Docs / Specification

A-run — Runs, pipelines and derive decisions

Status: accepted

disposable-execution-state — Disposable execution state shares one remote recovery database

Cited byrun.export.remote-staterun.export.remote-stateUnder container-profile, PostgreSQL holds typed outboxes, acknowledged keyed state and log checkpoints in the execution database; a replacement reoffers identical pending event ids before advancing its acknowledged frontier.run.export.writer-fencedrun.export.writer-fencedA PostgreSQL exporter whose durable writer lease has transferred raises ExecutionWriterFenced before dispatch or state publication; its lease row stays locked throughout an admitted outbound call, and takeover waits for that call.

A disposable disk loses paid-call records, callbacks and pending exports, so execution replacement needs every recorded value in one remote database behind the existing storage ports.

d1-execution-state — D1 execution state uses a private binding and durable callback guards

Cited byrun.journal.d1-profilerun.journal.d1-profileCONTEXTFUL_STORAGE_PROFILE=cloudflare-d1 selects D1 for catalog, journal, awakeables and export state through a private Worker outbound binding; R2 holds blob content and corpus objects.run.callback-guard.scoperun.callback-guard.scopeA guard protects each owner scope its callback admits, every ancestor scope and every lease key, entity fences included; another job's admission, an unrelated export and transfer of any unprotected row proceed.run.callback-guard.acquirerun.callback-guard.acquireGuard acquisition checks the exact owner, active attempt and fence of every row it protects and binds them in one D1 statement; a row another guard protects admits no second callback.run.callback-guard.identityrun.callback-guard.identityA guard records its execution, attempt, holder identity, journal entry key, the key idempotency-key sends, admission time, and its destination's declared deduplication window, none when the destination declares none.run.callback-guard.releaserun.callback-guard.releaseA holder deletes its own guard when its callback returns, before journaling the callback's value.run.callback-guard.replayrun.callback-guard.replayWithout an operator, a guard releases only when its holder is gone, its owner lease has lapsed and window still covers its key; release and takeover commit in one D1 batch, and replay sends that key.run.callback-guard.manualrun.callback-guard.manualApart from release and replay, a guard releases only through contextful storage reconcile-guard, which deletes it and appends an audit row naming token, evidence and operator in one D1 batch.run.callback-guard.classrun.callback-guard.classA guard's evidence class is replay-safe while window covers its key; otherwise receipt-required for a publication callback and unknown for any other.run.export.d1-staterun.export.d1-stateUnder d1-profile, D1 commits export outboxes, acknowledged keyed state and log checkpoints; a sink commit without its D1 acknowledgement reoffers the same delivery identity.

D1’s batch transaction ends with the request, so it holds no database lock across a provider call. A durable guard row blocks transfer of its callback’s rows until release; expiry could admit a second writer while the effect is ambiguous, and a key alone proves no deduplication.

d1-coordinated-groups — D1 coordinated groups commit through versioned sender rows

Cited byrun.export.group-storagerun.export.group-storageA coordinated publication under postgres raises PublicationStorageUnsupported naming the coordinated-group-outbox capability before execution, staging or delivery; a cloudflare-d1 sender state over 8 MiB raises it before staging.run.export.group-d1-staterun.export.group-d1-stateUnder d1-profile, D1 holds each group's producer frontier, sender outbox and active namespace; one D1 batch commits a completing acknowledgement with its promoted state and active namespace.run.export.group-d1-leaserun.export.group-d1-leaseA cloudflare-d1 group writer holds one durable D1 lease per publication, and every sender write predicates on that lease and the row's prior version.run.export.group-d1-recoveryrun.export.group-d1-recoveryAfter an empty-disk replacement, contextful export group resumes a staged or partially acknowledged cloudflare-d1 group from D1, reoffering identical group and event identifiers before staging a later frontier.

The sender’s state machine stays; only its persistence changes. A batch’s first statement takes a fresh write token, and each later statement predicates on it, so a lost race changes no row.

registered-bodies-pin — Registered bodies pin the executing host and public semantic dependencies

Cited byrun.own.body-implementationrun.own.body-implementationStore-driven owner pins include the host-verified digest of its executing binary and concrete registered body type; configuration selects a body name and supplies no implementation identity.run.own.body-dependenciesrun.own.body-dependenciesRegistration declares prompt/template, public provider/model configuration and policy identities affecting execution; owner pins carry their digests independently of structural input and output declarations.

Configuration names registered code and cannot authenticate a digest supplied beside that name. Credential values have no field in provider semantics.

plan-compiled-content — A plan is compiled, content-hashed data with no embedded runtime

Cited bytopology.compose.script-runtimetopology.compose.script-runtimeA JavaScript runtime linked into any profile raises ScriptRuntimeLinked. The authoring surface is a build-time compiler emitting a serialized, content-hashed plan.run.compile.authoring-surfacerun.compile.authoring-surfaceAuthoring code runs only at build time and emits a content-hashed plan. No authoring code executes in the serving environment. No build profile embeds a scripting runtime.run.compile.inline-step-bodyrun.compile.inline-step-bodyA step body other than a connector reference raises PipelineInlineStepBody.run.compile.control-flowrun.compile.control-flowA data-dependent conditional or loop in a workflow body raises PipelineUndeclaredControlFlow; branching travels as branch and fan-out as parallel.run.compile.node-id-collisionrun.compile.node-id-collisionA node id repeated in one plan raises PipelineNodeIdCollision, naming the id and both positions.run.transform.arityrun.transform.arityA chain operation emitting more rows than it consumed raises PipelineTransformArity.run.select.no-store-rootrun.select.no-store-rootA source built without a store root or without its pipeline id raises DeriveNoStoreRoot, naming which is absent.

A journaled step replays correctly only against the definition that produced it. Data selects a declared arm and never which arms exist.

incremental-position-bound — An incremental position is bound to a named field and a seed is bounded

Cited bystore.lease.cursor-kindstore.lease.cursor-kindA cursor whose kind takes no lease reaching cursors/ raises LeaseCursorKindMismatch.store.merge.cursor-recencystore.merge.cursor-recencyResolving a cursor by last-write time raises SyncCursorConflict. A cursor resolves through its commit.run.advance.field-renamerun.advance.field-renameOpening a position whose stored field differs from the declared incremental field raises CursorFieldMismatch before any request leaves the host.run.advance.walk-positionrun.advance.walk-positionUnder a monotonic cursor, a pull reporting more and carrying a position other than the one it asked continues its walk: the next pull asks that position and admits rows from the walk's floor, and the run commits the frontier.run.advance.unorderable-positionrun.advance.unorderable-positionA row with no orderable value in the clock field, or a stream switching between text and numeric positions mid-pass, raises CursorPositionUnorderable, terminal for the pull.run.seed.declaration-missingrun.seed.declaration-missingA seeded table without primary_key, or with order_by left at the ingest stamp, raises PipelineSeedDeclarationMissing at plan and validate.run.seed.ceiling-breachedrun.seed.ceiling-breachedA seeded row whose ordering stamp reaches below raises PipelineSeedCeilingBreached naming the value; its chunk lands nothing, and the stamp is neither clamped nor dropped.run.seed.ceiling-unevaluablerun.seed.ceiling-unevaluableA batch missing the ordering column, or a stamp unorderable against the ceiling, raises PipelineSeedCeilingUnevaluable; a text stamp orders only when Z-suffixed at the ceiling's fractional width.run.seed.source-changedrun.seed.source-changedA differing fingerprint raises PipelineSeedSourceChanged naming both values; an equal one skips the load, and an unavailable one skips with a warning.

A cursor value means nothing without the field it was measured on.

external-signals-single — External signals are single-valued catalog writes

Cited byrun.suspend.conflicting-resolutionrun.suspend.conflicting-resolutionA second resolution with a different payload raises AwakeableAlreadyResolved and leaves the recorded value untouched.run.suspend.expired-tokenrun.suspend.expired-tokenResolving a token past its deadline raises AwakeableTimedOut.run.cancel.not-in-flightrun.cancel.not-in-flightOnly a row holding a non-terminal RunStatus accepts a mark; a stop matching none raises CancelTargetNotInFlight, answering 409 over HTTP and exiting non-zero at the terminal.run.cancel.distinct-terminal-statusrun.cancel.distinct-terminal-statuscanceled is a terminal status apart from failed, and upstream health observations skip it.

A signal’s value is fixed once observed, so replay reads what the first resumption saw. Deadlines evaluate lazily, so no target owes a durable timer.

Revisit: a deploy target where the requesting process and the run share no catalog; the poll’s catalog read becomes measurable under high fire concurrency.

derive-work-set — The derive work set is an anti-join against marker rows

Cited byrun.select.anti-joinrun.select.anti-joinEach tick recomputes the outstanding set: every parent row holding neither a passage nor a settled marker under its current derivation-key in the pipeline's own output table, or, for a host task, its marker table.run.select.parent-scanrun.select.parent-scanThe derive source scans parent tables of at most 1000000 rows in memory. For larger tables, the source streams through the read engine in batches, holding one batch in memory.run.emit.failure-off-tablerun.emit.failure-off-tablePer-unit failure state recorded outside the output table raises DeriveFailureOffTable.run.emit.unit-statusrun.emit.unit-statusunit_status is ok, empty where the engine established nothing to derive, unavailable where it returned nothing and stated no reason, or failed on a typed error; any other value raises DeriveUnitStatusUnknown.run.emit.reserved-discriminatorrun.emit.reserved-discriminatorA derive table declaring a column named kind raises DeriveReservedDiscriminator.run.emit.host-rowsrun.emit.host-rowsA host task's content row carries its unit's unit_ref, derivation_key and task_version, kind passage and unit_status ok; every unit lands one marker, ok over content rows, empty over none.run.emit.output-tablesrun.emit.output-tablesA host-task pipeline declares exactly its task's marker and content tables, and a unit returns rows for its content tables alone; either breach raises DeriveOutputTablesMismatch, the second failing that unit alone.run.emit.marker-lastrun.emit.marker-lastA host-task run commits each content table under its own commit, then the marker table, and a content table failing stops the fire before its marker lands, so the unit re-runs and its rows collapse by key.

The tier’s own output table is the single record of what is done, failed or settled, and each tick recomputes the work set from it.

Revisit: the parent scan dominates tick cost on a real archive; a re-derive signal for changed parent rows becomes necessary.

derivation-key-decides — A derivation key decides whether a settled unit is current

Cited byrun.select.required-keyrun.select.required-keyMissing or blank source_table or parent_id_column raises DeriveConfigKeyMissing, naming the key and pipeline. For built-in tasks, missing or blank engine or media_column raises the same error.run.select.foreign-output-tablerun.select.foreign-output-tableThe anti-join's pipeline id comes from the build alone; a config key naming another pipeline's output raises DeriveForeignOutputTable.run.select.unit-parentsrun.select.unit-parentsA host task reads each joined table once, before the anti-join and before processing its first unit. Each unit carries every row whose join-column value equals that unit's key. Rows landed after that read are absent.run.select.join-keyrun.select.join-keyA host task that joins tables also hashes each unit's joined rows into its task-version key, each table's rows sorted over its read columns, so a joined row landing, changing or leaving re-derives that unit alone.run.select.key-changerun.select.key-changeRows under the current key landed before the unit's latest ok or empty landing under another key count for nothing, so a key changed and changed back derives the unit again.run.emit.settled-revivedrun.emit.settled-revivedA unit that settles under its current key while a tick derives it raises DeriveSettledUnitRevived, and that tick lands none of its rows; a changed key revives nothing.run.emit.derivation-keyrun.emit.derivation-keyEvery passage and marker row carries derivation_key: lowercase hex SHA-256 over the engine id, the binding less its bounds and zone, the output table's declared columns, and the parent row's id, media value and derivation_key.run.emit.stale-supersedesrun.emit.stale-supersedesA unit's latest ok or empty landing supersedes rows landed earlier under another key. Those rows answer until that landing. The next fold drops the superseded rows and rebuilds the table's sidecars without them.run.emit.marker-rowrun.emit.marker-rowA unit yielding no passage lands one marker row, cue_seq -1 and kind marker, carrying its status, attempts, last error and whether it retries.

An engine id alone never re-derives a corrected parent row. A unit’s old rows answer until its new rows or marker commit, so no read sees an empty unit.

Revisit: hashing parent rows dominates tick cost on a real archive.

derived-unit-follows — A derived unit follows its parent’s bytes and lifetime

Cited byrun.emit.stale-supersedesrun.emit.stale-supersedesA unit's latest ok or empty landing supersedes rows landed earlier under another key. Those rows answer until that landing. The next fold drops the superseded rows and rebuilds the table's sidecars without them.run.emit.local-content-keyrun.emit.local-content-keyA local media unit's derivation-key includes a SHA-256 digest of canonical file bytes, so changed bytes under an unchanged path reselect the unit.

A media path can stay constant while its bytes change, and a deleted parent leaves derived rows in another table. Freshness and no orphaned citations decide.

passage-s-modality — A passage’s modality names its output

Cited bystore.reserve.modalitystore.reserve.modality_modality takes text, image, audio, structured or mixed; another value fails its batch's validation.run.emit.output-modalityrun.emit.output-modalityA text passage extracted from a video parent carries _modality text, and an advertised image passage carries image, each under modality.

Output kind decides retrieval and sidecar selection. A passage keeps its source medium through its parent link.

chained-derive-pipelines — Chained derive pipelines follow their source tables

Cited byrun.select.derive-orderrun.select.derive-orderA derive pipeline reading another derive pipeline's output table runs after that parent on the parent's tick, regardless of declaration order or its own schedule.run.select.parent-outcomerun.select.parent-outcomeA derived child starts only once its parent produces a completed run outcome, a failed one included, and then reads only the parent's committed rows; a launch, wait or signal failure, or a worker dispatch error, stops the unit first.run.select.join-orderrun.select.join-orderA host task joining another derive pipeline's output table runs after that pipeline on its tick, as derive-order orders a source table's reader; among several such parents on one chain, it runs after the last.run.select.derive-cyclerun.select.derive-cycleA build whose derive source-table or join dependencies return to a pipeline raises DeriveCycle, names every pipeline on the cycle and arms none.run.select.derive-after-conflictrun.select.derive-after-conflictA derive child whose after names a pipeline other than the derive parent it runs after raises DeriveAfterConflict and arms none.

Declaration order and independent schedules give no landing order. One tick carries a new parent row through its children.

selection-stays-bounded — Selection stays bounded and countable before a tick pays

Cited byrun.select.unit-parentsrun.select.unit-parentsA host task reads each joined table once, before the anti-join and before processing its first unit. Each unit carries every row whose join-column value equals that unit's key. Rows landed after that read are absent.run.select.dry-runrun.select.dry-runpipeline run --dry-run on a derive pipeline prints its eligible, already-derived and outstanding unit counts from one selection, calling no engine and landing no row.

Selection memory stays independent of archive size, and the outstanding count is known before any engine spend.

derive-engine-machine — A derive engine is a machine-bound argv child with a cleared environment

Cited byrun.bind.unbound-enginerun.bind.unbound-engineAn engine with no [derive.<name>] block raises DeriveEngineUnbound, naming the pipeline, the engine, the file to edit and every bound engine.run.bind.command-in-manifestrun.bind.command-in-manifestA Binding key preprocess, env or allow_hosts, or a step's command, inside [pipeline.source.config] raises DeriveCommandInManifest.run.bind.unknown-taskrun.bind.unknown-tasktask names transcribe, the default, link_preview, or a task the embedding binary registered; any other value raises DeriveUnknownTask, listing the built-in and registered names.run.bind.host-taskrun.bind.host-taskAn embedding binary registers each compiled derive task by name before build. Configuration selects that registered name without supplying a command. A duplicate built-in or registered task name raises DeriveTaskNameTaken.run.bind.driver-mismatchrun.bind.driver-mismatchdriver is exec or "none" behind transcribe and fetch behind link_preview, and a host task names no engine; any other pairing raises DeriveDriverMismatch.run.bind.endpoint-host-barerun.bind.endpoint-host-bareAn endpoint_host carrying a path, query, port or scheme raises DeriveEndpointHostNotBare.run.bind.remote-url-unsupportedrun.bind.remote-url-unsupportedAn http or https media value for an engine declining remote addresses raises DeriveRemoteUrlUnsupported, naming the when = "media_is_url" preprocess step.run.bind.media-unreadablerun.bind.media-unreadableA media value that is neither an address nor a readable local file raises DeriveMediaUnreadable, failing that unit alone.run.bind.confidence-rangerun.bind.confidence-rangeA confidence outside 0.0..=1.0 after adapter normalization raises DeriveConfidenceOutOfRange and lands null.run.bind.advisory-zonerun.bind.advisory-zoneA row zone taken from the binding's advisory zone key raises DeriveAdvisoryZone.run.exec.shell-commandrun.exec.shell-commandA string-valued command raises DeriveShellCommand; no-shell runs the argument array.run.exec.env-namerun.exec.env-nameAn allowlist name that is not ASCII alphanumeric or underscore, or that leads with a digit, raises DeriveEnvNameInvalid.run.exec.non-zero-exitrun.exec.non-zero-exitA step exiting non-zero raises DeriveStepExit carrying its bounded error text into the run audit.run.exec.deadline-elapsedrun.exec.deadline-elapsedIf a chain exceeds its deadline, the executor raises DeriveStepTimeout, naming the running step.run.exec.output-caprun.exec.output-capThe executor counts and discards output past the bound without buffering. Crossing the bound kills the step and raises DeriveOutputCap with the byte count. The executor continues draining so the child does not block.run.exec.silent-steprun.exec.silent-stepA preprocess step exiting zero without writing its output file raises DeriveStepProducedNothing.run.exec.no-shellrun.exec.no-shellA step runs as its argument array with no shell, in a process group of its own, under a cleared environment holding only the binding's env table.

A manifest requests an engine by name; the machine’s configuration defines what that name executes. Row data never becomes syntax.

Revisit: operators routinely wrap steps in pinned scripts to recover shell features.

nested-arrow-canonical — Nested Arrow is canonical and the relational shape is a reversible projection

Cited byrun.normalize.mode-unknownrun.normalize.mode-unknownA mode outside the two raises PipelineNormalizeModeUnknown, printing both spellings.run.normalize.list-index-missingrun.normalize.list-index-missingA relational child table emitted without the list index that makes its projection reversible raises PipelineListIndexMissing, naming the parent and the list.

Normalizing once in host code serves any number of sinks. The list index makes shredding reversible.

Revisit: orphaned children from root-level filtering become a reported data-quality problem; a deployment is relational at every sink.

table-commit-owns — A table commit owns its schema-diff evidence

Cited byrun.record.schema-diff-homerun.record.schema-diff-homeA table's run manifest holds its committed downgrade events with its parts and cursor; run history reads them under that run id.run.record.schema-diff-shaperun.record.schema-diff-shapeEach downgrade event names the table, column path, source type, landed type and reason; a stage that does not commit contributes none.

The reconciled schema describes only the latest shape, and a live projection can drop events. The commit marker publishes rows, cursor and schema evidence together.

secret-guard-has — The secret guard has one host-owned catalogue

Cited byrun.guard-secrets.matchersrun.guard-secrets.matchersMatchers are linear-time, regex-free forward scans, each anchored on a literal prefix; the credential catalogue lives in code under a precision and recall fixture test.run.guard-secrets.llm-candidaterun.guard-secrets.llm-candidateAn LLM candidate starts with sk- at input start or after a byte outside ASCII alphanumerics, - and _; its tail spans that alphabet. Admission masks the whole candidate.run.guard-secrets.llm-admissionrun.guard-secrets.llm-admissionAn LLM candidate needs 32 B of tail: a proj-, svcacct-, service-, admin- or ant- prefix permits the whole tail; otherwise its first 32 bytes are ASCII alphanumerics.run.guard-secrets.mask-onlyrun.guard-secrets.mask-onlyThe guard is on by default and blocks no run; each pull logs the count of masked cells per column.

A manifest edit cannot change what the host considers a secret. A catalogue change carries code and a fixture review.

Consequences: a prefix-only scan conflates long hyphenated public identifiers with credentials, so bare candidates take a narrower grammar than tagged families.

decoder-child-owns — A decoder child owns one input and two bounds

Cited byrun.land.parse-deadlinerun.land.parse-deadlineA decode runs for at most 60 s from child spawn; expiry kills its process group and raises parse-crashed.run.land.parse-memoryrun.land.parse-memoryA decoder child receives at most 512 MiB of memory; exceeding the bound fails that input under parse-crashed.

The bounds protect the serving process while one input fails by name. A child carries no parser state into another input.

observed-batch-fixes — An observed batch fixes its landing types

Cited byrun.land.typed-pullrun.land.typed-pullA pull's types object maps a column to a type spelled as typed-landing reads it, and the run commit lands that column in it; an unreadable spelling fails the pull as incompatible.run.land.irreconcilable-schemarun.land.irreconcilable-schemaAn arriving schema the store cannot reconcile fails the batch as incompatible.

A source without schema discovery still runs. A source reporting no rows offers no guessed columns.

run-substrate-storage — The run substrate is three storage ports, and the file tree is one adapter

Cited byrun.journal.blob-writerun.journal.blob-writeConcurrent writers of one blob hash converge on one stored value and none errors on another's write; no partial write survives beside it.run.journal.substrate-portrun.journal.substrate-portOne execution interface provides: open or resume under a scope and content-hashed plan reference; record step output; commit a cursor; suspend on an awakeable with timeout; attach a retry schedule; describe capabilities.run.journal.storage-portsrun.journal.storage-portsJournal rows, blobs and awakeables persist through a journal store, a blob store and an awakeable store; every run.journal and run.suspend clause holds for each adapter, the file tree included.run.journal.postgres-storesrun.journal.postgres-storescontextful-pg serves journal rows, blobs and awakeables through storage-ports in the catalog's PostgreSQL database; conditional journal writes serialize across connections, and recorded values survive replacement of every local disk.run.journal.container-profilerun.journal.container-profileCONTEXTFUL_STORAGE_PROFILE=postgres selects postgres-stores with shared owners, cadence and remote-state; corpus objects use a remote S3-compatible bucket with pull-before-run and push-after-run enabled.run.journal.d1-profilerun.journal.d1-profileCONTEXTFUL_STORAGE_PROFILE=cloudflare-d1 selects D1 for catalog, journal, awakeables and export state through a private Worker outbound binding; R2 holds blob content and corpus objects.run.journal.d1-blobrun.journal.d1-blobD1 commits metadata atomically and stores each blob digest, whose R2 object key is blobs/<sha256>; an R2 write precedes its D1 reference, an R2 deletion follows removal of every reference, and a read verifies the digest.run.journal.d1-guardrun.journal.d1-guardA committed D1 guard blocks transfer of the rows it protects throughout an admitted external callback and outlives the callback's crash, releasing only under release, replay or manual.run.journal.d1-recoveryrun.journal.d1-recoveryThe D1 recovery identity binds one project and schema to an R2 object frontier; a missing object or mismatched generation follows execution-recovery.run.journal.d1-backuprun.journal.d1-backupA D1 recovery captures the execution database with its guard and export rows, the R2 blob and corpus frontier, project recovery identity and executable schema before writers resume.run.journal.storage-incompleterun.journal.storage-incompleteMissing profile bindings, corpus state, strict execution guards or a supported outbox raises StorageCapabilityMissing before execution admission; absent compiled adapters follow capability-absent.run.journal.execution-recoveryrun.journal.execution-recoveryMissing execution tables or a mismatched project recovery identity raise ExecutionRecoveryMismatch. Normal startup provisions no recovery identity. A corpus-only restore admits no paid or effectful work.run.journal.current-ownerrun.journal.current-ownerAn execution checks its durable owner, admitted pins and active attempt immediately before effect dispatch and publication; a superseded attempt enters neither boundary, and a late stop still follows land-path-uncut.run.journal.durable-dispatchrun.journal.durable-dispatchPostgreSQL admission holds shared owner and unexpired lease locks through each bounded provider or destination callback, including item ancestors and entity fences; owner replacement, retirement and takeover serialize after admitted callbacks.

A host keeping its own transactional store would otherwise hold replay state twice, the second copy outside its retention and export. One home for replay state per host decided it.

blob-put-may — A blob put may wait on its adapter’s write lock

SQLite holds one write lock per file, so its put waits behind another connection’s write transaction. One transactional home for journal rows and blobs decided it.

Revisit: a host runs a long write transaction on the machine file beside the run stores.

host-opens-execution — A host opens an execution through one handle keyed on a declared scope

Cited byrun.journal.substrate-portrun.journal.substrate-portOne execution interface provides: open or resume under a scope and content-hashed plan reference; record step output; commit a cursor; suspend on an awakeable with timeout; attach a retry schedule; describe capabilities.run.own.host-scoperun.own.host-scopeThe catalog keys every owner on its scope — live table, backfill chunk or host-declared id — a table owner keeping its stored key byte for byte, and a host owner pinning the plan reference and identities the host supplies.

A derive step or host job would otherwise restate owner claim, pin check and retirement. One implementation of those rules decided it.

superseded-owner-retires — A superseded owner retires by operator verb or applied declaration, never at open

Cited byrun.own.apply-retires-supersededrun.own.apply-retires-supersededA claimed pipeline apply retires a build or sweepless store-driven job's pending owner when the applied snapshot produces no matching declared plan reference: a verified body's input identity, otherwise its plan reference.run.own.apply-retire-refusedrun.own.apply-retire-refusedAn applied retirement meeting rewind-unsafe leaves the owner pending and the snapshot claimed, and the apply names the execution and rewind on standard error.

A pending owner pinned to a plan no declaration produces refuses every fire. No recorded work is discarded without an operator decision or a declaration that cannot resume it.

unclosed-execution-recovers — An unclosed execution recovers by lease takeover, and one keeper per engine renews leases

Cited byrun.cancel.engine-keeperrun.cancel.engine-keeperOne keeper per engine renews every registered execution's owner lease and feeds its token, sleeping until the earliest deadline; opening an execution registers it, and close or drop deregisters it.run.cancel.abandoned-workrun.cancel.abandoned-workAbandoned work surfaces as the Canceled tag through the ordinary failure path, which settles the request ledger, closes the record and leaves the position alone.

A crashed process runs no destructor, so a status written on drop covers only the clean exit and one event reads two ways.

Revisit: a renewal lags measurably under a large deadline heap.

host-registered-derive — A host-registered derive task is compiled code, versioned into the derivation key

Cited byrun.own.host-scoperun.own.host-scopeThe catalog keys every owner on its scope — live table, backfill chunk or host-declared id — a table owner keeping its stored key byte for byte, and a host owner pinning the plan reference and identities the host supplies.run.own.unclosed-executionrun.own.unclosed-executionAn execution handle dropped without close records no status; its owner stays pending, and the next open under its scope resumes it once owner-lease lapses.run.own.body-implementationrun.own.body-implementationStore-driven owner pins include the host-verified digest of its executing binary and concrete registered body type; configuration selects a body name and supplies no implementation identity.run.own.body-dependenciesrun.own.body-dependenciesRegistration declares prompt/template, public provider/model configuration and policy identities affecting execution; owner pins carry their digests independently of structural input and output declarations.run.own.rewindrun.own.rewindcontextful run rewind <execution-id> --reason <text> retires the pending host or table owner holding that execution and leaves the scope's committed position alone, so the scope's next fire claims a fresh execution.run.own.rewind-unsaferun.own.rewind-unsafeRetiring an owner with an attempt on an unexpired owner-lease, a waiting attempt, or an awakeable pending before its deadline raises ExecutionRewindUnsafe naming it; --force overrides none.run.own.apply-retires-supersededrun.own.apply-retires-supersededA claimed pipeline apply retires a build or sweepless store-driven job's pending owner when the applied snapshot produces no matching declared plan reference: a verified body's input identity, otherwise its plan reference.run.own.apply-retire-refusedrun.own.apply-retire-refusedAn applied retirement meeting rewind-unsafe leaves the owner pending and the snapshot claimed, and the apply names the execution and rewind on standard error.run.own.checkpoint-commitrun.own.checkpoint-commitWhen the parts a run of a position-addressed source staged since its last commit reach 512 MiB, the run commits them with the position after its last staged pull before staging more rows, then keeps pulling under the same execution.run.own.checkpoint-frontierrun.own.checkpoint-frontierUnder a monotonic cursor, a checkpoint commits only before a pull whose every clock passes the run's frontier, so no commit's position splits the rows of one instant.run.own.checkpoint-resumerun.own.checkpoint-resumeA checkpoint caches its position and marker in the catalog cursor while the owner stays pending, and collects the journal's recorded pulls, so a resumption pulls afresh from that position.run.own.checkpoint-scoperun.own.checkpoint-scopeA source is position-addressed when each pull's position names a watermark, page token or stable offset. A http-url-walk, a replacing table, a body's prepared landing, and a seeding or receiving scope commit once.run.emit.task-versionrun.emit.task-versionA host task's derivation_key hashes its registered name, its task_version and the parent row's id, declared columns and derivation_key, so raising the version re-selects every settled unit.run.emit.version-retainedrun.emit.version-retainedOn an output table declaring retain_versions, stale-supersedes holds per unit and task_version, so rows under an earlier task version stay current under that version beside the newer version's rows.

Configuration selects only engine-named code, and a task version change re-selects every settled unit. A unit spanning several tables is whole once its marker commits.

model-declared-sql — A model is a declared SQL table whose build publishes through its snapshot manifest

Cited byrun.model.model-blockrun.model.model-blockA [[model]] block takes ModelSpec, with statement-source, model-policy and opt-out-record; an unknown key refuses as spec-invalid.run.model.build-idrun.model.build-idA build's id is the snapshot id it publishes.run.publish.holdrun.publish.holdA hold is a HoldRecord committed as holds/<build id>.json in the model's table directory, replacing any earlier hold on that build; collection skips a held build, and a hold confers no other authority.

A reader comparing two figures needs the build each came from. No representable torn publication decided it.

coordinated-exports-activate — Coordinated exports activate a complete immutable group in a receiver namespace

Cited byrun.export.group-blockrun.export.group-blockA local [[publication]] takes PublicationDeclaration; its typed export members cover every producer output exactly once and share one destination and header binding.run.export.group-sourcerun.export.group-sourceA successful store-driven job or materialized model build records one immutable completion binding its run identifier, pinned input frontier and all output table frontiers, including empty outputs.run.export.group-deliveryrun.export.group-deliverycontextful export group <name> reads every completed producer member through post-commit-read, rechecks every frontier, and stages one ordered outbox with explicit member-complete events followed by one group-complete event.run.export.group-identityrun.export.group-identityA group's identity binds its store incarnation, destination, namespace, read identity, predecessor, publication order, input frontier, membership, delivered base and next state; each event identifier binds that group and its sequence.run.export.group-activationrun.export.group-activationA receiver stages member events transactionally and activates every member together only after validating the complete group; interrupted delivery preserves the active group, and acknowledged retries preserve its bytes and visibility.run.export.group-checkpointrun.export.group-checkpointcontextful export checkpoint saves delivery state; contextful export restore replays compatible immutable events while the receiver retains its accepted groups and active frontier, so an older checkpoint reverses no deletion or later publication.run.export.group-rebuildrun.export.group-rebuildcontextful export rebuild <name> --namespace <epoch> exports the completed producer's full admitted state into a fresh namespace without executing its effects; the receiver keeps its active namespace until the replacement group completes.run.export.group-incompatiblerun.export.group-incompatibleMembership drift, incarnation mismatch, a changed pending read identity, an incompatible checkpoint, an incomplete producer frontier, or a predecessor/order mismatch raises PublicationIncompatible before delivery or activation.

Output tables commit independently, and a downstream projection needs one completed frontier across every member. Atomic visibility and stale-replay refusal decide.

sweep-freezes-transaction — A sweep freezes one transaction-time bound and carries state through its own outputs

Cited byrun.sweep.frozen-as-ofrun.sweep.frozen-as-ofEvery origin of one sweep reads at one as_of: the job's declared as_of, else the instant the sweep opens, recorded once as open-as-of records it for resumes.run.sweep.carried-staterun.sweep.carried-stateUnder state = "carried", origins run in ascending order one at a time, each reading the job's output tables at the commit of the preceding origin and every other table at the sweep's as_of.run.sweep.fresh-staterun.sweep.fresh-stateUnder state = "fresh", the default, every table an origin reads, its output tables included, resolves at the sweep's as_of, so no origin reads a row another origin wrote.

Availability time separates origins; transaction time fixes the corpus. Origins then differ only in their availability bound.

build-stale-landings — A build is stale by the landings it has not read

Cited byrun.publish.stalenessrun.publish.stalenessA published model is stale at t when an input holds a committed run outside its watermark snapshot chain, its commit_seq above through, committed before t minus max_lag; build status --json names each such input under stale_inputs.run.publish.staleness-omitted-checkrun.publish.staleness-omitted-checkAn input whose runs outside the watermark snapshot chain, at or below through, differ in count or digest from omitted holds a waiting run counted as committed before t minus max_lag.run.publish.staleness-model-inputrun.publish.staleness-model-inputAn input that is a model also waits on each of its published builds newer than the watermark snapshot, aged by that build's created_at.run.publish.staleness-collected-runrun.publish.staleness-collected-runA waiting run whose manifest retention collected counts as committed before t minus max_lag.

The newest input commit against the clock reads a quiet input stale forever. A rebuild over the current frontier always clears staleness.

minor-contract-bump — A minor contract bump admits only what an old reader still reads

Cited byrun.model.contract-majorrun.model.contract-majorUnder the published build's major, a contract that drops or retypes a published column, makes a non-null one nullable, adds a non-null column or changes the grain refuses as contract-mismatch, naming the column and the major to bump.run.model.contract-minorrun.model.contract-minorUnder the published build's major, a contract that only adds nullable columns or makes nullable ones non-null publishes once its minor exceeds the published one, else refuses as contract-mismatch, naming the added or tightened column and the bumped minor.

A reader written against an earlier minor of the same major reads every later build unchanged.

orchestrator-role-port — The orchestrator role is a port, and a provider’s workflow engine fills it at the unit grain

Cited byrun.orchestrate.rolerun.orchestrate.roleA target's orchestrator implements every operation in substrate-port. The engine runner over storage-ports is the reference implementation.run.orchestrate.provider-steprun.orchestrate.provider-stepA provider adapter runs one provider step per table pull or backfill chunk, recording that table's or chunk's commit pointer. The engine's journal entries under entry-key remain inside the provider step.run.orchestrate.semanticsrun.orchestrate.semanticsEvery run.journal, run.retry, run.suspend and run.cancel clause holds inside a provider step. An adapter's conformance suite demonstrates these clauses before a target profile names the adapter.

A step otherwise crosses two engines. One semantics, proved once, holds inside each provider step.

Revisit: a provider offering a sub-chunk grain.

awakeable-resumes-credentialed — An awakeable resumes on the credentialed face, beside the worker relay

Cited byrun.suspend.awakeablerun.suspend.awakeableAn awakeable suspends a run durably: the engine mints an opaque single-use token and persists a pending row through the awakeable store; an external party resumes by posting the token back.run.suspend.resume-routerun.suspend.resume-routePOST /awake/:token on the served face answers 200 with the recorded payload, 404 for unknown-token, 409 for conflicting-resolution and 410 for expired-token. GET /awake/:token reports state without resuming.run.suspend.resume-authenticatesrun.suspend.resume-authenticatesThe resume route admits the request's credential before reading the registry, answering 401 without one, and passes the credential's verified on_behalf_of as the caller subject.

The relay’s deployment key names no caller, so the relay cannot hand the registry a verified subject.

bound-hit-rides — A bound hit rides its failure and is listed on the run record

Cited byrun.retry.bound-hit-is-transientrun.retry.bound-hit-is-transientA connector striking linear-memory or call-deadline fails the attempt Transient, the failure naming the bound it struck.run.retry.bound-hit-recordedrun.retry.bound-hit-recordedThe run record lists every bound hit with its step label, attempt and bound, a hit a later attempt recovered from included.

An attempt that succeeds after a bound hit otherwise leaves no trace. The list adds no retry layer and no catalog column.

meter-reservation-holds — A meter reservation holds no wait of its own

Cited byconnector.meter.acquire-callconnector.meter.acquire-callEach limiter call takes at most 5 s. A reservation does not sleep: denial returns RateLimited without waiting. The run's retry schedule performs the specified wait.

A blocking HTTP acquire cannot select on a run’s cancellation token, so the retry sleep performs the wait.

batch-key-answers — A batch key answers within a declared retention window

Cited byrun.land.receive-batch-keyrun.land.receive-batch-keyA batch key fixes each touched table's run id stem receive-<digest>.<table> and owner scope, a later attempt taking .2, .3; a table whose run under the key, or under the group its scope names, committed replays it and lands nothing.run.land.receive-key-expiredrun.land.receive-key-expiredA batch key replays or resumes only within the source's key_retention_secs of its first attempt. After that window, the receiver raises non-retryable ReceiveBatchKeyExpired before reading the body. No table lands.

A key answering forever promises deduplication the store cannot bound. No default chooses a window for the sender.

received-batches-spooled — Received batches spooled behind a landing commit as one group

Cited byrun.land.receive-spoolrun.land.receive-spoolA batch decodes and validates alone, so a malformed body answers alone, then spools, synced, to its pipeline's queue before waiting for the land lock; a leader lands every spooled batch, a dead receiver's included.run.land.receive-grouprun.land.receive-groupThe land lock's holder lands the batches spooled under its credential, up to max_queue_depth members and 64 MiB, as one run per touched table, keyed by the group or a lone member, then pushes once and answers each.

A batch landing its own run pays a commit, a part and a push. A malformed body fails no other batch.

terminal-item-s — A terminal item’s outcome is a row of a reserved relation

Cited byrun.items.outcome-recordrun.items.outcome-recordEach terminal item appends one row to the reserved _items table once its receipt commits: job, logical key, entity namespace and key, attempt count, terminal outcome, reason, attempt run id, execution id and end instant.run.items.terminal-outcomerun.items.terminal-outcomeAn item row's outcome is an ItemTerminal, exhausted on the attempt spending retry-budget; its reason carries the failure tag and error-cap message.run.items.served-keyrun.items.served-keyAn item row carries its logical and entity keys as the job's input relation served them, so a key its source masks or classes lands under that rule, never in the clear.

An isolated item’s run ids are digests no reader inverts, and its receipt sits in a catalog cursor no read face exposes.

backfill-commits-checkpoints — A backfill commits at checkpoints and walks one page per pull

Cited byconnector.source.http-watermark-walkconnector.source.http-watermark-walkUnder an incremental field without next-URL or Link-header pagination, one generic HTTP source pull reads one page from the stored watermark; its position carries that watermark and the next page's token, and the walk's last page carries none.connector.source.page-capconnector.source.page-capOne walk issues at most 1000 requests; a watermark walk counts them from its last page whose every clock passes every clock the walk served before.

A backfill window outgrows one commit’s staging bound, and a watermark walk outgrows one pull. A next-URL walk names pages by URLs the journal never holds, so it commits once.

run-record-folds — The run record folds inside its own append

Cited byrun.record.reserved-tablerun.record.reserved-tableThe durable run record is a reserved store table holding two append-only rows per run, one at plan and one at commit; the latest row per run and phase wins. The local catalog is a cache in front of it.run.record.record-foldsrun.record.record-foldsAn append to reserved-table runs a pass on it once triggers fires; a pass that fails leaves the row appended and the append succeeding, and the next append retries it.

Nothing else folds _runs, so its listing, every watermark and every push grow by run. A run’s row never fails on the record’s upkeep.

iceberg-overwrite-commit — An Iceberg export replaces its table through a hand-written overwrite commit

Cited byrun.export-iceberg.createrun.export-iceberg.createAn export finding no table creates it at the declared format version and commits its files as one append snapshot, requiring that main does not exist.run.export-iceberg.overwriterun.export-iceberg.overwriteEach later export commits one overwrite snapshot that adds its data files and marks every live file of the parent snapshot deleted, requiring the table uuid, main at the parent snapshot id, and the current schema and default spec ids.run.export-iceberg.commit-retryrun.export-iceberg.commit-retryA conflicting commit reloads the table and, while its uuid and schema and partition spec ids are unchanged, retries with the written files, at most 3 attempts; a changed id or the last conflict raises ExportCommitConflict.

The Iceberg library on the workspace’s Arrow major exposes fast_append but no overwrite, and keeps its commit builder and action trait crate-private. A reader names one table, so each export replaces the rows under that name. Name continuity and the dependency graph decide.

iceberg-audience — An Iceberg namespace serves one credential, and caller SQL needs a single-audience warehouse

Cited byrun.export-iceberg.audiencerun.export-iceberg.audienceEach Iceberg export publishes for exactly one admitted credential, which maps to exactly one namespace; the gateway derives a reader's namespace from its audience key, and the reader never names one.run.export-iceberg.namespace-sharedrun.export-iceberg.namespace-sharedTwo Iceberg exports naming one namespace under different credentials, one credential under two namespaces, or one table raise ExportNamespaceShared at preflight, naming both exports.run.export-iceberg.caller-sqlrun.export-iceberg.caller-sqlCaller-written SQL reaches the catalog's query engine only from a store entry declaring caller_sql for a single-audience warehouse; otherwise the gateway runs the entry's templates against the mapped namespace.run.export-iceberg.query-refusedrun.export-iceberg.query-refusedA mapped reader's request naming a namespace, an undeclared template, a table outside [a-z_][a-z0-9_], or caller SQL on a shared warehouse raises ExportQueryRefused and reaches no engine.

A reader of the export runs outside the read face, so the grant applied at export time is the only one it holds. A catalog query token reads every namespace in its warehouse. Isolation decides.