Job resolution

job-resolution-1

Tests included

This contract defines the behaviour of jobs: a crafting bench, a build queue, or research.

It decides what your crafting bench or build queue does when it is stopped, fails, or has nowhere to put the result.

Use in your game

Opens the authoring tool with this contract added and its questions unanswered. Or download the ZIP and add it later.

What is in the ZIP

The ZIP holds the contract and its acceptance tests. In the authoring tool, choose Add contract and pick this ZIP. If you keep your design as files, put them in contracts/ and fill in the answers there.

Download contract JSON · Download tests

Questions

Up to 9 questions. Some appear only after earlier answers.

Try the answers

Pick answers to see which rules and tests apply. Nothing is saved here: the ZIP and the authoring tool start unanswered.

Show exact wording for builders

Does this job need inputs that can be claimed and spent?

Required inputs	The job needs one or more inputs. Brewing one potion may need two herbs and one bottle. The request checks the required share at the request gate. The lifecycle claims and spends that share at the selected times.
No inputs	The job claims and spends no input. Researching Pottery may need an unlocked lab but no material. Input checks, claims, returns, and spending are empty. Eligibility conditions may still prevent the game from offering the request.

What happens to recorded work when this job stops?

Asked when: the work phases list has at least one row.
If not asked: The job has no work span before finish; start and finish settle in one batch, unless an allowed delivery answer leaves the result visibly finished. No partial work is recorded, and no interruption can stop the job before its finish gate. A recoverable failure while waiting still lands it in stopped, with the start gate as its resume point.

Keep with job	Recorded work stays with the same job. A half-built wall remains halfway built after rain stops the work. A normal stop preserves all recorded work. Only this job can resume from it.
Reverse while stopped	Recorded work falls while the job is stopped. A cooling forge loses heat while no smith works. Recorded work decreases under reversal-declared-in and never passes below no work. Claim changes caused by the decrease settle through lifecycle step 12.
Reset at stop	Recorded work returns to none when the job stops. An interrupted lockpick attempt starts again from the beginning. The first ordinary stop records no work. Cancellation records no terminal work after its input snapshot is taken.

What does a listed failure do unless that failure says otherwise?

Asked when: the failures list has at least one row.
If not asked: No accepted or finished job fails; refusal, stopping, cancellation, and blocked delivery are different outcomes.

Partial inputs or work	Failure may lose part of the current inputs, recorded work, or both, whichever exist. A spill may lose one cup of broth while the same soup remains unfinished. The cited failure rule may lose a strict subset of claimed inputs, reduce recorded work without passing below no work, or do both. It creates no successful output and leaves the same job stopped.
Job ruined	Failure ends this job for good. An overcooked meal is ruined and cannot finish as the same meal. The job enters terminal failed and creates no successful output. A finished but undelivered new output is destroyed.

What happens to inputs this job still claims when it is cancelled?

Asked when: the cancellations list has at least one row.
If not asked: An accepted job cannot be cancelled. A reviewer confirms this before the adoption relies on it.

Return claimed	Every surviving claimed input returns to its source. Cancelling a queued soldier returns the 50 gold already set aside. Release every unit still claimed by the job. Do not add units that were never claimed or were already lost.
Return nothing	No claimed input returns. Cancelling a fired clay pot spends the clay already placed in the kiln. Spend every unit still claimed by the job and release none. Inputs not yet claimed remain at their sources.
Return by rule	A game rule chooses the returned share. Cancelling a half-built wall may return unused bricks but not dried mortar. Release the subset named by cancel-return-declared-in, never more than the current claim, and spend the rest.

What happens to later waiting jobs that needed a cancelled job's output?

Asked when: the dependent cancellations list has at least one row.
If not asked: Cancelling a job leaves later waiting jobs in place, even when they needed its output.

End dependents	Later jobs that can no longer get the needed output are cancelled too. Cancelling an iron ingot also cancels the waiting sword that needed it. Cancel every transitively dependent later waiting job whose requirement can no longer be met. Settle them in waiting order.
Leave dependents	Later jobs remain waiting. A sword order may wait for another iron ingot after its first ingot job is cancelled. Leave every later dependent job waiting. The wait ends only when the requirement is met again or the job is cancelled.

When do required inputs become unavailable to other rules?

Asked when: Job inputs is Required inputs.
If not asked: This job claims no input, so there is no claim time to choose.

Taken at request	All inputs are claimed when the request is accepted. A queued soldier reserves its full gold cost before training starts. Atomically claim the full requirement at admission, whether the job waits or starts.
Taken at start	All inputs are claimed when work starts. A workbench leaves wood available until the bench begins the chair. Atomically claim the full requirement at start. No other rule can use claimed units.
Taken at finish	Inputs stay available until successful finish. A ritual checks for three crystals only when the casting completes. Claim and spend the full requirement at the finish gate. No pre-finish input claim exists.
With progress	Inputs are claimed as work advances. A wall claims half its bricks when it reaches half of its recorded work. Before each observable advance, claim the rounded share required at the proposed work point. Release the matching share when work reverses.

Does a stopped job keep the inputs it has already claimed?

Asked when: Partial work is Keep with job or Reverse while stopped or Reset at stop and Input claim timing is Taken at request or Taken at start or With progress.
If not asked: When no pre-finish claim exists there is nothing to hold; otherwise the stopped job keeps its claim.

Hold	The job keeps the claim while stopped. A paused wall keeps its reserved bricks at the site. Retain the current claim while stopped. Work changes may first reduce a progress-based claim.
Release and reclaim	The claim returns while stopped and must be claimed again before resuming. A paused research topic releases its points for another topic. Release the current claim while stopped. Reclaim the required share before resuming; remain stopped if that share is unavailable.

When is the completed result delivered?

Asked when: the delivery cases list has at least one row, or the output destinations list has at least one row, or the collection events list has at least one row, or the readmission events list has at least one row, or the redelivery events list has at least one row.
If not asked: A finished output is delivered automatically as soon as its normal destination accepts it.

Automatic	Delivery happens as soon as a destination accepts the output. A trained unit leaves the barracks for its rally point at once. Move from finished to delivered immediately after the capacity policy accepts one destination.
On collection	The output waits for collection at its accepted place. A cooked meal stays on the stove until a player picks it up. Keep the accessible output in finished until collection-declared-in occurs, then report delivery once.

What happens when the whole output does not fit at its normal destination?

Never full	The normal destination always accepts the output. Completed research always fits in the research ledger. No job reaches a capacity-blocked state. A reviewer confirms the capacity promise before the adoption relies on it. An in-place output always answers this way. If the capacity promise is false, the adoption is broken; there is no fallback lifecycle branch.
Wait before start	The job waits before starting until room is reserved. A bakery starts a loaf only after one shelf space is held for it. Keep admission pending until the whole output has reserved room. Hold that reservation through delivery.
Wait until space	Completed work stops at the finish gate until the output fits. An assembler holds a finished engine while its output slot is full. The job moves to stopped at its finish gate, work phase or not, and retains completed work until capacity clears.
Hold undelivered	The job finishes and owns one inaccessible output until delivery can retry. A forge holds one finished sword while the rack is full. Spend inputs and keep one owned output in finished. Only redelivery-declared-in retries the normal destination; work is not repeated.
Try destinations	The job tries named places in order. A mined gem tries the backpack, then the cart, then waits if both refuse it. Try the normal destination, then output-destinations in written order. Keep the same output in finished if all refuse; only redelivery-declared-in retries the route.

Numbers and rulesno numbers, 3 rules

Numbers

This contract has no numbers to set.

Rules

Progress-based input claims cannot reset all work when inputs run out; keep or reverse the work, or claim inputs at another time.

Forbidden when Input claim timing is With progress and Partial work is Reset at stop.
Reversing work while inputs are claimed with progress can make the same materials leave and return repeatedly.

Forbidden when Input claim timing is With progress and Partial work is Reverse while stopped. (a warning, not an error)
A collected result must already be at an accepted destination; choose a destination rule that puts it there first.

Forbidden when Delivery trigger is On collection and Output full is Hold undelivered, or Delivery trigger is On collection and Output full is Try destinations.

Lists17 lists

Some settings are lists of rows.

A reference points to a number or a rule in your design. For a number, use its address in your tuning. For a rule, use its file and heading, such as 02-mechanics.md#recovery. Each field's description says what it needs.

Job

job

Give the job rule and the normal output destination. One adoption has exactly one row.

An empty list means: An empty job list is never a behavior choice: this adoption requires exactly one job row, and a reviewer rejects a file without it.

Each row is: job-declared-in, normal-destination-declared-in, output-kind.

Every field

Field	Kind	When it appears	Meaning
`job-declared-in`	reference	Required	The rule naming required inputs, one successful output unit, any in-place target, and game-owned choices or quality rules.
`normal-destination-declared-in`	reference	Required	The rule naming the output's ordinary destination.
`output-kind`	choice: new-thing, in-place	Required	Whether success creates a new thing or transforms the cited target in place.

Read first

read-first

Optionally point a reviewer to prose that must be read before trusting the adoption.

An empty list means: No advance reading is required.

Each row is: id, read-first.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this reviewer note.
`read-first`	reference	Required	The prose a reviewer should read first.

Work phases

work-phases

List the work span before finish. One adoption has at most one row.

An empty list means: Start and finish settle in one batch.

Each row is: id, duration-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name the work span in the game's words.
`duration-declared-in`	reference	Required	The duration and clock rule, or the event rule that completes the work.

Interruptions

interruptions

List the game rules allowed to instruct a working job to stop.

An empty list means: Stops arise only from lifecycle inability.

Each row is: id, interruptions-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this interruption.
`interruptions-declared-in`	reference	Required	The rules allowed to instruct the stop.

Reversal rules

reversal-rules

Give the work-decrease rule exactly when stopped work reverses.

An empty list means: Stopped work does not reverse.

Each row is: id, reversal-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this reversal rule.
`reversal-declared-in`	reference	Required	The rule that determines how recorded work decreases while stopped.

Progress rounding rules

progress-rounding-rules

Give the proportional rounding rule exactly when inputs are claimed with progress.

An empty list means: Inputs are not claimed with progress.

Each row is: id, progress-rounding-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this rounding rule.
`progress-rounding-declared-in`	reference	Required	The rule that rounds each divisible input's proportional claim.

Cancel return rules

cancel-return-rules

Give the return rule exactly when cancellation returns a rule-sized share.

An empty list means: Cancellation does not return a rule-sized share.

Each row is: id, cancel-return-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this cancellation return rule.
`cancel-return-declared-in`	reference	Required	The rule naming the part of the current claim returned on cancellation.

Collection events

collection-events

Give the collection event exactly when a finished output waits for collection.

An empty list means: A finished output does not wait for collection.

Each row is: id, collection-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this collection event.
`collection-declared-in`	reference	Required	The event that accepts the finished output and delivers it.

Readmission events

readmission-events

Give the readmission event exactly when output room is reserved before start.

An empty list means: Output room is not reserved before start.

Each row is: id, readmission-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this readmission event.
`readmission-declared-in`	reference	Required	The rule or event that tries admission again without polling.

Redelivery events

redelivery-events

Give the retry event when a held output or a route that can be refused may actually try delivery again.

An empty list means: A held output or a route that can be refused does not retry delivery.

Each row is: id, redelivery-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this redelivery event.
`redelivery-declared-in`	reference	Required	The rule or event that tries delivery again without polling.

Work limits

work-limits

List each working and waiting pool.

An empty list means: Jobs share no work limit and every otherwise-ready job starts.

Each row is: id, covers-declared-in, scope, places-declared-in, place-assignment-declared-in, working-limit-key, waiting-limit-key, waiting-order, order-declared-in, releases-working-at.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this pool in the game's words.
`covers-declared-in`	reference	Required	The rule identifying exactly which requests use this pool.
`scope`	choice: each-place, shared	Required	Whether each cited place has separate counts or all covered jobs share one set.
`places-declared-in`	reference	Present when row scope is Each place.	For separate place counts, the rule identifying those places.
`place-assignment-declared-in`	reference	Present when row scope is Each place.	For separate place counts, the rule assigning each request to one place.
`working-limit-key`	reference	Required	The positive whole number of jobs that may occupy the working count.
`waiting-limit-key`	reference	Optional	The non-negative whole number that may remain waiting. Omission means no finite waiting limit.
`waiting-order`	choice: request-order, game-rule-order	Required	Whether room goes by request order or a cited total ordering rule.
`order-declared-in`	reference	Present when row waiting order is Game rule order.	The total ordering rule when game-rule order applies.
`releases-working-at`	choice: finished, delivered	Optional	The successful transition after whose report the working count is released. Omission means finished.

Standing orders

standing-orders

List retained repeat orders.

An empty list means: No request repeats automatically.

Each row is: id, work-limit, requests-job-declared-in, eligible-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this repeating order.
`work-limit`	string	Required	The work-limit row whose free room may create the job.
`requests-job-declared-in`	reference	Required	The job kind this row requests.
`eligible-declared-in`	reference	Required	The rule deciding whether another request may be created.

Failures

failures

List failures that may happen after acceptance.

An empty list means: Accepted and finished jobs do not fail.

Each row is: id, from-state, trigger-declared-in, result.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this failure, such as overcooked or storm-damage.
`from-state`	choice: waiting, working, stopped, finished	Required	The state from which this failure may happen.
`trigger-declared-in`	reference	Required	The rule giving the chance, condition, or event and any permitted loss.
`result`	choice: partial-inputs-or-work, job-ruined	Optional	A result for this failure. Omission uses the shared answer.

Cancellations

cancellations

List controls or events that may cancel an unfinished job.

An empty list means: An accepted job cannot be cancelled; a reviewer confirms this before the adoption relies on it.

Each row is: id, trigger-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name the cancellation in the game's words.
`trigger-declared-in`	reference	Required	The control or event that cancels the unfinished job.

Dependent cancellations

dependent-cancellations

List static links through which a later waiting job needs an earlier job's output.

An empty list means: No later waiting job has a static dependency on an earlier job's output.

Each row is: id, cancellation, link-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this dependency case.
`cancellation`	string	Required	The matching cancellation row.
`link-declared-in`	reference	Required	The static link from the later requirement to the earlier output.

Delivery cases

delivery-cases

List a real capacity or delivery condition not already carried by a collection, readmission, redelivery, or fallback row.

An empty list means: When every other delivery row set is also empty, delivery is automatic and the normal destination always accepts the output. A reviewer confirms both promises before the adoption relies on them.

Each row is: id, condition-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this delivery situation.
`condition-declared-in`	reference	Required	The capacity or collection rule that makes the situation relevant.

Output destinations

output-destinations

List fallback destinations after the normal destination, in the order tried.

An empty list means: No fallback destination follows the normal destination.

Each row is: id, destination-declared-in.

Every field

Field	Kind	When it appears	Meaning
`id`	string	Required	Name this fallback destination.
`destination-declared-in`	reference	Required	The rule naming the destination and how it accepts the whole output.

For builders

Exact mechanism wording and 66 pack tests

Exact mechanism wording

This is the single normative authority for states, event order, input claims, and reports. Questions describe choices used here; they do not redefine these steps.

A job run begins with one request and ends at rejection, cancellation, terminal failure, or delivery. Every report carries the same job id and run id. It also carries old and new lifecycle state, cause, recorded work before and after, input units newly claimed, released, spent, or lost, and the output destination when chosen. Amounts use units and numbers from the cited game rules. job-requested has no old state and sits outside the ordered instant batch. job-rejected ends the run but is not a lifecycle state. destination-refused is stateless: old and new state are both finished.

A claim makes inputs unavailable to every other rule while keeping their source known. Releasing a claim returns surviving units to that source. Spending or losing units removes them; neither can later be released.

The forward path is requested -> waiting -> started -> working -> finished -> delivered. Side paths are working -> stopped -> working, requested/waiting/working/stopped -> cancelled, and waiting/working/stopped/finished -> failed. A recoverable failure reports job-failed and lands in stopped instead.

Not every job visits every state. waiting and stopped can return to the forward path. cancelled, terminal failed, and delivered are terminal. started is a transition boundary, not a waiting state. Entry to any terminal state immediately releases every working or waiting count. releases-working-at affects only the success path and never delays terminal release.

Every stopped job records all active stop causes and its resume point. It resumes only after every cause clears. Finish-gate causes are output-full and inputs-unavailable-at-finish; they are slot-retaining. Every other cause is non-retaining. Entry to stopped always releases a waiting count. A stopped job retains its working count only while every active cause is slot-retaining; the first non-retaining cause releases it. partial-work applies once when the first ordinary stop cause joins the set, never for a finish-gate cause. failure-recovery is neither: it is non-retaining, and partial-work never applies to it, because step 16 has already settled the loss.

Whenever a pool has free working room, it first offers that room to admitted jobs eligible to start or resume, in the pool's waiting order. A job stopped by an instruction joins that order at the stop moment and never outranks the job that displaced it. A cleared reason also causes a waiting or stopped job to be offered free room again. After those offers, the pool scans standing orders in written order. It also scans when created, after a rejection of a request the pool did not create in this scan, and when cited eligibility becomes true. A scan keeps creating eligible requests until no row is eligible or no room remains. A scan may create more than one job from the same row, filling all free room. These are level-triggered scans, not one-time edges.

### Request and accept

1. Read job-declared-in once. It names required inputs, one successful output unit, any in-place target, and game-owned choice or quality rules. If work limits exist, assign the request to exactly one pool. For separate place counts, assign it to exactly one cited place. Report job-requested. 2. Check availability without reserving anything. For required inputs, test the full requirement under the three whole-claim timings. Under progress-based claiming, test only the initial rounded share. A game rule may require a stricter offer check. If the tested share is missing, report job-rejected with cause missing-inputs; claim nothing, record no work, and create no output. Jobs with no inputs skip the check. 3. Decide whether the request would enter waiting, including a free pool whose order places an earlier admitted job first. Waiting admission always consumes waiting capacity. If that limit is full, reject with cause job-limit-full. A request that starts immediately uses no waiting count. 4. Attempt admission. When room must be reserved before start, reserve the whole output atomically. If room is unavailable, the request stays requested; readmission-declared-in causes another attempt without polling. Recheck input and waiting limits on delayed admission. On admission, accept the request. Claim the full requirement in the same batch when inputs are taken at request. An admitted request that cannot start enters waiting; report job-waiting and every current reason. No work is recorded in waiting, and no input is claimed there except the claim made by taken-at-request.

### Start

5. Recheck every admission and start gate. Claim the full requirement under start timing. Under progress-based timing, claim the initial share. A failed claim enters waiting, consuming waiting capacity; if the waiting limit is full, reject with cause job-limit-full and release any output reservation. Otherwise report job-waiting with cause inputs-unavailable. Inputs taken at request are already held; inputs taken at finish remain at their source. 6. Keep any output reservation through delivery; other output answers reserve nothing. Leave the waiting count, acquire the working count, and report job-started. 7. Without a work-phase row, resolve start and finish in one batch. The reports stay ordered unless hold-undelivered, all-refused try-destinations, or on-collection legally parks the job in visible finished, or a finish-gate cause stops it there. With a work phase, enter working and report job-working.

### Work and input claims

8. Work completes as duration-declared-in says: its clock advances or its completion event occurs. Record exposed work points at full precision. A display meter is outside this contract. 9. With progress-based timing, every observable advance first claims the rounded share for the proposed work point. If unavailable, do not record the advance; stop with cause inputs-unavailable. Whole-claim timings keep their full claim. Finish timing keeps inputs available elsewhere. 10. Reaching the required work moves to the finish gate. It does not yet spend inputs or create the successful output.

### Stop, resume, and interrupt

11. An interruption is a temporary inability or instruction to advance that is not refusal, failure, cancellation, or delivery. It moves working -> stopped, adds its cause, applies partial-work and the claim policy, then reports job-stopped. An instructed stop must be named by interruptions-declared-in. A later cause joins the set and reports stopped -> stopped; it does not apply the work answer again. 12. First adjust a progress-based claim to any reduced work. Then apply stopped-claims: hold the claim, or release it to its source. Whole claims taken at request or start follow the same answer. Finish timing has no claim. When the question is not asked, the claim is held. 13. When every cause clears, the job competes for free working room through its pool, or proceeds without a pool. Recheck every gate and reclaim any released share. If a gate or claim is unavailable, remain stopped and keep the room free. Otherwise report job-resumed and return to the recorded resume point: a waiting-origin failure continues at step 5 and acquires the selected count at step 6, while interrupted work reacquires the count and enters working. The same job resumes; no new request is created. 14. The finish gate tests capacity and any finish-time claim together. The finish-gate wait answer adds output-full; an unavailable claim adds inputs-unavailable-at-finish. These causes preserve completed work and retain working room unless another active cause releases it. They never apply partial-work. stopped-claims applies to finish-gate stops exactly as in step 12. When every cause clears and any released claim is reclaimed, report job-resumed and return directly to the finish gate.

### Fail

15. A failure row may fire only from its named state. A failure from finished is always terminal; no recoverable result exists there. Resolve its row result, or the shared failure answer when the row has none, atomically. For a recoverable result, apply the stopped-claim policy before the one job-failed report. 16. A partial result may lose a strict subset of claimed inputs, reduce work without passing below none, or do both. It creates no successful output. Under progress-based timing, apply losses first. If the claim is held, reduce work to the highest point the surviving claim supports and release excess claim. If the claim was released, reduce work only by the named loss. The same job lands in stopped with cause failure-recovery; its recorded resume point is the start gate for a waiting-origin failure, the prior work point for a working failure, or the already-recorded point for a stopped failure. Later recovery follows the normal resume rule. 17. A ruined job enters terminal failed, can never finish as the same job, and creates no successful output. Failure from finished destroys its one undelivered new output. For in-place work, it ruins the transformation, not the target's existence. The cited failure rule owns the damaged state. Failure itself returns no claimed input; remaining claims stay assigned to the failed job unless the cited failure rule disposes of them. After cited claim changes, terminal entry releases every count and reports job-failed.

### Cancel

18. A declared cancellation may target requested, waiting, working, or stopped. Snapshot current claims, release every count, apply the return answer when asked, enter cancelled, and report job-cancelled. Under the reset answer, terminal work becomes none after the snapshot. Cancellation creates no output and never undoes a finished or delivered output. 19. Returning claimed inputs releases every surviving claimed unit. Returning nothing spends them. A rule-sized return releases exactly its named subset and spends the rest. No answer recreates a unit already lost, and unclaimed inputs remain where they are. 20. A dependency is the declared static link from a later waiting job's requirement to the cancelled job's output. Ending dependents finds every transitive later waiting job whose requirement can no longer be met. After the first cancellation settles, cancel those jobs in waiting order, each with its own claim settlement and report. Leaving dependents keeps them waiting. Completed intermediate jobs and delivered outputs remain.

### Finish and deliver

21. At the finish gate, finish-time timing tries to claim the full input. If unavailable, follow the finish-gate stop rule. Other timings must hold the required claim. Atomically spend inputs and establish the one successful output: a new thing or a cited target transformed in place. An in-place output is delivered by that state change at its site. A compound output is still one atomic delivery unit. Report job-finished. 22. Resolve capacity by the selected answer. An always-accepting destination takes the whole output. A pre-start reservation is already held. A finish-gate wait follows the stop rule. A held output remains one owned, inaccessible output until its cited retry. An ordered route tries the normal destination and then fallback rows. Every refusal by any destination, including a held output's first refusal and each refusal on a cited retry, reports destination-refused. If all refuse, keep the same output until the cited retry. Delivery never polls. An in-place output has no destination capacity: it is delivered by the state change of step 21, and the adoption answers never-full. 23. Automatic delivery moves an accepted result finished -> delivered immediately. Collection keeps it accessible at its chosen destination until the cited event, then moves it to delivered. Report job-delivered exactly once. 24. On success, release working room after the transition named by the pool row and after that transition's report. Then run the room-offer and standing-order process. Rejection ends its run; a later retry belongs to the requester unless a standing order creates it.

### Ordering guarantee

One transition, all claim changes, and all reports settle before another transition begins. Claim changes happen before the transition report unless a step says otherwise. Automatic delivery to an accepting destination after an instant start keeps job-started, job-finished, and job-delivered in one ordered batch with no outside event between them. Events offered at the same moment enter this lifecycle one at a time in the order supplied by Event resolution. This contract creates no same-moment ordering rule.

Verification pack

sha256:bfbe0f8482c06bd771e70af5afb44d53afad291161ea87d85f32021397ab2c3b

The format calls an adoption with its matching pack Checked: the tests travel with it, but a game has not necessarily passed them. Without the pack the adoption is Promised: the builder still owes the chosen behavior.

66 pack tests

Placeholders are filled from the adoption's answers, values, rows, and verification inputs.

reports identify their job run and state change

reports-identify-the-run

scenarioonce

Applies for every adoption

A request reads the rule cited at job-declared-in once, makes any pool and place assignment, and reports job-requested. Across the runs needed to reach every constructible report, every report in each run keeps that run's id and the same job id and records the cause, work, claim changes, and chosen destination. Every report except job-requested carries old and new state; job-requested carries a new state only. job-rejected is not a state; destination-refused is a finished-to-finished report.

Given: the set of Instance job runs needed to reach every transition and stateless report the adoption can construct
When: the report log is read in settlement order
Then: the request reads the rule cited at job-declared-in once, assigns exactly one pool and one cited place where those declarations exist, then reports job-requested
every report in each run carries that run's id and the same job id, plus cause, work before and after, units newly claimed, released, spent, or lost, and the destination when one is chosen
every report except job-requested carries old and new state; job-requested carries a new state only and sits outside any ordered instant batch
job-rejected ends the run without becoming a lifecycle state, and destination-refused has old and new state both finished
Diagnostics: Instance-job-rule-read-log
Instance-report-log
Instance-state-trace
Instance-work-before-after
Instance-claim-ledger

claims preserve ownership and settle once

claims-keep-their-source

scenarioonce

Applies for every adoption

A claim makes its units unavailable everywhere else but keeps their source known. Release returns surviving units there. Spending and loss remove units, so neither kind can later be released. A no-input adoption has no claim event to assert.

Given: each claim, release, spend, and loss that a run of Instance can construct; a no-input adoption has an empty claim ledger here
When: another rule tries to use a claimed unit and the run later settles that unit
Then: the claimed unit is unavailable to every other rule while its source remains recorded
release returns each surviving unit to that source
spending or losing removes the unit, and no removed unit is later released
Diagnostics: Instance-claim-ledger
Instance-source-record
Instance-usable-inputs

a request with a missing tested share is rejected cleanly

exact-inputs-required

scenarioonce

Applies when Job inputs is Required inputs.

A request cannot pass with less than its tested share. Whole-claim timings test the full requirement. For progress claiming, both gates test at least the initial rounded share and never the full requirement by default; a stricter offer check named by the rule cited at job-declared-in may test more, and the test reads that rule to decide. Rejection claims nothing, records no work, and creates no output.

Given: a request for Instance with less than the tested input share available — the full requirement for a whole-claim timing; for progress claiming both gates test at least the initial rounded share and never the full requirement by default, while a stricter offer check named by the rule cited at job-declared-in may test more, and the test reads that rule to decide
When: the availability check runs without reserving inputs
Then: job-rejected reports cause missing-inputs and ends the run
no input is claimed, no work is recorded, and no output is created
Diagnostics: Instance-report-log
Instance-claim-ledger
Instance-work-before-after
Instance-output-identity

a no-input job skips the input check

no-input-check-is-empty

scenarioonce

Applies when Job inputs is No inputs.

This job needs no input, so its input check and every input settlement are empty. Pool, place, capacity, and other admission gates still apply.

Given: an otherwise eligible Instance request
When: the request reaches its availability check
Then: the input check is skipped and the claim, release, spend, and loss fields remain empty
non-input admission gates still decide whether the request is admitted
Diagnostics: Instance-admission-trace
Instance-claim-ledger

request-time inputs are claimed at admission

request-time-claim-is-atomic

scenarioonce

Applies when Input claim timing is Taken at request.

In each constructible admission shape, the whole requirement is claimed in one batch before job-started and, where the job waits, before job-waiting. An adoption with no waiting shape asserts only the immediate-start case.

Given: each admission shape Instance can construct, the waiting shape asserted only where one exists
When: each constructible admission runs
Then: the full requirement is claimed atomically in the admission batch
the claim precedes job-started in the report order, and where the job waits, precedes job-waiting
no partial claim is observable
Diagnostics: Instance-admission-trace
Instance-claim-ledger
Instance-report-order

Row.id accounts for waiting admission

waiting-admission-uses-pool-capacity

scenarioper work-limits row

Applies for every adoption

Pool Row.id is selected under Row.covers declared in. Waiting admission consumes its waiting capacity; an immediate start does not. Where the row declares a waiting limit, reaching it makes the next would-wait request reject with job-limit-full. With no waiting limit, this pool's waiting count never causes job-limit-full. This test names the address and restates nothing from it.

Given: requests assigned to pool Row.id, including one that can start immediately and one that would wait; where this pool declares a waiting limit, also fill that limit
When: each request reaches admission under the coverage rule cited at Row.covers declared in
Then: an admitted waiting request consumes one waiting count, while an immediate start consumes none
where the pool declares a waiting limit, a request that would exceed it reports job-rejected with cause job-limit-full
where the row declares no waiting limit, no request is ever rejected with job-limit-full by this pool's waiting count
Diagnostics: Instance-count-trace
Instance-report-log
Instance-pool-assignment

Row.id is legal exactly for pre-start reservation

readmission-event-pairs-with-reservation

scenarioper readmission-events row

Applies for every adoption

Row Row.id is legal exactly when output-full is wait-before-start. Under that answer, the lifecycle consults the rule cited at Row.readmission declared in. A row under another answer is a defect this test fails by construction. The test names the address and restates nothing from it.

Given: readmission-events row Row.id in the adoption
When: the output-full answer is checked
Then: the row is legal only under wait-before-start; its presence under any other answer fails this test by construction
the lifecycle consults the rule cited at Row.readmission declared in under that answer
Diagnostics: Instance-admission-trace
Instance-event-log

pre-start reservation declares a readmission event

reservation-needs-a-readmission-event

scenarioonce

Applies when Output full is Wait before start.

An adoption answering wait-before-start declares at least one readmission-events row. An adoption with none fails this test by construction.

Given: an adoption answering wait-before-start
When: its readmission-events rows are inspected
Then: the adoption declares at least one readmission-events row, and an adoption with none fails this test by construction
Diagnostics: Instance-declaration-record

waiting records reasons but no work

waiting-records-every-current-reason

scenarioonce

Applies for every adoption

Each waiting shape this adoption can construct reports every current reason and records no work. Only the taken-at-request answer can already hold an input claim there; an adoption with no waiting shape has no assertion in this test.

Given: each admitted Instance request that the adoption can construct with one or more reasons it cannot start; an adoption that constructs none asserts nothing here
When: the admitted request enters waiting
Then: job-waiting reports every current reason
no work is recorded and no input is claimed in waiting except an already-required request-time claim
Diagnostics: Instance-report-log
Instance-state-trace
Instance-claim-ledger

start-time inputs are claimed before start

start-time-claim-is-atomic

scenarioonce

Applies when Input claim timing is Taken at start.

The full requirement is claimed atomically at the start gate. If it cannot be claimed, the job waits with inputs-unavailable; if a declared waiting limit is full, it rejects with job-limit-full and releases any output reservation.

Given: an admitted Instance job at its start gate
When: the full requirement is available, then in a second run is unavailable
Then: the available run claims the full requirement atomically before job-started
the unavailable run enters waiting with cause inputs-unavailable, or rejects with job-limit-full where its full waiting limit prevents admission, releasing any output reservation on rejection
Diagnostics: Instance-claim-ledger
Instance-report-log
Instance-reservation-ledger

finish-time inputs remain usable before the finish gate

finish-time-inputs-stay-at-source

scenarioonce

Applies when Input claim timing is Taken at finish.

Before the finish gate, all required inputs remain at their source and available to other rules.

Given: an admitted Instance job before its finish gate
When: the job waits, starts, and records every pre-finish work point it can construct
Then: the full required inputs remain at their source and no pre-finish claim exists
Diagnostics: Instance-claim-ledger
Instance-usable-inputs

progress claiming begins with the initial share

progress-claim-starts-with-rounded-share

scenarioonce

Applies when Input claim timing is With progress.

The request and start gates test at least the initial rounded share and never the full requirement by default. A stricter offer check named by the rule cited at job-declared-in may test more, and the test reads that rule to decide. Start claims the required share before reporting job-started.

Given: a request and start for Instance whose initial rounded share can be observed
When: the request check and then the start gate run
Then: both gates test at least the initial rounded share and never the full requirement by default; a stricter offer check named by the rule cited at job-declared-in may test more, and the test reads that rule to decide
start claims that share before job-started, and an unavailable share follows the start-time waiting or rejection rule
Diagnostics: Instance-claim-ledger
Instance-report-log

start exchanges waiting room for working room

start-counts-settle-before-report

scenarioonce

Applies for every adoption

At job-started, the job has left any waiting count and acquired any selected working count. No job rests in started; it is a transition boundary. A pre-start output reservation remains held. Shapes this adoption cannot construct add no assertion.

Given: each admitted Instance job that can start, with and without a pool where those shapes exist
When: the job crosses the start boundary
Then: any waiting count is left and any selected working count is acquired before job-started
an output reservation, where the selected answer created one, remains held through delivery
no job is ever observed resting in started; it is a transition boundary
Diagnostics: Instance-count-trace
Instance-reservation-ledger
Instance-report-log

Row.id enters working and reaches the finish gate

work-phase-enters-working

scenarioper work-phases row

Applies for every adoption

Work phase Row.id enters working, reports job-working, and completes as Row.duration declared in says. Work is recorded at full precision. Reaching the required amount reaches the finish gate but does not spend inputs or create output. The test names the address and restates nothing from it.

Given: a started Instance job using work phase Row.id
When: the job enters working and completes as Row.duration declared in says
Then: job-working reports entry to working
exposed work points use full precision and any display meter remains outside this contract
reaching required work moves to the finish gate without yet spending inputs or creating output
Diagnostics: Instance-state-trace
Instance-work-before-after
Instance-claim-ledger
Instance-output-identity

a job without work settles start and finish together

instant-start-settles-finish-in-one-batch

scenarioonce

Applies for every adoption

With no work phase, start and finish settle in one batch unless hold-undelivered, an all-refused try-destinations route, or on-collection parks the job in visible finished, or a finish-gate cause stops it at the gate: an unavailable finish-time claim or a wait-until-space capacity wait. An adoption with a work phase has no assertion here.

Given: the absence case: if Instance has no work-phases row, a request that passes its gates; if it has a work phase, this template asserts nothing
When: the job starts
Then: start and finish settle in one ordered batch
the ordered batch ends early only when hold-undelivered, an all-refused try-destinations route, or on-collection parks the job in visible finished, or a finish-gate cause stops it at the gate: an unavailable finish-time claim or a wait-until-space capacity wait
Diagnostics: Instance-report-log
Instance-state-trace

a job without work does not stop before finish

no-stop-before-the-finish-gate

scenarioonce

Applies for every adoption

An adoption with no work-phases row records no partial work and never enters stopped for an interruption of work before its finish gate. A recoverable failure while waiting is a failure, not an interruption: it lands in stopped under step 16 with the start gate as its resume point. An adoption with a work phase asserts nothing here.

Given: the absence case where Instance has no work-phases row; an adoption with a work phase asserts nothing here
When: an admitted job advances to its finish gate
Then: no partial work is recorded
the job never enters stopped for an interruption of work before its finish gate; a recoverable failure while waiting lands in stopped under step 16 with the start gate as its resume point
Diagnostics: Instance-work-before-after
Instance-state-trace

Row.id is legal exactly for progress claiming

progress-rounding-rule-pairs-with-progress

scenarioper progress-rounding-rules row

Applies for every adoption

Row Row.id is legal exactly when input-claim-timing is with-progress. Under that answer, the lifecycle consults the rule cited at Row.progress rounding declared in. A row under another answer is a defect this test fails by construction. The test names the address and restates nothing from it.

Given: progress-rounding-rules row Row.id in the adoption
When: the input-claim-timing answer is checked
Then: the row is legal only under with-progress; its presence under any other answer fails this test by construction
the lifecycle consults the rule cited at Row.progress rounding declared in under that answer
Diagnostics: Instance-claim-ledger
Instance-work-before-after

progress claiming declares a rounding rule

progress-needs-a-rounding-rule

scenarioonce

Applies when Input claim timing is With progress.

An adoption answering with-progress declares at least one progress-rounding-rules row. An adoption with none fails this test by construction.

Given: an adoption answering with-progress
When: its progress-rounding-rules rows are inspected
Then: the adoption declares at least one progress-rounding-rules row, and an adoption with none fails this test by construction
Diagnostics: Instance-declaration-record

Row.id records an ordinary stop once

declared-interruption-stops-once

scenarioper interruptions row

Applies for every adoption

Instruction Row.id is allowed by Row.interruptions declared in. A row without a work phase is a defect this test fails by construction. Entry to stopped records every active cause and its resume point, releases any waiting count the adoption's pool gives it (an adoption with no work-limits row has none), and applies the work and claim answers once before job-stopped; a later cause reports stopped to stopped without applying the work answer again. The test names the address and restates nothing from it.

Given: a working Instance job and the instruction allowed by Row.interruptions declared in; an interruptions row in an adoption with no work-phases row is a defect this test fails by construction
When: Row.id adds the first ordinary cause and a second cause later joins while the job is stopped
Then: the first cause moves working to stopped, records every active cause and its resume point, applies partial-work and the claim policy once, releases any waiting count the adoption's pool gives it, then reports job-stopped
the later cause reports stopped to stopped and does not apply the work answer again
Diagnostics: Instance-state-trace
Instance-stop-causes
Instance-work-before-after
Instance-report-log

only named instructions can stop work

unnamed-instructions-cannot-stop

scenarioonce

Applies for every adoption

An instruction absent from every interruptions row is not an allowed stop. With an empty list, stops arise only from lifecycle inability. An adoption with no working state, or no unnamed instruction, asserts nothing here.

Given: each instruction this adoption can construct that is absent from all interruptions rows; an adoption with no working state, or no unnamed instruction, asserts nothing here
When: the instruction is offered to a Instance job in working, where that state exists
Then: the instruction does not add a stop cause and does not report job-stopped
Diagnostics: Instance-stop-causes
Instance-report-log

an ordinary stop preserves recorded work

kept-work-stays-with-the-job

scenarioonce

Applies when Partial work is Keep with job.

The same job keeps all recorded work through an ordinary stop and resumes from that amount; the work is never transferred to another job. An adoption that can construct no ordinary stop asserts nothing here, and a finish-gate stop never applies this answer.

Given: each Instance job with recorded work that the adoption can drive to a first ordinary stop; an adoption that can construct no ordinary stop asserts nothing here, and a finish-gate stop never applies this answer
When: the stop settles and that same job later resumes
Then: the same job retains the same recorded amount through the stop and resumes from it
no other job receives that work
Diagnostics: Instance-work-before-after
Instance-run-id-trace

Row.id is legal exactly for reversing stopped work

reversal-rule-pairs-with-reversing-work

scenarioper reversal-rules row

Applies for every adoption

Row Row.id is legal exactly when partial-work is reverse-while-stopped. Under that answer, the lifecycle consults the rule cited at Row.reversal declared in: recorded work decreases while the job is stopped as that rule says and never passes below no work. A row under another answer is a defect this test fails by construction. The test names the address and restates nothing from it.

Given: reversal-rules row Row.id in the adoption
When: the partial-work answer is checked
Then: the row is legal only under reverse-while-stopped; its presence under any other answer fails this test by construction
the lifecycle consults the rule cited at Row.reversal declared in under that answer
under that answer recorded work decreases while the job is stopped as the cited rule says and never passes below no work
Diagnostics: Instance-reversal-log

reversing stopped work declares a reversal rule

reversing-work-needs-a-reversal-rule

scenarioonce

Applies when Partial work is Reverse while stopped.

An adoption answering reverse-while-stopped declares at least one reversal-rules row. An adoption with none fails this test by construction.

Given: an adoption answering reverse-while-stopped
When: its reversal-rules rows are inspected
Then: the adoption declares at least one reversal-rules row, and an adoption with none fails this test by construction
Diagnostics: Instance-declaration-record

an ordinary stop resets recorded work

reset-work-clears-on-ordinary-stop

scenarioonce

Applies when Partial work is Reset at stop.

Each first ordinary stop this adoption can construct resets recorded work to none. Where cancellation exists, it first snapshots the claim and leaves no terminal work. A recoverable failure is not an ordinary stop and does not reset work here; step 16 alone settles its loss.

Given: each Instance job with recorded work that can reach a first ordinary stop, and each separate cancellable run the adoption can construct
When: each available ordinary stop settles and, separately where cancellation is constructible, cancellation occurs
Then: the ordinary stop records no work
where cancellation is constructible, its claim snapshot is taken before terminal work becomes none, and no terminal work remains after cancellation
Diagnostics: Instance-work-before-after
Instance-claim-snapshot
Instance-state-trace

a stopped job keeps its current claim

stopped-job-holds-claim

scenarioonce

Applies when Stopped claims is Hold.

Where stopped work reverses, claim changes caused by the decrease settle through this stopped-claims step. A whole claim taken at request or start then follows hold exactly as a progress claim does, after any progress claim is first reduced to the recorded work. The adjusted claim remains assigned to the job.

Given: each Instance stop the adoption can construct with a current claim; an adoption with no such stop asserts nothing here
When: any work decrease and progress-based claim adjustment settle and the stop remains active
Then: where reverse-while-stopped applies, claim changes caused by the decrease settle through the stopped-claims step
a whole claim taken at request or at start follows this answer exactly as a progress claim does, after any progress claim is first reduced to the recorded work
the adjusted current claim stays assigned to the job and unavailable elsewhere until another lifecycle step settles it
Diagnostics: Instance-claim-ledger
Instance-stop-causes

a stopped job releases and must reclaim inputs

stopped-job-releases-and-reclaims

scenarioonce

Applies when Stopped claims is Release and reclaim.

Where stopped work reverses, claim changes caused by the decrease settle through this stopped-claims step. A whole claim taken at request or start then follows release-and-reclaim exactly as a progress claim does, after any progress claim is first reduced to the recorded work. Resume must reclaim the required share; if it cannot, the same job stays stopped and leaves the room free.

Given: each Instance stop the adoption can construct with a current claim; an adoption with no such stop asserts nothing here
When: any work decrease and progress-based claim adjustment settle, then all causes clear once with the required share available and once without it
Then: where reverse-while-stopped applies, claim changes caused by the decrease settle through the stopped-claims step
a whole claim taken at request or at start follows this answer exactly as a progress claim does, after any progress claim is first reduced to the recorded work
the adjusted claim is released while stopped
the available run reclaims the required share before job-resumed, while the unavailable run remains stopped and leaves working room free
Diagnostics: Instance-claim-ledger
Instance-state-trace
Instance-count-trace

the same job resumes only after every cause clears

resume-waits-for-every-cause

scenarioonce

Applies for every adoption

The same job resumes only after every active cause clears and every gate passes. It competes for room through its pool where the adoption declares one, and otherwise proceeds without a pool. If a gate or claim is unavailable, it remains stopped and keeps the room free; on success it reports job-resumed and returns to its recorded resume point without creating another request.

Given: each stopped Instance shape the adoption can construct, including overlapping causes where constructible
When: causes clear one at a time and the last cause clears
Then: no resume occurs while a cause remains
after the last cause clears, the same job rechecks gates and competes for room through its pool where the adoption declares one, and otherwise proceeds without a pool; it reports job-resumed only on success and creates no new request
if a gate or claim is unavailable, the job remains stopped and keeps the room free
an interrupted-work resume returns to its recorded work point, while a waiting-origin recoverable failure returns to the start gate
Diagnostics: Instance-stop-causes
Instance-resume-point
Instance-run-id-trace
Instance-report-log

an unasked stopped-claim choice defaults to hold

unasked-stopped-claim-answer-holds

scenarioonce

Applies for every adoption

Where stopped-claims was not asked, a request-time claim held by a job stopped from waiting or by a finish-gate cause remains assigned after any progress adjustment. An adoption with an explicit answer, or without that live shape, has no assertion here.

Given: each Instance request-time claim held while its job is stopped from waiting or by a finish-gate cause and stopped-claims was not asked; an adoption with an answer or no such claim asserts nothing here
When: the stop settles
Then: the current claim remains assigned to the stopped job after any progress-based adjustment
Diagnostics: Instance-claim-ledger
Instance-stop-causes

a full destination stops at the finish gate

finish-gate-wait-retains-completed-work

scenarioonce

Applies when Output full is Wait until space.

A full destination adds the slot-retaining output-full cause at the finish gate, work phase or not. Completed work and working room remain; partial-work does not apply; resume returns directly to the finish gate. An instant job stops there too, and its one batch ends at that gate.

Given: a job in Instance with completed work, or an instant job at the finish gate of its one batch, and no room for the whole output
When: the finish gate first blocks and later gains room
Then: the job stops with slot-retaining cause output-full, preserves completed work, retains its working count while every active cause is slot-retaining, and does not apply partial-work
the first active non-retaining cause releases the working count, and no successful output is established while output-full remains
where a current claim exists, the explicit stopped-claims answer applies; if that question was not asked, the claim is held
when every cause clears it reports job-resumed and returns directly to the finish gate without repeating work
Diagnostics: Instance-state-trace
Instance-work-before-after
Instance-count-trace
Instance-report-log

an unavailable finish claim stops at the gate

finish-claim-wait-is-slot-retaining

scenarioonce

Applies when Input claim timing is Taken at finish.

A missing finish-time claim adds inputs-unavailable-at-finish. It retains the slot and completed work, never applies partial-work, and returns directly to the finish gate after the claim succeeds. An adoption that always has its inputs at the gate constructs no wait and asserts nothing here.

Given: a job in Instance at the finish gate without its full required input; an adoption that always has its inputs at the gate constructs no wait and asserts nothing here
When: the claim fails and later becomes available
Then: the job stops with slot-retaining cause inputs-unavailable-at-finish, preserves completed work, retains any working count while every active cause is slot-retaining, and does not apply partial-work
the first active non-retaining cause releases the working count
any other current claim follows the explicit stopped-claims answer, or is held when that question was not asked
after every cause clears it claims the full requirement, reports job-resumed, and returns directly to the finish gate
Diagnostics: Instance-claim-ledger
Instance-state-trace
Instance-count-trace

Row.id offers and releases room in lifecycle order

work-limit-offers-room-and-releases-counts

scenarioper work-limits row

Applies for every adoption

Pool Row.id uses working limit Row.working limit key. It offers free room to admitted jobs before scanning standing orders. Terminal entry releases every count immediately. On success, finished or omission releases after job-finished; delivered releases after job-delivered. The cited coverage and limit rules are at Row.covers declared in and Row.working limit key; this test restates neither.

Given: pool Row.id at its working limit Row.working limit key, with admitted jobs eligible to start or resume and active jobs driven through each success or terminal side path the adoption can construct
When: room becomes free, a reason clears, a terminal state is entered, and a successful job reaches the transition this row selects
Then: free room is offered first to admitted eligible jobs in the pool's waiting order, and a cleared reason re-offers room
where the adoption declares an interruption, a job stopped by instruction is ordered at its stop moment and never outranks the job that displaced it
entry to cancelled, terminal failed, or delivered releases every count immediately
on success, releases-working-at finished releases after finished and job-finished, releases-working-at delivered releases after delivered and job-delivered, and omission follows finished; room offers and standing-order scans then run
Diagnostics: Instance-count-trace
Instance-pool-offer-log
Instance-report-log
Instance-standing-order-scan-log

Row.id releases working room after finish

pool-releases-at-finished

scenarioper work-limits row

Applies when row releases working at is Finished.

Pool Row.id declares release at finished. The working count is released after job-finished, and the room offer and standing-order scan run after that report.

Given: a successful Instance job in pool Row.id reaching finished
When: job-finished is reported
Then: the working count is released after job-finished
the room offer and standing-order scan run after that report
Diagnostics: Instance-count-trace
Instance-pool-offer-log
Instance-standing-order-scan-log
Instance-report-log

Row.id releases working room after delivery

pool-releases-at-delivered

scenarioper work-limits row

Applies when row releases working at is Delivered.

Pool Row.id declares release at delivered. The working count is released after job-delivered, and the room offer and standing-order scan run after that report.

Given: a successful Instance job in pool Row.id reaching delivered
When: job-delivered is reported
Then: the working count is released after job-delivered
the room offer and standing-order scan run after that report
Diagnostics: Instance-count-trace
Instance-pool-offer-log
Instance-standing-order-scan-log
Instance-report-log

Row.id keeps separate counts per place

each-place-pool-assigns-one-place

scenarioper work-limits row

Applies when row scope is Each place.

Pool Row.id keeps separate counts for the places at Row.places declared in and assigns each request through Row.place assignment declared in. Each request uses exactly one place. The test names the addresses and restates nothing from them.

Given: two places from Row.places declared in and requests covered by Row.covers declared in
When: Row.place assignment declared in assigns each request
Then: every request belongs to exactly one cited place and consumes only that place's working and waiting counts
free room at one place does not change another place's counts
Diagnostics: Instance-pool-assignment
Instance-count-trace

Row.id shares one count

shared-pool-uses-one-count

scenarioper work-limits row

Applies when row scope is Shared.

Every request covered by Row.covers declared in uses the one shared count in pool Row.id. The test names the address and restates nothing from it.

Given: requests covered by Row.covers declared in from every place the adoption can construct
When: the requests enter pool Row.id
Then: all requests consume the same shared working and waiting counts
Diagnostics: Instance-pool-assignment
Instance-count-trace

Row.id offers room in request order

request-order-pool-offers-in-admission-order

scenarioper work-limits row

Applies when row waiting order is Request order.

Pool Row.id offers room to eligible jobs in request order. A request enters waiting even with free room when an earlier admitted job is first.

Given: two eligible admitted jobs in pool Row.id with a known admission order
When: one working place becomes free
Then: the earlier admitted eligible job receives the first offer
a request whose pool has free room still enters waiting when the pool's order places an earlier admitted job first
Diagnostics: Instance-pool-offer-log
Instance-waiting-order-record

Row.id offers room in its cited order

game-rule-pool-offers-in-cited-order

scenarioper work-limits row

Applies when row waiting order is Game rule order.

Pool Row.id follows the order named by Row.order declared in, subject to the stop-moment rule that a displaced job never outranks its displacer. A request enters waiting even with free room when that order places an earlier admitted job first. The test names the address and restates nothing from it.

Given: two eligible admitted jobs in pool Row.id whose order can be distinguished by Row.order declared in
When: one working place becomes free
Then: offers follow the order named by Row.order declared in, subject to the stop-moment rule that a displaced job never outranks its displacer
a request whose pool has free room still enters waiting when the pool's order places an earlier admitted job first
Diagnostics: Instance-pool-offer-log
Instance-waiting-order-record

without a pool every ready job starts

no-pool-means-every-ready-job-starts

scenarioonce

Applies for every adoption

An adoption with no work-limits row starts every otherwise-ready job and never reports job-waiting with a pool cause. An adoption with pools asserts nothing here.

Given: the absence case where Instance has no work-limits row; an adoption with pools asserts nothing here
When: an otherwise-ready job reaches its start gate
Then: every otherwise-ready job starts
no job reports job-waiting with a pool cause
Diagnostics: Instance-state-trace
Instance-report-log

Row.id is scanned in written order until room is filled

standing-order-scans-are-level-triggered

scenarioper standing-orders row

Applies for every adoption

Standing order Row.id belongs to Row.work limit. After room offers, scans consult Row.eligible declared in in written order and can create repeated requests from Row.requests job declared in until eligibility or room ends. Scans also run at pool creation, when eligibility becomes true, and after the specified outside rejection. The test names the addresses and restates nothing from them.

Given: standing order Row.id attached to pool Row.work limit, with its cited eligibility false and then true and enough room for more than one job
When: the pool is created, finishes room offers, observes eligibility become true, and later receives a rejected request that this scan did not create
Then: each scan considers rows in written order after room offers and consults Row.eligible declared in
while this row remains eligible, one scan can create more than one request named by Row.requests job declared in until no row is eligible or no room remains
creation of the pool, fresh eligibility, and the stated rejection each cause a scan; the row remains for later scans
Diagnostics: Instance-standing-order-scan-log
Instance-request-log
Instance-count-trace

Row.id is read before the adoption is trusted

read-first-note-precedes-verification

scenarioper read-first row

Applies for every adoption

Before trusting this adoption, the reviewer reads Row.read first for note Row.id. This test names the address and restates nothing from it.

Given: review of the Instance adoption
When: the reviewer begins lifecycle verification
Then: the reviewer reads Row.read first before accepting results that depend on it
Diagnostics: Instance-review-record

Row.id resolves only from Row.from state

failure-row-fires-from-its-state

scenarioper failures row

Applies for every adoption

Failure Row.id can fire only from Row.from state under Row.trigger declared in and reports job-failed once. A row that declares its own result is governed by that result's own test below; this test asserts only the firing state and report for such a row. For a row that omits result, Bind shared result. A failure from finished is always terminal; a row from finished that resolves to a recoverable result is a defect this test fails by construction. The test names the address and restates nothing from it.

Given: Instance job runs in Row.from state and in each other reachable state where the adoption can offer failure Row.id through Row.trigger declared in
When: the trigger is offered in each state
Then: the failure fires only from Row.from state, resolves atomically, and reports job-failed once
a row that declares its own result is governed by that result's own test below; this test asserts only the firing state and the report for such a row
for a row that omits result, Bind shared result
where Row.from state is finished, the resolved result is job-ruined; a recoverable result from finished is a defect this test fails by construction
Diagnostics: Instance-failure-log
Instance-state-trace
Instance-claim-ledger
Instance-resume-point
Instance-output-identity

Row.id applies its recoverable result

failure-row-result-recoverable

scenarioper failures row

Applies when row result is Partial inputs or work.

Failure Row.id declares a recoverable result. It settles losses, creates no successful output, releases any waiting count, stops the same job with cause failure-recovery, and reports job-failed once. Under reset-at-stop the work answer does not apply: a recoverable failure is not an ordinary stop, and step 16 alone settles the loss. The resume point is the start gate from waiting, the prior work point from working, or the already-recorded point from stopped. A recoverable result from finished is a defect this test fails by construction.

Given: failure Row.id resolving from Row.from state under Row.trigger declared in with its declared recoverable result
When: the failure settles
Then: every named input loss is a strict subset of the current claim, work never falls below none, and the failure creates no successful output; under reset-at-stop the work answer does not apply, because a recoverable failure is not an ordinary stop
any waiting count is released, and the same job stops with cause failure-recovery and one job-failed report after claim settlement
the resume point is the start gate from waiting, the prior work point from working, or the already-recorded point from stopped; a recoverable result from finished is a defect this test fails by construction
Diagnostics: Instance-failure-log
Instance-state-trace
Instance-claim-ledger
Instance-resume-point
Instance-output-identity

Row.id applies its ruined result

failure-row-result-ruined

scenarioper failures row

Applies when row result is Job ruined.

Failure Row.id declares a ruined result. Cited claim changes settle first, terminal entry releases every count next, and job-failed follows. The job is terminal and creates no new successful output. The damaged state belongs to Row.trigger declared in; this test reads that rule only to confirm the job is terminal.

Given: failure Row.id resolving from Row.from state under Row.trigger declared in with its declared ruined result
When: the failure settles
Then: cited claim changes settle first, then terminal entry releases every count, then job-failed
the job enters terminal failed, creates no new successful output, returns no claim by failure, and keeps remaining claims assigned unless the cited rule disposes of them
where the job row declares new-thing and failure starts from finished, the undelivered output is destroyed; where it declares in-place, the transformation is ruined but the target still exists
the damaged state is owned by the rule at Row.trigger declared in and this test reads it only to confirm the job is terminal
Diagnostics: Instance-failure-log
Instance-state-trace
Instance-claim-ledger
Instance-count-trace
Instance-report-log
Instance-output-identity

Row.id settles progress claims after failure loss

progress-failure-adjusts-claim-after-loss

scenarioper failures row

Applies when Input claim timing is With progress.

For each recoverable Row.id outcome that changes inputs or work, progress-based settlement applies losses first. A held claim caps work at the highest supported point and releases excess; a released claim reduces work only by the named loss. Ruined outcomes add no assertion. The cited rule is Row.trigger declared in; this test restates nothing from it.

Given: each recoverable Row.id outcome the cited rule can construct with an input loss or work reduction; ruined outcomes assert nothing here
When: Row.trigger declared in resolves the failure with the stopped claim held in one run and released in another
Then: losses settle first
with a held claim, work is reduced to the highest point the surviving claim supports and excess claim is released
with a released claim, work is reduced only by the named loss
Diagnostics: Instance-claim-ledger
Instance-work-before-after

accepted jobs do not fail without a declared failure

no-failure-without-a-failure-row

scenarioonce

Applies for every adoption

An adoption with no failures row never reports job-failed from an accepted or finished job. An adoption with a failure row asserts nothing here.

Given: the absence case where Instance has no failures row; an adoption with a failure row asserts nothing here
When: accepted and finished jobs are observed
Then: no accepted or finished job reports job-failed
Diagnostics: Instance-report-log

Row.id snapshots and cancels one job

declared-cancellation-settles-one-job

scenarioper cancellations row

Applies for every adoption

Cancellation Row.id is legal from requested, waiting, working, and stopped where those states exist. It snapshots claims, releases counts, Bind return result, enters cancelled, and reports job-cancelled. It never recreates lost units or undoes finished output. Where this adoption declares no dependent-cancellations row, every later waiting job stays in place. The trigger is cited at Row.trigger declared in; this test restates nothing from it.

Given: Instance jobs in each of requested, waiting, working, and stopped that the adoption can construct, with cancellation Row.id offered through Row.trigger declared in
When: each legal cancellation settles
Then: the current claim is snapshotted before settlement, every count is released, the answer Bind return result, and the job enters cancelled before job-cancelled
no answer returns more than the current claim, recreates a lost unit, or moves an unclaimed input
cancellation creates no output and never undoes a finished or delivered output
where this adoption declares no dependent-cancellations row, every later waiting job stays in place
Diagnostics: Instance-claim-snapshot
Instance-claim-ledger
Instance-count-trace
Instance-report-log

Row.id is legal exactly for rule-sized cancellation return

cancel-return-rule-pairs-with-rule-sized-return

scenarioper cancel-return-rules row

Applies for every adoption

Row Row.id is legal exactly when cancel-return is return-by-rule. Under that answer, the lifecycle consults the rule cited at Row.cancel return declared in. A row under another answer is a defect this test fails by construction. The test names the address and restates nothing from it.

Given: cancel-return-rules row Row.id in the adoption
When: the cancel-return answer is checked
Then: the row is legal only under return-by-rule; its presence under any other answer fails this test by construction
the lifecycle consults the rule cited at Row.cancel return declared in under that answer
Diagnostics: Instance-claim-snapshot
Instance-claim-ledger

rule-sized cancellation return declares a return rule

rule-sized-return-needs-a-return-rule

scenarioonce

Applies when Cancel return is Return by rule.

An adoption answering return-by-rule declares at least one cancel-return-rules row. An adoption with none fails this test by construction.

Given: an adoption answering return-by-rule
When: its cancel-return-rules rows are inspected
Then: the adoption declares at least one cancel-return-rules row, and an adoption with none fails this test by construction
Diagnostics: Instance-declaration-record

accepted jobs cannot be cancelled without a declared cancellation

no-cancellation-without-a-cancellation-row

scenarioonce

Applies for every adoption

An adoption with no cancellations row never reports job-cancelled, and a reviewer confirms that promise before the adoption relies on it. An adoption with a cancellation row asserts nothing here.

Given: the absence case where Instance has no cancellations row; an adoption with a cancellation row asserts nothing here
When: accepted jobs are observed and the adoption prepares to rely on this promise
Then: no accepted job reports job-cancelled
Diagnostics: Instance-report-log
Instance-review-record

Row.id settles later dependent jobs

dependent-cancellation-follows-answer

scenarioper dependent-cancellations row

Applies for every adoption

For dependency Row.id after cancellation Row.cancellation, the adoption Bind dependent result. Completed intermediate jobs and delivered outputs remain. The link is cited at Row.link declared in; this test restates nothing from it.

Given: cancellation Row.cancellation and later waiting jobs connected by the static dependency at Row.link declared in
When: the earlier job is cancelled before producing the required output
Then: the adoption Bind dependent result
completed intermediate jobs and delivered outputs remain
Diagnostics: Instance-dependency-trace
Instance-waiting-order-record
Instance-claim-ledger
Instance-report-log

the finish gate commits inputs and one output atomically

finish-spends-and-establishes-one-output

scenarioonce

Applies for every adoption

At the finish gate, required claims are spent and one successful output is established in the same commit before job-finished. A compound result is still one unit. For an in-place job, the state change at the site is the delivery; it has no destination capacity and answers never-full. A new thing follows the selected delivery path.

Given: a job in Instance at the finish gate with every required claim and capacity gate satisfied
When: the job finishes
Then: required claims are spent and exactly one successful output is established atomically before job-finished
a compound output remains one delivery unit
where the job row declares in-place, the state change at the site is the in-place delivery; an in-place output has no destination capacity, so the adoption answers never-full and no capacity branch is taken; where it declares new-thing, the one output follows the selected delivery rules
Diagnostics: Instance-claim-ledger
Instance-output-identity
Instance-state-trace
Instance-report-log

Row.id invokes the selected capacity response

delivery-case-invokes-selected-answer

scenarioper delivery-cases row

Applies for every adoption

When Row.condition declared in establishes delivery case Row.id, the lifecycle applies the selected output-full answer to the whole output: Bind capacity response. The test names the address and restates nothing from it.

Given: a whole Instance output and delivery case Row.id
When: the condition at Row.condition declared in holds
Then: the lifecycle applies exactly the selected output-full answer to the whole output, without splitting it or inventing another capacity response: Bind capacity response
Diagnostics: Instance-delivery-attempts

the normal destination accepts every whole output

normal-destination-never-blocks

generalonce

Applies when Output full is Never full.

Across Inputs scope, under never-full, the normal destination accepts every whole output. An in-place output is delivered by the state change at its site, so no capacity branch exists for it. There is no capacity-blocked fallback; a refusal is a defect in the adoption.

Scope: Inputs scope
Holds: under the never-full answer, every successful whole output is accepted without a capacity-blocked state, fallback, or inaccessible held output; an in-place output is delivered by the state change at its site and no capacity branch exists for it; if the capacity promise fails, the adoption fails rather than taking another lifecycle branch
Diagnostics: Instance-delivery-attempts

a job waits before admission for reserved output room

pre-start-reservation-blocks-admission

scenarioonce

Applies when Output full is Wait before start.

Without room for the whole output, the request stays requested and waits for its cited readmission event. An adoption declaring no such event can never leave requested, which the paired existence test reports as a defect. Successful admission reserves the whole space atomically and holds it through delivery. An adoption whose destination always has room constructs no block and asserts nothing here; an in-place job answers never-full, so this test never applies to it.

Given: a request for Instance whose whole output does not have reservable room; an adoption whose destination always has room constructs no block and asserts nothing here; an in-place job answers never-full, so this test never applies to it
When: admission is attempted
Then: the request remains requested, records no work, and makes no admission-time claim until a cited readmission event retries admission
when room exists, the whole output is reserved atomically and the reservation is held through delivery
an adoption declaring no such readmission event can never leave requested, which the paired existence test reports as a defect
Diagnostics: Instance-state-trace
Instance-reservation-ledger
Instance-claim-ledger

a held output remains one inaccessible owned result

held-output-retries-only-on-event

scenarioonce

Applies when Output full is Hold undelivered.

For a new-thing job, a refused normal destination leaves one owned inaccessible output in finished. Inputs stay spent; time alone does not retry; work is not repeated. The first refusal and every refusal on retry report destination-refused. Each cited redelivery event retries without creating a duplicate, and a successful retry reports job-delivered exactly once. An adoption with no such row can never deliver; the paired existence test reports that as a defect. An in-place job answers never-full, so this test never applies to it.

Given: a finished Instance job whose normal destination refuses the whole output; an in-place job answers never-full, so this test never applies to it
When: time passes and, where the adoption declares one, a cited redelivery event later occurs
Then: exactly one owned inaccessible output remains in finished with its inputs spent, and no polling or repeated work occurs
each cited event retries the normal destination and no duplicate output appears; the first refusal and every refusal on retry report destination-refused; an adoption with no redelivery event can never deliver, which the paired existence test reports as a defect
the retry that succeeds reports job-delivered exactly once
Diagnostics: Instance-output-location
Instance-delivery-attempts
Instance-claim-ledger

a held output declares a redelivery event

held-output-needs-a-redelivery-event

scenarioonce

Applies when Output full is Hold undelivered.

An adoption answering hold-undelivered declares at least one redelivery-events row. An adoption with none fails this test by construction.

Given: an adoption answering hold-undelivered
When: its redelivery-events rows are inspected
Then: the adoption declares at least one redelivery-events row, and an adoption with none fails this test by construction
Diagnostics: Instance-declaration-record

Row.id is legal exactly for a refused-output retry

redelivery-event-pairs-with-retry-answer

scenarioper redelivery-events row

Applies for every adoption

Row Row.id is legal exactly when output-full is hold-undelivered or try-destinations. After refusal, only Row.redelivery declared in retries delivery, using the same output without repeating work. A row under another answer is a defect this test fails by construction. The test names the address and restates nothing from it.

Given: redelivery-events row Row.id in the adoption
When: the output-full answer is checked and, under hold-undelivered or try-destinations, Row.redelivery declared in occurs after refusal
Then: the row is legal only under hold-undelivered or try-destinations; its presence under any other answer fails this test by construction
under either legal answer the lifecycle retries only on the cited event and keeps the same output without repeating work
Diagnostics: Instance-event-log
Instance-delivery-attempts
Instance-output-identity

Row.id is legal exactly for the ordered route

fallback-destination-pairs-with-ordered-route

scenarioper output-destinations row

Applies for every adoption

Fallback row Row.id at Row.destination declared in is legal only when output-full is try-destinations. Its presence under any other answer is a defect this test fails by construction.

Given: output-destinations row Row.id in the adoption
When: the output-full answer is checked
Then: the row is legal only under try-destinations; its presence under any other answer is a defect this test fails by construction
Diagnostics: Instance-declaration-record

Row.id is tried in its written place

fallback-destination-keeps-written-order

scenarioper output-destinations row

Applies when Output full is Try destinations.

The ordered route tries the normal destination, then fallback Row.id at Row.destination declared in in written order. Each refusal reports destination-refused. When this row accepts, it receives the whole output and no later row is tried. The test names the address and restates nothing from it.

Given: one whole output, its normal destination and every fallback before Row.id refusing it, with Row.id able to accept it
When: the route reaches Row.destination declared in
Then: each refusal before acceptance reports destination-refused with both states finished
the whole output is delivered at Row.id, no later fallback is tried, and the output is never split
Diagnostics: Instance-delivery-attempts
Instance-report-log
Instance-output-location

the ordered route tries whole-output destinations in order

ordered-route-keeps-one-output

scenarioonce

Applies when Output full is Try destinations.

For a new-thing job, the route tries the normal destination and every fallback in written order, delivers the whole output to the first place that accepts, and stops there. Each refusal reports. If all refuse, the same output stays finished without polling and cited redelivery events restart the route. Where every destination can refuse, the adoption declares a redelivery event; a route no destination can wholly refuse needs none. An in-place job answers never-full, so this test never applies to it.

Given: a finished Instance output whose normal destination refuses it, with each fallback acceptance pattern the adoption can construct; an in-place job answers never-full, so this test never applies to it
When: the route tries the normal destination and fallback rows in written order
Then: every refusal reports destination-refused and the first accepting destination receives the whole output
no later destination is tried after acceptance and the output is never split
if all destinations refuse, the same output stays finished without polling; each cited redelivery event retries from the normal destination, and an adoption with no such event never retries
where every destination on the route can refuse the output, the adoption declares a redelivery event; a route no destination can wholly refuse needs none
Diagnostics: Instance-delivery-attempts
Instance-output-identity
Instance-report-log

an accepted output is delivered immediately

automatic-delivery-reports-once

scenarioonce

Applies for every adoption

Under the automatic answer, or where delivery-trigger was never asked and delivery is therefore automatic, an accepted output moves from finished to delivered and reports job-delivered exactly once. An adoption answering on-collection asserts nothing here, and where the job row declares in-place this test asserts nothing beyond the single report.

Given: a finished Instance output accepted by its chosen destination under the automatic answer, or where delivery-trigger was never asked and delivery is therefore automatic; an adoption answering on-collection asserts nothing here, and where the job row declares in-place this test asserts nothing beyond the single report
When: capacity resolution accepts it
Then: the job moves finished to delivered immediately and reports job-delivered exactly once
Diagnostics: Instance-state-trace
Instance-report-log

Row.id is legal exactly for collection delivery

collection-event-pairs-with-collection-delivery

scenarioper collection-events row

Applies for every adoption

Row Row.id is legal exactly when delivery-trigger is on-collection. Under that answer, the lifecycle consults the rule cited at Row.collection declared in. A row under another answer is a defect this test fails by construction. The test names the address and restates nothing from it.

Given: collection-events row Row.id in the adoption
When: the delivery-trigger answer is checked
Then: the row is legal only under on-collection; its presence under any other answer fails this test by construction
the lifecycle consults the rule cited at Row.collection declared in under that answer
Diagnostics: Instance-event-log

collection delivery declares a collection event

collection-needs-a-collection-event

scenarioonce

Applies when Delivery trigger is On collection.

An adoption answering on-collection declares at least one collection-events row. An adoption with none fails this test by construction.

Given: an adoption answering on-collection
When: its collection-events rows are inspected
Then: the adoption declares at least one collection-events row, and an adoption with none fails this test by construction
Diagnostics: Instance-declaration-record

an accepted output remains accessible until collection

collection-delivery-waits-for-event

scenarioonce

Applies when Delivery trigger is On collection.

An accepted output stays accessible at its chosen destination in finished until a cited collection event occurs. That event delivers it and reports job-delivered exactly once. An adoption declaring no such event can never leave finished, which the paired existence test reports as a defect. An adoption that can construct no accepted output asserts nothing here.

Given: an accepted Instance output at its chosen destination; an adoption that can construct no accepted output asserts nothing here
When: time passes and, where the adoption declares one, a cited collection event occurs
Then: the output remains accessible in finished before the event
the event moves it to delivered and job-delivered reports exactly once
an adoption declaring no such collection event can never leave finished, which the paired existence test reports as a defect
Diagnostics: Instance-output-location
Instance-event-log
Instance-report-log

a rejected run is not retried by the lifecycle

rejection-ends-the-requested-run

scenarioonce

Applies for every adoption

Rejection ends its run. Clearing the reason does not revive it: a later retry belongs to the requester, unless a standing order creates a new run. Where this adoption declares no standing-orders row, no request repeats automatically.

Given: each Instance request that the adoption can construct as rejected
When: the rejection settles and its cause later clears
Then: the rejected run remains ended and the lifecycle creates no retry
a later retry has a new run created by the requester unless a standing-order scan creates it
where this adoption declares no standing-orders row, no request repeats automatically
Diagnostics: Instance-run-id-trace
Instance-request-log

the lifecycle and settlement order hold for the whole run

lifecycle-holds

generalonce

Applies for every adoption

Across Inputs scope, each transition settles with its claim changes and reports before the next begins. Claim changes precede the report unless a numbered step says otherwise. The stated forward and side paths are the only observed transitions. Instant automatic delivery keeps job-started, job-finished, and job-delivered in one batch. Same-moment order comes from Event resolution, not this contract. The adoption supplies the audit seeds through verification inputs.

Holds: one transition, all of its claim changes, and all of its reports settle before another transition begins; claim changes precede the transition report unless a numbered step states otherwise; an instant start with an accepting destination keeps job-started, job-finished, and job-delivered in one ordered batch with no outside event between them; only the forward path requested to waiting to started to working to finished to delivered, with unvisited states skipped without changing order, the stopped and resume side path, the cancellation side path, terminal failure, and recoverable failure into stopped are observed; same-moment events enter one at a time in the order Event resolution supplies, and this contract adds no ordering rule
Seeds: Inputs seeds
Scope: Inputs scope
Diagnostics: Instance-state-trace
Instance-claim-ledger
Instance-report-log
Instance-first-ordering-violation

Use this contract in your game ↑