3.4 KiB
ADDED Requirements
Requirement: Run log sequences survive restart per stream
Generated Run SHALL allocate durable log sequence numbers independently for each full log stream ID. It MUST persist the locally allocated and Platform-acknowledged watermarks before deleting acknowledged spool segments.
Scenario: Run restarts with an existing spool
- WHEN generated Run restarts using a spool root that contains acknowledged watermarks or pending log segments
- THEN it SHALL restore the watermark for every affected log stream
- AND the next emitted entry for each stream MUST use a sequence greater than all restored allocated and acknowledged values
Scenario: Multiple declared streams emit output
- WHEN declared stdout and stderr streams emit interleaved log lines
- THEN Run SHALL maintain a monotonic sequence independently within each stream
- AND one stream's activity MUST NOT create a sequence gap in another stream
Requirement: Run reconciles a missing local watermark
Before reusing a stable server-bound log stream ID without a local watermark, generated Run SHALL obtain the latest acknowledged sequence through a signed Platform Run-channel progress query. The query response MUST contain only stream progress metadata needed for sequence recovery.
Scenario: Spool root was recreated
- WHEN a generated Run finds no local watermark for a stable stream that Platform already knows
- THEN Run SHALL obtain the stream's latest acknowledged sequence before allocating the next entry
- AND it MUST NOT restart that stream at sequence one
Scenario: Platform has no existing stream progress
- WHEN the signed progress query reports no acknowledged sequence for a valid new Run-bound stream
- THEN Run SHALL initialize that stream at its first sequence
- AND Platform SHALL continue to create the bound log stream from the signed ingest request
Requirement: Conflicting durable batches are isolated
Run SHALL classify an acknowledged-range conflict or sequence gap as a non-retryable spool recovery condition. It MUST durably quarantine the affected segment with a redacted reason, emit an operator-visible diagnostic, and continue only after its allocation watermark has been reconciled safely.
Scenario: Platform rejects replacement content in an acknowledged range
- WHEN Platform rejects a Run log batch because the range conflicts with acknowledged history
- THEN Run MUST NOT retry the same segment indefinitely
- AND it SHALL retain an auditable quarantined copy outside the active upload queue
Scenario: Platform reports a sequence gap
- WHEN Platform rejects a Run log batch because its first sequence does not follow the acknowledged stream sequence
- THEN Run SHALL isolate the batch and reconcile stream progress
- AND it MUST NOT silently skip the missing range or overwrite acknowledged entries
Requirement: Browser log delivery reflects accepted durable entries
Platform SHALL publish browser SSE log events only after a batch is durably accepted. An ingest recovery failure MUST NOT block control heartbeat or lifecycle reporting.
Scenario: A spool segment is quarantined
- WHEN Run quarantines an irreconcilable log segment
- THEN Platform Web MUST NOT present the rejected body as a live log event
- AND the management terminal SHALL continue receiving subsequently accepted log entries