Operation Journal and Recovery Evidence

Operation Journal and Recovery Evidence A data-flow diagram generated by Archify. 01 / Operation intent 02 / Journal identity 03 / Physical evidence 04 / Canonical outcome 05 / Recovery + consumers Semantic Send · one logical mutation · 01 / Operation intent · operation Semantic Send one logical mutation operation Batch Inputs · ordered occurrences · 01 / Operation intent · member 0..n Batch Inputs ordered occurrences member 0..n SendIdentity · invocation · method · 02 / Journal identity · phase · member SendIdentity invocation · method phase · member OperationJournal · entries + attempts · 03 / Physical evidence · ordered evidence OperationJournal entries + attempts ordered evidence BatchOutcome · complete ordered members · 04 / Canonical outcome · four commit states BatchOutcome complete ordered members four commit states OperationMetadata · immutable snapshot · 04 / Canonical outcome · bounded aggregate OperationMetadata immutable snapshot bounded aggregate RecoveryAction · retry · inspect · wait · 05 / Recovery + consumers · safe continuation RecoveryAction retry · inspect · wait safe continuation Public Recovery · reconcile · adapters · 05 / Recovery + consumers · bounded + redacted Public Recovery reconcile · adapters bounded + redacted allocate once semantic identity bind entry same workflow aggregate attempts UNKNOWN wins settle every member identity preserved attach on escape whole-request evidence action typed ordered evidence candidates are not proof Legend primary data policy / PII data store data flow

Commit-state lattice

  • • NOT_SENT is positive proof that dispatch did not occur; REJECTED is a decoded refusal
  • • UNKNOWN means a dispatched write may have committed; CONFIRMED requires correlated success
  • • Workflow aggregation is conservative: UNKNOWN outranks every settled state

Recovery contract

  • • Only an explicit owner may replay NOT_SENT or REJECTED work
  • • UNKNOWN normally carries inspect_and_reconcile; candidates never become known resource IDs
  • • WAIT and NONE keep retry policy separate from exception categories

Bounded public evidence

  • • Metadata and batch members are capped, redacted, ordered, and duplicate-safe
  • • Escaping errors carry settled progress without adapter-specific inference