@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/internal/ActionPersistence.js

@@ -0,0 +1,1395 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ActionPersistence_exports = {};
+__export(ActionPersistence_exports, {
+  AttemptAdmissionRejected: () => AttemptAdmissionRejected,
+  AttemptEvidenceQuarantined: () => AttemptEvidenceQuarantined,
+  AttemptSuspended: () => AttemptSuspended,
+  CacheConflictDetected: () => CacheConflictDetected,
+  CacheCorruptionDetected: () => CacheCorruptionDetected,
+  earliestBoundarySnapshot: () => earliestBoundarySnapshot,
+  evidenceQuarantined: () => evidenceQuarantined,
+  make: () => make,
+  maxInertJsonCharacters: () => maxInertJsonCharacters,
+  maxInertJsonDepth: () => maxInertJsonDepth,
+  maxInertJsonNodes: () => maxInertJsonNodes
+});
+module.exports = __toCommonJS(ActionPersistence_exports);
+var import_crypto = require("@smthrs/crypto");
+var import_engine = require("@smthrs/engine");
+var import_flow = require("@smthrs/flow");
+var CacheEnvironment = __toESM(require("@smthrs/flow/CacheEnvironment"), 1);
+var import_journal = require("@smthrs/journal");
+var import_kernel = require("@smthrs/kernel");
+var import_keys = require("@smthrs/keys");
+var import_run_store = require("@smthrs/run-store");
+var import_step_cache = require("@smthrs/step-cache");
+var Cause = __toESM(require("effect/Cause"), 1);
+var Clock = __toESM(require("effect/Clock"), 1);
+var Context = __toESM(require("effect/Context"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Exit = __toESM(require("effect/Exit"), 1);
+var Metric = __toESM(require("effect/Metric"), 1);
+var Option = __toESM(require("effect/Option"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var EngineStoreMetrics = __toESM(require("../EngineStoreMetrics.js"), 1);
+var Inconsistency = __toESM(require("../Inconsistency.js"), 1);
+var ReplayOnly = __toESM(require("../ReplayOnly.js"), 1);
+var StepBoundary = __toESM(require("../StepBoundary.js"), 1);
+var StepSandbox = __toESM(require("../StepSandbox.js"), 1);
+var WorkspaceSandbox = __toESM(require("../WorkspaceSandbox.js"), 1);
+var AttemptAdmission = __toESM(require("./AttemptAdmission.js"), 1);
+var CacheAdmission = __toESM(require("./CacheAdmission.js"), 1);
+var CacheAgeHistory = __toESM(require("./CacheAgeHistory.js"), 1);
+var CacheAgeVerdicts = __toESM(require("./CacheAgeVerdicts.js"), 1);
+var CacheOutputPolicy = __toESM(require("./CacheOutputPolicy.js"), 1);
+var CachePublication = __toESM(require("./CachePublication.js"), 1);
+var CallFacts = __toESM(require("./CallFacts.js"), 1);
+var CopiedRecord = __toESM(require("./CopiedRecord.js"), 1);
+var EffectRecords = __toESM(require("./EffectRecords.js"), 1);
+var HostReflection = __toESM(require("./HostReflection.js"), 1);
+var JournalRecords = __toESM(require("./JournalRecords.js"), 1);
+var ProvenanceSlot = __toESM(require("./ProvenanceSlot.js"), 1);
+var SandboxedExecution = __toESM(require("./SandboxedExecution.js"), 1);
+var StepFacts = __toESM(require("./StepFacts.js"), 1);
+class AttemptSuspended extends Schema.TaggedError()(
+  "@smthrs/engine-store/AttemptSuspended",
+  {
+    code: Schema.Literal("attempt_suspended"),
+    runId: Schema.String,
+    keyDigest: Schema.String,
+    attempt: Schema.Int
+  }
+) {
+}
+class AttemptAdmissionRejected extends Schema.TaggedError()(
+  "@smthrs/engine-store/AttemptAdmissionRejected",
+  {
+    code: Schema.Literal("attempt_admission_rejected"),
+    keyDigest: Schema.String,
+    outcome: Schema.String
+  }
+) {
+}
+class CacheConflictDetected extends Schema.TaggedError()(
+  "@smthrs/engine-store/CacheConflictDetected",
+  {
+    code: Schema.Literal("cache_conflict_detected"),
+    keyDigest: Schema.String,
+    recordedRunId: Schema.String
+  }
+) {
+}
+class CacheCorruptionDetected extends Schema.TaggedError()(
+  "@smthrs/engine-store/CacheCorruptionDetected",
+  {
+    code: Schema.Literal("cache_corruption_detected"),
+    keyDigest: Schema.String,
+    path: Schema.String,
+    recordedDigest: Schema.String,
+    measuredDigest: Schema.String
+  }
+) {
+}
+class AttemptEvidenceQuarantined extends Schema.TaggedError()(
+  "@smthrs/engine-store/AttemptEvidenceQuarantined",
+  {
+    code: Schema.Literal("attempt_evidence_quarantined"),
+    keyDigest: Schema.String,
+    attempt: Schema.Int,
+    path: Schema.String,
+    recordedDigest: Schema.String,
+    measuredDigest: Schema.String
+  }
+) {
+}
+const evidenceQuarantined = (cause) => {
+  for (const reason of cause.reasons) {
+    const carried = Cause.isFailReason(reason) ? reason.error : Cause.isDieReason(reason) ? reason.defect : void 0;
+    if (carried instanceof AttemptEvidenceQuarantined) {
+      return carried;
+    }
+  }
+  return void 0;
+};
+const replayCorruption = (cause) => {
+  for (const reason of cause.reasons) {
+    if (Cause.isFailReason(reason) && reason.error instanceof StepBoundary.BoundaryCorruption) {
+      return reason.error;
+    }
+  }
+  return void 0;
+};
+const actionKind = (action) => typeof action === "object" && action !== null && typeof action.name === "string" ? action.name : "flows/engine-store/action";
+const declarationViolated = (cause) => cause.reasons.some(
+  (reason) => Cause.isFailReason(reason) && (reason.error instanceof StepBoundary.UndeclaredWrite || reason.error instanceof StepSandbox.UndeclaredRead)
+);
+const settlementViolated = (cause) => cause.reasons.some(
+  (reason) => Cause.isFailReason(reason) && (reason.error instanceof StepBoundary.UndeclaredWrite || reason.error instanceof StepBoundary.MissingDeclaredOutput || reason.error instanceof StepBoundary.SurvivingDeclaredRemoval)
+);
+const AttemptMeta = Schema.Struct({
+  tier: Schema.Literals(["sealed", "compensable", "irreversible"]),
+  // Only a genuine action idempotency key permits automatic released retry.
+  // Old rows without this evidence remain fail-closed (issues #2982/#3409).
+  keyed: Schema.optional(Schema.Literal(true)),
+  /**
+   * The sealed declaration admits multiple legitimate recorded results under
+   * this key. Absence remains the durable determinism claim.
+   */
+  nondeterministic: Schema.optional(Schema.Literal(true)),
+  boundary: Schema.optional(StepBoundary.BoundaryEvidence),
+  /**
+   * The prepare-time measurement matched the caller-declared read set the
+   * step key was derived from (issue #106). Only such completions may enter
+   * the shared cache: a stale declaration executes against the *real*
+   * content, so recording its result under the declaration's key would hand
+   * a later, genuinely accurate run the wrong value as a verified hit.
+   */
+  readSetVerified: Schema.optional(Schema.Literal(true)),
+  /**
+   * The row's boundary evidence failed integrity verification and was removed
+   * after its detailed corruption record reached the journal (issue #171).
+   * The succeeded outcome remains authoritative, but this row may never be
+   * converged into the shared cache again.
+   */
+  boundaryQuarantined: Schema.optional(Schema.Literal(true)),
+  /**
+   * The failed row records a boundary violation (a prepare or settle
+   * failure), so the failed replay branch can re-emit the `hardViolation`
+   * journal record idempotently after a crash in the finish→emit window
+   * (issue #109) — the violation kind is not recoverable from the persisted
+   * cause alone.
+   */
+  hardViolation: Schema.optional(Schema.Literal(true)),
+  snapshotId: Schema.optional(Schema.String),
+  /**
+   * The jj operation that recorded `snapshotId`, when the host reports one.
+   * A whole-repository rewind restores it to undo bookmark moves, rebases,
+   * `describe`, and `abandon` that a tree restore leaves in place.
+   */
+  snapshotOperationId: Schema.optional(Schema.String),
+  /**
+   * The engine `SnapshotBoundary` handle taken before this attempt executed.
+   * Wrapped so an opaque `null` or `undefined` handle stays distinguishable
+   * from no handle; `handle` is absent when the handle was `undefined`.
+   */
+  boundarySnapshot: Schema.optional(Schema.Struct({ handle: Schema.optionalKey(Schema.Unknown) })),
+  // The incarnation that admitted the running row. Since issues #102/#103
+  // the adoption decision rests on the admission permit rather than this
+  // nonce — a live same-key fiber of this process would be holding the
+  // permit, which distinguishes a dead fiber from a live dispatch in a way
+  // the recorded incarnation cannot — but the field is kept as durable
+  // forensic evidence of which incarnation last drove the attempt.
+  admittedBy: Schema.optional(import_run_store.Ownership.OwnerId),
+  /**
+   * How far this attempt's effect boundary got, in EXECUTABLE state.
+   *
+   * The journal's boundary records already say this, and adoption cannot use
+   * them: `@smthrs/journal` puts every payload it writes through redaction,
+   * deliberately, so a recorded `output` may never be re-entered as a flow's
+   * result (issue #72), and the journal offers no read addressed by producer
+   * identity — only a full scan of the run. So the same fact is written here,
+   * where the attempt's `outcome` column is already replayed verbatim, in the
+   * SAME transaction as the record that describes it.
+   *
+   * - `intended`: the body was dispatched and its outcome is not durably
+   *   known. Whether the effect reached the outside world is genuinely
+   *   unanswerable from durable state.
+   * - `parked`: the body reached a durable wait and suspended, so it never
+   *   finished and nothing crossed. Recorded explicitly because a park leaves
+   *   the same `running` row a crash does.
+   * - `succeeded`: the body completed and the row carries its result.
+   */
+  effectCrossing: Schema.optional(Schema.Literals(["intended", "parked", "succeeded"]))
+});
+const decodeMeta = (value) => {
+  const decoded = Schema.decodeUnknownResult(AttemptMeta)(value);
+  return decoded._tag === "Success" ? decoded.success : void 0;
+};
+const earliestBoundarySnapshot = (attempts, runId, stepKeyDigest, range) => Effect.gen(function* () {
+  for (let attempt = range.earliest; attempt <= range.latest; attempt++) {
+    const row = yield* attempts.get({ runId, stepKeyDigest, attempt }).pipe(Effect.orDie);
+    const persisted = Option.isSome(row) ? decodeMeta(row.value.meta)?.boundarySnapshot : void 0;
+    if (persisted !== void 0) return Option.some(persisted.handle);
+  }
+  return Option.none();
+});
+const CauseJson = Schema.Struct({
+  reasons: Schema.Array(Schema.Union([
+    Schema.Struct({ _tag: Schema.Literal("Fail"), error: Schema.Unknown }),
+    Schema.Struct({ _tag: Schema.Literal("Die"), defect: Schema.Unknown }),
+    Schema.Struct({
+      _tag: Schema.Literal("Interrupt"),
+      fiberId: Schema.optional(Schema.NullOr(Schema.Number))
+    })
+  ]))
+});
+const maxInertJsonDepth = import_run_store.AttemptStore.maximumJsonDepth - 4;
+const maxInertJsonNodes = import_run_store.AttemptStore.maximumJsonNodes - 8;
+const maxInertJsonCharacters = 256 * 1024;
+const inertJsonRejected = /* @__PURE__ */ Symbol("inertJsonRejected");
+const inertJsonOmitted = /* @__PURE__ */ Symbol("inertJsonOmitted");
+const arrayBufferViewMarker = "[ArrayBufferView]";
+const spendNodes = (budget, nodes) => {
+  if (budget.nodes + nodes > maxInertJsonNodes) return false;
+  budget.nodes += nodes;
+  return true;
+};
+const isWellFormedInertString = (value) => {
+  for (let index = 0; index < value.length; index++) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const low = value.charCodeAt(++index);
+      if (!(low >= 56320 && low <= 57343)) return false;
+    } else if (unit >= 56320 && unit <= 57343) return false;
+  }
+  return true;
+};
+const spend = (budget, value) => {
+  budget.characters += value.length;
+  return budget.characters <= maxInertJsonCharacters && isWellFormedInertString(value);
+};
+const spendEnumeratedKey = (budget, key) => {
+  budget.enumeratedKeys += 1;
+  if (budget.enumeratedKeys > maxInertJsonNodes) return false;
+  return typeof key !== "string" || spend(budget, key);
+};
+const inertJson = (value, budget) => {
+  const active = /* @__PURE__ */ new WeakSet();
+  const reduce = (current, depth) => {
+    if (depth > maxInertJsonDepth) return inertJsonRejected;
+    if (depth > 0 && !spendNodes(budget, 1)) return inertJsonRejected;
+    if (current === null) return null;
+    switch (typeof current) {
+      case "boolean":
+        return current;
+      case "number":
+        return Number.isFinite(current) ? current : null;
+      case "string":
+        return spend(budget, current) ? current : inertJsonRejected;
+      case "undefined":
+      case "symbol":
+      case "function":
+      case "bigint":
+        return inertJsonOmitted;
+      case "object": {
+        if (HostReflection.host.isProxy(current) || active.has(current)) return inertJsonRejected;
+        if (ArrayBuffer.isView(current)) return arrayBufferViewMarker;
+        active.add(current);
+        try {
+          if (Array.isArray(current)) {
+            const lengthDescriptor = Object.getOwnPropertyDescriptor(current, "length");
+            if (lengthDescriptor === void 0 || !("value" in lengthDescriptor) || typeof lengthDescriptor.value !== "number") return inertJsonRejected;
+            const output2 = [];
+            for (let index = 0; index < lengthDescriptor.value; index++) {
+              const descriptor = Object.getOwnPropertyDescriptor(current, String(index));
+              const reduced = reduce(
+                descriptor !== void 0 && "value" in descriptor ? descriptor.value : void 0,
+                depth + 1
+              );
+              if (reduced === inertJsonRejected) return inertJsonRejected;
+              output2.push(reduced === inertJsonOmitted ? null : reduced);
+            }
+            return output2;
+          }
+          const output = {};
+          const tag = Object.getOwnPropertyDescriptor(current, "_tag");
+          const conflictMessage = tag !== void 0 && "value" in tag && tag.value === WorkspaceSandbox.MaterializationConflict.identifier;
+          for (const key of Reflect.ownKeys(current)) {
+            if (!spendEnumeratedKey(budget, key)) return inertJsonRejected;
+            if (typeof key !== "string") continue;
+            const descriptor = Object.getOwnPropertyDescriptor(current, key);
+            if (descriptor === void 0) continue;
+            if (!descriptor.enumerable && !(key === "message" && conflictMessage) || !("value" in descriptor)) {
+              continue;
+            }
+            const member = (key === "message" || key === "stack") && typeof descriptor.value === "string" ? import_journal.Redaction.redact(descriptor.value) : descriptor.value;
+            const reduced = reduce(member, depth + 1);
+            if (reduced === inertJsonRejected) return inertJsonRejected;
+            if (reduced === inertJsonOmitted) continue;
+            Object.defineProperty(output, key, {
+              value: reduced,
+              enumerable: true,
+              configurable: true,
+              writable: true
+            });
+          }
+          return output;
+        } finally {
+          active.delete(current);
+        }
+      }
+    }
+    return inertJsonRejected;
+  };
+  try {
+    const reduced = reduce(value, 0);
+    return reduced === inertJsonRejected || reduced === inertJsonOmitted ? null : reduced;
+  } catch {
+    return null;
+  }
+};
+const persistCause = (cause) => {
+  const budget = { nodes: 2, characters: 0, enumeratedKeys: 0 };
+  const reasons = [];
+  for (const reason of cause.reasons) {
+    if (!spendNodes(budget, 3)) {
+      return { reasons: [{ _tag: "Die", defect: null }] };
+    }
+    if (Cause.isFailReason(reason)) {
+      reasons.push({ _tag: "Fail", error: inertJson(reason.error, budget) });
+    } else if (Cause.isDieReason(reason)) {
+      reasons.push({ _tag: "Die", defect: inertJson(reason.defect, budget) });
+    } else {
+      reasons.push({ _tag: "Interrupt", fiberId: reason.fiberId ?? null });
+    }
+  }
+  return { reasons };
+};
+const attemptPayload = (value) => value;
+const rehydrateCause = (error) => {
+  const decoded = Schema.decodeUnknownResult(CauseJson)(error);
+  if (decoded._tag === "Success" && decoded.success.reasons.length > 0) {
+    return Cause.fromReasons(decoded.success.reasons.map((reason) => {
+      switch (reason._tag) {
+        case "Fail":
+          return Cause.makeFailReason(reason.error);
+        case "Die":
+          return Cause.makeDieReason(reason.defect);
+        case "Interrupt":
+          return Cause.makeInterruptReason(reason.fiberId ?? void 0);
+      }
+    }));
+  }
+  return Cause.die(error);
+};
+const declaredCachePolicy = (action) => {
+  const annotations = action?.annotations;
+  return Context.isContext(annotations) ? CacheEnvironment.cachePolicyOf(annotations) : void 0;
+};
+const make = (deps) => {
+  const execute = (input, stepKeyDigest) => Effect.andThen(
+    import_flow.Action.reportDispatch({ outcome: "executed", stepKeyDigest, attempt: input.attempt }),
+    deps.execute(input)
+  );
+  const admission = deps.admission ?? AttemptAdmission.makeUnsafe();
+  const recordedAgeVerdict = deps.cacheAgeVerdict ?? CacheAgeVerdicts.make(deps.runId);
+  const lineageId = import_engine.FlowEngine.Lineage.root(deps.runId);
+  return Effect.fn("ActionPersistence.execute")((input) => {
+    const replay = { gated: false };
+    return Effect.gen(function* () {
+      yield* Effect.annotateCurrentSpan({
+        runId: deps.runId,
+        attempt: input.attempt,
+        tier: input.tier
+      });
+      const attempts = yield* import_run_store.AttemptStore.AttemptStore;
+      const cache = yield* import_step_cache.CacheStore.CacheStore;
+      const journal = yield* import_journal.Journal.Journal;
+      const runs = yield* import_run_store.RunStore.RunStore;
+      const policy = declaredCachePolicy(input.action);
+      const scopeTag = policy?.scope === "run" ? `run:${deps.runId}` : policy?.scope === "flow" ? `flow:${Option.getOrUndefined(
+        Option.map(yield* Effect.serviceOption(import_flow.FlowRuntime.FlowInstance), (instance) => instance.flow._tag)
+      ) ?? `run:${deps.runId}`}` : void 0;
+      const stepKeyDigest = yield* Schema.decodeUnknownEffect(import_crypto.Sha256)(input.key).pipe(Effect.orDie);
+      replay.stepKeyDigest = stepKeyDigest;
+      const keyDigest = scopeTag === void 0 ? stepKeyDigest : yield* Schema.decodeUnknownEffect(import_crypto.Sha256)(`${input.key}\0scope:${scopeTag}`).pipe(Effect.orDie);
+      yield* Effect.annotateCurrentSpan({ stepKeyDigest, keyDigest });
+      const attemptId = { runId: deps.runId, stepKeyDigest, attempt: input.attempt };
+      const emitLifecycle = (record) => journal.emitDurable(record, deps.owner).pipe(
+        Effect.catch((error) => error.code === "fence_lost" ? Effect.interrupt : Effect.fail(error))
+      );
+      const callFacts = CallFacts.make(input.action, deps.runId);
+      const stepFacts = StepFacts.make(input.action, deps.runId);
+      const emitStepSettled = (outcome) => Effect.flatMap(
+        stepFacts.settled(outcome),
+        (record) => record === void 0 ? Effect.void : Effect.asVoid(emitLifecycle(record))
+      );
+      const emitCallInvoked = Effect.flatMap(
+        callFacts.invoked,
+        (record) => record === void 0 ? Effect.void : Effect.asVoid(emitLifecycle(record))
+      );
+      const emitCallSettled = (outcome) => Effect.flatMap(
+        callFacts.settled(outcome),
+        (record) => record === void 0 ? Effect.void : Effect.asVoid(emitLifecycle(record))
+      );
+      const atomically = (effect) => journal.transact(effect);
+      const settleAttempt = (row, records) => atomically(Effect.gen(function* () {
+        const finished = yield* attempts.finish(row, deps.owner);
+        if (finished._tag !== "Finished") {
+          return false;
+        }
+        if (row.state === "succeeded" && stepFacts.annotated) {
+          const committed = yield* attempts.get(attemptId);
+          if (Option.isNone(committed)) {
+            return yield* Effect.fail(
+              new import_run_store.AttemptStore.AttemptStoreError({
+                code: "persistence_failed",
+                method: "get",
+                message: "Finished checkpoint outcome disappeared",
+                cause: attemptId
+              })
+            );
+          }
+          yield* emitStepSettled(committed.value.outcome);
+        }
+        yield* Effect.forEach(records, (record) => emitLifecycle(record), { discard: true });
+        if (row.state === "succeeded" && callFacts.settles) {
+          const committed = yield* attempts.get(attemptId);
+          if (Option.isNone(committed)) {
+            return yield* Effect.die(new Error("Finished call outcome disappeared"));
+          }
+          yield* emitCallSettled(committed.value.outcome);
+        }
+        return true;
+      }));
+      const fencedAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+      const heartbeat = yield* runs.heartbeat(deps.runId, deps.owner, fencedAtMs);
+      if (heartbeat._tag !== "Updated") {
+        return yield* Effect.interrupt;
+      }
+      if (input.tier === "irreversible" && input.attempt > 1 && deps.idempotencyKey === void 0) {
+        return yield* Effect.fail(
+          new import_flow.Action.IrreversibleRetryRequiresIdempotencyKey({
+            actionName: actionKind(input.action),
+            attempt: input.attempt
+          })
+        );
+      }
+      const cacheDeclaration = CacheAdmission.declaration(input);
+      const declarationMeta = {
+        tier: input.tier,
+        ...deps.idempotencyKey === void 0 ? {} : { keyed: true },
+        ...input.nondeterministic === void 0 ? {} : { nondeterministic: input.nondeterministic }
+      };
+      const cacheSource = (action, recorded) => ({
+        runId: deps.runId,
+        lineageId,
+        sourceId: `cache:${keyDigest}:${action}${recorded === void 0 ? "" : `:${recorded.runId}:${recorded.eventSeq}`}`,
+        sourceSeq: 0
+      });
+      const noteUnshareable = (unshareable) => Effect.gen(function* () {
+        const reason = yield* Schema.decodeUnknownEffect(import_crypto.Sha256)(`${unshareable.stage}:${unshareable.message}`).pipe(
+          Effect.orDie
+        );
+        yield* emitLifecycle(JournalRecords.cacheProvenance(cacheSource(`unpublished:${reason}`), {
+          keyDigest,
+          action: "unpublished",
+          stage: unshareable.stage,
+          message: unshareable.message
+        }));
+      });
+      const recordCache = (options) => Effect.gen(function* () {
+        const meta = options.admission.meta;
+        let unshareable = yield* CachePublication.publishArtifacts(meta.boundary);
+        const generation = yield* Schema.decodeUnknownEffect(import_keys.DerivedKey)({
+          kind: "cache-generation",
+          meta,
+          result: options.result
+        }).pipe(Effect.orDie);
+        const recording = yield* atomically(
+          Effect.gen(function* () {
+            const receipt = yield* emitLifecycle(
+              JournalRecords.cacheProvenance({
+                runId: deps.runId,
+                lineageId,
+                cacheKey: keyDigest,
+                sourceId: `${deps.sourceId}:cache:${keyDigest}:recorded:${generation}`,
+                sourceSeq: 0
+              }, { keyDigest, action: "recorded" })
+            );
+            const entry = {
+              keyDigest,
+              result: options.result,
+              meta,
+              createdAtMs: options.createdAtMs,
+              recordedRunId: deps.runId,
+              recordedEventSeq: receipt.seq
+            };
+            const outcome = yield* cache.put(entry);
+            if (outcome._tag === "Inserted") {
+              const recorded = { runId: deps.runId, eventSeq: receipt.seq };
+              yield* emitLifecycle(JournalRecords.cacheProvenance(cacheSource("admitted", recorded), {
+                keyDigest,
+                action: "admitted",
+                recordedRunId: recorded.runId,
+                recordedEventSeq: recorded.eventSeq
+              }));
+            }
+            return { entry, outcome };
+          })
+        ).pipe(Effect.catchTag("@smthrs/step-cache/CacheStoreError", (error) => (
+          // Only availability of the local transaction is optional. A known
+          // deterministic Conflict below still belongs to Inconsistency.
+          noteUnshareable({ stage: "entry", message: `local cache publication failed: ${error.message}` }).pipe(
+            Effect.as(void 0)
+          )
+        )));
+        if (recording === void 0) {
+          return;
+        }
+        if (unshareable === void 0 && recording.outcome._tag !== "Conflict") {
+          unshareable = yield* CachePublication.publishEntry(recording.entry);
+        }
+        if (unshareable !== void 0) {
+          yield* noteUnshareable(unshareable);
+        }
+        if (recording.outcome._tag === "Conflict") {
+          const conflicting = yield* cache.get(keyDigest);
+          if (meta.nondeterministic === true) {
+            const recorded = Option.map(conflicting, (entry) => ({
+              runId: entry.recordedRunId,
+              eventSeq: entry.recordedEventSeq
+            }));
+            yield* emitLifecycle(
+              JournalRecords.cacheProvenance(
+                cacheSource("conflict_first_writer", Option.getOrUndefined(recorded)),
+                {
+                  keyDigest,
+                  action: "conflict_first_writer",
+                  recordedRunId: Option.getOrNull(Option.map(recorded, (value) => value.runId)),
+                  recordedEventSeq: Option.getOrNull(Option.map(recorded, (value) => value.eventSeq))
+                }
+              )
+            );
+            return;
+          }
+          const receiverOption = yield* Effect.serviceOption(Inconsistency.Inconsistency);
+          const receiver = Option.isSome(receiverOption) ? receiverOption.value : Inconsistency.make({ journal, verdict: "fail", owner: deps.owner });
+          const verdict = yield* receiver.note({
+            key: keyDigest,
+            existing: Option.getOrUndefined(conflicting),
+            attempted: recording.entry
+          });
+          if (verdict === "fail") {
+            return yield* Effect.fail(
+              new CacheConflictDetected({
+                code: "cache_conflict_detected",
+                keyDigest,
+                recordedRunId: Option.isSome(conflicting) ? conflicting.value.recordedRunId : "unknown"
+              })
+            );
+          }
+        }
+      });
+      return yield* admission.withPermit(`${deps.runId}|${stepKeyDigest}`)(
+        Effect.gen(function* () {
+          const attemptSource = (record) => ({
+            runId: deps.runId,
+            lineageId,
+            // A sealed dispatch's result lives in the step cache, so the record
+            // carries the digest that addresses it: replay hands the projection
+            // the sealed value instead of re-deriving it, and a cache miss is
+            // simply an absent value rather than a broken fold.
+            ...input.tier === "sealed" ? { cacheKey: keyDigest } : {},
+            sourceId: `${deps.sourceId}:attempt:${stepKeyDigest}:${input.attempt}:${record}`,
+            sourceSeq: 0
+          });
+          const emitConverging = (record) => emitLifecycle(record).pipe(
+            Effect.catch(
+              (error) => error.code !== "idempotency_conflict" ? Effect.fail(error) : record.eventType === "flows.engine.cache-provenance" ? ProvenanceSlot.accept({ journal, runId: deps.runId, record, conflict: error }) : CopiedRecord.accept({ journal, runs, runId: deps.runId, record, conflict: error })
+            )
+          );
+          const expireRow = (ttlMs, stale) => Effect.gen(function* () {
+            const recorded = {
+              runId: stale.recordedRunId,
+              eventSeq: stale.recordedEventSeq
+            };
+            const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+            yield* emitConverging(
+              JournalRecords.cacheProvenance(cacheSource("expired", recorded), {
+                keyDigest,
+                action: "expired",
+                ttlMs,
+                ageMs: nowMs - stale.createdAtMs,
+                recordedRunId: recorded.runId,
+                recordedEventSeq: recorded.eventSeq
+              })
+            );
+            yield* cache.evict(keyDigest, { ifRecordedBy: recorded });
+          });
+          const admitByAge = (ttlMs, row) => Effect.gen(function* () {
+            const recorded = { runId: row.recordedRunId, eventSeq: row.recordedEventSeq };
+            const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+            const measured = nowMs - row.createdAtMs <= ttlMs ? "admitted" : "expired";
+            const decision = (verdict) => JournalRecords.cacheProvenance(cacheSource("ttl", recorded), {
+              keyDigest,
+              action: "ttl",
+              ttlMs,
+              verdict,
+              recordedRunId: recorded.runId,
+              recordedEventSeq: recorded.eventSeq
+            });
+            const expectedSource = cacheSource("ttl", recorded).sourceId;
+            const prior = yield* CacheAgeHistory.find(journal, deps.runId, (entry) => {
+              const payload = entry.payload;
+              return entry.sourceId === expectedSource || payload?.action === "ttl" && payload.keyDigest === keyDigest && payload.recordedRunId === recorded.runId && payload.recordedEventSeq === recorded.eventSeq;
+            });
+            if (prior !== void 0 && (prior.sourceId !== expectedSource || prior.sourceSeq !== 0)) {
+              yield* emitConverging(JournalRecords.cacheProvenance(cacheSource("replay_failed", recorded), {
+                keyDigest,
+                action: "replay_failed",
+                reason: "incompatible-age-history",
+                recordedRunId: recorded.runId,
+                recordedEventSeq: recorded.eventSeq
+              }));
+              return yield* Effect.fail(
+                new import_journal.Journal.JournalError({
+                  code: "idempotency_conflict",
+                  message: "incompatible recorded cache-age decision: producer identity changed",
+                  cause: prior
+                })
+              );
+            }
+            return yield* emitLifecycle(decision(measured)).pipe(
+              Effect.as(measured),
+              Effect.catch((error) => {
+                if (error.code !== "idempotency_conflict") {
+                  return Effect.fail(error);
+                }
+                const conflict = new import_journal.Journal.JournalError({
+                  code: "idempotency_conflict",
+                  message: "incompatible recorded cache-age decision: restore the original TTL and history identity or use a new action identity; the cache row was not served or expired",
+                  cause: error
+                });
+                const opposite = measured === "admitted" ? "expired" : "admitted";
+                return emitLifecycle(decision(opposite)).pipe(
+                  Effect.catch(
+                    (oppositeError) => oppositeError.code === "idempotency_conflict" ? CacheAgeHistory.copiedVerdict({
+                      journal,
+                      runs,
+                      runId: deps.runId,
+                      decision: decision(measured),
+                      conflict
+                    }).pipe(
+                      Effect.tapError(
+                        (failure) => failure.code === "idempotency_conflict" ? emitConverging(JournalRecords.cacheProvenance(cacheSource("replay_failed", recorded), {
+                          keyDigest,
+                          action: "replay_failed",
+                          reason: "incompatible-age-history",
+                          recordedRunId: recorded.runId,
+                          recordedEventSeq: recorded.eventSeq
+                        })).pipe(Effect.asVoid) : Effect.void
+                      ),
+                      Effect.map((verdict) => ({ _tag: "Historical", verdict }))
+                    ) : Effect.fail(oppositeError)
+                  ),
+                  Effect.flatMap(
+                    (receipt) => receipt._tag === "Historical" ? Effect.succeed(receipt.verdict) : receipt._tag === "Duplicate" ? Effect.succeed(opposite) : Effect.fail(conflict)
+                  )
+                );
+              })
+            );
+          });
+          const admissible = (ttlMs, row) => Effect.gen(function* () {
+            if (ttlMs === void 0) {
+              const recorded = yield* recordedAgeVerdict(journal, keyDigest);
+              if (recorded !== void 0) {
+                return yield* Effect.fail(
+                  new import_journal.Journal.JournalError({
+                    code: "idempotency_conflict",
+                    message: "incompatible recorded cache-age decision: ttlMs cannot be removed after a recorded verdict",
+                    cause: recorded
+                  })
+                );
+              }
+              return row;
+            }
+            if (Option.isNone(row)) {
+              return row;
+            }
+            if ((yield* admitByAge(ttlMs, row.value)) === "admitted") {
+              return row;
+            }
+            yield* expireRow(ttlMs, row.value);
+            return Option.none();
+          });
+          const existing = yield* attempts.get(attemptId);
+          if (cacheDeclaration._tag === "Eligible") {
+            const observed = yield* cache.get(keyDigest).pipe(
+              Effect.catch(
+                (error) => noteUnshareable({ stage: "entry", message: `cache lookup failed: ${error.message}` }).pipe(
+                  Effect.as(Option.none())
+                )
+              )
+            );
+            const evidenceDecision = CacheAdmission.candidate(
+              Option.isSome(observed) ? decodeMeta(observed.value.meta) : void 0
+            );
+            const outputDecision = evidenceDecision._tag === "CandidateEvidence" ? CacheOutputPolicy.replay(input.metadata, evidenceDecision.evidence) : void 0;
+            const candidate = outputDecision?._tag === "Refused" ? outputDecision : evidenceDecision;
+            const cached = Option.isNone(observed) || candidate._tag === "CandidateEvidence" || policy?.ttlMs === void 0 ? yield* admissible(policy?.ttlMs, observed) : observed;
+            if (Option.isSome(cached)) {
+              if (candidate._tag === "Refused") {
+                yield* emitConverging(JournalRecords.cacheProvenance(
+                  cacheSource("replay_failed", {
+                    runId: cached.value.recordedRunId,
+                    eventSeq: cached.value.recordedEventSeq
+                  }),
+                  {
+                    keyDigest,
+                    action: "replay_failed",
+                    reason: candidate.reason,
+                    recordedRunId: cached.value.recordedRunId,
+                    recordedEventSeq: cached.value.recordedEventSeq
+                  }
+                ));
+              }
+              if (candidate._tag === "CandidateEvidence" && Option.isNone(existing)) {
+                const boundary2 = yield* StepBoundary.StepBoundary;
+                const measured = yield* boundary2.prepare(cacheDeclaration.metadata).pipe(Effect.option);
+                const verified = Option.isSome(measured) && StepBoundary.readSetMatches(measured.value);
+                if (verified) {
+                  const evidence2 = candidate.evidence;
+                  yield* emitCallInvoked;
+                  let materialized = yield* boundary2.replayOutputs(evidence2).pipe(Effect.exit);
+                  if (Exit.isFailure(materialized) && CachePublication.replayMissingArtifact(materialized.cause) !== void 0) {
+                    if (yield* CachePublication.hydrateArtifacts(evidence2)) {
+                      materialized = yield* boundary2.replayOutputs(evidence2).pipe(Effect.exit);
+                    }
+                  }
+                  if (Exit.isSuccess(materialized)) {
+                    const recorded = {
+                      runId: cached.value.recordedRunId,
+                      eventSeq: cached.value.recordedEventSeq
+                    };
+                    yield* emitConverging(JournalRecords.cacheProvenance(cacheSource("hit", recorded), {
+                      keyDigest,
+                      recordedRunId: cached.value.recordedRunId,
+                      recordedEventSeq: cached.value.recordedEventSeq
+                    }));
+                    yield* Metric.update(EngineStoreMetrics.stepCacheDecision.VerifiedHit, 1);
+                    yield* import_flow.Action.reportDispatch({
+                      outcome: "replayed",
+                      stepKeyDigest,
+                      attempt: input.attempt
+                    });
+                    return cached.value.result;
+                  }
+                  const corruption = replayCorruption(materialized.cause);
+                  yield* emitConverging(
+                    JournalRecords.cacheProvenance(
+                      cacheSource("replay_failed", {
+                        runId: cached.value.recordedRunId,
+                        eventSeq: cached.value.recordedEventSeq
+                      }),
+                      {
+                        keyDigest,
+                        action: "replay_failed",
+                        reason: corruption === void 0 ? "host" : "corruption",
+                        recordedRunId: cached.value.recordedRunId,
+                        recordedEventSeq: cached.value.recordedEventSeq
+                      }
+                    )
+                  );
+                  if (corruption !== void 0) {
+                    const receiverOption = yield* Effect.serviceOption(Inconsistency.Inconsistency);
+                    const receiver = Option.isSome(receiverOption) ? receiverOption.value : Inconsistency.make({ journal, verdict: "fail", owner: deps.owner });
+                    const verdict = yield* receiver.noteCorruption({
+                      runId: deps.runId,
+                      keyDigest,
+                      path: corruption.path,
+                      recordedDigest: corruption.recordedDigest,
+                      measuredDigest: corruption.measuredDigest,
+                      recordedRunId: cached.value.recordedRunId,
+                      recordedEventSeq: cached.value.recordedEventSeq
+                    });
+                    yield* cache.evict(keyDigest, {
+                      ifRecordedBy: {
+                        runId: cached.value.recordedRunId,
+                        eventSeq: cached.value.recordedEventSeq
+                      }
+                    });
+                    if (verdict === "fail") {
+                      return yield* Effect.fail(
+                        new CacheCorruptionDetected({
+                          code: "cache_corruption_detected",
+                          keyDigest,
+                          path: corruption.path,
+                          recordedDigest: corruption.recordedDigest,
+                          measuredDigest: corruption.measuredDigest
+                        })
+                      );
+                    }
+                  }
+                  yield* Metric.update(EngineStoreMetrics.stepCacheDecision.ReplayFailed, 1);
+                } else if (Option.isSome(measured)) {
+                  yield* emitConverging(
+                    JournalRecords.cacheProvenance(
+                      cacheSource("stale_read_set", {
+                        runId: cached.value.recordedRunId,
+                        eventSeq: cached.value.recordedEventSeq
+                      }),
+                      {
+                        keyDigest,
+                        action: "stale_read_set",
+                        recordedRunId: cached.value.recordedRunId,
+                        recordedEventSeq: cached.value.recordedEventSeq
+                      }
+                    )
+                  );
+                  yield* cache.evict(keyDigest, {
+                    ifRecordedBy: {
+                      runId: cached.value.recordedRunId,
+                      eventSeq: cached.value.recordedEventSeq
+                    }
+                  });
+                  yield* Metric.update(EngineStoreMetrics.stepCacheDecision.StaleReadSet, 1);
+                } else {
+                  yield* Metric.update(EngineStoreMetrics.stepCacheDecision.Unmeasurable, 1);
+                }
+              } else if (candidate._tag === "Refused") {
+                yield* Metric.update(EngineStoreMetrics.stepCacheDecision.UnverifiableEvidence, 1);
+              }
+            } else {
+              yield* Metric.update(EngineStoreMetrics.stepCacheDecision.Miss, 1);
+            }
+          }
+          if (Option.isSome(existing)) {
+            const row = existing.value;
+            if (row.state === "succeeded") {
+              yield* emitCallInvoked;
+              const meta2 = decodeMeta(row.meta);
+              let corruptEvidence = false;
+              const outputDecision = meta2?.boundary === void 0 ? void 0 : CacheOutputPolicy.replay(input.metadata, meta2.boundary);
+              const storedDecision = CacheAdmission.candidate(meta2);
+              const refused = storedDecision._tag === "Refused" && (storedDecision.reason === "contradictory-evidence" || storedDecision.reason === "quarantined-evidence") ? storedDecision : outputDecision;
+              if (refused?._tag === "Refused") {
+                yield* emitConverging(JournalRecords.cacheProvenance(cacheSource("replay_failed"), {
+                  keyDigest,
+                  action: "replay_failed",
+                  reason: refused.reason
+                }));
+              }
+              if (meta2?.boundary !== void 0 && refused?._tag !== "Refused") {
+                const boundary2 = yield* StepBoundary.StepBoundary;
+                const materialized = yield* boundary2.replayOutputs(meta2.boundary).pipe(Effect.exit);
+                if (Exit.isFailure(materialized)) {
+                  const corruption = replayCorruption(materialized.cause);
+                  corruptEvidence = corruption !== void 0;
+                  yield* emitConverging(
+                    JournalRecords.cacheProvenance(cacheSource("replay_failed"), {
+                      keyDigest,
+                      action: "replay_failed",
+                      reason: corruption === void 0 ? "host" : "corruption"
+                    })
+                  );
+                  if (corruption !== void 0) {
+                    const receiverOption = yield* Effect.serviceOption(Inconsistency.Inconsistency);
+                    const receiver = Option.isSome(receiverOption) ? receiverOption.value : Inconsistency.make({ journal, verdict: "fail", owner: deps.owner });
+                    const verdict = yield* receiver.noteCorruption({
+                      runId: deps.runId,
+                      // The attempt row, not a cache row: this evidence is
+                      // addressed by (runId, stepKeyDigest, attempt).
+                      keyDigest: stepKeyDigest,
+                      path: corruption.path,
+                      recordedDigest: corruption.recordedDigest,
+                      measuredDigest: corruption.measuredDigest
+                    });
+                    const { boundary: _quarantined, readSetVerified: _unverified, ...retainedMeta } = meta2;
+                    const quarantinedMeta = {
+                      ...retainedMeta,
+                      boundaryQuarantined: true
+                    };
+                    const quarantined = yield* atomically(Effect.gen(function* () {
+                      const quarantineAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+                      const fence = yield* runs.heartbeat(deps.runId, deps.owner, quarantineAtMs);
+                      if (fence._tag !== "Updated") {
+                        return false;
+                      }
+                      const patched = yield* attempts.patch(
+                        attemptId,
+                        { meta: attemptPayload(quarantinedMeta) },
+                        deps.owner
+                      );
+                      return patched._tag === "Patched";
+                    }));
+                    if (!quarantined) {
+                      return yield* Effect.interrupt;
+                    }
+                    if (verdict === "fail") {
+                      return yield* Effect.die(
+                        new AttemptEvidenceQuarantined({
+                          code: "attempt_evidence_quarantined",
+                          keyDigest: stepKeyDigest,
+                          attempt: input.attempt,
+                          path: corruption.path,
+                          recordedDigest: corruption.recordedDigest,
+                          measuredDigest: corruption.measuredDigest
+                        })
+                      );
+                    }
+                  }
+                }
+              }
+              const admission3 = CacheAdmission.completion(
+                cacheDeclaration,
+                meta2,
+                corruptEvidence || refused?._tag === "Refused"
+              );
+              if (admission3._tag === "PublishCompletion") {
+                yield* recordCache({
+                  result: row.outcome,
+                  admission: admission3,
+                  createdAtMs: row.finishedAtMs ?? (yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor)))
+                });
+              }
+              if (meta2?.boundary?.deviation !== void 0) {
+                yield* emitConverging(
+                  JournalRecords.expectedSetDeviation(attemptSource("deviation"), {
+                    ...attemptId,
+                    ...meta2.boundary.deviation
+                  })
+                );
+              }
+              yield* emitStepSettled(row.outcome);
+              yield* emitConverging(
+                JournalRecords.attemptFinished(attemptSource("finished"), { ...attemptId, state: "succeeded" })
+              );
+              yield* emitCallSettled(row.outcome);
+              yield* import_flow.Action.reportDispatch({ outcome: "replayed", stepKeyDigest, attempt: input.attempt });
+              return row.outcome;
+            }
+            if (row.state === "failed") {
+              yield* emitCallInvoked;
+              if (decodeMeta(row.meta)?.hardViolation === true) {
+                yield* emitConverging(
+                  JournalRecords.hardViolation(attemptSource("hard-violation"), {
+                    ...attemptId,
+                    error: rehydrateCause(row.error)
+                  })
+                );
+              }
+              yield* emitConverging(
+                JournalRecords.attemptFinished(attemptSource("finished"), { ...attemptId, state: "failed" })
+              );
+              return yield* Effect.failCause(rehydrateCause(row.error));
+            }
+            if (row.state === "suspended") {
+              return yield* Effect.fail(
+                new AttemptSuspended({
+                  code: "attempt_suspended",
+                  runId: deps.runId,
+                  keyDigest: stepKeyDigest,
+                  attempt: input.attempt
+                })
+              );
+            }
+          }
+          const runningRow = Option.isSome(existing) && existing.value.state === "running" ? existing.value : void 0;
+          const runningMeta = runningRow === void 0 ? void 0 : decodeMeta(runningRow.meta);
+          if (runningRow !== void 0 && runningMeta?.effectCrossing === "succeeded") {
+            yield* emitCallInvoked;
+            const finishedAtMs2 = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+            const finished2 = yield* settleAttempt(
+              { ...attemptId, state: "succeeded", finishedAtMs: finishedAtMs2 },
+              [JournalRecords.attemptFinished(attemptSource("finished"), { ...attemptId, state: "succeeded" })]
+            );
+            if (!finished2) {
+              return yield* Effect.interrupt;
+            }
+            return runningRow.outcome;
+          }
+          if (input.tier === "irreversible" && runningMeta?.effectCrossing === "intended" && deps.idempotencyKey === void 0) {
+            return yield* Effect.fail(
+              new import_flow.Action.IrreversibleRetryRequiresIdempotencyKey({
+                actionName: actionKind(input.action),
+                attempt: input.attempt
+              })
+            );
+          }
+          if (deps.replayOnly !== void 0) {
+            replay.gated = true;
+            const refused = {
+              runId: deps.runId,
+              stepKeyDigest,
+              attempt: input.attempt,
+              action: actionKind(input.action)
+            };
+            yield* deps.replayOnly.observe({
+              ...refused,
+              tier: input.tier,
+              outcome: runningRow === void 0 ? "would-execute" : "resumes"
+            });
+            return yield* Effect.die(new ReplayOnly.WouldExecute(refused));
+          }
+          const adopted = runningRow !== void 0;
+          yield* atomically(Effect.gen(function* () {
+            if (!adopted) {
+              const now = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+              const initialMeta = { ...declarationMeta, admittedBy: deps.owner };
+              const put = yield* attempts.put(
+                { ...attemptId, state: "running", startedAtMs: now, meta: attemptPayload(initialMeta) },
+                deps.owner
+              );
+              if (put._tag === "FenceLost" || put._tag === "RunNotFound") {
+                return yield* Effect.interrupt;
+              }
+              if (put._tag !== "Inserted") {
+                return yield* Effect.fail(
+                  new AttemptAdmissionRejected({
+                    code: "attempt_admission_rejected",
+                    keyDigest: stepKeyDigest,
+                    outcome: put._tag
+                  })
+                );
+              }
+            } else {
+              const claimAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+              const claimFence = yield* runs.heartbeat(deps.runId, deps.owner, claimAtMs);
+              if (claimFence._tag !== "Updated") {
+                return yield* Effect.interrupt;
+              }
+              const rehomed = yield* attempts.patch(attemptId, {
+                meta: attemptPayload(
+                  { ...runningMeta, ...declarationMeta, admittedBy: deps.owner }
+                )
+              }, deps.owner);
+              if (rehomed._tag !== "Patched") {
+                return yield* Effect.interrupt;
+              }
+            }
+            yield* emitLifecycle(
+              JournalRecords.attemptStarted(attemptSource("started"), { ...attemptId, tier: input.tier })
+            );
+            yield* emitCallInvoked;
+          }));
+          const snapshotFields = (id, operationId) => operationId === void 0 ? { meta: { snapshotId: id }, announced: { snapshotId: id } } : {
+            meta: { snapshotId: id, snapshotOperationId: operationId },
+            announced: { snapshotId: id, operationId }
+          };
+          const announceSnapshot = (fields) => emitLifecycle(
+            JournalRecords.snapshotIdentified(attemptSource("snapshot"), { ...attemptId, ...fields.announced })
+          );
+          let snapshotId;
+          let snapshotMeta = {};
+          if (input.tier !== "compensable") {
+            yield* emitLifecycle(
+              JournalRecords.snapshotIdentified(attemptSource("snapshot"), { ...attemptId, carried: true })
+            );
+          }
+          if (input.tier === "compensable") {
+            const jj = deps.engineJj === void 0 ? yield* import_kernel.Jj.Jj : deps.engineJj;
+            const boundaryHandle = input.snapshot === void 0 ? void 0 : yield* input.snapshot;
+            const boundarySnapshot = runningMeta?.boundarySnapshot ?? (input.snapshot === void 0 ? void 0 : boundaryHandle === void 0 ? {} : { handle: boundaryHandle });
+            const boundaryMeta = boundarySnapshot === void 0 ? {} : { boundarySnapshot };
+            if (adopted && runningMeta?.snapshotId !== void 0) {
+              yield* jj.restore(runningMeta.snapshotId);
+              snapshotId = runningMeta.snapshotId;
+              const fields = snapshotFields(snapshotId, runningMeta.snapshotOperationId);
+              snapshotMeta = { ...fields.meta, ...boundaryMeta };
+              yield* announceSnapshot(fields);
+            } else {
+              if (input.attempt > 1) {
+                const previous = yield* attempts.get({ ...attemptId, attempt: input.attempt - 1 });
+                if (Option.isSome(previous) && decodeMeta(previous.value.meta)?.snapshotId !== void 0) {
+                  yield* jj.restore(decodeMeta(previous.value.meta).snapshotId);
+                }
+              }
+              const snapshot = yield* jj.snapshot(`smithers action ${stepKeyDigest} attempt ${input.attempt}`);
+              snapshotId = snapshot.commitId;
+              const fields = snapshotFields(snapshotId, snapshot.operationId);
+              snapshotMeta = { ...fields.meta, ...boundaryMeta };
+              yield* atomically(
+                attempts.patch(attemptId, {
+                  meta: attemptPayload(
+                    { ...declarationMeta, admittedBy: deps.owner, ...snapshotMeta }
+                  )
+                }, deps.owner).pipe(Effect.andThen(announceSnapshot(fields)))
+              );
+            }
+          }
+          const failBoundaryAttempt = (cause) => Effect.gen(function* () {
+            const finishedAtMs2 = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+            const finished2 = yield* settleAttempt({
+              ...attemptId,
+              state: "failed",
+              finishedAtMs: finishedAtMs2,
+              error: attemptPayload(persistCause(cause)),
+              meta: { ...declarationMeta, hardViolation: true }
+            }, [
+              JournalRecords.hardViolation(attemptSource("hard-violation"), { ...attemptId, error: cause }),
+              JournalRecords.attemptFinished(attemptSource("finished"), { ...attemptId, state: "failed" })
+            ]);
+            if (!finished2) {
+              return yield* Effect.interrupt;
+            }
+            return yield* Effect.failCause(cause);
+          });
+          const boundary = input.tier === "sealed" && input.metadata !== void 0 ? yield* StepBoundary.StepBoundary : void 0;
+          const preparedResult = boundary === void 0 || input.metadata === void 0 ? void 0 : yield* boundary.prepare(input.metadata).pipe(Effect.exit);
+          if (preparedResult !== void 0 && Exit.isFailure(preparedResult)) {
+            return yield* failBoundaryAttempt(preparedResult.cause);
+          }
+          const prepared = preparedResult === void 0 ? void 0 : preparedResult.value;
+          const stepSandbox = boundary === void 0 || input.metadata === void 0 ? Option.none() : yield* Effect.serviceOption(StepSandbox.StepSandbox);
+          const opened = Option.isSome(stepSandbox) ? yield* stepSandbox.value.open.pipe(Effect.exit) : void 0;
+          if (opened !== void 0 && Exit.isFailure(opened)) {
+            return yield* failBoundaryAttempt(opened.cause);
+          }
+          const sandbox = boundary === void 0 || input.metadata === void 0 ? void 0 : opened !== void 0 ? opened.value : Option.getOrUndefined(yield* Effect.serviceOption(WorkspaceSandbox.WorkspaceSandbox));
+          const isolated = sandbox === void 0 || input.metadata === void 0 ? void 0 : yield* SandboxedExecution.execute({
+            sandbox,
+            descriptor: input.metadata,
+            workflow: execute(input, stepKeyDigest)
+          }).pipe(Effect.exit);
+          const settlement = isolated !== void 0 && Exit.isSuccess(isolated) ? isolated.value : void 0;
+          const effect = input.tier === "irreversible" || input.tier === "compensable" ? {
+            id: `${deps.runId}:${stepKeyDigest}:${input.attempt}`,
+            kind: actionKind(input.action),
+            tier: input.tier,
+            runId: deps.runId,
+            lineageId,
+            sourceId: deps.sourceId,
+            attempt: input.attempt,
+            ...deps.idempotencyKey === void 0 ? {} : { idempotencyKey: deps.idempotencyKey },
+            ...snapshotId === void 0 ? {} : { changeId: snapshotId }
+          } : void 0;
+          const parked = (cause) => Effect.map(
+            Effect.serviceOption(import_flow.FlowRuntime.FlowInstance),
+            (instance) => evidenceQuarantined(cause) !== void 0 || Option.getOrUndefined(instance)?.suspended === true && Cause.hasInterruptsOnly(cause)
+          );
+          const dispatchMeta = {
+            ...runningMeta,
+            ...declarationMeta,
+            admittedBy: deps.owner,
+            ...snapshotMeta
+          };
+          const recordCrossing = (crossing, patch, record) => Effect.flatMap(
+            atomically(Effect.gen(function* () {
+              if (record !== void 0) {
+                yield* emitLifecycle(record);
+              }
+              const patched = yield* attempts.patch(
+                attemptId,
+                {
+                  ...patch,
+                  meta: attemptPayload({ ...dispatchMeta, effectCrossing: crossing })
+                },
+                deps.owner
+              );
+              return patched._tag === "Patched";
+            })),
+            (recorded) => recorded ? Effect.void : Effect.interrupt
+          );
+          const dispatch = effect === void 0 ? execute(input, stepKeyDigest) : Effect.uninterruptibleMask(
+            (restore) => Effect.gen(function* () {
+              yield* recordCrossing("intended", {}, EffectRecords.boundary(effect, "intended"));
+              const exit = yield* Effect.exit(restore(execute(input, stepKeyDigest)));
+              yield* Exit.isSuccess(exit) ? recordCrossing(
+                "succeeded",
+                { outcome: attemptPayload(exit.value) },
+                EffectRecords.boundary(effect, "succeeded", exit.value)
+              ) : Effect.flatMap(
+                parked(exit.cause),
+                (isPark) => isPark ? recordCrossing("parked", {}) : emitLifecycle(EffectRecords.boundary(effect, "unknown")).pipe(
+                  Effect.catchCause(
+                    (cause) => Effect.logWarning("engine-store: failed to persist unknown effect boundary", cause).pipe(
+                      Effect.annotateLogs({ runId: deps.runId, step: input.key })
+                    )
+                  )
+                )
+              );
+              return yield* exit;
+            })
+          );
+          const outcome = isolated === void 0 ? yield* dispatch.pipe(Effect.exit) : Exit.map(isolated, (settled2) => settled2.result);
+          if (Exit.isFailure(outcome)) {
+            if (yield* parked(outcome.cause)) {
+              return yield* Effect.failCause(outcome.cause);
+            }
+            const finishedAtMs2 = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+            const violation = declarationViolated(outcome.cause);
+            const finished2 = yield* settleAttempt({
+              ...attemptId,
+              state: "failed",
+              finishedAtMs: finishedAtMs2,
+              error: attemptPayload(persistCause(outcome.cause)),
+              meta: attemptPayload(
+                {
+                  ...declarationMeta,
+                  ...violation ? { hardViolation: true } : {},
+                  ...snapshotMeta
+                }
+              )
+            }, [
+              ...violation ? [
+                JournalRecords.hardViolation(attemptSource("hard-violation"), {
+                  ...attemptId,
+                  error: outcome.cause
+                })
+              ] : [],
+              JournalRecords.attemptFinished(attemptSource("finished"), { ...attemptId, state: "failed" })
+            ]);
+            if (!finished2) {
+              return yield* Effect.interrupt;
+            }
+            return yield* Effect.failCause(outcome.cause);
+          }
+          if (settlement !== void 0) {
+            yield* emitConverging(
+              JournalRecords.diffBundleCaptured(attemptSource("diff-bundle"), {
+                ...attemptId,
+                bundleIdentity: settlement.bundleIdentity,
+                changedPaths: settlement.files.map((change) => change.path),
+                deviations: settlement.deviations
+              })
+            );
+            const dispatcher = Option.getOrUndefined(
+              yield* Effect.serviceOption(WorkspaceSandbox.EffectDispatcher)
+            );
+            const deduped = /* @__PURE__ */ new Set();
+            for (const queued of settlement.effects) {
+              if (deduped.has(queued.idempotencyKey)) continue;
+              deduped.add(queued.idempotencyKey);
+              if (dispatcher !== void 0) yield* dispatcher.dispatch(queued);
+            }
+            yield* emitConverging(
+              JournalRecords.copyBackSettled(attemptSource("copy-back"), {
+                ...attemptId,
+                bundleIdentity: settlement.bundleIdentity,
+                rebases: settlement.rebases,
+                queued: [...deduped],
+                dispatched: dispatcher === void 0 ? [] : [...deduped]
+              })
+            );
+          }
+          const settled = prepared === void 0 || boundary === void 0 ? void 0 : yield* boundary.settle(prepared).pipe(Effect.exit);
+          yield* settled === void 0 ? Effect.void : Metric.update(
+            EngineStoreMetrics.boundarySettlement[Exit.isSuccess(settled) ? settled.value.deviation === void 0 ? "Clean" : "Deviation" : settlementViolated(settled.cause) ? "Violation" : "Refused"],
+            1
+          );
+          if (settled !== void 0 && Exit.isFailure(settled)) {
+            return yield* failBoundaryAttempt(settled.cause);
+          }
+          const settledEvidence = settled === void 0 ? void 0 : settled.value;
+          const evidence = settledEvidence === void 0 || settlement === void 0 ? settledEvidence : {
+            ...settledEvidence,
+            ...settlement.deviations.length === 0 ? {
+              wholeTreeWritesVerified: true,
+              // `StepSandbox` is the injectable façade; the
+              // `WorkspaceSandbox` service is the same isolated
+              // transaction backend and proves the same read property.
+              hermeticReadsVerified: true
+            } : {
+              deviation: {
+                _tag: "ExpectedSetDeviation",
+                paths: settlement.deviations,
+                diffIdentity: settlement.bundleIdentity
+              }
+            }
+          };
+          const finishedAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+          const readSetVerified = prepared !== void 0 && StepBoundary.readSetMatches(prepared);
+          const meta = {
+            ...declarationMeta,
+            ...snapshotMeta,
+            ...evidence === void 0 ? {} : { boundary: evidence },
+            ...readSetVerified ? { readSetVerified: true } : {}
+          };
+          const finished = yield* settleAttempt(
+            {
+              ...attemptId,
+              state: "succeeded",
+              finishedAtMs,
+              outcome: attemptPayload(outcome.value),
+              meta: attemptPayload(meta)
+            },
+            [
+              ...evidence?.deviation === void 0 ? [] : [
+                JournalRecords.expectedSetDeviation(attemptSource("deviation"), {
+                  ...attemptId,
+                  ...evidence.deviation
+                })
+              ],
+              JournalRecords.attemptFinished(attemptSource("finished"), { ...attemptId, state: "succeeded" })
+            ]
+          );
+          if (!finished) return yield* Effect.interrupt;
+          const admission2 = CacheAdmission.completion(cacheDeclaration, meta, false);
+          if (admission2._tag === "PublishCompletion") {
+            yield* recordCache({ result: outcome.value, admission: admission2, createdAtMs: finishedAtMs });
+          } else if (admission2.reason === "unverified-recorded-reads") {
+            yield* emitConverging(
+              JournalRecords.cacheProvenance(cacheSource("unverified_read_set"), {
+                keyDigest,
+                action: "unverified_read_set"
+              })
+            );
+          }
+          return outcome.value;
+        })
+      );
+    }).pipe(
+      // The operation's own span is annotated above once the digest exists;
+      // this ambient context gives every child store, boundary, and sandbox
+      // span the dispatch identity as it opens.
+      //
+      // `stepKey`, never `key`: `@smthrs/journal`'s `Redaction.isSensitiveKey`
+      // treats a standalone trailing `key` word as a credential name and
+      // replaces the value, and `RedactedLogger` applies that rule to every
+      // log annotation under a real host. The span uses the same name so a
+      // trace and a log line name the dispatch identically.
+      Effect.annotateSpans({
+        runId: deps.runId,
+        stepKey: input.key,
+        attempt: input.attempt,
+        tier: input.tier
+      }),
+      Effect.annotateLogs({
+        runId: deps.runId,
+        stepKey: input.key,
+        attempt: input.attempt,
+        tier: input.tier
+      }),
+      EngineStoreMetrics.observe({
+        timer: EngineStoreMetrics.dispatchDuration,
+        counter: EngineStoreMetrics.dispatch
+      }),
+      // A dispatch that settled without reaching the gate was served from a
+      // durable record: a recorded success, or a recorded failure it rethrew.
+      // An interruption or a defect settled nothing and reports nothing.
+      Effect.onExit((exit) => {
+        const replayOnly = deps.replayOnly;
+        const stepKeyDigest = replay.stepKeyDigest;
+        if (replayOnly === void 0 || replay.gated || stepKeyDigest === void 0) return Effect.void;
+        if (Exit.isFailure(exit) && (Cause.hasInterrupts(exit.cause) || Cause.hasDies(exit.cause))) return Effect.void;
+        return replayOnly.observe({
+          runId: deps.runId,
+          stepKeyDigest,
+          attempt: input.attempt,
+          action: actionKind(input.action),
+          tier: input.tier,
+          outcome: "replayed"
+        });
+      })
+    );
+  });
+};
+//# sourceMappingURL=ActionPersistence.js.map