@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.3

package/src/internal/ArtifactRoots.ts

@@ -0,0 +1,92 @@
+/**
+ * Shared fail-closed decoding of artifact addresses held by durable engine
+ * rows.
+ *
+ * @since 1.0.0
+ */
+
+import * as ArtifactStore from "@smthrs/artifacts/ArtifactStore"
+import * as Effect from "effect/Effect"
+import * as Schema from "effect/Schema"
+import * as StepBoundary from "../StepBoundary.ts"
+
+const RootMeta = Schema.Struct({ boundary: StepBoundary.BoundaryEvidence })
+const MetaJson = Schema.fromJsonString(Schema.Unknown)
+// The store's own address schema is the one rule for what counts as a digest;
+// reimplementing it here is how the two drift apart.
+const isDigest = Schema.is(ArtifactStore.Digest)
+
+/**
+ * A durable root row this build cannot interpret safely.
+ *
+ * @category errors
+ * @since 1.0.0
+ */
+export class ArtifactRootDecodeError extends Schema.TaggedError<ArtifactRootDecodeError>()(
+  "@smthrs/engine-store/ArtifactRootDecodeError",
+  { table: Schema.String, cause: Schema.Unknown }
+) {
+  override readonly name = "ArtifactRootDecodeError"
+  override get message(): string {
+    return `a ${this.table} row carries artifact evidence this build cannot decode`
+  }
+}
+
+/**
+ * Extracts referenced boundary digests from one metadata column.
+ *
+ * @category decoding
+ * @since 1.0.0
+ */
+export const rootDigests = (
+  table: string,
+  metaJson: string
+): Effect.Effect<ReadonlyArray<string>, ArtifactRootDecodeError> =>
+  Effect.gen(function*() {
+    const meta = yield* Schema.decodeUnknownEffect(MetaJson)(metaJson).pipe(
+      Effect.mapError((cause) => new ArtifactRootDecodeError({ table, cause }))
+    )
+    if (meta === null || typeof meta !== "object" || !("boundary" in meta)) return []
+    const decoded = Schema.decodeUnknownResult(RootMeta)(meta)
+    if (decoded._tag === "Failure") {
+      return yield* Effect.fail(new ArtifactRootDecodeError({ table, cause: decoded.failure }))
+    }
+    return StepBoundary.referencedDigests(decoded.success.boundary)
+  })
+
+const collectArtifactDigests = (root: unknown): ReadonlyArray<string> => {
+  const digests = new Set<string>()
+  const pending: Array<unknown> = [root]
+  while (pending.length > 0) {
+    const next = pending.pop()
+    if (typeof next === "string") {
+      if (isDigest(next)) digests.add(next)
+      continue
+    }
+    if (Array.isArray(next)) {
+      pending.push(...next)
+      continue
+    }
+    if (next !== null && typeof next === "object") {
+      pending.push(...Object.values(next as Readonly<Record<string, unknown>>))
+    }
+  }
+  return [...digests]
+}
+
+/**
+ * Extracts digest-shaped addresses from one opaque attempt checkpoint.
+ *
+ * @category decoding
+ * @since 1.0.0
+ */
+export const checkpointDigests = (
+  checkpointJson: string | null
+): Effect.Effect<ReadonlyArray<string>, ArtifactRootDecodeError> =>
+  Effect.gen(function*() {
+    if (checkpointJson === null) return []
+    const checkpoint = yield* Schema.decodeUnknownEffect(MetaJson)(checkpointJson).pipe(
+      Effect.mapError((cause) => new ArtifactRootDecodeError({ table: "flows_attempts.checkpoint_json", cause }))
+    )
+    return collectArtifactDigests(checkpoint)
+  })

package/src/internal/AttemptAdmission.ts

@@ -0,0 +1,76 @@
+/**
+ * The in-process attempt admission mutex.
+ *
+ * One instance lives per store incarnation (per `EngineStore.make`, alongside
+ * the owner nonce). Every durable action dispatch holds the key's permit
+ * for its whole admission-execute-finish span, so at most one fiber of this
+ * process can be driving a given `(runId, stepKeyDigest, attempt)` at a time.
+ *
+ * That exclusion is the liveness evidence adoption needs (issues #86, #102,
+ * #103): a persisted `running` row observed *while holding the key's permit*
+ * cannot belong to a live fiber of this process — a live same-key dispatch
+ * would be holding the permit — so it is crash or interruption evidence and
+ * safe to adopt, whether the admitting incarnation was another process
+ * (superseded by the run fence) or this very one (a dead fiber after an
+ * in-process re-drive). The recorded incarnation nonce alone could not make
+ * that distinction, which both let a TOCTOU window double-execute an
+ * irreversible body (issue #102) and permanently failed a same-incarnation
+ * re-drive with `AttemptAdmissionRejected` (issue #103).
+ *
+ * @since 0.1.0
+ */
+
+import * as Context from "effect/Context"
+import * as Effect from "effect/Effect"
+import * as Layer from "effect/Layer"
+import * as RcMap from "effect/RcMap"
+import * as Scope from "effect/Scope"
+import * as Semaphore from "effect/Semaphore"
+
+/**
+ * The single operation the admission mutex exposes: run something while
+ * holding a key's exclusive permit.
+ *
+ * It is deliberately not a lock/unlock pair. Handing out a permit a caller
+ * must remember to return would make an interrupted dispatch leak exclusion
+ * for the rest of the process's life; a bracketing combinator cannot.
+ *
+ * @since 0.1.0
+ * @category services
+ */
+export interface Service {
+  /**
+   * Runs `effect` while holding this process's exclusive permit for `key`.
+   * Concurrent same-key callers wait; the permit is released on any exit,
+   * including interruption.
+   */
+  readonly withPermit: (
+    key: string
+  ) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>
+}
+
+/**
+ * Constructs the keyed admission mutex synchronously.
+ *
+ * Gates are reference-counted and removed once no fiber holds or awaits
+ * them, so the map does not grow with the number of distinct keys a
+ * long-lived process dispatches.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const makeUnsafe = (): Service => {
+  // One layer identity per incarnation; each operation borrows its owner
+  // through a shared memo map, so the last operation releases the RcMap.
+  const Locks = Context.Service<RcMap.RcMap<string, Semaphore.Semaphore>>("AttemptAdmission/Locks")
+  const layer = Layer.effect(Locks, RcMap.make({ lookup: (_key: string) => Semaphore.make(1) }))
+  const owners = Layer.makeMemoMapUnsafe()
+  return {
+    withPermit: (key) => (effect) =>
+      Effect.scoped(Effect.gen(function*() {
+        const services = yield* Layer.buildWithMemoMap(layer, owners, yield* Scope.Scope)
+        const lock = yield* RcMap.get(Context.get(services, Locks), key)
+        return yield* lock.withPermit(effect)
+      }))
+  }
+}

package/src/internal/AttemptLifecycle.ts

@@ -0,0 +1,163 @@
+/**
+ * Complete attempt-history projection. The attempt store remains authoritative;
+ * only v2 histories contain enough evidence to rebuild this projection.
+ *
+ * @since 1.0.0
+ */
+
+import * as EngineEvent from "@smthrs/journal/EngineEvent"
+import * as JournalEvent from "@smthrs/journal/JournalEvent"
+import type * as Projection from "@smthrs/journal/Projection"
+import * as Cause from "effect/Cause"
+import * as Effect from "effect/Effect"
+import * as Schema from "effect/Schema"
+
+/**
+ * An attempt state with completion data required only at completion.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const AttemptLifecycle = EngineEvent.AttemptLifecycle
+/**
+ * An attempt state with completion data required only at completion.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export type AttemptLifecycle = EngineEvent.AttemptLifecycle
+/**
+ * Validate untrusted encoded state without dropping contradictory fields.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decode = (input: unknown) =>
+  Effect.suspend(() => Schema.decodeUnknownEffect(AttemptLifecycle, { onExcessProperty: "error" })(input)).pipe(
+    Effect.catchCause((cause) =>
+      Effect.fail(
+        new EngineEvent.EventError({
+          code: "malformed",
+          message: "invalid attempt lifecycle",
+          cause: Cause.squash(cause)
+        })
+      )
+    )
+  )
+
+/**
+ * The latest complete journal state for one attempt.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export interface Row {
+  readonly executionId: string
+  readonly stepKeyDigest: string
+  readonly attempt: number
+  readonly seq: number
+  readonly lifecycle: AttemptLifecycle
+}
+
+/**
+ * Attempt projection rows, independent of executable engine storage.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export type State = ReadonlyArray<Row>
+
+/**
+ * A versioned retained projection. Its sequence covers every included row.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const Snapshot = Schema.Struct({
+  version: Schema.Literal(2),
+  lineage: EngineEvent.Lineage,
+  seq: JournalEvent.Seq,
+  rows: Schema.Array(Schema.Struct({
+    executionId: JournalEvent.Identifier,
+    stepKeyDigest: JournalEvent.Identifier,
+    attempt: JournalEvent.NonNegativeQuantity,
+    seq: JournalEvent.Seq,
+    lifecycle: AttemptLifecycle
+  }))
+}).check(
+  Schema.makeFilter((snapshot) =>
+    snapshot.rows.every((row) => row.seq <= snapshot.seq && row.executionId === snapshot.lineage.runId) &&
+    new Set(snapshot.rows.map((row) => JSON.stringify([row.executionId, row.stepKeyDigest, row.attempt]))).size ===
+      snapshot.rows.length
+  )
+)
+
+/**
+ * Decode retained state and check all lineage coordinates before suffix replay.
+ * Source admission still applies independently to every suffix event.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const restore = (input: unknown, consumer: EngineEvent.Consumer) =>
+  Effect.suspend(() => Schema.decodeUnknownEffect(Snapshot, { onExcessProperty: "error" })(input)).pipe(
+    Effect.flatMap((snapshot) => {
+      const lineage = snapshot.lineage
+      return lineage.runId !== consumer.runId || lineage.lineageId !== consumer.lineageId ||
+          lineage.rootRunId !== consumer.rootRunId || lineage.round !== consumer.round ||
+          lineage.parentRunId !== consumer.parentRunId
+        ? Effect.fail(
+          new EngineEvent.EventError({
+            code: "foreign",
+            message: "attempt snapshot is outside the consumer lineage",
+            cause: lineage
+          })
+        )
+        : Effect.succeed(snapshot)
+    }),
+    Effect.catchCause((failure) => {
+      const cause = Cause.squash(failure)
+      return Effect.fail(
+        cause instanceof EngineEvent.EventError ?
+          cause
+          : new EngineEvent.EventError({ code: "malformed", message: "invalid attempt snapshot", cause })
+      )
+    })
+  )
+
+/**
+ * Reduces full lifecycle records with monotonic sequence and legal state
+ * transitions. A missing start is incomplete history, never terminal success.
+ *
+ * @category projections
+ * @since 1.0.0
+ */
+export const projection = (consumer: EngineEvent.Consumer): Projection.Projection<State, EngineEvent.EventError> => ({
+  name: "flows/engine/attempts/v2",
+  initial: [],
+  reduce: (state, entry) =>
+    Effect.gen(function*() {
+      const decoded = yield* EngineEvent.decodeEntry(entry, consumer)
+      if (decoded._tag !== "Attempt") return state
+      const { attempt, executionId, lifecycle, stepKeyDigest } = decoded.payload
+      const previous = state.find((row) =>
+        row.executionId === executionId && row.stepKeyDigest === stepKeyDigest && row.attempt === attempt
+      )
+      if (
+        previous === undefined
+          ? lifecycle.state !== "running"
+          : entry.seq <= previous.seq || previous.lifecycle.state === "succeeded" ||
+            previous.lifecycle.state === "failed" || lifecycle.startedAtMs !== previous.lifecycle.startedAtMs
+      ) {
+        return yield* Effect.fail(
+          new EngineEvent.EventError({
+            code: "transition",
+            message: "attempt history has a missing start, reordered record or transition after completion",
+            cause: { previous, entry }
+          })
+        )
+      }
+      const row: Row = { executionId, stepKeyDigest, attempt, seq: entry.seq, lifecycle }
+      return [...state.filter((candidate) => candidate !== previous), row]
+    })
+})

package/src/internal/AttemptProbe.ts

@@ -0,0 +1,90 @@
+/**
+ * Survivor discovery for an action key's attempt rows.
+ *
+ * Two implementations answer the same question — the durable state's single
+ * ordered range read (issue #77) and the point-probe walk against
+ * `AttemptStore` for storage that cannot range-scan. They are kept here
+ * together, behind one entry point, because their answers must agree: a run
+ * that resumes under SQL state and under the fallback must restore the same
+ * retry origin and the same attempt counter (issue #96).
+ *
+ * @since 0.1.0
+ */
+
+import type { AttemptStore } from "@smthrs/run-store"
+import * as Effect from "effect/Effect"
+import * as Option from "effect/Option"
+import type * as DurableEngineState from "../DurableEngineState.ts"
+
+/**
+ * How long a pruned leading run of attempt numbers the survivor scan
+ * tolerates before it reports "no attempt row survives".
+ *
+ * A retention/prune job removes attempts oldest-first, so a surviving
+ * sequence is contiguous once its first row is found; the bound caps the
+ * pruned prefix walk (issue #69). It is a *semantic* bound, not merely a
+ * cost bound: the point-probe fallback cannot distinguish "nothing ever ran"
+ * from "the first 33 attempts were pruned" without a range read, so both
+ * paths apply the same tolerance and a key whose earliest survivor sits past
+ * it restarts its expiration budget and attempt numbering on either backend
+ * (issue #96). Restarting is safe — the pruned numbers are gone, so the
+ * fresh counter cannot collide — and, unlike the previous split, it is the
+ * same behaviour on every backend.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const prunedPrefixScanLimit = 32
+
+/**
+ * Finds the surviving attempt rows for an action key: the earliest row's
+ * start time — the durable retry origin when attempt 1 itself was pruned
+ * (issue #69) — and the highest attempt number contiguous from it, from
+ * which the engine resumes the attempt counter (issue #59). `Option.none()`
+ * means no attempt row survives within `prunedPrefixScanLimit`.
+ *
+ * When the durable state can range-scan attempts, one ordered SELECT answers
+ * both questions (issue #77); otherwise the point-read scan against
+ * `AttemptStore` answers them, paying up to `prunedPrefixScanLimit`
+ * sequential gets for a key that never ran. Both answers pass through the
+ * same tolerance check, so the two paths cannot diverge (issue #96).
+ *
+ * @since 0.1.0
+ * @category combinators
+ */
+export const probeAttempts = (
+  attemptStore: AttemptStore.Service,
+  survivors: DurableEngineState.Service["attemptSurvivors"],
+  runId: string,
+  stepKeyDigest: string
+): Effect.Effect<Option.Option<DurableEngineState.AttemptSurvivors>> =>
+  Effect.gen(function*() {
+    if (survivors !== undefined) {
+      const found = yield* survivors(runId, stepKeyDigest)
+      if (Option.isNone(found)) return Option.none()
+      return found.value.earliestAttempt > prunedPrefixScanLimit
+        ? Option.none()
+        : found
+    }
+    let earliest = Option.none<AttemptStore.Attempt>()
+    let attempt = 1
+    for (; attempt <= prunedPrefixScanLimit; attempt++) {
+      const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt }).pipe(Effect.orDie)
+      if (Option.isSome(row)) {
+        earliest = row
+        break
+      }
+    }
+    if (Option.isNone(earliest)) return Option.none()
+    let latest = attempt
+    for (let next = attempt + 1;; next++) {
+      const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt: next }).pipe(Effect.orDie)
+      if (Option.isNone(row)) break
+      latest = next
+    }
+    return Option.some({
+      earliestAttempt: attempt,
+      earliestStartedAtMs: earliest.value.startedAtMs,
+      latest
+    })
+  })

package/src/internal/CacheAdmission.ts

@@ -0,0 +1,133 @@
+/**
+ * Pure, phase-specific cache evidence admission. Storage decoding, current-read
+ * measurement, TTL history, output replay and publication I/O stay with their owners.
+ * @since 1.0.0-rc.0
+ */
+
+import type { Action } from "@smthrs/flow"
+import type { FileBoundary } from "@smthrs/flow/FileBoundary"
+import * as FileSet from "@smthrs/plan/FileSet"
+import type * as StepBoundary from "../StepBoundary.ts"
+
+/** Reasons an existing declaration cannot name reusable results.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type DisabledReason = "unsealed" | "missing-boundary" | "expected-boundary" | "unresolved-read-glob"
+
+/** Declaration eligibility is separate from proof that a result may be reused.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Declaration =
+  | { readonly _tag: "Eligible"; readonly metadata: FileBoundary }
+  | { readonly _tag: "Disabled"; readonly reason: DisabledReason }
+
+/** The proof-bearing part of already-decoded attempt metadata.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Metadata {
+  readonly tier: Action.Tier
+  readonly boundary?: StepBoundary.BoundaryEvidence | undefined
+  readonly readSetVerified?: true | undefined
+  readonly boundaryQuarantined?: true | undefined
+}
+
+/** A refusal is not a failure of an already durable action outcome.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Refused {
+  readonly _tag: "Refused"
+  readonly reason:
+    | DisabledReason
+    | "invalid-meta"
+    | "unsealed-meta"
+    | "missing-evidence"
+    | "deviation"
+    | "unverified-writes"
+    | "unverified-hermetic-reads"
+    | "unverified-recorded-reads"
+    | "quarantined-evidence"
+    | "contradictory-evidence"
+}
+
+/** Necessary historical evidence, not yet a hit: current reads and outputs still need verification.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface CandidateEvidence<M extends Metadata> {
+  readonly _tag: "CandidateEvidence"
+  readonly meta: M
+  readonly evidence: StepBoundary.BoundaryEvidence
+}
+
+/** Shared gate for fresh completion and durable-completion convergence.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface PublishCompletion<M extends Metadata> {
+  readonly _tag: "PublishCompletion"
+  readonly meta: M
+}
+
+/** Classifies existing declaration policy without changing keys or measuring the host.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export const declaration = (
+  input: { readonly tier: Action.Tier; readonly metadata?: FileBoundary | undefined }
+): Declaration => {
+  if (input.tier !== "sealed") return { _tag: "Disabled", reason: "unsealed" }
+  if (input.metadata === undefined) return { _tag: "Disabled", reason: "missing-boundary" }
+  if (input.metadata.boundaryMode !== "hard") return { _tag: "Disabled", reason: "expected-boundary" }
+  if (input.metadata.readSet.some(FileSet.isGlob)) return { _tag: "Disabled", reason: "unresolved-read-glob" }
+  return { _tag: "Eligible", metadata: input.metadata }
+}
+
+/** Candidate reads are remeasured, so do not require a historical readSetVerified flag here.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export const candidate = <M extends Metadata>(meta: M | undefined): CandidateEvidence<M> | Refused => {
+  if (meta === undefined) return { _tag: "Refused", reason: "invalid-meta" }
+  // Legacy flags never override quarantine. Retain the durable outcome and
+  // the original metadata, but refuse to promote contradictory proof to reuse.
+  if (meta.boundaryQuarantined === true) {
+    return {
+      _tag: "Refused",
+      reason: meta.boundary !== undefined || meta.readSetVerified === true
+        ? "contradictory-evidence"
+        : "quarantined-evidence"
+    }
+  }
+  if (meta.readSetVerified === true && meta.boundary === undefined) {
+    return { _tag: "Refused", reason: "contradictory-evidence" }
+  }
+  if (meta.tier !== "sealed") return { _tag: "Refused", reason: "unsealed-meta" }
+  const evidence = meta.boundary
+  if (evidence === undefined) return { _tag: "Refused", reason: "missing-evidence" }
+  if (evidence.deviation !== undefined) return { _tag: "Refused", reason: "deviation" }
+  if (evidence.wholeTreeWritesVerified !== true) return { _tag: "Refused", reason: "unverified-writes" }
+  if (evidence.hermeticReadsVerified !== true) return { _tag: "Refused", reason: "unverified-hermetic-reads" }
+  return { _tag: "CandidateEvidence", meta, evidence }
+}
+
+/** Publication additionally requires the read proof associated with the completed body.
+ * Both stored quarantine and the caller's current integrity verdict forbid publication.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export const completion = <M extends Metadata>(
+  declared: Declaration,
+  meta: M | undefined,
+  quarantined: boolean
+): PublishCompletion<M> | Refused => {
+  if (quarantined) return { _tag: "Refused", reason: "quarantined-evidence" }
+  if (declared._tag === "Disabled") return { _tag: "Refused", reason: declared.reason }
+  const checked = candidate(meta)
+  if (checked._tag === "Refused") return checked
+  if (checked.meta.readSetVerified !== true) return { _tag: "Refused", reason: "unverified-recorded-reads" }
+  return { _tag: "PublishCompletion", meta: checked.meta }
+}

package/src/internal/CacheAgeHistory.ts

@@ -0,0 +1,58 @@
+/**
+ * Read-only validation of copied cache-age decisions. Producer identities and
+ * persisted payloads remain unchanged; ancestry alone is not a reuse proof.
+ * @since 1.0.0-rc.0
+ */
+
+import { FlowEngine } from "@smthrs/engine"
+import type { Journal, JournalEvent } from "@smthrs/journal"
+import type { RunStore } from "@smthrs/run-store"
+import * as Effect from "effect/Effect"
+import { find, prove } from "./CopiedRecord.ts"
+
+/**
+ * Paged journal lookup shared with copied-record validation.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export { find } from "./CopiedRecord.ts"
+
+const fieldsEqual = (value: unknown, expected: unknown): boolean => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false
+  if (typeof expected !== "object" || expected === null || Array.isArray(expected)) return false
+  const record = value as Readonly<Record<string, unknown>>
+  const keys = Object.keys(expected)
+  return Object.keys(record).length === keys.length &&
+    keys.every((key) => record[key] === (expected as Readonly<Record<string, unknown>>)[key])
+}
+
+/** A copied verdict is usable only through an exact, retained fork prefix.
+ * Missing/compacted ancestry and malformed or unrelated history fail closed.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export const copiedVerdict = (options: {
+  readonly journal: Journal.Service
+  readonly runs: RunStore.Service
+  readonly runId: string
+  readonly decision: JournalEvent.Input
+  readonly conflict: Journal.JournalError
+}): Effect.Effect<"admitted" | "expired", Journal.JournalError> =>
+  Effect.gen(function*() {
+    const { journal, conflict, decision } = options
+    const source = (entry: JournalEvent.Entry) =>
+      entry.sourceId === decision.sourceId && entry.sourceSeq === decision.sourceSeq
+    const entry = yield* find(journal, options.runId, source)
+    if (entry === undefined) return yield* Effect.fail(conflict)
+    const payload = entry.payload as { readonly verdict?: unknown } | null
+    const verdict = payload?.verdict
+    if (verdict !== "admitted" && verdict !== "expired") return yield* Effect.fail(conflict)
+    const expected = { ...decision.payload as Readonly<Record<string, unknown>>, verdict }
+    if (entry.eventType !== decision.eventType || !fieldsEqual(entry.payload, expected)) {
+      return yield* Effect.fail(conflict)
+    }
+    const original = yield* prove({ ...options, entry, same: fieldsEqual })
+    return fieldsEqual(original.record.meta, { lineageId: FlowEngine.Lineage.root(original.ancestor) })
+      ? verdict
+      : yield* Effect.fail(conflict)
+  })

package/src/internal/CacheAgeVerdicts.ts

@@ -0,0 +1,61 @@
+/**
+ * Incremental evidence for the no-TTL cache guard.
+ * @since 1.0.0-rc.0
+ */
+
+import { Journal, JournalEvent } from "@smthrs/journal"
+import * as Effect from "effect/Effect"
+import * as Semaphore from "effect/Semaphore"
+
+/**
+ * Per-executor index of TTL markers in an append-only journal generation.
+ * Refresh before answering, retaining the first record for either its producer
+ * key or payload key so malformed and copied verdicts still refuse removal.
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export const make = (runId: string) => {
+  const gate = Semaphore.makeUnsafe(1)
+  const id = JournalEvent.RunId.make(runId)
+  let source: Journal.Service | undefined
+  let generation: number | undefined
+  let after: JournalEvent.Seq | undefined
+  const verdicts = new Map<string, JournalEvent.Entry>()
+  return (
+    journal: Journal.Service,
+    keyDigest: string
+  ): Effect.Effect<JournalEvent.Entry | undefined, Journal.JournalError> =>
+    Semaphore.withPermit(gate)(Effect.gen(function*() {
+      const currentGeneration = journal.generation === undefined ? 0 : (yield* journal.generation(id)).generation
+      if (source !== journal || generation !== currentGeneration) {
+        source = journal
+        generation = currentGeneration
+        after = undefined
+        verdicts.clear()
+      }
+      while (true) {
+        const page = yield* journal.entries({ runId: id, limit: 128, ...after === undefined ? {} : { after } })
+        const next = page.entries.at(-1)?.seq
+        if (
+          (page.hasMore && next === undefined) ||
+          (next !== undefined && after !== undefined && next <= after)
+        ) {
+          return yield* Effect.fail(
+            new Journal.JournalError({ code: "read_failed", message: "cache history cursor did not advance" })
+          )
+        }
+        for (const entry of page.entries) {
+          const producerKey = /^cache:([^:]+):ttl:/.exec(entry.sourceId)?.[1]
+          const payload = entry.payload as { action?: unknown; keyDigest?: unknown } | null
+          if (producerKey !== undefined && !verdicts.has(producerKey)) verdicts.set(producerKey, entry)
+          if (payload?.action === "ttl" && typeof payload.keyDigest === "string" && !verdicts.has(payload.keyDigest)) {
+            verdicts.set(payload.keyDigest, entry)
+          }
+        }
+        // Publish each fully processed page, including the final one. A read
+        // failure or interruption retries only the unvalidated suffix.
+        after = next ?? after
+        if (!page.hasMore) return verdicts.get(keyDigest)
+      }
+    }))
+}