Operations

ctrlrun effects --state ambiguous          # the queue that matters
ctrlrun inspect <action-id>                # one action's whole history
ctrlrun receipts --verify-chain            # after a restore, or any direct write
ctrlrun stats                              # what the receipts say

​

What to watch, and what to do about it

​

Getting it somewhere you can see it

​

Routine

• Back up the store. It holds every in-flight effect key, every approval and the receipt chain. Restoring a database from before an action ran is how a duplicate execution becomes possible again.
• Verify the chain after a restore, and after any maintenance that wrote to the database directly.
• Take the backup before the first new process starts on a deploy, because migrations run at open and there is no way back.
• Size the lease to your slowest executor, not to your average one. It defaults to five minutes and is meant to be raised. A lease shorter than the work it covers turns healthy slow actions into unknown outcomes.
• A reporting role still needs CREATE on the schema. Opening the store migrates it, so a read-only role cannot run --verify-chain — it is refused before a receipt is read, naming the missing privilege. Read-only is for your own queries against the tables, not for the CLI.

​

What this does not do

• There is nothing to run. No agent, no sidecar, no scheduler. Every command above is a one-shot read of the store.
• It does not retry for you. A proven non-execution leaves the key retryable — the next attempt is admitted rather than refused — and nothing performs that attempt but your code. Every other outcome refuses one.
• It does not resolve unknown outcomes for you. A person or a reconcile hook does, and only where the hook’s answer points.
• It is not an audit product. Receipts are evidence you can export; what you do with them is outside this project.

​

Next

• Recovery after a crash: why nothing sweeps.
• Reconcile automatically: the hook that answers without a person.
• Get started · Why.