@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/DurableEngineState.js

@@ -0,0 +1,1648 @@
+/**
+ * Durable deferred-completion and clock-deadline state used by the flow
+ * engine adapter.
+ *
+ * A parked run keeps the `suspended` status the run store admits; there is
+ * no `waiting` status. The waiting taxonomy lives beside it on the run row
+ * in the `waiting_reason`, `waiting_wake_at_ms`, `waiting_token`, and
+ * `waiting_request` columns, written by `park` and cleared by `wake`. See
+ * `docs/concepts/durable-waits.md`.
+ *
+ * @since 0.1.0
+ */
+import * as Dialect from "@smthrs/database/Dialect";
+import { afterCommit, DatabaseError, DurableWriter } from "@smthrs/database/DurableWriter";
+import { contentDigest } from "@smthrs/journal/JournalEvent";
+import * as Cause from "effect/Cause";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+import * as EngineStateSchema from "./internal/EngineStateSchema.js";
+import { compareText } from "./internal/Ordering.js";
+const pendingCancellationLimit = (limit) => Number.isSafeInteger(limit) && limit >= 0
+    ? Effect.void
+    : Effect.die(new RangeError("Pending cancellation limit must be a non-negative safe integer"));
+/** JSON text carrying an arbitrary decoded value. */
+const UnknownFromJsonString = Schema.fromJsonString(Schema.Unknown);
+/** @private */
+const NonNegativeSafeInt = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/**
+ * The durable address of a deferred result.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const DeferredAddress = Schema.Struct({
+    flowName: Schema.NonEmptyString,
+    executionId: Schema.NonEmptyString,
+    deferredName: Schema.NonEmptyString
+});
+/**
+ * The first durable completion recorded for a deferred.
+ *
+ * Correlation data remains opaque at this boundary. A future external-event
+ * layer owns its schema and authorization policy.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const DeferredRow = Schema.Struct({
+    ...DeferredAddress.fields,
+    exit: Schema.Unknown,
+    metadata: Schema.optionalKey(Schema.Unknown),
+    completedAtMs: NonNegativeSafeInt
+});
+/**
+ * The durable address of a clock.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const ClockAddress = Schema.Struct({
+    flowName: Schema.NonEmptyString,
+    executionId: Schema.NonEmptyString,
+    clockName: Schema.NonEmptyString
+});
+/**
+ * A durable absolute clock deadline.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const ClockRow = Schema.Struct({
+    ...ClockAddress.fields,
+    deferredName: Schema.NonEmptyString,
+    dueAtMs: NonNegativeSafeInt,
+    completedAtMs: Schema.NullOr(NonNegativeSafeInt)
+});
+/**
+ * The core wait-reason vocabulary a supervisor understands for wake policy.
+ *
+ * - `approval` — parked until a human (or policy) approves; woken by token.
+ * - `event` — parked on an external event / deferred completion.
+ * - `timer` — parked until `wakeAt`; woken by the durable clock sweep.
+ * - `quota` — parked on provider quota; woken at `wakeAt` when known.
+ * - `released` — the owning process released the run without settling it
+ *   (shutdown, heartbeat self-interrupt; issue #39). A released row has no
+ *   held lease and no `wakeAt`: any supervisor/sweeper MUST scan for this
+ *   reason explicitly and re-drive the run through the claim path, or
+ *   released runs are stranded forever (issue #67).
+ * - `quarantine` — parked because a SUCCEEDED attempt row's recorded
+ *   evidence measured corrupt under the strict verdict (issue #171). The
+ *   row cannot be evicted/re-executed like a cache row (its side effects
+ *   already ran), so the corrupt boundary evidence is quarantined off the
+ *   row while its durable outcome stays intact. No sweeper auto-wakes this
+ *   reason: the strict integrity verdict remains visible until an explicit
+ *   resume, which completes from the recorded outcome without re-execution.
+ *
+ * Left open (`string & {}`) so a plugin can park on a reason the core
+ * taxonomy has not named yet — the store persists whatever it is given
+ * rather than rejecting unknown reasons.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const WaitingReason = Schema.NonEmptyString;
+/**
+ * The payload recorded when a run parks.
+ *
+ * `reason` and `wakeAt` earn columns because a supervisor sweeper queries
+ * them (`WHERE waiting_reason = 'quota' AND waiting_wake_at_ms <= ?`);
+ * `token` is compare-and-swap/lookup material a wake handler matches
+ * against.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const Waiting = Schema.Struct({
+    reason: WaitingReason,
+    wakeAt: Schema.optional(NonNegativeSafeInt),
+    token: Schema.optional(Schema.NonEmptyString),
+    /**
+     * What the wait declared about itself: for a `HumanTask` park, the kind of
+     * answer it wants, the prompt, and the attempt budget.
+     *
+     * `reason` and `token` say that a person owes the run an answer and which
+     * wait point holds it. Neither says what was asked, and the question lives
+     * in an action payload of an execution that has released its owner, so a
+     * reader had nothing to render but the wait's own name. This is the question
+     * itself, as the JSON TEXT the declaring flow wrote, stored and cleared with
+     * the other waiting columns.
+     */
+    request: Schema.optional(Schema.String)
+});
+/**
+ * A decoded waiting row for a parked run.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const WaitingRow = Schema.Struct({
+    runId: Schema.NonEmptyString,
+    reason: WaitingReason,
+    wakeAt: Schema.NullOr(NonNegativeSafeInt),
+    token: Schema.NullOr(Schema.NonEmptyString),
+    /** The question {@link Waiting} declared, absent on a park that declared none. */
+    request: Schema.optionalKey(Schema.Json)
+});
+/**
+ * A durable parent edge in the run DAG.
+ *
+ * The run row's `state_json` carries only the first (creating) parent; a
+ * diamond gives a run a second parent the row cannot express. Cycle
+ * detection must see every edge from every owner process and across
+ * restarts (issues #40/#41), so edges are persisted here. `seq` is a
+ * store-global insertion order used only to list a run's parents oldest
+ * first (and to make the cycle walk deterministic); it no longer arbitrates
+ * anything, so duplicate values would be harmless (issues #54/#66).
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const RunParentEdge = Schema.Struct({
+    childId: Schema.NonEmptyString,
+    parentId: Schema.NonEmptyString,
+    seq: NonNegativeSafeInt
+});
+/**
+ * The surviving attempt rows of one action key: the earliest surviving
+ * row's start time and the highest attempt number contiguous from it.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export const AttemptSurvivors = Schema.Struct({
+    /**
+     * The lowest surviving attempt number. Anything above 1 means the prune
+     * job removed a leading run of attempts; the engine store applies the
+     * pruned-prefix tolerance to it so both survivor paths agree (issue #96).
+     */
+    earliestAttempt: NonNegativeSafeInt,
+    earliestStartedAtMs: NonNegativeSafeInt,
+    latest: NonNegativeSafeInt
+});
+/**
+ * Recording a parent edge would close a cycle in the run DAG.
+ *
+ * Raised from inside the same transaction that inserted the edge, which is
+ * rolled back: a rejected edge leaves no durable trace anywhere (issues
+ * #54/#55/#56). `path` lists execution ids from the child back to itself
+ * through its would-be ancestors, matching the engine's
+ * `FlowCycleDetected.path` shape.
+ *
+ * @since 0.1.0
+ * @category errors
+ */
+export class RunParentCycleError extends Schema.TaggedError()("@smthrs/engine-store/RunParentCycleError", {
+    path: Schema.Array(Schema.String)
+}) {
+}
+/**
+ * A durable engine-state invariant broke: a defect (a bug), never a typed
+ * failure.
+ *
+ * `value_not_serializable` and `value_not_decodable` name the JSON column
+ * (`field`) whose value could not be written or read back.
+ * `deferred_completion_missing` and `run_parent_edge_missing` mean a row a
+ * first-writer transaction just lost to was gone when read.
+ *
+ * @since 1.0.0
+ * @category errors
+ */
+export class EngineStateFault extends Schema.TaggedError()("@smthrs/engine-store/EngineStateFault", {
+    reason: Schema.Literals([
+        "value_not_serializable",
+        "value_not_decodable",
+        "deferred_completion_missing",
+        "run_parent_edge_missing"
+    ]),
+    field: Schema.optional(Schema.String),
+    cause: Schema.optional(Schema.Defect())
+}) {
+    get message() {
+        switch (this.reason) {
+            case "value_not_serializable":
+                return `${this.field} must be JSON-serializable`;
+            case "value_not_decodable":
+                return `could not decode ${this.field}`;
+            case "deferred_completion_missing":
+                return "deferred completion disappeared during first-writer transaction";
+            case "run_parent_edge_missing":
+                return "run parent edge disappeared during first-writer transaction";
+        }
+    }
+}
+/**
+ * Service tag for durable deferred completions and absolute clock deadlines.
+ *
+ * @since 0.1.0
+ * @category services
+ */
+export class DurableEngineState extends Context.Service()("@smthrs/engine-store/DurableEngineState") {
+}
+/** @private */
+const deferredKey = (address) => JSON.stringify([address.flowName, address.executionId, address.deferredName]);
+/** @private */
+const clockKey = (address) => JSON.stringify([address.flowName, address.executionId, address.clockName]);
+/** @private */
+const DeferredDatabaseRow = Schema.Struct({
+    ...DeferredAddress.fields,
+    exitJson: Schema.String,
+    metadataJson: Schema.NullOr(Schema.String),
+    completedAtMs: NonNegativeSafeInt
+});
+/** @private */
+const ClockDatabaseRow = Schema.Struct({
+    ...ClockAddress.fields,
+    deferredName: Schema.NonEmptyString,
+    dueAtMs: NonNegativeSafeInt,
+    completedAtMs: Schema.NullOr(NonNegativeSafeInt)
+});
+/** @private */
+const WaitingDatabaseRow = Schema.Struct({
+    runId: Schema.NonEmptyString,
+    waitingReason: WaitingReason,
+    waitingWakeAtMs: Schema.NullOr(NonNegativeSafeInt),
+    waitingToken: Schema.NullOr(Schema.NonEmptyString),
+    /** Absent rather than null on a database written before `0004_waiting_request`. */
+    waitingRequest: Schema.optional(Schema.NullOr(Schema.String))
+});
+/**
+ * The declared question of a waiting row, or absence.
+ *
+ * The column is the wait's own JSON, so text that does not parse is text the
+ * writer never wrote: it is reported as no declared question rather than
+ * failing the read of a park that is otherwise intact.
+ */
+const decodeWaitingRequest = (value) => {
+    if (value === null || value === undefined)
+        return {};
+    try {
+        return { request: JSON.parse(value) };
+    }
+    catch {
+        return {};
+    }
+};
+const decodeWaitingRow = (input) => decodeWaitingRowResult(input).pipe(Effect.orDie);
+/** {@link decodeWaitingRow} with its parse failure left in the error channel. */
+const decodeWaitingRowResult = (input) => Schema.decodeUnknownEffect(WaitingDatabaseRow)(input).pipe(Effect.map((row) => ({
+    runId: row.runId,
+    reason: row.waitingReason,
+    wakeAt: row.waitingWakeAtMs,
+    token: row.waitingToken,
+    ...decodeWaitingRequest(row.waitingRequest)
+})));
+/** @private */
+const RunParentDatabaseRow = Schema.Struct({
+    childId: Schema.NonEmptyString,
+    parentId: Schema.NonEmptyString,
+    seq: NonNegativeSafeInt
+});
+const decodeRunParentEdge = (input) => decodeRunParentEdgeResult(input).pipe(Effect.orDie);
+/** {@link decodeRunParentEdge} with its parse failure left in the error channel. */
+const decodeRunParentEdgeResult = (input) => Schema.decodeUnknownEffect(RunParentDatabaseRow)(input);
+/**
+ * Walks the parent chain upward from `parentId` over the durable edges,
+ * looking for `childId`. Returns the cycle path the new `(childId,
+ * parentId)` edge would close — ids from the child back to itself, matching
+ * the engine's `FlowCycleDetected.path` shape — or `undefined` when the
+ * edge is safe. A repeated id (pre-existing corrupt cycle written outside
+ * this API) terminates that branch instead of looping forever.
+ */
+const findCyclePath = (childId, parentId, parentsOf) => Effect.suspend(() => {
+    if (parentId === childId) {
+        return Effect.succeed([childId]);
+    }
+    const seen = new Set([parentId]);
+    const walk = (current, chain) => Effect.gen(function* () {
+        const parents = yield* parentsOf(current);
+        for (const parent of parents) {
+            if (parent === childId)
+                return [...chain, parent].reverse();
+            if (seen.has(parent))
+                continue;
+            seen.add(parent);
+            const found = yield* walk(parent, [...chain, parent]);
+            if (found !== undefined)
+                return found;
+        }
+        return undefined;
+    });
+    return walk(parentId, [parentId]);
+});
+/** @private */
+const DeferredAddressDatabaseRow = DeferredAddress;
+/** The digests of a stored completion row's encoded text. */
+const deferredDigest = (row) => ({
+    exit: contentDigest(row.exitJson),
+    metadata: row.metadataJson === null ? null : contentDigest(row.metadataJson)
+});
+/** The digests of a memory completion row, over the text the SQL store would keep. */
+const memoryDigest = (row) => Effect.gen(function* () {
+    const exitJson = yield* encodeJson(row.exit, "exit");
+    const metadataJson = row.metadata === undefined ? null : yield* encodeJson(row.metadata, "metadata");
+    return deferredDigest({ exitJson, metadataJson });
+});
+const encodeJson = (value, field) => Schema.encodeEffect(UnknownFromJsonString)(value).pipe(Effect.mapError((cause) => new EngineStateFault({ reason: "value_not_serializable", field, cause })), Effect.orDie);
+const decodeJson = (value, field) => Schema.decodeUnknownEffect(UnknownFromJsonString)(value).pipe(Effect.mapError((cause) => new EngineStateFault({ reason: "value_not_decodable", field, cause })), Effect.orDie);
+/**
+ * Rehydrates Effect's JSON representation after a storage round-trip.
+ *
+ * `Exit` and `Cause` deliberately serialize as plain JSON objects. Leaving a
+ * failure in that form is unsafe: the success branch happens to be rebuilt by
+ * `Exit.map`, while a plain failure is not an Exit and the deferred's schema
+ * rejects it after restart. Unknown non-Exit payloads remain untouched for
+ * the generic durable-state contract.
+ */
+const restoreJsonExit = (value) => {
+    if (typeof value !== "object" || value === null)
+        return value;
+    const record = value;
+    if (record["_id"] !== "Exit")
+        return value;
+    if (record["_tag"] === "Success")
+        return Exit.succeed(record["value"]);
+    if (record["_tag"] !== "Failure")
+        return value;
+    const cause = record["cause"];
+    if (typeof cause !== "object" || cause === null)
+        return value;
+    const failures = cause["failures"];
+    if (!Array.isArray(failures))
+        return value;
+    const reasons = [];
+    for (const failure of failures) {
+        if (typeof failure !== "object" || failure === null)
+            return value;
+        const reason = failure;
+        switch (reason["_tag"]) {
+            case "Fail":
+                reasons.push(Cause.makeFailReason(reason["error"]));
+                break;
+            case "Die":
+                reasons.push(Cause.makeDieReason(reason["defect"]));
+                break;
+            case "Interrupt":
+                reasons.push(Cause.makeInterruptReason(typeof reason["fiberId"] === "number" ? reason["fiberId"] : undefined));
+                break;
+            default:
+                return value;
+        }
+    }
+    return Exit.failCause(Cause.fromReasons(reasons));
+};
+const decodeDeferredRow = (input) => Schema.decodeUnknownEffect(DeferredDatabaseRow)(input).pipe(Effect.orDie, Effect.flatMap((row) => Effect.all({
+    exit: decodeJson(row.exitJson, "exit_json").pipe(Effect.map(restoreJsonExit)),
+    metadata: row.metadataJson === null
+        ? Effect.succeed(undefined)
+        : decodeJson(row.metadataJson, "metadata_json")
+}).pipe(Effect.map(({ exit, metadata }) => ({
+    flowName: row.flowName,
+    executionId: row.executionId,
+    deferredName: row.deferredName,
+    exit,
+    ...(metadata === undefined ? {} : { metadata }),
+    completedAtMs: row.completedAtMs
+})))));
+const decodeClockRow = (input) => decodeClockRowResult(input).pipe(Effect.orDie);
+/** {@link decodeClockRow} with its parse failure left in the error channel. */
+const decodeClockRowResult = (input) => Schema.decodeUnknownEffect(ClockDatabaseRow)(input).pipe(Effect.map((row) => ({
+    flowName: row.flowName,
+    executionId: row.executionId,
+    clockName: row.clockName,
+    deferredName: row.deferredName,
+    dueAtMs: row.dueAtMs,
+    completedAtMs: row.completedAtMs
+})));
+/** The primary key of a clock row, read defensively off a row that may not decode. */
+const clockRowKey = (row) => JSON.stringify([row["flowName"], row["executionId"], row["clockName"]]);
+/** The primary key of a deferred completion, read the same way. */
+const deferredAddressRowKey = (row) => JSON.stringify([row["flowName"], row["executionId"], row["deferredName"]]);
+/** The primary key of a run-parent edge, read the same way. */
+const runParentRowKey = (row) => JSON.stringify([row["childId"], row["parentId"]]);
+/**
+ * The deepest nesting {@link Service.waitingTree} walks.
+ *
+ * A run tree is authored, not generated: `agent/run` → `coding/request` →
+ * `coding/Request` → `coding/PrepareWithWiki` → `coding/PreparePlan` is five,
+ * and the deepest composition in this repository is well inside this. The cap
+ * exists so a tree whose edges were corrupted outside the engine costs a
+ * bounded read rather than the whole table.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const waitingTreeMaxDepth = 64;
+/** The primary key of a parked run's waiting payload, read the same way. */
+const waitingRowKey = (row) => JSON.stringify([row["runId"]]);
+/**
+ * Decodes the rows one durable-state sweep read, skipping — with a
+ * storage-integrity warning naming the row's key — any row that will not
+ * decode.
+ *
+ * Decoding the batch through `Effect.orDie` made one malformed row fatal for
+ * every row beside it: `completedDeferreds` and `pendingClocks` are what
+ * `register` sweeps, so a single unreadable row anywhere in a flow's history
+ * killed every registration of that flow, and no run of it ever resumed again.
+ * The blast radius of a corrupt row must be that row. The key is logged
+ * because it is what an operator needs to find and repair it, and it is read
+ * field by field off the raw row so a row that failed to decode can still name
+ * itself.
+ *
+ * Every enumeration goes through here for that reason, not just the two the
+ * outage named: `dueClocks`, `waitingRuns`, `runParents`, and `runChildren`
+ * each had their own version of it — no timer in the store fires, no parked
+ * run is ever swept, no cycle check can read a run's ancestry, no
+ * cancellation reaches a child.
+ *
+ * The point reads (`deferred`, `clock`, `waiting`) deliberately stay on
+ * `Effect.orDie`. They answer a question about ONE row, and their callers
+ * read "no row" as "this never happened": silently reporting that for a
+ * completion or deadline that is durably recorded but unreadable would
+ * re-run work whose side effects already ran. There the corrupt row IS the
+ * blast radius, so dying is the correct-sized failure.
+ */
+const decodeSweep = (rows, kind, keyOf, decode) => Effect.gen(function* () {
+    const decoded = [];
+    for (const row of rows) {
+        const result = yield* Effect.result(decode(row));
+        if (Result.isSuccess(result)) {
+            decoded.push(result.success);
+            continue;
+        }
+        yield* Effect.logWarning(`engine-store: skipping a malformed ${kind} row ${keyOf(row)}`, result.failure);
+    }
+    return decoded;
+});
+/**
+ * Demotes a write boundary's storage failures to defects, reason by reason.
+ *
+ * `transaction` declares the BODY's error type, and the shared writer adds
+ * `DatabaseError` to it. A sole storage failure is already a defect; a
+ * composite one used to be cast back through the declared channel, which let
+ * a raw `DatabaseError` surface as a typed failure of a type that never
+ * admits one. Re-channelling keeps the error object, its annotations, the
+ * other reasons and the interruptions intact while making the declared type
+ * true. Every other reason is passed through UNCHANGED rather than rebuilt,
+ * so a body failure keeps its own identity and spans.
+ */
+const dieOnDatabaseError = (cause) => Cause.fromReasons(cause.reasons.map((reason) => Cause.isFailReason(reason) && reason.error instanceof DatabaseError
+    ? Cause.makeDieReason(reason.error).annotate(Cause.reasonAnnotations(reason))
+    // Narrowing a generic union by `instanceof` is beyond the checker, but
+    // the guard above is the proof: what is left is a defect, an
+    // interruption, or a failure whose error is not a `DatabaseError`.
+    : reason));
+/**
+ * Constructs the database-backed durable-state implementation.
+ *
+ * Clock creation is fenced against the current run owner. Deferred completion
+ * and clock firing are external trigger admissions protected by first-writer
+ * and compare-and-set semantics; execution remains claim-gated by `RunStore`.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const make = Effect.gen(function* () {
+    const sql = yield* Effect.service(SqlClient.SqlClient);
+    const writer = yield* DurableWriter;
+    // Engine-store-owned storage created outside the journal migration
+    // (issues #40/#41/#79/#81). The statements, their rationale, and
+    // the dialects each is known to accept live in one machine-readable
+    // inventory so the pg-porting plan cannot omit them (issue #92).
+    yield* EngineStateSchema.apply(sql, writer);
+    const selectDeferred = (address) => sql `
+      SELECT
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        deferred_name AS "deferredName",
+        exit_json AS "exitJson",
+        metadata_json AS "metadataJson",
+        completed_at_ms AS "completedAtMs"
+      FROM flows_deferred_completions
+      WHERE flow_name = ${address.flowName}
+        AND execution_id = ${address.executionId}
+        AND deferred_name = ${address.deferredName}
+    `;
+    const selectClock = (address) => sql `
+      SELECT
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        clock_name AS "clockName",
+        deferred_name AS "deferredName",
+        due_at_ms AS "dueAtMs",
+        completed_at_ms AS "completedAtMs"
+      FROM flows_clock_deadlines
+      WHERE flow_name = ${address.flowName}
+        AND execution_id = ${address.executionId}
+        AND clock_name = ${address.clockName}
+    `;
+    const deferred = Effect.fn("DurableEngineState.deferred")((address) => selectDeferred(address).pipe(Effect.orDie, Effect.flatMap((rows) => rows[0] === undefined
+        ? Effect.succeedNone
+        : Effect.map(decodeDeferredRow(rows[0]), Option.some))));
+    const consumeDeferred = Effect.fn("DurableEngineState.consumeDeferred")((address, consumedAtMs) => writer.write(sql `
+      UPDATE flows_deferred_completions
+      SET consumed_at_ms = ${consumedAtMs}
+      WHERE flow_name = ${address.flowName}
+        AND execution_id = ${address.executionId}
+        AND deferred_name = ${address.deferredName}
+        AND consumed_at_ms IS NULL
+      RETURNING flow_name AS "flowName"
+    `).pipe(Effect.orDie, Effect.map((rows) => rows.length > 0)));
+    const completeDeferred = Effect.fn("DurableEngineState.completeDeferred")((row) => Effect.gen(function* () {
+        const exitJson = yield* encodeJson(row.exit, "exit");
+        const metadataJson = row.metadata === undefined
+            ? null
+            : yield* encodeJson(row.metadata, "metadata");
+        return yield* writer.write(Effect.gen(function* () {
+            const inserted = yield* sql `
+            INSERT INTO flows_deferred_completions (
+              flow_name,
+              execution_id,
+              deferred_name,
+              exit_json,
+              metadata_json,
+              completed_at_ms
+            ) VALUES (
+              ${row.flowName},
+              ${row.executionId},
+              ${row.deferredName},
+              ${exitJson},
+              ${metadataJson},
+              ${row.completedAtMs}
+            )
+            ON CONFLICT (flow_name, execution_id, deferred_name) DO NOTHING
+            RETURNING
+              flow_name AS "flowName",
+              execution_id AS "executionId",
+              deferred_name AS "deferredName",
+              exit_json AS "exitJson",
+              metadata_json AS "metadataJson",
+              completed_at_ms AS "completedAtMs"
+          `;
+            if (inserted[0] !== undefined) {
+                return {
+                    _tag: "Completed",
+                    row: yield* decodeDeferredRow(inserted[0]),
+                    digest: deferredDigest(inserted[0])
+                };
+            }
+            const existing = yield* selectDeferred(row);
+            if (existing[0] === undefined) {
+                return yield* Effect.die(new EngineStateFault({ reason: "deferred_completion_missing" }));
+            }
+            return {
+                _tag: "Existing",
+                row: yield* decodeDeferredRow(existing[0]),
+                digest: deferredDigest(existing[0])
+            };
+        })).pipe(Effect.orDie);
+    }));
+    const clock = Effect.fn("DurableEngineState.clock")((address) => selectClock(address).pipe(Effect.orDie, Effect.flatMap((rows) => rows[0] === undefined
+        ? Effect.succeedNone
+        : Effect.map(decodeClockRow(rows[0]), Option.some))));
+    const scheduleClock = Effect.fn("DurableEngineState.scheduleClock")((row, owner) => writer.write(Effect.gen(function* () {
+        const inserted = yield* sql `
+          INSERT INTO flows_clock_deadlines (
+            flow_name,
+            execution_id,
+            clock_name,
+            deferred_name,
+            due_at_ms,
+            completed_at_ms
+          )
+          SELECT
+            ${row.flowName},
+            ${row.executionId},
+            ${row.clockName},
+            ${row.deferredName},
+            ${row.dueAtMs},
+            ${row.completedAtMs}
+          WHERE EXISTS (
+            SELECT 1
+            FROM flows_runs
+            WHERE run_id = ${row.executionId}
+              AND status = 'running'
+              AND owner_host_id = ${owner.hostId}
+              AND owner_pid = ${owner.pid}
+              AND owner_nonce = ${owner.nonce}
+          )
+          ON CONFLICT (flow_name, execution_id, clock_name) DO NOTHING
+          RETURNING
+            flow_name AS "flowName",
+            execution_id AS "executionId",
+            clock_name AS "clockName",
+            deferred_name AS "deferredName",
+            due_at_ms AS "dueAtMs",
+            completed_at_ms AS "completedAtMs"
+        `;
+        if (inserted[0] !== undefined) {
+            return {
+                _tag: "Scheduled",
+                row: yield* decodeClockRow(inserted[0])
+            };
+        }
+        const existing = yield* selectClock(row);
+        if (existing[0] !== undefined) {
+            return {
+                _tag: "Existing",
+                row: yield* decodeClockRow(existing[0])
+            };
+        }
+        return yield* Effect.interrupt;
+    })).pipe(Effect.orDie));
+    const completeClock = Effect.fn("DurableEngineState.completeClock")((address, completedAtMs) => writer.write(Effect.gen(function* () {
+        const updated = yield* sql `
+          UPDATE flows_clock_deadlines
+          SET completed_at_ms = ${completedAtMs}
+          WHERE flow_name = ${address.flowName}
+            AND execution_id = ${address.executionId}
+            AND clock_name = ${address.clockName}
+            AND completed_at_ms IS NULL
+          RETURNING
+            flow_name AS "flowName",
+            execution_id AS "executionId",
+            clock_name AS "clockName",
+            deferred_name AS "deferredName",
+            due_at_ms AS "dueAtMs",
+            completed_at_ms AS "completedAtMs"
+        `;
+        if (updated[0] !== undefined) {
+            return {
+                _tag: "Completed",
+                row: yield* decodeClockRow(updated[0])
+            };
+        }
+        const existing = yield* selectClock(address);
+        return existing[0] === undefined
+            ? { _tag: "NotFound" }
+            : {
+                _tag: "AlreadyCompleted",
+                row: yield* decodeClockRow(existing[0])
+            };
+    })).pipe(Effect.orDie));
+    const dueClocks = Effect.fn("DurableEngineState.dueClocks")((nowMs) => sql `
+      SELECT
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        clock_name AS "clockName",
+        deferred_name AS "deferredName",
+        due_at_ms AS "dueAtMs",
+        completed_at_ms AS "completedAtMs"
+      FROM flows_clock_deadlines
+      WHERE completed_at_ms IS NULL
+        AND due_at_ms <= ${nowMs}
+      ORDER BY due_at_ms, execution_id, clock_name
+    `.pipe(Effect.orDie, 
+    // This is the whole store's due-timer sweep: dying on one unreadable
+    // deadline stopped every timer in every flow from firing.
+    Effect.flatMap((rows) => decodeSweep(rows, "clock deadline", clockRowKey, decodeClockRowResult))));
+    const pendingClocks = Effect.fn("DurableEngineState.pendingClocks")((scope) => (scope.executionId !== undefined
+        ? sql `
+      SELECT
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        clock_name AS "clockName",
+        deferred_name AS "deferredName",
+        due_at_ms AS "dueAtMs",
+        completed_at_ms AS "completedAtMs"
+      FROM flows_clock_deadlines
+      WHERE completed_at_ms IS NULL
+        AND execution_id = ${scope.executionId}
+        AND ${scope.flowName === undefined ? sql `1 = 1` : sql `flow_name = ${scope.flowName}`}
+        AND EXISTS (
+          SELECT 1 FROM flows_runs
+          WHERE flows_runs.run_id = flows_clock_deadlines.execution_id
+            AND flows_runs.status NOT IN ('completed', 'failed', 'cancelled')
+        )
+      ORDER BY due_at_ms, execution_id, clock_name
+    `
+        : scope.flowName !== undefined
+            ? sql `
+      SELECT
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        clock_name AS "clockName",
+        deferred_name AS "deferredName",
+        due_at_ms AS "dueAtMs",
+        completed_at_ms AS "completedAtMs"
+      FROM flows_clock_deadlines
+      WHERE completed_at_ms IS NULL
+        AND flow_name = ${scope.flowName}
+        AND EXISTS (
+          SELECT 1 FROM flows_runs
+          WHERE flows_runs.run_id = flows_clock_deadlines.execution_id
+            AND flows_runs.status NOT IN ('completed', 'failed', 'cancelled')
+        )
+      ORDER BY due_at_ms, execution_id, clock_name
+    `
+            : sql `
+      SELECT
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        clock_name AS "clockName",
+        deferred_name AS "deferredName",
+        due_at_ms AS "dueAtMs",
+        completed_at_ms AS "completedAtMs"
+      FROM flows_clock_deadlines
+      WHERE completed_at_ms IS NULL
+        AND EXISTS (
+          SELECT 1 FROM flows_runs
+          WHERE flows_runs.run_id = flows_clock_deadlines.execution_id
+            AND flows_runs.status NOT IN ('completed', 'failed', 'cancelled')
+        )
+      ORDER BY due_at_ms, execution_id, clock_name
+    `).pipe(Effect.orDie, 
+    // A row that will not decode is a storage-integrity event about that
+    // row. Dying here made one of them fatal for the whole sweep, and so
+    // for `register` itself (issue B-08).
+    Effect.flatMap((rows) => decodeSweep(rows, "clock deadline", clockRowKey, decodeClockRowResult))));
+    const completedDeferreds = Effect.fn("DurableEngineState.completedDeferreds")((flowName) => sql `
+      SELECT
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        deferred_name AS "deferredName"
+      FROM flows_deferred_completions
+      WHERE flow_name = ${flowName}
+        AND consumed_at_ms IS NULL
+        AND EXISTS (
+          SELECT 1 FROM flows_runs
+          WHERE flows_runs.run_id = flows_deferred_completions.execution_id
+            AND flows_runs.status NOT IN ('completed', 'failed', 'cancelled')
+        )
+      ORDER BY execution_id, deferred_name
+    `.pipe(Effect.orDie, Effect.flatMap((rows) => decodeSweep(rows, "deferred completion", deferredAddressRowKey, (row) => Schema.decodeUnknownEffect(DeferredAddressDatabaseRow)(row)))));
+    const completeRunClocks = Effect.fn("DurableEngineState.completeRunClocks")((executionId, completedAtMs) => writer.write(sql `
+      UPDATE flows_clock_deadlines
+      SET completed_at_ms = ${completedAtMs}
+      WHERE execution_id = ${executionId}
+        AND completed_at_ms IS NULL
+      RETURNING
+        flow_name AS "flowName",
+        execution_id AS "executionId",
+        clock_name AS "clockName",
+        deferred_name AS "deferredName",
+        due_at_ms AS "dueAtMs",
+        completed_at_ms AS "completedAtMs"
+    `).pipe(Effect.orDie, Effect.flatMap((rows) => Effect.forEach(rows, decodeClockRow)), Effect.map((rows) => [...rows].sort((left, right) => compareText(left.flowName, right.flowName) || compareText(left.clockName, right.clockName)))));
+    const selectWaiting = (runId) => sql `
+      SELECT
+        run_id AS "runId",
+        waiting_reason AS "waitingReason",
+        waiting_wake_at_ms AS "waitingWakeAtMs",
+        waiting_token AS "waitingToken",
+        waiting_request AS "waitingRequest"
+      FROM flows_runs
+      WHERE run_id = ${runId}
+        AND waiting_reason IS NOT NULL
+    `;
+    const park = Effect.fn("DurableEngineState.park")((runId, waiting, owner) => writer.write(Effect.gen(function* () {
+        const updated = yield* sql `
+          UPDATE flows_runs
+          SET
+            waiting_reason = ${waiting.reason},
+            waiting_wake_at_ms = ${waiting.wakeAt ?? null},
+            waiting_token = ${waiting.token ?? null},
+            waiting_request = ${waiting.request ?? null}
+          WHERE run_id = ${runId}
+            AND owner_host_id = ${owner.hostId}
+            AND owner_pid = ${owner.pid}
+            AND owner_nonce = ${owner.nonce}
+          RETURNING
+            run_id AS "runId",
+            waiting_reason AS "waitingReason",
+            waiting_wake_at_ms AS "waitingWakeAtMs",
+            waiting_token AS "waitingToken",
+            waiting_request AS "waitingRequest"
+        `;
+        if (updated[0] === undefined) {
+            return { _tag: "NotFound" };
+        }
+        return { _tag: "Parked", row: yield* decodeWaitingRow(updated[0]) };
+    })).pipe(Effect.orDie));
+    const wake = Effect.fn("DurableEngineState.wake")((runId) => writer.write(Effect.gen(function* () {
+        const before = yield* selectWaiting(runId);
+        if (before[0] === undefined) {
+            const existing = yield* sql `
+            SELECT run_id AS "runId" FROM flows_runs WHERE run_id = ${runId}
+          `;
+            return existing[0] === undefined ? { _tag: "NotFound" } : { _tag: "NotWaiting" };
+        }
+        const row = yield* decodeWaitingRow(before[0]);
+        yield* sql `
+          UPDATE flows_runs
+          SET
+            waiting_reason = NULL,
+            waiting_wake_at_ms = NULL,
+            waiting_token = NULL,
+            waiting_request = NULL
+          WHERE run_id = ${runId}
+            AND waiting_reason IS NOT NULL
+        `;
+        return { _tag: "Woken", row };
+    })).pipe(Effect.orDie));
+    const waiting = Effect.fn("DurableEngineState.waiting")((runId) => selectWaiting(runId).pipe(Effect.orDie, Effect.flatMap((rows) => rows[0] === undefined
+        ? Effect.succeedNone
+        : Effect.map(decodeWaitingRow(rows[0]), Option.some))));
+    /**
+     * Every open wait in one run tree, the named run's own first.
+     *
+     * Walk the authoritative spawn and trampoline edges. UNION visits each
+     * (run, depth) pair once; the depth cap bounds even externally corrupted
+     * cycles. Grouping by run afterwards collapses unequal-depth DAG paths
+     * and orders each wait at its shortest attached distance from the root.
+     * Correlated edge lookups seek each parent's indexes instead of building
+     * an edge set from the database's entire execution history.
+     */
+    const waitingTree = Effect.fn("DurableEngineState.waitingTree")((runId, options) => sql `
+      WITH RECURSIVE tree(run_id, depth) AS (
+        SELECT run_id, 0 FROM flows_runs WHERE run_id = ${runId}
+        UNION
+        SELECT child.run_id, tree.depth + 1
+        FROM tree
+        JOIN flows_runs child ON child.run_id IN (
+          SELECT child_id FROM flows_run_parents WHERE parent_id = tree.run_id
+          UNION ALL
+          SELECT run_id FROM flows_runs WHERE parent_run_id = tree.run_id
+        )
+        WHERE tree.depth < ${waitingTreeMaxDepth}
+          AND (${options?.detached === "include" ? 1 : 0} = 1
+            OR child.parent_run_id = tree.run_id
+            OR COALESCE(${Dialect.jsonText(sql, sql `child.state_json`, "$.onParentExit")}, 'cancel') <> 'detach')
+      ), reachable(run_id, depth) AS (
+        SELECT run_id, MIN(depth) FROM tree GROUP BY run_id
+      )
+      SELECT
+        parked.run_id AS "runId",
+        parked.waiting_reason AS "waitingReason",
+        parked.waiting_wake_at_ms AS "waitingWakeAtMs",
+        parked.waiting_token AS "waitingToken",
+        parked.waiting_request AS "waitingRequest"
+      FROM reachable
+      JOIN flows_runs parked ON parked.run_id = reachable.run_id
+      WHERE parked.waiting_reason IS NOT NULL
+        AND parked.status NOT IN ('completed', 'failed', 'cancelled')
+      ORDER BY reachable.depth, parked.created_at_ms, parked.run_id
+    `.pipe(Effect.orDie, Effect.flatMap((rows) => decodeSweep(rows, "waiting run", waitingRowKey, decodeWaitingRowResult))));
+    const waitingRuns = Effect.fn("DurableEngineState.waitingRuns")((filter) => {
+        // `1 = 0` short-circuits the cancel predicate away when the caller did
+        // not ask for it, so the reason/wake filters (and the 0004 index) stay
+        // the leading predicates (issue #68).
+        const cancelRequestedOnly = filter?.cancelRequested === true ? 1 : 0;
+        return (filter?.reason !== undefined && filter.dueBeforeMs !== undefined
+            ? sql `
+        SELECT
+          run_id AS "runId",
+          waiting_reason AS "waitingReason",
+          waiting_wake_at_ms AS "waitingWakeAtMs",
+          waiting_token AS "waitingToken",
+          waiting_request AS "waitingRequest"
+        FROM flows_runs
+        WHERE waiting_reason = ${filter.reason}
+          AND waiting_wake_at_ms IS NOT NULL
+          AND waiting_wake_at_ms <= ${filter.dueBeforeMs}
+          AND (${cancelRequestedOnly} = 0 OR cancel_requested_at_ms IS NOT NULL)
+          AND status NOT IN ('completed', 'failed', 'cancelled')
+        ORDER BY waiting_wake_at_ms, run_id
+      `
+            : filter?.reason !== undefined
+                ? sql `
+        SELECT
+          run_id AS "runId",
+          waiting_reason AS "waitingReason",
+          waiting_wake_at_ms AS "waitingWakeAtMs",
+          waiting_token AS "waitingToken",
+          waiting_request AS "waitingRequest"
+        FROM flows_runs
+        WHERE waiting_reason = ${filter.reason}
+          AND (${cancelRequestedOnly} = 0 OR cancel_requested_at_ms IS NOT NULL)
+          AND status NOT IN ('completed', 'failed', 'cancelled')
+        ORDER BY waiting_wake_at_ms IS NULL, waiting_wake_at_ms, run_id
+      `
+                : filter?.dueBeforeMs !== undefined
+                    ? sql `
+        SELECT
+          run_id AS "runId",
+          waiting_reason AS "waitingReason",
+          waiting_wake_at_ms AS "waitingWakeAtMs",
+          waiting_token AS "waitingToken",
+          waiting_request AS "waitingRequest"
+        FROM flows_runs
+        WHERE waiting_reason IS NOT NULL
+          AND waiting_wake_at_ms IS NOT NULL
+          AND waiting_wake_at_ms <= ${filter.dueBeforeMs}
+          AND (${cancelRequestedOnly} = 0 OR cancel_requested_at_ms IS NOT NULL)
+          AND status NOT IN ('completed', 'failed', 'cancelled')
+        ORDER BY waiting_wake_at_ms, run_id
+      `
+                    : sql `
+        SELECT
+          run_id AS "runId",
+          waiting_reason AS "waitingReason",
+          waiting_wake_at_ms AS "waitingWakeAtMs",
+          waiting_token AS "waitingToken",
+          waiting_request AS "waitingRequest"
+        FROM flows_runs
+        WHERE waiting_reason IS NOT NULL
+          AND (${cancelRequestedOnly} = 0 OR cancel_requested_at_ms IS NOT NULL)
+          AND status NOT IN ('completed', 'failed', 'cancelled')
+        ORDER BY waiting_wake_at_ms IS NULL, waiting_wake_at_ms, run_id
+      `).pipe(Effect.orDie, 
+        // The parked-run sweeper's only enumeration: one unreadable waiting
+        // payload stranded every parked run, including the ones whose
+        // cancellation had already been requested.
+        Effect.flatMap((rows) => decodeSweep(rows, "waiting run", waitingRowKey, decodeWaitingRowResult)));
+    });
+    const pendingRows = (flowName, limit, after, through, descending = false, eligibleBeforeMs) => sql `
+      SELECT run_id AS "runId", created_at_ms AS "createdAtMs" FROM flows_runs
+        ${Dialect.isPostgres(sql) ? sql `` : sql `INDEXED BY flows_runs_listing_3`}
+      WHERE status = 'pending'
+        AND ${eligibleBeforeMs === undefined ? sql `TRUE` : sql `created_at_ms < ${eligibleBeforeMs}`}
+        AND execution_flow = ${flowName}
+        AND ${after === undefined ? sql `TRUE` : sql `(
+          created_at_ms > ${after.createdAtMs}
+          OR (created_at_ms = ${after.createdAtMs} AND run_id > ${after.runId})
+        )`}
+        AND ${through === undefined ? sql `TRUE` : sql `(
+          created_at_ms < ${through.createdAtMs}
+          OR (created_at_ms = ${through.createdAtMs} AND run_id <= ${through.runId})
+        )`}
+      ORDER BY ${descending ? sql `created_at_ms DESC, run_id DESC` : sql `created_at_ms, run_id`}
+      LIMIT ${limit ?? (Dialect.isPostgres(sql) ? null : -1)}
+    `.pipe(Effect.orDie, Effect.map((rows) => rows.map((row) => ({ runId: row.runId, createdAtMs: Number(row.createdAtMs) }))));
+    const pendingRuns = Effect.fn("DurableEngineState.pendingRuns")((flowName, limit, after, through, eligibleBeforeMs) => pendingRows(flowName, limit, after, through, false, eligibleBeforeMs));
+    const pendingRunTail = Effect.fn("DurableEngineState.pendingRunTail")((flowName, eligibleBeforeMs) => pendingRows(flowName, 1, undefined, undefined, true, eligibleBeforeMs).pipe(Effect.map((rows) => Option.fromNullishOr(rows[0]))));
+    const pendingCancellationRows = (limit, after, through, descending = false) => pendingCancellationLimit(limit).pipe(Effect.andThen(sql `
+      SELECT run_id AS "runId", created_at_ms AS "createdAtMs" FROM flows_runs
+        ${Dialect.isPostgres(sql) ? sql `` : sql `INDEXED BY flows_runs_pending_cancel_idx`}
+      WHERE status = 'pending' AND cancel_requested_at_ms IS NOT NULL
+        AND ${after === undefined ? sql `TRUE` : sql `(created_at_ms, run_id) > (${after.createdAtMs}, ${after.runId})`}
+        AND ${through === undefined ? sql `TRUE` : sql `(created_at_ms, run_id) <= (${through.createdAtMs}, ${through.runId})`}
+      ORDER BY ${descending ? sql `created_at_ms DESC, run_id DESC` : sql `created_at_ms, run_id`}
+      LIMIT ${limit}
+    `.pipe(Effect.orDie, Effect.map((rows) => rows.map((row) => ({ runId: row.runId, createdAtMs: Number(row.createdAtMs) }))))));
+    const pendingCancellationRuns = Effect.fn("DurableEngineState.pendingCancellationRuns")((limit, after, through) => pendingCancellationRows(limit, after, through));
+    const pendingCancellationTail = Effect.fn("DurableEngineState.pendingCancellationTail")(() => pendingCancellationRows(1, undefined, undefined, true).pipe(Effect.map((rows) => Option.fromNullishOr(rows[0]))));
+    const staleRunningRuns = Effect.fn("DurableEngineState.staleRunningRuns")((staleBeforeMs, limit) => 
+    // `LIMIT -1` is SQLite's explicit "no limit"; the partial index created
+    // in `make` serves the predicate, so the per-tick sweep is an index
+    // range read instead of a full table scan (issue #79).
+    sql `
+      SELECT run_id AS "runId", heartbeat_at_ms AS "heartbeatAtMs"
+      FROM flows_runs
+      WHERE status = 'running'
+        AND heartbeat_at_ms IS NOT NULL
+        AND heartbeat_at_ms < ${staleBeforeMs}
+      ORDER BY heartbeat_at_ms, run_id
+      LIMIT ${limit ?? (Dialect.isPostgres(sql) ? null : -1)}
+    `.pipe(Effect.orDie, Effect.map((rows) => rows.map((row) => ({ runId: String(row.runId), heartbeatAtMs: Number(row.heartbeatAtMs) })))));
+    /**
+     * One ordered range read replaces the engine store's per-attempt point
+     * probes (issue #77): a fresh key costs one empty SELECT instead of 32
+     * sequential gets, and a resumed key one SELECT instead of one per
+     * surviving attempt. The earliest surviving row is the durable retry
+     * origin (issue #69) and the highest attempt contiguous from it the
+     * resumed counter (issue #59). This read is deliberately unbounded; the
+     * pruned-prefix tolerance that makes it agree with the point-probe
+     * fallback is applied once, by the caller, in
+     * `internal/AttemptProbe.probeAttempts` (issue #96).
+     */
+    const attemptSurvivors = Effect.fn("DurableEngineState.attemptSurvivors")((runId, stepKeyDigest) => sql `
+      SELECT attempt AS "attempt", started_at_ms AS "startedAtMs"
+      FROM flows_attempts
+      WHERE run_id = ${runId}
+        AND step_key_digest = ${stepKeyDigest}
+      ORDER BY attempt
+    `.pipe(Effect.orDie, Effect.map((rows) => {
+        const first = rows[0];
+        if (first === undefined)
+            return Option.none();
+        let latest = Number(first.attempt);
+        for (let index = 1; index < rows.length; index++) {
+            const next = Number(rows[index].attempt);
+            if (next !== latest + 1)
+                break;
+            latest = next;
+        }
+        return Option.some({
+            earliestAttempt: Number(first.attempt),
+            earliestStartedAtMs: Number(first.startedAtMs),
+            latest
+        });
+    })));
+    const selectRunParent = (childId, parentId) => sql `
+      SELECT
+        child_id AS "childId",
+        parent_id AS "parentId",
+        seq AS "seq"
+      FROM flows_run_parents
+      WHERE child_id = ${childId}
+        AND parent_id = ${parentId}
+    `;
+    const parentIdsOf = (id) => sql `
+      SELECT
+        child_id AS "childId",
+        parent_id AS "parentId",
+        seq AS "seq"
+      FROM flows_run_parents
+      WHERE child_id = ${id}
+      ORDER BY seq
+    `.pipe(Effect.orDie, Effect.map((rows) => rows.map((row) => String(row.parentId))));
+    const recordRunParent = Effect.fn("DurableEngineState.recordRunParent")((childId, parentId) => writer.write(Effect.gen(function* () {
+        // MAX(seq)+1 and the insert share one write transaction, so the
+        // assigned seq is a total insertion order over the store.
+        const inserted = yield* sql `
+          INSERT INTO flows_run_parents (child_id, parent_id, seq)
+          SELECT ${childId}, ${parentId}, COALESCE(MAX(seq), 0) + 1
+          FROM flows_run_parents
+          WHERE TRUE
+          ON CONFLICT (child_id, parent_id) DO NOTHING
+          RETURNING
+            child_id AS "childId",
+            parent_id AS "parentId",
+            seq AS "seq"
+        `;
+        if (inserted[0] !== undefined) {
+            // The cycle check shares the insert's transaction: a hit fails the
+            // effect, rolling the insert back, so a rejected edge is never
+            // durable and there is no check-then-record window for another
+            // writer to slip through (issues #54/#55/#56). The insert
+            // precedes the walk, so the transaction holds the write lock
+            // while walking: under `DurableWriter.write`'s documented contract —
+            // write transactions are mutually serialized (issue #74) — of two
+            // edges that jointly close a cycle, exactly the later one fails.
+            // This is a contract requirement, not a SQLite artifact; a
+            // backend that ran writes at READ COMMITTED would break it and is
+            // excluded by the DurableWriter contract.
+            const cycle = yield* findCyclePath(childId, parentId, parentIdsOf);
+            if (cycle !== undefined) {
+                return yield* Effect.fail(new RunParentCycleError({ path: cycle }));
+            }
+            return {
+                _tag: "Recorded",
+                edge: yield* decodeRunParentEdge(inserted[0])
+            };
+        }
+        const existing = yield* selectRunParent(childId, parentId);
+        if (existing[0] === undefined) {
+            return yield* Effect.die(new EngineStateFault({ reason: "run_parent_edge_missing" }));
+        }
+        return {
+            _tag: "Existing",
+            edge: yield* decodeRunParentEdge(existing[0])
+        };
+    })).pipe(Effect.catch((error) => error instanceof RunParentCycleError ? Effect.fail(error) : Effect.die(error))));
+    const removeRunParentsForRun = Effect.fn("DurableEngineState.removeRunParentsForRun")((runId) => writer.write(sql `
+      DELETE FROM flows_run_parents
+      WHERE child_id = ${runId}
+        OR parent_id = ${runId}
+    `).pipe(Effect.orDie, Effect.asVoid));
+    // Keep state-first ordering. This gate and DurableWriter's shared permit are
+    // both taken at the caller's interruptibility, so an interruptible caller can
+    // still be cancelled while queued, including behind a journal-only write that
+    // skips this gate.
+    // A nested SQL transaction already owns the connection and bypasses this gate.
+    const transactionGate = Semaphore.makeUnsafe(1);
+    const transaction = (effect) => Effect.flatMap(Effect.serviceOption(sql.transactionService), (enclosing) => {
+        const write = (body) => writer.write(body).pipe(Effect.catchCause((cause) => {
+            // Only a sole storage failure is normalized. A composite keeps every
+            // reason for the caller to diagnose, and its storage failures are
+            // demoted to defects one by one rather than cast through the
+            // declared error type: `transaction` promises the BODY's failures,
+            // so a `DatabaseError` arriving as a typed failure would be a lie
+            // the compiler could not catch. Defect identity is unchanged.
+            if (cause.reasons.length === 1) {
+                const reason = cause.reasons[0];
+                if (Cause.isFailReason(reason) && reason.error instanceof DatabaseError) {
+                    return Effect.die(reason.error);
+                }
+            }
+            return Effect.failCause(dieOnDatabaseError(cause));
+        }));
+        if (Option.isSome(enclosing))
+            return write(effect);
+        return Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+            yield* restore(transactionGate.take(1));
+            let released = false;
+            const release = Effect.suspend(() => {
+                if (released)
+                    return Effect.void;
+                released = true;
+                return transactionGate.release(1).pipe(Effect.asVoid);
+            });
+            return yield* restore(write(Effect.gen(function* () {
+                // Release at COMMIT, before publication can read through another
+                // transaction. A failed write instead releases in ensuring below.
+                yield* afterCommit(release, sql);
+                return yield* effect;
+            }))).pipe(Effect.ensuring(release));
+        }));
+    });
+    const runParents = Effect.fn("DurableEngineState.runParents")((childId) => sql `
+      SELECT
+        child_id AS "childId",
+        parent_id AS "parentId",
+        seq AS "seq"
+      FROM flows_run_parents
+      WHERE child_id = ${childId}
+      ORDER BY seq
+    `.pipe(Effect.orDie, 
+    // One unreadable edge made a run's whole ancestry unreadable, so no
+    // subflow under it could be linked at all.
+    Effect.flatMap((rows) => decodeSweep(rows, "run parent", runParentRowKey, decodeRunParentEdgeResult))));
+    const runChildren = Effect.fn("DurableEngineState.runChildren")((parentId) => sql `
+      SELECT
+        child_id AS "childId",
+        parent_id AS "parentId",
+        seq AS "seq"
+      FROM flows_run_parents
+      WHERE parent_id = ${parentId}
+      ORDER BY seq
+    `.pipe(Effect.orDie, 
+    // The cancellation cascade's only cross-process way to find a run's
+    // children: one unreadable sibling edge left every child running after
+    // its parent was cancelled.
+    Effect.flatMap((rows) => decodeSweep(rows, "run parent", runParentRowKey, decodeRunParentEdgeResult))));
+    return DurableEngineState.of({
+        deferred,
+        consumeDeferred,
+        completeDeferred,
+        clock,
+        scheduleClock,
+        completeClock,
+        completeRunClocks,
+        dueClocks,
+        pendingClocks,
+        completedDeferreds,
+        park,
+        wake,
+        waiting,
+        waitingTree,
+        waitingRuns,
+        pendingRuns,
+        pendingRunTail,
+        pendingCancellationRuns,
+        pendingCancellationTail,
+        staleRunningRuns,
+        attemptSurvivors,
+        recordRunParent,
+        removeRunParentsForRun,
+        runParents,
+        runChildren,
+        transaction
+    });
+});
+/**
+ * Provides database-backed durable engine state.
+ *
+ * @since 0.1.0
+ * @category layers
+ */
+export const layer = Layer.effect(DurableEngineState, make);
+/**
+ * Constructs a deterministic in-memory durable-state implementation.
+ *
+ * The returned service can be shared by multiple fresh engine instances in a
+ * test to model process restart over the same storage. With `runs` supplied
+ * it enforces the same ownership fences as the SQL implementation and is
+ * held to the same contract suite
+ * (`test/contract/DurableEngineStateContract.ts`).
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const makeMemory = (options = {}) => {
+    const deferreds = new Map();
+    const consumedDeferreds = new Map();
+    const clocks = new Map();
+    const waitingRows = new Map();
+    // childId -> (parentId -> seq); `parentSeq` mirrors the SQL MAX(seq)+1.
+    const parentEdges = new Map();
+    let parentSeq = 0;
+    const snapshotDeferred = (row) => Schema.decodeUnknownEffect(DeferredRow)(row).pipe(Effect.orDie, Effect.flatMap((decoded) => Effect.all({
+        exitJson: encodeJson(decoded.exit, "exit"),
+        metadataJson: decoded.metadata === undefined
+            ? Effect.succeed(null)
+            : encodeJson(decoded.metadata, "metadata")
+    }).pipe(Effect.flatMap(({ exitJson, metadataJson }) => decodeDeferredRow({
+        flowName: decoded.flowName,
+        executionId: decoded.executionId,
+        deferredName: decoded.deferredName,
+        exitJson,
+        metadataJson,
+        completedAtMs: decoded.completedAtMs
+    })))));
+    const snapshotClock = (row) => Schema.decodeUnknownEffect(ClockRow)(row).pipe(Effect.orDie, Effect.map((decoded) => ({ ...decoded })));
+    const snapshotWaiting = (row) => ({ ...row });
+    /** The synchronous twin of `findCyclePath` over the in-memory edge map. */
+    const findCyclePathSync = (childId, parentId) => {
+        if (parentId === childId)
+            return [childId];
+        const seen = new Set([parentId]);
+        const walk = (current, chain) => {
+            for (const parent of parentEdges.get(current)?.keys() ?? []) {
+                if (parent === childId)
+                    return [...chain, parent].reverse();
+                if (seen.has(parent))
+                    continue;
+                seen.add(parent);
+                const found = walk(parent, [...chain, parent]);
+                if (found !== undefined)
+                    return found;
+            }
+            return undefined;
+        };
+        return walk(parentId, [parentId]);
+    };
+    const sameOwner = (left, right) => left.hostId === right.hostId && left.pid === right.pid && left.nonce === right.nonce;
+    /** Mirrors the SQL `flows_runs` owner-match predicate for a run. */
+    const runView = (runId, presented) => {
+        if (options.runs === undefined) {
+            return { exists: true, running: true, owned: true };
+        }
+        const view = options.runs(runId);
+        if (Option.isNone(view)) {
+            return { exists: false, running: false, owned: false };
+        }
+        const owned = presented !== undefined &&
+            view.value.owner !== null &&
+            sameOwner(view.value.owner, presented);
+        return { exists: true, running: view.value.status === "running", owned };
+    };
+    /**
+     * Mirrors the SQL sweeps' run-status join: a row whose run has settled is
+     * never swept, and `Option.none()` from a supplied `runs` view means the run
+     * does not exist, so its orphaned engine-state rows stay hidden. The
+     * permissive default (no `runs` view) treats every run as live because a
+     * standalone memory store has no run table to consult.
+     */
+    const isLive = (runId) => {
+        if (options.runs === undefined)
+            return true;
+        const view = options.runs(runId);
+        return Option.isSome(view) && (view.value.status === "pending" ||
+            view.value.status === "running" ||
+            view.value.status === "suspended");
+    };
+    const pendingMemoryRows = (flowName, after, through, eligibleBeforeMs, cancellationOnly = false) => Array.from(options.listRuns?.() ?? [])
+        .filter(([runId, view]) => view.status === "pending" && (flowName === undefined || view.flowName === flowName) &&
+        (!cancellationOnly || view.cancelRequestedAtMs != null) &&
+        (eligibleBeforeMs === undefined || (view.createdAtMs ?? 0) < eligibleBeforeMs) &&
+        (after === undefined || (view.createdAtMs ?? 0) > after.createdAtMs ||
+            ((view.createdAtMs ?? 0) === after.createdAtMs && compareText(runId, after.runId) > 0)) &&
+        (through === undefined || (view.createdAtMs ?? 0) < through.createdAtMs ||
+            ((view.createdAtMs ?? 0) === through.createdAtMs && compareText(runId, through.runId) <= 0)))
+        .sort(([leftId, left], [rightId, right]) => (left.createdAtMs ?? 0) - (right.createdAtMs ?? 0) || compareText(leftId, rightId))
+        .map(([runId, view]) => ({ runId, createdAtMs: view.createdAtMs ?? 0 }));
+    const unguarded = {
+        deferred: Effect.fn("DurableEngineState.deferred")((address) => Effect.gen(function* () {
+            const row = deferreds.get(deferredKey(address));
+            return row === undefined ? Option.none() : Option.some(yield* snapshotDeferred(row));
+        })),
+        consumeDeferred: Effect.fn("DurableEngineState.consumeDeferred")((address, consumedAtMs) => Effect.sync(() => {
+            const key = deferredKey(address);
+            if (!deferreds.has(key) || consumedDeferreds.has(key))
+                return false;
+            consumedDeferreds.set(key, consumedAtMs);
+            return true;
+        })),
+        completeDeferred: Effect.fn("DurableEngineState.completeDeferred")((row) => Effect.gen(function* () {
+            const stored = yield* snapshotDeferred(row);
+            const key = deferredKey(stored);
+            const existing = deferreds.get(key);
+            if (existing !== undefined) {
+                return {
+                    _tag: "Existing",
+                    row: yield* snapshotDeferred(existing),
+                    digest: yield* memoryDigest(existing)
+                };
+            }
+            deferreds.set(key, stored);
+            return {
+                _tag: "Completed",
+                row: yield* snapshotDeferred(stored),
+                digest: yield* memoryDigest(stored)
+            };
+        })),
+        clock: Effect.fn("DurableEngineState.clock")((address) => Effect.gen(function* () {
+            const row = clocks.get(clockKey(address));
+            return row === undefined ? Option.none() : Option.some(yield* snapshotClock(row));
+        })),
+        scheduleClock: Effect.fn("DurableEngineState.scheduleClock")((row, owner) => Effect.gen(function* () {
+            // Mirrors the SQL fence: creation requires the presented owner to
+            // currently run the execution; a lost fence surfaces as
+            // self-interruption, an existing row wins regardless.
+            const stored = yield* snapshotClock(row);
+            const key = clockKey(stored);
+            const existing = clocks.get(key);
+            if (existing !== undefined) {
+                return { _tag: "Existing", row: yield* snapshotClock(existing) };
+            }
+            const view = runView(stored.executionId, owner);
+            if (!view.exists || !view.running || !view.owned) {
+                return yield* Effect.interrupt;
+            }
+            clocks.set(key, stored);
+            return { _tag: "Scheduled", row: yield* snapshotClock(stored) };
+        })),
+        completeClock: Effect.fn("DurableEngineState.completeClock")((address, completedAtMs) => Effect.sync(() => {
+            const key = clockKey(address);
+            const existing = clocks.get(key);
+            if (existing === undefined) {
+                return { _tag: "NotFound" };
+            }
+            if (existing.completedAtMs !== null) {
+                return { _tag: "AlreadyCompleted", row: { ...existing } };
+            }
+            const row = { ...existing, completedAtMs };
+            clocks.set(key, row);
+            return { _tag: "Completed", row: { ...row } };
+        })),
+        dueClocks: Effect.fn("DurableEngineState.dueClocks")((nowMs) => Effect.forEach(Array.from(clocks.values())
+            .filter((row) => row.completedAtMs === null && row.dueAtMs <= nowMs)
+            .sort((left, right) => left.dueAtMs - right.dueAtMs ||
+            compareText(left.executionId, right.executionId) ||
+            compareText(left.clockName, right.clockName)), snapshotClock)),
+        completeRunClocks: Effect.fn("DurableEngineState.completeRunClocks")((executionId, completedAtMs) => Effect.sync(() => {
+            const completed = [];
+            for (const [key, row] of clocks) {
+                if (row.executionId !== executionId || row.completedAtMs !== null)
+                    continue;
+                const next = { ...row, completedAtMs };
+                clocks.set(key, next);
+                completed.push({ ...next });
+            }
+            return completed.sort((left, right) => compareText(left.flowName, right.flowName) || compareText(left.clockName, right.clockName));
+        })),
+        pendingClocks: Effect.fn("DurableEngineState.pendingClocks")((scope) => Effect.flatMap(Effect.sync(() => Array.from(clocks.values())
+            .filter((row) => row.completedAtMs === null &&
+            isLive(row.executionId) &&
+            (scope.executionId === undefined || row.executionId === scope.executionId) &&
+            (scope.flowName === undefined || row.flowName === scope.flowName))
+            .sort((left, right) => left.dueAtMs - right.dueAtMs ||
+            compareText(left.executionId, right.executionId) ||
+            compareText(left.clockName, right.clockName))), (rows) => Effect.forEach(rows, snapshotClock))),
+        completedDeferreds: Effect.fn("DurableEngineState.completedDeferreds")((flowName) => Effect.sync(() => Array.from(deferreds.values())
+            .filter((row) => row.flowName === flowName && isLive(row.executionId) && !consumedDeferreds.has(deferredKey(row)))
+            .map(({ flowName, executionId, deferredName }) => ({
+            flowName,
+            executionId,
+            deferredName
+        }))
+            .sort((left, right) => compareText(left.executionId, right.executionId) ||
+            compareText(left.deferredName, right.deferredName)))),
+        park: Effect.fn("DurableEngineState.park")((runId, waitingPayload, owner) => Effect.sync(() => {
+            // Mirrors the SQL fence: only the current owner of an existing run
+            // may park it; anything else reports NotFound, exactly like the
+            // owner-guarded UPDATE matching no row.
+            const view = runView(runId, owner);
+            if (!view.exists || !view.owned) {
+                return { _tag: "NotFound" };
+            }
+            // The declared question is stored as JSON TEXT and read back decoded,
+            // exactly as the column and its SELECT do it.
+            const row = {
+                runId,
+                reason: waitingPayload.reason,
+                wakeAt: waitingPayload.wakeAt ?? null,
+                token: waitingPayload.token ?? null,
+                ...decodeWaitingRequest(waitingPayload.request)
+            };
+            waitingRows.set(runId, row);
+            return { _tag: "Parked", row: snapshotWaiting(row) };
+        })),
+        wake: Effect.fn("DurableEngineState.wake")((runId) => Effect.sync(() => {
+            const row = waitingRows.get(runId);
+            if (row === undefined) {
+                // Mirrors SQL: an unknown run is NotFound, an existing unparked
+                // run is NotWaiting.
+                return runView(runId, undefined).exists
+                    ? { _tag: "NotWaiting" }
+                    : { _tag: "NotFound" };
+            }
+            waitingRows.delete(runId);
+            return { _tag: "Woken", row: snapshotWaiting(row) };
+        })),
+        waiting: Effect.fn("DurableEngineState.waiting")((runId) => Effect.sync(() => {
+            const row = waitingRows.get(runId);
+            return row === undefined ? Option.none() : Option.some(snapshotWaiting(row));
+        })),
+        waitingTree: Effect.fn("DurableEngineState.waitingTree")((runId, walk) => Effect.sync(() => {
+            // Breadth-first over recorded spawn edges: the named run first, then
+            // each generation beneath it. This memory view does not model the
+            // parent_run_id trampoline links that the SQL walk also follows.
+            const found = [];
+            const seen = new Set([runId]);
+            let frontier = [runId];
+            for (let depth = 0; depth <= waitingTreeMaxDepth && frontier.length > 0; depth++) {
+                const next = [];
+                for (const current of frontier) {
+                    const row = waitingRows.get(current);
+                    if (row !== undefined && isLive(current))
+                        found.push(snapshotWaiting(row));
+                    for (const [childId, parents] of parentEdges) {
+                        if (!parents.has(current) || seen.has(childId))
+                            continue;
+                        // The SQL walk skips a detached subtree; so does this one, for a
+                        // view that records the policy. A view that does not describes an
+                        // attached child, which is the default.
+                        const view = options.runs?.(childId);
+                        if (walk?.detached !== "include" && view !== undefined && Option.isSome(view) &&
+                            view.value.onParentExit === "detach")
+                            continue;
+                        seen.add(childId);
+                        next.push(childId);
+                    }
+                }
+                frontier = next;
+            }
+            return found;
+        })),
+        waitingRuns: Effect.fn("DurableEngineState.waitingRuns")((filter) => Effect.sync(() => Array.from(waitingRows.values())
+            // Mirrors the SQL status predicate: a terminally closed run's
+            // stale waiting row never surfaces to a sweeper (issue #28). The
+            // permissive default (no `runs` view) treats every run as live.
+            .filter((row) => isLive(row.runId))
+            .filter((row) => filter?.reason === undefined || row.reason === filter.reason)
+            .filter((row) => filter?.dueBeforeMs === undefined ||
+            (row.wakeAt !== null && row.wakeAt <= filter.dueBeforeMs))
+            // Mirrors the SQL cancel predicate over
+            // `flows_runs.cancel_requested_at_ms` (issue #68). Without a
+            // `runs` view the flag is unknowable, so the query stays
+            // permissive and the sweeper's own per-row guard decides.
+            .filter((row) => {
+            if (filter?.cancelRequested !== true)
+                return true;
+            if (options.runs === undefined)
+                return true;
+            const view = options.runs(row.runId);
+            return Option.isSome(view) && view.value.cancelRequestedAtMs != null;
+        })
+            .sort((left, right) => Number(left.wakeAt === null) - Number(right.wakeAt === null) ||
+            (left.wakeAt ?? 0) - (right.wakeAt ?? 0) ||
+            compareText(left.runId, right.runId))
+            .map(snapshotWaiting))),
+        pendingRuns: Effect.fn("DurableEngineState.pendingRuns")((flowName, limit, after, through, eligibleBeforeMs) => Effect.sync(() => {
+            const ordered = pendingMemoryRows(flowName, after, through, eligibleBeforeMs);
+            return limit === undefined ? ordered : ordered.slice(0, limit);
+        })),
+        pendingRunTail: Effect.fn("DurableEngineState.pendingRunTail")((flowName, eligibleBeforeMs) => Effect.sync(() => Option.fromNullishOr(pendingMemoryRows(flowName, undefined, undefined, eligibleBeforeMs).at(-1)))),
+        pendingCancellationRuns: Effect.fn("DurableEngineState.pendingCancellationRuns")((limit, after, through) => pendingCancellationLimit(limit).pipe(Effect.andThen(Effect.sync(() => pendingMemoryRows(undefined, after, through, undefined, true).slice(0, limit))))),
+        pendingCancellationTail: Effect.fn("DurableEngineState.pendingCancellationTail")(() => Effect.sync(() => Option.fromNullishOr(pendingMemoryRows(undefined, undefined, undefined, undefined, true).at(-1)))),
+        staleRunningRuns: Effect.fn("DurableEngineState.staleRunningRuns")((staleBeforeMs, limit) => Effect.sync(() => {
+            // Mirrors the SQL scan of `flows_runs`: without an enumerator there
+            // is nothing to scan, so no stale rows exist.
+            if (options.listRuns === undefined)
+                return [];
+            const stale = [];
+            for (const [runId, view] of options.listRuns()) {
+                const heartbeatAtMs = view.heartbeatAtMs;
+                if (view.status === "running" &&
+                    typeof heartbeatAtMs === "number" &&
+                    heartbeatAtMs < staleBeforeMs) {
+                    stale.push({ runId, heartbeatAtMs });
+                }
+            }
+            const ordered = stale.sort((left, right) => left.heartbeatAtMs - right.heartbeatAtMs ||
+                compareText(left.runId, right.runId));
+            // Mirrors the SQL LIMIT: oldest heartbeats first, capped per sweep
+            // (issue #79).
+            return limit === undefined ? ordered : ordered.slice(0, limit);
+        })),
+        recordRunParent: Effect.fn("DurableEngineState.recordRunParent")((childId, parentId) => 
+        // A single synchronous step mirrors the SQL transaction: the cycle
+        // check and the insert are atomic — no fiber can interleave between
+        // them, and a rejected edge is never observable (issues #54/#55/#56).
+        Effect.suspend(() => {
+            const parents = parentEdges.get(childId) ?? new Map();
+            const existing = parents.get(parentId);
+            if (existing !== undefined) {
+                return Effect.succeed({
+                    _tag: "Existing",
+                    edge: { childId, parentId, seq: existing }
+                });
+            }
+            const cycle = findCyclePathSync(childId, parentId);
+            if (cycle !== undefined) {
+                return Effect.fail(new RunParentCycleError({ path: cycle }));
+            }
+            parentSeq += 1;
+            parents.set(parentId, parentSeq);
+            parentEdges.set(childId, parents);
+            return Effect.succeed({
+                _tag: "Recorded",
+                edge: { childId, parentId, seq: parentSeq }
+            });
+        })),
+        removeRunParentsForRun: Effect.fn("DurableEngineState.removeRunParentsForRun")((runId) => Effect.sync(() => {
+            parentEdges.delete(runId);
+            for (const [childId, parents] of parentEdges) {
+                parents.delete(runId);
+                if (parents.size === 0)
+                    parentEdges.delete(childId);
+            }
+        })),
+        runParents: Effect.fn("DurableEngineState.runParents")((childId) => Effect.sync(() => Array.from(parentEdges.get(childId) ?? [])
+            .map(([parentId, seq]) => ({ childId, parentId, seq }))
+            .sort((left, right) => left.seq - right.seq))),
+        runChildren: Effect.fn("DurableEngineState.runChildren")((parentId) => Effect.sync(() => {
+            const edges = [];
+            for (const [childId, parents] of parentEdges) {
+                const seq = parents.get(parentId);
+                if (seq !== undefined)
+                    edges.push({ childId, parentId, seq });
+            }
+            return edges.sort((left, right) => left.seq - right.seq);
+        }))
+    };
+    const gate = Semaphore.makeUnsafe(1);
+    const transactionDepth = new Map();
+    const guard = (effect) => Effect.flatMap(Effect.fiberId, (fiberId) => (transactionDepth.get(fiberId) ?? 0) > 0 ? effect : gate.withPermit(effect));
+    const restoreMap = (target, source) => {
+        target.clear();
+        for (const [key, value] of source)
+            target.set(key, value);
+    };
+    const transaction = (effect, options) => Effect.flatMap(Effect.fiberId, (fiberId) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+        const nested = (transactionDepth.get(fiberId) ?? 0) > 0;
+        if (!nested)
+            yield* restore(gate.take(1));
+        const before = {
+            deferreds: new Map(deferreds),
+            consumedDeferreds: new Map(consumedDeferreds),
+            clocks: new Map(clocks),
+            waitingRows: new Map(waitingRows),
+            parentEdges: new Map([...parentEdges].map(([child, parents]) => [child, new Map(parents)])),
+            parentSeq
+        };
+        transactionDepth.set(fiberId, (transactionDepth.get(fiberId) ?? 0) + 1);
+        let committed = false;
+        let closed = false;
+        const close = Effect.suspend(() => {
+            if (closed)
+                return Effect.void;
+            closed = true;
+            const depth = transactionDepth.get(fiberId) - 1;
+            if (depth === 0)
+                transactionDepth.delete(fiberId);
+            else
+                transactionDepth.set(fiberId, depth);
+            return nested ? Effect.void : gate.release(1).pipe(Effect.asVoid);
+        });
+        const commit = Effect.sync(() => {
+            committed = true;
+        }).pipe(Effect.andThen(close));
+        return yield* Effect.sync(() => options?.onCommit(commit)).pipe(Effect.andThen(restore(effect)), Effect.catchCause((cause) => Effect.sync(() => {
+            if (committed)
+                return;
+            restoreMap(deferreds, before.deferreds);
+            restoreMap(consumedDeferreds, before.consumedDeferreds);
+            restoreMap(clocks, before.clocks);
+            restoreMap(waitingRows, before.waitingRows);
+            restoreMap(parentEdges, before.parentEdges);
+            parentSeq = before.parentSeq;
+        }).pipe(Effect.andThen(Effect.failCause(cause)))), Effect.ensuring(close));
+    })));
+    return DurableEngineState.of({
+        deferred: (address) => guard(unguarded.deferred(address)),
+        consumeDeferred: (address, consumedAtMs) => guard(unguarded.consumeDeferred(address, consumedAtMs)),
+        completeDeferred: (row) => guard(unguarded.completeDeferred(row)),
+        clock: (address) => guard(unguarded.clock(address)),
+        scheduleClock: (row, owner) => guard(unguarded.scheduleClock(row, owner)),
+        completeClock: (address, completedAtMs) => guard(unguarded.completeClock(address, completedAtMs)),
+        dueClocks: (nowMs) => guard(unguarded.dueClocks(nowMs)),
+        completeRunClocks: (executionId, completedAtMs) => guard(unguarded.completeRunClocks(executionId, completedAtMs)),
+        pendingClocks: (scope) => guard(unguarded.pendingClocks(scope)),
+        completedDeferreds: (flowName) => guard(unguarded.completedDeferreds(flowName)),
+        park: (runId, waiting, owner) => guard(unguarded.park(runId, waiting, owner)),
+        wake: (runId) => guard(unguarded.wake(runId)),
+        waiting: (runId) => guard(unguarded.waiting(runId)),
+        waitingTree: (runId, options) => guard(unguarded.waitingTree(runId, options)),
+        waitingRuns: (filter) => guard(unguarded.waitingRuns(filter)),
+        pendingRuns: (flowName, limit, after, through, eligibleBeforeMs) => guard(unguarded.pendingRuns(flowName, limit, after, through, eligibleBeforeMs)),
+        pendingRunTail: (flowName, eligibleBeforeMs) => guard(unguarded.pendingRunTail(flowName, eligibleBeforeMs)),
+        pendingCancellationRuns: (limit, after, through) => guard(unguarded.pendingCancellationRuns(limit, after, through)),
+        pendingCancellationTail: () => guard(unguarded.pendingCancellationTail()),
+        staleRunningRuns: (staleBeforeMs, limit) => guard(unguarded.staleRunningRuns(staleBeforeMs, limit)),
+        attemptSurvivors: undefined,
+        recordRunParent: (childId, parentId) => guard(unguarded.recordRunParent(childId, parentId)),
+        removeRunParentsForRun: (runId) => guard(unguarded.removeRunParentsForRun(runId)),
+        runParents: (childId) => guard(unguarded.runParents(childId)),
+        runChildren: (parentId) => guard(unguarded.runChildren(parentId)),
+        transaction
+    });
+};
+/**
+ * Provides deterministic in-memory durable engine state.
+ *
+ * @since 0.1.0
+ * @category layers
+ */
+export const layerMemory = Layer.sync(DurableEngineState, makeMemory);
+//# sourceMappingURL=DurableEngineState.js.map