@catalyst-cloud/schema 0.1.22 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalyst-cloud/schema",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "type": "module",
   "description": "Typed Drizzle schema = single source of truth for the per-tenant Mirror DO SQLite store (CTC-13 / ADR-0002). Shared by the mirror Worker, the host-sync replica, and the browser OPFS replica.",
   "license": "MIT",

package/src/events/registry.ts

@@ -1607,6 +1607,34 @@ export const durableEventTypes = {
     wakes: { consumerClass: "dispatcher" },
     entity: "ticket",
   },
+  "runner.container.stopped": {
+    rationale:
+      "CTC-1118 D4 — RunnerDispatchDO observed its own Container stop (activity expiry, a platform rollout SIGTERM, or an orderly exit) and reported it to the tenant DO. A positive observation ('a container stopped'), never an inferred absence — the entitlement plane's epistemic rule (entitlement.ts's RevokeRequest.observation). NOT wake-eligible: the report only collapses a held lease's deadline (existence-plane, never ownership — ADR-0037 Amendment 7), it does not itself create new eligible work for the dispatcher.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "runner",
+  },
+  "runner.start.failed": {
+    rationale:
+      "CTC-951 — the MirrorDO alarm's existence-push (ADR-0037 Amendment 7) tried to start a tenant runner and the platform refused it. ADR-0039 durable-fact example ('a runner reported an outcome'): the first failure of a backoff episode. NOT wake-eligible — a start failure must never itself trigger the dispatcher, or the dispatch plane would wake on its own retry clock.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "runner",
+  },
+  "runner.start.recovered": {
+    rationale:
+      "CTC-951 — a tenant runner start succeeded after a prior runner.start.failed backoff episode closed it. The paired recovery fact to runner.start.failed; never appended for a start that never failed, and never appended merely because the eligible work that triggered the episode disappeared during backoff (that is a silent clear, not a recovery).",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "runner",
+  },
+  "runner.work.reclaimable": {
+    rationale:
+      "CTC-1118 D5 — the MirrorDO alarm's existence-push found eligible work whose lease row still records a holder with a PAST deadline: a tenure that died without releasing, now being re-driven. ADR-0039 durable-fact example ('work became eligible'/'a runner reported an outcome') and the ticket's own Gherkin acceptance signal — a positive observation (a deadline verifiably passed while a holder was recorded), deduped per lapsed tenure via (ticket, phase, generation) so a unit that stays eligible across several alarm passes does not re-emit. NOT wake-eligible: the existence-push that discovers this already proceeds with its own /ensure call in the same pass, so nothing needs to wake on this event alone.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
   "session.ended": {
     rationale: "An agent session ended — a real lifecycle boundary fact.",
     ingestVerb: "coordination.publish",

package/src/events/retention.ts

@@ -166,10 +166,18 @@ export function mayPruneHotEvent(check: HotEventPruneCheck): boolean {
 //
 // Transcripts are NOT events and get their OWN retention class: short default, longer
 // keep-on-failure, neither inherited from event retention above nor from ADR-0036's original
-// no-lifecycle default. Enforced by two operator-applied R2 lifecycle delete-age rules keyed on the
-// name markers below (docs/event-backbone/retention-and-deletion.md's transcript section;
-// docs/devops.md carries the exact provisioning calls). The name prefixes are imported by
-// apps/mirror's transcript name grammar so route grammar and lifecycle rules share one definition.
+// no-lifecycle default. The name prefixes are imported by apps/mirror's transcript name grammar so
+// the route grammar and the retention markers share one definition.
+//
+// ⚠️ THE TWO WINDOWS BELOW ARE POLICY, NOT WHAT THE BUCKET CURRENTLY ENFORCES. R2 lifecycle rules
+// filter on `conditions.prefix` ONLY — no suffix, no tag — and these markers sit in the LAST key
+// segment, so NO lifecycle rule can select by outcome. The interim enforcement is ONE delete-age
+// rule per account transcript-scope prefix (`${account}/linear-`) at the 180-day FAIL window:
+// fail-class matches exactly, ok-class is kept 6x longer, and the error is toward retention rather
+// than toward destroying post-mortem evidence. Splitting the two windows needs an R2 suffix/tag
+// filter or a name-aware sweeper (ADR-0041 point 4; revisit at CTC-967). Provisioning calls:
+// docs/devops.md → "Session transcript lifecycle rules"; policy: the transcript section of
+// docs/event-backbone/retention-and-deletion.md.
 
 /** A transcript whose worker reported a clean outcome is kept 30 days. */
 export const TRANSCRIPT_RETENTION_OK_MS = 30 * 24 * 60 * 60 * 1000; // 30 days