@catalyst-cloud/schema 0.1.21 → 0.1.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalyst-cloud/schema",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "type": "module",
   "description": "Typed Drizzle schema = single source of truth for the per-tenant Mirror DO SQLite store (CTC-13 / ADR-0002). Shared by the mirror Worker, the host-sync replica, and the browser OPFS replica.",
   "license": "MIT",

package/src/events/registry.ts

@@ -1607,6 +1607,20 @@ export const durableEventTypes = {
     wakes: { consumerClass: "dispatcher" },
     entity: "ticket",
   },
+  "runner.start.failed": {
+    rationale:
+      "CTC-951 — the MirrorDO alarm's existence-push (ADR-0037 Amendment 7) tried to start a tenant runner and the platform refused it. ADR-0039 durable-fact example ('a runner reported an outcome'): the first failure of a backoff episode. NOT wake-eligible — a start failure must never itself trigger the dispatcher, or the dispatch plane would wake on its own retry clock.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "runner",
+  },
+  "runner.start.recovered": {
+    rationale:
+      "CTC-951 — a tenant runner start succeeded after a prior runner.start.failed backoff episode closed it. The paired recovery fact to runner.start.failed; never appended for a start that never failed, and never appended merely because the eligible work that triggered the episode disappeared during backoff (that is a silent clear, not a recovery).",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "runner",
+  },
   "session.ended": {
     rationale: "An agent session ended — a real lifecycle boundary fact.",
     ingestVerb: "coordination.publish",

package/src/events/retention.ts

@@ -162,6 +162,36 @@ export function mayPruneHotEvent(check: HotEventPruneCheck): boolean {
   return check.archivedAt !== null && check.ageMs > EVENT_HOT_WINDOW_MS;
 }
 
+// ── Session transcripts — the artifact plane's first lifecycle class (CTC-963 / ADR-0041) ─────────
+//
+// Transcripts are NOT events and get their OWN retention class: short default, longer
+// keep-on-failure, neither inherited from event retention above nor from ADR-0036's original
+// no-lifecycle default. The name prefixes are imported by apps/mirror's transcript name grammar so
+// the route grammar and the retention markers share one definition.
+//
+// ⚠️ THE TWO WINDOWS BELOW ARE POLICY, NOT WHAT THE BUCKET CURRENTLY ENFORCES. R2 lifecycle rules
+// filter on `conditions.prefix` ONLY — no suffix, no tag — and these markers sit in the LAST key
+// segment, so NO lifecycle rule can select by outcome. The interim enforcement is ONE delete-age
+// rule per account transcript-scope prefix (`${account}/linear-`) at the 180-day FAIL window:
+// fail-class matches exactly, ok-class is kept 6x longer, and the error is toward retention rather
+// than toward destroying post-mortem evidence. Splitting the two windows needs an R2 suffix/tag
+// filter or a name-aware sweeper (ADR-0041 point 4; revisit at CTC-967). Provisioning calls:
+// docs/devops.md → "Session transcript lifecycle rules"; policy: the transcript section of
+// docs/event-backbone/retention-and-deletion.md.
+
+/** A transcript whose worker reported a clean outcome is kept 30 days. */
+export const TRANSCRIPT_RETENTION_OK_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+
+/** A transcript whose worker failed/died mid-phase is kept 180 days — keep-on-failure, so a
+ *  post-mortem is possible long after the ok-class copies have expired. */
+export const TRANSCRIPT_RETENTION_FAIL_MS = 180 * 24 * 60 * 60 * 1000; // 180 days
+
+/** The name marker a clean-outcome transcript carries in its final key segment. */
+export const TRANSCRIPT_OK_NAME_PREFIX = "transcript-ok-";
+
+/** The name marker a failed/crashed-outcome transcript carries in its final key segment. */
+export const TRANSCRIPT_FAIL_NAME_PREFIX = "transcript-fail-";
+
 /** Bump when the projection's slot ASSIGNMENT changes (a field moves position, or the slot count
  *  changes); additive-at-the-end changes to a slot's semantic meaning still bump, because AE has no
  *  schema to enforce it and a silent reinterpretation of an existing blob/double is the failure mode