DecisionCase lifecycle

A DecisionCaseOne run unit: intake + snapshot + obligations + candidates + terminal is a durable unit of work, not a single request. Models, L3, and memory calls fail. Processes restart. Without explicit states, leases, timeouts, and resume rules, you get orphan traces and double emits. This doc is the lifecycle contract.

States#

flowchart TB
    %% house-style: decision-case-lifecycle
    subgraph run["Active case"]
        direction LR
        q["queued"] --> ls["leased"]
        ls --> rn["running"]
        rn --> ap["awaiting_ports"]
        ap --> rn
        ap --> rw["retry_wait"]
        rw --> ls
        rn --> tz["terminalizing"]
    end
    gate{{"Kernel re-check / CardSink"}}
    subgraph term["Terminals"]
        direction LR
        ok["terminal:<br/>emit / supersede / withhold / abstain"]
        hd["held"]
        cx["cancelled"]
        to["timed_out"]
        fi["failed_infra"]
    end
    back(["↩ Opportunity ledger on semantic block"])
    tz --> gate
    gate --> ok
    gate --> back
    tz --> hd
    q & ls & rn --> cx
    rn & rw --> to
    ap & rw --> fi

    classDef govc fill:#fff4d6,stroke:#c99a2e,color:#000
    classDef agentc fill:#e8f0ff,stroke:#5b7bd5,color:#000
    classDef loopc fill:#eef7ee,stroke:#4f9a4f,color:#000
    class gate govc
    class back loopc

Rule: failed_infra and timed_out are not customer withholds. They do not teach soft gates. They page on-call. Semantic withhold / abstain only after the stage graph could finish with a frozen ledger.

Identity and durability#

Case row + append-only stage events live in the L4 operational store. Crash mid-stage: resume from last completed stage checkpoint if ledger frozen for that stage; otherwise restart from last safe checkpoint (never re-emit without idempotency key — 27).

Timeouts (registry defaults — lock in ops)#

Exception-tier cases get tighter wall clocks than energy/cost investigative lanes (latency_tier registry).

Cancel#

Who may cancel: on-call (ops), plant owner (plant-scoped), system on kill-switch (28-commissioning-and-controls.md).

Cancel writes a DecisionTraceAlways-on record: observed, context, action, policy, approval, outcome (and seam decisions) with terminal_reason=cancelled (or closes as failed_infra if no ledger). Never leaves a half-sent CardSink without compensating idempotent check.

Crash resume algorithm (normative intent)#

1. Worker starts → claim next queued / reclaim expired leased.
2. Load case + last completed stage id + frozen sub-ledger.
3. If CardSink already succeeded for this decision_case_id + emit_idempotency_key → mark terminal emit/supersede; do not call models again.
4. Else continue from next stage under the same lockfile and as-known-at snapshot id.
5. Do not refresh PSMPlant Situation Model to “now” on resume — that breaks replay. New evidence requires a new case or explicit recheck work item.

Token budget failure#

If a stage cannot fit required proof rows (proof floorMinimum evidence/structure required before emit (asset bound, verification path, L3 condition test for discoveries), intersecting hard constraints, calculator refs for priced claims) inside the token budget after zoom policy:

→ withhold or abstain with gate_id=token_budget_required_proof (hard-adjacent: not soft-tunable to “drop proof”).

Never silently truncate required measured rows to force a draft. Optional advisory / OE chunks truncate first (05-context-engineering.md).

Rejected alternatives#

What would change this#

• Wall clocks too tight for enveloped L3 sims → raise stage budgets by latency tier after measured p95.
• Need human “pause case” without cancel → add paused state via ADR.

v1 slice vs later#

Change class#

Timeouts and caps: data. New states that change terminal semantics: ADR + kernel/lifecycle bump.