing);
+	if (thing === void 0) return UNDEFINED.toString();
+	if (thing === 0 && 1 / thing < 0) return NEGATIVE_ZERO.toString();
+	if (type === 'bigint') return `["BigInt","${thing}"]`;
+	return String(thing);
+}
diff --git a/packages/core/src/vendor/devalue/src/types.d.ts b/packages/core/src/vendor/devalue/src/types.d.ts
new file mode 100644
index 0000000000..f7219ae27a
--- /dev/null
+++ b/packages/core/src/vendor/devalue/src/types.d.ts
@@ -0,0 +1,187 @@
+export type TypedArray =
+	| Int8Array
+	| Uint8Array
+	| Uint8ClampedArray
+	| Int16Array
+	| Uint16Array
+	| Float16Array
+	| Int32Array
+	| Uint32Array
+	| Float32Array
+	| Float64Array
+	| BigInt64Array
+	| BigUint64Array;
+
+/**
+ * The introspection/extraction operations `stringify` performs on the value
+ * being serialized. Every dynamic operation — property reads, prototype
+ * method calls, iteration, type classification — goes through this
+ * interface, so overriding members lets you control exactly how values are
+ * inspected.
+ *
+ * Use cases:
+ * - **Side-effect-free serialization**: replace operations that can execute
+ *   user code (getters, proxy traps, patched prototypes, `Symbol.toStringTag`
+ *   accessors) with implementations based on captured intrinsics, internal
+ *   slots, or property descriptors.
+ * - **Foreign-runtime serialization**: serialize values that live in another
+ *   JavaScript runtime (a `node:vm` context, a WASM-hosted engine, a remote
+ *   process) by implementing the operations over handle objects. The
+ *   `stringify` algorithm never touches the value directly, so "value" can
+ *   be any opaque token as long as the operations agree on what it means.
+ *
+ * All members are optional when passed to `stringify` — omitted members fall
+ * back to the defaults (native behavior, exported as `defaultOperations`).
+ */
+export interface StringifyOperations {
+	/**
+	 * Returns the key used for deduplication and cycle detection (compared
+	 * with `Map` key semantics). Two values that represent the same logical
+	 * object must return the same key. Default: the value itself.
+	 *
+	 * Override this when serializing through handles, where two distinct
+	 * handle objects may refer to the same underlying value.
+	 */
+	identify(value: any): unknown;
+
+	/**
+	 * Classifies a value. Same contract as the `typeof` operator, except
+	 * `null` must be reported as `'null'` (not `'object'`).
+	 */
+	typeOf(value: any):
+		| 'undefined'
+		| 'null'
+		| 'boolean'
+		| 'number'
+		| 'bigint'
+		| 'string'
+		| 'symbol'
+		| 'function'
+		| 'object';
+
+	/**
+	 * Extracts the host-JavaScript primitive from a value whose `typeOf` is
+	 * `'null'`, `'boolean'`, `'number'`, `'bigint'` or `'string'`.
+	 * Default: the value itself (it already is the primitive).
+	 */
+	primitive(value: any): undefined | null | boolean | number | bigint | string;
+
+	/**
+	 * Returns the brand of an object value — the strings produced by
+	 * `Object.prototype.toString` without the wrapping (`'Date'`, `'Array'`,
+	 * `'Map'`, `'Object'`, `'Temporal.Instant'`, …). This decides which
+	 * serialization strategy is used, so hardened implementations should use
+	 * engine-level brand checks rather than (spoofable, getter-invoking)
+	 * `Symbol.toStringTag` lookups.
+	 */
+	tag(value: any): string;
+
+	/** Returns true if the object value should be treated as a thenable. */
+	isThenable(value: any): boolean;
+
+	/**
+	 * Resolves a thenable to its settled value (which is then serialized).
+	 * Only called from `stringifyAsync` for values where `isThenable`
+	 * returned true.
+	 */
+	resolveThenable(value: any): Promise<any>;
+
+	/**
+	 * Extracts the inner value of a boxed primitive (`Number`, `String`,
+	 * `Boolean`, `BigInt` objects). Equivalent to `value.valueOf()`. The
+	 * result is serialized recursively, so it may be a foreign value/handle.
+	 */
+	unbox(value: any): any;
+
+	/**
+	 * Returns the ISO string for a `Date` value, or `''` for an invalid
+	 * date. Equivalent to `value.toISOString()`.
+	 */
+	dateISO(value: any): string;
+
+	/**
+	 * Returns the string form of a `URL`, `URLSearchParams` or `Temporal.*`
+	 * value. Equivalent to `value.toString()`.
+	 */
+	toStringValue(value: any): string;
+
+	/** Returns the source and flags of a `RegExp` value. */
+	regExp(value: any): { source: string; flags: string };
+
+	/**
+	 * Returns an iterable over the elements of a `Set` value. The iterable
+	 * is consumed on the host; elements may be foreign values/handles.
+	 */
+	setValues(value: any): Iterable<any>;
+
+	/**
+	 * Returns an iterable over the `[key, value]` entries of a `Map` value.
+	 * The iterable is consumed on the host; keys/values may be foreign
+	 * values/handles.
+	 */
+	mapEntries(value: any): Iterable<[any, any]>;
+
+	/**
+	 * Returns the view metadata of a typed array or `DataView` value.
+	 * `length` is only meaningful for typed arrays. `buffer` is serialized
+	 * recursively, so it may be a foreign value/handle.
+	 */
+	viewInfo(value: any): {
+		buffer: any;
+		byteOffset: number;
+		byteLength: number;
+		length?: number;
+		bufferByteLength: number;
+	};
+
+	/**
+	 * Returns a host `ArrayBuffer` with the bytes of an `ArrayBuffer` value.
+	 * Default: the value itself. Foreign-runtime implementations should copy
+	 * the bytes into a host buffer.
+	 */
+	arrayBuffer(value: any): ArrayBuffer;
+
+	/** Returns the length of an `Array` value. */
+	arrayLength(value: any): number;
+
+	/** Returns true if an `Array` value has an own element at `index`. */
+	hasOwnIndex(value: any, index: number): boolean;
+
+	/**
+	 * Returns the populated indices of a (sparse) `Array` value as strings,
+	 * in ascending order. Equivalent to `Object.keys(value)` filtered to
+	 * valid array indices.
+	 */
+	arrayIndices(value: any): string[];
+
+	/**
+	 * Classifies a plain-object candidate:
+	 * - `{ kind: 'plain' | 'null-proto', keys }` — a serializable POJO and
+	 *   its own enumerable string keys
+	 * - `{ kind: 'not-plain' }` — a non-POJO (stringify throws)
+	 * - `{ kind: 'symbol-keys' }` — a POJO with enumerable symbol keys
+	 *   (stringify throws)
+	 */
+	objectShape(
+		value: any
+	):
+		| { kind: 'plain' | 'null-proto'; keys: string[] }
+		| { kind: 'not-plain' }
+		| { kind: 'symbol-keys' };
+
+	/**
+	 * Reads a property from an `Array` or plain-object value. Equivalent to
+	 * `value[key]`. Hardened implementations can read through property
+	 * descriptors to control what happens for accessor properties.
+	 */
+	get(value: any, key: string | number): any;
+}
+
+/** Options for `stringify` and `stringifyAsync`. */
+export interface StringifyOptions {
+	/**
+	 * Overrides for the introspection/extraction operations used while
+	 * serializing. Omitted members fall back to `defaultOperations`.
+	 */
+	operations?: Partial<StringifyOperations>;
+}
diff --git a/packages/core/src/vendor/devalue/src/utils.ts b/packages/core/src/vendor/devalue/src/utils.ts
new file mode 100644
index 0000000000..e09f2e5792
--- /dev/null
+++ b/packages/core/src/vendor/devalue/src/utils.ts
@@ -0,0 +1,167 @@
+// @ts-nocheck
+import { MAX_ARRAY_INDEX, MAX_ARRAY_LEN } from './constants.js';
+
+/** @type {Record<string, string>} */
+export const escaped = {
+	'<': '\\u003C',
+	'\\': '\\\\',
+	'\b': '\\b',
+	'\f': '\\f',
+	'\n': '\\n',
+	'\r': '\\r',
+	'\t': '\\t',
+	'\u2028': '\\u2028',
+	'\u2029': '\\u2029'
+};
+
+export class DevalueError extends Error {
+	// Property declarations added for TypeScript: constructor-assignment
+	// inference only applies to JS files, and consumers read these fields.
+	declare path: string;
+	declare value: any;
+	declare root: any;
+
+	/**
+	 * @param {string} message
+	 * @param {string[]} keys
+	 * @param {any} [value] - The value that failed to be serialized
+	 * @param {any} [root] - The root value being serialized
+	 */
+	constructor(message, keys, value, root) {
+		super(message);
+		this.name = 'DevalueError';
+		this.path = keys.join('');
+		this.value = value;
+		this.root = root;
+	}
+}
+
+/** @param {any} thing */
+export function is_primitive(thing) {
+	return thing === null || (typeof thing !== 'object' && typeof thing !== 'function');
+}
+
+const object_proto_names = /* @__PURE__ */ Object.getOwnPropertyNames(Object.prototype)
+	.sort()
+	.join('\0');
+
+/** @param {any} thing */
+export function is_plain_object(thing) {
+	const proto = Object.getPrototypeOf(thing);
+
+	return (
+		proto === Object.prototype ||
+		proto === null ||
+		Object.getPrototypeOf(proto) === null ||
+		Object.getOwnPropertyNames(proto).sort().join('\0') === object_proto_names
+	);
+}
+
+/** @param {any} thing */
+export function get_type(thing) {
+	return Object.prototype.toString.call(thing).slice(8, -1);
+}
+
+/** @param {string} char */
+function get_escaped_char(char) {
+	switch (char) {
+		case '"':
+			return '\\"';
+		case '<':
+			return '\\u003C';
+		case '\\':
+			return '\\\\';
+		case '\n':
+			return '\\n';
+		case '\r':
+			return '\\r';
+		case '\t':
+			return '\\t';
+		case '\b':
+			return '\\b';
+		case '\f':
+			return '\\f';
+		case '\u2028':
+			return '\\u2028';
+		case '\u2029':
+			return '\\u2029';
+		default:
+			return char < ' ' ? `\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}` : '';
+	}
+}
+
+/** @param {string} str */
+export function stringify_string(str) {
+	let result = '';
+	let last_pos = 0;
+	const len = str.length;
+
+	for (let i = 0; i < len; i += 1) {
+		const char = str[i];
+		const replacement = get_escaped_char(char);
+		if (replacement) {
+			result += str.slice(last_pos, i) + replacement;
+			last_pos = i + 1;
+		}
+	}
+
+	return `"${last_pos === 0 ? str : result + str.slice(last_pos)}"`;
+}
+
+/** @param {Record<string | symbol, any>} object */
+export function enumerable_symbols(object) {
+	return Object.getOwnPropertySymbols(object).filter(
+		(symbol) => Object.getOwnPropertyDescriptor(object, symbol).enumerable
+	);
+}
+
+const is_identifier = /^[a-zA-Z_$][a-zA-Z_$0-9]*$/;
+
+/** @param {string} key */
+export function stringify_key(key) {
+	return is_identifier.test(key) ? '.' + key : '[' + JSON.stringify(key) + ']';
+}
+
+/** @param {number} n */
+export function is_valid_array_index(n) {
+	if (!Number.isInteger(n)) return false;
+	if (n < 0) return false;
+	if (n > MAX_ARRAY_INDEX) return false;
+	return true;
+}
+
+/** @param {number} n */
+export function is_valid_array_len(n) {
+	if (!Number.isInteger(n)) return false;
+	if (n < 0) return false;
+	if (n > MAX_ARRAY_LEN) return false;
+	return true;
+}
+
+/** @param {string} s */
+function is_valid_array_index_string(s) {
+	if (s.length === 0) return false;
+	if (s.length > 1 && s.charCodeAt(0) === 48) return false; // leading zero
+	for (let i = 0; i < s.length; i++) {
+		const c = s.charCodeAt(i);
+		if (c < 48 || c > 57) return false;
+	}
+	// by this point we know it's a string of digits, but it has to be within
+	// the range of valid array indices
+	return is_valid_array_index(+s);
+}
+
+/**
+ * Finds the populated indices of an array.
+ * @param {unknown[]} array
+ */
+export function valid_array_indices(array) {
+	const keys = Object.keys(array);
+	for (var i = keys.length - 1; i >= 0; i--) {
+		if (is_valid_array_index_string(keys[i])) {
+			break;
+		}
+	}
+	keys.length = i + 1;
+	return keys;
+}
diff --git a/packages/core/src/workflow.ts b/packages/core/src/workflow.ts
index f56580e0d0..23ec287eb3 100644
--- a/packages/core/src/workflow.ts
+++ b/packages/core/src/workflow.ts
@@ -29,6 +29,7 @@ import {
   dehydrateWorkflowReturnValue,
   hydrateWorkflowArguments,
 } from './serialization.js';
+import { registerRealmSerializationIntrinsics } from './serialization/operations.js';
 import { createUseStep } from './step.js';
 import {
   BODY_INIT_SYMBOL,
@@ -356,6 +357,12 @@ async function createWorkflowSession({
     fixedTimestamp,
   });
 
+  // Capture the realm's engine Error intrinsics while it is still pristine
+  // (before the workflow bundle evaluates) so serialization can read
+  // `error.stack` from VM-created errors passively — see
+  // registerRealmSerializationIntrinsics in serialization/operations.ts.
+  registerRealmSerializationIntrinsics(vmGlobalThis);
+
   const initialInterruption = withResolvers<never>();
   let state: WorkflowSessionState = {
     type: 'running',
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 78f6defd4d..e1e97de754 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -552,9 +552,6 @@ importers:
       debug:
         specifier: 4.4.3
         version: 4.4.3(supports-color@8.1.1)
-      devalue:
-        specifier: 5.8.1
-        version: 5.8.1
       ms:
         specifier: 2.1.3
         version: 2.1.3