Rebuild the live status page around one chart, and put the causal trace on a dial

apps/api/src/cora/api/main.py

@@ -1507,7 +1507,9 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None]:
                         list_subjects=app.state.subject.list_subjects,
                         list_campaigns=app.state.campaign.list_campaigns,
                         list_datasets=app.state.data.list_datasets,
+                        list_procedures=app.state.operation.list_procedures,
                         list_clearances=app.state.safety.list_clearances,
+                        list_plans=app.state.recipe.list_plans,
                         list_enclosures=app.state.enclosure.list_enclosures,
                         list_decisions=app.state.decision.list_decisions,
                         get_run_history=app.state.run.get_run_history,

apps/api/src/cora/infrastructure/adapters/in_memory_event_activity_trail.py

@@ -32,19 +32,34 @@ async def read_since(
         self, *, cursor: EventActivityCursor, limit: int
     ) -> tuple[list[EventActivityRow], EventActivityCursor]:
         cursor_key = _cursor_key(cursor)
+        all_events = self._store.all_events()
         newer = sorted(
-            (e for e in self._store.all_events() if (e.transaction_id, e.position) > cursor_key),
+            (e for e in all_events if (e.transaction_id, e.position) > cursor_key),
             key=lambda e: (e.transaction_id, e.position),
         )[:limit]
         if not newer:
             return [], cursor
+        # Stands in for the Postgres adapter's LEFT JOIN on `event_id`. Built
+        # over every event in the store, not just the page being returned: a
+        # cause is usually older than the page that carries its effect, so
+        # resolving against `newer` alone would report almost every cause as
+        # unresolvable and the two adapters would disagree.
+        occurred_by_event_id = {e.event_id: e.occurred_at for e in all_events}
         rows = [
             EventActivityRow(
+                event_id=event.event_id,
                 stream_type=event.stream_type,
                 stream_id=event.stream_id,
                 event_type=event.event_type,
                 occurred_at=event.occurred_at,
                 recorded_at=event.recorded_at,
+                correlation_id=event.correlation_id,
+                causation_id=event.causation_id,
+                cause_occurred_at=(
+                    occurred_by_event_id.get(event.causation_id)
+                    if event.causation_id is not None
+                    else None
+                ),
             )
             for event in newer
         ]

apps/api/src/cora/infrastructure/adapters/postgres_event_activity_trail.py

@@ -24,14 +24,21 @@
 """
 
 _READ_SINCE_SQL = """
-SELECT stream_type, stream_id, event_type, occurred_at, recorded_at,
-       transaction_id::text AS transaction_id_text, position
-FROM events
-WHERE (transaction_id, position) > ($1::xid8, $2)
-  AND transaction_id < pg_snapshot_xmin(pg_current_snapshot())
-ORDER BY transaction_id ASC, position ASC
+SELECT e.event_id, e.stream_type, e.stream_id, e.event_type, e.occurred_at, e.recorded_at,
+       e.correlation_id, e.causation_id, cause.occurred_at AS cause_occurred_at,
+       e.transaction_id::text AS transaction_id_text, e.position
+FROM events e
+LEFT JOIN events cause ON cause.event_id = e.causation_id
+WHERE (e.transaction_id, e.position) > ($1::xid8, $2)
+  AND e.transaction_id < pg_snapshot_xmin(pg_current_snapshot())
+ORDER BY e.transaction_id ASC, e.position ASC
 LIMIT $3
 """
+"""The LEFT JOIN rides `events_event_id_unique`, so resolving a cause is one
+index lookup per row and at most `limit` of them. It is LEFT rather than
+INNER because a null `causation_id` is the common case, not an anomaly: every
+operator-originated command arrives over REST with no cause, and an INNER
+join would silently drop exactly those rows."""
 
 # xid8 0 is Postgres's own invalid-transaction-id sentinel: never assigned
 # to a real transaction, so it compares strictly less than any row that
@@ -65,11 +72,15 @@ async def read_since(
             return [], cursor
         activity = [
             EventActivityRow(
+                event_id=row["event_id"],
                 stream_type=row["stream_type"],
                 stream_id=row["stream_id"],
                 event_type=row["event_type"],
                 occurred_at=row["occurred_at"],
                 recorded_at=row["recorded_at"],
+                correlation_id=row["correlation_id"],
+                causation_id=row["causation_id"],
+                cause_occurred_at=row["cause_occurred_at"],
             )
             for row in rows
         ]

apps/api/src/cora/infrastructure/ports/event_activity_trail.py

@@ -9,13 +9,22 @@
 promoting a single-consumer port to the shared kernel would be the reverse
 of the rule-of-three this codebase applies to new cross-cutting primitives.
 
-Ships `stream_type`, `stream_id`, `event_type`, `occurred_at`, `recorded_at`
-only. NEVER `payload`. `test_run_events_carry_no_pii.py` (and its Access-BC
-sibling) are the only two fitness tests that guard event field names against
-personal data, and they cover exactly two of the twenty-five stream types
-this port's data spans; shipping raw payloads across every BC would carry
-that guarantee somewhere it does not hold. A lane needs to know THAT
-something happened and WHAT KIND, never the values inside it.
+Ships `event_id`, `stream_type`, `stream_id`, `event_type`, `occurred_at`,
+`recorded_at`, `correlation_id`, `causation_id` and `cause_occurred_at` only.
+NEVER `payload`. `test_run_events_carry_no_pii.py` (and its Access-BC sibling) are
+the only two fitness tests that guard event field names against personal
+data, and they cover exactly two of the twenty-five stream types this port's
+data spans; shipping raw payloads across every BC would carry that guarantee
+somewhere it does not hold. A lane needs to know THAT something happened and
+WHAT KIND, never the values inside it.
+
+The three relationship columns do not weaken that. They are opaque
+identifiers and one timestamp drawn from the envelope, never from
+`payload`, so no BC's field names ride out on them and the guarantee the two
+fitness tests actually make is unchanged. They answer "which events belong to
+one operator action" and "which event caused this one", both of which are
+structure, not content. Anything requiring a VALUE from inside an event still
+has to come from a domain-specific read, not from here.
 
 Cursor discipline mirrors `cora.infrastructure.ports.event_store`'s own
 documented rule: `position` alone is unsafe (sequences advance on rollback,
@@ -51,11 +60,25 @@ class EventActivityCursor:
 
 @dataclass(frozen=True)
 class EventActivityRow:
+    event_id: UUID
+    """This event's own identity, and the thing a `causation_id` points AT.
+    Without it a consumer holds a cause it can never resolve: it can tell that
+    an event was caused, but not by which of the events it already has."""
+
     stream_type: str
     stream_id: UUID
     event_type: str
     occurred_at: datetime
     recorded_at: datetime
+    correlation_id: UUID
+    causation_id: UUID | None
+    cause_occurred_at: datetime | None
+    """When the causing event happened, resolved by the query rather than left
+    to the reader. A consumer holding a bounded window cannot resolve a
+    `causation_id` older than that window, and without this it can only say
+    "no cause" for an event that certainly had one. Carrying the time turns an
+    unresolvable parent into "caused by something at 14:31:30, before this
+    window" instead of silence. `None` only when `causation_id` is."""
 
 
 class EventActivityTrail(Protocol):

apps/api/tests/integration/test_event_activity_trail_postgres.py

@@ -33,6 +33,10 @@ async def _write_event(
     stream_type: str = "Run",
     stream_id: UUID | None = None,
     event_type: str = "RunStarted",
+    event_id: UUID | None = None,
+    correlation_id: UUID | None = None,
+    causation_id: UUID | None = None,
+    occurred_at: datetime = _NOW,
 ) -> UUID:
     stream_id = stream_id or uuid4()
     await store.append(
@@ -41,12 +45,13 @@ async def _write_event(
         0,
         [
             NewEvent(
-                event_id=uuid4(),
+                event_id=event_id or uuid4(),
                 event_type=event_type,
                 schema_version=1,
                 payload={"irrelevant": "never read back by this trail"},
-                occurred_at=_NOW,
-                correlation_id=uuid4(),
+                occurred_at=occurred_at,
+                correlation_id=correlation_id or uuid4(),
+                causation_id=causation_id,
                 principal_id=None,
             )
         ],
@@ -125,6 +130,59 @@ async def test_read_since_advances_the_cursor_so_a_second_call_sees_nothing_new(
     assert second_rows == []
 
 
+@pytest.mark.integration
+async def test_read_since_carries_correlation_and_a_null_cause_for_an_operator_command(
+    db_pool: asyncpg.Pool,
+) -> None:
+    """A command arriving over REST has no `causation_id`. That is the common
+    case, not an anomaly, so the LEFT JOIN must return the row rather than
+    filter it out the way an INNER join would."""
+    store = PostgresEventStore(db_pool)
+    trail = PostgresEventActivityTrail(db_pool)
+    cursor = await trail.head()
+    correlation_id = uuid4()
+
+    await _write_event(store, correlation_id=correlation_id, causation_id=None)
+    rows, _cursor = await trail.read_since(cursor=cursor, limit=10)
+
+    assert len(rows) == 1
+    assert rows[0].correlation_id == correlation_id
+    assert rows[0].causation_id is None
+    assert rows[0].cause_occurred_at is None
+
+
+@pytest.mark.integration
+async def test_read_since_resolves_the_cause_s_time_even_when_the_cause_is_not_in_the_page(
+    db_pool: asyncpg.Pool,
+) -> None:
+    """The join resolves against the whole table, not the page being returned.
+    A cause is almost always older than the effect that cites it, so a lookup
+    limited to the current page would report nearly every cause unresolvable
+    and hand the browser a window it cannot distinguish from "uncaused"."""
+    store = PostgresEventStore(db_pool)
+    trail = PostgresEventActivityTrail(db_pool)
+
+    cause_event_id = uuid4()
+    cause_at = datetime(2026, 6, 21, 11, 20, 0, tzinfo=UTC)
+    await _write_event(store, event_id=cause_event_id, occurred_at=cause_at)
+
+    # Baseline AFTER the cause, so the cause is deliberately outside the page.
+    cursor = await trail.head()
+    await _write_event(
+        store,
+        stream_type="Caution",
+        event_type="CautionRegistered",
+        causation_id=cause_event_id,
+    )
+
+    rows, _cursor = await trail.read_since(cursor=cursor, limit=10)
+
+    assert len(rows) == 1
+    assert rows[0].event_type == "CautionRegistered"
+    assert rows[0].causation_id == cause_event_id
+    assert rows[0].cause_occurred_at == cause_at
+
+
 @pytest.mark.integration
 async def test_read_since_limit_truncates_and_the_cursor_still_advances(
     db_pool: asyncpg.Pool,