@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/internal/RunDriver.js

@@ -0,0 +1,1584 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var RunDriver_exports = {};
+__export(RunDriver_exports, {
+  FlowCycleDetected: () => FlowCycleDetected,
+  make: () => make,
+  samePayload: () => samePayload,
+  spawnEffectKind: () => spawnEffectKind
+});
+module.exports = __toCommonJS(RunDriver_exports);
+var CapabilitySet = __toESM(require("@smthrs/capability/CapabilitySet"), 1);
+var import_DurableWriter = require("@smthrs/database/DurableWriter");
+var import_engine = require("@smthrs/engine");
+var import_flow = require("@smthrs/flow");
+var import_journal = require("@smthrs/journal");
+var import_run_store = require("@smthrs/run-store");
+var Cause = __toESM(require("effect/Cause"), 1);
+var Clock = __toESM(require("effect/Clock"), 1);
+var Deferred = __toESM(require("effect/Deferred"), 1);
+var Duration = __toESM(require("effect/Duration"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Exit = __toESM(require("effect/Exit"), 1);
+var Metric = __toESM(require("effect/Metric"), 1);
+var Option = __toESM(require("effect/Option"), 1);
+var Result = __toESM(require("effect/Result"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var Scope = __toESM(require("effect/Scope"), 1);
+var DurableEngineState = __toESM(require("../DurableEngineState.js"), 1);
+var EngineStoreMetrics = __toESM(require("../EngineStoreMetrics.js"), 1);
+var import_EventTypes = require("../EventTypes.js");
+var ExecutionFacts = __toESM(require("../ExecutionFacts.js"), 1);
+var import_RunState = require("../RunState.js");
+var WakeBus = __toESM(require("../WakeBus.js"), 1);
+var ActionPersistence = __toESM(require("./ActionPersistence.js"), 1);
+var EffectRecords = __toESM(require("./EffectRecords.js"), 1);
+var ExitEncoding = __toESM(require("./ExitEncoding.js"), 1);
+var JournalRecords = __toESM(require("./JournalRecords.js"), 1);
+var RunCoordinator = __toESM(require("./RunCoordinator.js"), 1);
+var RunLifecycle = __toESM(require("./RunLifecycle.js"), 1);
+var StateTransaction = __toESM(require("./StateTransaction.js"), 1);
+const RunStateJson = Schema.fromJsonString(import_RunState.RunState);
+const asDefects = (cause) => Cause.fromReasons(
+  cause.reasons.map(
+    (reason) => Cause.isFailReason(reason) ? Cause.makeDieReason(reason.error).annotate(Cause.reasonAnnotations(reason)) : reason
+  )
+);
+const FlowCycleDetected = import_flow.FlowRuntime.FlowCycleDetected;
+const spawnEffectKind = import_EventTypes.EventTypes.childSpawnKind;
+const snapshot = (row) => ({
+  status: row.status,
+  owner: row.owner,
+  heartbeatAtMs: row.heartbeatAtMs
+});
+const isPlainObject = (value) => {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+const samePayload = (left, right) => {
+  if (Object.is(left, right)) return true;
+  if (typeof left === "number" && typeof right === "number") {
+    return left === 0 && right === 0;
+  }
+  if (Array.isArray(left)) {
+    if (!Array.isArray(right) || left.length !== right.length) return false;
+    for (let index = 0; index < left.length; index++) {
+      if (!samePayload(left[index], right[index])) return false;
+    }
+    return true;
+  }
+  if (Array.isArray(right) || !isPlainObject(left) || !isPlainObject(right)) return false;
+  const leftKeys = Object.keys(left);
+  const rightKeys = Object.keys(right);
+  if (leftKeys.length !== rightKeys.length) return false;
+  for (const key of leftKeys) {
+    if (!Object.hasOwn(right, key) || !samePayload(left[key], right[key])) return false;
+  }
+  return true;
+};
+const cancelRequested = { _tag: "CancelRequested" };
+const staleRunningSweepBatch = 64;
+const stealRefusalBackoffFirst = Duration.times(import_run_store.Ownership.heartbeatInterval, 2);
+const stealRefusalBackoffMax = import_run_store.Ownership.heartbeatStaleAfter;
+const withoutResult = (state) => {
+  const { cancellation: _, result: __, ...rest } = state;
+  return rest;
+};
+const make = (dependencies) => Effect.gen(function* () {
+  const journal = yield* import_journal.Journal.Journal;
+  const writer = yield* import_DurableWriter.DurableWriter;
+  const store = yield* import_run_store.RunStore.RunStore;
+  const engineState = yield* DurableEngineState.DurableEngineState;
+  const lifecycle = RunLifecycle.make(store, engineState);
+  const wakeBus = dependencies.wakeBus ?? WakeBus.makeNoop();
+  const suppliedIsAlive = dependencies.isAlive;
+  const isAlive = suppliedIsAlive ?? import_run_store.Ownership.leaseLiveness(import_run_store.Ownership.heartbeatStaleAfter);
+  const livenessEvidenceKind = (expectedOwner) => suppliedIsAlive === void 0 ? "lease-expired" : import_run_store.Ownership.sameHostIncarnation(expectedOwner, dependencies.owner) ? "same-host-pid-dead" : "cross-host-unreachable-stale";
+  const sameOwner = (left, right) => left.hostId === right.hostId && left.pid === right.pid && left.nonce === right.nonce;
+  const registrations = /* @__PURE__ */ new Map();
+  const warnedUnregistered = /* @__PURE__ */ new Set();
+  const stealRefusals = /* @__PURE__ */ new Map();
+  const deferSteal = (runId, heartbeatAtMs, nowMs) => {
+    const previous = stealRefusals.get(runId);
+    const attempt = previous !== void 0 && previous.heartbeatAtMs === heartbeatAtMs ? previous.attempt + 1 : 1;
+    const waitMs = Math.min(
+      Duration.toMillis(stealRefusalBackoffFirst) * Math.pow(2, attempt - 1),
+      Duration.toMillis(stealRefusalBackoffMax)
+    );
+    stealRefusals.set(runId, { heartbeatAtMs, nextProbeAtMs: nowMs + waitMs, attempt });
+  };
+  const stealRefusedSourceId = (owner, heartbeatAtMs, evidence) => `${dependencies.journalSource}:steal-refused:${evidence}:${JSON.stringify([owner.hostId, owner.pid, owner.nonce])}:${heartbeatAtMs}`;
+  const liveInstances = /* @__PURE__ */ new Map();
+  const retainedScopes = /* @__PURE__ */ new Map();
+  const releaseRetainedScope = (runId, exit) => Effect.suspend(() => {
+    const scope = retainedScopes.get(runId);
+    if (scope === void 0) return Effect.void;
+    retainedScopes.delete(runId);
+    return Scope.close(scope, exit).pipe(
+      Effect.catchCause(
+        (cause) => Effect.logWarning(
+          `engine-store: finalizers of parked run ${runId} failed while closing its retained flow scope`,
+          cause
+        )
+      )
+    );
+  });
+  const retainedRuns = Effect.sync(() => new Set(retainedScopes.keys()));
+  yield* Effect.addFinalizer(
+    () => Effect.forEach(
+      Array.from(retainedScopes.keys()),
+      (runId) => releaseRetainedScope(runId, Exit.void),
+      { discard: true }
+    )
+  );
+  const encodeState = (state) => Schema.encodeEffect(RunStateJson)(state).pipe(Effect.orDie);
+  const decodeState = (stateJson) => Schema.decodeUnknownEffect(RunStateJson)(stateJson).pipe(Effect.orDie);
+  const recordResume = (executionId, parked, reason) => dependencies.requestResume === void 0 || !parked ? Effect.void : dependencies.requestResume(executionId, reason);
+  const recordParentResume = (parentExecutionId) => dependencies.requestResume === void 0 ? Effect.void : Effect.flatMap(
+    engineState.waiting(parentExecutionId),
+    (waiting) => recordResume(
+      parentExecutionId,
+      Option.isSome(waiting) && waiting.value.reason !== "quarantine",
+      "parent"
+    )
+  );
+  const executionFacts = ExecutionFacts.make({
+    runs: store,
+    state: engineState,
+    journal,
+    sourceId: dependencies.journalSource
+  });
+  const requestCancellation = (runId, at) => executionFacts.requestCancel(runId, at).pipe(
+    Effect.catchIf(
+      (error) => error._tag === "@smthrs/journal/JournalError" || error instanceof import_DurableWriter.DatabaseError,
+      Effect.die
+    )
+  );
+  const decisionRecord = (runId, payload, sourceId) => (
+    // Lifecycle decisions normally use the unfenced channel: they commit in the SAME transaction
+    // as the store-level owner CAS that is its fence (`transitionOwned`,
+    // `activate`, `claim`/`steal` outcomes), and by then the run is often no
+    // longer `running` under this owner, which is the exact predicate the
+    // journal fence asserts. Several call sites (claim-lost,
+    // steal-refused-owner-alive, activation-lost) also record decisions for
+    // runs this driver never owned at all — first-writer-wins evidence,
+    // which is what the unfenced channel exists for. Lease reconfirmation
+    // retains ownership and emits this record through the fenced channel.
+    JournalRecords.runDecision({
+      runId,
+      lineageId: import_engine.FlowEngine.Lineage.root(runId),
+      sourceId,
+      ...sourceId === dependencies.journalSource ? {} : { sourceSeq: 0 }
+    }, payload)
+  );
+  const completeRunClocks = (runId, completedAtMs) => Effect.flatMap(engineState.completeRunClocks(runId, completedAtMs), (completed) => Effect.forEach(completed, (clock) => journal.emitDurableUnfenced(
+    JournalRecords.clockCompletedFor(
+      dependencies.journalSource,
+      import_engine.FlowEngine.Lineage.root(runId),
+      clock,
+      completedAtMs
+    )
+  ), { discard: true }));
+  const emitDecision = (runId, payload, sourceId = dependencies.journalSource) => Effect.gen(function* () {
+    const decision = payload;
+    const authoritative = sourceId === dependencies.journalSource && decision.decision !== "wake-scheduled" && decision.decision !== "child-policy-applied";
+    const recorded = authoritative ? {
+      ...decision,
+      executionFact: yield* executionFacts.fact(runId, decision.decision === "created" ? "created" : "legacy")
+    } : payload;
+    yield* journal.emitDurableUnfenced(decisionRecord(runId, recorded, sourceId));
+  }).pipe(Effect.orDie);
+  const emitEvidence = (runId, payload, sourceId = dependencies.journalSource) => journal.emitDurableUnfenced(decisionRecord(runId, payload, sourceId)).pipe(
+    Effect.flatMap(
+      (receipt) => receipt._tag === "Duplicate" ? Effect.logDebug(
+        `engine-store: run ${runId} already recorded this evidence`,
+        { runId, sourceId, seq: receipt.seq }
+      ) : Effect.void
+    ),
+    Effect.catch(
+      (error) => Effect.logWarning(
+        `engine-store: evidence about run ${runId} was not admitted to the journal (${error.code}); the run is unaffected`,
+        { runId, sourceId, code: error.code, payload }
+      )
+    )
+  );
+  const transactState = StateTransaction.make(engineState, journal);
+  const transitionAndRecord = (runId, toStatus, stateJson, decision, guard, afterTransitioned, waiting) => transactState(
+    Effect.gen(function* () {
+      if (waiting !== void 0 && waiting !== null) {
+        const parked = yield* engineState.park(runId, waiting, dependencies.owner);
+        if (parked._tag === "NotFound") {
+          return yield* Effect.fail({ _tag: "TransitionRefused", outcome: parked });
+        }
+      }
+      const transitioned = yield* store.transitionOwned(
+        runId,
+        dependencies.owner,
+        toStatus,
+        stateJson,
+        guard
+      ).pipe(Effect.orDie);
+      if (transitioned._tag !== "Transitioned") {
+        return yield* Effect.fail({ _tag: "TransitionRefused", outcome: transitioned });
+      }
+      if (waiting === null) {
+        yield* engineState.wake(runId);
+      }
+      if (afterTransitioned !== void 0) {
+        yield* afterTransitioned;
+      }
+      if (toStatus === "completed" || toStatus === "failed") {
+        yield* completeRunClocks(runId, yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor)));
+      }
+      yield* emitDecision(runId, { ...decision, state: JSON.parse(stateJson) });
+      return transitioned;
+    })
+  ).pipe(
+    Effect.catchTag("TransitionRefused", ({ outcome }) => Effect.succeed(outcome)),
+    Effect.orDie
+  );
+  const abandon = (runId, claimedAtMs) => store.abandonClaim(runId, dependencies.owner, claimedAtMs).pipe(
+    Effect.asVoid,
+    Effect.orDie
+  );
+  const claimAndActivate = Effect.fn(
+    "RunDriver.claimAndActivate"
+  )(function* (row) {
+    return yield* Effect.gen(function* () {
+      yield* Effect.annotateCurrentSpan({ runId: row.runId, status: row.status });
+      if (dependencies.canExecute !== void 0 && !(yield* dependencies.canExecute(row))) {
+        return false;
+      }
+      if (row.status === "completed" || row.status === "failed" || row.status === "cancelled") {
+        yield* Effect.annotateCurrentSpan({ outcome: "terminal" });
+        yield* Metric.update(EngineStoreMetrics.claim.Terminal, 1);
+        return false;
+      }
+      if (row.cancelRequestedAtMs === null) {
+        const waiting = yield* engineState.waiting(row.runId);
+        if (Option.isSome(waiting) && waiting.value.reason === "quarantine") {
+          return false;
+        }
+      }
+      const expected = snapshot(row);
+      const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+      let claim;
+      let stealEvidenceKind;
+      let recoveredClaim;
+      if (row.status === "running") {
+        if (row.owner === null || row.heartbeatAtMs === null || row.heartbeatAtMs >= nowMs - Duration.toMillis(import_run_store.Ownership.heartbeatStaleAfter)) {
+          if (row.owner !== null && !sameOwner(row.owner, dependencies.owner)) {
+            deferSteal(row.runId, row.heartbeatAtMs, nowMs);
+            yield* emitEvidence(row.runId, {
+              decision: "steal-refused-owner-alive",
+              evidence: "lease-fresh",
+              expectedOwner: row.owner,
+              heartbeatAtMs: row.heartbeatAtMs
+            }, stealRefusedSourceId(row.owner, row.heartbeatAtMs, "lease-fresh"));
+          }
+          yield* Effect.annotateCurrentSpan({ outcome: "heartbeat_fresh" });
+          yield* Metric.update(EngineStoreMetrics.claim.HeartbeatFresh, 1);
+          return false;
+        }
+        if (yield* isAlive(row.owner, { claimant: dependencies.owner, heartbeatAtMs: row.heartbeatAtMs, nowMs })) {
+          deferSteal(row.runId, row.heartbeatAtMs, nowMs);
+          yield* emitEvidence(row.runId, {
+            decision: "steal-refused-owner-alive",
+            // Always a supplied probe. The default check is the lease, and
+            // the lease already refused above for every row that could still
+            // be fresh, so reaching this arm means the deployment answered
+            // for the owner with something the store cannot see.
+            evidence: "probe",
+            expectedOwner: row.owner,
+            heartbeatAtMs: row.heartbeatAtMs
+          }, stealRefusedSourceId(row.owner, row.heartbeatAtMs, "probe"));
+          yield* Effect.annotateCurrentSpan({ outcome: "steal_refused_owner_alive" });
+          yield* Metric.update(EngineStoreMetrics.claim.StealRefusedOwnerAlive, 1);
+          yield* Effect.logDebug("run steal refused, recorded owner is alive", {
+            runId: row.runId,
+            heartbeatAtMs: row.heartbeatAtMs
+          });
+          return false;
+        }
+        stealEvidenceKind = livenessEvidenceKind(row.owner);
+        claim = yield* store.steal(
+          row.runId,
+          expected,
+          dependencies.owner,
+          nowMs,
+          {
+            expectedOwner: row.owner,
+            checkedAtMs: nowMs,
+            kind: stealEvidenceKind
+          }
+        ).pipe(Effect.orDie);
+      } else {
+        if (row.claim !== null && row.claimedAtMs !== null && !sameOwner(row.claim, dependencies.owner) && row.claimedAtMs < nowMs - Duration.toMillis(import_run_store.Ownership.heartbeatStaleAfter) && !(yield* isAlive(row.claim, { claimant: dependencies.owner, heartbeatAtMs: row.claimedAtMs, nowMs }))) {
+          const recovered = yield* store.recoverClaim(
+            row.runId,
+            row.claim,
+            row.claimedAtMs,
+            dependencies.owner,
+            nowMs,
+            { expectedOwner: row.claim, checkedAtMs: nowMs, kind: livenessEvidenceKind(row.claim) }
+          ).pipe(Effect.orDie);
+          if (recovered._tag === "Recovered") {
+            recoveredClaim = { claimant: row.claim, claimedAtMs: row.claimedAtMs };
+          }
+        }
+        claim = yield* store.claim(
+          row.runId,
+          expected,
+          dependencies.owner,
+          nowMs
+        ).pipe(Effect.orDie);
+      }
+      if (claim._tag !== "Claimed") {
+        yield* emitEvidence(row.runId, {
+          decision: "claim-lost",
+          outcome: claim._tag,
+          expected
+        });
+        yield* Effect.annotateCurrentSpan({ outcome: "claim_lost" });
+        yield* Metric.update(EngineStoreMetrics.claim.ClaimLost, 1);
+        yield* Effect.logDebug("run claim lost", { runId: row.runId, outcome: claim._tag });
+        return false;
+      }
+      const activation = yield* transactState(
+        Effect.gen(function* () {
+          if (dependencies.canActivate !== void 0 && !(yield* dependencies.canActivate(yield* store.get(row.runId).pipe(Effect.orDie)))) {
+            return { _tag: "SnapshotChanged" };
+          }
+          if (row.cancelRequestedAtMs === null) {
+            const waiting = yield* engineState.waiting(row.runId);
+            if (Option.isSome(waiting) && waiting.value.reason === "quarantine") {
+              return { _tag: "SnapshotChanged" };
+            }
+          }
+          const activation2 = yield* store.activate(
+            row.runId,
+            dependencies.owner,
+            claim.claimedAtMs,
+            expected
+          ).pipe(Effect.orDie);
+          if (activation2._tag !== "Activated") {
+            return activation2;
+          }
+          yield* emitDecision(row.runId, {
+            decision: row.status === "running" ? "stolen-and-activated" : "claimed-and-activated",
+            previousStatus: row.status,
+            owner: dependencies.owner,
+            // What admitted the takeover, so an operator reading the journal
+            // can tell a lease that simply expired from a probe that
+            // positively reported the owner gone.
+            ...stealEvidenceKind === void 0 ? {} : { evidence: stealEvidenceKind },
+            ...recoveredClaim === void 0 ? {} : { recoveredClaim }
+          });
+          return activation2;
+        })
+      ).pipe(Effect.orDie);
+      if (activation._tag !== "Activated") {
+        yield* abandon(row.runId, claim.claimedAtMs);
+        yield* emitEvidence(row.runId, {
+          decision: "activation-lost",
+          outcome: activation._tag,
+          expected
+        });
+        yield* Effect.annotateCurrentSpan({ outcome: "activation_lost" });
+        yield* Metric.update(EngineStoreMetrics.claim.ActivationLost, 1);
+        yield* Effect.logDebug("run activation lost", { runId: row.runId, outcome: activation._tag });
+        return false;
+      }
+      yield* Effect.annotateCurrentSpan({ outcome: "activated" });
+      yield* Metric.update(EngineStoreMetrics.claim.Activated, 1);
+      stealRefusals.delete(row.runId);
+      return true;
+    });
+  });
+  const descendantsOf = lifecycle.descendants;
+  const requestCancelDescendants = (runId, nowMs) => Effect.gen(function* () {
+    const descendants = yield* descendantsOf(runId);
+    yield* Effect.forEach(
+      descendants,
+      (childId) => requestCancellation(childId, nowMs),
+      { discard: true }
+    );
+    return descendants;
+  });
+  const exitPolicyOf = (row) => decodeState(row.stateJson).pipe(
+    // A row written before the policy existed, or created outside
+    // `ensureRun` (a seeded edge, an external admission), names none. It
+    // is a LINKED child either way, and the contract for a linked child is
+    // that it ends with the run it belongs to; `detach` is the deliberate
+    // exception and has to be recorded to hold.
+    Effect.map((state) => state.onParentExit ?? "cancel")
+  );
+  const endLinkedChildren = (runId, nowMs) => Effect.gen(function* () {
+    const roots = (yield* lifecycle.rounds(runId)).map((row) => row.runId);
+    const seen = new Set(roots);
+    const cancelled = [];
+    const detached = [];
+    let frontier = roots;
+    while (frontier.length > 0) {
+      const next = [];
+      for (const parentId of frontier) {
+        for (const edge of yield* engineState.runChildren(parentId)) {
+          if (seen.has(edge.childId)) continue;
+          const rounds = yield* lifecycle.rounds(edge.childId);
+          for (const round of rounds) seen.add(round.runId);
+          seen.add(edge.childId);
+          const row = rounds.find(
+            (round) => round.status !== "completed" && round.status !== "failed" && round.status !== "cancelled"
+          );
+          if (row === void 0) continue;
+          if ((yield* exitPolicyOf(rounds.find((round) => round.runId === edge.childId))) === "detach") {
+            detached.push(edge.childId);
+            continue;
+          }
+          for (const round of rounds) {
+            if (round.status !== "completed" && round.status !== "failed" && round.status !== "cancelled") {
+              cancelled.push(round.runId);
+            }
+            next.push(round.runId);
+          }
+        }
+      }
+      frontier = next;
+    }
+    yield* Effect.forEach(
+      cancelled,
+      (childId) => requestCancellation(childId, nowMs),
+      { discard: true }
+    );
+    return { cancelled, detached };
+  });
+  const applyChildExitPolicy = (runId) => Effect.gen(function* () {
+    const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+    const outcome = yield* endLinkedChildren(runId, nowMs).pipe(Effect.orDie);
+    if (outcome.cancelled.length === 0 && outcome.detached.length === 0) return;
+    yield* emitDecision(runId, {
+      decision: "child-policy-applied",
+      appliedAtMs: nowMs,
+      cancelled: outcome.cancelled,
+      detached: outcome.detached
+    });
+  });
+  const inheritParentCancellation = (parentId, childId) => Effect.gen(function* () {
+    const rounds = yield* lifecycle.rounds(parentId).pipe(Effect.orDie);
+    if (rounds.length === 0) return;
+    const cancelled = rounds.find((round) => round.cancelRequestedAtMs !== null || round.status === "cancelled");
+    if (cancelled !== void 0) {
+      const nowMs = cancelled.cancelRequestedAtMs ?? (yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor)));
+      yield* requestCancellation(childId, nowMs).pipe(Effect.orDie);
+      return;
+    }
+    if (rounds.some((round) => round.status !== "completed" && round.status !== "failed")) return;
+    if ((yield* exitPolicyOf(yield* store.get(childId).pipe(Effect.orDie))) === "detach") {
+      return;
+    }
+    yield* requestCancellation(childId, yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor))).pipe(
+      Effect.orDie
+    );
+  });
+  const cancelOwned = (runId, state) => Effect.gen(function* () {
+    const interruptedAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+    const stateJson = yield* encodeState({
+      ...withoutResult(state),
+      cancellation: { interruptedAtMs }
+    });
+    let cascaded = [];
+    let settled = false;
+    yield* transactState(
+      Effect.gen(function* () {
+        yield* store.acknowledgeCancel(runId, dependencies.owner, interruptedAtMs).pipe(Effect.orDie);
+        const transitioned = yield* store.transitionOwned(
+          runId,
+          dependencies.owner,
+          "cancelled",
+          stateJson
+        ).pipe(Effect.orDie);
+        if (transitioned._tag !== "Transitioned") return;
+        settled = true;
+        cascaded = yield* requestCancelDescendants(runId, interruptedAtMs);
+        yield* completeRunClocks(runId, interruptedAtMs);
+        yield* engineState.wake(runId).pipe(Effect.asVoid);
+        yield* journal.emitDurableUnfenced(
+          JournalRecords.interrupted({
+            runId,
+            lineageId: import_engine.FlowEngine.Lineage.root(runId),
+            sourceId: dependencies.journalSource
+          }, {
+            outcome: "cancelled",
+            interruptedAtMs,
+            owner: dependencies.owner,
+            executionFact: yield* executionFacts.fact(runId),
+            ...cascaded.length === 0 ? {} : { cascadedTo: cascaded }
+          })
+        ).pipe(Effect.orDie);
+      })
+    ).pipe(Effect.orDie);
+    yield* releaseRetainedScope(runId, Exit.failCause(Cause.interrupt()));
+    if (cascaded.length > 0) {
+      const activeCoordinator = yield* Deferred.await(coordinatorDeferred);
+      yield* Effect.forEach(cascaded, (childId) => activeCoordinator.wake(childId), { discard: true });
+    }
+    if (settled) {
+      yield* announceSettled(runId, state);
+    }
+  });
+  const interruptedWaiting = (runId, instance) => Effect.gen(function* () {
+    if (instance === void 0 || !instance.suspended) return { reason: "released" };
+    const declared = instance.waiting;
+    if (declared !== void 0) return declared;
+    const pendingClocks = yield* engineState.pendingClocks({ executionId: runId });
+    return pendingClocks.length > 0 ? {
+      reason: "timer",
+      wakeAt: Math.min(...pendingClocks.map((clock) => clock.dueAtMs))
+    } : { reason: "event" };
+  });
+  const releaseOwned = (runId, state, cause, round) => Effect.gen(function* () {
+    const waiting = yield* interruptedWaiting(runId, round?.instance);
+    const suspension = round !== void 0 && waiting.reason !== "released" ? (yield* encodeResult(
+      round.flow,
+      new import_flow.Flow.Suspended({ cause: round.instance.cause })
+    )).encoded : void 0;
+    yield* transitionAndRecord(
+      runId,
+      "suspended",
+      yield* encodeState(
+        suspension === void 0 ? withoutResult(state) : { ...withoutResult(state), result: suspension }
+      ),
+      // Why the run was released (#3328): an operator reading a parked run
+      // must be able to tell a lapsed lease on a live host from a shutdown.
+      { decision: "interrupt-released", owner: dependencies.owner, cause },
+      void 0,
+      void 0,
+      waiting
+    );
+  });
+  const settleInterrupted = (runId, state, cause, round) => store.get(runId).pipe(
+    Effect.flatMap((row) => {
+      if (row.claim !== null && row.claimedAtMs !== null && sameOwner(row.claim, dependencies.owner)) {
+        return abandon(runId, row.claimedAtMs);
+      }
+      if (row.status !== "running" || row.owner === null || !sameOwner(row.owner, dependencies.owner)) {
+        return Effect.void;
+      }
+      return row.cancelRequestedAtMs !== null ? cancelOwned(runId, state) : releaseOwned(runId, state, cause, round);
+    }),
+    Effect.catch((error) => error.code === "not_found_row" ? Effect.void : Effect.die(error))
+  );
+  const encodeResult = (flow, result) => ExitEncoding.encode(flow, result);
+  const normalizePayload = (flow, payload) => {
+    const codec = Schema.toCodecJson(flow.payloadSchema);
+    return Schema.decodeUnknownEffect(codec)(payload).pipe(
+      Effect.orDie,
+      Effect.flatMap((decoded) => Schema.encodeEffect(codec)(decoded)),
+      Effect.orDie
+    );
+  };
+  const ensureCreatedRun = (options) => Effect.gen(function* () {
+    const created = yield* store.create(options.executionId, options.stateJson, {
+      ...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId },
+      lineageId: options.lineageId,
+      roundOrdinal: options.roundOrdinal
+    }).pipe(Effect.exit);
+    if (Exit.isSuccess(created)) {
+      return yield* options.onCreated;
+    }
+    const failure = Cause.findFail(created.cause);
+    if (Result.isFailure(failure)) {
+      return yield* Effect.failCause(failure.failure);
+    }
+    const error = failure.success.error;
+    if (!(error instanceof import_run_store.RunStore.RunStoreError) || error.code !== "constraint") {
+      return yield* Effect.die(error);
+    }
+    const existing = yield* store.get(options.executionId).pipe(Effect.orDie);
+    const persisted = yield* decodeState(existing.stateJson);
+    const sameParent = options.parentRunId === void 0 || existing.parentRunId === options.parentRunId;
+    const conflict = persisted.flowName !== options.flowName ? {
+      field: "flow",
+      expected: persisted.flowName,
+      actual: options.flowName
+    } : !samePayload(persisted.payload, options.payload) ? {
+      field: "payload",
+      expected: "the encoded payload the execution was admitted with",
+      actual: "a different encoded payload"
+    } : !import_engine.FlowEngine.joinable(
+      // A row with no persisted authority ran unrestricted, and is
+      // refused further dispatch; only an unrestricted caller joins it.
+      persisted.capabilityCeilings ?? [],
+      options.capabilityCeilings
+    ) ? {
+      // A join answers the result the admitted authority produced.
+      field: "capabilities",
+      expected: "a capability ceiling covering the one the execution was admitted with",
+      actual: "a capability ceiling that does not cover it"
+    } : existing.lineageId !== options.lineageId ? {
+      field: "lineage",
+      expected: existing.lineageId ?? "no lineage",
+      actual: options.lineageId
+    } : existing.roundOrdinal !== options.roundOrdinal ? {
+      field: "round",
+      expected: String(existing.roundOrdinal),
+      actual: String(options.roundOrdinal)
+    } : !sameParent ? {
+      field: "parent",
+      expected: existing.parentRunId ?? "no parent",
+      // `!sameParent` implies the requested parent is present: an
+      // omitted parent is deliberately compatible with any persisted
+      // parent when joining an already-created root.
+      actual: options.parentRunId
+    } : void 0;
+    if (conflict !== void 0) {
+      return yield* Effect.die(
+        new import_engine.FlowEngine.ExecutionIdentityConflict({
+          executionId: options.executionId,
+          status: existing.status,
+          ...conflict,
+          message: `execution ${options.executionId} already belongs to ${conflict.field} identity ${conflict.expected}; it cannot be reused for ${conflict.actual}`
+        })
+      );
+    }
+  });
+  const coordinatorDeferred = yield* Deferred.make();
+  const cancelPollLoop = (executionId) => Effect.gen(function* () {
+    while (true) {
+      const requested = yield* store.get(executionId).pipe(
+        Effect.map((row) => row.cancelRequestedAtMs !== null),
+        Effect.catch(() => Effect.succeed(false))
+      );
+      if (requested) {
+        yield* store.acknowledgeCancel(
+          executionId,
+          dependencies.owner,
+          yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor))
+        ).pipe(Effect.orDie);
+        return cancelRequested;
+      }
+      yield* Effect.sleep(import_run_store.Ownership.heartbeatInterval);
+    }
+  });
+  const continueLineage = (seam, advanced) => Effect.gen(function* () {
+    const target = registrations.get(seam.handoff.flow)?.at(-1);
+    const payload = target === void 0 ? seam.handoff.payload : yield* normalizePayload(target.flow, seam.handoff.payload);
+    const nextCeilings = [
+      // The execution guard rejects missing persisted authority before a handler can hand off.
+      ...seam.state.capabilityCeilings,
+      ...seam.handoff.capabilityCeilings ?? [[]],
+      // The successor records its own declaration, as admission would, so
+      // a later join compares against the authority it actually runs
+      // under. A target this process does not run has none here; the root
+      // caller's re-entry then carries a declaration the row lacks and is
+      // refused rather than trusted.
+      ...target === void 0 ? [] : import_flow.Flow.parseCapabilityCeilings(import_flow.Flow.capabilityCeilings(target.flow.annotations))
+    ];
+    const nextStateJson = yield* encodeState({
+      version: 1,
+      flowName: seam.handoff.flow,
+      payload,
+      capabilityCeilings: nextCeilings,
+      ...seam.state.parentExecutionId === void 0 ? {} : { parentExecutionId: seam.state.parentExecutionId },
+      ...seam.state.onParentExit === void 0 ? {} : { onParentExit: seam.state.onParentExit },
+      ...seam.state.maxRounds === void 0 ? {} : { maxRounds: seam.state.maxRounds },
+      ...seam.handoff.deadline === void 0 ? {} : { deadline: seam.handoff.deadline }
+    });
+    const settledStateJson = yield* encodeState({
+      ...seam.state,
+      result: (yield* encodeResult(seam.flow, seam.handoff)).encoded
+    });
+    const cancelled = { _tag: "HandoffCancelled" };
+    const fenceLost = { _tag: "HandoffFenceLost" };
+    const committed = yield* Effect.result(
+      transactState(Effect.gen(function* () {
+        yield* ensureCreatedRun({
+          flowName: seam.handoff.flow,
+          executionId: advanced.executionId,
+          stateJson: nextStateJson,
+          payload,
+          lineageId: advanced.round.rootExecutionId,
+          roundOrdinal: advanced.round.ordinal,
+          parentRunId: seam.executionId,
+          capabilityCeilings: nextCeilings,
+          onCreated: emitDecision(advanced.executionId, {
+            decision: "created",
+            state: JSON.parse(nextStateJson),
+            lineageId: advanced.round.rootExecutionId,
+            roundOrdinal: advanced.round.ordinal,
+            parentExecutionId: seam.executionId
+          })
+        });
+        const transitioned = yield* transitionAndRecord(
+          seam.executionId,
+          "completed",
+          settledStateJson,
+          {
+            decision: "handed-off",
+            status: "completed",
+            flow: seam.handoff.flow,
+            lineageId: advanced.round.rootExecutionId,
+            roundOrdinal: advanced.round.ordinal,
+            nextExecutionId: advanced.executionId,
+            owner: dependencies.owner
+          },
+          { cancelRequested: "absent" }
+        );
+        if (transitioned._tag === "Transitioned") return;
+        return yield* Effect.fail(
+          transitioned._tag === "GuardFailed" ? cancelled : fenceLost
+        );
+      })).pipe(Effect.catchTag("@smthrs/journal/JournalError", Effect.die))
+    );
+    if (Result.isFailure(committed)) {
+      if (committed.failure._tag === "HandoffCancelled") {
+        yield* cancelOwned(seam.executionId, seam.state);
+      }
+      return;
+    }
+    const activeCoordinator = yield* Deferred.await(coordinatorDeferred);
+    yield* activeCoordinator.wake(advanced.executionId);
+  });
+  const announceSettled = (executionId, state) => Effect.gen(function* () {
+    yield* wakeBus.wake(executionId);
+    const parents = /* @__PURE__ */ new Set();
+    if (state.parentExecutionId !== void 0) parents.add(state.parentExecutionId);
+    const rounds = yield* lifecycle.rounds(executionId).pipe(Effect.orDie);
+    for (const roundId of /* @__PURE__ */ new Set([executionId, ...rounds.map((round) => round.runId)])) {
+      for (const edge of yield* engineState.runParents(roundId)) parents.add(edge.parentId);
+    }
+    if (parents.size === 0) return;
+    const activeCoordinator = yield* Deferred.await(coordinatorDeferred);
+    for (const parentId of parents) {
+      yield* recordParentResume(parentId);
+      yield* activeCoordinator.wake(parentId);
+      yield* wakeBus.wake(parentId);
+    }
+  });
+  const endLineage = (seam, error) => Effect.gen(function* () {
+    const stateJson = yield* encodeState({
+      ...seam.state,
+      result: (yield* encodeResult(seam.flow, new import_flow.Flow.Complete({ exit: Exit.die(error) }))).encoded
+    });
+    const transitioned = yield* transitionAndRecord(
+      seam.executionId,
+      "failed",
+      stateJson,
+      {
+        decision: "lineage-exhausted",
+        status: "failed",
+        lineageId: error.lineageId,
+        maxRounds: error.maxRounds,
+        owner: dependencies.owner
+      },
+      { cancelRequested: "absent" },
+      // The lineage is over, not continuing: this round is the last one,
+      // so it ends its children like any other terminal exit. A round that
+      // HANDS OFF settles through `continueLineage` instead and deliberately
+      // does not, because the lineage — and therefore the parent the
+      // children are linked to — carries on.
+      applyChildExitPolicy(seam.executionId)
+    );
+    if (transitioned._tag === "GuardFailed") {
+      yield* cancelOwned(seam.executionId, seam.state);
+    } else if (transitioned._tag === "Transitioned") {
+      yield* announceSettled(seam.executionId, seam.state);
+    }
+  });
+  const endInvalidRound = (seam, error) => Effect.gen(function* () {
+    const stateJson = yield* encodeState({
+      ...seam.state,
+      result: (yield* encodeResult(seam.flow, new import_flow.Flow.Complete({ exit: Exit.die(error) }))).encoded
+    });
+    const transitioned = yield* transitionAndRecord(
+      seam.executionId,
+      "failed",
+      stateJson,
+      {
+        decision: "round-invalid",
+        status: "failed",
+        message: error.message,
+        owner: dependencies.owner
+      },
+      { cancelRequested: "absent" },
+      applyChildExitPolicy(seam.executionId)
+    );
+    if (transitioned._tag === "GuardFailed") {
+      yield* cancelOwned(seam.executionId, seam.state);
+    } else if (transitioned._tag === "Transitioned") {
+      yield* announceSettled(seam.executionId, seam.state);
+    }
+  });
+  const handOff = (seam) => import_engine.FlowEngine.Round.next(
+    {
+      // The row's lineage_id was written from a round's rootExecutionId,
+      // so this rehydrates the brand; `Round.next` still validates it.
+      rootExecutionId: seam.row.lineageId,
+      ordinal: seam.row.roundOrdinal
+    },
+    // The origin persisted its budget into every round's state, so a
+    // multi-flow handoff cannot reset the lineage by changing targets.
+    { flowName: seam.flow._tag, maxRounds: seam.state.maxRounds }
+  ).pipe(
+    Effect.flatMap((advanced) => continueLineage(seam, advanced)),
+    Effect.catch(
+      (error) => error instanceof import_engine.FlowEngine.Round.InvalidRound ? endInvalidRound(seam, error) : endLineage(seam, error)
+    )
+  );
+  const drive = (executionId) => Effect.suspend(() => {
+    let interruptState;
+    let round;
+    let durableParkAccepted = false;
+    let lapsedMs;
+    return Effect.gen(function* () {
+      const initial = yield* store.get(executionId).pipe(
+        Effect.catch(
+          (error) => error.code === "not_found_row" ? Effect.succeed(void 0) : Effect.die(error)
+        )
+      );
+      if (initial === void 0) return;
+      const state = yield* decodeState(initial.stateJson);
+      interruptState = state;
+      const registration = registrations.get(state.flowName)?.at(-1);
+      if (registration === void 0) {
+        if (initial.status === "cancelled" || initial.status === "completed" || initial.status === "failed") return;
+        if ((initial.status === "pending" || initial.status === "suspended" || initial.status === "running") && initial.cancelRequestedAtMs !== null) {
+          if (!(yield* claimAndActivate(initial))) {
+            return;
+          }
+          return yield* cancelOwned(executionId, withoutResult(state));
+        }
+        if (!warnedUnregistered.has(executionId)) {
+          warnedUnregistered.add(executionId);
+          yield* Effect.logWarning(
+            `engine-store: run ${executionId} woke for flow ${state.flowName}, which is not registered in this process; leaving it parked for a worker that registers the flow`,
+            { runId: executionId, flowName: state.flowName }
+          );
+        }
+        return;
+      }
+      if (!(yield* claimAndActivate(initial))) {
+        return;
+      }
+      yield* Effect.logDebug("run activated", { flowName: state.flowName });
+      const activeState = withoutResult(state);
+      const cleared = yield* transitionAndRecord(
+        executionId,
+        "running",
+        yield* encodeState(activeState),
+        { decision: "resumed", status: "running" },
+        { cancelRequested: "absent" },
+        void 0,
+        null
+      );
+      if (cleared._tag === "GuardFailed") {
+        return yield* cancelOwned(executionId, withoutResult(state));
+      }
+      if (cleared._tag !== "Transitioned") return;
+      const payload = yield* Schema.decodeUnknownEffect(
+        Schema.toCodecJson(registration.flow.payloadSchema)
+      )(activeState.payload).pipe(Effect.orDie);
+      yield* releaseRetainedScope(executionId, Exit.void);
+      const instance = import_engine.FlowEngine.makeInstance(
+        registration.flow,
+        executionId,
+        activeState.deadline
+      );
+      round = { flow: registration.flow, instance };
+      const flowEngine = yield* dependencies.engine;
+      yield* Effect.gen(function* () {
+        liveInstances.set(executionId, instance);
+        const result = yield* Effect.scoped(
+          Effect.raceFirst(
+            Effect.raceFirst(
+              Effect.suspend(
+                () => activeState.capabilityCeilings === void 0 ? Effect.die(new Error("Missing persisted capabilityCeilings; execution cannot safely resume")) : registration.execute(payload, executionId)
+              ).pipe(
+                CapabilitySet.attenuateGroups(activeState.capabilityCeilings ?? [[]]),
+                import_flow.Flow.intoResult,
+                Effect.provideService(import_flow.FlowRuntime.FlowInstance, instance),
+                Effect.provideService(import_flow.FlowRuntime.FlowRuntime, flowEngine)
+              ),
+              import_run_store.Ownership.heartbeatLoop(executionId, dependencies.owner, {
+                onReconfirm: (unconfirmedMs) => {
+                  const record = decisionRecord(executionId, {
+                    decision: "lease-reconfirmed",
+                    detail: { unconfirmedMs }
+                  }, dependencies.journalSource);
+                  return journal.emitDurable(record, dependencies.owner).pipe(Effect.asVoid, Effect.orDie);
+                },
+                onLapse: (unconfirmedMs) => Effect.sync(() => {
+                  lapsedMs = unconfirmedMs;
+                })
+              }).pipe(
+                Effect.provideService(import_run_store.RunStore.RunStore, store)
+              )
+            ),
+            cancelPollLoop(executionId)
+          )
+        ).pipe(
+          Effect.ensuring(Effect.sync(() => liveInstances.delete(executionId))),
+          // A suspension is the ONE settlement `Flow.intoResult` leaves the
+          // flow scope open for, so from the instant it surfaces the scope
+          // needs an owner. Retention is taken HERE, inside the race's own
+          // exit processing — `Effect.onExit` finalizers run uninterruptibly —
+          // because taking it any later crosses an interruptible boundary: an
+          // interrupt landing there would end the drive with the scope never
+          // retained, unreachable, and its finalizers never run at all. The
+          // entry is inserted into a cleanup region that was registered before
+          // this race started, so it is owned from this instant on: every
+          // ending, including an interrupt observed at the boundary between
+          // this finalizer and the settlement below, releases it there.
+          Effect.onExit(
+            (exit) => Effect.suspend(() => {
+              if (!(Exit.isSuccess(exit) && exit.value._tag === "Suspended")) return Effect.void;
+              retainedScopes.set(executionId, instance.scope);
+              return dependencies.unsafeOnScopeRetained?.(executionId) ?? Effect.void;
+            })
+          )
+        );
+        const settleRound = Effect.gen(function* () {
+          if (result._tag === "CancelRequested") {
+            yield* cancelOwned(executionId, activeState);
+            return;
+          }
+          const quarantine = result._tag === "Complete" && Exit.isFailure(result.exit) ? ActionPersistence.evidenceQuarantined(result.exit.cause) : void 0;
+          if (quarantine !== void 0) {
+            const parked = yield* transitionAndRecord(
+              executionId,
+              "suspended",
+              yield* encodeState(withoutResult(activeState)),
+              {
+                decision: "quarantined",
+                status: "suspended",
+                keyDigest: quarantine.keyDigest,
+                owner: dependencies.owner
+              },
+              { cancelRequested: "absent" },
+              void 0,
+              { reason: "quarantine", token: quarantine.keyDigest }
+            );
+            if (parked._tag === "GuardFailed") {
+              yield* cancelOwned(executionId, activeState);
+            }
+            return;
+          }
+          if (result._tag === "Handoff") {
+            yield* handOff({
+              executionId,
+              row: initial,
+              state: activeState,
+              flow: registration.flow,
+              handoff: result
+            });
+            return;
+          }
+          const encodedResult = yield* encodeResult(registration.flow, result);
+          const nextState = { ...activeState, result: encodedResult.encoded };
+          const status = encodedResult.note !== void 0 ? "failed" : result._tag === "Suspended" ? "suspended" : Exit.isSuccess(result.exit) ? "completed" : "failed";
+          let waiting = null;
+          if (status === "suspended") {
+            const declared = instance.waiting;
+            const pendingClocks = yield* engineState.pendingClocks({ executionId });
+            waiting = declared !== void 0 ? declared : pendingClocks.length > 0 ? {
+              reason: "timer",
+              wakeAt: Math.min(...pendingClocks.map((clock) => clock.dueAtMs))
+            } : { reason: "event" };
+          }
+          const transitioned = yield* transitionAndRecord(
+            executionId,
+            status,
+            yield* encodeState(nextState),
+            { decision: "transitioned", status, owner: dependencies.owner },
+            { cancelRequested: "absent" },
+            // A suspension is not an exit: the run is parked and will settle
+            // later, so its children keep going and its timers stay armed. A
+            // `completed` or `failed` run is done, so its attached children
+            // end with it. The transition closes its own clock rows.
+            status === "suspended" ? void 0 : applyChildExitPolicy(executionId),
+            waiting
+          ).pipe(
+            // The park becomes durable the instant this transition commits, so
+            // the flag that records it is set in the transition's own exit
+            // processing. `Effect.onExit` finalizers run uninterruptibly and
+            // before the fiber can observe an interruption again, so no
+            // interrupt can land between the durable commit and the flag and
+            // make the cleanup region discard a scope the park still needs.
+            Effect.onExit(
+              (exit) => Effect.sync(() => {
+                if (status === "suspended" && Exit.isSuccess(exit) && exit.value._tag === "Transitioned") {
+                  durableParkAccepted = true;
+                }
+              })
+            )
+          );
+          if (transitioned._tag === "GuardFailed") {
+            yield* cancelOwned(executionId, activeState);
+            return;
+          }
+          if (transitioned._tag !== "Transitioned") return;
+          if (status !== "suspended") {
+            yield* announceSettled(executionId, activeState);
+            return;
+          }
+        });
+        yield* settleRound;
+      });
+    }).pipe(
+      // Install ownership cleanup before the claim itself. Limiting it to
+      // the execution race strands an activated row if shutdown lands in
+      // setup or settlement; a replacement host in the same process then
+      // correctly refuses to steal from the still-live PID forever.
+      Effect.onInterrupt(
+        () => interruptState === void 0 ? Effect.void : settleInterrupted(
+          executionId,
+          interruptState,
+          lapsedMs === void 0 ? { kind: "interrupted" } : { kind: "lease-lapsed", unconfirmedMs: Math.max(0, Math.floor(lapsedMs)) },
+          round
+        )
+      ),
+      Effect.onExit(
+        () => Effect.suspend(() => {
+          liveInstances.delete(executionId);
+          return round === void 0 || durableParkAccepted ? Effect.void : releaseRetainedScope(executionId, Exit.void);
+        })
+      ),
+      Effect.annotateLogs({ runId: executionId })
+    );
+  });
+  const coordinator = yield* RunCoordinator.make({
+    drain: drive
+  });
+  yield* Deferred.succeed(coordinatorDeferred, coordinator);
+  const sweepCancelRequested = Effect.gen(function* () {
+    const released = yield* engineState.waitingRuns({ reason: "released" });
+    const cancelRequestedRows = yield* engineState.waitingRuns({ cancelRequested: true });
+    const candidates = /* @__PURE__ */ new Map();
+    for (const waiting of released) candidates.set(waiting.runId, waiting);
+    for (const waiting of cancelRequestedRows) candidates.set(waiting.runId, waiting);
+    for (const waiting of candidates.values()) {
+      const row = yield* store.get(waiting.runId).pipe(
+        Effect.catch(() => Effect.succeed(void 0))
+      );
+      if (row !== void 0 && row.status === "suspended" && (row.cancelRequestedAtMs !== null || waiting.reason === "released")) {
+        yield* coordinator.wake(row.runId);
+      }
+    }
+  });
+  const sweepReadyTimers = Effect.gen(function* () {
+    const nowMs = yield* Clock.currentTimeMillis;
+    const due = yield* engineState.waitingRuns({ reason: "timer", dueBeforeMs: nowMs });
+    const completions = /* @__PURE__ */ new Map();
+    for (const waiting of due) {
+      const row = yield* store.get(waiting.runId).pipe(Effect.catch(() => Effect.succeed(void 0)));
+      if (row === void 0 || row.status !== "suspended") continue;
+      const state = yield* decodeState(row.stateJson);
+      if (!registrations.has(state.flowName)) continue;
+      let ready = completions.get(state.flowName);
+      if (ready === void 0) {
+        ready = new Set((yield* engineState.completedDeferreds(state.flowName)).map((address) => address.executionId));
+        completions.set(state.flowName, ready);
+      }
+      if (!ready.has(row.runId)) continue;
+      yield* coordinator.schedule(row.runId);
+    }
+  });
+  const pendingCycles = /* @__PURE__ */ new Map();
+  let pendingCancellationCycle;
+  const sweepPendingCancellation = () => Effect.gen(function* () {
+    if (pendingCancellationCycle === void 0) {
+      const tail = yield* engineState.pendingCancellationTail();
+      if (Option.isNone(tail)) return;
+      pendingCancellationCycle = { through: tail.value };
+    }
+    const cycle = pendingCancellationCycle;
+    const candidates = yield* engineState.pendingCancellationRuns(
+      staleRunningSweepBatch,
+      cycle.after,
+      cycle.through
+    );
+    for (const cursor of candidates) {
+      const row = yield* store.get(cursor.runId).pipe(
+        Effect.catch(
+          (error) => error.code === "not_found_row" ? Effect.succeed(void 0) : error.code === "decode_failed" ? Effect.logWarning("engine-store: unreadable pending cancellation skipped", {
+            runId: cursor.runId,
+            error
+          }).pipe(Effect.as(void 0)) : Effect.die(error)
+        )
+      );
+      cycle.after = cursor;
+      if (row === void 0 || row.status !== "pending" || row.cancelRequestedAtMs === null || (yield* coordinator.active).has(cursor.runId)) continue;
+      if (dependencies.canExecute !== void 0 && !(yield* dependencies.canExecute(row))) continue;
+      if (!(yield* coordinator.active).has(cursor.runId)) yield* coordinator.schedule(cursor.runId);
+    }
+    if (candidates.length < staleRunningSweepBatch || candidates.at(-1)?.runId === cycle.through.runId) pendingCancellationCycle = void 0;
+  });
+  let pendingFlowOffset = 0;
+  const sweepPending = () => Effect.gen(function* () {
+    let remaining = staleRunningSweepBatch;
+    const allNames = Array.from(registrations.keys());
+    const offset = allNames.length === 0 ? 0 : pendingFlowOffset % allNames.length;
+    const names = [...allNames.slice(offset), ...allNames.slice(0, offset)];
+    pendingFlowOffset++;
+    for (const name of names) {
+      const registration = registrations.get(name)?.at(-1);
+      if (registration === void 0 || remaining === 0) continue;
+      let cycle = pendingCycles.get(name);
+      if (cycle === void 0) {
+        const eligibleBeforeMs = (yield* Clock.currentTimeMillis) - Duration.toMillis(import_run_store.Ownership.heartbeatStaleAfter);
+        const tail = yield* engineState.pendingRunTail(name, eligibleBeforeMs);
+        if (Option.isNone(tail)) continue;
+        cycle = { through: tail.value, eligibleBeforeMs };
+        pendingCycles.set(name, cycle);
+      }
+      const requested = remaining;
+      const pending = yield* engineState.pendingRuns(
+        name,
+        requested,
+        cycle.after,
+        cycle.through,
+        cycle.eligibleBeforeMs
+      );
+      for (const cursor of pending) {
+        if (remaining === 0 || registrations.get(name)?.at(-1) !== registration) break;
+        remaining--;
+        const row = yield* store.get(cursor.runId).pipe(
+          Effect.catch(
+            (error) => error.code === "not_found_row" ? Effect.succeed(void 0) : error.code === "decode_failed" ? Effect.logWarning("engine-store: unreadable pending admission skipped", {
+              runId: cursor.runId,
+              flowName: name,
+              error
+            }).pipe(Effect.as(void 0)) : Effect.die(error)
+          )
+        );
+        cycle.after = cursor;
+        if (row === void 0 || row.status !== "pending" || (yield* coordinator.active).has(cursor.runId)) {
+          continue;
+        }
+        if (dependencies.canExecute !== void 0 && !(yield* dependencies.canExecute(row))) {
+          continue;
+        }
+        if (registrations.get(name)?.at(-1) !== registration || (yield* coordinator.active).has(cursor.runId)) {
+          continue;
+        }
+        yield* coordinator.schedule(cursor.runId);
+      }
+      const last = pending.at(-1);
+      if (pending.length < requested || last !== void 0 && last.runId === cycle.through.runId) {
+        pendingCycles.delete(name);
+      }
+    }
+  });
+  const sweepStaleRunning = Effect.gen(function* () {
+    const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+    const deferred = Array.from(stealRefusals.values()).filter((entry) => entry.nextProbeAtMs > nowMs).length;
+    const stale = yield* engineState.staleRunningRuns(
+      nowMs - Duration.toMillis(import_run_store.Ownership.heartbeatStaleAfter),
+      staleRunningSweepBatch + deferred
+    );
+    const visible = new Set(stale.map((row) => row.runId));
+    for (const runId of stealRefusals.keys()) {
+      if (!visible.has(runId)) stealRefusals.delete(runId);
+    }
+    let woken = 0;
+    for (const { heartbeatAtMs, runId } of stale) {
+      if (woken >= staleRunningSweepBatch) break;
+      const refusal = stealRefusals.get(runId);
+      if (refusal !== void 0 && refusal.heartbeatAtMs === heartbeatAtMs && refusal.nextProbeAtMs > nowMs) continue;
+      woken = woken + 1;
+      yield* coordinator.wake(runId);
+    }
+  });
+  const resilientSweep = (sweep, name) => sweep.pipe(
+    Effect.sandbox,
+    Effect.catchCause((cause) => Effect.logWarning(`engine-store: ${name} sweep failed; retrying next tick`, cause))
+  );
+  yield* Effect.forkScoped(
+    Effect.forever(
+      Effect.sleep(import_run_store.Ownership.heartbeatInterval).pipe(
+        Effect.andThen(
+          // One transient defect (a `SQLITE_BUSY` escaping `waitingRuns()`'s
+          // `orDie`, a wake failure) must not kill the sweeper for the rest
+          // of the process lifetime (issue #44) — that would silently revert
+          // to pre-#27 behavior where cancel of parked runs is never
+          // delivered. Mirror `armClock`'s hardening: expose the full cause,
+          // log it, and keep ticking.
+          resilientSweep(sweepCancelRequested, "parked-run cancel").pipe(
+            Effect.andThen(resilientSweep(sweepStaleRunning, "stale-running")),
+            Effect.andThen(resilientSweep(sweepReadyTimers, "ready timer")),
+            Effect.andThen(resilientSweep(sweepPendingCancellation(), "pending cancellation")),
+            Effect.andThen(resilientSweep(sweepPending(), "pending admission"))
+          )
+        )
+      )
+    )
+  );
+  const ensureRun = (flow, options) => Effect.gen(function* () {
+    const payload = yield* Schema.encodeEffect(
+      Schema.toCodecJson(flow.payloadSchema)
+    )(
+      options.payload
+    ).pipe(Effect.orDie);
+    yield* transactState(Effect.gen(function* () {
+      let parentRecorded = false;
+      if (options.parent !== void 0) {
+        const parentEdge = yield* engineState.recordRunParent(
+          options.executionId,
+          options.parent.executionId
+        ).pipe(
+          Effect.catch(
+            (error) => Effect.fail(
+              new FlowCycleDetected({ code: "flow_cycle_detected", path: error.path })
+            )
+          )
+        );
+        parentRecorded = parentEdge._tag === "Recorded";
+      }
+      const round = options.round ?? import_engine.FlowEngine.Round.initial(options.executionId);
+      const previousExecutionId = options.round?.previousExecutionId;
+      const onParentExit = options.discard === true ? "detach" : "cancel";
+      const state = {
+        version: 1,
+        flowName: flow._tag,
+        payload,
+        capabilityCeilings: yield* import_engine.FlowEngine.requestedAuthority(flow),
+        onParentExit,
+        ...options.parent === void 0 ? {} : { parentExecutionId: options.parent.executionId },
+        ...flow.maxRounds === void 0 ? {} : { maxRounds: flow.maxRounds }
+      };
+      const createdStateJson = yield* encodeState(state);
+      yield* ensureCreatedRun({
+        flowName: flow._tag,
+        capabilityCeilings: state.capabilityCeilings,
+        executionId: options.executionId,
+        stateJson: createdStateJson,
+        payload,
+        lineageId: round.rootExecutionId,
+        roundOrdinal: round.ordinal,
+        ...previousExecutionId === void 0 ? {} : { parentRunId: previousExecutionId },
+        onCreated: Effect.gen(function* () {
+          yield* emitDecision(options.executionId, {
+            decision: "created",
+            state: JSON.parse(createdStateJson),
+            ...options.parent === void 0 ? {} : { parentExecutionId: options.parent.executionId }
+          });
+          if (options.parent !== void 0) {
+            yield* journal.emitDurableUnfenced(
+              EffectRecords.boundary(
+                {
+                  id: `${options.parent.executionId}:spawn:${options.executionId}`,
+                  kind: spawnEffectKind,
+                  tier: "irreversible",
+                  runId: options.parent.executionId,
+                  lineageId: import_engine.FlowEngine.Lineage.root(options.parent.executionId),
+                  sourceId: dependencies.journalSource,
+                  attempt: 1,
+                  residue: `Child run ${options.executionId} exists and keeps its own journal; rewinding past its spawn orphans it.`
+                },
+                "succeeded",
+                // `attached` is written even though it is always false: the
+                // lineage-tree bridge in `@smthrs/time-travel` reads it off
+                // this payload, and an absent field there would make "this
+                // spawn is detached" indistinguishable from "this producer
+                // predates the field". A run created with a parent is a
+                // separate run row with its own claim, which is what detached
+                // means; attached nesting
+                // never reaches `create` because it is one journal.
+                { childRunId: options.executionId, flowName: flow._tag, attached: false }
+              )
+            ).pipe(Effect.orDie);
+          }
+        })
+      });
+      if (options.parent !== void 0) {
+        yield* inheritParentCancellation(
+          options.parent.executionId,
+          options.executionId
+        );
+        if (parentRecorded) {
+          yield* emitDecision(options.executionId, {
+            decision: "parent-recorded",
+            parentExecutionId: options.parent.executionId
+          });
+        }
+      }
+    })).pipe(
+      Effect.catchIf((error) => error instanceof import_journal.Journal.JournalError || error instanceof import_DurableWriter.DatabaseError, Effect.die)
+    );
+  });
+  const readResult = (flow, executionId, followLineage = false) => Effect.annotateCurrentSpan({ executionId, flow: flow._tag }).pipe(
+    Effect.andThen(import_engine.FlowEngine.requestedAuthority(flow)),
+    Effect.flatMap(
+      (requested) => Effect.map(followLineage ? store.latestRound(executionId) : store.get(executionId), (row) => ({
+        row,
+        requested
+      }))
+    ),
+    Effect.catch(
+      (error) => error.code === "not_found_row" ? Effect.succeed(void 0) : Effect.die(error)
+    ),
+    Effect.flatMap((found) => {
+      if (found === void 0) {
+        return Effect.fail(
+          new import_flow.FlowRuntime.FlowExecutionNotFound({
+            code: "execution_not_found",
+            executionId
+          })
+        );
+      }
+      const { row, requested } = found;
+      return decodeState(row.stateJson).pipe(
+        Effect.flatMap((state) => {
+          if (!followLineage && state.flowName !== flow._tag || state.result === void 0) {
+            return Effect.succeedNone;
+          }
+          if (!import_engine.FlowEngine.joinable(state.capabilityCeilings ?? [], requested)) {
+            return Effect.die(import_engine.FlowEngine.capabilityConflict(executionId));
+          }
+          const resultFlow = state.flowName === flow._tag ? flow : registrations.get(state.flowName)?.at(-1)?.flow;
+          if (resultFlow === void 0) {
+            return Effect.die(new import_engine.FlowEngine.FlowNotRegistered({
+              flowName: state.flowName,
+              message: `Flow ${state.flowName} is not registered`
+            }));
+          }
+          return Schema.decodeUnknownEffect(
+            Schema.toCodecJson(import_flow.Flow.Result({
+              success: resultFlow.successSchema,
+              error: resultFlow.errorSchema
+            }))
+          )(state.result).pipe(
+            Effect.orDie,
+            Effect.map(Option.some)
+          );
+        }),
+        Effect.map((result) => ({ result, status: row.status }))
+      );
+    })
+  );
+  const authorizeResume = (flow, executionId) => Effect.gen(function* () {
+    const row = yield* store.get(executionId).pipe(
+      Effect.catch((error) => error.code === "not_found_row" ? Effect.succeed(void 0) : Effect.die(error))
+    );
+    if (row === void 0) return false;
+    const state = yield* decodeState(row.stateJson);
+    if (state.flowName !== flow._tag) return false;
+    if (!import_engine.FlowEngine.joinable(state.capabilityCeilings ?? [], yield* import_engine.FlowEngine.requestedAuthority(flow))) {
+      return yield* Effect.die(import_engine.FlowEngine.capabilityConflict(executionId));
+    }
+    return true;
+  });
+  const poll = Effect.fn("FlowEngine.poll")(
+    (flow, executionId) => Effect.map(readResult(flow, executionId), (observed) => observed.result)
+  );
+  const execute = Effect.fn("FlowEngine.execute")(
+    function* (flow, options) {
+      yield* Effect.annotateCurrentSpan({ executionId: options.executionId, flow: flow._tag });
+      if (!registrations.has(flow._tag)) {
+        return yield* Effect.die(
+          new import_engine.FlowEngine.FlowNotRegistered({
+            flowName: flow._tag,
+            message: `Flow ${flow._tag} is not registered`
+          })
+        );
+      }
+      if (options.discard) {
+        yield* Effect.uninterruptible(
+          ensureRun(flow, options).pipe(Effect.andThen(coordinator.schedule(options.executionId)))
+        );
+        return void 0;
+      }
+      yield* ensureRun(flow, options);
+      if (options.follow === true) {
+        yield* coordinator.scheduleIf(
+          options.executionId,
+          store.get(options.executionId).pipe(
+            Effect.orDie,
+            Effect.map((row) => row.status === "pending")
+          )
+        );
+        yield* coordinator.join(options.executionId);
+      } else {
+        yield* coordinator.run(options.executionId);
+      }
+      const observed = yield* Effect.orDie(readResult(
+        flow,
+        options.executionId,
+        options.parent !== void 0 && options.round === void 0
+      ));
+      if (Option.isSome(observed.result)) {
+        return observed.result.value;
+      }
+      return observed.status === "cancelled" ? new import_flow.Flow.Complete({ exit: Exit.failCause(Cause.interrupt()) }) : new import_flow.Flow.Suspended({});
+    }
+  );
+  const interrupt = Effect.fn("FlowEngine.interrupt")(
+    (_flow, executionId) => Effect.gen(function* () {
+      yield* Effect.annotateCurrentSpan({ executionId });
+      const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+      const requested = yield* transactState(
+        Effect.gen(function* () {
+          yield* requestCancellation(executionId, nowMs);
+          return [executionId, ...yield* requestCancelDescendants(executionId, nowMs)];
+        }),
+        // Capture the shared writer directly. SqlJournal.transact catches a
+        // selected failure and can discard the rest of a composite cause.
+        (write) => Effect.flatMap(Effect.exit(writer.write(write)), (exit) => exit)
+      ).pipe(
+        Effect.catchCause((cause) => {
+          const failure = (error) => new import_flow.FlowRuntime.CancelRequestFailed({
+            code: "cancel_request_failed",
+            executionId,
+            reason: error.message
+          });
+          if (cause.reasons.length === 1) {
+            const reason = cause.reasons[0];
+            if (Cause.isDieReason(reason) && reason.defect instanceof import_DurableWriter.DatabaseError) {
+              return Effect.fail(failure(reason.defect));
+            }
+            if (Cause.isFailReason(reason)) {
+              return Effect.fail(failure(reason.error));
+            }
+          }
+          return Effect.failCause(asDefects(cause));
+        })
+      );
+      yield* journal.whenCommitted(Effect.gen(function* () {
+        for (const targetId of requested) {
+          const instance = liveInstances.get(targetId);
+          if (instance !== void 0) instance.interrupted = true;
+          yield* coordinator.requestInterrupt(targetId);
+        }
+      }));
+    })
+  );
+  const scheduleResume = Effect.fn("FlowEngine.scheduleResume")(
+    (flowName, executionId, reason, sourceId) => transactState(Effect.gen(function* () {
+      yield* Effect.annotateCurrentSpan({ executionId, flow: flowName, reason });
+      const row = yield* store.get(executionId).pipe(
+        Effect.catch(
+          (error) => error.code === "not_found_row" ? Effect.succeed(void 0) : Effect.die(error)
+        )
+      );
+      if (row === void 0) return;
+      if (row.status === "completed" || row.status === "failed" || row.status === "cancelled") return;
+      const state = yield* decodeState(row.stateJson);
+      if (state.flowName !== flowName) return;
+      const waiting = yield* engineState.waiting(executionId);
+      if (Option.isSome(waiting) && waiting.value.reason === "quarantine") {
+        if (reason !== "operator") return;
+        yield* engineState.wake(executionId);
+      }
+      yield* emitDecision(executionId, {
+        decision: "wake-scheduled",
+        reason
+      }, sourceId);
+      return { parked: row.status === "suspended" };
+    })).pipe(
+      Effect.orDie,
+      // A host can write a separate database. Release the engine transaction
+      // before calling it, but record its request before publishing the wake.
+      Effect.flatMap(
+        (scheduled) => scheduled === void 0 ? Effect.void : (reason === "operator" || reason === "delegated" ? Effect.void : recordResume(executionId, scheduled.parked, reason)).pipe(
+          Effect.andThen(coordinator.wake(executionId)),
+          Effect.andThen(wakeBus.wake(executionId))
+        )
+      )
+    )
+  );
+  return {
+    register: Effect.fn("FlowEngine.register")(
+      (flow, handler) => Effect.acquireRelease(
+        Effect.sync(() => {
+          const registration = { flow, execute: handler };
+          const entries = registrations.get(flow._tag) ?? [];
+          entries.push(registration);
+          registrations.set(flow._tag, entries);
+          pendingCycles.delete(flow._tag);
+          warnedUnregistered.clear();
+          return { registration, entries };
+        }),
+        ({ registration, entries }) => Effect.sync(() => {
+          const wasLatest = entries.at(-1) === registration;
+          entries.splice(entries.indexOf(registration), 1);
+          if (entries.length === 0) registrations.delete(flow._tag);
+          if (wasLatest) {
+            pendingCycles.delete(flow._tag);
+            if (entries.length > 0) warnedUnregistered.clear();
+          }
+        })
+      ).pipe(Effect.asVoid)
+    ),
+    execute,
+    poll,
+    interrupt,
+    // The durable engine has ONE cancellation path (the release policy). The
+    // port promises forced cancellation without cleanup; nothing here can
+    // deliver that — a durable run is closed by a fenced transition whose
+    // finalizers, cascade, and interruption record are the point — and
+    // answering with `interrupt` silently reinterpreted the caller's
+    // request as the safe one. Refusing is what keeps the excluded feature
+    // from appearing to half-work; `interrupt` is the supported request and
+    // is still available to the same caller. The memory engine, which does
+    // have two behaviors, is unchanged.
+    //
+    // The reason is the release policy "Durable interruptUnsafe" verbatim, not a
+    // paraphrase of it: the release note and the failure a caller catches
+    // are the same statement, so an operator who reads one and a developer
+    // who logs the other are reading the same sentence.
+    interruptUnsafe: Effect.fn("FlowEngine.interruptUnsafe")(
+      (_flow, executionId) => Effect.fail(
+        new import_flow.FlowRuntime.CancelRequestFailed({
+          code: "unsafe_interrupt_unsupported",
+          executionId,
+          reason: "The durable engine has one cancellation path, interrupt, which is durable and cascades to linked children. FlowRuntime.interruptUnsafe on the durable engine fails with unsafe_interrupt_unsupported instead of forcing cancellation without cleanup."
+        })
+      )
+    ),
+    resume: Effect.fn("FlowEngine.resume")(
+      (flow, executionId, options) => Effect.annotateCurrentSpan({ executionId, flow: flow._tag }).pipe(
+        // A resume drives the run under its admitted authority, so a caller
+        // whose authority does not cover it may not wake or join it, and a
+        // request that names no admitted run of this flow drives nothing.
+        Effect.andThen(authorizeResume(flow, executionId)),
+        Effect.flatMap(
+          (authorized) => authorized ? Effect.andThen(
+            options?.poll === true ? Effect.void : scheduleResume(flow._tag, executionId, options?.delegated === true ? "delegated" : "operator"),
+            coordinator.run(executionId)
+          ) : Effect.void
+        )
+      )
+    ),
+    scheduleResume,
+    active: Effect.fn("FlowEngine.active")(() => coordinator.active)(),
+    retainedRuns
+  };
+});
+//# sourceMappingURL=RunDriver.js.map