fed-sx-types Phase 7: pipeline trigger fan-out + flow_dispatch

The post-append fan-out that fires durable flows from arriving activities (fed-sx-triggers-loop.md Phases 2+3), native into next/flow — no cross-guest FFI. - pipeline.erl: apply_triggers/3 runs AFTER the kernel append (rejected activities never reach it). It looks the activity's type up in the trigger registry, drops specs whose guard/actor-scope fails or whose {activity_cid, trigger_cid} pair already fired (federation can deliver the same activity twice — dedup is keyed on that pair, read from the actor's :triggers_fired), and dispatches the rest. Returns the audit triples for the kernel to fold into :triggers_fired + its projection. Must not be called inside a `try` (it does gen_server:calls, which deadlock the scheduler inside a try); running post-append in its own step satisfies that. - flow_dispatch.erl: bridges a matched trigger to flow_store:start, with the activity bound into the flow's input env. guard_passes/3 gates on actor-scope + guard. Failures (unknown flow, crashing first step) come back as {error, _}, never raised — one flow can't take down the rest. - flow_store.erl: drive wrapped in try (the drive is pure, so the try is safe) so a flow whose step raises yields {error, {flow_crashed, _}} instead of crashing the store. Tests: flow_dispatch.sh (12), pipeline_triggers.sh (10). lib/erlang 771/771, next/flow 34/34. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:22:50 +00:00
parent fc6a47ad62
commit 6b4850b34e
5 changed files with 460 additions and 9 deletions
--- a/next/flow/flow_store.erl
+++ b/next/flow/flow_store.erl
@@ -89,10 +89,14 @@ handle_call({start, Name, Input}, _From, {Reg, Ins, N}) ->
        not_found ->
            {reply, {error, no_such_flow}, {Reg, Ins, N}};
        {ok, Flow} ->
-            R = flow:drive(Flow, Input, []),
-            Status = result_status(R),
-            Ins2 = set_keyed(N, {Name, Input, [], Status}, Ins),
-            {reply, {ok, N, R}, {Reg, Ins2, N + 1}}
+            case safe_drive(Flow, Input, []) of
+                {ok, R} ->
+                    Status = result_status(R),
+                    Ins2 = set_keyed(N, {Name, Input, [], Status}, Ins),
+                    {reply, {ok, N, R}, {Reg, Ins2, N + 1}};
+                {error, Crash} ->
+                    {reply, {error, {flow_crashed, Crash}}, {Reg, Ins, N}}
+            end
    end;
 handle_call({resume, Id, Value}, _From, {Reg, Ins, N}) ->
    case find_keyed(Id, Ins) of
@@ -106,10 +110,14 @@ handle_call({resume, Id, Value}, _From, {Reg, Ins, N}) ->
                    {reply, {error, no_such_flow}, {Reg, Ins, N}};
                {ok, Flow} ->
                    NewLog = log_append(Log, Tag, Value),
-                    R = flow:drive(Flow, Input, NewLog),
-                    Status = result_status(R),
-                    Ins2 = set_keyed(Id, {Name, Input, NewLog, Status}, Ins),
-                    {reply, {ok, R}, {Reg, Ins2, N}}
+                    case safe_drive(Flow, Input, NewLog) of
+                        {ok, R} ->
+                            Status = result_status(R),
+                            Ins2 = set_keyed(Id, {Name, Input, NewLog, Status}, Ins),
+                            {reply, {ok, R}, {Reg, Ins2, N}};
+                        {error, Crash} ->
+                            {reply, {error, {flow_crashed, Crash}}, {Reg, Ins, N}}
+                    end
            end
    end;
 handle_call({status, Id}, _From, {Reg, Ins, N}) ->
@@ -129,6 +137,18 @@ handle_info(_, S) -> {noreply, S}.
 result_status({flow_done, R})      -> {done, R};
 result_status({flow_suspended, T})  -> {suspended, T}.

+%% safe_drive/3 — flow:drive is pure (no blocking receive), so a `try`
+%% around it is safe in this runtime and isolates a flow whose step
+%% raises: the store returns {error, {flow_crashed, _}} instead of the
+%% gen_server crashing, keeping one bad flow from taking down others.
+safe_drive(Flow, Input, Log) ->
+    try {ok, flow:drive(Flow, Input, Log)}
+    catch
+        throw:R -> {error, {throw, R}};
+        error:R -> {error, {error, R}};
+        exit:R  -> {error, {exit, R}}
+    end.
+
 log_append([], Tag, Value) -> [{Tag, Value}];
 log_append([H | T], Tag, Value) -> [H | log_append(T, Tag, Value)].

--- a/next/kernel/flow_dispatch.erl
+++ b/next/kernel/flow_dispatch.erl
@@ -0,0 +1,76 @@
+-module(flow_dispatch).
+-export([start/4, guard_passes/3]).
+
+%% Bridge from "an activity matched a trigger" to "a flow started with
+%% that activity as input" (fed-sx-triggers Phase 3). A NATIVE call into
+%% next/flow (flow_store) — the engine is Erlang-on-SX too, so there is
+%% no cross-guest FFI: the kernel and the workflow engine share one
+%% runtime.
+%%
+%% start(Spec, Activity, ActorState, Cfg)
+%%   -> {ok, FlowId, {ActivityCid, TriggerCid, FlowId}}   (audit triple)
+%%    | {error, Reason}
+%%
+%% The flow named in Spec is started with the activity bound into its
+%% input environment, so flow steps can read the activity, the actor id,
+%% and the trigger cid (the audit chain). Flow-start failures — an
+%% unknown flow name, or a crashing first step (flow_store isolates the
+%% raise) — come back as {error, Reason}, never raised, so the fan-out
+%% caller is insulated from one flow's failure.
+
+start(Spec, Activity, ActorState, _Cfg) ->
+    FlowName    = trigger_registry:spec_flow_name(Spec),
+    TriggerCid  = trigger_registry:spec_cid(Spec),
+    ActivityCid = activity_cid(Activity),
+    Input = [{activity, Activity},
+             {actor, actor_id_of(ActorState, Activity)},
+             {trigger_cid, TriggerCid}],
+    case flow_store:start(FlowName, Input) of
+        {ok, FlowId, _Result} ->
+            {ok, FlowId, {ActivityCid, TriggerCid, FlowId}};
+        {error, Reason} ->
+            {error, Reason}
+    end.
+
+%% guard_passes(Spec, Activity, ActorState) — a spec fires when its
+%% actor-scope admits the activity's actor AND its guard (if any)
+%% returns true. An `any` scope and an `undefined` guard always pass;
+%% the guard lets one activity-type bind multiple flows with
+%% discriminators.
+guard_passes(Spec, Activity, ActorState) ->
+    scope_ok(trigger_registry:spec_actor_scope(Spec), Activity) andalso
+        guard_ok(trigger_registry:spec_guard(Spec), Activity, ActorState).
+
+scope_ok(any, _Activity) -> true;
+scope_ok(Scope, Activity) ->
+    case envelope:get_field(actor, Activity) of
+        {ok, Scope} -> true;
+        _           -> false
+    end.
+
+guard_ok(undefined, _Activity, _ActorState) -> true;
+guard_ok(Guard, Activity, ActorState) when is_function(Guard, 2) ->
+    Guard(Activity, ActorState);
+guard_ok(_, _, _) -> false.
+
+%% ── helpers ─────────────────────────────────────────────────────
+
+activity_cid(Activity) ->
+    case envelope:get_field(id, Activity) of
+        {ok, Cid} -> Cid;
+        _         -> undefined
+    end.
+
+%% actor_id_of/2 — prefer the receiving actor's id (ActorState carries
+%% {actor_id, _}); fall back to the activity's :actor. Reading
+%% ActorState as a proplist keeps this decoupled from actor_state's
+%% internal shape and testable with a plain [{actor_id, _}] stand-in.
+actor_id_of(ActorState, Activity) ->
+    case envelope:get_field(actor_id, ActorState) of
+        {ok, Id} -> Id;
+        _ ->
+            case envelope:get_field(actor, Activity) of
+                {ok, A} -> A;
+                _       -> undefined
+            end
+    end.
--- a/next/kernel/pipeline.erl
+++ b/next/kernel/pipeline.erl
@@ -7,7 +7,8 @@
         stage_signature/1, stage_signature/2,
         stage_replay/1, stage_replay/2,
         stage_schema/1, stage_schema/2,
-         apply_object_schema/2, stage_object_schema/1]).
+         apply_object_schema/2, stage_object_schema/1,
+         apply_triggers/3]).

 %% Validation pipeline per design §14.
 %%
@@ -301,3 +302,98 @@ stage_field(_, []) -> nil.
 find_keyed(_, []) -> {error, not_found};
 find_keyed(K, [{K, V} | _]) -> {ok, V};
 find_keyed(K, [_ | Rest]) -> find_keyed(K, Rest).
+
+%% ── fed-sx triggers Step 2: post-append fan-out ─────────────────
+%%
+%% apply_triggers/3 — fires the durable flows bound to an activity's
+%% type AFTER it has been accepted and appended (rejected activities
+%% never reach here, so a flow only runs for an activity that really
+%% landed). For each spec the activity's type is bound to, the spec
+%% must pass its guard/actor-scope, and its {ActivityCid, TriggerCid}
+%% pair must not already have fired (federation can deliver the same
+%% activity twice via different peers — dedup is keyed on that pair,
+%% read from the receiving actor's :triggers_fired). Surviving specs are
+%% dispatched via flow_dispatch:start (a native flow_store:start), which
+%% never raises.
+%%
+%% Returns {ok, Results} where Results is one
+%%   {ActivityCid, TriggerCid, {ok, FlowId} | {error, Reason}}
+%% per spec actually dispatched (guard-passed, not a duplicate). The
+%% kernel folds the {ActivityCid, TriggerCid} pairs into the actor's
+%% :triggers_fired (dedup) and the audit triples into its projection.
+%% No matching/ready registry yields {ok, []}.
+%%
+%% Cfg gates the fan-out on {trigger_registry, trigger_registry} (the
+%% registered gen_server), mirroring the object-schema stage's
+%% {peer_types, _} gate. apply_triggers must NOT be called inside a
+%% `try` — flow_dispatch does gen_server:calls, and a blocking call
+%% inside a try deadlocks this scheduler; the fan-out runs after append,
+%% in its own step, so this is naturally satisfied.
+
+apply_triggers(Activity, ActorState, Cfg) ->
+    case trigger_registry_ready(Cfg) of
+        false -> {ok, []};
+        true ->
+            Type    = activity_type_of(Activity),
+            Specs   = trigger_registry:lookup(Type),
+            ActCid  = trigger_activity_cid(Activity),
+            Fired   = field_or_default(triggers_fired, ActorState, []),
+            fire_each(Specs, Activity, ActorState, ActCid, Fired, Cfg, [])
+    end.
+
+trigger_registry_ready(Cfg) ->
+    case stage_field(trigger_registry, Cfg) of
+        nil -> false;
+        _ ->
+            case erlang:whereis(trigger_registry) of
+                undefined -> false;
+                _         -> true
+            end
+    end.
+
+fire_each([], _A, _AS, _ACid, _Fired, _Cfg, Acc) ->
+    {ok, lists:reverse(Acc)};
+fire_each([Spec | Rest], A, AS, ACid, Fired, Cfg, Acc) ->
+    TCid = trigger_registry:spec_cid(Spec),
+    Pair = {ACid, TCid},
+    AlreadyFired = pair_member(Pair, Fired) orelse acc_member(Pair, Acc),
+    Pass = (not AlreadyFired) andalso flow_dispatch:guard_passes(Spec, A, AS),
+    case Pass of
+        false ->
+            fire_each(Rest, A, AS, ACid, Fired, Cfg, Acc);
+        true ->
+            Outcome = case flow_dispatch:start(Spec, A, AS, Cfg) of
+                          {ok, FlowId, _Audit} -> {ok, FlowId};
+                          {error, Reason}      -> {error, Reason}
+                      end,
+            fire_each(Rest, A, AS, ACid, Fired, Cfg, [{ACid, TCid, Outcome} | Acc])
+    end.
+
+activity_type_of(Activity) ->
+    case envelope:get_field(type, Activity) of
+        {ok, Type} -> Type;
+        _          -> undefined
+    end.
+
+trigger_activity_cid(Activity) ->
+    case envelope:get_field(id, Activity) of
+        {ok, Cid} -> Cid;
+        _         -> undefined
+    end.
+
+field_or_default(Key, Proplist, Default) ->
+    case envelope:get_field(Key, Proplist) of
+        {ok, V} -> V;
+        _       -> Default
+    end.
+
+%% pair_member/2 — {ACid, TCid} present in a [{ACid, TCid}] fired list.
+pair_member(_, []) -> false;
+pair_member(P, [P | _]) -> true;
+pair_member(P, [_ | Rest]) -> pair_member(P, Rest).
+
+%% acc_member/2 — {ACid, TCid} already dispatched this call (Acc holds
+%% {ACid, TCid, Outcome} triples).
+acc_member(_, []) -> false;
+acc_member({A, T}, [{A, T, _} | _]) -> true;
+acc_member(P, [_ | Rest]) -> acc_member(P, Rest).
--- a/next/tests/flow_dispatch.sh
+++ b/next/tests/flow_dispatch.sh
@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+# next/tests/flow_dispatch.sh — fed-sx triggers Phase 3.
+#
+# flow_dispatch bridges a matched trigger to a started flow — a native
+# flow_store:start (the engine is Erlang-on-SX too, no FFI). Confirms
+# guard/actor-scope gating, the audit triple, synchronous first-step
+# execution, suspend/resume of a started instance, a branch on an
+# activity field, and graceful handling of an unknown flow name.
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+if [ ! -x "$SX_SERVER" ]; then
+  SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+fi
+if [ ! -x "$SX_SERVER" ]; then
+  echo "ERROR: sx_server.exe not found." >&2
+  exit 1
+fi
+
+VERBOSE="${1:-}"
+PASS=0; FAIL=0; ERRORS=""
+TMPFILE=$(mktemp); trap "rm -f $TMPFILE" EXIT
+
+# Activity (Create of a Note by alice), receiving actor-state, and a
+# couple of flows: `capture` echoes the activity's type out of the
+# flow's input env; `wait_flow` suspends then wraps the resumed value;
+# `cat_flow` branches on the inner object's :type.
+ACT='[{type, create}, {actor, alice}, {id, <<97,99,105,100>>}, {object, [{type, note}]}]'
+AS='[{actor_id, alice}]'
+CAP='flow_spec:flow_node(fun(In) -> {ok, A} = envelope:get_field(activity, In), {ok, T} = envelope:get_field(type, A), T end)'
+WAITF='flow_spec:sequence([flow:suspend(w), flow_spec:flow_node(fun(V) -> {got, V} end)])'
+CATF='flow_spec:branch(fun(In) -> {ok, A} = envelope:get_field(activity, In), {ok, O} = envelope:get_field(object, A), envelope:get_field(type, O) =:= {ok, note} end, flow_spec:flow_const(is_note), flow_spec:flow_const(not_note))'
+
+cat > "$TMPFILE" <<EPOCHS
+(epoch 1)
+(load "lib/erlang/tokenizer.sx")
+(load "lib/erlang/parser.sx")
+(load "lib/erlang/parser-core.sx")
+(load "lib/erlang/parser-expr.sx")
+(load "lib/erlang/parser-module.sx")
+(load "lib/erlang/transpile.sx")
+(load "lib/erlang/runtime.sx")
+(load "lib/erlang/vm/dispatcher.sx")
+(epoch 2)
+(eval "(er-load-gen-server!)")
+(eval "(get (erlang-load-module (file-read \"next/kernel/envelope.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/flow/flow.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/flow/flow_spec.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/flow/flow_store.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/kernel/trigger_registry.erl\")) :name)")
+(epoch 3)
+(eval "(get (erlang-load-module (file-read \"next/kernel/flow_dispatch.erl\")) :name)")
+
+;; ── guard / actor-scope gating ─────────────────────────────
+(epoch 10)
+(eval "(get (erlang-eval-ast \"flow_dispatch:guard_passes(trigger_registry:mk_spec(c, f, undefined, any), ${ACT}, ${AS})\") :name)")
+(epoch 11)
+(eval "(get (erlang-eval-ast \"flow_dispatch:guard_passes(trigger_registry:mk_spec(c, f, fun(_, _) -> false end, any), ${ACT}, ${AS}) =:= false\") :name)")
+(epoch 12)
+(eval "(get (erlang-eval-ast \"flow_dispatch:guard_passes(trigger_registry:mk_spec(c, f, fun(A, _) -> envelope:get_field(actor, A) =:= {ok, alice} end, any), ${ACT}, ${AS})\") :name)")
+(epoch 13)
+(eval "(get (erlang-eval-ast \"flow_dispatch:guard_passes(trigger_registry:mk_spec(c, f, undefined, alice), ${ACT}, ${AS})\") :name)")
+(epoch 14)
+(eval "(get (erlang-eval-ast \"flow_dispatch:guard_passes(trigger_registry:mk_spec(c, f, undefined, bob), ${ACT}, ${AS}) =:= false\") :name)")
+
+;; ── start: audit triple + synchronous first step ───────────
+(epoch 20)
+(eval "(get (erlang-eval-ast \"flow_store:start_link(), flow_store:register_flow(capture, ${CAP}), flow_dispatch:start(trigger_registry:mk_spec(<<116,99>>, capture, undefined, any), ${ACT}, ${AS}, []) =:= {ok, 1, {<<97,99,105,100>>, <<116,99>>, 1}}\") :name)")
+(epoch 21)
+(eval "(get (erlang-eval-ast \"flow_store:start_link(), flow_store:register_flow(capture, ${CAP}), {ok, FlowId, _} = flow_dispatch:start(trigger_registry:mk_spec(<<116,99>>, capture, undefined, any), ${ACT}, ${AS}, []), flow_store:status(FlowId) =:= {ok, {done, create}}\") :name)")
+
+;; ── unknown flow name -> {error, no_such_flow}, no crash ────
+(epoch 30)
+(eval "(get (erlang-eval-ast \"flow_store:start_link(), flow_dispatch:start(trigger_registry:mk_spec(<<116,99>>, ghostflow, undefined, any), ${ACT}, ${AS}, []) =:= {error, no_such_flow}\") :name)")
+
+;; ── started instance suspends; resume completes ────────────
+(epoch 40)
+(eval "(get (erlang-eval-ast \"flow_store:start_link(), flow_store:register_flow(wait_flow, ${WAITF}), {ok, FlowId, _} = flow_dispatch:start(trigger_registry:mk_spec(<<116,99>>, wait_flow, undefined, any), ${ACT}, ${AS}, []), S1 = flow_store:status(FlowId), R = flow_store:resume(FlowId, 7), S1 =:= {ok, {suspended, w}} andalso R =:= {ok, {flow_done, {got, 7}}}\") :name)")
+
+;; ── branch on an activity field (both branches) ────────────
+(epoch 50)
+(eval "(get (erlang-eval-ast \"flow_store:start_link(), flow_store:register_flow(cat_flow, ${CATF}), {ok, FlowId, _} = flow_dispatch:start(trigger_registry:mk_spec(<<116,99>>, cat_flow, undefined, any), ${ACT}, ${AS}, []), flow_store:status(FlowId) =:= {ok, {done, is_note}}\") :name)")
+(epoch 51)
+(eval "(get (erlang-eval-ast \"flow_store:start_link(), flow_store:register_flow(cat_flow, ${CATF}), {ok, FlowId, _} = flow_dispatch:start(trigger_registry:mk_spec(<<116,99>>, cat_flow, undefined, any), [{type, create}, {actor, alice}, {id, <<120>>}, {object, [{type, article}]}], ${AS}, []), flow_store:status(FlowId) =:= {ok, {done, not_note}}\") :name)")
+EPOCHS
+
+OUTPUT=$(timeout 360 "$SX_SERVER" < "$TMPFILE" 2>/dev/null)
+
+check() {
+  local epoch="$1" desc="$2" expected="$3"
+  local actual
+  actual=$(echo "$OUTPUT" | awk -v e="$epoch" '
+    $0 ~ "^\\(ok-len " e " " { getline; print; exit }
+    $0 ~ "^\\(ok " e " "     { print; exit }
+    $0 ~ "^\\(error " e " "  { print; exit }
+  ')
+  [ -z "$actual" ] && actual="<no output for epoch $epoch>"
+  if echo "$actual" | grep -qF -- "$expected"; then
+    PASS=$((PASS+1))
+    [ "$VERBOSE" = "-v" ] && echo "  ok $desc"
+  else
+    FAIL=$((FAIL+1))
+    ERRORS+="  FAIL [$desc] (epoch $epoch) expected: $expected | actual: $actual
+"
+  fi
+}
+
+check  3 "flow_dispatch module loaded"      "flow_dispatch"
+check 10 "undefined guard + any scope pass" "true"
+check 11 "guard false -> no pass"           "true"
+check 12 "guard true on activity field"     "true"
+check 13 "actor-scope match passes"         "true"
+check 14 "actor-scope mismatch fails"       "true"
+check 20 "start returns audit triple"       "true"
+check 21 "first step runs synchronously"    "true"
+check 30 "unknown flow -> no_such_flow"     "true"
+check 40 "started flow suspends + resumes"   "true"
+check 50 "branch then-arm (is_note)"        "true"
+check 51 "branch else-arm (not_note)"       "true"
+
+TOTAL=$((PASS+FAIL))
+if [ $FAIL -eq 0 ]; then
+  echo "ok $PASS/$TOTAL next/tests/flow_dispatch.sh passed"
+else
+  echo "FAIL $PASS/$TOTAL passed, $FAIL failed:"
+  echo "$ERRORS"
+fi
+[ $FAIL -eq 0 ]
--- a/next/tests/pipeline_triggers.sh
+++ b/next/tests/pipeline_triggers.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# next/tests/pipeline_triggers.sh — fed-sx triggers Phase 2.
+#
+# pipeline:apply_triggers/3 is the post-append fan-out: a successfully
+# appended activity has its type looked up in the trigger registry, and
+# each surviving spec (guard + actor-scope pass, not already fired) is
+# dispatched to a durable flow. Confirms lookup -> dispatch, no-match,
+# guard rejection, {activity,trigger}-cid dedup, multi-bind, graceful
+# handling of an unknown flow and a crashing flow, and the cfg gate.
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+SX_SERVER="${SX_SERVER:-hosts/ocaml/_build/default/bin/sx_server.exe}"
+if [ ! -x "$SX_SERVER" ]; then
+  SX_SERVER="/root/rose-ash/hosts/ocaml/_build/default/bin/sx_server.exe"
+fi
+if [ ! -x "$SX_SERVER" ]; then
+  echo "ERROR: sx_server.exe not found." >&2
+  exit 1
+fi
+
+VERBOSE="${1:-}"
+PASS=0; FAIL=0; ERRORS=""
+TMPFILE=$(mktemp); trap "rm -f $TMPFILE" EXIT
+
+ACT='[{type, create}, {actor, alice}, {id, <<97,99,105,100>>}, {object, [{type, note}]}]'
+AS='[{actor_id, alice}]'
+CFG='[{trigger_registry, trigger_registry}]'
+DONEF='flow_spec:flow_const(ran)'
+BOOMF='flow_spec:flow_node(fun(_) -> error(kaboom) end)'
+
+cat > "$TMPFILE" <<EPOCHS
+(epoch 1)
+(load "lib/erlang/tokenizer.sx")
+(load "lib/erlang/parser.sx")
+(load "lib/erlang/parser-core.sx")
+(load "lib/erlang/parser-expr.sx")
+(load "lib/erlang/parser-module.sx")
+(load "lib/erlang/transpile.sx")
+(load "lib/erlang/runtime.sx")
+(load "lib/erlang/vm/dispatcher.sx")
+(epoch 2)
+(eval "(er-load-gen-server!)")
+(eval "(get (erlang-load-module (file-read \"next/kernel/envelope.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/flow/flow.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/flow/flow_spec.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/flow/flow_store.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/kernel/trigger_registry.erl\")) :name)")
+(eval "(get (erlang-load-module (file-read \"next/kernel/flow_dispatch.erl\")) :name)")
+(epoch 3)
+(eval "(get (erlang-load-module (file-read \"next/kernel/pipeline.erl\")) :name)")
+
+;; ── lookup -> dispatch ─────────────────────────────────────
+(epoch 10)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,99>>, ranflow, undefined, any)), flow_store:start_link(), flow_store:register_flow(ranflow, ${DONEF}), pipeline:apply_triggers(${ACT}, ${AS}, ${CFG}) =:= {ok, [{<<97,99,105,100>>, <<116,99>>, {ok, 1}}]}\") :name)")
+;; the dispatched flow really ran (instance recorded done)
+(epoch 11)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,99>>, ranflow, undefined, any)), flow_store:start_link(), flow_store:register_flow(ranflow, ${DONEF}), pipeline:apply_triggers(${ACT}, ${AS}, ${CFG}), flow_store:status(1) =:= {ok, {done, ran}}\") :name)")
+
+;; ── no matching trigger -> no dispatch ─────────────────────
+(epoch 20)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), flow_store:start_link(), pipeline:apply_triggers(${ACT}, ${AS}, ${CFG}) =:= {ok, []}\") :name)")
+
+;; ── guard returns false -> no dispatch ─────────────────────
+(epoch 30)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,99>>, ranflow, fun(_, _) -> false end, any)), flow_store:start_link(), flow_store:register_flow(ranflow, ${DONEF}), pipeline:apply_triggers(${ACT}, ${AS}, ${CFG}) =:= {ok, []}\") :name)")
+
+;; ── dedup: already-fired {activity,trigger} pair -> skipped ─
+(epoch 40)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,99>>, ranflow, undefined, any)), flow_store:start_link(), flow_store:register_flow(ranflow, ${DONEF}), pipeline:apply_triggers(${ACT}, [{actor_id, alice}, {triggers_fired, [{<<97,99,105,100>>, <<116,99>>}]}], ${CFG}) =:= {ok, []}\") :name)")
+
+;; ── multiple triggers for the same type -> each dispatched ─
+(epoch 50)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,49>>, ranflow, undefined, any)), trigger_registry:add(create, trigger_registry:mk_spec(<<116,50>>, ranflow, undefined, any)), flow_store:start_link(), flow_store:register_flow(ranflow, ${DONEF}), {ok, Rs} = pipeline:apply_triggers(${ACT}, ${AS}, ${CFG}), length(Rs) =:= 2\") :name)")
+
+;; ── unknown flow name -> {error, _} in results, no crash ───
+(epoch 60)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,99>>, ghostflow, undefined, any)), flow_store:start_link(), pipeline:apply_triggers(${ACT}, ${AS}, ${CFG}) =:= {ok, [{<<97,99,105,100>>, <<116,99>>, {error, no_such_flow}}]}\") :name)")
+
+;; ── crashing flow -> isolated as {error, {flow_crashed, _}} ─
+(epoch 61)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,99>>, boom, undefined, any)), flow_store:start_link(), flow_store:register_flow(boom, ${BOOMF}), {ok, [{_, _, Outcome}]} = pipeline:apply_triggers(${ACT}, ${AS}, ${CFG}), case Outcome of {error, {flow_crashed, _}} -> true; _ -> false end\") :name)")
+
+;; ── no trigger_registry cfg -> {ok, []} ────────────────────
+(epoch 70)
+(eval "(get (erlang-eval-ast \"trigger_registry:start_link(), trigger_registry:add(create, trigger_registry:mk_spec(<<116,99>>, ranflow, undefined, any)), flow_store:start_link(), flow_store:register_flow(ranflow, ${DONEF}), pipeline:apply_triggers(${ACT}, ${AS}, []) =:= {ok, []}\") :name)")
+EPOCHS
+
+OUTPUT=$(timeout 360 "$SX_SERVER" < "$TMPFILE" 2>/dev/null)
+
+check() {
+  local epoch="$1" desc="$2" expected="$3"
+  local actual
+  actual=$(echo "$OUTPUT" | awk -v e="$epoch" '
+    $0 ~ "^\\(ok-len " e " " { getline; print; exit }
+    $0 ~ "^\\(ok " e " "     { print; exit }
+    $0 ~ "^\\(error " e " "  { print; exit }
+  ')
+  [ -z "$actual" ] && actual="<no output for epoch $epoch>"
+  if echo "$actual" | grep -qF -- "$expected"; then
+    PASS=$((PASS+1))
+    [ "$VERBOSE" = "-v" ] && echo "  ok $desc"
+  else
+    FAIL=$((FAIL+1))
+    ERRORS+="  FAIL [$desc] (epoch $epoch) expected: $expected | actual: $actual
+"
+  fi
+}
+
+check  3 "pipeline module loaded"            "pipeline"
+check 10 "lookup -> dispatch (audit)"        "true"
+check 11 "dispatched flow actually ran"      "true"
+check 20 "no matching trigger -> no dispatch" "true"
+check 30 "guard false -> no dispatch"        "true"
+check 40 "dedup already-fired -> skipped"    "true"
+check 50 "multi-bind: each dispatched"       "true"
+check 60 "unknown flow -> error in results"  "true"
+check 61 "crashing flow isolated"            "true"
+check 70 "no registry cfg -> no dispatch"    "true"
+
+TOTAL=$((PASS+FAIL))
+if [ $FAIL -eq 0 ]; then
+  echo "ok $PASS/$TOTAL next/tests/pipeline_triggers.sh passed"
+else
+  echo "FAIL $PASS/$TOTAL passed, $FAIL failed:"
+  echo "$ERRORS"
+fi
+[ $FAIL -eq 0 ]