provisa 0.1.0a331__tar.gz → 0.1.0a332__tar.gz

{provisa-0.1.0a331/provisa.egg-info → provisa-0.1.0a332}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: provisa
-Version: 0.1.0a331
+Version: 0.1.0a332
 Summary: Config-driven data virtualization platform
 Requires-Python: <3.14,>=3.12
 License-File: LICENSE

{provisa-0.1.0a331 → provisa-0.1.0a332}/provisa/_ui/docs-site/arch/requirements/index.html

@@ -19467,6 +19467,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -37399,6 +37427,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -45011,6 +45067,13 @@
 <p><strong>Use case:</strong> An operator can state what a regional outage costs in recovery time at each of three spend levels, and sell the standby to the accounts that need it instead of taxing every Starter org for it.</p>
 <p><strong>Code:</strong> <code>pricing_model.py</code>, <code>terraform/gcp-saas/main.tf</code></p>
 <p><strong>Tests:</strong> —</p>
+<h2 id="13-multi-tenancy-organizations_18">13. Multi-Tenancy &amp; Organizations<a class="headerlink" href="#13-multi-tenancy-organizations_18" title="Permanent link">&para;</a></h2>
+<h3 id="REQ-1461">REQ-1461 · Federation Engine<a class="headerlink" href="#REQ-1461" title="Permanent link">&para;</a></h3>
+<p><strong>Status:</strong> 💡 proposed · <strong>Priority:</strong> MUST · <strong>Type:</strong> behavioral</p>
+<p>The cold-shard wake is reconciled with the executor's retry budget by ORDERING, not by widening the budget. A node provision is roughly 90-120s (k8s_provisioner._await_operation, bounded by PROVISA_ENGINE_NODE_TIMEOUT=420) while a statement's retry budget is 30s (_retry_budget/PROVISA_RETRY_BUDGET_SECS), so a query that discovered an absent shard from inside its retry loop could never wait the wake out -- it would exhaust the budget and fail on a shard that was seconds from ready. The wake therefore runs BEFORE the terminal call, at the top of _execute_plan and ahead of _run_plan_terminal, so the wait for capacity is not spent from the retry budget at all and the budget keeps its intended meaning: transient failures of a shard that is already up. Raising PROVISA_RETRY_BUDGET_SECS to cover a cold start is explicitly REJECTED -- it would make every genuinely failing query on a warm shard hang for minutes. Because _execute_plan is the one terminal seam every surface routes through (<a href="#REQ-1386">REQ-1386</a>), no protocol server carries a wake of its own.</p>
+<p><strong>Use case:</strong> A query that arrives at a shard whose node pool is at zero waits out the node provision and then executes, instead of failing after 30 seconds against an engine that is still coming up.</p>
+<p><strong>Code:</strong> <code>provisa/pgwire/_pipeline.py</code>, <code>provisa/federation/engine_wake.py</code></p>
+<p><strong>Tests:</strong> —</p>
 
 
 

{provisa-0.1.0a331 → provisa-0.1.0a332}/provisa/_ui/docs-site/de/arch/requirements/index.html

@@ -19467,6 +19467,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -37399,6 +37427,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -45011,6 +45067,13 @@
 <p><strong>Use case:</strong> An operator can state what a regional outage costs in recovery time at each of three spend levels, and sell the standby to the accounts that need it instead of taxing every Starter org for it.</p>
 <p><strong>Code:</strong> <code>pricing_model.py</code>, <code>terraform/gcp-saas/main.tf</code></p>
 <p><strong>Tests:</strong> —</p>
+<h2 id="13-multi-tenancy-organizations_18">13. Multi-Tenancy &amp; Organizations<a class="headerlink" href="#13-multi-tenancy-organizations_18" title="Permanent link">&para;</a></h2>
+<h3 id="REQ-1461">REQ-1461 · Federation Engine<a class="headerlink" href="#REQ-1461" title="Permanent link">&para;</a></h3>
+<p><strong>Status:</strong> 💡 proposed · <strong>Priority:</strong> MUST · <strong>Type:</strong> behavioral</p>
+<p>The cold-shard wake is reconciled with the executor's retry budget by ORDERING, not by widening the budget. A node provision is roughly 90-120s (k8s_provisioner._await_operation, bounded by PROVISA_ENGINE_NODE_TIMEOUT=420) while a statement's retry budget is 30s (_retry_budget/PROVISA_RETRY_BUDGET_SECS), so a query that discovered an absent shard from inside its retry loop could never wait the wake out -- it would exhaust the budget and fail on a shard that was seconds from ready. The wake therefore runs BEFORE the terminal call, at the top of _execute_plan and ahead of _run_plan_terminal, so the wait for capacity is not spent from the retry budget at all and the budget keeps its intended meaning: transient failures of a shard that is already up. Raising PROVISA_RETRY_BUDGET_SECS to cover a cold start is explicitly REJECTED -- it would make every genuinely failing query on a warm shard hang for minutes. Because _execute_plan is the one terminal seam every surface routes through (<a href="#REQ-1386">REQ-1386</a>), no protocol server carries a wake of its own.</p>
+<p><strong>Use case:</strong> A query that arrives at a shard whose node pool is at zero waits out the node provision and then executes, instead of failing after 30 seconds against an engine that is still coming up.</p>
+<p><strong>Code:</strong> <code>provisa/pgwire/_pipeline.py</code>, <code>provisa/federation/engine_wake.py</code></p>
+<p><strong>Tests:</strong> —</p>
 
 
 

{provisa-0.1.0a331 → provisa-0.1.0a332}/provisa/_ui/docs-site/es/arch/requirements/index.html

@@ -19467,6 +19467,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -37399,6 +37427,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -45011,6 +45067,13 @@
 <p><strong>Use case:</strong> An operator can state what a regional outage costs in recovery time at each of three spend levels, and sell the standby to the accounts that need it instead of taxing every Starter org for it.</p>
 <p><strong>Code:</strong> <code>pricing_model.py</code>, <code>terraform/gcp-saas/main.tf</code></p>
 <p><strong>Tests:</strong> —</p>
+<h2 id="13-multi-tenancy-organizations_18">13. Multi-Tenancy &amp; Organizations<a class="headerlink" href="#13-multi-tenancy-organizations_18" title="Permanent link">&para;</a></h2>
+<h3 id="REQ-1461">REQ-1461 · Federation Engine<a class="headerlink" href="#REQ-1461" title="Permanent link">&para;</a></h3>
+<p><strong>Status:</strong> 💡 proposed · <strong>Priority:</strong> MUST · <strong>Type:</strong> behavioral</p>
+<p>The cold-shard wake is reconciled with the executor's retry budget by ORDERING, not by widening the budget. A node provision is roughly 90-120s (k8s_provisioner._await_operation, bounded by PROVISA_ENGINE_NODE_TIMEOUT=420) while a statement's retry budget is 30s (_retry_budget/PROVISA_RETRY_BUDGET_SECS), so a query that discovered an absent shard from inside its retry loop could never wait the wake out -- it would exhaust the budget and fail on a shard that was seconds from ready. The wake therefore runs BEFORE the terminal call, at the top of _execute_plan and ahead of _run_plan_terminal, so the wait for capacity is not spent from the retry budget at all and the budget keeps its intended meaning: transient failures of a shard that is already up. Raising PROVISA_RETRY_BUDGET_SECS to cover a cold start is explicitly REJECTED -- it would make every genuinely failing query on a warm shard hang for minutes. Because _execute_plan is the one terminal seam every surface routes through (<a href="#REQ-1386">REQ-1386</a>), no protocol server carries a wake of its own.</p>
+<p><strong>Use case:</strong> A query that arrives at a shard whose node pool is at zero waits out the node provision and then executes, instead of failing after 30 seconds against an engine that is still coming up.</p>
+<p><strong>Code:</strong> <code>provisa/pgwire/_pipeline.py</code>, <code>provisa/federation/engine_wake.py</code></p>
+<p><strong>Tests:</strong> —</p>
 
 
 

{provisa-0.1.0a331 → provisa-0.1.0a332}/provisa/_ui/docs-site/fr/arch/requirements/index.html

@@ -19467,6 +19467,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -37399,6 +37427,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -45011,6 +45067,13 @@
 <p><strong>Use case:</strong> An operator can state what a regional outage costs in recovery time at each of three spend levels, and sell the standby to the accounts that need it instead of taxing every Starter org for it.</p>
 <p><strong>Code:</strong> <code>pricing_model.py</code>, <code>terraform/gcp-saas/main.tf</code></p>
 <p><strong>Tests:</strong> —</p>
+<h2 id="13-multi-tenancy-organizations_18">13. Multi-Tenancy &amp; Organizations<a class="headerlink" href="#13-multi-tenancy-organizations_18" title="Permanent link">&para;</a></h2>
+<h3 id="REQ-1461">REQ-1461 · Federation Engine<a class="headerlink" href="#REQ-1461" title="Permanent link">&para;</a></h3>
+<p><strong>Status:</strong> 💡 proposed · <strong>Priority:</strong> MUST · <strong>Type:</strong> behavioral</p>
+<p>The cold-shard wake is reconciled with the executor's retry budget by ORDERING, not by widening the budget. A node provision is roughly 90-120s (k8s_provisioner._await_operation, bounded by PROVISA_ENGINE_NODE_TIMEOUT=420) while a statement's retry budget is 30s (_retry_budget/PROVISA_RETRY_BUDGET_SECS), so a query that discovered an absent shard from inside its retry loop could never wait the wake out -- it would exhaust the budget and fail on a shard that was seconds from ready. The wake therefore runs BEFORE the terminal call, at the top of _execute_plan and ahead of _run_plan_terminal, so the wait for capacity is not spent from the retry budget at all and the budget keeps its intended meaning: transient failures of a shard that is already up. Raising PROVISA_RETRY_BUDGET_SECS to cover a cold start is explicitly REJECTED -- it would make every genuinely failing query on a warm shard hang for minutes. Because _execute_plan is the one terminal seam every surface routes through (<a href="#REQ-1386">REQ-1386</a>), no protocol server carries a wake of its own.</p>
+<p><strong>Use case:</strong> A query that arrives at a shard whose node pool is at zero waits out the node provision and then executes, instead of failing after 30 seconds against an engine that is still coming up.</p>
+<p><strong>Code:</strong> <code>provisa/pgwire/_pipeline.py</code>, <code>provisa/federation/engine_wake.py</code></p>
+<p><strong>Tests:</strong> —</p>
 
 
 

{provisa-0.1.0a331 → provisa-0.1.0a332}/provisa/_ui/docs-site/he/arch/requirements/index.html

@@ -19467,6 +19467,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -37399,6 +37427,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -45011,6 +45067,13 @@
 <p><strong>Use case:</strong> An operator can state what a regional outage costs in recovery time at each of three spend levels, and sell the standby to the accounts that need it instead of taxing every Starter org for it.</p>
 <p><strong>Code:</strong> <code>pricing_model.py</code>, <code>terraform/gcp-saas/main.tf</code></p>
 <p><strong>Tests:</strong> —</p>
+<h2 id="13-multi-tenancy-organizations_18">13. Multi-Tenancy &amp; Organizations<a class="headerlink" href="#13-multi-tenancy-organizations_18" title="Permanent link">&para;</a></h2>
+<h3 id="REQ-1461">REQ-1461 · Federation Engine<a class="headerlink" href="#REQ-1461" title="Permanent link">&para;</a></h3>
+<p><strong>Status:</strong> 💡 proposed · <strong>Priority:</strong> MUST · <strong>Type:</strong> behavioral</p>
+<p>The cold-shard wake is reconciled with the executor's retry budget by ORDERING, not by widening the budget. A node provision is roughly 90-120s (k8s_provisioner._await_operation, bounded by PROVISA_ENGINE_NODE_TIMEOUT=420) while a statement's retry budget is 30s (_retry_budget/PROVISA_RETRY_BUDGET_SECS), so a query that discovered an absent shard from inside its retry loop could never wait the wake out -- it would exhaust the budget and fail on a shard that was seconds from ready. The wake therefore runs BEFORE the terminal call, at the top of _execute_plan and ahead of _run_plan_terminal, so the wait for capacity is not spent from the retry budget at all and the budget keeps its intended meaning: transient failures of a shard that is already up. Raising PROVISA_RETRY_BUDGET_SECS to cover a cold start is explicitly REJECTED -- it would make every genuinely failing query on a warm shard hang for minutes. Because _execute_plan is the one terminal seam every surface routes through (<a href="#REQ-1386">REQ-1386</a>), no protocol server carries a wake of its own.</p>
+<p><strong>Use case:</strong> A query that arrives at a shard whose node pool is at zero waits out the node provision and then executes, instead of failing after 30 seconds against an engine that is still coming up.</p>
+<p><strong>Code:</strong> <code>provisa/pgwire/_pipeline.py</code>, <code>provisa/federation/engine_wake.py</code></p>
+<p><strong>Tests:</strong> —</p>
 
 
 

{provisa-0.1.0a331 → provisa-0.1.0a332}/provisa/_ui/docs-site/it/arch/requirements/index.html

@@ -19467,6 +19467,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -37399,6 +37427,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -45011,6 +45067,13 @@
 <p><strong>Use case:</strong> An operator can state what a regional outage costs in recovery time at each of three spend levels, and sell the standby to the accounts that need it instead of taxing every Starter org for it.</p>
 <p><strong>Code:</strong> <code>pricing_model.py</code>, <code>terraform/gcp-saas/main.tf</code></p>
 <p><strong>Tests:</strong> —</p>
+<h2 id="13-multi-tenancy-organizations_18">13. Multi-Tenancy &amp; Organizations<a class="headerlink" href="#13-multi-tenancy-organizations_18" title="Permanent link">&para;</a></h2>
+<h3 id="REQ-1461">REQ-1461 · Federation Engine<a class="headerlink" href="#REQ-1461" title="Permanent link">&para;</a></h3>
+<p><strong>Status:</strong> 💡 proposed · <strong>Priority:</strong> MUST · <strong>Type:</strong> behavioral</p>
+<p>The cold-shard wake is reconciled with the executor's retry budget by ORDERING, not by widening the budget. A node provision is roughly 90-120s (k8s_provisioner._await_operation, bounded by PROVISA_ENGINE_NODE_TIMEOUT=420) while a statement's retry budget is 30s (_retry_budget/PROVISA_RETRY_BUDGET_SECS), so a query that discovered an absent shard from inside its retry loop could never wait the wake out -- it would exhaust the budget and fail on a shard that was seconds from ready. The wake therefore runs BEFORE the terminal call, at the top of _execute_plan and ahead of _run_plan_terminal, so the wait for capacity is not spent from the retry budget at all and the budget keeps its intended meaning: transient failures of a shard that is already up. Raising PROVISA_RETRY_BUDGET_SECS to cover a cold start is explicitly REJECTED -- it would make every genuinely failing query on a warm shard hang for minutes. Because _execute_plan is the one terminal seam every surface routes through (<a href="#REQ-1386">REQ-1386</a>), no protocol server carries a wake of its own.</p>
+<p><strong>Use case:</strong> A query that arrives at a shard whose node pool is at zero waits out the node provision and then executes, instead of failing after 30 seconds against an engine that is still coming up.</p>
+<p><strong>Code:</strong> <code>provisa/pgwire/_pipeline.py</code>, <code>provisa/federation/engine_wake.py</code></p>
+<p><strong>Tests:</strong> —</p>
 
 
 

{provisa-0.1.0a331 → provisa-0.1.0a332}/provisa/_ui/docs-site/pt/arch/requirements/index.html

@@ -19467,6 +19467,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -37399,6 +37427,34 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#13-multi-tenancy-organizations_18" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        13. Multi-Tenancy &amp; Organizations
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="13. Multi-Tenancy &amp; Organizations">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#REQ-1461" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        REQ-1461 · Federation Engine
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
     </ul>
@@ -45011,6 +45067,13 @@
 <p><strong>Use case:</strong> An operator can state what a regional outage costs in recovery time at each of three spend levels, and sell the standby to the accounts that need it instead of taxing every Starter org for it.</p>
 <p><strong>Code:</strong> <code>pricing_model.py</code>, <code>terraform/gcp-saas/main.tf</code></p>
 <p><strong>Tests:</strong> —</p>
+<h2 id="13-multi-tenancy-organizations_18">13. Multi-Tenancy &amp; Organizations<a class="headerlink" href="#13-multi-tenancy-organizations_18" title="Permanent link">&para;</a></h2>
+<h3 id="REQ-1461">REQ-1461 · Federation Engine<a class="headerlink" href="#REQ-1461" title="Permanent link">&para;</a></h3>
+<p><strong>Status:</strong> 💡 proposed · <strong>Priority:</strong> MUST · <strong>Type:</strong> behavioral</p>
+<p>The cold-shard wake is reconciled with the executor's retry budget by ORDERING, not by widening the budget. A node provision is roughly 90-120s (k8s_provisioner._await_operation, bounded by PROVISA_ENGINE_NODE_TIMEOUT=420) while a statement's retry budget is 30s (_retry_budget/PROVISA_RETRY_BUDGET_SECS), so a query that discovered an absent shard from inside its retry loop could never wait the wake out -- it would exhaust the budget and fail on a shard that was seconds from ready. The wake therefore runs BEFORE the terminal call, at the top of _execute_plan and ahead of _run_plan_terminal, so the wait for capacity is not spent from the retry budget at all and the budget keeps its intended meaning: transient failures of a shard that is already up. Raising PROVISA_RETRY_BUDGET_SECS to cover a cold start is explicitly REJECTED -- it would make every genuinely failing query on a warm shard hang for minutes. Because _execute_plan is the one terminal seam every surface routes through (<a href="#REQ-1386">REQ-1386</a>), no protocol server carries a wake of its own.</p>
+<p><strong>Use case:</strong> A query that arrives at a shard whose node pool is at zero waits out the node provision and then executes, instead of failing after 30 seconds against an engine that is still coming up.</p>
+<p><strong>Code:</strong> <code>provisa/pgwire/_pipeline.py</code>, <code>provisa/federation/engine_wake.py</code></p>
+<p><strong>Tests:</strong> —</p>