grid_engine 0.3.0-rc.22

Tree engine for the_grid — genesis_tree reconciles the running system: build(observed), mount = spawn, unmount = kill.

0.3.0-rc.22

• Added: under TrajectoryDiscipline.cut a decision-bearing append loss HALTS admission through TrajectoryAdmissionHalt (latch-only, cleared by the operator) and opens the station-and-node gate instead of demoting the mirror; under shadow the mirror-compromised latch is unchanged. SessionScope._rearm failure under cut gates once without gate.rearmFailed; WorkList binds the ambient TrajectoryRecorderScope through the availability registry, so a WorkList-mounting root needs the production ProviderScope (tg-ppo5, #364).
• Added: the epoch-scoped dual-read soak instrument (soakWindowEpoch) and fold-backed mount facts served under dual-read primary; designed session dual-read lags are explained rather than counted as divergence (tg-esha #354, #350, tg-3yw5 #356).
• Added: admission facts (reservations, mount-eligibility refusals, the cached read-failure set) exposed for StationControl /status (#349).
• Fixed: a stalled molecule pour is re-armed and exposed instead of idling the scope silently (tg-kuux, #359).
• Fixed: held session worktrees survive until the work bead closes and are collected on demand (#357, #361).
• Floors grid_runtime to ^0.2.0-rc.16, where TrajectoryAppendResult was introduced.

0.3.0-rc.21

• Fixed: session dual-read now classifies Q9's positive retired-round/open-head shape as retired-round-open-by-design (counted by retired_round_open_by_design_divergences), a one-pass fold terminal lead as fold-ahead-of-legacy, and a legacy terminal still absent after reconciliation as legacy-terminal-no-fold-terminal; all three are cumulative explained classes rather than unexplained divergences.
• Fixed: a confirmed MountRefused now binds unless the candidate's linked session is live — non-terminal, unpaused and not a retired #rN round (protectsLiveWork); before, any bead in the mounted set or carrying a retired round kept its reservation and re-minted through a refusal, which is how an un-stamped bead ran during the dual-read soak (tg-g230, #345).
• Fixed: StationAdmissionReservation carries an identity-compared reservationToken; SessionScope hands it back on an abandoned mint and abandonSessionAttempt releases an unconsumed reservation only for the identical token, so a scope torn down between admission and createSession returns its capacity instead of holding a null-session slot for the epoch (three per boot burst against --max-agents). WorkBead keys its reservation provider on the token so a fresh grant remounts the session subtree deliberately (tg-g230, #345).
• Floors grid_runtime to ^0.2.0-rc.15, where the reconciled gate close was introduced.

0.3.0-rc.20

• Added: StationAdmissionAuthority — one station-owned service (created and disposed by StationServices) owns capacity reservation, priority-then-bead-id ordering and every durable attempt transition; WorkList derives candidates and SessionScope routes its nine transitions through it. A composition with no ambient StationServices keeps the synchronous offline default (the same eligibility clauses and kDefaultMaxConcurrentWork), a fresh reservation is visible in the flush that derived it, and a bead whose branch is mounted always participates — the mounted-work guard from tg-zat (tg-1u3c, #328).
• Fixed: a mint that times out on the state store is voided — reap, void metadata, close before release, one backoff invalidation — instead of leaving a counted ghost session; adopt-with-rivals routes through the authority's existing surplus retirement (tg-akc8, #329).
• Fixed: the leased process dispatcher classifies a StepSignal.failed as Failed.noResult and an untyped result() exception as Failed.invalidResult, so a latched-failed critic step parks at a gate instead of stranding its session (tg-cg94, #330).
• Fixed: a bead carrying a live session, or already mounted, KEEPS its branch when the content gate refuses it (stale approval, cached read failure); the refusal still flares edge-triggered but no longer disposes the running round — four live rounds were killed this way on lunar epoch 43 (tg-b7ro, #331).
• Added: pause and resume for live work sessions — the three-valued grid.session.pause_state axis, a PausedSession disposition that blocks mount, and the authority refusing a paused linked session with clause paused (tg-5kb, #334).
• Added: SessionScope exposes a mintFailed diagnostics flag, set on the first unresolved mint failure and cleared on recovery or rework, for the station status projection (tg-f6r, #335).
• Fixed: retireVoidedSession returns a typed live-fence refusal that SessionScope settles as inert without charging the mint budget, flaring session.voidRefused once (tg-m3ud, #336).
• Added: ProcessSessionUpdate.failed carries an optional CapabilityFailureKind; ProcessAllocation._driveChannel threads it into AllocationFailed, and a declared non-result classifies as infra regardless of how long the turn ran while inferred silence is unchanged (tg-bqed, #338).
• Floors beads_dart to ^0.2.0-rc.10 and grid_runtime to ^0.2.0-rc.13.

0.3.0-rc.19

• Fixed: a store timeout while PARKING a failed orphan pour no longer escapes as an unawaited microtask that kills the resident (exit 255). SessionScopeState._resumeOrphanedPour wraps its _parkFailedMoleculePour await in the same containment the fresh-mint path already had, clears the in-flight guard on either outcome, and flares the park failure by name instead of throwing past runZonedGuarded (tg-j94f, #324).

0.3.0-rc.18

• Mount reconciliation now reports locally owned issue-type and drive-list exclusions through the existing named eligibility flare, turns a throwing eligibility predicate into a refusal instead of aborting the walk, and gives each new refusal one bounded next-event-tick recheck. Rechecks reuse value-equal mounted WorkBead seed identity so unchanged branches do not re-run SessionResolver, while cold round-keyed retired-session evidence now enters the existing stays-mounted reconciliation path. The full-tree missing-eligibility-row fixture is a falsifying regression witness for genesis-7ob; the exact epoch-29 production cause remains unconfirmed until the landed lunar boot.

0.3.0-rc.17

• Floors grid_runtime to ^0.2.0-rc.12 because failure_policy.dart consumes the re-exported StepFailureClass.noResult and StepFailureClass.invalidResult members introduced by grid_trajectory 0.2.0-rc.4; published 0.3.0-rc.15 and 0.3.0-rc.16 remain unchanged.

0.3.0-rc.16

• A bead the store reports ready but the frontier excludes now FLARES the clause: cross-store link exclusions are a composed MountEligibilityPredicate (crossLinkExclusionClause through composeMountEligibility, beside mountAttemptClause), applyBlockGuard reports each block through an onBlocked observation, and work.mountEligibilityRefused re-fires whenever the refusing clause CHANGES rather than once per transition. Priority-then-bead-id admission and the live-session carve-out are preserved and pinned (tg-vdt0, #311).
• Floors tightened to beads_dart ^0.2.0-rc.8.

0.3.0-rc.15

• Breaking: Failed.nonResult, AllocationFailed.nonResult and isHarnessSilence(nonResult:) are REMOVED with no shim; a capability failure is now the typed CapabilityFailure (CapabilityFailureKind {work, noResult, invalidResult}) carried on the existing Failed/AllocationFailed arms, and each capability declares its own per-step restart policy through SupervisionPolicy (retry budget + backoff; undeclared policies keep the circuit-wide defaults byte-for-byte). A malformed or absent result retries ONLY its own lane and is never graded F (tg-e32f, #309). Migration: replace every Failed.nonResult(...) / AllocationFailed.nonResult(...) with the typed failure and, where a capability needs a lane-specific budget, declare supervisionPolicy; power_station's grid_assets committee.dart carries six such call sites and migrates in pow-dzc — do not floor a consumer on this rc before that lands.

0.3.0-rc.14

• Added: SessionLedgerMetricsProjection.cacheTokens (CacheTokenTotals{cacheRead, cacheCreate, uncachedInput}) and landedDeliveries (LandedDeliveryTotals{landedCost, landedCount}) — the component totals behind cacheHitRatio and costPerLandedDelivery, so a multi-store consumer can merge projections by weighted sum instead of averaging averages; the two scalars are unchanged and derived from the records (tg-mws0, #307).

0.3.0-rc.13

• Ready work is re-minted after a terminal session closes: linked session rows are ordered deterministically, surplus dead keys retire through the existing void path, and every blocking terminal is surfaced; rework selects open sessions without changing its park predicate (tg-83k1, #300).
• Adopts grid_runtime 0.2.0-rc.11 (the GitOps work-tree-root guard): the engine fakes answer the root probe without recording it (tg-amwa, #302).
• Floors tightened to grid_runtime ^0.2.0-rc.11.

0.3.0-rc.12

• Silent, artifact-less harness exits (a usage window running out, a network refusal) classify as infra: the restart budget is spent with backoff, then the round opens a gate naming the throttle and flares harness.throttled with the tail of the agent's output — never a gateless failed strand (tg-mbeh, #294; shipped in this rc after the tag was cut from main).
• Breaking: process groups are supervised as groups and exit status is preserved — SessionOrphaned is a new RuntimeEvent variant (emitted once, NOT terminal: the group stays supervised until it empties or the bounded grace elapses and it is signalled), so exhaustive switches over RuntimeEvent need an arm (tg-8kye, #290; engine consumes the new event). Migration: add SessionOrphaned() to every switch (event); power_station#195 is the consumer fix.
• Floors tightened to grid_runtime ^0.2.0-rc.10, grid_trajectory ^0.2.0-rc.1.

0.3.0-rc.11

• Breaking: StationKernel is deleted; runGrid is the station's single flush coordinator and now carries the tg-60n fail-closed flush guard (#284). Migration: nothing constructs StationKernel in the org — drop any import of it and call runGrid (grid_sdk run_grid.dart); see decisions/2026-09-02-run-grid-is-the-single-flush-coordinator.
• Foreign dependency rows (a bd dep naming another store's prefix) are refused loudly instead of silently mis-linking; cross-store edges are link beads (tg-mspw, #283).
• Pending work is admitted by priority, then bead id, so a P0 never waits behind alphabetically earlier P2s (tg-lohr, #279).
• Floors tightened to beads_dart ^0.2.0-rc.7 and grid_runtime ^0.2.0-rc.9.

0.3.0-rc.10

• Breaking: adopts genesis_tree 0.3.0 — InheritedBranch.addDependent and TreeContext.dependOnInheritedSeedOfExactType gain {Object? aspect}, and the engine's Provider / registry overrides and FakeTreeContext forward it (#260). Migration: bump genesis_tree to ^0.3.0 and add the aspect parameter to any addDependent / dependOnInheritedSeedOfExactType override; callers that pass no aspect are unchanged.
• Dual-read: pre-transition step fold absences are classified rather than reported as unexplained divergences (#258); session/step dual-read divergences carry a classified cause (#254).
• Tests pin leased protocol-event completion (#257).

0.3.0-rc.9

• The trajectory dual-read surfaces (tg-zfek, cut-wiring C1–C4): trajectory_views declares the fold READ interfaces and the winner rule in the engine's own domain layer — grid_sdk implements them over grid_trajectory's row types, so the engine gains no dependency and no SQL client enters its transitive set. Adds the session-axis pass (dual_read_pass: the overlay and its monotone guard, the comparator, lag/adjudication, the one escalation rule) and the step-axis pass (step_dual_read_pass: the collapse rule, the shared effectiveStepCursor, the three step-axis protections), plus the trajectory_scope ambient value (#245, #250).
• ProcessSession: a protocol-neutral session contract over lease-produced allocations, so a supervised long-lived process is driven by bytes and its outcome derived from structured updates; the legacy dispatcher is retained for one-turn capabilities (#246).
• Gate-rearm observation: successor step rounds are derived from durable closed-gate history and scoped to their structural step incarnation, and a missing running transition is reconstructed when successful completion proves the in-process attempt ran (#247).
• Historical sessions are fenced with an explicit legacy outcome on the completed-disposition latch; unmarked dead-key recovery is preserved (#232).

0.3.0-rc.8

• CompletionContract.artifactDurability: a capability declaring it is not complete — cached, leased, or live — until its artifact is durably present; an artifactless completion is UNRESOLVED, never 'finished' (#226).
• Rework's replacement mint is decoupled from gate cleanup: supersession is applied before the superseded round's gate auto-close, and a failed close flares without eating the fresh round (#227).

0.3.0-rc.7

• ServiceBundle.derive(): a total derivation factory with an all-required private constructor — adding a bundle field is now a compile error at every derivation site instead of a silently dropped field (#217).
• WedgeMonitor.pollSnapshot exposes the wedge classification over one captured join for coherent status projection (#221).
• Live sessions settle when their work bead closes (#215); molecule reap participates in topological ordering (#216).

0.3.0-rc.6

• A dropped state-persist now gets a bounded, durable consequence: the failure routes into the supervised-restart writer (persisted restartCount + backoff cooldown; circuit-break + escalation at exhaustion). Kills the unbounded 1 Hz re-derive that grew one store by gigabytes (#207).
• Molecule step graphs are collected before session close, and externally closed sessions replay their teardown at boot (#206, #208).
• An exhausted successor mint parks a gate instead of abandoning the molecule (#209); every post-retire abandoned mint flares, LOUD or GONE (#210).
• up warns at boot when the state store's types.custom is missing engine types — the misconfiguration that silently stranded three molecules (#211).
• Floors tightened for train coherence: grid_runtime ^0.2.0-rc.4, beads_dart ^0.2.0-rc.4.

0.3.0-rc.5

• Fixes 0.3.0-rc.4, which DOES NOT COMPILE against its own declared dependencies. rc.4 allowed grid_runtime: ^0.2.0-rc.1, but its SessionScope/WorkList reference StationBeadWriter.closeOpenGatesForTerminal, GateCloseCause and GateSweepSessionDisposition, which first ship in grid_runtime 0.2.0-rc.3. The constraint is tightened to ^0.2.0-rc.3. Do not use 0.3.0-rc.4.

0.3.0-rc.4

• Breaking: operatorRulingMetadata gains a REQUIRED evidenceSession named parameter. Migration: pass the session id whose artifacts the ruling is evidenced by — operatorRulingMetadata(nodePath, grade: g, rationale: r, evidenceSession: sessionId). Rulings are now scoped to the generation they addressed, so a prior round's ruling can no longer merge into a fresh round's identical node path (tg-04tj).
• The rework cap counts only rounds that reached a VERDICT: a spec-readiness HOLD, where no specify agent ran and no committee graded, no longer spends budget (tg-04tj, completing tg-9q58).
• MountEligibilityPredicate / MountEligibilityDecision (MountEligible / MountRefused): an injectable predicate consulted at the mount boundary, with edge-triggered work.mountEligibilityRefused / work.mountEligibilityRestored flares naming the refused clause. ServiceBundle gains mountEligibility. The engine supplies the SEAM only — concrete clauses come from the composing assets pack (tg-8900).
• Route verdicts persist through CapabilityHostState._persistAdvance / _persistEscalate so a round's verdict evidence is durable (tg-04tj).

0.3.0-rc.3

• Breaking: the kMaxReworkRounds budget now counts only rounds that reached a durable verdict; verdict-less infrastructure losses retain history but do not spend rework budget (tg-9q58).
• Breaking (tg-1fa2.5): the provider layer — Provider<T> is a MOUNTED seed (SingleChildStatefulSeed): create: runs once per mount (tree-owned, tree-disposed), .value adopts without ownership; ProviderScope is the availability registry (a watch<T>() miss parks the dependent and a later provider mount rebuilds it); read<T>() never registers. Kind is fixed for a branch's lifetime — both create/value flips throw.

0.3.0-rc.2

• A failed molecule pour FLARES (session.moleculePourFailed) and parks the session at a durable gate (tg-aec) — both the fresh-mint and adopted-orphan paths; the silent inert-session class is closed.
• FederatedSnapshotSource judges ready-staleness by AGE (readyStaleAge) from the live source heartbeat, with rising-edge sync.memberStaleByAge/sync.memberRecovered flares (tg-zd4v).
• The wedge alarm samples LAST and ALWAYS in StationDriver.afterFlush — a throwing scan can no longer silence the stall detector (tg-60n).
• A throwing rebuild no longer decapitates the flush tick (tg-60n, #154).

0.3.0-rc.1

• Breaking: tracks beads_dart 0.2.0-rc.1 and grid_runtime 0.2.0-rc.1 — the bd export retirement and StationBeadWriter(reader:). No engine API change of its own; the constraint bump is the breaking part for resolvers.
• Changed: lifecycle reads are observed through the probe-reader seam.

0.2.0

• Breaking: diagnostics ride the genesis_foundation substrate — the local Diagnosable mixin and DiagnosticsBuilder class are retired in favor of foundation's Diagnosticable/DiagnosticsBuilder (a GridDiagnosticable marker and the typed addTyped adapter remain). Seed hooks override debugFillProperties(DiagnosticsBuilder).
• State-owned cross-repo link beads gate the ready frontier (fail-closed).

0.1.2

• Family coherence release: step results filter by active incarnation (live route joins, the_grid#139); current session-scope surface.

0.1.1

• Every circuit step now mounts as a tree node (the_grid #105).
• Fixed: rework mint gated on fresh readiness; rework remint eligibility derived from snapshots; circuit round threaded into capability args; derived rework caps parked at the route gate (the_grid #107, #116, #118, #119).

0.1.0

• Initial release: genesis_tree-based tree engine reconciling the running system (build(observed), mount = spawn, unmount = kill).