PostgreSql

Remarks

This client persists Schedule command, generation, and occurrence facts but does not start a hosted loop. Use PostgreSqlDurableScheduleProcessor to run one bounded, manually invoked due pass. The initial implementation admits Work targets only because it can atomically compose the existing caller-owned Work writer. Callers must authorize the Schedule scope before invoking this client. Configure distinct non-owner, non- BYPASSRLS dispatcher and runtime login roles with the documented PostgreSQL role recipe , and apply schema version 4 before accepting Schedule work. Hosted activation is intentionally deferred; this client and processor never register or start a background loop.

Remarks

The role name is checked with current_user before a Schedule processor sets its scoped RLS setting or bridges an occurrence to Work. The safety window limits how far a single database-clock observation may advance an interval cursor; a larger jump suspends rather than consumes future occurrences.

Remarks

This service is registered only by explicit worker-host composition. It does not apply schema migrations and does not own durable correctness: the store still owns claims, leases, permits, fencing, and durable history.

Remarks

The processor first claims a payload-free dispatch lease through the dispatcher data source, then opens a separate scoped runtime transaction to record and bridge Schedule facts. It does not start a loop, execute Work, invoke a provider, or start Flow targets. Cancellation is observed before each additional lease; work already committed by a prior claim remains durable.

Remarks

The helper does not assign NpgsqlCommand.CommandTimeout or alter connection settings. It records typed deadline evidence against the original exception before any boundary-specific translation. Non-query cancellation caused only by that package deadline becomes TimeoutException ; caller cancellation and every other failure preserve their concrete type, token, SQLSTATE, and stack. The helper is used only for schema status, health observation, and pre-execution runtime admission.

Remarks

The writer never opens, commits, rolls back, replaces, or disposes the supplied transaction. Domain state and Work acceptance therefore commit or roll back together in the same database.

Remarks

This selection is created while the runtime pump is resolved. It intentionally never rereads a custom registry, so later registry mutation cannot widen a running host's discovery authority.

Remarks

Migration and epoch mutations hold one session advisory lock across their individual transactions. The session scope is required to prevent another migration owner from interleaving between migrations; lock acquisition is nevertheless bounded and cancellation-aware, and the owning connection is always disposed after the mutation so PostgreSQL releases the lock even when explicit cleanup cannot run.

Remarks

Applications authorize the trusted scope before this client is invoked. The client never reads a raw Work result into its public assessment and never invokes an executor while applying a repair assertion.

Remarks

Use a migration-owner data source. Runtime registration may validate status but must never apply DDL.

Remarks

Slice 6 deliberately makes this a no-op wrapper. Durable Flow trace context, Activities, links, tags, and exports remain #685's responsibility; its narrow integration can replace this implementation without changing claim, permit, completion, or hosted-lifecycle ownership.

Remarks

Observers run after the named database boundary commits and must preserve that ordering. They must not access the database or initiate another Flow operation, because observers exist only to certify recovery boundaries such as a deterministic subprocess termination.

Remarks

Discovery uses only the dispatcher-role data source. Claim and mutation use only the scoped runtime-role source. Evaluation runs after the claim transaction releases every database resource.

Remarks

This is a passive provider operation. Applications may call it from an external trigger or test, but must not loop it in an ASP.NET request or register hosted work; hosted activation requires the explicit AddWorkerHost() opt-in.

Remarks

One pass is deliberately sequential and process-local. PostgreSQL retains all authoritative discovery, claim, lease, permit, completion, schedule, scope, and epoch decisions. The internal execution boundary is intentionally uninstrumented so #685 can attach Activity and ActivityLink behavior without taking ownership of this lifecycle.

Remarks

The supplied connection must use the dedicated retention-operator role described by the PostgreSQL role recipe. It is not interchangeable with the runtime or dispatcher data source. The application authorizes every caller, stores archive bytes externally, and decides policy cadence; this client proves only protocol correspondence.

Remarks

The digest binds the persisted suspension shape to the exact activity wait and child Work. Its field order and length-prefixed UTF-8 encoding are a durable compatibility contract: changing either requires a new SchemaId and a corresponding migration constraint.

Remarks

This is an internal provider implementation of the public Provider SPI. Applications must authorize an operation before calling it; opaque scope and aggregate identities are not authorization grants.

Remarks

This internal class supports controlled derived test seams. Overrides must preserve claim identity, runtime epoch and scope-generation fences, lease ownership, dispatch projection, Work history, and transaction guarantees.

Remarks

This client does not authenticate callers, apply schema migrations, or start a processor. Applications authorize the trusted DurableScopeId before calling it. The data source must use the scoped runtime role.

Remarks

These options control activation only. They do not apply migrations, alter durable protocol policy, or replace PostgreSQL leases, recovery epochs, and history as the source of truth. Registering PostgreSQL storage remains passive until AppSurfaceDurablePostgreSqlBuilder.AddWorkerHost is called.

Remarks

This module does not create data sources, choose database credentials, apply migrations, or start a worker. Call AppSurfaceDurablePostgreSqlServiceCollectionExtensions.AddAppSurfaceDurablePostgreSql with the application's reviewed dispatcher and runtime data sources, then opt into AddWorkerHost only where continuous activation is intended.

Remarks

Applications must authorize every request before this client is called.

Remarks

The Work store invokes this projector in the same transaction that commits terminal Work truth. That makes a coalesced occurrence eligible immediately, without relying on the Schedule's normal interval to wake it.

The definition row is locked before its dispatch row is updated. Schedule processing takes the same definition lock, so a terminal Work transition cannot race a pending occurrence from one active generation into a later generation.