Request and Run Lifecycle

After request decoding and workflow-specific validation, the Web adapter starts an audit Run when persistence is enabled. Actor is derived from instance authentication, not from an untrusted request field.

Chat, alert, and bot investigations add one bounded event for each tool outcome. Alert ingestion first persists the delivery, normalized events, incident updates, and jobs in a separate transaction. The worker then links a Run to the event, incident, and job; persists the structured investigation; delivers notifications; and completes the job. Change preview records proposal acceptance and changed-file count. Change apply records the workspace and applied-file count. A deferred failure transition prevents a started Run from remaining running when a handler or worker exits through an error path.

The store replays JSONL records on startup and rejects corrupt versions, duplicate starts, invalid event sequences, and invalid final transitions.

The alert store separately replays delivery, event, incident, and job records. Jobs interrupted in running state return to pending during startup before the in-process worker begins claiming work.