@smthrs/control 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/ControlLive.js

@@ -0,0 +1,1293 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ControlLive_exports = {};
+__export(ControlLive_exports, {
+  layer: () => layer
+});
+module.exports = __toCommonJS(ControlLive_exports);
+var Sha256 = __toESM(require("@smthrs/crypto/Sha256"), 1);
+var Fault = __toESM(require("@smthrs/flow/Fault"), 1);
+var import_journal = require("@smthrs/journal");
+var import_notifications = require("@smthrs/notifications");
+var SteerPayload = __toESM(require("@smthrs/notifications/SteerPayload"), 1);
+var import_registry = require("@smthrs/registry");
+var import_Descriptor = require("@smthrs/registry/Descriptor");
+var import_effect = require("effect");
+var Cancellation = __toESM(require("./Cancellation.js"), 1);
+var import_Control = require("./Control.js");
+var import_ControlError = require("./ControlError.js");
+var import_ControlExecutor = require("./ControlExecutor.js");
+var ControlFacts = __toESM(require("./ControlFacts.js"), 1);
+var import_ControlRuntime = require("./ControlRuntime.js");
+var import_ControlSchema = require("./ControlSchema.js");
+var DispatchReader = __toESM(require("./DispatchReader.js"), 1);
+var import_issues = require("./internal/issues.js");
+var MutationBoundary = __toESM(require("./internal/MutationBoundary.js"), 1);
+var import_planning = require("./internal/planning.js");
+var Lineage = __toESM(require("./Lineage.js"), 1);
+var Steering = __toESM(require("./Steering.js"), 1);
+const sourceId = import_journal.JournalEvent.SourceId.make("/control");
+const snapshotPageSize = 1024;
+const snapshotPartitionConcurrency = 8;
+const partitionPageSize = 100;
+const unavailable = (feature) => new import_ControlError.Unavailable({ feature, ticket: "control-runtime-engine-integration" });
+const watchReadFailed = (cause) => cause.code === "journal_closed" ? unavailable("watch") : new import_ControlError.PersistenceError({
+  operation: "watch",
+  message: `Reading the control journal failed (${cause.code})`,
+  cause
+});
+const accepted = (key, runId) => runId === void 0 ? { _tag: "Accepted", receiptId: key } : { _tag: "Accepted", receiptId: key, runId };
+const terminal = (status) => status === "cancelled" || status === "completed" || status === "failed";
+const live = (status) => status === "running" || status === "accepted";
+const terminalOrAccepted = (key, run) => terminal(run.status) ? { _tag: "Terminal", runId: run.runId, status: run.status } : accepted(key, run.runId);
+const withoutStampedPrincipal = (input) => {
+  if (input === null || typeof input !== "object") return input;
+  const { principal: _principal, ...rest } = input;
+  const message = rest["message"];
+  if (message === null || typeof message !== "object") return rest;
+  const { principal: _messagePrincipal, ...messageRest } = message;
+  return { ...rest, message: messageRest };
+};
+const fingerprint = (operation, principal, input) => `control-mutation:v2:${Sha256.digestSync((0, import_planning.canonical)({
+  operation,
+  actor: { id: principal.id, kind: principal.kind },
+  intent: withoutStampedPrincipal(input)
+}))}`;
+const json = (value) => JSON.parse(JSON.stringify(value));
+const declaredTrigger = (decodedInput) => {
+  if (decodedInput === null || typeof decodedInput !== "object" || Array.isArray(decodedInput)) return void 0;
+  const held = decodedInput["trigger"];
+  return held !== null && typeof held === "object" && !Array.isArray(held) ? held : void 0;
+};
+const invalid = (issue) => new import_ControlError.InvalidInput({ issue });
+const AttributedApprovalInput = import_effect.Schema.Struct({
+  ...import_ControlSchema.ApprovalInputSchema.fields,
+  principal: import_effect.Schema.optional(import_ControlSchema.Principal)
+});
+const AttributedReasonedMutationInput = import_effect.Schema.Struct({
+  ...import_ControlSchema.ReasonedMutationInputSchema.fields,
+  principal: import_effect.Schema.optional(import_ControlSchema.Principal)
+});
+const AttributedResumeInput = import_effect.Schema.Struct({
+  ...import_ControlSchema.ResumeInputSchema.fields,
+  principal: import_effect.Schema.optional(import_ControlSchema.Principal)
+});
+const AttributedRunInput = import_effect.Schema.Union([
+  import_effect.Schema.Struct({
+    ...import_ControlSchema.RunInputSchema.members[0].fields,
+    principal: import_effect.Schema.optional(import_ControlSchema.Principal),
+    reservedRunId: import_effect.Schema.optional(import_effect.Schema.NonEmptyString)
+  }),
+  import_effect.Schema.Struct({ ...import_ControlSchema.RunInputSchema.members[1].fields, principal: import_effect.Schema.optional(import_ControlSchema.Principal) })
+]);
+const AttributedSignalInput = import_effect.Schema.Struct({
+  ...import_ControlSchema.SignalInputSchema.fields,
+  principal: import_effect.Schema.optional(import_ControlSchema.Principal)
+});
+const validIdempotencyKey = (value) => {
+  if (value.length === 0 || value.length > 1024 || value.includes("\0")) return false;
+  for (let index = 0; index < value.length; index++) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const low = value.charCodeAt(++index);
+      if (!(low >= 56320 && low <= 57343)) return false;
+      continue;
+    }
+    if (unit >= 56320 && unit <= 57343) return false;
+  }
+  return true;
+};
+const snapshotMutation = (operation, decode, input) => import_effect.Effect.suspend(() => {
+  const admitted = MutationBoundary.admit(input);
+  if (!admitted.ok) return import_effect.Effect.fail(invalid(`${operation}: ${admitted.complaint}`));
+  return decode(admitted.value).pipe(
+    import_effect.Effect.mapError((error) => invalid(`${operation}: invalid mutation at ${(0, import_issues.schemaIssuePath)(error)}`)),
+    import_effect.Effect.flatMap(
+      (snapshot) => validIdempotencyKey(snapshot.idempotencyKey) ? import_effect.Effect.succeed(snapshot) : import_effect.Effect.fail(invalid(`${operation}.idempotencyKey: must be 1 to 1024 well-formed characters`))
+    )
+  );
+});
+const snapshotApproval = (operation, input) => snapshotMutation(operation, import_effect.Schema.decodeUnknownEffect(AttributedApprovalInput), input);
+const snapshotReasonedMutation = (operation, input) => snapshotMutation(operation, import_effect.Schema.decodeUnknownEffect(AttributedReasonedMutationInput), input);
+const snapshotResume = (input) => snapshotMutation("resume", import_effect.Schema.decodeUnknownEffect(AttributedResumeInput), input);
+const snapshotRun = (input) => snapshotMutation("run", import_effect.Schema.decodeUnknownEffect(AttributedRunInput), input);
+const snapshotSignal = (input) => snapshotMutation("signal", import_effect.Schema.decodeUnknownEffect(AttributedSignalInput), input);
+const snapshotSteer = (input) => snapshotMutation("steer", import_effect.Schema.decodeUnknownEffect(import_ControlSchema.SteerInputSchema), input);
+const pageBounds = (cursor, limit) => {
+  if (limit !== void 0 && (!Number.isSafeInteger(limit) || limit < 1 || limit > import_ControlSchema.maxPageSize)) {
+    return import_effect.Effect.fail(
+      invalid(`limit: must be an integer between 1 and ${import_ControlSchema.maxPageSize}, received ${String(limit)}`)
+    );
+  }
+  if (cursor === void 0) return import_effect.Effect.succeed({ start: 0, size: limit ?? import_ControlSchema.defaultPageSize });
+  const start = Number(cursor);
+  return Number.isSafeInteger(start) && start >= 0 ? import_effect.Effect.succeed({ start, size: limit ?? import_ControlSchema.defaultPageSize }) : import_effect.Effect.fail(invalid(`cursor: must be a cursor this listing returned, received ${JSON.stringify(cursor)}`));
+};
+const cursorNatural = import_effect.Schema.Number.check(
+  import_effect.Schema.isInt(),
+  import_effect.Schema.isGreaterThanOrEqualTo(0),
+  import_effect.Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)
+);
+const runCursor = import_effect.Schema.fromJsonString(import_effect.Schema.Struct({
+  version: import_effect.Schema.Literal(1),
+  filters: import_effect.Schema.String,
+  source: import_effect.Schema.Union([import_effect.Schema.Literal(0), import_effect.Schema.Literal(1)]),
+  sequence: cursorNatural,
+  createdAt: cursorNatural,
+  runId: import_effect.Schema.NonEmptyString
+}));
+const page = (values, bounds) => {
+  const items = values.slice(bounds.start, bounds.start + bounds.size);
+  const next = bounds.start + items.length;
+  return next < values.length ? { items, nextCursor: String(next) } : { items };
+};
+const eventFromEntry = (entry) => ({
+  sequence: entry.seq,
+  kind: entry.eventType,
+  runId: entry.runId,
+  occurredAt: entry.emittedAtMs,
+  payload: entry.payload
+});
+const layer = import_effect.Layer.effect(
+  import_Control.Control,
+  import_effect.Effect.gen(function* () {
+    const runtime = yield* import_ControlRuntime.ControlRuntime;
+    const journal = yield* import_journal.Journal.Journal;
+    const notifications = yield* import_notifications.NotificationQueue.NotificationQueue;
+    const registry = yield* import_registry.Registry.Registry;
+    const executor = yield* import_effect.Effect.serviceOption(import_ControlExecutor.ControlExecutor);
+    const dispatch = import_effect.Option.getOrElse(
+      yield* import_effect.Effect.serviceOption(DispatchReader.DispatchReader),
+      DispatchReader.makeNone
+    );
+    const observing = import_effect.Option.isSome(executor) && executor.value.readExecution !== void 0;
+    const observe = (run) => import_effect.Effect.gen(function* () {
+      if (import_effect.Option.isNone(executor) || executor.value.readExecution === void 0) return run;
+      const observed = yield* executor.value.readExecution(run.runId);
+      if (observed._tag === "Missing") return { ...run, executionObservation: "missing" };
+      return {
+        ...run,
+        executionObservation: "observed",
+        executionView: observed.executionView,
+        status: observed.status,
+        waitingReason: observed.waitingReason,
+        parentRunId: observed.parentRunId,
+        lineageId: observed.lineageId,
+        roundOrdinal: observed.roundOrdinal,
+        // The executor's answer replaces this plane's copy here as it does
+        // for every other observed field. It has to: a control plane over
+        // its own coordination database cannot see the executions a flow
+        // spawned, so a nested `HumanTask` park is a fact only the executor
+        // holds. Where the two share one database the runtime computes the
+        // same rows itself and the observation reproduces them.
+        pendingWaits: observed.pendingWaits
+      };
+    });
+    const getRun = (runId) => runtime.getRun(runId).pipe(import_effect.Effect.flatMap(observe));
+    const refuseCodeDrift = (runId) => runtime.codeDrift(runId).pipe(import_effect.Effect.flatMap((drift) => drift === void 0 ? import_effect.Effect.void : import_effect.Effect.fail(drift)));
+    const withCodeDrift = (run) => terminal(run.status) ? import_effect.Effect.succeed(run) : runtime.codeDrift(run.runId).pipe(
+      import_effect.Effect.map(
+        (drift) => drift === void 0 ? run : {
+          ...run,
+          codeDrift: {
+            ...drift.recorded === void 0 ? {} : { recorded: drift.recorded },
+            ...drift.current === void 0 ? {} : { current: drift.current },
+            ...drift.recordedEngine === void 0 ? {} : { recordedEngine: drift.recordedEngine },
+            ...drift.currentEngine === void 0 ? {} : { currentEngine: drift.currentEngine }
+          }
+        }
+      ),
+      import_effect.Effect.orElseSucceed(() => run)
+    );
+    const mutationSemaphore = yield* import_effect.Semaphore.make(1);
+    const record = (runId, eventType, payload) => (
+      // Unfenced: the control plane mutates runs it does not own — that is
+      // the point of a control plane — so its event records are
+      // first-writer-wins admissions, not owner-fenced lifecycle writes.
+      journal.emitDurableUnfenced(
+        new import_journal.JournalEvent.Input({
+          runId: import_journal.JournalEvent.RunId.make(runId),
+          sourceId,
+          eventType,
+          payload: json(payload)
+        })
+      ).pipe(
+        import_effect.Effect.map((receipt) => receipt.seq),
+        import_effect.Effect.mapError(
+          (cause) => new import_ControlError.PersistenceError({
+            operation: eventType,
+            message: `Failed to persist ${eventType}`,
+            cause
+          })
+        )
+      )
+    );
+    const emit = (runId, eventType, payload) => import_effect.Effect.asVoid(record(runId, eventType, payload));
+    const settleUnlaunched = (runId, cause, fault) => import_effect.Effect.gen(function* () {
+      const fence = yield* runtime.claimFence(runId);
+      const run = yield* runtime.writeStatus(runId, fence, "failed");
+      yield* emit(
+        runId,
+        "control.run.failed",
+        json({ runId, status: "failed", cause: cause.slice(0, 4096), fault, ...ControlFacts.runFact(run) })
+      );
+    }).pipe(
+      journal.transact,
+      import_effect.Effect.catchCause(
+        (failure) => import_effect.Effect.annotateLogs(
+          import_effect.Effect.logWarning("A refused launch could not be settled"),
+          { runId, cause: import_effect.Cause.pretty(failure) }
+        )
+      )
+    );
+    const transact = (operation, effect) => mutationSemaphore.withPermits(1)(
+      journal.transact(effect).pipe(
+        import_effect.Effect.mapError(
+          (cause) => cause instanceof import_journal.Journal.JournalError ? new import_ControlError.PersistenceError({
+            operation: `${operation}.idempotency`,
+            message: `Failed to commit ${operation} and its idempotency receipt atomically`,
+            cause
+          }) : cause
+        )
+      )
+    );
+    const mutate = (operation, key, principal, mutationFingerprint, effect, replay = true, claimRunKey = false) => transact(
+      operation,
+      import_effect.Effect.gen(function* () {
+        const durableKey = (0, import_planning.mutationKey)(operation, key, principal);
+        const prior = yield* runtime.lookupMutation(durableKey, mutationFingerprint);
+        if (prior !== void 0 && (replay || prior._tag === "Conflict")) {
+          return prior._tag === "AlreadyApplied" ? { ...prior, receiptId: key } : prior;
+        }
+        const claim = claimRunKey ? yield* runtime.claimRunKey(durableKey, mutationFingerprint) : void 0;
+        if (claim?._tag === "Raced") return (0, import_planning.alreadyApplied)(key, claim.receipt);
+        return yield* import_effect.Effect.gen(function* () {
+          const receipt = yield* effect;
+          if (receipt._tag === "Parked" && claimRunKey) {
+            yield* runtime.releaseRunKey(durableKey);
+          } else if (receipt._tag !== "Parked" && prior === void 0) {
+            yield* runtime.recordMutation(durableKey, mutationFingerprint, receipt);
+          }
+          return receipt;
+        }).pipe(import_effect.Effect.onExit(
+          (exit) => claim?._tag === "Claimed" && import_effect.Exit.isFailure(exit) ? runtime.releaseRunKey(durableKey) : import_effect.Effect.void
+        ));
+      })
+    );
+    const takeUpResume = (runId, sequence) => import_effect.Option.isNone(executor) ? import_effect.Effect.void : executor.value.resumeRun({ runId }).pipe(
+      import_effect.Effect.flatMap((uptake) => uptake === "resuming" ? runtime.clearResume(runId, sequence) : import_effect.Effect.void)
+    );
+    const hand = (launch) => import_effect.Effect.gen(function* () {
+      const acceptance = import_effect.Option.isSome(executor) ? yield* executor.value.launch(launch).pipe(
+        import_effect.Effect.tapError((error) => settleUnlaunched(error.runId, error.message, Fault.of(error)))
+      ) : "pending";
+      yield* transact(
+        "run.acceptance",
+        import_effect.Effect.gen(function* () {
+          const current = yield* runtime.getRun(launch.run.runId);
+          if (current.status !== "accepted") return;
+          const fence = yield* runtime.claimFence(current.runId);
+          const run = acceptance === "accepted" ? yield* runtime.writeStatus(current.runId, fence, "running") : yield* runtime.releasePending(current.runId, fence);
+          yield* emit(
+            run.runId,
+            acceptance === "accepted" ? "control.run.running" : "control.run.pending",
+            {
+              runId: run.runId,
+              status: run.status,
+              ...ControlFacts.runFact(run)
+            }
+          );
+        })
+      );
+    });
+    const relaunchStranded = (runId) => import_effect.Effect.gen(function* () {
+      const current = yield* runtime.getRun(runId);
+      if (current.status !== "accepted" || current.ownerId === void 0) return;
+      const ours = yield* runtime.claimFence(runId).pipe(
+        import_effect.Effect.as(true),
+        import_effect.Effect.catchTag("/control/ClaimLost", () => import_effect.Effect.succeed(false))
+      );
+      if (ours) return;
+      yield* refuseCodeDrift(runId);
+      const claimed = yield* runtime.resume(runId, { scope: "launched" }).pipe(
+        import_effect.Effect.catchTag("/control/ClaimLost", () => import_effect.Effect.succeed(void 0))
+      );
+      if (claimed === void 0 || claimed.status !== "accepted" || claimed.planId === void 0) return;
+      yield* hand({ plan: yield* runtime.getPlan(claimed.planId), run: claimed });
+    }).pipe(
+      // The recorded receipt is the retry's answer either way; a relaunch
+      // that fails leaves the run where it was for the next retry.
+      import_effect.Effect.catch(
+        (failure) => import_effect.Effect.annotateLogs(
+          import_effect.Effect.logWarning("A stranded run could not be relaunched"),
+          { runId, cause: failure.message }
+        )
+      )
+    );
+    const decide = (decision, submitted) => import_effect.Effect.gen(function* () {
+      const input = yield* snapshotApproval(decision, submitted);
+      const principal = yield* runtime.stampPrincipal(input.principal);
+      return yield* decideAs(decision, input, principal).pipe(
+        // Every refusal leaves a durable audit record: who asked, for which
+        // target, under which scope. The journal row's time is when. It is
+        // written after the refused mutation rolled back, so it is the only
+        // row the refusal adds; a record that cannot be written fails the
+        // call rather than leaving an unaudited refusal.
+        import_effect.Effect.catchTag("/control/Unauthorized", (refusal) => emit(
+          input.target._tag === "Plan" ? `plan:${input.target.planId}` : input.target.runId,
+          "control.approval.refused",
+          json({ decision, principal, scope: input.scope, target: input.target })
+        ).pipe(import_effect.Effect.andThen(import_effect.Effect.fail(refusal))))
+      );
+    });
+    const decideAs = (decision, input, principal) => import_effect.Effect.gen(function* () {
+      yield* runtime.authorizeApproval({ principal, target: input.target, decision, scope: input.scope });
+      if (input.target._tag === "Node") {
+        const current = yield* getRun(input.target.runId).pipe(
+          import_effect.Effect.catchTag("/control/RunNotFound", () => import_effect.Effect.succeed(void 0))
+        );
+        if (current !== void 0 && terminal(current.status)) {
+          const settled = { _tag: "Terminal", runId: current.runId, status: current.status };
+          return settled;
+        }
+      }
+      let delegated;
+      const receipt = yield* mutate(
+        decision,
+        input.idempotencyKey,
+        principal,
+        fingerprint(decision, principal, input),
+        import_effect.Effect.gen(function* () {
+          if (input.target._tag === "Node") yield* refuseCodeDrift(input.target.runId);
+          const token = yield* runtime.lookupApproval(input.target);
+          yield* runtime.resolveApproval(token, decision, principal, input.scope);
+          if (decision === "approved") {
+            yield* runtime.installBulkGrant(token, input.target.envelope, input.scope);
+          }
+          yield* emit(
+            input.target._tag === "Plan" ? `plan:${input.target.planId}` : input.target.runId,
+            `control.approval.${decision}`,
+            json({
+              ...ControlFacts.approvalDecisionFact(token.tokenId, input.target),
+              target: input.target._tag,
+              scope: input.scope,
+              envelope: input.target.envelope,
+              principal
+            })
+          );
+          if (input.target._tag === "Plan") return accepted(input.idempotencyKey);
+          const runId = input.target.runId;
+          delegated = yield* runtime.requestResume(runId);
+          yield* emit(runId, "control.run.resumed", { runId });
+          return accepted(input.idempotencyKey, runId);
+        })
+      );
+      if (input.target._tag === "Node" && delegated !== void 0) {
+        yield* takeUpResume(input.target.runId, delegated);
+      }
+      return receipt;
+    });
+    const runMutation = (submitted) => import_effect.Effect.gen(function* () {
+      const input = yield* snapshotResume(submitted);
+      const settled = yield* getRun(input.runId);
+      if (terminal(settled.status)) {
+        return { _tag: "Terminal", runId: settled.runId, status: settled.status };
+      }
+      const principal = yield* runtime.stampPrincipal(input.principal);
+      return yield* mutate(
+        "resume",
+        input.idempotencyKey,
+        principal,
+        fingerprint("resume", principal, input),
+        import_effect.Effect.gen(function* () {
+          const current = yield* getRun(input.runId);
+          if (terminal(current.status)) {
+            return { _tag: "Terminal", runId: current.runId, status: current.status };
+          }
+          if (input.allowCodeDrift !== true) yield* refuseCodeDrift(input.runId);
+          let handedTo;
+          const claimed = yield* (input.allowCodeDrift === true ? runtime.resumeAdopting(input.runId, { scope: "launched" }) : runtime.resume(input.runId, { scope: "launched" })).pipe(
+            import_effect.Effect.catchTag("/control/ClaimLost", (error) => {
+              if (error.parkedBy !== void 0) {
+                handedTo = error.parkedBy;
+                return import_effect.Effect.succeed(void 0);
+              }
+              if (error.reason !== void 0) return import_effect.Effect.fail(error);
+              return runtime.getRun(input.runId).pipe(import_effect.Effect.flatMap(
+                (stored) => (
+                  // A retained fork is parked in control and pending in the
+                  // engine. Its accepted read overlay is not a live claim.
+                  // Never replace that engine continuation with control state.
+                  live(stored.status) || live(current.status) && current.executionView?.current.status !== "pending" ? import_effect.Effect.fail(new import_ControlError.ClaimLost({ runId: input.runId })) : import_effect.Effect.succeed(void 0)
+                )
+              ));
+            })
+          );
+          const sequence = yield* record(
+            input.runId,
+            "control.run.resume",
+            json({
+              runId: input.runId,
+              status: (claimed ?? current).status,
+              ...claimed === void 0 ? {} : ControlFacts.runFact(claimed),
+              principal,
+              ...input.reason === void 0 ? {} : { reason: input.reason },
+              ...handedTo === void 0 ? {} : { handedTo }
+            })
+          );
+          if (handedTo !== void 0) {
+            yield* runtime.requestResume(input.runId, { consent: sequence });
+            const handedOff = {
+              _tag: "Accepted",
+              receiptId: input.idempotencyKey,
+              runId: input.runId,
+              handedTo
+            };
+            return handedOff;
+          }
+          return claimed === void 0 ? accepted(input.idempotencyKey, input.runId) : terminalOrAccepted(input.idempotencyKey, claimed);
+        })
+      );
+    });
+    const executorRequestCancel = (runId) => import_effect.Option.isNone(executor) ? import_effect.Effect.succeed("unknown") : executor.value.requestCancel({ runId });
+    const executorSettleCancelledPark = (runId) => import_effect.Option.isNone(executor) ? import_effect.Effect.void : executor.value.settleCancelledPark({ runId });
+    const reconcileTerminal = (runId, status) => import_effect.Effect.gen(function* () {
+      const current = yield* runtime.getRun(runId);
+      if (terminal(current.status)) return;
+      const fence = yield* runtime.claimFence(runId).pipe(
+        // A parked coordination row has released its fence. Claim that row
+        // before copying the engine's terminal fact; a live peer still wins.
+        import_effect.Effect.catchTag("/control/ClaimLost", () => runtime.resume(runId).pipe(import_effect.Effect.andThen(runtime.claimFence(runId))))
+      );
+      const run = yield* runtime.writeStatus(runId, fence, status);
+      yield* emit(runId, `control.run.${status}`, json({ runId, status, ...ControlFacts.runFact(run) }));
+    }).pipe(
+      journal.transact,
+      import_effect.Effect.catchCause(
+        (failure) => import_effect.Effect.annotateLogs(
+          import_effect.Effect.logWarning("A settled engine row could not be reconciled onto the control row"),
+          { runId, status, cause: import_effect.Cause.pretty(failure) }
+        )
+      )
+    );
+    const wake = (run, messageId) => {
+      if (run.status !== "parked") return import_effect.Effect.void;
+      if (run.waitingReason !== "event" && run.waitingReason !== "released") return import_effect.Effect.void;
+      return refuseCodeDrift(run.runId).pipe(
+        import_effect.Effect.andThen(runtime.resume(run.runId, { scope: "launched" })),
+        import_effect.Effect.flatMap(
+          (resumed) => emit(
+            run.runId,
+            "control.steer.woke",
+            {
+              runId: run.runId,
+              messageId,
+              status: resumed.status,
+              ...ControlFacts.runFact(resumed)
+            }
+          )
+        ),
+        // A detached live host keeps its fence. Delegate the admitted event
+        // wake to it, just as a node decision does, instead of leaving an idle
+        // retained module with input it will never get a boundary to drain.
+        import_effect.Effect.catchTag(
+          "/control/ClaimLost",
+          (refusal) => refusal.parkedBy === void 0 ? import_effect.Effect.void : import_effect.Effect.gen(function* () {
+            const delegated = yield* runtime.requestResume(run.runId).pipe(
+              import_effect.Effect.catchTag("/control/InvalidInput", () => import_effect.Effect.succeed(void 0))
+            );
+            if (delegated !== void 0) yield* emit(run.runId, "control.run.resumed", { runId: run.runId });
+          })
+        ),
+        import_effect.Effect.catchTag("/control/RunNotFound", () => import_effect.Effect.void),
+        import_effect.Effect.catchTag(
+          "/control/CodeDrift",
+          (drift) => import_effect.Effect.annotateLogs(import_effect.Effect.logWarning("A steer did not wake a run whose code changed"), {
+            runId: run.runId,
+            cause: drift.message
+          })
+        )
+      );
+    };
+    const withSteering = (runs) => import_effect.Effect.forEach(runs, (run) => notifications.pending(run.runId).pipe(
+      import_effect.Effect.map((pending) => ({
+        ...run,
+        steering: {
+          pending: pending.filter((notification) => notification.delivery === "steer").length
+        }
+      })),
+      import_effect.Effect.catchTag("/notifications/NotificationError", () => import_effect.Effect.succeed(run)),
+      import_effect.Effect.mapError(
+        (cause) => new import_ControlError.PersistenceError({
+          operation: "control.list.steering",
+          message: `Failed to read pending steering for ${run.runId}`,
+          cause
+        })
+      )
+    ));
+    const triggerRuns = (triggerId) => import_effect.Effect.gen(function* () {
+      let start = 0;
+      while (true) {
+        const fires = yield* dispatch.fires({
+          _tag: "fires",
+          filters: { triggerId },
+          limit: import_ControlSchema.maxPageSize,
+          ...start === 0 ? {} : { cursor: String(start) }
+        });
+        if (fires.length <= start + import_ControlSchema.maxPageSize) {
+          return fires.flatMap((fire) => fire.triggerId === triggerId && fire.runId !== void 0 ? [fire.runId] : []);
+        }
+        start = Math.max(fires.length, start * 2);
+      }
+    });
+    const readerSees = (reader, runId) => runId.startsWith("plan:") ? import_effect.Effect.succeed(false) : runtime.getRun(runId).pipe(
+      import_effect.Effect.map((run) => (0, import_ControlRuntime.launchedByMatches)(run, reader)),
+      import_effect.Effect.catchTag("/control/RunNotFound", () => import_effect.Effect.succeed(false))
+    );
+    const confined = (submitted, mutation) => submitted.reader === void 0 ? mutation : import_effect.Effect.flatMap(
+      readerSees(submitted.reader, submitted.runId),
+      (visible) => visible ? mutation : import_effect.Effect.fail(new import_ControlError.RunNotFound({ runId: submitted.runId }))
+    );
+    const list = (request) => import_effect.Effect.gen(function* () {
+      if (request._tag === "executions") {
+        if (request.reader !== void 0 && !(yield* readerSees(request.reader, request.runId))) {
+          return yield* new import_ControlError.RunNotFound({ runId: request.runId });
+        }
+        yield* runtime.getRun(request.runId);
+        yield* import_effect.Schema.decodeUnknownEffect(import_ControlSchema.ListRequest)(request).pipe(
+          import_effect.Effect.mapError(() => invalid("executionIds: at most 200 nonempty execution IDs are admitted"))
+        );
+        const batch = import_effect.Option.isSome(executor) && executor.value.readExecutions !== void 0 ? yield* executor.value.readExecutions(request) : {
+          source: null,
+          revision: null,
+          snapshots: request.executionIds.map((executionId) => ({
+            _tag: "Unavailable",
+            executionId,
+            reason: "unsupported"
+          }))
+        };
+        return { _tag: "executions", source: batch.source, revision: batch.revision, items: batch.snapshots };
+      }
+      const bounds = yield* pageBounds(request._tag === "runs" ? void 0 : request.cursor, request.limit);
+      if (request._tag === "plans") {
+        if (request.reader !== void 0) return { _tag: "plans", items: [] };
+        const result = yield* runtime.queryPlans({
+          flowId: request.filters?.flowId,
+          decision: request.filters?.decision,
+          after: bounds.start,
+          limit: bounds.size
+        });
+        const items2 = result.plans.map((plan) => ({
+          card: plan.card,
+          // The JSON form the durable runtime stores, whichever runtime answers.
+          input: JSON.parse(JSON.stringify(plan.decodedInput ?? null)),
+          decision: plan.decision
+        }));
+        return result.next === void 0 ? { _tag: "plans", items: items2 } : { _tag: "plans", items: items2, nextCursor: String(result.next) };
+      }
+      if (request._tag === "flows") {
+        const [registered, warnings] = yield* import_effect.Effect.all([registry.list(), registry.warnings()]);
+        const available = registered.length > 0 ? registered.map((descriptor) => ({
+          flowId: descriptor.name,
+          description: descriptor.description,
+          ...(0, import_Descriptor.inputDocument)(descriptor.input) === void 0 ? {} : { inputSchema: (0, import_Descriptor.inputDocument)(descriptor.input) }
+        })) : yield* runtime.listFlows;
+        const result = page(available, bounds);
+        const diagnostics = warnings.length === 0 ? {} : { warnings };
+        return result.nextCursor === void 0 ? { _tag: "flows", items: result.items, ...diagnostics } : { _tag: "flows", items: result.items, ...diagnostics, nextCursor: result.nextCursor };
+      }
+      if (request._tag === "triggers") {
+        if (request.reader !== void 0) return { _tag: "triggers", items: [] };
+        let triggers = yield* dispatch.list(request);
+        if (request.filters?.triggerId !== void 0) {
+          triggers = triggers.filter((trigger) => trigger.triggerId === request.filters?.triggerId);
+        }
+        if (request.filters?.flowId !== void 0) {
+          triggers = triggers.filter((trigger) => trigger.flowId === request.filters?.flowId);
+        }
+        if (request.filters?.enabled !== void 0) {
+          triggers = triggers.filter((trigger) => trigger.enabled === request.filters?.enabled);
+        }
+        const result = page(triggers, bounds);
+        return result.nextCursor === void 0 ? { _tag: "triggers", items: result.items } : { _tag: "triggers", items: result.items, nextCursor: result.nextCursor };
+      }
+      if (request._tag === "fires") {
+        let fires = yield* dispatch.fires(request);
+        const reader2 = request.reader;
+        if (reader2 !== void 0) {
+          const seen = yield* import_effect.Effect.forEach(fires, (fire) => fire.runId === void 0 ? import_effect.Effect.succeed(false) : readerSees(reader2, fire.runId));
+          fires = fires.filter(
+            (_, index) => seen[index]
+          );
+        }
+        if (request.filters?.triggerId !== void 0) {
+          fires = fires.filter((fire) => fire.triggerId === request.filters?.triggerId);
+        }
+        if (request.filters?.runId !== void 0) {
+          fires = fires.filter((fire) => fire.runId === request.filters?.runId);
+        }
+        if (request.filters?.outcome !== void 0) {
+          fires = fires.filter((fire) => fire.outcome === request.filters?.outcome);
+        }
+        const result = page(fires, bounds);
+        return result.nextCursor === void 0 ? { _tag: "fires", items: result.items } : { _tag: "fires", items: result.items, nextCursor: result.nextCursor };
+      }
+      const filters = request.filters;
+      const reader = request.reader;
+      if (reader !== void 0 && filters?.principalId !== void 0 && filters.principalId !== reader.id) {
+        return { _tag: "runs", items: [] };
+      }
+      const launcher = reader !== void 0 ? { id: reader.id, kind: reader.kind } : filters?.principalId === void 0 ? void 0 : { id: filters.principalId };
+      const fingerprint2 = JSON.stringify([
+        filters?.runId ?? null,
+        filters?.flowId ?? null,
+        filters?.status ?? null,
+        filters?.parentRunId ?? null,
+        filters?.lineageId ?? null,
+        // Keep legacy cursor fingerprints byte-identical unless opting in.
+        ...filters?.terminal === void 0 && request.order === void 0 ? [] : [filters?.terminal ?? null, request.order ?? null],
+        ...filters?.since === void 0 && filters?.until === void 0 && filters?.triggerId === void 0 ? [] : [filters.since ?? null, filters.until ?? null, filters.triggerId ?? null],
+        ...launcher === void 0 ? [] : [launcher.id, launcher.kind ?? null]
+      ]);
+      const cursor = request.cursor === void 0 ? void 0 : yield* import_effect.Schema.decodeUnknownEffect(runCursor)(
+        request.cursor
+      ).pipe(import_effect.Effect.mapError(() => invalid("cursor: expected a run listing cursor")));
+      if (cursor !== void 0 && cursor.filters !== fingerprint2) {
+        return yield* invalid("cursor: belongs to different run filters");
+      }
+      if (filters?.runId !== void 0) {
+        let runs = yield* getRun(filters.runId).pipe(
+          import_effect.Effect.map((run) => [run]),
+          import_effect.Effect.catchTag("/control/RunNotFound", () => import_effect.Effect.succeed([]))
+        );
+        if (filters.flowId !== void 0) runs = runs.filter((run) => run.flowId === filters.flowId);
+        if (filters.status !== void 0) runs = runs.filter((run) => run.status === filters.status);
+        if (filters.terminal !== void 0) runs = runs.filter((run) => terminal(run.status) === filters.terminal);
+        if (filters.parentRunId !== void 0) runs = runs.filter((run) => run.parentRunId === filters.parentRunId);
+        if (filters.lineageId !== void 0) runs = runs.filter((run) => run.lineageId === filters.lineageId);
+        if (launcher !== void 0) runs = runs.filter((run) => (0, import_ControlRuntime.launchedByMatches)(run, launcher));
+        if (filters.since !== void 0) runs = runs.filter((run) => run.createdAt >= filters.since);
+        if (filters.until !== void 0) runs = runs.filter((run) => run.createdAt < filters.until);
+        if (filters.triggerId !== void 0) {
+          const started = yield* triggerRuns(filters.triggerId);
+          runs = runs.filter((run) => started.includes(run.runId));
+        }
+        return { _tag: "runs", items: yield* withSteering(yield* import_effect.Effect.forEach(runs, withCodeDrift)) };
+      }
+      const postFiltered = observing && (filters?.status !== void 0 || filters?.terminal !== void 0);
+      const { triggerId, principalId: _principalId, ...unowned } = filters ?? {};
+      const selected = launcher === void 0 ? unowned : { ...unowned, launchedBy: launcher };
+      const narrowed = triggerId === void 0 ? selected : { ...selected, runIds: yield* triggerRuns(triggerId) };
+      const sourceFilters = postFiltered ? Object.fromEntries(Object.entries(narrowed).filter(([key]) => key !== "status" && key !== "terminal")) : narrowed;
+      const collected = [];
+      let sourceCursor = cursor;
+      let sourceNext;
+      while (true) {
+        const result = yield* runtime.queryRuns({
+          filters: sourceFilters,
+          order: request.order,
+          cursor: sourceCursor,
+          limit: bounds.size - collected.length
+        });
+        const observed = yield* import_effect.Effect.forEach(result.items, observe);
+        for (const run of observed) {
+          if (!postFiltered || (filters?.status === void 0 || run.status === filters.status) && (filters?.terminal === void 0 || terminal(run.status) === filters.terminal)) collected.push(run);
+        }
+        sourceNext = result.nextCursor;
+        if (!postFiltered || sourceNext === void 0 || collected.length >= bounds.size) break;
+        sourceCursor = { version: 1, filters: fingerprint2, ...sourceNext };
+      }
+      const items = yield* withSteering(collected);
+      return sourceNext === void 0 ? { _tag: "runs", items } : {
+        _tag: "runs",
+        items,
+        nextCursor: JSON.stringify({ version: 1, filters: fingerprint2, ...sourceNext })
+      };
+    });
+    const streamForRun = (runId, filter) => journal.stream({
+      runId: import_journal.JournalEvent.RunId.make(runId),
+      ...filter.afterSequence === void 0 ? {} : { afterSequence: import_journal.JournalEvent.Seq.make(filter.afterSequence) }
+    }).pipe(
+      import_effect.Stream.map(eventFromEntry),
+      import_effect.Stream.mapError(watchReadFailed)
+    );
+    const snapshotHighWater = (runId) => journal.transact(
+      import_effect.Effect.gen(function* () {
+        const first = yield* journal.entries({ runId, limit: 1 });
+        const initial = first.entries[0];
+        if (initial === void 0) return void 0;
+        let lower = initial.seq;
+        let step = 1;
+        let upper = lower;
+        const maximumSequence = Number.MAX_SAFE_INTEGER - 1;
+        while (lower < maximumSequence) {
+          const probe = Math.min(maximumSequence, lower + step - 1);
+          const next = yield* journal.entries({
+            runId,
+            after: import_journal.JournalEvent.Seq.make(probe),
+            limit: 1
+          });
+          const entry = next.entries[0];
+          if (entry === void 0) {
+            upper = probe;
+            break;
+          }
+          lower = entry.seq;
+          if (lower === maximumSequence) return entry.seq;
+          step = Math.min(maximumSequence - lower, step * 2);
+        }
+        while (lower < upper) {
+          const middle = lower + Math.ceil((upper - lower) / 2);
+          const next = yield* journal.entries({
+            runId,
+            after: import_journal.JournalEvent.Seq.make(middle - 1),
+            limit: 1
+          });
+          const entry = next.entries[0];
+          if (entry === void 0) {
+            upper = middle - 1;
+          } else {
+            lower = entry.seq;
+          }
+        }
+        return import_journal.JournalEvent.Seq.make(lower);
+      })
+    ).pipe(import_effect.Effect.mapError(watchReadFailed));
+    const snapshotForRunAt = (runId, filter, highWater) => {
+      const journalRunId = import_journal.JournalEvent.RunId.make(runId);
+      const initialAfter = filter.afterSequence === void 0 ? void 0 : import_journal.JournalEvent.Seq.make(filter.afterSequence);
+      if (highWater === void 0 || initialAfter !== void 0 && initialAfter >= highWater) {
+        return import_effect.Stream.empty;
+      }
+      return import_effect.Stream.paginate(initialAfter, (after) => journal.entries({
+        runId: journalRunId,
+        ...after === void 0 ? {} : { after },
+        limit: snapshotPageSize
+      }).pipe(
+        import_effect.Effect.map((page2) => {
+          const entries2 = page2.entries.filter((entry) => entry.seq <= highWater);
+          const last = entries2.at(-1);
+          const next = last === void 0 || last.seq >= highWater || !page2.hasMore ? import_effect.Option.none() : import_effect.Option.some(last.seq);
+          return [entries2, next];
+        }),
+        import_effect.Effect.mapError(watchReadFailed)
+      )).pipe(import_effect.Stream.map(eventFromEntry));
+    };
+    const snapshotForRun = (runId, filter) => import_effect.Stream.unwrap(
+      import_effect.Effect.map(
+        snapshotHighWater(import_journal.JournalEvent.RunId.make(runId)),
+        (highWater) => snapshotForRunAt(runId, filter, highWater)
+      )
+    );
+    const inventory = (page2) => {
+      const first = {};
+      return import_effect.Stream.paginate(
+        first,
+        (cursor) => import_effect.Effect.map(
+          page2({ ...cursor, limit: partitionPageSize }),
+          (next) => [
+            next.ids,
+            next.next === void 0 ? import_effect.Option.none() : import_effect.Option.some({ after: next.next, through: next.through })
+          ]
+        )
+      );
+    };
+    const journalPartitions = import_effect.Stream.concat(
+      import_effect.Stream.map(inventory(runtime.pagePlanIds), (planId) => `plan:${planId}`),
+      inventory(runtime.pageRunIds)
+    );
+    const snapshot = (filter) => filter.runId !== void 0 ? snapshotForRun(filter.runId, filter) : import_effect.Stream.flatMap(journalPartitions, (partition) => snapshotForRun(partition, filter), {
+      concurrency: snapshotPartitionConcurrency
+    });
+    const entries = (filter) => filter.follow === false ? snapshot(filter) : filter.runId !== void 0 ? streamForRun(filter.runId, filter) : import_effect.Stream.unwrap(
+      import_effect.Effect.gen(function* () {
+        const subscription = yield* journal.changes;
+        const cutoffs = /* @__PURE__ */ new Map();
+        const pin = (partition) => {
+          const pinned = import_effect.Deferred.makeUnsafe();
+          cutoffs.set(partition, pinned);
+          return snapshotHighWater(import_journal.JournalEvent.RunId.make(partition)).pipe(
+            import_effect.Effect.onExit((exit) => import_effect.Deferred.done(pinned, exit))
+          );
+        };
+        const walk = journalPartitions.pipe(
+          import_effect.Stream.mapEffect(
+            (partition) => import_effect.Effect.suspend(
+              () => cutoffs.has(partition) ? import_effect.Effect.succeed(import_effect.Option.none()) : import_effect.Effect.map(pin(partition), (highWater) => import_effect.Option.some([partition, highWater]))
+            ),
+            { concurrency: snapshotPartitionConcurrency }
+          ),
+          import_effect.Stream.filter(import_effect.Option.isSome),
+          import_effect.Stream.map((pinned) => pinned.value),
+          import_effect.Stream.flatMap(([partition, highWater]) => snapshotForRunAt(partition, filter, highWater), {
+            concurrency: snapshotPartitionConcurrency
+          })
+        );
+        const cutoffFor = (partition) => import_effect.Effect.suspend(() => {
+          const known = cutoffs.get(partition);
+          if (known !== void 0) {
+            return import_effect.Effect.map(import_effect.Deferred.await(known), (highWater) => ({ highWater, claimed: false }));
+          }
+          return import_effect.Effect.map(pin(partition), (highWater) => ({ highWater, claimed: true }));
+        });
+        const seenByPartition = /* @__PURE__ */ new Map();
+        const gapCheck = (partition, expected, arrived) => journal.entries({
+          runId: import_journal.JournalEvent.RunId.make(partition),
+          ...expected === void 0 ? {} : { after: import_journal.JournalEvent.Seq.make(expected) },
+          limit: 1
+        }).pipe(
+          import_effect.Effect.mapError(watchReadFailed),
+          import_effect.Effect.flatMap((page2) => {
+            const missed = page2.entries[0];
+            if (missed === void 0 || missed.seq >= arrived) return import_effect.Effect.void;
+            return import_effect.Effect.fail(
+              new import_ControlError.PersistenceError({
+                operation: "watch",
+                message: `the live tail lost journal entries for ${partition}: sequence ${missed.seq} was committed but never delivered to this watcher`
+              })
+            );
+          })
+        );
+        const trackTail = (entry, cutoff) => {
+          const partition = String(entry.runId);
+          const expected = seenByPartition.get(partition) ?? cutoff;
+          if (expected !== void 0 && entry.seq <= expected) return import_effect.Effect.succeed(import_effect.Option.none());
+          seenByPartition.set(partition, entry.seq);
+          return expected !== void 0 && entry.seq === expected + 1 ? import_effect.Effect.succeed(import_effect.Option.some(entry)) : import_effect.Effect.map(gapCheck(partition, expected, entry.seq), () => import_effect.Option.some(entry));
+        };
+        const tail = import_effect.Stream.fromSubscription(subscription).pipe(
+          // Every committed entry names its partition. The first one from a
+          // partition nobody pinned yet pins it here and is preceded by that
+          // partition's snapshot, which also recovers any earlier notice the
+          // sliding buffer dropped.
+          import_effect.Stream.flatMap(
+            (entry) => import_effect.Stream.unwrap(import_effect.Effect.gen(function* () {
+              const partition = String(entry.runId);
+              const { highWater, claimed } = yield* cutoffFor(partition);
+              const history = claimed ? snapshotForRunAt(partition, filter, highWater) : import_effect.Stream.empty;
+              if (highWater !== void 0 && entry.seq <= highWater) return history;
+              const tracked = yield* trackTail(entry, highWater);
+              return import_effect.Option.isSome(tracked) ? import_effect.Stream.concat(history, import_effect.Stream.succeed(eventFromEntry(tracked.value))) : history;
+            }))
+          )
+        );
+        return import_effect.Stream.merge(walk, tail);
+      })
+    );
+    const watch = (filter) => {
+      const { reader, ...unrestricted } = filter;
+      if (reader === void 0) return watchAll(unrestricted);
+      if (filter.runId !== void 0) {
+        const runId = filter.runId;
+        return import_effect.Stream.unwrap(import_effect.Effect.map(
+          readerSees(reader, runId),
+          (visible) => visible ? watchAll(unrestricted) : import_effect.Stream.fail(new import_ControlError.RunNotFound({ runId }))
+        ));
+      }
+      const decided = /* @__PURE__ */ new Map();
+      return watchAll(unrestricted).pipe(
+        // A lost-tail failure names the partition and sequence it missed,
+        // which may be another principal's; a restricted reader learns only
+        // that its stream ended incomplete.
+        import_effect.Stream.mapError(
+          (error) => error._tag === "/control/PersistenceError" ? new import_ControlError.PersistenceError({ operation: "watch", message: "the watch lost journal entries and ended" }) : error
+        ),
+        import_effect.Stream.filterEffect((event) => {
+          const partition = event.runId;
+          const known = decided.get(partition);
+          if (known !== void 0) return import_effect.Effect.succeed(known);
+          return import_effect.Effect.tap(
+            readerSees(reader, partition),
+            (visible) => import_effect.Effect.sync(() => decided.set(partition, visible))
+          );
+        })
+      );
+    };
+    const watchAll = (filter) => {
+      if (filter.afterSequence !== void 0 && filter.runId === void 0) {
+        return import_effect.Stream.fail(invalid("afterSequence: a watch cursor resumes one run, so it requires runId"));
+      }
+      const cursor = filter.afterCursor;
+      if (cursor !== void 0) {
+        if (filter.runId === void 0) {
+          return import_effect.Stream.fail(invalid("afterCursor: a watch cursor resumes one run, so it requires runId"));
+        }
+        if (filter.afterSequence !== void 0) {
+          return import_effect.Stream.fail(invalid("afterCursor: cannot be combined with afterSequence"));
+        }
+        if (!import_effect.Schema.is(import_ControlSchema.WatchCursor)(cursor)) {
+          return import_effect.Stream.fail(invalid("afterCursor: sequence and offset must be nonnegative safe journal integers"));
+        }
+      }
+      const afterSequence = cursor === void 0 ? filter.afterSequence : cursor.offset === void 0 ? cursor.sequence : cursor.sequence === 0 ? void 0 : cursor.sequence - 1;
+      return entries({
+        ...filter,
+        afterSequence
+      }).pipe(
+        import_effect.Stream.map((event) => {
+          const lineage = Lineage.derive(event);
+          const expanded = [event, ...lineage === void 0 ? [] : [lineage], ...Steering.derive(event)];
+          const checkpointed = expanded.map((member, offset) => ({
+            ...member,
+            cursor: offset === expanded.length - 1 ? { sequence: event.sequence } : { sequence: event.sequence, offset }
+          }));
+          return cursor?.offset !== void 0 && event.sequence === cursor.sequence ? checkpointed.slice(cursor.offset + 1) : checkpointed;
+        }),
+        import_effect.Stream.flattenIterable
+      );
+    };
+    const service = {
+      plan: import_effect.Effect.fn("Control.plan")(
+        (input) => mutationSemaphore.withPermits(1)(
+          journal.transact(import_effect.Effect.gen(function* () {
+            const { card, created } = yield* runtime.plan(input);
+            const runId = import_journal.JournalEvent.RunId.make(`plan:${card.planId}`);
+            if (!created) {
+              let after;
+              while (true) {
+                const page2 = yield* journal.entries({
+                  runId,
+                  ...after === void 0 ? {} : { after },
+                  limit: snapshotPageSize
+                });
+                if (page2.entries.some(
+                  (entry) => entry.sourceId === sourceId && entry.eventType === "control.plan.created"
+                )) {
+                  return card;
+                }
+                if (!page2.hasMore) break;
+                after = page2.entries[page2.entries.length - 1].seq;
+              }
+            }
+            yield* emit(runId, "control.plan.created", {
+              planId: card.planId,
+              flowId: card.flowId,
+              digest: card.digest
+            });
+            return card;
+          })).pipe(
+            import_effect.Effect.mapError(
+              (cause) => cause instanceof import_journal.Journal.JournalError ? new import_ControlError.PersistenceError({
+                operation: "plan",
+                message: "Failed to commit plan and its creation entry atomically",
+                cause
+              }) : cause
+            )
+          )
+        ).pipe(import_effect.Effect.flatMap(
+          (card) => registry.warnings().pipe(import_effect.Effect.map((all) => {
+            const warnings = all.filter((warning) => warning.name === input.flowId);
+            return warnings.length === 0 ? card : { warnings, ...card };
+          }))
+        ))
+      ),
+      run: import_effect.Effect.fn("Control.run")(
+        (submitted) => import_effect.Effect.gen(function* () {
+          const input = yield* snapshotRun(submitted);
+          if (input._tag === "Resume") return yield* runMutation(input);
+          const principal = yield* runtime.stampPrincipal(input.principal);
+          let admitted;
+          const receipt = yield* mutate(
+            "run",
+            input.idempotencyKey,
+            principal,
+            fingerprint("run", principal, input),
+            import_effect.Effect.gen(function* () {
+              const launched = yield* runtime.launch(
+                input.planId,
+                input.digest,
+                input.envelope,
+                principal,
+                input.reservedRunId
+              );
+              if (launched._tag === "Parked") {
+                return { ...launched.receipt, receiptId: input.idempotencyKey };
+              }
+              const plan = yield* runtime.getPlan(input.planId);
+              const trigger = declaredTrigger(plan.decodedInput);
+              yield* emit(
+                launched.run.runId,
+                "control.run.accepted",
+                {
+                  runId: launched.run.runId,
+                  planId: input.planId,
+                  digest: input.digest,
+                  status: launched.run.status,
+                  ...trigger === void 0 ? {} : { trigger },
+                  ...ControlFacts.runFact(launched.run, "created")
+                }
+              );
+              admitted = { plan, run: launched.run };
+              return {
+                _tag: "Accepted",
+                receiptId: input.idempotencyKey,
+                runId: launched.run.runId
+              };
+            }),
+            true,
+            true
+          );
+          if (receipt._tag === "Accepted" && admitted !== void 0) yield* hand(admitted);
+          else if (receipt._tag === "AlreadyApplied" && receipt.runId !== void 0) {
+            yield* relaunchStranded(receipt.runId);
+          }
+          return receipt;
+        })
+      ),
+      approve: import_effect.Effect.fn("Control.approve")((input) => decide("approved", input)),
+      deny: import_effect.Effect.fn("Control.deny")((input) => decide("denied", input)),
+      steer: import_effect.Effect.fn("Control.steer")(
+        (submitted) => confined(
+          submitted,
+          import_effect.Effect.flatMap(snapshotSteer(submitted), (input) => mutate(
+            "steer",
+            input.idempotencyKey,
+            input.message.principal,
+            fingerprint("steer", input.message.principal, input),
+            import_effect.Effect.gen(function* () {
+              if (input.message.runId !== input.runId) {
+                return yield* import_effect.Effect.fail(
+                  invalid(
+                    `message.runId: must be ${JSON.stringify(input.runId)}, received ${JSON.stringify(input.message.runId)}`
+                  )
+                );
+              }
+              const run = yield* getRun(input.runId);
+              if (terminal(run.status)) return { _tag: "Terminal", runId: run.runId, status: run.status };
+              const item = (0, import_ControlSchema.steerItem)(input.message);
+              const admission = yield* notifications.admit(input.runId, {
+                _tag: "human-steer",
+                id: input.message.messageId,
+                delivery: "steer",
+                targetLineageId: input.runId,
+                provenance: {
+                  sourceRunId: input.runId,
+                  sourceLineageId: input.runId,
+                  sourceTurn: 0,
+                  sourceActor: `${input.message.principal.kind}:${input.message.principal.id}`,
+                  ...input.message.attribution === void 0 ? {} : { attribution: input.message.attribution }
+                },
+                payload: SteerPayload.encode(item)
+              }, input.version).pipe(
+                import_effect.Effect.mapError(
+                  (cause) => cause instanceof import_notifications.NotificationQueue.NotificationError ? cause : new import_ControlError.PersistenceError({
+                    operation: "control.steer.notification",
+                    message: "Failed to admit steering notification",
+                    cause
+                  })
+                )
+              );
+              const inputReceipt = () => {
+                if (input.version === void 0 || item.kind !== "Message") {
+                  return accepted(input.idempotencyKey, input.runId);
+                }
+                const payload = admission.consumedNotification?.payload;
+                return {
+                  _tag: "Accepted",
+                  receiptId: input.idempotencyKey,
+                  runId: input.runId,
+                  inputConsumed: admission.consumed === true,
+                  inputBody: payload?.body ?? item.body
+                };
+              };
+              if (input.version !== void 0 && (admission.consumed || admission.duplicate)) {
+                return inputReceipt();
+              }
+              if (admission.decision === "rejected-full") {
+                return yield* import_effect.Effect.fail(
+                  new import_notifications.NotificationQueue.NotificationError({
+                    code: "notification_full",
+                    notificationId: input.message.messageId,
+                    message: "Steering queue is full; retry after pending notifications are delivered"
+                  })
+                );
+              }
+              yield* emit(input.runId, Steering.enqueuedEventType, {
+                runId: input.runId,
+                messageId: input.message.messageId,
+                kind: item.kind,
+                createdAt: input.message.createdAt
+              });
+              yield* wake(run, input.message.messageId);
+              return inputReceipt();
+            })
+          ))
+        )
+      ),
+      signal: import_effect.Effect.fn("Control.signal")(
+        (submitted) => confined(
+          submitted,
+          import_effect.Effect.flatMap(snapshotSignal(submitted), (input) => import_effect.Effect.gen(function* () {
+            const principal = yield* runtime.stampPrincipal(input.principal);
+            const key = fingerprint("signal", principal, input);
+            const durableKey = (0, import_planning.mutationKey)("signal", input.idempotencyKey, principal);
+            const receipt = yield* mutate(
+              "signal",
+              input.idempotencyKey,
+              principal,
+              key,
+              import_effect.Effect.gen(function* () {
+                const current = yield* getRun(input.runId);
+                if (terminal(current.status)) {
+                  return { _tag: "Terminal", runId: current.runId, status: current.status };
+                }
+                yield* runtime.admitSignal(durableKey, input.runId, input.signal, principal);
+                yield* emit(input.runId, "control.signal.admitted", {
+                  commandId: durableKey,
+                  runId: input.runId,
+                  name: input.signal.name
+                });
+                return accepted(input.idempotencyKey, input.runId);
+              }),
+              true,
+              true
+            );
+            if (receipt._tag !== "Accepted" && receipt._tag !== "AlreadyApplied") return receipt;
+            const command = yield* runtime.signalCommand(durableKey);
+            if (command === void 0 || command.state === "delivered" || command.state === "terminal") return receipt;
+            if (command.state === "rejected") {
+              return yield* new import_ControlError.NoMatchingWait({ runId: input.runId, waitName: input.signal.name });
+            }
+            const delivery = import_effect.Option.isNone(executor) ? "unknown" : yield* executor.value.deliverSignal({ ...command });
+            if (delivery === "no-match") {
+              yield* runtime.settleSignal(durableKey, "rejected");
+              return yield* new import_ControlError.NoMatchingWait({ runId: input.runId, waitName: input.signal.name });
+            }
+            if (delivery === "refused") {
+              yield* runtime.settleSignal(durableKey, "rejected");
+              return yield* new import_ControlError.Unauthorized({
+                message: `This caller has no authority to answer "${input.signal.name}" on run ${input.runId}`
+              });
+            }
+            if (delivery === "delivered") {
+              yield* runtime.settleSignal(durableKey, "delivered");
+            }
+            return receipt;
+          }))
+        )
+      ),
+      cancel: import_effect.Effect.fn("Control.cancel")(
+        (submitted) => confined(
+          submitted,
+          import_effect.Effect.flatMap(
+            snapshotReasonedMutation("cancel", submitted),
+            (input) => import_effect.Effect.flatMap(runtime.stampPrincipal(input.principal), (principal) => mutate(
+              "cancel",
+              input.idempotencyKey,
+              principal,
+              fingerprint("cancel", principal, input),
+              import_effect.Effect.gen(function* () {
+                const current = yield* getRun(input.runId);
+                if (terminal(current.status)) {
+                  yield* reconcileTerminal(input.runId, current.status);
+                  return { _tag: "Terminal", runId: current.runId, status: current.status };
+                }
+                const record2 = yield* executorRequestCancel(input.runId);
+                if (typeof record2 !== "string") {
+                  yield* reconcileTerminal(input.runId, record2.status);
+                  return { _tag: "Terminal", runId: input.runId, status: record2.status };
+                }
+                const prior = yield* runtime.lookupMutation(
+                  (0, import_planning.mutationKey)("cancel", input.idempotencyKey, principal),
+                  fingerprint("cancel", principal, input)
+                );
+                if (record2 !== "already-requested" && prior === void 0) {
+                  yield* emit(
+                    input.runId,
+                    Cancellation.requestedEventType,
+                    json({
+                      runId: input.runId,
+                      source: "control",
+                      principal,
+                      ...input.reason === void 0 ? {} : { reason: input.reason }
+                    })
+                  );
+                }
+                return accepted(input.idempotencyKey, input.runId);
+              }),
+              false
+            ).pipe(
+              import_effect.Effect.flatMap(
+                (receipt) => import_effect.Effect.gen(function* () {
+                  if (receipt._tag !== "Accepted") return receipt;
+                  const settle = (effect) => transact(
+                    "cancel",
+                    import_effect.Effect.gen(function* () {
+                      const run2 = yield* effect;
+                      yield* emit(
+                        input.runId,
+                        `control.run.${run2.status}`,
+                        {
+                          runId: input.runId,
+                          status: run2.status,
+                          ...ControlFacts.runFact(run2)
+                        }
+                      );
+                      return run2;
+                    })
+                  );
+                  const run = yield* runtime.interrupt(input.runId, settle).pipe(
+                    import_effect.Effect.catchTag("/control/ClaimLost", () => import_effect.Effect.gen(function* () {
+                      const current = yield* getRun(input.runId);
+                      if (terminal(current.status)) return current;
+                      if (live(current.status) && current.ownerId !== void 0) return void 0;
+                      return yield* runtime.resume(input.runId).pipe(
+                        import_effect.Effect.andThen(runtime.interrupt(input.runId, settle)),
+                        import_effect.Effect.catchTag("/control/ClaimLost", () => import_effect.Effect.succeed(void 0))
+                      );
+                    }))
+                  );
+                  return run === void 0 ? receipt : terminalOrAccepted(input.idempotencyKey, run);
+                })
+              ),
+              // Both rows, before the process that asked goes away. The engine row
+              // carries the request the moment the mutation commits, but nothing
+              // drives a parked run, so the row stayed `suspended` until some
+              // later long-lived engine happened to sweep it: `gc` collected the
+              // run in `control.db` and skipped it in `engine.db` for fifteen
+              // seconds and six commands in the release validation.
+              import_effect.Effect.tap(
+                () => import_effect.Effect.gen(function* () {
+                  yield* executorSettleCancelledPark(input.runId);
+                  const current = yield* getRun(input.runId);
+                  if (terminal(current.status)) yield* reconcileTerminal(input.runId, current.status);
+                })
+              )
+            ))
+          )
+        )
+      ),
+      resume: import_effect.Effect.fn("Control.resume")((input) => confined(input, runMutation(input))),
+      list,
+      watch
+    };
+    return import_Control.Control.of(service);
+  })
+);
+//# sourceMappingURL=ControlLive.js.map