@smthrs/control 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/SqlControlRuntime.js

@@ -0,0 +1,1521 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var SqlControlRuntime_exports = {};
+__export(SqlControlRuntime_exports, {
+  layer: () => layer,
+  layerWithStore: () => layerWithStore,
+  make: () => makeRuntime,
+  migrate: () => migrate
+});
+module.exports = __toCommonJS(SqlControlRuntime_exports);
+var Dialect = __toESM(require("@smthrs/database/Dialect"), 1);
+var import_DurableWriter = require("@smthrs/database/DurableWriter");
+var DurableWrites = __toESM(require("@smthrs/database/DurableWriter"), 1);
+var import_run_store = require("@smthrs/run-store");
+var import_effect = require("effect");
+var SqlClient = __toESM(require("effect/unstable/sql/SqlClient"), 1);
+var ApprovalAuthority = __toESM(require("./ApprovalAuthority.js"), 1);
+var Attribution = __toESM(require("./Cancellation.js"), 1);
+var import_ControlError = require("./ControlError.js");
+var ControlExecutor = __toESM(require("./ControlExecutor.js"), 1);
+var import_ControlRuntime = require("./ControlRuntime.js");
+var import_ControlSchema = require("./ControlSchema.js");
+var ActiveFibers = __toESM(require("./internal/activeFibers.js"), 1);
+var import_issues = require("./internal/issues.js");
+var import_planning = require("./internal/planning.js");
+var import_sqlSchemaErrors = require("./internal/sqlSchemaErrors.js");
+var Lineage = __toESM(require("./Lineage.js"), 1);
+var Migrations = __toESM(require("./Migrations.js"), 1);
+var import_SystemFlows = require("./SystemFlows.js");
+const persistence = (operation) => (cause) => new import_ControlError.PersistenceError({
+  operation,
+  message: `Control runtime failed to ${operation}`,
+  cause
+});
+const storedFailure = (location, path, reason) => new import_ControlError.PersistenceError({
+  operation: `decode ${location}`,
+  message: `Control runtime could not decode ${location}: ${(0, import_issues.cappedIssue)(path, reason)}`
+});
+const decodeStoredValue = (location, schema, value) => import_effect.Schema.decodeUnknownEffect(schema)(value).pipe(
+  import_effect.Effect.mapError(
+    (error) => storedFailure(location, (0, import_issues.schemaIssuePath)(error), "stored value does not match its schema")
+  )
+);
+const decodeStoredJson = (location, schema, json) => import_effect.Effect.try({
+  try: () => JSON.parse(json),
+  catch: () => storedFailure(location, "$", "stored value is not valid JSON")
+}).pipe(import_effect.Effect.flatMap((value) => decodeStoredValue(location, schema, value)));
+const withLauncher = (summary, launcher) => launcher === void 0 ? summary : { ...summary, launchedBy: { id: launcher.id, kind: launcher.kind } };
+const signalPrincipal = (json) => json === null ? import_effect.Effect.succeed({}) : import_effect.Effect.map(
+  decodeStoredJson("control_signal_commands.principal_json", import_ControlSchema.Principal, json),
+  (principal) => ({ principal })
+);
+const randomId = () => globalThis.crypto.randomUUID();
+const terminal = (status) => status === "cancelled" || status === "completed" || status === "failed";
+const maxWaitTreeDepth = 64;
+const missingWaitTreeSchema = (cause) => (0, import_sqlSchemaErrors.missingTable)("flows_runs")(cause) || (0, import_sqlSchemaErrors.missingTable)("flows_run_parents")(cause) || (0, import_sqlSchemaErrors.causeMessages)(cause).some((message) => message.includes("execution_flow"));
+const declaredRequest = (value) => {
+  if (value === null) return {};
+  try {
+    return { request: JSON.parse(value) };
+  } catch {
+    return {};
+  }
+};
+const storeStatus = (status) => {
+  switch (status) {
+    case "accepted":
+    case "running":
+      return "running";
+    case "parked":
+    case "waiting-approval":
+      return "suspended";
+    default:
+      return status;
+  }
+};
+const sameProcess = (left, right) => left.hostId === right.hostId && left.pid === right.pid;
+const approvalIdentity = (target) => target._tag === "Plan" ? { targetTag: target._tag, runId: "", targetId: target.planId } : { targetTag: target._tag, runId: target.runId, targetId: target.requestId };
+const sameApprovalIdentity = (left, right) => left._tag === "Plan" ? right._tag === "Plan" && left.planId === right.planId : right._tag === "Node" && left.runId === right.runId && left.requestId === right.requestId;
+const tokenFromRow = (row, target) => import_effect.Effect.gen(function* () {
+  const decision = row.decisionJson === null ? { _tag: "Pending" } : yield* decodeStoredJson("control_tokens.decision_json", import_ControlRuntime.ApprovalDecision, row.decisionJson);
+  if (row.decisionJson === null && row.resolved === 1) {
+    return yield* new import_ControlError.PersistenceError({
+      operation: "recover an approval decision",
+      message: "This legacy approval erased its decision. Preserve the database for review; create a new run and request a new approval. It cannot safely resume through this gate."
+    });
+  }
+  const expectedPrincipal = decision._tag === "Pending" ? void 0 : decision.decisionPrincipal;
+  const storedPrincipal = row.decisionPrincipalJson === null ? void 0 : yield* decodeStoredJson("control_tokens.decision_principal_json", import_ControlSchema.Principal, row.decisionPrincipalJson);
+  if (row.resolved !== (decision._tag === "Pending" ? 0 : 1) || JSON.stringify(storedPrincipal) !== JSON.stringify(expectedPrincipal)) {
+    return yield* storedFailure(
+      "control_tokens.decision_json",
+      "$",
+      "approval decision disagrees with its resolution"
+    );
+  }
+  return {
+    tokenId: row.tokenId,
+    target,
+    ...decision
+  };
+});
+const planScanBatch = 200;
+const CancelRequestPayload = import_effect.Schema.Struct({
+  principal: import_effect.Schema.optional(import_ControlSchema.Principal),
+  reason: import_effect.Schema.optional(import_effect.Schema.String)
+});
+const EngineInterruptionPayload = import_effect.Schema.Struct({
+  outcome: import_effect.Schema.optional(import_effect.Schema.String),
+  interruptedAtMs: import_effect.Schema.optional(import_effect.Schema.Number)
+});
+const EngineStateProjection = import_effect.Schema.Struct({ flowName: import_effect.Schema.NonEmptyString });
+const migrate = import_effect.Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  if (Dialect.isReadOnly(sql)) return;
+  yield* DurableWrites.make(sql).write(
+    import_effect.Effect.forEach(Object.values(Migrations.set.migrations), (migration) => migration, { discard: true })
+  );
+}).pipe(import_effect.Effect.mapError(persistence("migrate")));
+const makeRuntime = (options = {}) => {
+  const owner = options.owner === void 0 ? Object.freeze({
+    hostId: `control-runtime-${randomId()}`,
+    pid: 1,
+    nonce: randomId()
+  }) : Object.freeze({ ...options.owner });
+  const isAlive = options.isAlive;
+  const approvalAuthority = options.approvalAuthority ?? ApprovalAuthority.local;
+  const authorizeApproval = approvalAuthority.authorize.bind(approvalAuthority);
+  return import_effect.Effect.gen(function* () {
+    const crypto = yield* import_effect.Crypto.Crypto;
+    const writer = yield* import_DurableWriter.DurableWriter;
+    const runStore = yield* import_run_store.RunStore.RunStore;
+    yield* migrate;
+    const sql = yield* import_effect.Effect.service(SqlClient.SqlClient);
+    const configuredFlows = options.flows ?? import_SystemFlows.plannable.map((entry) => ({
+      flowId: entry.flowId,
+      description: `Reserved ${entry.verb} system flow`,
+      deployClass: entry.deployClass,
+      envelope: import_planning.emptyEnvelope
+    }));
+    const readFlows = (options.loadFlows === void 0 ? import_effect.Effect.succeed(configuredFlows) : import_effect.Effect.suspend(options.loadFlows)).pipe(
+      import_effect.Effect.map((entries) => new Map(entries.map((flow) => [flow.flowId, flow])))
+    );
+    const readCurrentFlows = options.currentFlows === void 0 ? readFlows : import_effect.Effect.suspend(options.currentFlows).pipe(
+      import_effect.Effect.map((entries) => new Map(entries.map((flow) => [flow.flowId, flow])))
+    );
+    const readAdoptedFlow = (flowId, runId) => options.adoptFlow === void 0 ? readCurrentFlows.pipe(import_effect.Effect.map((flows) => flows.get(flowId))) : import_effect.Effect.suspend(() => options.adoptFlow(flowId, runId));
+    const fibers = /* @__PURE__ */ new Map();
+    let pendingSignalCursor = 0;
+    const now = import_effect.Clock.currentTimeMillis;
+    const query = (operation) => (effect) => effect.pipe(import_effect.Effect.mapError(persistence(operation)));
+    const probe = (effect) => import_effect.Effect.flatMap(
+      import_effect.Effect.serviceOption(sql.transactionService),
+      (enclosing) => import_effect.Option.isSome(enclosing) ? sql.withTransaction(effect) : effect
+    );
+    const nextSequence = (name) => writer.write(import_effect.Effect.gen(function* () {
+      yield* sql`INSERT INTO control_sequences (name, value) VALUES (${name}, 0) ON CONFLICT (name) DO NOTHING`;
+      const rows = yield* sql`
+          UPDATE control_sequences SET value = value + 1
+          WHERE name = ${name} AND value < ${Number.MAX_SAFE_INTEGER} RETURNING value
+        `;
+      const value = Number(rows[0]?.value);
+      if (!Number.isSafeInteger(value) || value < 1) {
+        return yield* import_effect.Effect.fail(new Error(`Sequence ${name} did not return a positive safe integer`));
+      }
+      return value;
+    })).pipe(import_effect.Effect.mapError(persistence("allocate a sequence")));
+    const readPlan = (planId) => sql`
+        SELECT plan_id AS "planId", card_json AS "cardJson",
+               decoded_input_json AS "decodedInputJson", decision
+        FROM control_plans WHERE plan_id = ${planId}
+      `.pipe(query("read a plan"), import_effect.Effect.map((rows) => import_effect.Option.fromNullishOr(rows[0])));
+    const storedPlan = (row) => import_effect.Effect.all({
+      card: decodeStoredJson("control_plans.card_json", import_ControlSchema.PlanCard, row.cardJson),
+      decodedInput: decodeStoredJson("control_plans.decoded_input_json", import_effect.Schema.Json, row.decodedInputJson),
+      decision: decodeStoredValue("control_plans.decision", import_ControlSchema.PlanDecision, row.decision)
+    });
+    const requirePlan = (planId) => import_effect.Effect.flatMap(
+      readPlan(planId),
+      import_effect.Option.match({
+        onNone: () => import_effect.Effect.fail(new import_ControlError.PlanNotFound({ planId })),
+        onSome: import_effect.Effect.succeed
+      })
+    );
+    const requireRow = (runId) => runStore.get(runId).pipe(
+      import_effect.Effect.mapError(
+        (error) => error.code === "not_found_row" ? new import_ControlError.RunNotFound({ runId }) : persistence("read a run")(error)
+      )
+    );
+    const controlStatus = (status) => {
+      switch (status) {
+        case "pending":
+          return "accepted";
+        case "running":
+          return "running";
+        case "suspended":
+          return "parked";
+        default:
+          return status;
+      }
+    };
+    const decodeRunState = (stateJson) => import_effect.Effect.gen(function* () {
+      const parsed = yield* decodeStoredJson("flows_runs.state_json", import_effect.Schema.Json, stateJson);
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        const candidate = parsed;
+        if ("runId" in candidate || "flowId" in candidate || "status" in candidate) {
+          return {
+            _tag: "Control",
+            summary: yield* decodeStoredValue("flows_runs.state_json as RunSummary", import_ControlSchema.RunSummary, parsed)
+          };
+        }
+      }
+      const engine = yield* decodeStoredValue(
+        "flows_runs.state_json as engine state",
+        EngineStateProjection,
+        parsed
+      );
+      return { _tag: "Engine", flowName: engine.flowName };
+    });
+    const optional = (value) => value === null || value === void 0 ? {} : { value };
+    const within = (column, scope) => sql.in(column, scope);
+    const baseSummary = (row, state) => state._tag === "Control" ? state.summary : {
+      runId: row.runId,
+      flowId: state.flowName,
+      status: controlStatus(row.status),
+      createdAt: row.createdAtMs,
+      updatedAt: row.finishedAtMs ?? row.startedAtMs ?? row.createdAtMs
+    };
+    const summaryFrom = (row, ancestry) => import_effect.Effect.gen(function* () {
+      const base = withLauncher(baseSummary(row, yield* decodeRunState(row.stateJson)), yield* launcherOf(row.runId));
+      const parentRunId = optional(row.parentRunId).value ?? ancestry.spawnedBy.get(row.runId);
+      const lineageId = optional(row.lineageId).value;
+      const roundOrdinal = optional(row.roundOrdinal).value;
+      const origin = Lineage.originOf({
+        ...parentRunId === void 0 ? {} : { parentRunId },
+        ...roundOrdinal === void 0 ? {} : { roundOrdinal },
+        forked: ancestry.forked.has(row.runId)
+      });
+      const waitingReason = ancestry.waitingFor.get(row.runId);
+      const cancellation = ancestry.cancellations.get(row.runId);
+      const pendingResume = ancestry.pendingResumes.get(row.runId);
+      const pendingWaits = ancestry.humanWaits.get(row.runId);
+      return {
+        ...base,
+        // A run whose tree holds an open human wait is waiting on a human,
+        // however nested the row that holds it and whether or not its own row
+        // has flipped to parked yet: a parent awaiting a `.child()` is
+        // blocked on that child's question either way. Rolling the status up
+        // is what lets every existing `status: "waiting-approval"` filter —
+        // the gateway inbox, `smithers approvals list`, the diagnosis card —
+        // find a `HumanTask` parked on a descendant.
+        //
+        // Only ATTACHED waits reach here. A `detach` spawn outlives the run
+        // that started it (`@smthrs/engine-store` `RunState.onParentExit`),
+        // so the walk stops at one rather than telling a reader that a run
+        // which can proceed cannot.
+        ...pendingWaits === void 0 ? {} : { pendingWaits },
+        ...pendingWaits === void 0 || !pendingWaits.some((wait) => wait.reason === ControlExecutor.humanWaitReason) || terminal(base.status) ? {} : { status: "waiting-approval" },
+        ...pendingResume === void 0 ? {} : { pendingResume },
+        ...parentRunId === void 0 ? {} : { parentRunId },
+        ...lineageId === void 0 ? {} : { lineageId },
+        ...roundOrdinal === void 0 ? {} : { roundOrdinal },
+        ...origin === void 0 ? {} : { origin },
+        ...waitingReason === void 0 ? {} : { waitingReason },
+        ...cancellation === void 0 ? {} : { cancellation }
+      };
+    });
+    const forkedRunIds = (scope) => sql`
+      SELECT DISTINCT run_id AS "runId" FROM flows_journal_events
+      WHERE event_type = ${Lineage.forkCreatedEventType} AND ${within("run_id", scope)}
+    `.pipe(
+      import_effect.Effect.map((rows) => new Set(rows.map((row) => row.runId))),
+      import_effect.Effect.catchIf(
+        (0, import_sqlSchemaErrors.missingTable)("flows_journal_events"),
+        () => import_effect.Effect.succeed(/* @__PURE__ */ new Set())
+      ),
+      import_effect.Effect.mapError(persistence("read fork markers"))
+    );
+    const spawnedBy = (scope) => sql`
+      SELECT child_id AS "childId", parent_id AS "parentId"
+      FROM flows_run_parents WHERE ${within("child_id", scope)} ORDER BY seq DESC
+    `.pipe(
+      probe,
+      // Descending, so the lowest `seq` is written last and wins the key.
+      import_effect.Effect.map((rows) => new Map(rows.map((row) => [row.childId, row.parentId]))),
+      import_effect.Effect.catchIf(
+        (0, import_sqlSchemaErrors.missingTable)("flows_run_parents"),
+        () => import_effect.Effect.succeed(/* @__PURE__ */ new Map())
+      ),
+      import_effect.Effect.mapError(persistence("read spawn edges"))
+    );
+    const waitingFor = (scope) => sql`
+      SELECT run_id AS "runId", waiting_reason AS "waitingReason"
+      FROM flows_runs WHERE waiting_reason IS NOT NULL AND ${within("run_id", scope)}
+    `.pipe(
+      import_effect.Effect.map((rows) => new Map(rows.map((row) => [row.runId, row.waitingReason]))),
+      import_effect.Effect.mapError(persistence("read waiting reasons"))
+    );
+    const humanWaits = (scope) => sql`
+      WITH RECURSIVE human_waits(wait_run_id, ancestor_id, depth) AS (
+        SELECT run_id, run_id, 0 FROM flows_runs
+        WHERE waiting_reason IN (${ControlExecutor.humanWaitReason}, 'event')
+          AND waiting_token IS NOT NULL
+          AND status NOT IN ('completed', 'failed', 'cancelled')
+        UNION
+        SELECT human_waits.wait_run_id, parent.run_id, human_waits.depth + 1
+        FROM flows_runs step JOIN human_waits ON step.run_id = human_waits.ancestor_id
+        JOIN flows_runs parent ON parent.run_id IN (
+          SELECT parent_id FROM flows_run_parents WHERE child_id = step.run_id
+          UNION ALL
+          SELECT step.parent_run_id WHERE step.parent_run_id IS NOT NULL
+        )
+        WHERE human_waits.depth < ${maxWaitTreeDepth}
+          AND (parent.run_id = step.parent_run_id
+            OR COALESCE(${Dialect.jsonText(sql, sql`step.state_json`, "$.onParentExit")}, 'cancel') <> 'detach')
+      ), reachable(wait_run_id, ancestor_id, depth) AS (
+        SELECT wait_run_id, ancestor_id, MIN(depth) FROM human_waits GROUP BY wait_run_id, ancestor_id
+      )
+      SELECT
+        reachable.ancestor_id AS "ancestorId",
+        reachable.depth AS "depth",
+        parked.run_id AS "runId",
+        parked.execution_flow AS "flowId",
+        parked.waiting_reason AS "waitingReason",
+        parked.waiting_token AS "waitingToken",
+        parked.waiting_request AS "waitingRequest",
+        parked.created_at_ms AS "createdAtMs"
+      FROM reachable JOIN flows_runs parked ON parked.run_id = reachable.wait_run_id
+      WHERE ${within("reachable.ancestor_id", scope)}
+      ORDER BY reachable.ancestor_id, reachable.depth, parked.created_at_ms, parked.run_id
+    `.pipe(
+      probe,
+      import_effect.Effect.map((rows) => {
+        const index = /* @__PURE__ */ new Map();
+        for (const row of rows) {
+          const built = ControlExecutor.pendingWaitOf({
+            runId: row.runId,
+            reason: row.waitingReason,
+            token: row.waitingToken,
+            createdAt: row.createdAtMs,
+            ...row.flowId === null ? {} : { flowId: row.flowId },
+            ...declaredRequest(row.waitingRequest)
+          });
+          if (built === void 0) continue;
+          const waits = index.get(row.ancestorId) ?? [];
+          waits.push(built);
+          index.set(row.ancestorId, waits);
+        }
+        return index;
+      }),
+      import_effect.Effect.catchIf(
+        missingWaitTreeSchema,
+        () => import_effect.Effect.succeed(/* @__PURE__ */ new Map())
+      ),
+      import_effect.Effect.mapError(persistence("read nested human waits"))
+    );
+    const cancelRequests = (scope) => sql`
+      SELECT run_id AS "runId", emitted_at_ms AS "emittedAtMs", payload_json AS "payloadJson"
+      FROM flows_journal_events
+      WHERE event_type = ${Attribution.requestedEventType} AND ${within("run_id", scope)}
+      ORDER BY run_id, seq
+    `.pipe(
+      import_effect.Effect.catchIf(
+        (0, import_sqlSchemaErrors.missingTable)("flows_journal_events"),
+        () => import_effect.Effect.succeed(
+          new Array()
+        )
+      ),
+      import_effect.Effect.mapError(persistence("read cancel requests")),
+      import_effect.Effect.flatMap(
+        (rows) => import_effect.Effect.gen(function* () {
+          const requests = /* @__PURE__ */ new Map();
+          for (const row of rows) {
+            if (requests.has(row.runId)) continue;
+            const payload = yield* decodeStoredJson(
+              "flows_journal_events.payload_json for control.run.cancel-requested",
+              CancelRequestPayload,
+              row.payloadJson
+            );
+            requests.set(row.runId, {
+              requestedAt: Number(row.emittedAtMs),
+              ...payload.principal === void 0 ? {} : { principal: payload.principal },
+              ...payload.reason === void 0 ? {} : { reason: payload.reason }
+            });
+          }
+          return requests;
+        })
+      )
+    );
+    const engineInterruptions = (scope) => sql`
+      SELECT run_id AS "runId", payload_json AS "payloadJson"
+      FROM flows_journal_events
+      WHERE event_type = ${Attribution.interruptedEventType} AND ${within("run_id", scope)}
+    `.pipe(
+      import_effect.Effect.catchIf(
+        (0, import_sqlSchemaErrors.missingTable)("flows_journal_events"),
+        () => import_effect.Effect.succeed(new Array())
+      ),
+      import_effect.Effect.mapError(persistence("read engine interruptions")),
+      import_effect.Effect.flatMap(
+        (rows) => import_effect.Effect.gen(function* () {
+          const cancelled = /* @__PURE__ */ new Map();
+          for (const row of rows) {
+            const payload = yield* decodeStoredJson(
+              "flows_journal_events.payload_json for flows.engine.interrupted",
+              EngineInterruptionPayload,
+              row.payloadJson
+            );
+            if (payload.outcome !== "cancelled") continue;
+            cancelled.set(row.runId, Number(payload.interruptedAtMs ?? 0));
+          }
+          return cancelled;
+        })
+      )
+    );
+    const cancelEvidence = (scope) => sql`
+      SELECT run_id AS "runId", parent_run_id AS "parentRunId",
+             cancel_requested_at_ms AS "cancelRequestedAtMs"
+      FROM flows_runs WHERE ${within("run_id", scope)}
+    `.pipe(import_effect.Effect.mapError(persistence("read cancel evidence")));
+    const cancellations = (scope) => import_effect.Effect.map(
+      import_effect.Effect.all({
+        rows: cancelEvidence(scope),
+        requests: cancelRequests(scope),
+        interrupted: engineInterruptions(scope),
+        spawnedBy: spawnedBy(scope)
+      }),
+      ({ interrupted, requests, rows, spawnedBy: spawnedBy2 }) => Attribution.attribute({
+        runs: rows.map((row) => {
+          const parentRunId = row.parentRunId ?? spawnedBy2.get(row.runId);
+          const cancelledAt = interrupted.get(row.runId);
+          return {
+            runId: row.runId,
+            ...parentRunId === void 0 || parentRunId === null ? {} : { parentRunId },
+            ...row.cancelRequestedAtMs === null ? {} : { cancelRequestedAt: Number(row.cancelRequestedAtMs) },
+            ...cancelledAt === void 0 ? {} : { cancelledAt }
+          };
+        }),
+        requests
+      })
+    );
+    const pendingResumeIndex = (scope) => sql`
+      SELECT run_id AS "runId", requested_seq AS "requestedSeq"
+      FROM control_run_resumes WHERE ${within("run_id", scope)}
+    `.pipe(
+      import_effect.Effect.map(
+        (rows) => new Map(rows.map((row) => [row.runId, Number(row.requestedSeq)]))
+      ),
+      import_effect.Effect.mapError(persistence("read pending resumes"))
+    );
+    const ancestryIndex = (scope) => import_effect.Effect.map(
+      import_effect.Effect.all({
+        forked: forkedRunIds(scope),
+        spawnedBy: spawnedBy(scope),
+        waitingFor: waitingFor(scope),
+        humanWaits: humanWaits(scope),
+        cancellations: cancellations(scope),
+        pendingResumes: pendingResumeIndex(scope)
+      }),
+      (index) => index
+    );
+    const ancestorChain = (runId) => import_effect.Effect.gen(function* () {
+      const chain = [];
+      const visited = /* @__PURE__ */ new Set();
+      let start = runId;
+      while (start !== void 0 && !visited.has(start)) {
+        const rows = yield* sql`
+            WITH RECURSIVE ancestry(run_id, parent_run_id) AS (
+              SELECT run_id, parent_run_id FROM flows_runs WHERE run_id = ${start}
+              UNION
+              SELECT runs.run_id, runs.parent_run_id
+              FROM flows_runs runs JOIN ancestry ON runs.run_id = ancestry.parent_run_id
+            )
+            SELECT run_id AS "runId", parent_run_id AS "parentRunId" FROM ancestry
+          `.pipe(import_effect.Effect.mapError(persistence("walk a run's ancestry")));
+        if (rows.length === 0) {
+          chain.push(start);
+          break;
+        }
+        let last;
+        for (const row of rows) {
+          if (visited.has(row.runId)) continue;
+          visited.add(row.runId);
+          chain.push(row.runId);
+          if (row.parentRunId === null) last = row.runId;
+        }
+        const spawn = last === void 0 ? void 0 : (yield* spawnedBy([last])).get(last);
+        start = spawn;
+      }
+      return chain;
+    });
+    const summaryOf = (row) => import_effect.Effect.zipWith(
+      decodeRunState(row.stateJson),
+      launcherOf(row.runId),
+      (state, launcher) => withLauncher(baseSummary(row, state), launcher)
+    );
+    const snapshotOf = (row) => ({
+      status: row.status,
+      owner: row.owner,
+      heartbeatAtMs: row.heartbeatAtMs
+    });
+    const ownedByUs = (row) => row.status === "running" && row.owner !== null && sameProcess(row.owner, owner);
+    const transition = (runId, claim2, summary, status) => import_effect.Effect.gen(function* () {
+      const timestamp = yield* now;
+      const next = {
+        ...summary,
+        status,
+        updatedAt: timestamp,
+        ...storeStatus(status) === "running" ? {} : { ownerId: void 0 },
+        // A park releases the owner columns, so the row itself stops saying
+        // which process is hosting the execution. The fence it was parked
+        // under is kept instead: it is what lets the host recognize its own
+        // park, and every other process tell that the execution belongs to
+        // one it cannot see (triage B-15). Any other status ends the park,
+        // so it ends the record with it.
+        parkedBy: storeStatus(status) === "suspended" ? JSON.stringify(claim2) : void 0
+      };
+      const outcome = yield* runStore.transitionOwned(
+        runId,
+        claim2,
+        storeStatus(status),
+        JSON.stringify(next)
+      ).pipe(import_effect.Effect.mapError(persistence("transition a run")));
+      if (outcome._tag === "NotFound") return yield* import_effect.Effect.fail(new import_ControlError.RunNotFound({ runId }));
+      if (outcome._tag !== "Transitioned") return yield* import_effect.Effect.fail(new import_ControlError.ClaimLost({ runId }));
+      return next;
+    });
+    const deadOwner = (row) => import_effect.Effect.gen(function* () {
+      if (isAlive === void 0 || row.owner === null) return void 0;
+      const nowMs = yield* now;
+      const alive = yield* isAlive(row.owner, { claimant: owner, heartbeatAtMs: row.heartbeatAtMs, nowMs });
+      if (alive) return void 0;
+      return {
+        expectedOwner: row.owner,
+        checkedAtMs: nowMs,
+        kind: import_run_store.Ownership.sameHostIncarnation(row.owner, owner) ? "same-host-pid-dead" : "lease-expired"
+      };
+    });
+    const claim = (runId, row, evidence, adopted) => import_effect.Effect.gen(function* () {
+      const timestamp = evidence?.checkedAtMs ?? (yield* now);
+      const claimant = { ...owner, nonce: randomId() };
+      const outcome = yield* runStore.claimAndOwn(runId, snapshotOf(row), claimant, timestamp, evidence).pipe(
+        import_effect.Effect.mapError(persistence("claim a run"))
+      );
+      if (outcome._tag === "NotFound") return yield* import_effect.Effect.fail(new import_ControlError.RunNotFound({ runId }));
+      if (outcome._tag !== "Activated") return yield* import_effect.Effect.fail(new import_ControlError.ClaimLost({ runId }));
+      const summary = yield* summaryOf(row);
+      return yield* transition(runId, claimant, {
+        ...summary,
+        ...adopted,
+        ownerId: JSON.stringify(claimant)
+      }, "accepted");
+    });
+    const recordedCode = (row) => import_effect.Effect.gen(function* () {
+      const summary = yield* summaryOf(row);
+      const seen = /* @__PURE__ */ new Set([row.runId]);
+      let parentId = optional(row.parentRunId).value ?? summary.parentRunId;
+      while (summary.executionDigest === void 0 && summary.engineVersion === void 0 && parentId !== void 0 && !seen.has(parentId)) {
+        seen.add(parentId);
+        const parentRow = yield* requireRow(parentId).pipe(
+          import_effect.Effect.catchTag("/control/RunNotFound", () => import_effect.Effect.succeed(void 0))
+        );
+        if (parentRow === void 0) break;
+        const parent = yield* summaryOf(parentRow);
+        if (parent.flowId !== summary.flowId) break;
+        if (parent.executionDigest !== void 0 || parent.engineVersion !== void 0) {
+          return { ...summary, executionDigest: parent.executionDigest, engineVersion: parent.engineVersion };
+        }
+        parentId = optional(parentRow.parentRunId).value ?? parent.parentRunId;
+      }
+      return summary;
+    });
+    const adoptable = (row) => import_effect.Effect.gen(function* () {
+      const summary = yield* summaryOf(row);
+      const flow = yield* readAdoptedFlow(summary.flowId, summary.runId);
+      const gone = flow === void 0 ? (0, import_planning.codeDriftOf)(yield* recordedCode(row), void 0, options.engineVersion) : void 0;
+      if (gone !== void 0) return yield* gone;
+      return (0, import_planning.adoptedCode)(summary, flow, options.engineVersion);
+    });
+    const resumeRun = (runId, scope, adopt) => import_effect.Effect.gen(function* () {
+      const row = yield* requireRow(runId);
+      const summary = yield* summaryOf(row);
+      if (terminal(summary.status)) return summary;
+      if (ownedByUs(row)) return summary;
+      if (scope === "launched" && row.status === "suspended" && summary.parkedBy !== void 0) {
+        const parkedOwner = yield* decodeStoredJson("parked host", import_run_store.Ownership.OwnerId, summary.parkedBy);
+        if (!sameProcess(parkedOwner, owner)) {
+          const alive = isAlive === void 0 || !import_run_store.Ownership.sameHostIncarnation(parkedOwner, owner) ? true : yield* isAlive(parkedOwner, { claimant: owner, heartbeatAtMs: row.heartbeatAtMs, nowMs: yield* now });
+          if (alive) {
+            return yield* new import_ControlError.ClaimLost({
+              runId,
+              reason: "The host that parked this run is still alive or its liveness is unknown",
+              parkedBy: { hostId: parkedOwner.hostId, pid: parkedOwner.pid }
+            });
+          }
+        }
+      }
+      if (scope === "launched") {
+        const indexed = yield* sql`SELECT run_id FROM control_runs WHERE run_id = ${runId}`.pipe(
+          import_effect.Effect.mapError(persistence("read the launch index"))
+        );
+        if (indexed.length === 0) return yield* new import_ControlError.ClaimLost({ runId });
+      }
+      if (row.status === "running") {
+        const evidence = yield* deadOwner(row);
+        return evidence === void 0 ? yield* new import_ControlError.ClaimLost({ runId }) : yield* claim(runId, row, evidence, adopt === void 0 ? void 0 : yield* adopt(row));
+      }
+      return yield* claim(runId, row, void 0, adopt === void 0 ? void 0 : yield* adopt(row));
+    });
+    const runPageKeys = (request, includeSpawn = true, includeWaitRollup = true) => {
+      const filters = request.filters;
+      const source = sql`CASE WHEN indexed.created_seq IS NULL THEN 1 ELSE 0 END`;
+      const sequence = sql`COALESCE(indexed.created_seq, 0)`;
+      const controlState = sql`(${Dialect.jsonText(sql, sql`runs.state_json`, "$.runId")} IS NOT NULL
+        OR ${Dialect.jsonText(sql, sql`runs.state_json`, "$.flowId")} IS NOT NULL
+        OR ${Dialect.jsonText(sql, sql`runs.state_json`, "$.status")} IS NOT NULL)`;
+      const flowId = sql`CASE WHEN ${controlState} THEN ${Dialect.jsonText(sql, sql`runs.state_json`, "$.flowId")}
+        ELSE ${Dialect.jsonText(sql, sql`runs.state_json`, "$.flowName")} END`;
+      const ownStatus = sql`CASE WHEN ${controlState} THEN ${Dialect.jsonText(sql, sql`runs.state_json`, "$.status")}
+        ELSE CASE runs.status WHEN 'pending' THEN 'accepted' WHEN 'suspended' THEN 'parked' ELSE runs.status END END`;
+      const status = includeWaitRollup ? sql`CASE
+          WHEN runs.status NOT IN ('completed', 'failed', 'cancelled')
+            AND runs.run_id IN (SELECT ancestorId FROM human_wait_ancestry)
+          THEN 'waiting-approval' ELSE ${ownStatus} END` : ownStatus;
+      const storedParent = sql`CASE WHEN ${controlState} THEN ${Dialect.jsonText(sql, sql`runs.state_json`, "$.parentRunId")} END`;
+      const storedLineage = sql`CASE WHEN ${controlState} THEN ${Dialect.jsonText(sql, sql`runs.state_json`, "$.lineageId")} END`;
+      const parent = includeSpawn ? sql`COALESCE(runs.parent_run_id,
+            (SELECT parent_id FROM flows_run_parents WHERE child_id = runs.run_id ORDER BY seq LIMIT 1),
+            ${storedParent})` : sql`COALESCE(runs.parent_run_id, ${storedParent})`;
+      const lineage = sql`COALESCE(runs.lineage_id, ${storedLineage})`;
+      const after = request.cursor;
+      const conditions = [sql`1 = 1`];
+      if (filters?.flowId !== void 0) conditions.push(sql`${flowId} = ${filters.flowId}`);
+      if (filters?.status !== void 0) conditions.push(sql`${status} = ${filters.status}`);
+      if (filters?.terminal !== void 0) {
+        const isTerminal = sql`${status} IN ('completed', 'failed', 'cancelled')`;
+        conditions.push(filters.terminal ? isTerminal : sql`NOT (${isTerminal})`);
+      }
+      if (filters?.parentRunId !== void 0) conditions.push(sql`${parent} = ${filters.parentRunId}`);
+      if (filters?.lineageId !== void 0) conditions.push(sql`${lineage} = ${filters.lineageId}`);
+      if (filters?.since !== void 0) conditions.push(sql`runs.created_at_ms >= ${filters.since}`);
+      if (filters?.until !== void 0) conditions.push(sql`runs.created_at_ms < ${filters.until}`);
+      if (filters?.launchedBy !== void 0) {
+        conditions.push(sql`indexed.principal_id = ${filters.launchedBy.id}`);
+        if (filters.launchedBy.kind !== void 0) {
+          conditions.push(sql`indexed.principal_kind = ${filters.launchedBy.kind}`);
+        }
+      }
+      if (filters?.runIds !== void 0) {
+        const ids = JSON.stringify([...new Set(filters.runIds)]);
+        conditions.push(
+          sql.onDialectOrElse({
+            /* v8 ignore next -- PostgreSQL adapter; covered by //packages/smithers/control:postgresInventory */
+            pg: () => sql`runs.run_id IN (SELECT jsonb_array_elements_text(${ids}::jsonb))`,
+            orElse: () => sql`runs.run_id IN (SELECT value FROM json_each(${ids}))`
+          })
+        );
+      }
+      if (after !== void 0) {
+        conditions.push(
+          request.order === "newest" ? sql`(runs.created_at_ms, ${source}, ${sequence}, runs.run_id) <
+              (${after.createdAt}, ${after.source}, ${after.sequence}, ${after.runId})` : request.order === "oldest" ? sql`(runs.created_at_ms, ${source}, ${sequence}, runs.run_id) >
+              (${after.createdAt}, ${after.source}, ${after.sequence}, ${after.runId})` : sql`(${source}, ${sequence}, runs.created_at_ms, runs.run_id) >
+              (${after.source}, ${after.sequence}, ${after.createdAt}, ${after.runId})`
+        );
+      }
+      const waitAncestry = includeWaitRollup ? sql`WITH RECURSIVE human_wait_ancestry(ancestorId, depth) AS (
+          SELECT run_id, 0 FROM flows_runs
+          WHERE waiting_reason = ${ControlExecutor.humanWaitReason}
+            AND status NOT IN ('completed', 'failed', 'cancelled')
+          UNION
+          SELECT parent.run_id, human_wait_ancestry.depth + 1
+          FROM flows_runs step JOIN human_wait_ancestry ON step.run_id = human_wait_ancestry.ancestorId
+          JOIN flows_runs parent ON parent.run_id IN (
+            SELECT parent_id FROM flows_run_parents WHERE child_id = step.run_id
+            UNION ALL
+            SELECT step.parent_run_id WHERE step.parent_run_id IS NOT NULL
+          )
+          WHERE human_wait_ancestry.depth < ${maxWaitTreeDepth}
+            AND (parent.run_id = step.parent_run_id
+              OR COALESCE(${Dialect.jsonText(sql, sql`step.state_json`, "$.onParentExit")}, 'cancel') <> 'detach')
+        )` : sql.literal("");
+      return sql`
+        ${waitAncestry}
+        SELECT runs.run_id AS "runId", ${source} AS source, ${sequence} AS sequence,
+               runs.created_at_ms AS "createdAt"
+        FROM flows_runs AS runs LEFT JOIN control_runs AS indexed ON indexed.run_id = runs.run_id
+        WHERE ${sql.and(conditions)}
+        ORDER BY ${request.order === "newest" ? sql`runs.created_at_ms DESC, ${source} DESC, ${sequence} DESC, runs.run_id DESC` : request.order === "oldest" ? sql`runs.created_at_ms, ${source}, ${sequence}, runs.run_id` : sql`${source}, ${sequence}, runs.created_at_ms, runs.run_id`}
+        LIMIT ${request.limit + 1}
+      `.pipe(
+        probe,
+        import_effect.Effect.catchIf(
+          (error) => includeSpawn && filters?.parentRunId !== void 0 && (0, import_sqlSchemaErrors.missingTable)("flows_run_parents")(error),
+          () => runPageKeys(request, false, includeWaitRollup)
+        ),
+        // Without the engine's wait-tree schema, retain the ordinary page.
+        import_effect.Effect.catchIf(
+          (error) => includeWaitRollup && missingWaitTreeSchema(error),
+          () => runPageKeys(request, includeSpawn, false)
+        ),
+        import_effect.Effect.mapError(persistence("query runs"))
+      );
+    };
+    const pageByRowId = (request, table, column, operation) => import_effect.Effect.gen(function* () {
+      yield* (0, import_ControlRuntime.idPageLimit)(request.limit);
+      const through = request.through ?? Number(
+        (yield* sql`
+            SELECT MAX(rowid) AS newest FROM ${sql.literal(table)}
+          `.pipe(query(operation)))[0]?.newest ?? 0
+      );
+      const rows = yield* sql`
+          SELECT ${sql.literal(column)} AS id, rowid AS position FROM ${sql.literal(table)}
+          WHERE rowid > ${request.after ?? 0} AND rowid <= ${through}
+          ORDER BY rowid LIMIT ${request.limit + 1}
+        `.pipe(query(operation));
+      const selected = rows.slice(0, request.limit);
+      return rows.length > request.limit ? { ids: selected.map((row) => row.id), next: Number(selected.at(-1).position), through } : { ids: selected.map((row) => row.id), through };
+    });
+    const pagePlanIds = (request) => pageByRowId(request, "control_plans", "plan_id", "page plans");
+    const queryPlans = (request) => import_effect.Effect.gen(function* () {
+      yield* (0, import_ControlRuntime.idPageLimit)(request.limit);
+      const plans = [];
+      let after = request.after ?? 0;
+      while (true) {
+        const conditions = [
+          sql`rowid > ${after}`,
+          ...request.decision === void 0 ? [] : [sql`decision = ${request.decision}`]
+        ];
+        const rows = yield* sql`
+            SELECT plan_id AS "planId", card_json AS "cardJson",
+                   decoded_input_json AS "decodedInputJson", decision, rowid AS position
+            FROM control_plans WHERE ${sql.and(conditions)}
+            ORDER BY rowid LIMIT ${planScanBatch}
+          `.pipe(query("page plans"));
+        for (const [index, row] of rows.entries()) {
+          after = Number(row.position);
+          const plan = yield* storedPlan(row);
+          if (request.flowId !== void 0 && plan.card.flowId !== request.flowId) continue;
+          plans.push(plan);
+          if (plans.length === request.limit) {
+            return index < rows.length - 1 || rows.length === planScanBatch ? { plans, next: after } : { plans };
+          }
+        }
+        if (rows.length < planScanBatch) return { plans };
+      }
+    });
+    const launcherOf = (runId) => import_effect.Effect.map(
+      sql`
+          SELECT principal_id AS id, principal_kind AS kind FROM control_runs WHERE run_id = ${runId}
+        `.pipe(query("read a run launcher")),
+      (rows) => {
+        const row = rows[0];
+        return row === void 0 || row.id === null || row.kind === null ? void 0 : { id: row.id, kind: row.kind };
+      }
+    );
+    const messages = (runId, kind, schema) => sql`
+        SELECT payload_json AS "payloadJson" FROM control_run_messages
+        WHERE run_id = ${runId} AND kind = ${kind} ORDER BY seq
+      `.pipe(
+      query("read run messages"),
+      import_effect.Effect.flatMap(
+        (rows) => import_effect.Effect.forEach(
+          rows,
+          (row) => decodeStoredJson(`control_run_messages.payload_json as ${kind}`, schema, row.payloadJson)
+        )
+      )
+    );
+    const appendMessage = (runId, kind, payload) => import_effect.Effect.gen(function* () {
+      yield* requireRow(runId);
+      yield* sql`
+          INSERT INTO control_run_messages (run_id, kind, payload_json)
+          VALUES (${runId}, ${kind}, ${JSON.stringify(payload)})
+        `.pipe(import_effect.Effect.mapError(persistence("append a run message")));
+    });
+    const service = (0, import_ControlRuntime.make)({
+      authorizeApproval,
+      plan: import_effect.Effect.fn("SqlControlRuntime.plan")(function* (input) {
+        const flow = (yield* readFlows).get(input.flowId);
+        if (flow === void 0) {
+          return yield* new import_ControlError.FlowNotFound({ flowId: input.flowId });
+        }
+        const requestFingerprint = yield* import_effect.Effect.try({
+          try: () => (0, import_planning.planFingerprint)(input),
+          catch: (cause) => new import_ControlError.InvalidInput({ issue: (0, import_issues.canonicalIssue)(cause) })
+        });
+        if (input.idempotencyKey !== void 0) {
+          const prior = yield* sql`
+            SELECT fingerprint, plan_id AS "planId" FROM control_plan_keys
+            WHERE idempotency_key = ${input.idempotencyKey}
+          `.pipe(query("read a plan key"));
+          const found = prior[0];
+          if (found !== void 0) {
+            if (found.fingerprint !== requestFingerprint) {
+              return yield* new import_ControlError.InvalidInput({
+                issue: `idempotency key ${input.idempotencyKey} was used for another plan`
+              });
+            }
+            const stored = yield* readPlan(found.planId);
+            if (import_effect.Option.isSome(stored)) {
+              const decoded2 = yield* storedPlan(stored.value);
+              return { card: decoded2.card, created: false };
+            }
+          }
+        }
+        const decoded = yield* flow.decode?.(input.input) ?? import_effect.Effect.try({
+          try: () => {
+            (0, import_planning.canonical)(input.input);
+            return input.input;
+          },
+          catch: (cause) => new import_ControlError.InvalidInput({ issue: (0, import_issues.canonicalIssue)(cause) })
+        });
+        const planId = `plan-${yield* nextSequence("plan")}`;
+        const handoff = flow.plan === void 0 ? void 0 : yield* flow.plan(decoded, planId);
+        const card = yield* (0, import_planning.planCard)({
+          planId,
+          flowId: input.flowId,
+          decodedInput: decoded,
+          envelope: (0, import_planning.budgeted)(flow.envelope, input.budget),
+          deployClass: flow.deployClass,
+          executionDigest: flow.executionDigest,
+          handoff,
+          idempotencyKey: input.idempotencyKey
+        }).pipe(import_effect.Effect.provideService(import_effect.Crypto.Crypto, crypto));
+        const identity = approvalIdentity(card.approval.target);
+        const outcome = yield* writer.write(import_effect.Effect.gen(function* () {
+          if (input.idempotencyKey !== void 0) {
+            yield* sql`
+              INSERT INTO control_plan_keys (idempotency_key, fingerprint, plan_id)
+              VALUES (${input.idempotencyKey}, ${requestFingerprint}, ${planId})
+              ON CONFLICT (idempotency_key) DO NOTHING
+            `;
+            const settled = yield* sql`
+              SELECT fingerprint, plan_id AS "planId" FROM control_plan_keys
+              WHERE idempotency_key = ${input.idempotencyKey}
+            `;
+            const holder = settled[0];
+            if (holder !== void 0 && holder.planId !== planId) {
+              return { _tag: "raced", holder };
+            }
+          }
+          const decodedJson = JSON.stringify(decoded ?? null);
+          yield* sql`
+            INSERT INTO control_plans (plan_id, card_json, decoded_input_json, decision)
+            VALUES (${planId}, ${JSON.stringify(card)}, ${decodedJson}, 'pending')
+          `;
+          yield* sql`
+            INSERT INTO control_tokens (
+              target_tag, run_id, target_id, token_id, target_json, resolved, decision_principal_json
+            )
+            VALUES (
+              ${identity.targetTag}, ${identity.runId}, ${identity.targetId}, ${planId},
+              ${JSON.stringify(card.approval.target)}, 0, NULL
+            )
+          `;
+          return { _tag: "stored" };
+        })).pipe(import_effect.Effect.mapError(persistence("store a plan")));
+        if (outcome._tag === "raced") {
+          if (outcome.holder.fingerprint !== requestFingerprint) {
+            return yield* new import_ControlError.InvalidInput({
+              issue: `idempotency key ${String(input.idempotencyKey)} was used for another plan`
+            });
+          }
+          const stored = yield* readPlan(outcome.holder.planId);
+          if (import_effect.Option.isNone(stored)) {
+            return yield* new import_ControlError.PersistenceError({
+              operation: "read a plan",
+              message: `plan key ${String(input.idempotencyKey)} names plan ${outcome.holder.planId}, which is absent`
+            });
+          }
+          const decodedHolder = yield* storedPlan(stored.value);
+          return { card: decodedHolder.card, created: false };
+        }
+        return { card, created: true };
+      }),
+      getPlan: import_effect.Effect.fn("SqlControlRuntime.getPlan")(
+        (planId) => import_effect.Effect.flatMap(requirePlan(planId), storedPlan)
+      ),
+      pagePlanIds,
+      queryPlans,
+      lookupApproval: import_effect.Effect.fn("SqlControlRuntime.lookupApproval")(function* (target) {
+        const tokenId = target._tag === "Plan" ? target.planId : target.requestId;
+        const identity = approvalIdentity(target);
+        const rows = yield* sql`
+          SELECT token_id AS "tokenId", target_json AS "targetJson", resolved,
+                 decision_principal_json AS "decisionPrincipalJson", decision_json AS "decisionJson"
+          FROM control_tokens
+          WHERE target_tag = ${identity.targetTag}
+            AND run_id = ${identity.runId}
+            AND target_id = ${identity.targetId}
+        `.pipe(query("read an approval token"));
+        const row = rows[0];
+        if (row === void 0) {
+          return yield* target._tag === "Node" ? new import_ControlError.RunNotFound({ runId: target.runId }) : new import_ControlError.PlanNotFound({ planId: target.planId });
+        }
+        const stored = yield* decodeStoredJson("control_tokens.target_json", import_ControlSchema.ApprovalTarget, row.targetJson);
+        if (!sameApprovalIdentity(stored, target)) {
+          return yield* new import_ControlError.PersistenceError({
+            operation: "validate an approval token",
+            message: "The stored approval target does not match its identity"
+          });
+        }
+        if (stored.digest !== target.digest) {
+          return yield* new import_ControlError.PlanDigestMismatch({
+            planId: tokenId,
+            expected: stored.digest,
+            actual: target.digest
+          });
+        }
+        if (!(0, import_planning.sameEnvelope)(stored.envelope, target.envelope)) {
+          return yield* new import_ControlError.EnvelopeMismatch({
+            planId: tokenId,
+            expected: (0, import_planning.canonical)(stored.envelope),
+            actual: (0, import_planning.canonical)(target.envelope)
+          });
+        }
+        const token = yield* tokenFromRow(row, stored);
+        if (token._tag !== "Pending") return yield* new import_ControlError.AlreadyResolved({ requestId: tokenId });
+        return token;
+      }),
+      registerApproval: import_effect.Effect.fn("SqlControlRuntime.registerApproval")(function* (target) {
+        yield* requireRow(target.runId);
+        const identity = approvalIdentity(target);
+        yield* sql`
+          INSERT INTO control_tokens (
+            target_tag, run_id, target_id, token_id, target_json, resolved, decision_principal_json
+          )
+          VALUES (
+            ${identity.targetTag}, ${identity.runId}, ${identity.targetId}, ${target.requestId},
+            ${JSON.stringify(target)}, 0, NULL
+          )
+          ON CONFLICT (target_tag, run_id, target_id) DO NOTHING
+        `.pipe(import_effect.Effect.mapError(persistence("register an approval token")));
+        const rows = yield* sql`
+          SELECT token_id AS "tokenId", target_json AS "targetJson", resolved,
+                 decision_principal_json AS "decisionPrincipalJson", decision_json AS "decisionJson"
+          FROM control_tokens
+          WHERE target_tag = ${identity.targetTag}
+            AND run_id = ${identity.runId}
+            AND target_id = ${identity.targetId}
+        `.pipe(query("read an approval token"));
+        const row = rows[0];
+        if (row === void 0) {
+          return yield* import_effect.Effect.fail(
+            new import_ControlError.PersistenceError({
+              operation: "register an approval token",
+              message: "A registered approval token could not be read back"
+            })
+          );
+        }
+        const stored = yield* decodeStoredJson("control_tokens.target_json", import_ControlSchema.ApprovalTarget, row.targetJson);
+        if (!sameApprovalIdentity(stored, target)) {
+          return yield* new import_ControlError.PersistenceError({
+            operation: "validate an approval token",
+            message: "The stored approval target does not match its identity"
+          });
+        }
+        if (stored.digest !== target.digest) {
+          return yield* new import_ControlError.PlanDigestMismatch({
+            planId: target.requestId,
+            expected: stored.digest,
+            actual: target.digest
+          });
+        }
+        if (!(0, import_planning.sameEnvelope)(stored.envelope, target.envelope)) {
+          return yield* new import_ControlError.EnvelopeMismatch({
+            planId: target.requestId,
+            expected: (0, import_planning.canonical)(stored.envelope),
+            actual: (0, import_planning.canonical)(target.envelope)
+          });
+        }
+        return yield* tokenFromRow(row, stored);
+      }),
+      installBulkGrant: import_effect.Effect.fn("SqlControlRuntime.installBulkGrant")(function* (token, envelope, scope) {
+        const timestamp = yield* now;
+        const identity = approvalIdentity(token.target);
+        yield* sql`
+          INSERT INTO control_grants (
+            target_tag, run_id, target_id, token_id, envelope_json, scope, installed_at_ms
+          )
+          VALUES (
+            ${identity.targetTag}, ${identity.runId}, ${identity.targetId}, ${token.tokenId},
+            ${JSON.stringify(envelope)}, ${scope}, ${timestamp}
+          )
+          ON CONFLICT (target_tag, run_id, target_id) DO NOTHING
+        `.pipe(import_effect.Effect.mapError(persistence("install a grant")));
+      }),
+      resolveApproval: import_effect.Effect.fn("SqlControlRuntime.resolveApproval")(function* (token, decision, principal, scope = "once") {
+        const requested = yield* import_effect.Effect.try({
+          try: () => structuredClone({ target: token.target, principal, tokenId: token.tokenId }),
+          catch: () => new import_ControlError.PersistenceError({
+            operation: "record an approval decision",
+            message: "The approval request cannot be captured"
+          })
+        });
+        const identity = approvalIdentity(requested.target);
+        const requestedPrincipal = requested.principal;
+        const tokenId = requested.tokenId;
+        const decidedAt = yield* now;
+        const answer = yield* decodeStoredValue(
+          "approval decision",
+          import_ControlRuntime.ApprovalDecision,
+          decision === "approved" ? { _tag: "Approved", decisionPrincipal: requestedPrincipal, decidedAt, scope } : { _tag: "Denied", decisionPrincipal: requestedPrincipal, decidedAt }
+        );
+        const resolved = yield* writer.write(import_effect.Effect.gen(function* () {
+          yield* authorizeApproval({ principal: requestedPrincipal, target: requested.target, decision, scope });
+          const rows = yield* sql`
+            UPDATE control_tokens
+            SET resolved = 1, decision_principal_json = ${JSON.stringify(requestedPrincipal)},
+                decision_json = ${JSON.stringify(answer)}
+            WHERE target_tag = ${identity.targetTag}
+              AND run_id = ${identity.runId}
+              AND target_id = ${identity.targetId}
+              AND resolved = 0
+            RETURNING token_id AS "tokenId"
+          `;
+          if (rows.length === 0) return false;
+          if (identity.targetTag === "Plan") {
+            yield* sql`UPDATE control_plans SET decision = ${decision} WHERE plan_id = ${identity.targetId}`;
+          }
+          return true;
+        })).pipe(import_effect.Effect.mapError(
+          (error) => error instanceof import_ControlError.Unauthorized || error instanceof import_ControlError.PersistenceError ? error : persistence("resolve an approval")(error)
+        ));
+        if (!resolved) return yield* new import_ControlError.AlreadyResolved({ requestId: tokenId });
+      }),
+      launch: import_effect.Effect.fn("SqlControlRuntime.launch")(function* (planId, requestedDigest, envelope, principal, reservedRunId) {
+        const row = yield* requirePlan(planId);
+        const plan = yield* storedPlan(row);
+        if (plan.card.digest !== requestedDigest) {
+          return yield* new import_ControlError.PlanDigestMismatch({
+            planId,
+            expected: plan.card.digest,
+            actual: requestedDigest
+          });
+        }
+        if (!(0, import_planning.sameEnvelope)(plan.card.envelope, envelope)) {
+          return yield* new import_ControlError.EnvelopeMismatch({
+            planId,
+            expected: (0, import_planning.canonical)(plan.card.envelope),
+            actual: (0, import_planning.canonical)(envelope)
+          });
+        }
+        if (plan.decision === "pending") {
+          const parked = {
+            _tag: "Parked",
+            receipt: {
+              _tag: "Parked",
+              receiptId: `launch:${planId}`,
+              planId,
+              status: "waiting-approval"
+            }
+          };
+          return parked;
+        }
+        if (plan.decision !== "approved") return yield* new import_ControlError.PlanDenied({ planId });
+        const sequence = yield* nextSequence("run");
+        const runId = reservedRunId ?? `run-${sequence}`;
+        const timestamp = yield* now;
+        const claimant = { ...owner, nonce: randomId() };
+        const summary = {
+          runId,
+          flowId: plan.card.flowId,
+          status: "accepted",
+          planId,
+          planDigest: plan.card.digest,
+          ...plan.card.executionDigest === void 0 ? {} : { executionDigest: plan.card.executionDigest },
+          ...options.engineVersion === void 0 ? {} : { engineVersion: options.engineVersion },
+          ownerId: JSON.stringify(claimant),
+          ...plan.card.envelope.budget.deadline === void 0 ? {} : { deadlineAt: timestamp + plan.card.envelope.budget.deadline },
+          createdAt: timestamp,
+          updatedAt: timestamp
+        };
+        yield* runStore.create(runId, JSON.stringify(summary)).pipe(
+          import_effect.Effect.mapError(persistence("create a run"))
+        );
+        yield* sql`INSERT INTO control_runs (run_id, created_seq, principal_id, principal_kind)
+          VALUES (${runId}, ${sequence}, ${principal?.id ?? null}, ${principal?.kind ?? null})`.pipe(
+          import_effect.Effect.mapError(persistence("index a run"))
+        );
+        const outcome = yield* runStore.claimAndOwn(
+          runId,
+          { status: "pending", owner: null, heartbeatAtMs: null },
+          claimant,
+          timestamp
+        ).pipe(import_effect.Effect.mapError(persistence("claim a new run")));
+        if (outcome._tag !== "Activated") return yield* new import_ControlError.ClaimLost({ runId });
+        const started = {
+          _tag: "Started",
+          receipt: (0, import_planning.accepted)(`launch:${planId}:${runId}`, runId),
+          run: withLauncher(summary, principal)
+        };
+        return started;
+      }),
+      getRun: import_effect.Effect.fn("SqlControlRuntime.getRun")(
+        (runId) => import_effect.Effect.gen(function* () {
+          const row = yield* requireRow(runId);
+          return yield* summaryFrom(row, yield* ancestryIndex(yield* ancestorChain(runId)));
+        })
+      ),
+      /**
+       * Every durable run in `flows_runs` insertion order: `control_runs`
+       * indexes only the runs this plane launched, while a child, a fork, and a
+       * later trampoline round are created by the engine straight into
+       * `flows_runs`. One indexed seek per page, with no row decoded, so a
+       * caller that walks every run holds one page of ids at a time.
+       */
+      pageRunIds: (request) => pageByRowId(request, "flows_runs", "run_id", "page runs"),
+      queryRuns: import_effect.Effect.fn("SqlControlRuntime.queryRuns")(function* (request) {
+        if (!Number.isSafeInteger(request.limit) || request.limit < 1 || request.limit > 500) {
+          return yield* new import_ControlError.InvalidInput({ issue: "limit: must be an integer between 1 and 500" });
+        }
+        const keys = yield* runPageKeys(request);
+        const selected = keys.slice(0, request.limit);
+        if (selected.length === 0) return { items: [] };
+        const chains = yield* import_effect.Effect.forEach(selected, (key) => ancestorChain(key.runId));
+        const ancestry = yield* ancestryIndex([...new Set(chains.flat())]);
+        const summaries = yield* import_effect.Effect.forEach(selected, (key) => requireRow(key.runId).pipe(
+          import_effect.Effect.flatMap((row) => import_effect.Effect.map(summaryFrom(row, ancestry), import_effect.Option.some)),
+          import_effect.Effect.catchTag("/control/RunNotFound", () => import_effect.Effect.succeed(import_effect.Option.none()))
+        ));
+        return {
+          items: summaries.filter(import_effect.Option.isSome).map((summary) => summary.value),
+          ...keys.length > request.limit ? { nextCursor: selected[selected.length - 1] } : {}
+        };
+      }),
+      listFlows: import_effect.Effect.fn("SqlControlRuntime.listFlows")(
+        () => import_effect.Effect.map(readFlows, (flows) => Array.from(flows.values(), (flow) => ({
+          flowId: flow.flowId,
+          description: flow.description
+        })))
+      )(),
+      deliverSignal: import_effect.Effect.fn("SqlControlRuntime.deliverSignal")(
+        (runId, signal) => (
+          // Durable delivery, and deliberately no resumption: a signal records a
+          // fact, it does not decide who runs next.
+          appendMessage(runId, "signal", signal)
+        )
+      ),
+      admitSignal: import_effect.Effect.fn("SqlControlRuntime.admitSignal")(function* (commandId, runId, signal, principal) {
+        yield* requireRow(runId);
+        const payloadJson = JSON.stringify(signal);
+        const principalJson = principal === void 0 ? null : JSON.stringify(principal);
+        yield* writer.write(sql`INSERT INTO control_signal_commands (command_id, run_id, payload_json, principal_json)
+          VALUES (${commandId}, ${runId}, ${payloadJson}, ${principalJson}) ON CONFLICT(command_id) DO NOTHING`).pipe(
+          import_effect.Effect.mapError(persistence("admit signal command"))
+        );
+      }),
+      signalCommand: import_effect.Effect.fn("SqlControlRuntime.signalCommand")(function* (commandId) {
+        const rows = yield* sql`
+          SELECT command_id AS "commandId", run_id AS "runId", payload_json AS "payloadJson", wait_token AS token, state,
+            principal_json AS "principalJson"
+          FROM control_signal_commands WHERE command_id = ${commandId}`.pipe(query("read signal command"));
+        const row = rows[0];
+        if (row === void 0) return void 0;
+        return {
+          commandId: row.commandId,
+          runId: row.runId,
+          token: row.token,
+          state: row.state,
+          signal: yield* decodeStoredJson("control_signal_commands.payload_json", import_ControlSchema.SignalPayload, row.payloadJson),
+          ...yield* signalPrincipal(row.principalJson)
+        };
+      }),
+      pendingSignals: import_effect.Effect.gen(function* () {
+        const read = (after) => sql`
+          SELECT seq, command_id AS "commandId", run_id AS "runId", payload_json AS "payloadJson", wait_token AS token, state,
+            principal_json AS "principalJson"
+          FROM control_signal_commands WHERE state = 'pending' AND seq > ${after} ORDER BY seq LIMIT 100`.pipe(
+          query("read pending signals")
+        );
+        let rows = yield* read(pendingSignalCursor);
+        if (rows.length === 0 && pendingSignalCursor !== 0) rows = yield* read(0);
+        pendingSignalCursor = rows.at(-1)?.seq ?? 0;
+        const decoded = yield* import_effect.Effect.forEach(
+          rows,
+          (row) => import_effect.Effect.all([
+            decodeStoredJson("control_signal_commands.payload_json", import_ControlSchema.SignalPayload, row.payloadJson),
+            signalPrincipal(row.principalJson)
+          ]).pipe(
+            import_effect.Effect.map(
+              ([signal, principal]) => import_effect.Option.some({
+                commandId: row.commandId,
+                runId: row.runId,
+                token: row.token,
+                state: row.state,
+                signal,
+                ...principal
+              })
+            ),
+            import_effect.Effect.catch(
+              (error) => writer.write(
+                sql`UPDATE control_signal_commands SET state = 'rejected' WHERE command_id = ${row.commandId} AND state = 'pending'`
+              ).pipe(
+                import_effect.Effect.mapError(persistence("quarantine malformed signal")),
+                import_effect.Effect.andThen(
+                  import_effect.Effect.logWarning("Malformed admitted signal rejected", { commandId: row.commandId, error })
+                ),
+                import_effect.Effect.as(import_effect.Option.none())
+              )
+            )
+          )
+        );
+        return decoded.filter(import_effect.Option.isSome).map((item) => item.value);
+      }),
+      bindSignal: import_effect.Effect.fn("SqlControlRuntime.bindSignal")(
+        (commandId, token) => writer.write(import_effect.Effect.gen(function* () {
+          yield* sql`UPDATE control_signal_commands SET wait_token = ${token} WHERE command_id = ${commandId} AND wait_token IS NULL AND state = 'pending' AND NOT EXISTS (SELECT 1 FROM control_signal_commands WHERE wait_token = ${token})`;
+          const rows = yield* sql`SELECT wait_token AS token FROM control_signal_commands WHERE command_id = ${commandId}`;
+          if (rows[0] === void 0) {
+            return yield* new import_ControlError.PersistenceError({
+              operation: "bind signal",
+              message: `No pending signal command ${commandId}`
+            });
+          }
+          return rows[0].token;
+        })).pipe(import_effect.Effect.mapError(persistence("bind signal")))
+      ),
+      settleSignal: import_effect.Effect.fn("SqlControlRuntime.settleSignal")(
+        (commandId, state) => writer.write(
+          sql`UPDATE control_signal_commands SET state = ${state} WHERE command_id = ${commandId} AND state = 'pending'`
+        ).pipe(import_effect.Effect.asVoid, import_effect.Effect.mapError(persistence("settle signal")))
+      ),
+      deliveredSignals: import_effect.Effect.fn("SqlControlRuntime.deliveredSignals")(function* (runId) {
+        yield* requireRow(runId);
+        const legacy = yield* messages(runId, "signal", import_ControlSchema.SignalPayload);
+        const rows = yield* sql`SELECT payload_json AS "payloadJson" FROM control_signal_commands WHERE run_id = ${runId} AND state != 'rejected' ORDER BY seq`.pipe(query("read admitted signals"));
+        return [
+          ...legacy,
+          ...yield* import_effect.Effect.forEach(
+            rows,
+            (row) => decodeStoredJson("control_signal_commands.payload_json", import_ControlSchema.SignalPayload, row.payloadJson)
+          )
+        ];
+      }),
+      requestResume: import_effect.Effect.fn("SqlControlRuntime.requestResume")(function* (runId, options2) {
+        const summary = yield* summaryOf(yield* requireRow(runId));
+        if (terminal(summary.status)) {
+          return yield* new import_ControlError.InvalidInput({
+            issue: `run ${runId} is ${summary.status} and cannot take a resume`
+          });
+        }
+        const sequence = yield* nextSequence("resume");
+        const timestamp = yield* now;
+        const consent = options2?.consent ?? null;
+        yield* writer.write(sql`
+          INSERT INTO control_run_resumes (run_id, requested_seq, requested_at_ms, consent_seq)
+          VALUES (${runId}, ${sequence}, ${timestamp}, ${consent})
+          ON CONFLICT (run_id) DO UPDATE SET
+            requested_seq = excluded.requested_seq,
+            requested_at_ms = excluded.requested_at_ms,
+            consent_seq = COALESCE(excluded.consent_seq, control_run_resumes.consent_seq)
+        `).pipe(import_effect.Effect.mapError(persistence("record a resume delegation")));
+        return sequence;
+      }),
+      // Terminal runs are filtered in SQL: a delegation nobody will ever take
+      // up must not keep appearing in every host's poll.
+      pendingResumes: sql`
+        SELECT resumes.run_id AS "runId",
+               resumes.requested_seq AS "requestedSeq",
+               resumes.requested_at_ms AS "requestedAtMs",
+               resumes.consent_seq AS "consentSeq"
+        FROM control_run_resumes AS resumes
+        JOIN flows_runs AS runs ON runs.run_id = resumes.run_id
+        WHERE runs.status NOT IN ('completed', 'failed', 'cancelled')
+        ORDER BY resumes.requested_seq
+      `.pipe(
+        query("read pending resumes"),
+        import_effect.Effect.map(
+          (rows) => rows.map((row) => ({
+            runId: row.runId,
+            sequence: Number(row.requestedSeq),
+            requestedAtMs: Number(row.requestedAtMs),
+            ...row.consentSeq === null ? {} : { consent: Number(row.consentSeq) }
+          }))
+        )
+      ),
+      clearResume: import_effect.Effect.fn("SqlControlRuntime.clearResume")(
+        (runId, sequence) => writer.write(sql`
+          DELETE FROM control_run_resumes WHERE run_id = ${runId} AND requested_seq = ${sequence}
+        `).pipe(import_effect.Effect.mapError(persistence("clear a resume delegation")), import_effect.Effect.asVoid)
+      ),
+      registerFiber: import_effect.Effect.fn("SqlControlRuntime.registerFiber")(function* (runId, fiber) {
+        yield* requireRow(runId);
+        ActiveFibers.register(fibers, runId, fiber);
+      }),
+      interrupt: import_effect.Effect.fn("SqlControlRuntime.interrupt")(function* (runId, settle = (effect) => effect) {
+        const row = yield* requireRow(runId);
+        const summary = yield* summaryOf(row);
+        if (terminal(summary.status)) return summary;
+        if (!ownedByUs(row)) return yield* new import_ControlError.ClaimLost({ runId });
+        const fiber = fibers.get(runId);
+        if (fiber !== void 0) yield* import_effect.Fiber.interrupt(fiber);
+        if (fibers.get(runId) === fiber) fibers.delete(runId);
+        return yield* settle(
+          writer.write(import_effect.Effect.gen(function* () {
+            const current = yield* summaryOf(yield* requireRow(runId));
+            if (terminal(current.status)) return current;
+            return yield* transition(runId, row.owner, current, "cancelled");
+          })).pipe(
+            import_effect.Effect.catchTag(
+              "@smthrs/database/DatabaseError",
+              (error) => import_effect.Effect.fail(persistence("settle an interrupted run")(error))
+            )
+          )
+        );
+      }),
+      codeDrift: import_effect.Effect.fn("SqlControlRuntime.codeDrift")(function* (runId) {
+        const summary = yield* recordedCode(yield* requireRow(runId));
+        const current = (yield* readCurrentFlows).get(summary.flowId);
+        const pinned = summary.executionDigest === void 0 || options.pinnedFlow === void 0 ? void 0 : yield* options.pinnedFlow(summary.flowId, summary.executionDigest);
+        return (0, import_planning.codeDriftOf)(
+          summary,
+          pinned === true ? { executionDigest: summary.executionDigest } : pinned === false ? void 0 : current,
+          options.engineVersion
+        );
+      }),
+      recordedCode: import_effect.Effect.fn("SqlControlRuntime.recordedCode")(function* (runId) {
+        const { executionDigest, engineVersion } = yield* recordedCode(yield* requireRow(runId));
+        return { executionDigest, engineVersion };
+      }),
+      resume: import_effect.Effect.fn("SqlControlRuntime.resume")((runId, resumeOptions) => resumeRun(runId, resumeOptions?.scope)),
+      resumeAdopting: import_effect.Effect.fn("SqlControlRuntime.resumeAdopting")((runId, resumeOptions) => resumeRun(runId, resumeOptions?.scope, adoptable)),
+      claimFence: import_effect.Effect.fn("SqlControlRuntime.claimFence")(function* (runId) {
+        const row = yield* requireRow(runId);
+        if (!ownedByUs(row)) return yield* new import_ControlError.ClaimLost({ runId });
+        return JSON.stringify(row.owner);
+      }),
+      releasePending: import_effect.Effect.fn("SqlControlRuntime.releasePending")(function* (runId, fence) {
+        const row = yield* requireRow(runId);
+        const presented = yield* decodeStoredJson("control fence", import_run_store.Ownership.OwnerId, fence).pipe(
+          import_effect.Effect.mapError(() => new import_ControlError.ClaimLost({ runId }))
+        );
+        const timestamp = yield* now;
+        const next = {
+          ...yield* summaryOf(row),
+          status: "accepted",
+          ownerId: void 0,
+          parkedBy: void 0,
+          updatedAt: timestamp
+        };
+        const outcome = yield* runStore.transitionOwned(
+          runId,
+          presented,
+          "suspended",
+          JSON.stringify(next)
+        ).pipe(import_effect.Effect.mapError(persistence("release a pending run")));
+        if (outcome._tag === "NotFound") return yield* new import_ControlError.RunNotFound({ runId });
+        if (outcome._tag !== "Transitioned") return yield* new import_ControlError.ClaimLost({ runId });
+        return next;
+      }),
+      writeStatus: import_effect.Effect.fn("SqlControlRuntime.writeStatus")(function* (runId, fence, status) {
+        const row = yield* requireRow(runId);
+        const presented = yield* decodeStoredJson("control fence", import_run_store.Ownership.OwnerId, fence).pipe(
+          import_effect.Effect.mapError(() => new import_ControlError.ClaimLost({ runId }))
+        );
+        return yield* transition(runId, presented, yield* summaryOf(row), status);
+      }),
+      /**
+       * The submitted identity wins, and only the clock is the runtime's.
+       *
+       * `Control.RunMutationInput` states the order: the runtime "supplies its
+       * own principal when the caller names none". The submitted one is the
+       * identity the server authenticated at its boundary, so a composition
+       * default that overrode it would rename every remote operator to
+       * whatever this process was built with.
+       */
+      stampPrincipal: import_effect.Effect.fn("SqlControlRuntime.stampPrincipal")(function* (submitted) {
+        const timestamp = yield* now;
+        return {
+          id: submitted?.id ?? options.principal?.id ?? "local",
+          kind: submitted?.kind ?? options.principal?.kind ?? "operator",
+          stampedAt: timestamp
+        };
+      }),
+      lookupMutation: import_effect.Effect.fn("SqlControlRuntime.lookupMutation")(function* (key, fingerprint) {
+        const rows = yield* sql`
+          SELECT fingerprint, receipt_json AS "receiptJson" FROM control_mutations WHERE mutation_key = ${key}
+        `.pipe(query("read a mutation"));
+        const row = rows[0];
+        if (row === void 0) return void 0;
+        if (row.fingerprint !== fingerprint) {
+          return { _tag: "Conflict", message: `idempotency key ${key} was used for another mutation` };
+        }
+        const receipt = yield* decodeStoredJson("control_mutations.receipt_json", import_ControlSchema.Receipt, row.receiptJson);
+        return (0, import_planning.alreadyApplied)(key, receipt);
+      }),
+      recordMutation: import_effect.Effect.fn("SqlControlRuntime.recordMutation")(
+        (key, fingerprint, receipt) => writer.write(import_effect.Effect.gen(function* () {
+          yield* sql`
+          INSERT INTO control_mutations (mutation_key, fingerprint, receipt_json)
+          VALUES (${key}, ${fingerprint}, ${JSON.stringify(receipt)})
+          ON CONFLICT (mutation_key) DO NOTHING
+        `;
+          const rows = yield* sql`
+          SELECT fingerprint, receipt_json AS "receiptJson"
+          FROM control_mutations WHERE mutation_key = ${key}
+        `;
+          const stored = rows[0];
+          if (stored === void 0 || stored.fingerprint !== fingerprint || stored.receiptJson !== JSON.stringify(receipt)) {
+            return yield* import_effect.Effect.fail(
+              new import_ControlError.PersistenceError({
+                operation: "record a mutation",
+                message: `Idempotency key ${key} was already settled by another mutation`
+              })
+            );
+          }
+        })).pipe(
+          import_effect.Effect.asVoid,
+          import_effect.Effect.mapError(
+            (cause) => cause instanceof import_ControlError.PersistenceError ? cause : persistence("record a mutation")(cause)
+          )
+        )
+      ),
+      claimRunKey: import_effect.Effect.fn("SqlControlRuntime.claimRunKey")((key, fingerprint) => {
+        const claimant = randomId();
+        return writer.write(import_effect.Effect.gen(function* () {
+          yield* sql`
+            INSERT INTO control_run_keys (idempotency_key, fingerprint, claimant)
+            VALUES (${key}, ${fingerprint}, ${claimant})
+            ON CONFLICT (idempotency_key) DO NOTHING
+          `;
+          const holders = yield* sql`
+            SELECT fingerprint, claimant FROM control_run_keys
+            WHERE idempotency_key = ${key}
+          `;
+          const holder = holders[0];
+          if (holder === void 0) {
+            return yield* new import_ControlError.PersistenceError({
+              operation: "claim a run key",
+              message: `Run key ${key} disappeared while it was being claimed`
+            });
+          }
+          if (holder.fingerprint !== fingerprint) {
+            return yield* new import_ControlError.InvalidInput({
+              issue: `idempotency key ${key} was used for another run`
+            });
+          }
+          if (holder.claimant === claimant) return { _tag: "Claimed" };
+          const rows = yield* sql`
+            SELECT fingerprint, receipt_json AS "receiptJson"
+            FROM control_mutations WHERE mutation_key = ${key}
+          `;
+          const record = rows[0];
+          if (record === void 0 || record.fingerprint !== fingerprint) {
+            return yield* new import_ControlError.PersistenceError({
+              operation: "claim a run key",
+              message: `Run key ${key} has no matching settled receipt`
+            });
+          }
+          const receipt = yield* decodeStoredJson("control_mutations.receipt_json", import_ControlSchema.Receipt, record.receiptJson);
+          return { _tag: "Raced", receipt };
+        })).pipe(
+          import_effect.Effect.mapError(
+            (cause) => cause instanceof import_ControlError.InvalidInput || cause instanceof import_ControlError.PersistenceError ? cause : persistence("claim a run key")(cause)
+          )
+        );
+      }),
+      releaseRunKey: import_effect.Effect.fn("SqlControlRuntime.releaseRunKey")(
+        (key) => writer.write(sql`
+          DELETE FROM control_run_keys WHERE idempotency_key = ${key}
+        `).pipe(
+          import_effect.Effect.asVoid,
+          import_effect.Effect.mapError(persistence("release a run key"))
+        )
+      ),
+      grants: import_effect.Effect.fn("SqlControlRuntime.grants")(
+        () => sql`
+          SELECT token_id AS "tokenId", envelope_json AS "envelopeJson",
+                 scope, installed_at_ms AS "installedAtMs"
+          FROM control_grants ORDER BY installed_at_ms, target_tag, run_id, target_id
+        `.pipe(
+          query("list grants"),
+          import_effect.Effect.flatMap(
+            (rows) => import_effect.Effect.forEach(rows, (row) => import_effect.Effect.all({
+              envelope: decodeStoredJson("control_grants.envelope_json", import_ControlSchema.Envelope, row.envelopeJson),
+              scope: decodeStoredValue("control_grants.scope", import_ControlSchema.GrantScope, row.scope)
+            }).pipe(
+              import_effect.Effect.map(({ envelope, scope }) => ({
+                tokenId: row.tokenId,
+                envelope,
+                scope,
+                installedAt: Number(row.installedAtMs)
+              }))
+            ))
+          )
+        )
+      )()
+    });
+    return service;
+  });
+};
+const layer = (options = {}) => import_effect.Layer.effect(import_ControlRuntime.ControlRuntime)(makeRuntime(options));
+const layerWithStore = (options = {}) => layer(options).pipe(import_effect.Layer.provideMerge(import_run_store.RunStore.layer));
+//# sourceMappingURL=SqlControlRuntime.js.map