Engineering notes

How the control plane behaves when a runner is reclaimed, a stream starts before enqueue, serve would start insecure, a job crash-loops, concurrent runs share a budget, or Postgres RLS cannot grant itself. Failure modes and the code that closes them. Not a second architecture overview.

• 1 · Generation fencing: A stale runner cannot overwrite the winner after reclaim.
• 2 · Subscribe-before-enqueue: Listen on the event broker before dispatch so early tokens are not lost.
• 3 · createRunCtx / fail-closed serve: One admission funnel; production serve refuses an insecure posture.
• 4 · Poison pill / reclaim ceiling: Crash-loop jobs stop reclaiming after a hard max_retries ceiling.
• 5 · Optimistic spend holds: Reserve an estimate at create time so concurrent runs can't all pass a terminal-only budget check at once.
• 6 · The RLS grant that can't grant itself: A Postgres 16 circular-grant gotcha that only shows up on a non-superuser DSN.

Each note opens in the engineering-notes layout. This index stays in Docs so the handbook sidebar remains. Related: decision write-ups · public chapters · Ops