Skip to main content

State Ownership

Which process each state transition and which database guard prevents conflicting writers.

Database and divide work. A fences settlement; a serializes conflicting transactions; and the cooperative excludes shard movement from normal writers. Control-plane changes use , while data-plane writes validate the . Prepared shard-move targets additionally validate the move ID, monotonic claim generation, and opaque claim token in the target mutation transaction.

Notes​

  • The create command owns input validation and the first durable creating transaction; other CLI commands cancel and read eligible state.
  • Coordinators own expired run-creation recovery, expired chunk lease recovery, run dispatch, run finalization, and outbox publishing.
  • Workers own chunk leases, attempt leases, execution attempt allocation, retry scheduling, and execution/attempt terminal transitions. Chunk-local worker state is addressed by run_id + run_shard + chunk_id.
  • Chunk-ready messages carry the execution alias and write epoch. Workers use the hinted pool without a control lookup on the normal path; a rejected hint triggers cache invalidation and an authoritative route refresh.
  • Database guards are the authority boundary: creation and coordinator leases, idempotent seed checks, shared run-state locks, chunk and attempt leases, conflict keys, current-attempt checks, worker ownership checks, and outbox delivery claim tokens prevent stale writes.
  • Shard-move takeover installs a higher generation under exclusive target admission. In-flight target writes finish before takeover; later writes from an older generation are rejected before mutation.