@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/internal/RunDriver.js

@@ -0,0 +1,2334 @@
+/**
+ * Claim-gated durable flow run lifecycle.
+ *
+ * @since 0.1.0
+ */
+import * as CapabilitySet from "@smthrs/capability/CapabilitySet";
+import { DatabaseError, DurableWriter } from "@smthrs/database/DurableWriter";
+import { FlowEngine } from "@smthrs/engine";
+import { Flow, FlowRuntime } from "@smthrs/flow";
+import { Journal } from "@smthrs/journal";
+import { Ownership, RunStore } from "@smthrs/run-store";
+import * as Cause from "effect/Cause";
+import * as Clock from "effect/Clock";
+import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Metric from "effect/Metric";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import * as Scope from "effect/Scope";
+import * as DurableEngineState from "../DurableEngineState.js";
+import * as EngineStoreMetrics from "../EngineStoreMetrics.js";
+import { EventTypes } from "../EventTypes.js";
+import * as ExecutionFacts from "../ExecutionFacts.js";
+import { RunState } from "../RunState.js";
+import * as WakeBus from "../WakeBus.js";
+import * as ActionPersistence from "./ActionPersistence.js";
+import * as EffectRecords from "./EffectRecords.js";
+import * as ExitEncoding from "./ExitEncoding.js";
+import * as JournalRecords from "./JournalRecords.js";
+import * as RunCoordinator from "./RunCoordinator.js";
+import * as RunLifecycle from "./RunLifecycle.js";
+import * as StateTransaction from "./StateTransaction.js";
+const RunStateJson = Schema.fromJsonString(RunState);
+/**
+ * Re-channels every typed reason of a cause as a defect, identity intact.
+ *
+ * A boundary whose declared error type cannot describe what happened has two
+ * honest options: widen the type, or stop calling the failure typed. Casting
+ * the cause is the third, dishonest one — it left a raw `DatabaseError`
+ * escaping an `Effect<void, CancelRequestFailed>`. Demotion keeps the error
+ * object, every other reason and every interruption, and no caller can
+ * mistake the result for a failure its handler declared.
+ */
+const asDefects = (cause) => Cause.fromReasons(cause.reasons.map((reason) => Cause.isFailReason(reason)
+    ? Cause.makeDieReason(reason.error).annotate(Cause.reasonAnnotations(reason))
+    : reason));
+/**
+ * Raised when a flow (directly or through mutual ancestry) attempts to
+ * execute an execution id that already appears in its own persisted
+ * `parentExecutionId` chain.
+ *
+ * Detection walks the already-persisted parent chain from the requesting
+ * parent upward — an O(depth) check, not a dependency-graph DFS — because
+ * `parentExecutionId` is the only edge our runtime model can express.
+ *
+ * The class is declared by `@smthrs/flow` (it is part of the `execute`
+ * contract) and re-exported here for the detector's callers.
+ *
+ * @since 0.1.0
+ * @category errors
+ */
+export const FlowCycleDetected = FlowRuntime.FlowCycleDetected;
+/**
+ * The effect kind a detached child spawn is journaled under, and therefore the
+ * kind an engine composition registers a spawn-compensation handler for.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const spawnEffectKind = EventTypes.childSpawnKind;
+const snapshot = (row) => ({
+    status: row.status,
+    owner: row.owner,
+    heartbeatAtMs: row.heartbeatAtMs
+});
+const isPlainObject = (value) => {
+    if (value === null || typeof value !== "object")
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+};
+/**
+ * Compares encoded JSON payloads structurally. Object key order is not part
+ * of JSON identity, while array order and array length are.
+ *
+ * Values outside JSON compare unequal unless both arguments are the same
+ * reference.
+ *
+ * @since 1.0.0
+ * @category guards
+ * @private
+ */
+export const samePayload = (left, right) => {
+    if (Object.is(left, right))
+        return true;
+    if (typeof left === "number" && typeof right === "number") {
+        return left === 0 && right === 0;
+    }
+    if (Array.isArray(left)) {
+        if (!Array.isArray(right) || left.length !== right.length)
+            return false;
+        for (let index = 0; index < left.length; index++) {
+            if (!samePayload(left[index], right[index]))
+                return false;
+        }
+        return true;
+    }
+    if (Array.isArray(right) || !isPlainObject(left) || !isPlainObject(right))
+        return false;
+    const leftKeys = Object.keys(left);
+    const rightKeys = Object.keys(right);
+    if (leftKeys.length !== rightKeys.length)
+        return false;
+    for (const key of leftKeys) {
+        if (!Object.hasOwn(right, key) || !samePayload(left[key], right[key]))
+            return false;
+    }
+    return true;
+};
+/**
+ * Sentinel produced when the cancel-request poll observes a durable
+ * cancellation before the flow settles.
+ */
+const cancelRequested = { _tag: "CancelRequested" };
+/**
+ * How many stale-running rows one heartbeat tick may wake (issue #79).
+ * Oldest heartbeats surface first, so a backlog larger than the batch
+ * drains across ticks; each successful steal removes the row from the
+ * stale window, and losing drivers see a shrinking batch next tick.
+ */
+const staleRunningSweepBatch = 64;
+/**
+ * How long a run waits before its live owner is probed again, and how far
+ * that wait doubles.
+ *
+ * A refusal is evidence: the recorded owner answered, so the one thing the
+ * sweep knows is that re-asking immediately is waste. Without a wait the
+ * oldest batch is re-probed every heartbeat forever and nothing behind it is
+ * ever reached (issue #79 follow-up). The first wait is two ticks, which is
+ * already enough for the batch to move on, and it doubles up to the lease
+ * window: an owner that stops heartbeating is therefore re-probed within one
+ * `heartbeatStaleAfter` of the last refusal, which is the same window every
+ * other reclaim decision is made against.
+ */
+const stealRefusalBackoffFirst = Duration.times(Ownership.heartbeatInterval, 2);
+const stealRefusalBackoffMax = Ownership.heartbeatStaleAfter;
+const withoutResult = (state) => {
+    const { cancellation: _, result: __, ...rest } = state;
+    return rest;
+};
+/**
+ * Constructs a scoped run driver.
+ *
+ * Every start and wake enters the same keyed coordinator and then the same
+ * exact-snapshot claim/activation path.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const make = (dependencies) => Effect.gen(function* () {
+    const journal = yield* Journal.Journal;
+    const writer = yield* DurableWriter;
+    const store = yield* RunStore.RunStore;
+    const engineState = yield* DurableEngineState.DurableEngineState;
+    const lifecycle = RunLifecycle.make(store, engineState);
+    const wakeBus = dependencies.wakeBus ?? WakeBus.makeNoop();
+    /**
+     * The deployment's own liveness answer, if it gave one.
+     *
+     * Kept separate from {@link isAlive} because the two differ in what they
+     * PROVE, and the journal says which was used: a supplied probe reports on
+     * the process (or the host it lives on), while the default reports only
+     * that the lease it stopped renewing has expired.
+     */
+    const suppliedIsAlive = dependencies.isAlive;
+    const isAlive = suppliedIsAlive ??
+        Ownership.leaseLiveness(Ownership.heartbeatStaleAfter);
+    /**
+     * The evidence kind a steal admitted by {@link isAlive} carries.
+     *
+     * `steal` is only reached for a run whose lease has already expired, so
+     * `lease-expired` is always true here; what the supplied-probe kinds add
+     * is WHY the deployment believes the owner is gone, which is the
+     * distinction `RunStore` binds to the host relation.
+     */
+    const livenessEvidenceKind = (expectedOwner) => suppliedIsAlive === undefined
+        ? "lease-expired"
+        : Ownership.sameHostIncarnation(expectedOwner, dependencies.owner)
+            ? "same-host-pid-dead"
+            : "cross-host-unreachable-stale";
+    /** Owner identity equality, the fence's own notion of "the same process". */
+    const sameOwner = (left, right) => left.hostId === right.hostId && left.pid === right.pid && left.nonce === right.nonce;
+    const registrations = new Map();
+    /**
+     * Runs already warned about waking without a registered flow (issue
+     * #62): the sweep retries every heartbeat, so the warning is emitted
+     * once per run, not once per tick. Cleared on every registration — a
+     * newly registered flow makes previously dropped runs drivable again.
+     */
+    const warnedUnregistered = new Set();
+    /**
+     * Runs whose owner answered a probe (or held a fresh lease) and are
+     * therefore not worth re-arbitrating yet. See {@link StealRefusal}.
+     *
+     * Bounded by the stale set the sweep can see: every tick drops the entries
+     * whose rows are no longer in the window it read, so a run that is stolen,
+     * released, or settled takes its entry with it.
+     */
+    const stealRefusals = new Map();
+    /**
+     * Records that a run's recorded owner was found alive, and when it may be
+     * asked about again.
+     */
+    const deferSteal = (runId, heartbeatAtMs, nowMs) => {
+        const previous = stealRefusals.get(runId);
+        // A moved lease is new evidence about a different state of the world, so
+        // it starts the ladder over instead of inheriting the old wait.
+        const attempt = previous !== undefined && previous.heartbeatAtMs === heartbeatAtMs ? previous.attempt + 1 : 1;
+        const waitMs = Math.min(Duration.toMillis(stealRefusalBackoffFirst) * Math.pow(2, attempt - 1), Duration.toMillis(stealRefusalBackoffMax));
+        stealRefusals.set(runId, { heartbeatAtMs, nextProbeAtMs: nowMs + waitMs, attempt });
+    };
+    /**
+     * The journal address of one refusal.
+     *
+     * Refusals were emitted through the driver's default source id with no
+     * `sourceSeq`, so nothing deduplicated them: a live owner cost one durable
+     * journal row per refused run per heartbeat, indefinitely. Addressing the
+     * record by the run, the owner, and the lease it was refused against makes
+     * the journal's own first-writer admission the deduplication — the same
+     * mechanism the registration-time wake records use — so a repeated refusal
+     * about an unchanged lease says nothing twice.
+     *
+     * The evidence is part of the address because one lease can be refused for
+     * two different reasons, and they are different records. A wake that
+     * arrives while the owner is still pulsing is refused by the lease alone
+     * (`lease-fresh`); the same owner, still alive but stalled past the
+     * window, is refused by the probe (`probe`). Addressing both to one key
+     * made the second write a different payload under the first one's address,
+     * which the journal rejects as `idempotency_conflict` — a defect that
+     * killed the drive fiber, dropped the probe refusal, and took down any
+     * `execute` joined to that run. One address per (run, owner, lease,
+     * evidence) keeps every reason sayable and still admits each of them once.
+     *
+     * That makes this driver's own payload a pure function of its address, so
+     * it can no longer conflict with itself. It is not the only writer at
+     * these addresses, and a conflict raised by another one is no longer fatal
+     * either: refusals are emitted through {@link emitEvidence}.
+     */
+    const stealRefusedSourceId = (owner, heartbeatAtMs, evidence) => `${dependencies.journalSource}:steal-refused:${evidence}:${JSON.stringify([owner.hostId, owner.pid, owner.nonce])}:${heartbeatAtMs}`;
+    const liveInstances = new Map();
+    /**
+     * Flow scopes retained past a round's settlement.
+     *
+     * `Flow.intoResult` closes the flow scope for every settlement EXCEPT a
+     * suspension — a parked flow keeps its scope so the resources its body
+     * acquired outlive the park (`packages/smithers/flows/flow/src/Flow/Runtime.ts`). Nothing
+     * then owned that scope: the instance left `liveInstances` on the way out
+     * and the `Scope.Closeable` became unreachable, so a cancelled parked flow
+     * never ran its finalizers and every park leaked one scope for the
+     * process's lifetime.
+     *
+     * The map is that owner. It holds at most one scope per run — an entry is
+     * a state, not a queue — and every removal goes through
+     * `releaseRetainedScope`, which deletes before it closes. That makes the
+     * close idempotent by construction rather than by a flag: a second caller
+     * finds no entry and does nothing, so concurrent cancel, resume, and
+     * shutdown paths cannot double-finalize.
+     */
+    const retainedScopes = new Map();
+    /**
+     * Closes a run's retained flow scope exactly once, if it has one.
+     *
+     * `exit` decides what the finalizers see. A cancellation closes with an
+     * interrupt exit so `Flow.withRollback` compensations run; a supersede
+     * (the run re-entered execution under a fresh instance and scope) closes
+     * with `Exit.void` so ordinary finalizers release resources while
+     * rollbacks correctly stay out — a re-driven round is not an unsuccessful
+     * exit.
+     */
+    const releaseRetainedScope = (runId, exit) => Effect.suspend(() => {
+        const scope = retainedScopes.get(runId);
+        if (scope === undefined)
+            return Effect.void;
+        retainedScopes.delete(runId);
+        return Scope.close(scope, exit).pipe(Effect.catchCause((cause) => Effect.logWarning(`engine-store: finalizers of parked run ${runId} failed while closing its retained flow scope`, cause)));
+    });
+    /**
+     * Snapshots the runs whose flow scope this driver is currently holding.
+     * Exposed for the leak assertions in `packages/smithers/flows/engine-store/test`, which
+     * would otherwise have to reach into driver internals.
+     */
+    const retainedRuns = Effect.sync(() => new Set(retainedScopes.keys()));
+    // Process shutdown must not strand parked scopes either: closing the
+    // driver's own scope releases every scope still retained. `Exit.void`,
+    // because a shutdown is a reclaimable release (issue #26) and not a
+    // cancellation, so compensations must not fire.
+    yield* Effect.addFinalizer(() => Effect.forEach(Array.from(retainedScopes.keys()), (runId) => releaseRetainedScope(runId, Exit.void), { discard: true }));
+    const encodeState = (state) => Schema.encodeEffect(RunStateJson)(state).pipe(Effect.orDie);
+    const decodeState = (stateJson) => Schema.decodeUnknownEffect(RunStateJson)(stateJson).pipe(Effect.orDie);
+    /**
+     * Tells the host that this driver is asking a PARKED execution to resume.
+     *
+     * Only a parked one. A wake against a run that is still running is
+     * already covered by the round it is in, and a request recorded for it
+     * would be a delegation no park ever takes up: the host polls it for as
+     * long as the run lives, and every poll pays a park wait for a run that
+     * is not parked.
+     *
+     * See {@link Dependencies.requestResume} for which wakes reach here.
+     */
+    const recordResume = (executionId, parked, reason) => dependencies.requestResume === undefined || !parked
+        ? Effect.void
+        : dependencies.requestResume(executionId, reason);
+    /**
+     * {@link recordResume} for the parent a settling child is waking.
+     *
+     * The waiting row is the park: it is written in the same transaction as
+     * the suspended transition and cleared by the claim that ends it, so a
+     * parent that has one is parked and a parent mid-round has none. It is
+     * read only for a host that records, so a composition without one pays
+     * nothing per child settlement.
+     */
+    const recordParentResume = (parentExecutionId) => dependencies.requestResume === undefined ? Effect.void : Effect.flatMap(engineState.waiting(parentExecutionId), (waiting) => recordResume(parentExecutionId, Option.isSome(waiting) && waiting.value.reason !== "quarantine", "parent"));
+    /**
+     * Run decisions are lifecycle records: they take the journal's durable
+     * channel so a saturated lossy queue can never drop them (issue #10).
+     * They stay ownerless because several decisions — `claim-lost`,
+     * `steal-refused-owner-alive`, post-transition `transitioned` — are
+     * legitimately recorded by a process that does not (or no longer does)
+     * own the run; the ownership fence for these paths is the run-row CAS
+     * that precedes each emit.
+     *
+     * `meta.lineageId` is a JOURNAL lineage id (`FlowEngine.Lineage`,
+     * `<runId>/root`), because that is the space a time-travel frame addresses:
+     * time travel (`packages/smithers/flows/time-travel/docs/README.md`) makes a frame `(lineageId, seq)`, and
+     * replay skips an entry whose `meta.lineageId` names a different lineage.
+     * The run row's `lineageId` column is a different space — the TRAMPOLINE
+     * lineage of `packages/smithers/flows/engine/docs/concepts/trampoline-rounds.md`, round 0's execution
+     * id.
+     *
+     * DECIDED (2026-08-12): decisions address the journal lineage of the run
+     * that records them, one per round, the same lineage that run's attempt
+     * and snapshot records already carry. Reading the run row's trampoline
+     * lineage here put a run's decisions in a lineage its own attempts do not
+     * address, so a rewind of that run skipped them. The trampoline lineage is
+     * not lost: `created` and `handed-off` carry `lineageId` and
+     * `roundOrdinal` in the decision payload, which is what walks a whole
+     * trampoline chain.
+     */
+    const executionFacts = ExecutionFacts.make({
+        runs: store,
+        state: engineState,
+        journal,
+        sourceId: dependencies.journalSource
+    });
+    const requestCancellation = (runId, at) => executionFacts.requestCancel(runId, at).pipe(Effect.catchIf((error) => error._tag === "@smthrs/journal/JournalError" || error instanceof DatabaseError, Effect.die));
+    const decisionRecord = (runId, payload, sourceId) => 
+    // Lifecycle decisions normally use the unfenced channel: they commit in the SAME transaction
+    // as the store-level owner CAS that is its fence (`transitionOwned`,
+    // `activate`, `claim`/`steal` outcomes), and by then the run is often no
+    // longer `running` under this owner, which is the exact predicate the
+    // journal fence asserts. Several call sites (claim-lost,
+    // steal-refused-owner-alive, activation-lost) also record decisions for
+    // runs this driver never owned at all — first-writer-wins evidence,
+    // which is what the unfenced channel exists for. Lease reconfirmation
+    // retains ownership and emits this record through the fenced channel.
+    JournalRecords.runDecision({
+        runId,
+        lineageId: FlowEngine.Lineage.root(runId),
+        sourceId,
+        ...(sourceId === dependencies.journalSource ? {} : { sourceSeq: 0 })
+    }, payload);
+    /**
+     * Completes every pending clock of a settled run and records each
+     * completion, in the caller's transaction. A run that settles before its
+     * timer fires still has to leave the journal saying the clock is done, or
+     * a rebuilt deadline index would arm it again (issue #2037).
+     */
+    const completeRunClocks = (runId, completedAtMs) => Effect.flatMap(engineState.completeRunClocks(runId, completedAtMs), (completed) => Effect.forEach(completed, (clock) => journal.emitDurableUnfenced(JournalRecords.clockCompletedFor(dependencies.journalSource, FlowEngine.Lineage.root(runId), clock, completedAtMs)), { discard: true }));
+    /**
+     * Records a decision this driver's own write transaction is responsible
+     * for: the `transitioned` record that commits with its run-row CAS, and
+     * the `claimed-and-activated` / `stolen-and-activated` record that commits
+     * with the activation CAS.
+     *
+     * These stay fatal. They take the driver's default source id, so the
+     * journal allocates them a fresh `sourceSeq` and no address can collide;
+     * a failure here is the storage layer failing under a transaction whose
+     * other half is a run-row write, and the transaction has to take the
+     * driver down with it rather than commit a terminal row whose decision
+     * never reached the journal.
+     */
+    const emitDecision = (runId, payload, sourceId = dependencies.journalSource) => Effect.gen(function* () {
+        const decision = payload;
+        const authoritative = sourceId === dependencies.journalSource && decision.decision !== "wake-scheduled" &&
+            decision.decision !== "child-policy-applied";
+        const recorded = authoritative
+            ? {
+                ...decision,
+                executionFact: yield* executionFacts.fact(runId, decision.decision === "created" ? "created" : "legacy")
+            }
+            : payload;
+        yield* journal.emitDurableUnfenced(decisionRecord(runId, recorded, sourceId));
+    }).pipe(Effect.orDie);
+    /**
+     * Records evidence ABOUT a run this driver does not own, and never raises
+     * on the drive fiber.
+     *
+     * `claim-lost`, `activation-lost` and `steal-refused-owner-alive` are the
+     * three decisions taken about a run another process holds. They are
+     * observations, not commitments: the arbitration they describe already
+     * happened in the store, the caller has already lost, and the very next
+     * thing every one of these call sites does is answer `false`. Routing them
+     * through {@link emitDecision} put an audit write on the failure path of
+     * the loop that drives every run in the process — an `idempotency_conflict`
+     * on a shared refusal address killed the drive fiber, dropped the record
+     * anyway, and took down any `execute` joined to that run.
+     *
+     * So the receipt is folded into a log, the shape `ActionPersistence`'s
+     * `emitConverging` uses for the same reason on the replay branches:
+     *
+     * - `Accepted`: the observation is durable. Nothing to say.
+     * - `Duplicate`: an identical observation is already durable — the
+     *   per-heartbeat deduplication the refusal address exists for. Debug.
+     * - `idempotency_conflict`: this address already holds a DIFFERENT
+     *   observation, so someone (another process, an earlier evidence shape,
+     *   a copied journal after a time-travel fork) said something else about
+     *   the same (run, owner, lease, evidence). The durable record wins and
+     *   the divergence is worth a warning, but it is still only evidence.
+     *
+     * Any other journal failure is folded the same way and for the same
+     * reason: an audit record must never be the thing that stops a driver
+     * from driving. A journal that is genuinely broken still fails the very
+     * next decision write that IS a fence, which is where it belongs.
+     */
+    const emitEvidence = (runId, payload, sourceId = dependencies.journalSource) => journal.emitDurableUnfenced(decisionRecord(runId, payload, sourceId)).pipe(Effect.flatMap((receipt) => receipt._tag === "Duplicate"
+        ? Effect.logDebug(`engine-store: run ${runId} already recorded this evidence`, { runId, sourceId, seq: receipt.seq })
+        : Effect.void), Effect.catch((error) => Effect.logWarning(`engine-store: evidence about run ${runId} was not admitted to the journal (${error.code}); the run is unaffected`, { runId, sourceId, code: error.code, payload })));
+    /**
+     * The package's ordered state-and-journal boundary: engine state first,
+     * the journal's write transaction inside it. See
+     * {@link StateTransaction.make} for the order and what it guarantees.
+     */
+    const transactState = StateTransaction.make(engineState, journal);
+    /**
+     * Commits a run-row transition and the decision describing it in ONE write
+     * transaction, reporting the store outcome.
+     *
+     * `RunStore` and the journal write through the same `DurableWriter`, so the CAS
+     * becomes a savepoint of this transaction: a crash can no longer leave a
+     * terminal run row whose `transitioned` decision never reached the
+     * journal, nor a decision for a CAS that lost. Temporal commits mutable
+     * state and its history events as one persistence request
+     * (`reference/temporal/service/history/workflow/transaction_impl.go`);
+     * this is the same unit of work for a run transition.
+     *
+     * The decision is emitted only for a `Transitioned` outcome: a lost CAS
+     * changed nothing, and its `claim-lost`/`activation-lost` records are
+     * emitted by the caller, outside the transaction, so they survive.
+     *
+     * `waiting` parks before the CAS releases ownership, inside this same
+     * transaction. A refused park or transition FAILS the transaction, so SQL
+     * rolls back and the memory state's serialized snapshot is restored too.
+     * Only outside both boundaries is the refusal returned as an outcome.
+     * No former owner reads or clears a replacement's waiting marker.
+     *
+     * `afterTransitioned` is the seam for work that must commit WITH the
+     * transition or not at all: today, ending the run's linked children on a
+     * terminal exit. It runs only after a successful CAS, so a lost fence
+     * touches nothing, and inside the transaction, so a crash between the two
+     * writes rolls both back.
+     */
+    const transitionAndRecord = (runId, toStatus, stateJson, decision, guard, afterTransitioned, waiting) => transactState(Effect.gen(function* () {
+        if (waiting !== undefined && waiting !== null) {
+            const parked = yield* engineState.park(runId, waiting, dependencies.owner);
+            if (parked._tag === "NotFound") {
+                return yield* Effect.fail({ _tag: "TransitionRefused", outcome: parked });
+            }
+        }
+        const transitioned = yield* store.transitionOwned(runId, dependencies.owner, toStatus, stateJson, guard).pipe(Effect.orDie);
+        if (transitioned._tag !== "Transitioned") {
+            return yield* Effect.fail({ _tag: "TransitionRefused", outcome: transitioned });
+        }
+        if (waiting === null) {
+            yield* engineState.wake(runId);
+        }
+        if (afterTransitioned !== undefined) {
+            yield* afterTransitioned;
+        }
+        // Every terminal round closes its own deadlines, including a
+        // handoff whose successor and linked children continue separately.
+        if (toStatus === "completed" || toStatus === "failed") {
+            yield* completeRunClocks(runId, yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor)));
+        }
+        // The decision carries the state it committed, so run state at a
+        // frame is DERIVED by replaying decisions rather than read off the
+        // run row's current `state_json`
+        // (Temporal's
+        // `ndc/state_rebuilder.go` is the model). Without it a fork at an
+        // early frame silently inherited the parent's *latest* state.
+        yield* emitDecision(runId, { ...decision, state: JSON.parse(stateJson) });
+        return transitioned;
+    })).pipe(Effect.catchTag("TransitionRefused", ({ outcome }) => Effect.succeed(outcome)), Effect.orDie);
+    const abandon = (runId, claimedAtMs) => store.abandonClaim(runId, dependencies.owner, claimedAtMs).pipe(Effect.asVoid, Effect.orDie);
+    const claimAndActivate = Effect.fn("RunDriver.claimAndActivate")(function* (row) {
+        return yield* Effect.gen(function* () {
+            yield* Effect.annotateCurrentSpan({ runId: row.runId, status: row.status });
+            if (dependencies.canExecute !== undefined && !(yield* dependencies.canExecute(row))) {
+                return false;
+            }
+            if (row.status === "completed" || row.status === "failed" || row.status === "cancelled") {
+                yield* Effect.annotateCurrentSpan({ outcome: "terminal" });
+                yield* Metric.update(EngineStoreMetrics.claim.Terminal, 1);
+                return false;
+            }
+            // Every drive, including a fresh execute or a queued wake, must
+            // preserve quarantine. Cancellation still claims the row to close it.
+            if (row.cancelRequestedAtMs === null) {
+                const waiting = yield* engineState.waiting(row.runId);
+                if (Option.isSome(waiting) && waiting.value.reason === "quarantine") {
+                    return false;
+                }
+            }
+            const expected = snapshot(row);
+            const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+            let claim;
+            let stealEvidenceKind;
+            let recoveredClaim;
+            if (row.status === "running") {
+                if (row.owner === null ||
+                    row.heartbeatAtMs === null ||
+                    row.heartbeatAtMs >= nowMs - Duration.toMillis(Ownership.heartbeatStaleAfter)) {
+                    // The lease is the refusal, and no probe is consulted for it: a
+                    // probe may be a remote call, and a fresh heartbeat already
+                    // answers the question. It is journaled anyway — but only when
+                    // another owner holds the run, because refusing to steal from
+                    // ourselves is routine re-entry rather than arbitration — so an
+                    // operator whose `resume` did nothing can see that a live owner
+                    // was in the way (issue #53 follow-up).
+                    if (row.owner !== null && !sameOwner(row.owner, dependencies.owner)) {
+                        deferSteal(row.runId, row.heartbeatAtMs, nowMs);
+                        yield* emitEvidence(row.runId, {
+                            decision: "steal-refused-owner-alive",
+                            evidence: "lease-fresh",
+                            expectedOwner: row.owner,
+                            heartbeatAtMs: row.heartbeatAtMs
+                        }, stealRefusedSourceId(row.owner, row.heartbeatAtMs, "lease-fresh"));
+                    }
+                    yield* Effect.annotateCurrentSpan({ outcome: "heartbeat_fresh" });
+                    yield* Metric.update(EngineStoreMetrics.claim.HeartbeatFresh, 1);
+                    return false;
+                }
+                if (yield* isAlive(row.owner, { claimant: dependencies.owner, heartbeatAtMs: row.heartbeatAtMs, nowMs })) {
+                    deferSteal(row.runId, row.heartbeatAtMs, nowMs);
+                    yield* emitEvidence(row.runId, {
+                        decision: "steal-refused-owner-alive",
+                        // Always a supplied probe. The default check is the lease, and
+                        // the lease already refused above for every row that could still
+                        // be fresh, so reaching this arm means the deployment answered
+                        // for the owner with something the store cannot see.
+                        evidence: "probe",
+                        expectedOwner: row.owner,
+                        heartbeatAtMs: row.heartbeatAtMs
+                    }, stealRefusedSourceId(row.owner, row.heartbeatAtMs, "probe"));
+                    yield* Effect.annotateCurrentSpan({ outcome: "steal_refused_owner_alive" });
+                    yield* Metric.update(EngineStoreMetrics.claim.StealRefusedOwnerAlive, 1);
+                    yield* Effect.logDebug("run steal refused, recorded owner is alive", {
+                        runId: row.runId,
+                        heartbeatAtMs: row.heartbeatAtMs
+                    });
+                    return false;
+                }
+                stealEvidenceKind = livenessEvidenceKind(row.owner);
+                claim = yield* store.steal(row.runId, expected, dependencies.owner, nowMs, {
+                    expectedOwner: row.owner,
+                    checkedAtMs: nowMs,
+                    kind: stealEvidenceKind
+                }).pipe(Effect.orDie);
+            }
+            else {
+                // A process that died between `claim` and `activate` leaves its
+                // claim on a parked or pending row, and every later claim loses to
+                // it: the run could never be driven again. A claim older than the
+                // lease whose claimant is gone is released first, by the same
+                // liveness rule a steal applies to a running owner.
+                if (row.claim !== null && row.claimedAtMs !== null && !sameOwner(row.claim, dependencies.owner) &&
+                    row.claimedAtMs < nowMs - Duration.toMillis(Ownership.heartbeatStaleAfter) &&
+                    !(yield* isAlive(row.claim, { claimant: dependencies.owner, heartbeatAtMs: row.claimedAtMs, nowMs }))) {
+                    const recovered = yield* store.recoverClaim(row.runId, row.claim, row.claimedAtMs, dependencies.owner, nowMs, { expectedOwner: row.claim, checkedAtMs: nowMs, kind: livenessEvidenceKind(row.claim) }).pipe(Effect.orDie);
+                    if (recovered._tag === "Recovered") {
+                        recoveredClaim = { claimant: row.claim, claimedAtMs: row.claimedAtMs };
+                    }
+                }
+                claim = yield* store.claim(row.runId, expected, dependencies.owner, nowMs).pipe(Effect.orDie);
+            }
+            if (claim._tag !== "Claimed") {
+                yield* emitEvidence(row.runId, {
+                    decision: "claim-lost",
+                    outcome: claim._tag,
+                    expected
+                });
+                yield* Effect.annotateCurrentSpan({ outcome: "claim_lost" });
+                yield* Metric.update(EngineStoreMetrics.claim.ClaimLost, 1);
+                yield* Effect.logDebug("run claim lost", { runId: row.runId, outcome: claim._tag });
+                return false;
+            }
+            // The activation CAS and the decision recording it commit together:
+            // a crash between them left a run durably running under this owner
+            // with no journal entry saying who took it.
+            const activation = yield* transactState(Effect.gen(function* () {
+                // Admission can change without changing the ownership snapshot
+                // (a released→running→released ABA, rewind, or consent change).
+                // Recheck its read-only native fence under the writer transaction;
+                // loading modules and probing external hosts remain preflight work.
+                if (dependencies.canActivate !== undefined &&
+                    !(yield* dependencies.canActivate(yield* store.get(row.runId).pipe(Effect.orDie)))) {
+                    return { _tag: "SnapshotChanged" };
+                }
+                // Another owner can quarantine and return to the same suspended
+                // snapshot between preflight and claim. Fence that park in the
+                // activation transaction too; the rejected claim is abandoned below.
+                if (row.cancelRequestedAtMs === null) {
+                    const waiting = yield* engineState.waiting(row.runId);
+                    if (Option.isSome(waiting) && waiting.value.reason === "quarantine") {
+                        return { _tag: "SnapshotChanged" };
+                    }
+                }
+                const activation = yield* store.activate(row.runId, dependencies.owner, claim.claimedAtMs, expected).pipe(Effect.orDie);
+                if (activation._tag !== "Activated") {
+                    return activation;
+                }
+                yield* emitDecision(row.runId, {
+                    decision: row.status === "running" ? "stolen-and-activated" : "claimed-and-activated",
+                    previousStatus: row.status,
+                    owner: dependencies.owner,
+                    // What admitted the takeover, so an operator reading the journal
+                    // can tell a lease that simply expired from a probe that
+                    // positively reported the owner gone.
+                    ...(stealEvidenceKind === undefined ? {} : { evidence: stealEvidenceKind }),
+                    ...(recoveredClaim === undefined ? {} : { recoveredClaim })
+                });
+                return activation;
+            })).pipe(Effect.orDie);
+            if (activation._tag !== "Activated") {
+                yield* abandon(row.runId, claim.claimedAtMs);
+                yield* emitEvidence(row.runId, {
+                    decision: "activation-lost",
+                    outcome: activation._tag,
+                    expected
+                });
+                yield* Effect.annotateCurrentSpan({ outcome: "activation_lost" });
+                yield* Metric.update(EngineStoreMetrics.claim.ActivationLost, 1);
+                yield* Effect.logDebug("run activation lost", { runId: row.runId, outcome: activation._tag });
+                return false;
+            }
+            yield* Effect.annotateCurrentSpan({ outcome: "activated" });
+            yield* Metric.update(EngineStoreMetrics.claim.Activated, 1);
+            // The run is this driver's now, so whatever it was told about the
+            // previous owner is spent.
+            stealRefusals.delete(row.runId);
+            return true;
+        });
+    });
+    /**
+     * Collects other rounds and transitive descendants of the logical run.
+     *
+     * Round membership and the edge table represent the logical job that every
+     * owner process and every restart can see (issues #40/#41), which is
+     * exactly why the cascade reads it instead of an in-process instance map:
+     * a cross-process cancellation is observed by a driver that never spawned
+     * the children and holds no `FlowInstance` for any of them.
+     *
+     * Deduplicated by run id, so the diamond the edge set permits is visited
+     * once and a (rejected, but defensively handled) cycle terminates. Work and
+     * memory are bounded by the finite durable edge set; there is deliberately
+     * no arbitrary fan-out cap, because truncating a wide generation would
+     * leave linked children uncancelled forever.
+     */
+    const descendantsOf = lifecycle.descendants;
+    /**
+     * Records a durable cancellation request against every linked descendant
+     * of a cancelled run.
+     *
+     * `requestCancel` is unfenced and first-writer-wins, so this is idempotent
+     * by construction: re-running the cascade — a re-drive, a second operator
+     * cancel, a child that also cascades from its own cancellation — writes
+     * nothing the second time and answers `AlreadyRequested`. A row that no
+     * longer exists answers `NotFound`, which is equally fine.
+     *
+     * `cancelOwned` calls it inside the same transaction as the parent's
+     * terminal `cancelled` transition, so a crash cannot commit a cancelled
+     * parent whose children were never asked to stop.
+     *
+     * Both callers record the run's OWN cancellation BEFORE this walk —
+     * `interrupt` writes the request, `cancelOwned` commits the terminal
+     * `cancelled` transition — and that order is load-bearing rather than
+     * incidental. A late admission inherits by reading the parent row after it
+     * has created the child row (`inheritParentCancellation`), so a walk that
+     * ran before the parent was marked could miss an edge whose admission also
+     * missed the mark. Both the SQL engine state and
+     * `DurableEngineState.makeMemory` serialize their transactions. The memory
+     * implementation snapshots and restores its maps on failure; the shared
+     * writer transaction supplies the run-store write boundary. The ordering
+     * also lets a child admitted within the cascade inherit cancellation.
+     */
+    const requestCancelDescendants = (runId, nowMs) => Effect.gen(function* () {
+        const descendants = yield* descendantsOf(runId);
+        yield* Effect.forEach(descendants, (childId) => requestCancellation(childId, nowMs), { discard: true });
+        return descendants;
+    });
+    /** The exit policy a child recorded for itself when it was spawned. */
+    const exitPolicyOf = (row) => decodeState(row.stateJson).pipe(
+    // A row written before the policy existed, or created outside
+    // `ensureRun` (a seeded edge, an external admission), names none. It
+    // is a LINKED child either way, and the contract for a linked child is
+    // that it ends with the run it belongs to; `detach` is the deliberate
+    // exception and has to be recorded to hold.
+    Effect.map((state) => state.onParentExit ?? "cancel"));
+    /**
+     * Applies the per-child exit policy when a run ends on its own terms.
+     *
+     * Cancellation is not this path. A cancelled run cascades to every linked
+     * descendant unconditionally (`requestCancelDescendants`): an operator who
+     * cancels a run is asking for the subtree to stop, and a child cannot opt
+     * out of that. What this closes is the other half — a parent that
+     * COMPLETED or FAILED used to leave every linked child running, so a
+     * `.child()` boundary whose parent died on an unrelated branch left a
+     * durable orphan nothing would ever wait for or cancel.
+     *
+     * Three shapes are left alone, and each for its own reason:
+     *
+     * - A child that recorded `detach` was spawned fire-and-forget. Outliving
+     *   the parent is the whole point, so it is reported, not touched, and its
+     *   own subtree is not walked — those runs hang off a run that is still
+     *   going.
+     * - A child that already settled has nothing to cancel, and it applied
+     *   this same policy to its own children when it settled.
+     * - A child whose row is gone leaves only an edge.
+     *
+     * The requests are written by the caller's transaction — the parent's
+     * terminal compare-and-swap — so a crash cannot commit a completed parent
+     * whose children were never asked to stop.
+     */
+    const endLinkedChildren = (runId, nowMs) => Effect.gen(function* () {
+        const roots = (yield* lifecycle.rounds(runId)).map((row) => row.runId);
+        const seen = new Set(roots);
+        const cancelled = [];
+        const detached = [];
+        let frontier = roots;
+        while (frontier.length > 0) {
+            const next = [];
+            for (const parentId of frontier) {
+                for (const edge of yield* engineState.runChildren(parentId)) {
+                    if (seen.has(edge.childId))
+                        continue;
+                    const rounds = yield* lifecycle.rounds(edge.childId);
+                    for (const round of rounds)
+                        seen.add(round.runId);
+                    seen.add(edge.childId);
+                    const row = rounds.find((round) => round.status !== "completed" && round.status !== "failed" && round.status !== "cancelled");
+                    if (row === undefined)
+                        continue;
+                    // The edge belongs to the creating round. Its ownership policy
+                    // survives the child's handoffs; do not infer it from a later
+                    // round written by a version that omitted onParentExit.
+                    // A nonempty lineage read includes its requested member.
+                    if ((yield* exitPolicyOf(rounds.find((round) => round.runId === edge.childId))) === "detach") {
+                        detached.push(edge.childId);
+                        continue;
+                    }
+                    for (const round of rounds) {
+                        if (round.status !== "completed" && round.status !== "failed" && round.status !== "cancelled") {
+                            cancelled.push(round.runId);
+                        }
+                        next.push(round.runId);
+                    }
+                }
+            }
+            frontier = next;
+        }
+        yield* Effect.forEach(cancelled, (childId) => requestCancellation(childId, nowMs), { discard: true });
+        return { cancelled, detached };
+    });
+    /**
+     * The effect a terminal transition runs inside its own transaction to end
+     * the children it is responsible for, journaling what it decided.
+     *
+     * The record is emitted only when there was a linked child to decide
+     * about, so an ordinary childless run adds nothing to its journal.
+     */
+    const applyChildExitPolicy = (runId) => Effect.gen(function* () {
+        const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+        const outcome = yield* endLinkedChildren(runId, nowMs).pipe(Effect.orDie);
+        if (outcome.cancelled.length === 0 && outcome.detached.length === 0)
+            return;
+        yield* emitDecision(runId, {
+            decision: "child-policy-applied",
+            appliedAtMs: nowMs,
+            cancelled: outcome.cancelled,
+            detached: outcome.detached
+        });
+    });
+    /**
+     * Carries a parent's durable cancellation onto a child that was linked
+     * AFTER the parent's cascade had already run.
+     *
+     * Admission and cancellation are two separate serialized write
+     * transactions over the same store, so they interleave in both orders and
+     * neither order may leak a live child (issue #83):
+     *
+     * - Admission first. The edge is committed before the cancellation
+     *   transaction opens, so `requestCancelDescendants` sees the child and
+     *   requests it. Nothing more is needed here.
+     * - Cancellation first. The cascade walked `flows_run_parents` while the
+     *   edge did not exist yet, so it could not have seen this child — and
+     *   the parent's drive may already be gone, so nothing will walk the
+     *   edge table again on its behalf. The child would be created fresh and
+     *   uncancelled, and would run to completion under a cancelled parent.
+     *
+     * The second order is closed by reading the parent row inside the SAME
+     * outer storage transaction that recorded the edge and created the child
+     * row, after the child row exists. Either the cancellation transaction
+     * committed before this read, in which case the request is visible here
+     * and is inherited atomically with the child's own creation, or it has
+     * not committed yet, in which case it commits after this transaction and
+     * its own cascade sees the edge. There is no third interleaving, so no
+     * ephemeral hand-off flag and no timing-based retry is involved. The
+     * argument rests on the store's serialized writes and the order inside
+     * `requestCancelDescendants`: a cancellation marks its own run before it
+     * walks the edge table. Memory durable-state transactions also serialize
+     * access and restore their snapshots on failure; they do not provide
+     * persistence across process crashes.
+     *
+     * Nesting falls out of this: the inherited request is written to the
+     * child's own row, so a grandchild admitted later reads a cancel-requested
+     * parent and inherits in turn.
+     *
+     * `requestCancel` is unfenced and first-writer-wins, so a repeated
+     * admission writes nothing the second time; a parent row that is gone,
+     * or one with no rounds at all, inherits nothing. Both ways a parent can
+     * exit are inherited here, and they differ in whether the child's own
+     * `onParentExit` can spare it. An explicit cancellation in ANY round is
+     * inherited unconditionally, whether it is a pending
+     * `cancel_requested_at_ms` or a round already settled terminally
+     * `cancelled` whose request column a compaction could have cleared. A
+     * parent that instead stopped normally, with EVERY round `completed` or
+     * `failed`, cancels a late child that was admitted attached and leaves an
+     * `onParentExit === "detach"` child to outlive it.
+     *
+     * The child does not need its own cascade here: it was just created, so
+     * it has no descendants of its own, and once it observes the inherited
+     * request `cancelOwned` cascades from it like any other cancellation.
+     */
+    const inheritParentCancellation = (parentId, childId) => Effect.gen(function* () {
+        const rounds = yield* lifecycle.rounds(parentId).pipe(Effect.orDie);
+        if (rounds.length === 0)
+            return;
+        const cancelled = rounds.find((round) => round.cancelRequestedAtMs !== null || round.status === "cancelled");
+        if (cancelled !== undefined) {
+            // The parent's own request timestamp, so the inherited request reads
+            // as the same operator intent rather than as a later, independent one.
+            const nowMs = cancelled.cancelRequestedAtMs ?? (yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor)));
+            yield* requestCancellation(childId, nowMs).pipe(Effect.orDie);
+            return;
+        }
+        // The same interleaving, for the other way a parent stops: a parent
+        // that had already COMPLETED or FAILED ran `applyChildExitPolicy`
+        // before this edge existed, so its walk could not have seen this
+        // child and nothing will walk again on its behalf. The child applies
+        // its own recorded policy here instead, in the transaction that made
+        // it a child, so an attached child admitted a moment too late cannot
+        // run on under a parent that is already gone.
+        if (rounds.some((round) => round.status !== "completed" && round.status !== "failed"))
+            return;
+        // Admission reads the child's recorded policy in this transaction.
+        // A later caller awaiting a detached execution cannot change the
+        // policy chosen by its original spawn.
+        if ((yield* exitPolicyOf(yield* store.get(childId).pipe(Effect.orDie))) === "detach") {
+            return;
+        }
+        yield* requestCancellation(childId, yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor))).pipe(Effect.orDie);
+    });
+    const cancelOwned = (runId, state) => Effect.gen(function* () {
+        const interruptedAtMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+        const stateJson = yield* encodeState({
+            ...withoutResult(state),
+            cancellation: { interruptedAtMs }
+        });
+        let cascaded = [];
+        let settled = false;
+        yield* transactState(Effect.gen(function* () {
+            yield* store.acknowledgeCancel(runId, dependencies.owner, interruptedAtMs).pipe(Effect.orDie);
+            const transitioned = yield* store.transitionOwned(runId, dependencies.owner, "cancelled", stateJson).pipe(Effect.orDie);
+            if (transitioned._tag !== "Transitioned")
+                return;
+            settled = true;
+            // Cancellation cascades to linked children (`Flow.interrupt` is
+            // documented to preserve "child-flow handling"). It is recorded
+            // durably, in this transaction, off the durable edge table, so the
+            // cascade is identical whether the cancellation was requested in
+            // this process or observed from another one — the pre-existing
+            // in-process linkage in `FlowEngine.make` fires off the ephemeral
+            // `instance.interrupted` flag, which a durable observation never
+            // sets and a second driver instance never has.
+            cascaded = yield* requestCancelDescendants(runId, interruptedAtMs);
+            // The run has no future, so neither do its timers. Completing the
+            // clock rows in this transaction is what stops a durable timer
+            // from outliving the run it belongs to: the sweep queries already
+            // skip a settled run's rows, and this stops them being pending at
+            // all — including under an in-memory state with no run view to
+            // join against.
+            yield* completeRunClocks(runId, interruptedAtMs);
+            // A cancel can race the final poll after the run already parked
+            // (park precedes the guarded terminal CAS). Clear the waiting row so
+            // the terminally cancelled run never surfaces to a sweeper again
+            // (issue #28). It shares the transition's transaction, so a crash
+            // can no longer land between them.
+            yield* engineState.wake(runId).pipe(Effect.asVoid);
+            // Durable channel (issue #10): the interruption record must survive
+            // the process exiting right after cancellation. Unfenced because the
+            // `cancelled` transition above has already released ownership; the
+            // fence is the transition CAS itself, which now commits with this
+            // record rather than before it.
+            yield* journal.emitDurableUnfenced(JournalRecords.interrupted({
+                runId,
+                lineageId: FlowEngine.Lineage.root(runId),
+                sourceId: dependencies.journalSource
+            }, {
+                outcome: "cancelled",
+                interruptedAtMs,
+                owner: dependencies.owner,
+                executionFact: yield* executionFacts.fact(runId),
+                ...(cascaded.length === 0 ? {} : { cascadedTo: cascaded })
+            })).pipe(Effect.orDie);
+        })).pipe(Effect.orDie);
+        // Post-commit, and only reachable after a transition that actually
+        // happened. Closing the parked flow scope runs the finalizers the
+        // suspension retained, with an interrupt exit so `Flow.withRollback`
+        // compensations fire — cancellation is exactly the unsuccessful exit
+        // they exist for. The run is durably cancelled first, so a crash
+        // inside a finalizer cannot resurrect it.
+        yield* releaseRetainedScope(runId, Exit.failCause(Cause.interrupt()));
+        // Waking a cascaded child is in-process scheduling: a child this
+        // process owns or has parked re-enters claim/activate now and the
+        // activation cancel guard closes it, instead of waiting out a poll
+        // interval. A child owned elsewhere ignores the wake and is reached by
+        // its own owner's cancel poll or by that owner's parked-run sweep.
+        if (cascaded.length > 0) {
+            const activeCoordinator = yield* Deferred.await(coordinatorDeferred);
+            yield* Effect.forEach(cascaded, (childId) => activeCoordinator.wake(childId), { discard: true });
+        }
+        // A cancelled round is a terminal settlement like a completed or
+        // failed one, so every parent already parked on it — through any round
+        // of its lineage — is woken to read the cancellation (#2758). Only
+        // after the transition this call committed: a lost fence woke nobody.
+        if (settled) {
+            yield* announceSettled(runId, state);
+        }
+    });
+    /**
+     * Releases an interrupted run reclaimably instead of closing it
+     * (issue #26). A drive-fiber interruption is not evidence of operator
+     * cancellation — process shutdown closes the coordinator scope, and the
+     * heartbeat loop self-interrupts on any heartbeat error — so the run
+     * transitions back to `suspended` while the fence is still validly held,
+     * leaving it claimable by any worker (Temporal worker-shutdown
+     * semantics). On genuine fence loss the owned transition fails
+     * harmlessly.
+     */
+    /**
+     * The waiting reason an interrupted round parks under.
+     *
+     * A flow that has ALREADY asked to suspend is parked, not released. The
+     * round's own settlement derives the same three answers a few statements
+     * later ({@link drive}'s `settleRound`), and losing the race to a
+     * shutdown must not lose the classification with it: a `released` row
+     * carries no wake time and no token, so a run that suspended on a
+     * 150-second clock came back as a run whose owner merely went away, and
+     * the sweeper had to re-drive it blind instead of waking it when its
+     * deadline fell due (release rehearsal).
+     *
+     * A flow that has NOT asked to suspend is a genuine shutdown or heartbeat
+     * self-interrupt, and `released` is exactly what it is (issue #39).
+     */
+    const interruptedWaiting = (runId, instance) => Effect.gen(function* () {
+        if (instance === undefined || !instance.suspended)
+            return { reason: "released" };
+        const declared = instance.waiting;
+        if (declared !== undefined)
+            return declared;
+        const pendingClocks = yield* engineState.pendingClocks({ executionId: runId });
+        return pendingClocks.length > 0
+            ? {
+                reason: "timer",
+                wakeAt: Math.min(...pendingClocks.map((clock) => clock.dueAtMs))
+            }
+            : { reason: "event" };
+    });
+    const releaseOwned = (runId, state, cause, round) => Effect.gen(function* () {
+        // Park atomically with releasing ownership (`park` is owner-fenced). The
+        // durable waiting row is what makes a released run visible to the
+        // parked-run sweeper: without it nothing ever re-drives the run and
+        // a durable `requestCancel` against it is write-only forever
+        // (issue #39). On genuine fence loss the park reports NotFound
+        // harmlessly, exactly like the transition below.
+        const waiting = yield* interruptedWaiting(runId, round?.instance);
+        // A run whose flow asked to suspend carries the suspension on its row,
+        // exactly as the round's own settlement writes it. `poll` publishes a
+        // state with no `result` as "not settled yet", so a park recorded
+        // without one was invisible to every resumer: `AgentSession`'s
+        // `awaitParked` polls `poll` and answers `unknown` for anything but a
+        // published `Suspended`, so `smithers approve` and `smithers run
+        // --resume` accepted the request and then drove nothing in the release rehearsal.
+        const suspension = round !== undefined && waiting.reason !== "released"
+            ? (yield* encodeResult(round.flow, new Flow.Suspended({ cause: round.instance.cause }))).encoded
+            : undefined;
+        yield* transitionAndRecord(runId, "suspended", yield* encodeState(suspension === undefined
+            ? withoutResult(state)
+            : { ...withoutResult(state), result: suspension }), 
+        // Why the run was released (#3328): an operator reading a parked run
+        // must be able to tell a lapsed lease on a live host from a shutdown.
+        { decision: "interrupt-released", owner: dependencies.owner, cause }, undefined, undefined, waiting);
+    });
+    /**
+     * Discriminates an interruption cause by durable state: only an
+     * interruption backed by a recorded cancel request closes the run;
+     * anything else releases it for reclaim (issue #26), under the waiting
+     * reason the flow had already declared for itself when it has one.
+     */
+    const settleInterrupted = (runId, state, cause, round) => store.get(runId).pipe(Effect.flatMap((row) => {
+        // Shutdown can arrive after the claim CAS but before activation, or
+        // after activation but before/after the execution race. Release only
+        // this incarnation's persisted fence; a settled or foreign row stays
+        // untouched, including its waiting reason.
+        if (row.claim !== null && row.claimedAtMs !== null && sameOwner(row.claim, dependencies.owner)) {
+            return abandon(runId, row.claimedAtMs);
+        }
+        if (row.status !== "running" || row.owner === null || !sameOwner(row.owner, dependencies.owner)) {
+            return Effect.void;
+        }
+        return row.cancelRequestedAtMs !== null ? cancelOwned(runId, state) : releaseOwned(runId, state, cause, round);
+    }), Effect.catch((error) => error.code === "not_found_row" ? Effect.void : Effect.die(error)));
+    /**
+     * Encodes a settlement for the row, and never fails.
+     *
+     * The encode used to be guarded with `Effect.orDie`, which made a
+     * settlement the flow's own codec rejects fatal for the drain rather than
+     * terminal for the run. `agent/run` declares both channels
+     * `Schema.Unknown`, so every `Data.TaggedError` an agent body fails with
+     * is such a settlement, and the release validation watched the whole
+     * chain: the drain died with `SchemaError: Expected JSON value at
+     * ["exit"]["cause"][0]["error"]`, `engine.db` kept the run `running`
+     * under a pid that had exited while `control.db` said `failed`, and the
+     * next process's stale-running sweep stole the row and billed the
+     * provider seat a second time. `ExitEncoding.encode` fails closed
+     * instead: on rejection it answers a JSON projection of the settlement
+     * and a `note`, and a noted settlement is written `failed`.
+     */
+    const encodeResult = (flow, result) => ExitEncoding.encode(flow, result);
+    /**
+     * Re-encodes a handoff payload through the target flow's own codec, so the
+     * bytes the next round's row holds are the bytes `ensureRun` would write
+     * for the same invocation.
+     */
+    const normalizePayload = (flow, payload) => {
+        const codec = Schema.toCodecJson(flow.payloadSchema);
+        return Schema.decodeUnknownEffect(codec)(payload).pipe(Effect.orDie, Effect.flatMap((decoded) => Schema.encodeEffect(codec)(decoded)), Effect.orDie);
+    };
+    /**
+     * Creates one run row, tolerating only an existing row with identical
+     * execution identity and encoded invocation data.
+     */
+    const ensureCreatedRun = (options) => Effect.gen(function* () {
+        const created = yield* store.create(options.executionId, options.stateJson, {
+            ...(options.parentRunId === undefined ? {} : { parentRunId: options.parentRunId }),
+            lineageId: options.lineageId,
+            roundOrdinal: options.roundOrdinal
+        }).pipe(Effect.exit);
+        if (Exit.isSuccess(created)) {
+            return yield* options.onCreated;
+        }
+        // A cause carrying no `Fail` reason — an interrupt-only cause, or a
+        // bare defect — used to reach `Option.getOrThrow(Exit.findErrorOption(...))`,
+        // which threw a raw `NoSuchElementError` defect and discarded the
+        // original cause. A caller that interrupted the fiber while
+        // `store.create` was inside its write transaction saw a crash rather
+        // than the cancellation it asked for. `Cause.findFail` hands back
+        // that residual cause typed `Cause<never>`, so re-raising it verbatim
+        // keeps an interrupt an interrupt (issue #151).
+        const failure = Cause.findFail(created.cause);
+        if (Result.isFailure(failure)) {
+            return yield* Effect.failCause(failure.failure);
+        }
+        const error = failure.success.error;
+        if (!(error instanceof RunStore.RunStoreError) || error.code !== "constraint") {
+            return yield* Effect.die(error);
+        }
+        const existing = yield* store.get(options.executionId).pipe(Effect.orDie);
+        const persisted = yield* decodeState(existing.stateJson);
+        const sameParent = options.parentRunId === undefined ||
+            existing.parentRunId === options.parentRunId;
+        const conflict = persisted.flowName !== options.flowName
+            ? {
+                field: "flow",
+                expected: persisted.flowName,
+                actual: options.flowName
+            }
+            : !samePayload(persisted.payload, options.payload)
+                ? {
+                    field: "payload",
+                    expected: "the encoded payload the execution was admitted with",
+                    actual: "a different encoded payload"
+                }
+                : !FlowEngine.joinable(
+                // A row with no persisted authority ran unrestricted, and is
+                // refused further dispatch; only an unrestricted caller joins it.
+                persisted.capabilityCeilings ?? [], options.capabilityCeilings)
+                    ? {
+                        // A join answers the result the admitted authority produced.
+                        field: "capabilities",
+                        expected: "a capability ceiling covering the one the execution was admitted with",
+                        actual: "a capability ceiling that does not cover it"
+                    }
+                    : existing.lineageId !== options.lineageId
+                        ? {
+                            field: "lineage",
+                            expected: existing.lineageId ?? "no lineage",
+                            actual: options.lineageId
+                        }
+                        : existing.roundOrdinal !== options.roundOrdinal
+                            ? {
+                                field: "round",
+                                expected: String(existing.roundOrdinal),
+                                actual: String(options.roundOrdinal)
+                            }
+                            : !sameParent
+                                ? {
+                                    field: "parent",
+                                    expected: existing.parentRunId ?? "no parent",
+                                    // `!sameParent` implies the requested parent is present: an
+                                    // omitted parent is deliberately compatible with any persisted
+                                    // parent when joining an already-created root.
+                                    actual: options.parentRunId
+                                }
+                                : undefined;
+        if (conflict !== undefined) {
+            return yield* Effect.die(new FlowEngine.ExecutionIdentityConflict({
+                executionId: options.executionId,
+                status: existing.status,
+                ...conflict,
+                message: `execution ${options.executionId} already belongs to ${conflict.field} identity ` +
+                    `${conflict.expected}; it cannot be reused for ${conflict.actual}`
+            }));
+        }
+    });
+    const coordinatorDeferred = yield* Deferred.make();
+    /**
+     * Observes a durably recorded cancellation request
+     * (`RunStore.requestCancel` / `cancel_requested_at_ms`) from another
+     * process. Polls on the heartbeat cadence — the request is unfenced, so
+     * only the owner can act on it, and it must act within a poll interval
+     * (issue #11). Completes when a request is observed; races against the
+     * flow like the heartbeat loop.
+     */
+    const cancelPollLoop = (executionId) => Effect.gen(function* () {
+        // Check-first: a request that raced in just before activation is
+        // observed without waiting out a full heartbeat (issue #27).
+        while (true) {
+            const requested = yield* store.get(executionId).pipe(Effect.map((row) => row.cancelRequestedAtMs !== null), Effect.catch(() => Effect.succeed(false)));
+            if (requested) {
+                yield* store.acknowledgeCancel(executionId, dependencies.owner, yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor))).pipe(Effect.orDie);
+                return cancelRequested;
+            }
+            yield* Effect.sleep(Ownership.heartbeatInterval);
+        }
+    });
+    /**
+     * Opens the next round, and closes this one, in ONE transaction.
+     *
+     * `ensureRun`'s parent-edge/run-row pairing (issue #80) is the precedent
+     * and the reason: a crash between the two writes would leave a terminal
+     * round whose successor was never created, and nothing would ever look for
+     * it again — the lineage would end silently at a round that says it handed
+     * off. The stores' own writes become savepoints of this transaction, so
+     * either both commit or neither.
+     *
+     * The next round is a run row chained through the RESERVED
+     * `parent_run_id` column, not a `flows_run_parents` edge: that table is
+     * the subflow DAG cycle detection walks, and a round is the same run
+     * continuing rather than a child being spawned
+     * (`packages/smithers/flows/engine/docs/concepts/trampoline-rounds.md`).
+     */
+    const continueLineage = (seam, advanced) => Effect.gen(function* () {
+        // The handoff payload travels encoded, and the next round's row has to
+        // hold the same value `ensureRun` would write for it: the root caller
+        // re-enters `execute` for this round, and its identical-create check
+        // compares encoded payloads structurally, so object key order cannot
+        // separate two encodings of the same value. The execution id itself
+        // uses canonical RFC 8785 JSON, so the identity and payload checks
+        // agree by construction.
+        //
+        // A target this process does not run has no codec to normalize
+        // through, and the round is still created with the payload verbatim —
+        // the same posture the wake path takes for an unregistered flow, and
+        // the reason a lineage survives a worker that only knows some of its
+        // legs.
+        const target = registrations.get(seam.handoff.flow)?.at(-1);
+        const payload = target === undefined
+            ? seam.handoff.payload
+            : yield* normalizePayload(target.flow, seam.handoff.payload);
+        const nextCeilings = [
+            // The execution guard rejects missing persisted authority before a handler can hand off.
+            ...seam.state.capabilityCeilings,
+            ...(seam.handoff.capabilityCeilings ?? [[]]),
+            // The successor records its own declaration, as admission would, so
+            // a later join compares against the authority it actually runs
+            // under. A target this process does not run has none here; the root
+            // caller's re-entry then carries a declaration the row lacks and is
+            // refused rather than trusted.
+            ...(target === undefined
+                ? []
+                : Flow.parseCapabilityCeilings(Flow.capabilityCeilings(target.flow.annotations)))
+        ];
+        const nextStateJson = yield* encodeState({
+            version: 1,
+            flowName: seam.handoff.flow,
+            payload,
+            capabilityCeilings: nextCeilings,
+            ...(seam.state.parentExecutionId === undefined
+                ? {}
+                : { parentExecutionId: seam.state.parentExecutionId }),
+            ...(seam.state.onParentExit === undefined ? {} : { onParentExit: seam.state.onParentExit }),
+            ...(seam.state.maxRounds === undefined ? {} : { maxRounds: seam.state.maxRounds }),
+            ...(seam.handoff.deadline === undefined ? {} : { deadline: seam.handoff.deadline })
+        });
+        const settledStateJson = yield* encodeState({
+            ...seam.state,
+            result: (yield* encodeResult(seam.flow, seam.handoff)).encoded
+        });
+        const cancelled = { _tag: "HandoffCancelled" };
+        const fenceLost = { _tag: "HandoffFenceLost" };
+        const committed = yield* Effect.result(transactState(Effect.gen(function* () {
+            // The next round's id is DERIVED from (lineage, ordinal), so a
+            // re-drive finds the exact row it already opened. Only an
+            // identical create is tolerated; a collision in flow, payload,
+            // parent, lineage, or ordinal is a defect.
+            yield* ensureCreatedRun({
+                flowName: seam.handoff.flow,
+                executionId: advanced.executionId,
+                stateJson: nextStateJson,
+                payload,
+                lineageId: advanced.round.rootExecutionId,
+                roundOrdinal: advanced.round.ordinal,
+                parentRunId: seam.executionId,
+                capabilityCeilings: nextCeilings,
+                onCreated: emitDecision(advanced.executionId, {
+                    decision: "created",
+                    state: JSON.parse(nextStateJson),
+                    lineageId: advanced.round.rootExecutionId,
+                    roundOrdinal: advanced.round.ordinal,
+                    parentExecutionId: seam.executionId
+                })
+            });
+            // DECIDED (2026-08-11, pending review): a handed-off round settles
+            // `completed`. The round did finish, and adding a `Continued`
+            // status would widen every status reader for a distinction the
+            // `handed-off` decision and lineage columns already record.
+            //
+            // DECIDED (2026-08-11, pending review): cancellation guards the
+            // handoff transition. If it raced the last poll, failing the outer
+            // transaction rolls successor creation back before the ordinary
+            // cancellation path closes the owned round.
+            const transitioned = yield* transitionAndRecord(seam.executionId, "completed", settledStateJson, {
+                decision: "handed-off",
+                status: "completed",
+                flow: seam.handoff.flow,
+                lineageId: advanced.round.rootExecutionId,
+                roundOrdinal: advanced.round.ordinal,
+                nextExecutionId: advanced.executionId,
+                owner: dependencies.owner
+            }, { cancelRequested: "absent" });
+            if (transitioned._tag === "Transitioned")
+                return;
+            return yield* Effect.fail(transitioned._tag === "GuardFailed" ? cancelled : fenceLost);
+        })).pipe(Effect.catchTag("@smthrs/journal/JournalError", Effect.die)));
+        if (Result.isFailure(committed)) {
+            if (committed.failure._tag === "HandoffCancelled") {
+                yield* cancelOwned(seam.executionId, seam.state);
+            }
+            return;
+        }
+        // The root caller follows the lineage itself, but a discarded (or
+        // orphaned) one does not exist to follow it, so the successor is woken
+        // here rather than left for a sweep that has no reason to look at it.
+        const activeCoordinator = yield* Deferred.await(coordinatorDeferred);
+        yield* activeCoordinator.wake(advanced.executionId);
+    });
+    /**
+     * Announces a committed terminal settlement: to any in-process caller
+     * parked on this run's poll loop, and to every parent attached to the
+     * logical run, which is runnable now. That wake is the only thing that
+     * says so: a child settlement never passes through `scheduleResume`.
+     *
+     * A diamond's second parent lives only in its durable edge (issue #2500),
+     * and `ensureRun` records an edge under the round the parent joined, so
+     * the edges are gathered from every round of the lineage, deduplicated
+     * with the creating parent `state_json` carries. Each is recorded for the
+     * same reason `scheduleResume` records: the round this wake schedules is
+     * the one a host's park guard has to recognize.
+     */
+    const announceSettled = (executionId, state) => Effect.gen(function* () {
+        yield* wakeBus.wake(executionId);
+        const parents = new Set();
+        if (state.parentExecutionId !== undefined)
+            parents.add(state.parentExecutionId);
+        const rounds = yield* lifecycle.rounds(executionId).pipe(Effect.orDie);
+        for (const roundId of new Set([executionId, ...rounds.map((round) => round.runId)])) {
+            for (const edge of yield* engineState.runParents(roundId))
+                parents.add(edge.parentId);
+        }
+        if (parents.size === 0)
+            return;
+        const activeCoordinator = yield* Deferred.await(coordinatorDeferred);
+        for (const parentId of parents) {
+            yield* recordParentResume(parentId);
+            yield* activeCoordinator.wake(parentId);
+            yield* wakeBus.wake(parentId);
+        }
+    });
+    /**
+     * Ends a lineage that asked for one round past its declared budget.
+     *
+     * The round itself ran to completion; what is refused is the handoff, so
+     * the round settles `failed` carrying the typed refusal and no successor
+     * is created (`packages/smithers/flows/engine/docs/concepts/trampoline-rounds.md`).
+     */
+    const endLineage = (seam, error) => Effect.gen(function* () {
+        const stateJson = yield* encodeState({
+            ...seam.state,
+            result: (yield* encodeResult(seam.flow, new Flow.Complete({ exit: Exit.die(error) }))).encoded
+        });
+        const transitioned = yield* transitionAndRecord(seam.executionId, "failed", stateJson, {
+            decision: "lineage-exhausted",
+            status: "failed",
+            lineageId: error.lineageId,
+            maxRounds: error.maxRounds,
+            owner: dependencies.owner
+        }, { cancelRequested: "absent" }, 
+        // The lineage is over, not continuing: this round is the last one,
+        // so it ends its children like any other terminal exit. A round that
+        // HANDS OFF settles through `continueLineage` instead and deliberately
+        // does not, because the lineage — and therefore the parent the
+        // children are linked to — carries on.
+        applyChildExitPolicy(seam.executionId));
+        if (transitioned._tag === "GuardFailed") {
+            yield* cancelOwned(seam.executionId, seam.state);
+        }
+        else if (transitioned._tag === "Transitioned") {
+            yield* announceSettled(seam.executionId, seam.state);
+        }
+    });
+    /** Fails a run whose persisted round identity or budget is malformed. */
+    const endInvalidRound = (seam, error) => Effect.gen(function* () {
+        const stateJson = yield* encodeState({
+            ...seam.state,
+            result: (yield* encodeResult(seam.flow, new Flow.Complete({ exit: Exit.die(error) }))).encoded
+        });
+        const transitioned = yield* transitionAndRecord(seam.executionId, "failed", stateJson, {
+            decision: "round-invalid",
+            status: "failed",
+            message: error.message,
+            owner: dependencies.owner
+        }, { cancelRequested: "absent" }, applyChildExitPolicy(seam.executionId));
+        if (transitioned._tag === "GuardFailed") {
+            yield* cancelOwned(seam.executionId, seam.state);
+        }
+        else if (transitioned._tag === "Transitioned") {
+            yield* announceSettled(seam.executionId, seam.state);
+        }
+    });
+    /**
+     * The handoff seam: the one place a round's terminal settlement and its
+     * successor are decided together.
+     */
+    const handOff = (seam) => FlowEngine.Round.next({
+        // The row's lineage_id was written from a round's rootExecutionId,
+        // so this rehydrates the brand; `Round.next` still validates it.
+        rootExecutionId: seam.row.lineageId,
+        ordinal: seam.row.roundOrdinal
+    }, 
+    // The origin persisted its budget into every round's state, so a
+    // multi-flow handoff cannot reset the lineage by changing targets.
+    { flowName: seam.flow._tag, maxRounds: seam.state.maxRounds }).pipe(Effect.flatMap((advanced) => continueLineage(seam, advanced)), Effect.catch((error) => error instanceof FlowEngine.Round.InvalidRound
+        ? endInvalidRound(seam, error)
+        : endLineage(seam, error)));
+    const drive = (executionId) => Effect.suspend(() => {
+        let interruptState;
+        let round;
+        let durableParkAccepted = false;
+        // Set by the heartbeat loop when this round's lease lapses, so the
+        // release it causes records why (#3328).
+        let lapsedMs;
+        return Effect.gen(function* () {
+            const initial = yield* store.get(executionId).pipe(Effect.catch((error) => error.code === "not_found_row"
+                ? Effect.succeed(undefined)
+                : Effect.die(error)));
+            if (initial === undefined)
+                return;
+            const state = yield* decodeState(initial.stateJson);
+            interruptState = state;
+            const registration = registrations.get(state.flowName)?.at(-1);
+            if (registration === undefined) {
+                // A coalesced wake can outlive terminal settlement. There is no
+                // parked work left for a handler to reclaim.
+                if (initial.status === "cancelled" || initial.status === "completed" || initial.status === "failed")
+                    return;
+                // Cancelling needs no handler. A parked run whose cancellation was
+                // durably requested used to be dropped here with everything else,
+                // and nothing else could ever reach it: the sweep woke the row every
+                // heartbeat and every wake bailed at this line, so a cancel written
+                // by a control-only process — the operator CLI, a second engine that
+                // registers other flows — stayed write-only forever while the run's
+                // linked children kept going. The terminal transition, the cascade
+                // over the durable edge table, and the interruption record are all
+                // written from the run ROW, so a process that could never execute
+                // this flow can still close it. Claiming first is what makes the
+                // close fenced: `cancelOwned` is owner-fenced, so exactly one of the
+                // sweeping processes wins and the rest see a lost CAS.
+                //
+                // `running` is here for the same reason `suspended` is. The row a
+                // hard-killed owner leaves behind is `running` with a frozen
+                // heartbeat and no waiting row, so the stale-running sweep is the
+                // only thing that reaches it, and it arrives through this same
+                // function: without this arm a control-only process could close a
+                // PARKED run of an unregistered flow and not a hard-killed one,
+                // though the two closes are the identical durable write. Nothing is
+                // weakened by admitting it, because the arbitration is
+                // `claimAndActivate`'s and not this guard's: a fresh lease or a live
+                // owner refuses the takeover and the run is left exactly as it was.
+                if ((initial.status === "pending" || initial.status === "suspended" || initial.status === "running") &&
+                    initial.cancelRequestedAtMs !== null) {
+                    if (!(yield* claimAndActivate(initial))) {
+                        return;
+                    }
+                    return yield* cancelOwned(executionId, withoutResult(state));
+                }
+                // A wake for a flow this process has not registered — after a full
+                // restart the sweep re-drives released rows before (or without)
+                // the flow ever registering here. Dropping the wake silently made
+                // the #39 reclaim guarantee invisibly conditional on registration
+                // (issue #62): warn (once per run, the sweep retries every
+                // heartbeat) and leave the durable waiting row untouched so any
+                // process that does register the flow still reclaims the run.
+                if (!warnedUnregistered.has(executionId)) {
+                    warnedUnregistered.add(executionId);
+                    yield* Effect.logWarning(`engine-store: run ${executionId} woke for flow ${state.flowName}, which is not registered in this process; leaving it parked for a worker that registers the flow`, { runId: executionId, flowName: state.flowName });
+                }
+                return;
+            }
+            if (!(yield* claimAndActivate(initial))) {
+                return;
+            }
+            yield* Effect.logDebug("run activated", { flowName: state.flowName });
+            const activeState = withoutResult(state);
+            // The activation transition carries the cancel guard: a run whose
+            // cancellation was durably requested while it was parked must cancel
+            // here instead of re-executing flow side effects (issue #27).
+            const cleared = yield* transitionAndRecord(executionId, "running", yield* encodeState(activeState), { decision: "resumed", status: "running" }, { cancelRequested: "absent" }, undefined, null);
+            if (cleared._tag === "GuardFailed") {
+                return yield* cancelOwned(executionId, withoutResult(state));
+            }
+            if (cleared._tag !== "Transitioned")
+                return;
+            const payload = yield* Schema.decodeUnknownEffect(Schema.toCodecJson(registration.flow.payloadSchema))(activeState.payload).pipe(Effect.orDie);
+            // A previous round of this run may have parked and retained its flow
+            // scope. That instance is now superseded — this round runs under the
+            // fresh instance below, with a scope of its own — so release the old
+            // one instead of orphaning it. `Exit.void`: a re-drive is a successful
+            // continuation, so ordinary finalizers release resources while
+            // `Flow.withRollback` compensations correctly stay out.
+            yield* releaseRetainedScope(executionId, Exit.void);
+            const instance = FlowEngine.makeInstance(registration.flow, executionId, activeState.deadline);
+            round = { flow: registration.flow, instance };
+            const flowEngine = yield* dependencies.engine;
+            // ONE cleanup region, registered before the race starts and spanning
+            // everything that can retain a scope or make its park durable: the
+            // suspension surfacing, the retention insertion in the race's exit,
+            // `encodeResult`, the pending-clock read, `engineState.park`, the
+            // guarded transition and the journal write it commits with, and the
+            // durable-park decision itself. Registering it here is what closes the
+            // last window: retention is inserted by an uninterruptible finalizer,
+            // and the fiber becomes interruptible again the instant that finalizer
+            // returns, so any cleanup piped onto the settlement alone would never
+            // be registered when an interrupt is already pending at that boundary —
+            // the scope would stay retained until the driver's own scope closed,
+            // which for a long-lived driver is not a release at all.
+            //
+            // `Exit.void` is the release exit, for the reason shutdown and a
+            // supersede use it (issue #26): a park that never committed leaves the
+            // run owned-but-stale or already re-owned, so it is reclaimed and
+            // replayed, and the replay re-registers its `Flow.withRollback`
+            // compensations under the reclaiming owner. Compensating here would
+            // undo work the journal still reports as done — and would then do it
+            // twice. Only a cancellation closes with an interrupt exit, and only
+            // `cancelOwned` does that.
+            yield* Effect.gen(function* () {
+                // Published inside the region for the same reason: the entry used to
+                // be written before `dependencies.engine` was awaited, one
+                // interruptible step ahead of the `ensuring` that removes it, so an
+                // interrupt landing there left this round's instance in the map for
+                // the driver's lifetime — a slow leak, and a stale instance for
+                // `interrupt` to mark interrupted.
+                liveInstances.set(executionId, instance);
+                const result = yield* Effect.scoped(Effect.raceFirst(Effect.raceFirst(Effect.suspend(() => activeState.capabilityCeilings === undefined
+                    ? Effect.die(new Error("Missing persisted capabilityCeilings; execution cannot safely resume"))
+                    : registration.execute(payload, executionId)).pipe(CapabilitySet.attenuateGroups(activeState.capabilityCeilings ?? [[]]), Flow.intoResult, Effect.provideService(FlowRuntime.FlowInstance, instance), Effect.provideService(FlowRuntime.FlowRuntime, flowEngine)), Ownership.heartbeatLoop(executionId, dependencies.owner, {
+                    onReconfirm: (unconfirmedMs) => {
+                        const record = decisionRecord(executionId, {
+                            decision: "lease-reconfirmed",
+                            detail: { unconfirmedMs }
+                        }, dependencies.journalSource);
+                        return journal.emitDurable(record, dependencies.owner).pipe(Effect.asVoid, Effect.orDie);
+                    },
+                    onLapse: (unconfirmedMs) => Effect.sync(() => {
+                        lapsedMs = unconfirmedMs;
+                    })
+                }).pipe(Effect.provideService(RunStore.RunStore, store))), cancelPollLoop(executionId))).pipe(Effect.ensuring(Effect.sync(() => liveInstances.delete(executionId))), 
+                // A suspension is the ONE settlement `Flow.intoResult` leaves the
+                // flow scope open for, so from the instant it surfaces the scope
+                // needs an owner. Retention is taken HERE, inside the race's own
+                // exit processing — `Effect.onExit` finalizers run uninterruptibly —
+                // because taking it any later crosses an interruptible boundary: an
+                // interrupt landing there would end the drive with the scope never
+                // retained, unreachable, and its finalizers never run at all. The
+                // entry is inserted into a cleanup region that was registered before
+                // this race started, so it is owned from this instant on: every
+                // ending, including an interrupt observed at the boundary between
+                // this finalizer and the settlement below, releases it there.
+                Effect.onExit((exit) => Effect.suspend(() => {
+                    if (!(Exit.isSuccess(exit) && exit.value._tag === "Suspended"))
+                        return Effect.void;
+                    retainedScopes.set(executionId, instance.scope);
+                    return dependencies.unsafeOnScopeRetained?.(executionId) ?? Effect.void;
+                })));
+                /**
+                 * Settles this round durably.
+                 *
+                 * A suspension that the guarded terminal transition durably accepts
+                 * sets `durableParkAccepted`, and that flag is the only thing that lets
+                 * a retained flow scope outlive this round. Every other ending — an
+                 * alternative settlement, a cancellation, a lost fence, a defect, an
+                 * interruption — leaves it unset, so the cleanup region registered
+                 * around the round releases the scope.
+                 */
+                const settleRound = Effect.gen(function* () {
+                    if (result._tag === "CancelRequested") {
+                        yield* cancelOwned(executionId, activeState);
+                        return;
+                    }
+                    // Corrupt evidence on a SUCCEEDED attempt row is an operator-visible
+                    // event, not a terminal run failure (issue #171): the row cannot be
+                    // evicted and re-executed like a corrupt cache row (#164) without
+                    // breaking exactly-once. ActionPersistence has already journalled
+                    // the corruption and quarantined only its boundary evidence off the
+                    // row. Park this first strict detection so it remains visible; the
+                    // next explicit resume returns the durable outcome without replaying
+                    // the poison or re-executing the action.
+                    const quarantine = result._tag === "Complete" && Exit.isFailure(result.exit)
+                        ? ActionPersistence.evidenceQuarantined(result.exit.cause)
+                        : undefined;
+                    if (quarantine !== undefined) {
+                        const parked = yield* transitionAndRecord(executionId, "suspended", yield* encodeState(withoutResult(activeState)), {
+                            decision: "quarantined",
+                            status: "suspended",
+                            keyDigest: quarantine.keyDigest,
+                            owner: dependencies.owner
+                        }, { cancelRequested: "absent" }, undefined, { reason: "quarantine", token: quarantine.keyDigest });
+                        if (parked._tag === "GuardFailed") {
+                            yield* cancelOwned(executionId, activeState);
+                        }
+                        return;
+                    }
+                    // A round that handed off settles through the seam instead: its
+                    // terminal transition and its successor's creation are one write, so
+                    // it cannot share the ordinary terminal path below.
+                    if (result._tag === "Handoff") {
+                        yield* handOff({
+                            executionId,
+                            row: initial,
+                            state: activeState,
+                            flow: registration.flow,
+                            handoff: result
+                        });
+                        return;
+                    }
+                    const encodedResult = yield* encodeResult(registration.flow, result);
+                    const nextState = { ...activeState, result: encodedResult.encoded };
+                    // A settlement the flow's codec rejected is written `failed`
+                    // whatever it claimed to be: the row must reach a terminal status
+                    // in this process, because the alternative — the `running` row the
+                    // release validation found — is re-executed by the next one.
+                    const status = encodedResult.note !== undefined
+                        ? "failed"
+                        : result._tag === "Suspended"
+                            ? "suspended"
+                            : Exit.isSuccess(result.exit)
+                                ? "completed"
+                                : "failed";
+                    let waiting = null;
+                    if (status === "suspended") {
+                        // Park atomically with the suspended transition while this
+                        // process still owns the row (`park` is owner-fenced). The
+                        // reason is derived from durable state: a pending
+                        // clock row means a timer wake with a known deadline; anything
+                        // else waits on an external event (deferred completion). This is
+                        // what makes `waitingRuns` sweepers and the 0004 partial index
+                        // match real suspensions (issue #12).
+                        // A flow-declared classification (FlowRuntime.annotateWaiting) wins:
+                        // it is the only way an approval or quota wait — and its wake
+                        // token — reaches the parked row (issue #31). The durable-state
+                        // derivation stays the fallback.
+                        const declared = instance.waiting;
+                        const pendingClocks = yield* engineState.pendingClocks({ executionId });
+                        waiting = declared !== undefined
+                            ? declared
+                            : pendingClocks.length > 0
+                                ? {
+                                    reason: "timer",
+                                    wakeAt: Math.min(...pendingClocks.map((clock) => clock.dueAtMs))
+                                }
+                                : { reason: "event" };
+                    }
+                    // Finalize is guarded on `cancel_requested_at_ms` inside the same
+                    // CAS: a cancellation request that raced past the last poll turns
+                    // the terminal transition into GuardFailed, and the run cancels
+                    // instead of finalizing (issue #11).
+                    const transitioned = yield* transitionAndRecord(executionId, status, yield* encodeState(nextState), { decision: "transitioned", status, owner: dependencies.owner }, { cancelRequested: "absent" }, 
+                    // A suspension is not an exit: the run is parked and will settle
+                    // later, so its children keep going and its timers stay armed. A
+                    // `completed` or `failed` run is done, so its attached children
+                    // end with it. The transition closes its own clock rows.
+                    status === "suspended" ? undefined : applyChildExitPolicy(executionId), waiting).pipe(
+                    // The park becomes durable the instant this transition commits, so
+                    // the flag that records it is set in the transition's own exit
+                    // processing. `Effect.onExit` finalizers run uninterruptibly and
+                    // before the fiber can observe an interruption again, so no
+                    // interrupt can land between the durable commit and the flag and
+                    // make the cleanup region discard a scope the park still needs.
+                    Effect.onExit((exit) => Effect.sync(() => {
+                        if (status === "suspended" && Exit.isSuccess(exit) && exit.value._tag === "Transitioned") {
+                            durableParkAccepted = true;
+                        }
+                    })));
+                    if (transitioned._tag === "GuardFailed") {
+                        // `cancelOwned` closes the retained scope itself, with the
+                        // interrupt exit cancellation compensations exist for. Leaving
+                        // `durableParkAccepted` unset therefore releases nothing a second
+                        // time: the entry is already gone from the map.
+                        yield* cancelOwned(executionId, activeState);
+                        return;
+                    }
+                    // A lost fence (`NotFound`, a mismatched CAS) settles nothing: the
+                    // run is someone else's now, so a suspension holds no durable park
+                    // and the cleanup region releases the scope rather than holding it
+                    // until shutdown.
+                    if (transitioned._tag !== "Transitioned")
+                        return;
+                    if (status !== "suspended") {
+                        // The settle is durable; tell any in-process caller parked on this
+                        // run's poll loop, so a run driven to completion by a sweep or a
+                        // coordinator wake is observed now rather than on the next tick.
+                        yield* announceSettled(executionId, activeState);
+                        return;
+                    }
+                });
+                yield* settleRound;
+            });
+        }).pipe(
+        // Install ownership cleanup before the claim itself. Limiting it to
+        // the execution race strands an activated row if shutdown lands in
+        // setup or settlement; a replacement host in the same process then
+        // correctly refuses to steal from the still-live PID forever.
+        Effect.onInterrupt(() => interruptState === undefined
+            ? Effect.void
+            : settleInterrupted(executionId, interruptState, lapsedMs === undefined
+                ? { kind: "interrupted" }
+                : { kind: "lease-lapsed", unconfirmedMs: Math.max(0, Math.floor(lapsedMs)) }, round)), Effect.onExit(() => Effect.suspend(() => {
+            liveInstances.delete(executionId);
+            // Cancellation settles first so its compensations still see the
+            // retained scope. A successful durable park alone retains it.
+            return round === undefined || durableParkAccepted
+                ? Effect.void
+                : releaseRetainedScope(executionId, Exit.void);
+        })), Effect.annotateLogs({ runId: executionId }));
+    });
+    const coordinator = yield* RunCoordinator.make({
+        drain: drive
+    });
+    yield* Deferred.succeed(coordinatorDeferred, coordinator);
+    /**
+     * Delivers cancellation to parked runs (issue #27). A suspended run has
+     * no owner and therefore no cancel poll, so `requestCancel` against it
+     * is write-only until something re-drives the run — a run parked on a
+     * deferred that never completes could otherwise never be cancelled. The
+     * sweep lists parked rows, and wakes any whose cancel was durably
+     * requested; the re-activation cancel guard then closes the run without
+     * re-executing the flow.
+     *
+     * The same sweep reclaims interrupt-released runs (issue #39): a run
+     * parked with reason `released` was interrupted mid-action by shutdown
+     * or a heartbeat self-interrupt, has no pending clock and no completed
+     * deferred, and would otherwise never be re-driven. Waking it re-enters
+     * the ordinary claim/activate path, which also delivers any pending
+     * cancel via the activation guard.
+     */
+    const sweepCancelRequested = Effect.gen(function* () {
+        // Fetch only actionable rows (issue #68): the sweep acts solely on
+        // released rows and rows whose cancellation was durably requested, so
+        // a large quota/event-parked fleet must cost it nothing per tick. The
+        // per-row `store.get` below is a status guard over the (small)
+        // actionable set, not a probe over every parked run — the in-memory
+        // implementation without a `runs` view stays permissive on the cancel
+        // predicate and relies on exactly this guard.
+        const released = yield* engineState.waitingRuns({ reason: "released" });
+        const cancelRequestedRows = yield* engineState.waitingRuns({ cancelRequested: true });
+        const candidates = new Map();
+        for (const waiting of released)
+            candidates.set(waiting.runId, waiting);
+        for (const waiting of cancelRequestedRows)
+            candidates.set(waiting.runId, waiting);
+        for (const waiting of candidates.values()) {
+            const row = yield* store.get(waiting.runId).pipe(Effect.catch(() => Effect.succeed(undefined)));
+            if (row !== undefined &&
+                row.status === "suspended" &&
+                (row.cancelRequestedAtMs !== null || waiting.reason === "released")) {
+                yield* coordinator.wake(row.runId);
+            }
+        }
+    });
+    /**
+     * A timer can fire while a dead control owner is still inside its stale
+     * cutoff. The clock completion is durable, but that first coordinator
+     * wake cannot claim yet (#3408). Revisit only due timer waits with an
+     * unconsumed completion; the normal drive still checks admission and CAS.
+     * Released actions, future timers and ordinary event waits are excluded.
+     */
+    const sweepReadyTimers = Effect.gen(function* () {
+        const nowMs = yield* Clock.currentTimeMillis;
+        const due = yield* engineState.waitingRuns({ reason: "timer", dueBeforeMs: nowMs });
+        const completions = new Map();
+        for (const waiting of due) {
+            const row = yield* store.get(waiting.runId).pipe(Effect.catch(() => Effect.succeed(undefined)));
+            if (row === undefined || row.status !== "suspended")
+                continue;
+            const state = yield* decodeState(row.stateJson);
+            if (!registrations.has(state.flowName))
+                continue;
+            let ready = completions.get(state.flowName);
+            if (ready === undefined) {
+                ready = new Set((yield* engineState.completedDeferreds(state.flowName)).map((address) => address.executionId));
+                completions.set(state.flowName, ready);
+            }
+            if (!ready.has(row.runId))
+                continue;
+            yield* coordinator.schedule(row.runId);
+        }
+    });
+    // Admissions committed before a host crash have no lease to go stale.
+    // Reuse the normal coordinator and claim/activate path for these rows.
+    const pendingCycles = new Map();
+    let pendingCancellationCycle;
+    // Explicit cancellation needs no registration or admission grace. A finite
+    // tail and cursor keep a denied prefix from starving eligible later rows,
+    // even when new cancellations arrive continuously.
+    const sweepPendingCancellation = () => Effect.gen(function* () {
+        if (pendingCancellationCycle === undefined) {
+            const tail = yield* engineState.pendingCancellationTail();
+            if (Option.isNone(tail))
+                return;
+            pendingCancellationCycle = { through: tail.value };
+        }
+        const cycle = pendingCancellationCycle;
+        const candidates = yield* engineState.pendingCancellationRuns(staleRunningSweepBatch, cycle.after, cycle.through);
+        for (const cursor of candidates) {
+            const row = yield* store.get(cursor.runId).pipe(Effect.catch((error) => error.code === "not_found_row" ? Effect.succeed(undefined) : error.code === "decode_failed"
+                ? Effect.logWarning("engine-store: unreadable pending cancellation skipped", {
+                    runId: cursor.runId,
+                    error
+                })
+                    .pipe(Effect.as(undefined))
+                : Effect.die(error)));
+            // Permanent misses advance; a transient read failure retries this slot.
+            cycle.after = cursor;
+            if (row === undefined || row.status !== "pending" || row.cancelRequestedAtMs === null ||
+                (yield* coordinator.active).has(cursor.runId))
+                continue;
+            if (dependencies.canExecute !== undefined && !(yield* dependencies.canExecute(row)))
+                continue;
+            if (!(yield* coordinator.active).has(cursor.runId))
+                yield* coordinator.schedule(cursor.runId);
+        }
+        if (candidates.length < staleRunningSweepBatch ||
+            candidates.at(-1)?.runId === cycle.through.runId)
+            pendingCancellationCycle = undefined;
+    });
+    let pendingFlowOffset = 0;
+    const sweepPending = () => Effect.gen(function* () {
+        let remaining = staleRunningSweepBatch;
+        const allNames = Array.from(registrations.keys());
+        const offset = allNames.length === 0 ? 0 : pendingFlowOffset % allNames.length;
+        const names = [...allNames.slice(offset), ...allNames.slice(0, offset)];
+        pendingFlowOffset++;
+        for (const name of names) {
+            const registration = registrations.get(name)?.at(-1);
+            if (registration === undefined || remaining === 0)
+                continue;
+            let cycle = pendingCycles.get(name);
+            if (cycle === undefined) {
+                const eligibleBeforeMs = (yield* Clock.currentTimeMillis) - Duration.toMillis(Ownership.heartbeatStaleAfter);
+                const tail = yield* engineState.pendingRunTail(name, eligibleBeforeMs);
+                if (Option.isNone(tail))
+                    continue;
+                cycle = { through: tail.value, eligibleBeforeMs };
+                pendingCycles.set(name, cycle);
+            }
+            const requested = remaining;
+            const pending = yield* engineState.pendingRuns(name, requested, cycle.after, cycle.through, cycle.eligibleBeforeMs);
+            for (const cursor of pending) {
+                if (remaining === 0 || registrations.get(name)?.at(-1) !== registration)
+                    break;
+                remaining--;
+                const row = yield* store.get(cursor.runId).pipe(Effect.catch((error) => error.code === "not_found_row" ? Effect.succeed(undefined) : error.code === "decode_failed"
+                    ? Effect.logWarning("engine-store: unreadable pending admission skipped", {
+                        runId: cursor.runId,
+                        flowName: name,
+                        error
+                    }).pipe(Effect.as(undefined))
+                    : Effect.die(error)));
+                // Advance after successful reads or permanent row errors; transient failures retry this
+                // position, while a retained query cursor skips deleted rows safely.
+                cycle.after = cursor;
+                if (row === undefined || row.status !== "pending" || (yield* coordinator.active).has(cursor.runId)) {
+                    continue;
+                }
+                if (dependencies.canExecute !== undefined && !(yield* dependencies.canExecute(row))) {
+                    continue;
+                }
+                if (registrations.get(name)?.at(-1) !== registration || (yield* coordinator.active).has(cursor.runId)) {
+                    continue;
+                }
+                yield* coordinator.schedule(cursor.runId);
+            }
+            const last = pending.at(-1);
+            if (pending.length < requested || (last !== undefined && last.runId === cycle.through.runId)) {
+                pendingCycles.delete(name);
+            }
+        }
+    });
+    /**
+     * Reclaims hard-killed runs (issue #53). An owner that dies without
+     * releasing (SIGKILL, OOM, power loss) leaves a `running` row with a
+     * frozen heartbeat and no waiting row, so the parked-run sweep above
+     * never sees it, and the steal path — reachable only through `drive()` —
+     * is never entered. Enumerate stale-running rows and re-drive them: the
+     * ordinary claim/steal path (liveness check, exact-snapshot steal CAS)
+     * then decides whether the owner is genuinely dead — the analog of
+     * Temporal's task-timeout re-dispatch. A pending durable cancel is
+     * delivered by the re-activation guard, same as for parked runs.
+     */
+    const sweepStaleRunning = Effect.gen(function* () {
+        const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+        // Rows this driver has already arbitrated and been refused. They are the
+        // oldest heartbeats in the window, so they sort first and would fill the
+        // batch every tick; the read asks for enough extra rows to see past
+        // exactly the ones it is going to skip.
+        const deferred = Array.from(stealRefusals.values()).filter((entry) => entry.nextProbeAtMs > nowMs).length;
+        // Capped per tick (issue #79): oldest heartbeats come back first, so a
+        // mass owner death drains across successive ticks — batch after batch
+        // as each stolen run's heartbeat leaves the stale window — instead of
+        // every surviving driver waking every stale run every second and
+        // contending N-drivers × M-runs on the claim/steal CAS.
+        const stale = yield* engineState.staleRunningRuns(nowMs - Duration.toMillis(Ownership.heartbeatStaleAfter), staleRunningSweepBatch + deferred);
+        // A refusal is remembered only while its row is still in the window this
+        // read covers. A run that was stolen, released, or settled leaves the
+        // stale set, and its entry leaves with it, so the map cannot outgrow the
+        // backlog it describes.
+        const visible = new Set(stale.map((row) => row.runId));
+        for (const runId of stealRefusals.keys()) {
+            if (!visible.has(runId))
+                stealRefusals.delete(runId);
+        }
+        let woken = 0;
+        for (const { heartbeatAtMs, runId } of stale) {
+            if (woken >= staleRunningSweepBatch)
+                break;
+            // A refusal defers only the lease it was refused against. An owner
+            // that pulsed and stalled again between two ticks never left this
+            // read's window, so the lease is what says the stall is a new one.
+            const refusal = stealRefusals.get(runId);
+            if (refusal !== undefined && refusal.heartbeatAtMs === heartbeatAtMs && refusal.nextProbeAtMs > nowMs)
+                continue;
+            woken = woken + 1;
+            yield* coordinator.wake(runId);
+        }
+    });
+    const resilientSweep = (sweep, name) => sweep.pipe(Effect.sandbox, Effect.catchCause((cause) => Effect.logWarning(`engine-store: ${name} sweep failed; retrying next tick`, cause)));
+    yield* Effect.forkScoped(Effect.forever(Effect.sleep(Ownership.heartbeatInterval).pipe(Effect.andThen(
+    // One transient defect (a `SQLITE_BUSY` escaping `waitingRuns()`'s
+    // `orDie`, a wake failure) must not kill the sweeper for the rest
+    // of the process lifetime (issue #44) — that would silently revert
+    // to pre-#27 behavior where cancel of parked runs is never
+    // delivered. Mirror `armClock`'s hardening: expose the full cause,
+    // log it, and keep ticking.
+    resilientSweep(sweepCancelRequested, "parked-run cancel").pipe(Effect.andThen(resilientSweep(sweepStaleRunning, "stale-running")), Effect.andThen(resilientSweep(sweepReadyTimers, "ready timer")), Effect.andThen(resilientSweep(sweepPendingCancellation(), "pending cancellation")), Effect.andThen(resilientSweep(sweepPending(), "pending admission")))))));
+    const ensureRun = (flow, options) => Effect.gen(function* () {
+        const payload = yield* Schema.encodeEffect(Schema.toCodecJson(flow.payloadSchema))(options.payload).pipe(Effect.orDie);
+        // Every requested parent — first (creating) parent and a diamond's
+        // second parent alike — is recorded as a durable edge BEFORE the run
+        // row is created. `recordRunParent` inserts the edge and checks for
+        // a cycle inside one storage transaction (issues #29/#40/#54/#56),
+        // so a rejected request fails here and never creates a run row — no
+        // `state_json` parent can outlive a rejected edge (issue #55). The
+        // edge table is the single source of truth for cycle detection in
+        // every owner process and across restarts (issues #40/#41).
+        //
+        // The edge record and the run-row creation share one outer storage
+        // transaction (issue #80): a crash between them used to commit a
+        // durable orphan edge for a child run that never existed — never
+        // GC'd, permanently walked by cycle detection, and able to force a
+        // false FlowCycleDetected if the execution id was later reused
+        // under an inverted topology. The stores' own writes become
+        // savepoints of this transaction, so either both commit or neither.
+        yield* transactState(Effect.gen(function* () {
+            let parentRecorded = false;
+            if (options.parent !== undefined) {
+                const parentEdge = yield* engineState.recordRunParent(options.executionId, options.parent.executionId).pipe(Effect.catch((error) => Effect.fail(new FlowCycleDetected({ code: "flow_cycle_detected", path: error.path }))));
+                parentRecorded = parentEdge._tag === "Recorded";
+            }
+            const round = options.round ?? FlowEngine.Round.initial(options.executionId);
+            const previousExecutionId = options.round?.previousExecutionId;
+            // Decided once, at spawn, from what the caller did with the result:
+            // a caller waiting for the value keeps the child attached, and a
+            // caller that discarded it detached the child on purpose. Nothing
+            // later rewrites this.
+            const onParentExit = options.discard === true ? "detach" : "cancel";
+            const state = {
+                version: 1,
+                flowName: flow._tag,
+                payload,
+                capabilityCeilings: yield* FlowEngine.requestedAuthority(flow),
+                onParentExit,
+                ...(options.parent === undefined
+                    ? {}
+                    : { parentExecutionId: options.parent.executionId }),
+                ...(flow.maxRounds === undefined ? {} : { maxRounds: flow.maxRounds })
+            };
+            const createdStateJson = yield* encodeState(state);
+            yield* ensureCreatedRun({
+                flowName: flow._tag,
+                capabilityCeilings: state.capabilityCeilings,
+                executionId: options.executionId,
+                stateJson: createdStateJson,
+                payload,
+                lineageId: round.rootExecutionId,
+                roundOrdinal: round.ordinal,
+                ...(previousExecutionId === undefined
+                    ? {}
+                    : { parentRunId: previousExecutionId }),
+                onCreated: Effect.gen(function* () {
+                    // The run's opening frame. `store.create` used to be the one
+                    // durable write with no journal record at all, which left the
+                    // replay-derived state projection with no base to fold onto —
+                    // `flowName` and `payload` exist nowhere else in the journal.
+                    // The state travels ENCODED, exactly as every later decision
+                    // carries it: `stateAt` folds these payloads and hands the winner
+                    // back as the run row's own `state_json`, so a base recorded in the
+                    // decoded shape would be a schema the caller cannot decode.
+                    yield* emitDecision(options.executionId, {
+                        decision: "created",
+                        state: JSON.parse(createdStateJson),
+                        ...(options.parent === undefined ? {} : { parentExecutionId: options.parent.executionId })
+                    });
+                    if (options.parent !== undefined) {
+                        // A spawn is a lineage edge, and a DETACHED spawn is a tier-3
+                        // effect: nothing the parent's rewind can undo, because the child
+                        // is its own claim and its own journal. The record
+                        // is boundary-shaped so the same assessment that classifies a
+                        // sent webhook classifies an orphaned child, and it is emitted at
+                        // `succeeded` because by this point the child run durably exists.
+                        // Unfenced: the creator of a detached child is not necessarily
+                        // the parent's current owner (an external spawn admission
+                        // creates child rows without holding the parent's fence), so
+                        // this lineage-edge record is first-writer-wins evidence keyed
+                        // by its spawn identity.
+                        yield* journal.emitDurableUnfenced(EffectRecords.boundary({
+                            id: `${options.parent.executionId}:spawn:${options.executionId}`,
+                            kind: spawnEffectKind,
+                            tier: "irreversible",
+                            runId: options.parent.executionId,
+                            lineageId: FlowEngine.Lineage.root(options.parent.executionId),
+                            sourceId: dependencies.journalSource,
+                            attempt: 1,
+                            residue: `Child run ${options.executionId} exists and keeps its own journal; rewinding past its spawn orphans it.`
+                        }, "succeeded", 
+                        // `attached` is written even though it is always false: the
+                        // lineage-tree bridge in `@smthrs/time-travel` reads it off
+                        // this payload, and an absent field there would make "this
+                        // spawn is detached" indistinguishable from "this producer
+                        // predates the field". A run created with a parent is a
+                        // separate run row with its own claim, which is what detached
+                        // means; attached nesting
+                        // never reaches `create` because it is one journal.
+                        { childRunId: options.executionId, flowName: flow._tag, attached: false })).pipe(Effect.orDie);
+                    }
+                })
+            });
+            // The row already exists; the durable edge recorded above is the
+            // only place a diamond's second parent lives (issues #41/#48): a
+            // driver-local side table would be invisible to other owners over
+            // the same store, lost across restart, and would grow without
+            // bound for the driver's lifetime.
+            //
+            // Which is also why the parent's cancellation is inherited HERE,
+            // last and inside this same transaction: the child row must already
+            // exist for `requestCancel` to have anything to write to, and the
+            // inheritance must commit or roll back with the edge that made this
+            // run a child in the first place. The inherited request is what the
+            // activation guard reads, so the child cancels instead of executing
+            // the flow body.
+            if (options.parent !== undefined) {
+                yield* inheritParentCancellation(options.parent.executionId, options.executionId);
+                if (parentRecorded) {
+                    yield* emitDecision(options.executionId, {
+                        decision: "parent-recorded",
+                        parentExecutionId: options.parent.executionId
+                    });
+                }
+            }
+        })).pipe(Effect.catchIf((error) => error instanceof Journal.JournalError || error instanceof DatabaseError, Effect.die));
+    });
+    const readResult = (flow, executionId, followLineage = false) => Effect.annotateCurrentSpan({ executionId, flow: flow._tag }).pipe(Effect.andThen(FlowEngine.requestedAuthority(flow)), Effect.flatMap((requested) => Effect.map(followLineage ? store.latestRound(executionId) : store.get(executionId), (row) => ({
+        row,
+        requested
+    }))), Effect.catch((error) => error.code === "not_found_row"
+        ? Effect.succeed(undefined)
+        : Effect.die(error)), Effect.flatMap((found) => {
+        if (found === undefined) {
+            // No run row at all is a typed not-found; `Option.none` is
+            // reserved for a known run that has not settled yet.
+            return Effect.fail(new FlowRuntime.FlowExecutionNotFound({
+                code: "execution_not_found",
+                executionId
+            }));
+        }
+        const { row, requested } = found;
+        return decodeState(row.stateJson).pipe(Effect.flatMap((state) => {
+            if ((!followLineage && state.flowName !== flow._tag) ||
+                state.result === undefined) {
+                return Effect.succeedNone;
+            }
+            // A result is what the admitted authority produced; a caller
+            // whose authority does not cover it never reads it.
+            if (!FlowEngine.joinable(state.capabilityCeilings ?? [], requested)) {
+                return Effect.die(FlowEngine.capabilityConflict(executionId));
+            }
+            const resultFlow = state.flowName === flow._tag ? flow : registrations.get(state.flowName)?.at(-1)?.flow;
+            if (resultFlow === undefined) {
+                // Direct nested callers must register the terminal flow's
+                // codec here, even when another worker executed that flow.
+                // This is the typed Trampoline's fail-fast wiring contract:
+                // terminal work has no future wake to justify Suspended.
+                return Effect.die(new FlowEngine.FlowNotRegistered({
+                    flowName: state.flowName,
+                    message: `Flow ${state.flowName} is not registered`
+                }));
+            }
+            return Schema.decodeUnknownEffect(Schema.toCodecJson(Flow.Result({
+                success: resultFlow.successSchema,
+                error: resultFlow.errorSchema
+            })))(state.result).pipe(Effect.orDie, Effect.map(Option.some));
+        }), Effect.map((result) => ({ result, status: row.status })));
+    }));
+    /**
+     * Whether a resume of `executionId` for `flow` may drive anything: only an
+     * admitted row of this declaration whose recorded authority the caller's
+     * covers. An unknown id or a row another declaration owns drives nothing,
+     * so a row admitted after this read is never woken on this request; a
+     * caller whose authority does not cover the row is refused.
+     */
+    const authorizeResume = (flow, executionId) => Effect.gen(function* () {
+        const row = yield* store.get(executionId).pipe(Effect.catch((error) => error.code === "not_found_row" ? Effect.succeed(undefined) : Effect.die(error)));
+        if (row === undefined)
+            return false;
+        const state = yield* decodeState(row.stateJson);
+        if (state.flowName !== flow._tag)
+            return false;
+        if (!FlowEngine.joinable(state.capabilityCeilings ?? [], yield* FlowEngine.requestedAuthority(flow))) {
+            return yield* Effect.die(FlowEngine.capabilityConflict(executionId));
+        }
+        return true;
+    });
+    const poll = Effect.fn("FlowEngine.poll")((flow, executionId) => Effect.map(readResult(flow, executionId), (observed) => observed.result));
+    const execute = Effect.fn("FlowEngine.execute")(function* (flow, options) {
+        yield* Effect.annotateCurrentSpan({ executionId: options.executionId, flow: flow._tag });
+        if (!registrations.has(flow._tag)) {
+            return yield* Effect.die(new FlowEngine.FlowNotRegistered({
+                flowName: flow._tag,
+                message: `Flow ${flow._tag} is not registered`
+            }));
+        }
+        // Cycle rejection happens atomically inside `ensureRun`'s call to
+        // `DurableEngineState.recordRunParent`: the storage transaction that
+        // inserts the edge also walks the parent chain and rolls back on a
+        // hit, so no in-process gate, cross-owner arbitration, or withdrawal
+        // protocol is needed here (issues #29/#40/#54/#55/#56) and the
+        // mutual `coordinator.run` deadlock cannot form.
+        if (options.discard) {
+            // Keep durable admission and scheduling together across caller cancellation.
+            // The coordinator owns the drive in the engine scope, so a
+            // detached child outlives the caller's action and execution.
+            yield* Effect.uninterruptible(ensureRun(flow, options).pipe(Effect.andThen(coordinator.schedule(options.executionId))));
+            return undefined;
+        }
+        yield* ensureRun(flow, options);
+        // Admission, handoff, or a wake normally scheduled this drive. A
+        // replacement host may instead find an admitted pending row with no
+        // drive, so schedule that row before joining. An idle suspended row
+        // stays passive until its actual wake or elapsed poll resumes it.
+        if (options.follow === true) {
+            yield* coordinator.scheduleIf(options.executionId, store.get(options.executionId).pipe(Effect.orDie, Effect.map((row) => row.status === "pending")));
+            yield* coordinator.join(options.executionId);
+        }
+        else {
+            yield* coordinator.run(options.executionId);
+        }
+        // `ensureRun` created the row above, so a not-found here is a broken
+        // store invariant, not a caller-recoverable state.
+        // The trampoline supplies `round` and consumes each raw handoff itself.
+        // A nested direct caller instead needs the child's current lineage row,
+        // including its own codec and cancellation status. `follow` schedules an
+        // undriven pending row before joining; it does not select the result's scope.
+        const observed = yield* Effect.orDie(readResult(flow, options.executionId, options.parent !== undefined && options.round === undefined));
+        if (Option.isSome(observed.result)) {
+            return observed.result.value;
+        }
+        // A cancelled run has no `Flow.Result` on its row — cancellation is
+        // recorded as `cancellation`, not as a settlement — so answering the
+        // absence with `Suspended` told the caller to wait for a run that was
+        // over. The engine's suspended-retry loop then did what that answer
+        // means: slept, resumed, re-drove, and asked again, for as long as the
+        // caller lived. A run cancelled underneath its caller interrupts the
+        // caller instead, which is what the memory engine already does
+        // (`layerMemory.ts` `interrupt` settles the round `Complete` with an
+        // interrupt cause) and what a cancellation means: the work the caller
+        // asked for is not going to happen.
+        // Result and cancellation status come from the same row snapshot.
+        return (observed.status === "cancelled"
+            ? new Flow.Complete({ exit: Exit.failCause(Cause.interrupt()) })
+            : new Flow.Suspended({}));
+    });
+    const interrupt = Effect.fn("FlowEngine.interrupt")((_flow, executionId) => Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({ executionId });
+        // Operator intent is recorded durably before the fiber interrupt so
+        // the interruption handler can tell cancellation apart from shutdown
+        // (issue #26), and so the request survives if this process dies
+        // before the interrupt lands.
+        //
+        // The write used to be `Effect.ignore`d, which answered success for a
+        // cancellation that was never recorded: the fiber interrupt that
+        // follows is then read as a shutdown by `settleInterrupted`, the run
+        // is RELEASED for reclaim rather than cancelled, another worker picks
+        // it up, and the caller was told the run was cancelled. The failure is
+        // typed instead, so the caller can retry against a state that is still
+        // truthful — the run is still running and still cancellable.
+        const nowMs = yield* Clock.currentTimeMillis.pipe(Effect.map(Math.floor));
+        // The package's one lock order, the same one every settlement takes:
+        // engine state first, then the journal. The descendant walk reads
+        // engine state while holding the SQL writer, so the alternative would
+        // deadlock against any fiber that ordered the two boundaries the
+        // other way.
+        const requested = yield* transactState(Effect.gen(function* () {
+            yield* requestCancellation(executionId, nowMs);
+            return [executionId, ...yield* requestCancelDescendants(executionId, nowMs)];
+        }), 
+        // Capture the shared writer directly. SqlJournal.transact catches a
+        // selected failure and can discard the rest of a composite cause.
+        (write) => Effect.flatMap(Effect.exit(writer.write(write)), (exit) => exit)).pipe(Effect.catchCause((cause) => {
+            // A composite is never a retryable CancelRequestFailed: retain
+            // every original reason, including defect identity and interruption.
+            const failure = (error) => new FlowRuntime.CancelRequestFailed({
+                code: "cancel_request_failed",
+                executionId,
+                reason: error.message
+            });
+            if (cause.reasons.length === 1) {
+                const reason = cause.reasons[0];
+                if (Cause.isDieReason(reason) && reason.defect instanceof DatabaseError) {
+                    return Effect.fail(failure(reason.defect));
+                }
+                // The typed channel is the normalized writer/store/journal union.
+                if (Cause.isFailReason(reason)) {
+                    return Effect.fail(failure(reason.error));
+                }
+            }
+            // A composite is not the retryable request failure the typed
+            // channel promises, so every typed reason is re-channelled as a
+            // defect rather than cast through `CancelRequestFailed`. The error
+            // objects, the accompanying defects and the interruptions all
+            // survive; only the channel changes, and it changes to the one the
+            // declared type actually admits.
+            return Effect.failCause(asDefects(cause));
+        }));
+        // Only after the durable write succeeds may the ephemeral surface say
+        // this instance was interrupted or stop its drive fiber. If the write
+        // failed, changing either would make a typed failure observably mutate
+        // the run (and could spuriously trigger the in-process child path).
+        // The transaction above records the parent and every durable
+        // descendant together. A run this process does not drive — parked
+        // here, owned elsewhere, or already settled — therefore receives the
+        // same child-flow handling without a partial-cascade state if any
+        // request write fails. `requestCancel` is first-writer-wins, so the
+        // owning driver's own cascade later writes nothing.
+        yield* journal.whenCommitted(Effect.gen(function* () {
+            for (const targetId of requested) {
+                const instance = liveInstances.get(targetId);
+                if (instance !== undefined)
+                    instance.interrupted = true;
+                // Publication only sends the request. Awaiting user finalizers
+                // here would make an outer commit uninterruptibly wait on them.
+                yield* coordinator.requestInterrupt(targetId);
+            }
+        }));
+    }));
+    const scheduleResume = Effect.fn("FlowEngine.scheduleResume")((flowName, executionId, reason, sourceId) => transactState(Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({ executionId, flow: flowName, reason });
+        const row = yield* store.get(executionId).pipe(Effect.catch((error) => error.code === "not_found_row"
+            ? Effect.succeed(undefined)
+            : Effect.die(error)));
+        if (row === undefined)
+            return;
+        // A settled run is not woken and then refused: it is not woken. The
+        // terminal reject used to live one layer down, in `claimAndActivate`,
+        // so a timer armed before its run was cancelled and an external
+        // trigger arriving after the run finished both wrote a
+        // `wake-scheduled` decision into the journal of a run that can never
+        // wake again — one per event, forever, on a durable channel.
+        if (row.status === "completed" || row.status === "failed" || row.status === "cancelled")
+            return;
+        const state = yield* decodeState(row.stateJson);
+        if (state.flowName !== flowName)
+            return;
+        const waiting = yield* engineState.waiting(executionId);
+        if (Option.isSome(waiting) && waiting.value.reason === "quarantine") {
+            if (reason !== "operator")
+                return;
+            // Recovery consent and its journal receipt commit together. A
+            // queued drive cannot consume quarantined evidence before consent.
+            yield* engineState.wake(executionId);
+        }
+        yield* emitDecision(executionId, {
+            decision: "wake-scheduled",
+            reason
+        }, sourceId);
+        return { parked: row.status === "suspended" };
+    })).pipe(Effect.orDie, 
+    // A host can write a separate database. Release the engine transaction
+    // before calling it, but record its request before publishing the wake.
+    Effect.flatMap((scheduled) => scheduled === undefined
+        ? Effect.void
+        : (reason === "operator" || reason === "delegated"
+            ? Effect.void
+            : recordResume(executionId, scheduled.parked, reason)).pipe(Effect.andThen(coordinator.wake(executionId)), Effect.andThen(wakeBus.wake(executionId))))));
+    return {
+        register: Effect.fn("FlowEngine.register")((flow, handler) => Effect.acquireRelease(Effect.sync(() => {
+            const registration = { flow, execute: handler };
+            const entries = registrations.get(flow._tag) ?? [];
+            entries.push(registration);
+            registrations.set(flow._tag, entries);
+            pendingCycles.delete(flow._tag);
+            warnedUnregistered.clear();
+            return { registration, entries };
+        }), ({ registration, entries }) => Effect.sync(() => {
+            const wasLatest = entries.at(-1) === registration;
+            entries.splice(entries.indexOf(registration), 1);
+            if (entries.length === 0)
+                registrations.delete(flow._tag);
+            if (wasLatest) {
+                pendingCycles.delete(flow._tag);
+                // Restoring a live predecessor changes which handler may
+                // drive pending work, just like a fresh registration does.
+                if (entries.length > 0)
+                    warnedUnregistered.clear();
+            }
+        })).pipe(Effect.asVoid)),
+        execute,
+        poll,
+        interrupt,
+        // The durable engine has ONE cancellation path (the release policy). The
+        // port promises forced cancellation without cleanup; nothing here can
+        // deliver that — a durable run is closed by a fenced transition whose
+        // finalizers, cascade, and interruption record are the point — and
+        // answering with `interrupt` silently reinterpreted the caller's
+        // request as the safe one. Refusing is what keeps the excluded feature
+        // from appearing to half-work; `interrupt` is the supported request and
+        // is still available to the same caller. The memory engine, which does
+        // have two behaviors, is unchanged.
+        //
+        // The reason is the release policy "Durable interruptUnsafe" verbatim, not a
+        // paraphrase of it: the release note and the failure a caller catches
+        // are the same statement, so an operator who reads one and a developer
+        // who logs the other are reading the same sentence.
+        interruptUnsafe: Effect.fn("FlowEngine.interruptUnsafe")((_flow, executionId) => Effect.fail(new FlowRuntime.CancelRequestFailed({
+            code: "unsafe_interrupt_unsupported",
+            executionId,
+            reason: "The durable engine has one cancellation path, interrupt, which is durable and cascades to linked children. FlowRuntime.interruptUnsafe on the durable engine fails with unsafe_interrupt_unsupported instead of forcing cancellation without cleanup."
+        }))),
+        resume: Effect.fn("FlowEngine.resume")((flow, executionId, options) => Effect.annotateCurrentSpan({ executionId, flow: flow._tag }).pipe(
+        // A resume drives the run under its admitted authority, so a caller
+        // whose authority does not cover it may not wake or join it, and a
+        // request that names no admitted run of this flow drives nothing.
+        Effect.andThen(authorizeResume(flow, executionId)), Effect.flatMap((authorized) => authorized
+            ? Effect.andThen(options?.poll === true
+                ? Effect.void
+                : scheduleResume(flow._tag, executionId, options?.delegated === true ? "delegated" : "operator"), coordinator.run(executionId))
+            : Effect.void))),
+        scheduleResume,
+        active: Effect.fn("FlowEngine.active")(() => coordinator.active)(),
+        retainedRuns
+    };
+});
+//# sourceMappingURL=RunDriver.js.map