The state a pure D1 query cannot see, declared rather than omitted.
THE SWEEP BEHIND THIS LIST. Every key a Durable Object in this package writes
was checked against the categories above, and all but one is backed by a row
a query here already returns:
flowsafe:run-owner-recovery:v1 — DECLARED below. It is written BEFORE the
D1 owner row, so a crash between the two leaves a run with no D1 record at
all.
flowsafe:agent-thread-binding:v1 / flowsafe:agent-run:v1:* — a thread's
binding to its agent run and that run's own state. Both name a run whose
ownership is RESERVED in D1 BEFORE execution begins
(agent-host/thread-host.ts, durable-object.ts) and settled only AFTER a
summary has persisted. The engine also writes a running snapshot as the
run starts, so an executing run is normally reported under runs on its own
— but that snapshot lands INSIDE runtime.start, after the reservation, and
the unsettled reservation is what covers the gap between the two as well as
any later moment the snapshot is behind the run. resource-owners is a WORK
category for exactly that reason: an unsettled reservation means a start
that has not durably settled, whatever the snapshot currently says.
(Pinned behaviourally by inventory.test.ts's ownership-ordering test, which
fails if settlement ever moves ahead of the persisted summary.)
flowsafe:suspension-deadline:v1 — an armed wake for a run that is
suspended, and therefore nonterminal, and therefore under runs.
flowsafe:maintenance-health:v1, flowsafe:maintenance-nonces:v1,
flowsafe:maintenance-deadline-cursor:v1 — the maintenance object's own
health, replay protection, and scan position. None is a unit of work: they
describe the sweeper, not what it sweeps.
The state a pure D1 query cannot see, declared rather than omitted.
THE SWEEP BEHIND THIS LIST. Every key a Durable Object in this package writes was checked against the categories above, and all but one is backed by a row a query here already returns:
flowsafe:run-owner-recovery:v1— DECLARED below. It is written BEFORE the D1 owner row, so a crash between the two leaves a run with no D1 record at all.flowsafe:agent-thread-binding:v1/flowsafe:agent-run:v1:*— a thread's binding to its agent run and that run's own state. Both name a run whose ownership is RESERVED in D1 BEFORE execution begins (agent-host/thread-host.ts, durable-object.ts) and settled only AFTER a summary has persisted. The engine also writes arunningsnapshot as the run starts, so an executing run is normally reported underrunson its own — but that snapshot lands INSIDEruntime.start, after the reservation, and the unsettled reservation is what covers the gap between the two as well as any later moment the snapshot is behind the run.resource-ownersis a WORK category for exactly that reason: an unsettled reservation means a start that has not durably settled, whatever the snapshot currently says. (Pinned behaviourally by inventory.test.ts's ownership-ordering test, which fails if settlement ever moves ahead of the persisted summary.)flowsafe:suspension-deadline:v1— an armed wake for a run that is suspended, and therefore nonterminal, and therefore underruns.flowsafe:maintenance-health:v1,flowsafe:maintenance-nonces:v1,flowsafe:maintenance-deadline-cursor:v1— the maintenance object's own health, replay protection, and scan position. None is a unit of work: they describe the sweeper, not what it sweeps.