/**
* #14387: the durable error code a workflow Turn carries once its
* recovery was refused — the Harness generation running it was lost
* and its deterministic in-process work must never be re-executed
* while the first run's outcome stays unwitnessed. The Turn is never
* settled: the code stays on the active row for the child result
* relay to classify the record blocked from, and the dispatch sweep
* parks the row (a cancel still scans it — settling the Turn
* cancelled is the cancel's own act).
*/
---
/**
* D7-2: the durable code a Turn carries while its parked Runtime
* execution's acceptance is still unknown. The dispatch sweep parks it,
* and the reconciler re-drives the cancellation load on its RECHECK
* cadence; the code never settles the Turn by itself. A cancel still
* scans it — settling the Turn cancelled is the cancel's own act.
*/
---
/**
* H4b: creates a child Session under its parent's exact binding,
* stamping the lineage in the same transaction. The idempotency key
* derives from the parent's committed launch, so a replay returns the
* original admission and never mints a second Session. The caller is
* the control plane (the relay), so this path deliberately skips the
* public actor/workspace checks — the parent's row carries them.
*/
---
/**
* The isolation slice (#13753 I1): the same creation, bound to the
* child run's ready child Workspace. The child's row takes the
* Workspace's directory instead of the parent's; the creating
* transaction locks the Workspace row and refuses unless it is ready,
* unfinished, prepared from the parent's current Workspace and storage,
* and names {@code childCwdRelative}.
*/
---
/**
* The child directory a child run's Workspace recorded, or null before
* its layout was recorded. Readiness is the creating transaction's to
* check, so a replay still answers once the Workspace moved on.
*/
---
/** The replay of {@link #insertChildSessionCommand}: same key and
* digest answers the original admission; either mismatch conflicts. */
---
/** A child Session's persisted lineage, or null for a root Session. */
---
/**
* Creates a Workspace-bound Session from one named command. The
* default fails closed: an implementation that has not opted into
* workspace creation refuses it wholesale rather than silently
* accepting a capability it cannot honor.
*/
---
/**
* The actor-carrying variant records the caller on the command receipt,
* so the receipt's replay answers the actor who recorded it — an
* OPERATOR's own retry of his own key — and not only the creator. The
* default drops the actor for implementations that cannot record it.
*/
---
/** The actor-carrying twin of {@link #insertTurnCommand}. */
---
/** The actor-carrying twin of {@link #insertTurnCommand}. */
---
/** The actor-carrying twin: the recorded rename answers its recorder. */
---
/**
* Retires the command row of a Session mutation the Harness refused
* before completion, so the refusal does not leave the Session's
* later lifecycle changes blocked by a {@code PENDING} row nothing
* completes. The receipt and digest survive for same-content retries
* and concurrent completion; completed outcomes remain replayable.
*/
---
/**
* Admits a close, archive or delete, or returns the operation that the
* same actor already admitted under the key. An archive completes here;
* a close or delete waits for {@link #completeOperation}.
*/
---
/** The given Sessions with a completed workspace close, in one read. */
---
/**
* Whether the Session's creator-keyed execution facts hold — the
* Registry still backs the binding exactly, its state is ACTIVE, and
* the create-command actor keeps OPERATOR or above. This is the
* passive-attachment subset the execution authority re-verifies, so
* any admission certifying a run under the creator's grants checks it
* first.
*/
---
/** The given Sessions whose execution facts hold, in one read. */
---
/**
* Blocks the operation, and when {@code budgetExempt} is true records the
* attempt as a wait on an external condition (a live journal writer or a
* stale Harness view) that never consumed the terminal retry budget.
*/
---
/**
* Settles a claimed cwd change in one transaction: re-verifies the
* Session facts, updates the binding directory and context revision,
* marks the operation completed or failed, and appends
* {@code session.context.changed} on success.
*
* @return the outcome; a contested claim returns {@code null}
*/
---
/**
* Marks a claimed cwd change terminally failed with its public failure
* code.
*
* @return false when the claim is no longer current — the write was
*         skipped and the caller must not report a terminal refusal
*/
---
/** The result of a settled cwd change. */
---
/**
* H4f: admits a public task cancel, or returns the operation the same
* actor already admitted under the key. The caller has validated the
* key and checked current access; under the Session lock this replays
* a retained key first, then — only for a new request — requires an
* active Session ({@code 409 session_not_active}), the task's
* {@code cancel} action ({@code 409 task_action_unavailable}) and no
* other open operation ({@code 409 session_operation_active}).
*/
---
/** Task cancels due for delivery: pending, or leased past their lease. */
---
/**
* Records a leased task cancel's outcome: {@code completed} with a
* receipt, {@code failed} or {@code recovery_blocked} with its code (the
* latter parked until {@code retryAt}), only while the claim is still
* current. A parked cancel is settled only by
* {@link #settleParkedOperation}.
*
* @return false when the claim is no longer current
*/
---
/**
* D7-2: operations parked recovery_blocked because their command's
* acceptance is unknown, due for reconciliation. No claim ever takes
* one; only the reconciler reads them.
*/
---
/**
* D7-2: settles a parked operation from its kind's evidence, only while
* it is still parked. Committed completes it with a receipt; not
* committed fails it with the proven code; unknown parks it again until
* {@code retryAt}.
*
* @return false when the operation is no longer parked
*/
---
/**
* D7-2: what the Session journal proves about a parked Turn input whose
* submission no Harness answered: committed once the journal holds its
* prompt's admission, not committed once no writer can still commit it.
*/
---
/**
* D7-2: what the Session journal proves about a parked Session title, or
* empty when its delivery is no longer parked: committed once the journal
* holds its revision's title, not committed once no writer can still
* commit it.
*/
---
/**
* D7-2: settles a parked Session title, only while it is still parked.
* Committed completes its command and shows the title; not committed
* fails it; unknown parks it again until {@code retryAt}.
*
* @return false when the title is no longer parked
*/
---
/** A task cancel's recorded outcome: its public status and code. */
---
/**
* Completes a claimed operation unless another worker claimed it since.
*
* @return false when the claim is no longer current
*/
---
/**
* Terminates a claimed operation whose retry budget is spent, recording
* the failure honestly: the operation row goes to FAILED with the
* failure code kept and delivery_state CONFIRMED so no recovery path
* re-drives it — and nothing else. The Session keeps its pending status
* and no completion event is appended, because the settle this operation
* promised never happened; the receipt the contract requires of every
* confirmed row certifies nothing.
*
* @return false when the claim is no longer current
*/
---
/**
* Retries the operation, and when {@code budgetExempt} is true records
* the attempt as a wait on an external condition (a live journal writer,
* a stale Harness view, or the projection lag after the Harness answered
* an action response) that must not consume the terminal retry budget.
* The attempt count still grows, so the dispatch backoff keeps
* stretching.
*/
---
/**
* Records that the current attempt reached the Harness (the decision was
* committed), so a later failure of this attempt stays budget-exempt even
* when the recovery reads that would reschedule it throw before that
* write (review round 14, R14-3). The row stays leased; the watermark
* only makes a re-claimed attempt read budgetExemptAttempt &gt; 0.
*/
---
/** The active Turn of each given Session, in one round trip. */
---
/** The latest Turn of each given Session, in one round trip. */
---
/**
* The latest environment event of each Session's latest Turn, in one
* round trip.
*/
---
/**
* A page of a Session's Turns, newest first: by creation time, then by
* Turn ID, both descending. A position excludes the Turn it names and
* every newer one.
*/
---
/** The message projection coverage of each Session, in one read. */
---
/** The Sessions whose message projection covers more than their replay floor. */
---
/**
* Raises the Session's replay floor only through readable message coverage.
*/
---
/**
* Rotates a stale materialization target behind the fresher ones by
* touching only {@code gmt_modified} on its progress row — never
* {@code covered_sequence}, which the gap guard must freeze on failure.
*/
---
/**
* D7-2: active Turns parked on an unresolved Runtime execution whose
* recheck is due. They are never dispatched; the reconciler drives a
* fresh cancellation load instead.
*/
---
/**
* #14387: durably marks an active Turn whose recovery was refused —
* the error code stays on the still-active row for the child result
* relay to classify from, and the dispatch lease is released so the
* drive ends without settling the Turn. Never a terminal status: the
* unwitnessed execution's outcome was never observed. A Harness park
* backs off before read-only journal observation; it may still settle
* from later authoritative evidence without replaying execution.
*/
---
/**
* D7-2: parks an active Turn on {@link #RUNTIME_RECOVERY_BLOCKED} until
* {@code retryAfter}, releasing the dispatch lease. The Turn keeps its
* status: only a proven cancel may settle it.
*/
---
/**
* Clears non-terminal text from a continuation epoch that did not reach
* a public terminal event, so the replacement stream is the only copy.
*/
---
/**
* Retracts the published text of the in-flight message a restarted model
* attempt replaces (#13319): deltas of the Turn in the live epoch with a
* source id at or after {@code fromSourceId} are emptied, projections are
* rebuilt, and a {@code stream.reconciled} event is appended. The Harness
* cursor advances past {@code retractionSourceId} either way.
*/
---
/**
* Appends a Session event unless one with the source key exists, when
* the tenant's Session exists and is neither deleted nor being deleted.
* The Session is locked before its status is read, so a deletion that
* commits first is always seen.
*/
