Engineering notes
How the control plane behaves when a runner is reclaimed, a stream starts before enqueue, serve would start insecure, a job crash-loops, concurrent runs share a budget, or Postgres RLS cannot grant itself. Failure modes and the code that closes them. Not a second architecture overview.
A stale runner cannot overwrite the winner after reclaim.
Listen on the event broker before dispatch so early tokens are not lost.
One admission funnel; production serve refuses an insecure posture.
Crash-loop jobs stop reclaiming after a hard max_retries ceiling.
Reserve an estimate at create time so concurrent runs can't all pass a terminal-only budget check at once.
A Postgres 16 circular-grant gotcha that only shows up on a non-superuser DSN, and why superuser-only test coverage hid it.
Related: decision write-ups · public chapters · Docs · Engineering notes index · Docs · Ops