From f84d9ed0c709cc2459ead513b07a08b00f22353c Mon Sep 17 00:00:00 2001 From: Lan_zhijiang Date: Mon, 14 Sep 2026 17:16:00 +0800 Subject: [PATCH] =?UTF-8?q?docs(contracts):=20=E6=98=8E=E7=A1=AE=20Job=20?= =?UTF-8?q?=E5=81=9C=E6=AD=A2=E4=B8=8E=E5=8F=AF=E4=BF=A1=E8=AE=B0=E5=BD=95?= =?UTF-8?q?=E8=AF=BB=E5=8F=96=E8=BE=B9=E7=95=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 20-product-tdd/knowledge-capability-contract.md | 8 ++++++++ 20-product-tdd/system-state-and-authority.md | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/20-product-tdd/knowledge-capability-contract.md b/20-product-tdd/knowledge-capability-contract.md index 60c7599..ec0c6de 100644 --- a/20-product-tdd/knowledge-capability-contract.md +++ b/20-product-tdd/knowledge-capability-contract.md @@ -173,6 +173,14 @@ external API uses one of those words. capability-handler, eligibility, atomic-claim, execution, and closure path. A Job has no retry or business-specific completeness semantics; timeout is a per-attempt execution budget, while partial progress and checkpointing remain owned by the invoked capability. +- Job admission only confirms persistence; the admitting Peer need not be an eligible executor. + `abort_requested` records best-effort stop intent. Pending work may close as aborted immediately; + running work stays running until its executor has exited and released its resources. Repeated + requests do not rewrite terminal outcomes. Stopping never promises rollback, retry, or reversal + of already dispatched external work. Each executor observes stop intent for its own active work. +- An observer's wait budget is separate from the Job execution budget. Ending observation does not + request cancellation. A final observed record is evidence of that observation, not a claim that + the database has remained unchanged since it was read. - A Cron is global command-creation policy, not a hidden execution path or a Source-owned schedule. A due occurrence is materialized under database serialization with one `scheduled_for` identity and at most one outstanding Job. Missed occurrences remain missed; diff --git a/20-product-tdd/system-state-and-authority.md b/20-product-tdd/system-state-and-authority.md index 7cc4070..7cb6c02 100644 --- a/20-product-tdd/system-state-and-authority.md +++ b/20-product-tdd/system-state-and-authority.md @@ -17,6 +17,11 @@ Record durable ownership of authoritative state across units and distinguish it authority, not request-path or product-tier authority over other peers. - Production rows are operational recovery data and must never be reproduced as development seed. +- Input validation belongs at the accepting boundary. A normal record read does not reapply + business input validation or require the corresponding runtime schema to be loaded. An execution + path may restore persisted representations into its language's types; it need not repeatedly + revalidate values already restored by that owner. Runtime capability checks remain separate + from the authority of saved records. ## Extension Installation Authority