model

const (
	// ApprovalRequested opens an approval: a decision found an approval obligation
	// unmet and asked for one, of one action digest.
	ApprovalRequested ApprovalKind = 1
	// ApprovalDecided is one approver's answer.
	ApprovalDecided ApprovalKind = 2
	// ApprovalRevoked withdraws an approver's earlier answer.
	ApprovalRevoked ApprovalKind = 3
)

const (
	ApprovalOutcomeGranted  ApprovalOutcome = 1
	ApprovalOutcomeRejected ApprovalOutcome = 2
)

const (
	AuthzIndeterminate AuthzEffect = 0
	AuthzPermit        AuthzEffect = 1
	AuthzDeny          AuthzEffect = 2
	AuthzNotApplicable AuthzEffect = 3
)

const (
	// DispatchSignal is a signal broadcast (ADR-0088).
	DispatchSignal DispatchChannel = 1
	// DispatchMessage is a message published for correlation (ADR-0020).
	DispatchMessage DispatchChannel = 2
)

const (
	// DispatchFromProcess is a running instance: a throw event, an end event, or a
	// send task naming a message.
	DispatchFromProcess DispatchSource = 1
	// DispatchFromPublish is a publish with no sending instance: POST /api/v1/messages,
	// or atlas's own order and fulfilment publishes.
	DispatchFromPublish DispatchSource = 2
	// DispatchFromInbound is a Worker's inbound watch (ADR-0075).
	DispatchFromInbound DispatchSource = 3
	// DispatchDirected is a directed delivery to one running instance (ADR-0428).
	DispatchDirected DispatchSource = 4
)

const (
	// OriginOrdered is the ordinary one: an order was placed, approved and
	// provisioned, and Atlas watched it happen.
	OriginOrdered EntitlementOrigin = 0
	// OriginAdopted is a privilege reconciliation found in a target system and
	// somebody accepted into the inventory. Atlas did not grant it and says so.
	OriginAdopted EntitlementOrigin = 1
	// OriginLegacy is what the estate already held when the portal was
	// commissioned.
	//
	// On the first day the inventory is empty and reality is full. Without this,
	// the first reconciliation reports every existing privilege as a discrepancy,
	// and each of those carries an executable "remove in the target system" — which
	// is how a new access-governance tool locks out a company on its first run.
	OriginLegacy EntitlementOrigin = 2
)

const (
	// EndReturned is a right given back: the order line was returned, the
	// deprovisioning process ran, the access went away. The ordinary ending, and
	// the only one that is evidence of a held period.
	EndReturned HoldEnd = 0
	// EndCorrected is a right reconciliation found the target system did not have,
	// and somebody accepted the correction.
	//
	// The access did not end here. As far as anybody can tell it was never there,
	// or went away at a moment nobody observed. What ended is Atlas's claim, and
	// the row says only that.
	EndCorrected HoldEnd = 1
)

const (
	// IncidentUnclassified is "not recorded": an older record, or a source whose
	// resolution the element's node type still decides.
	IncidentUnclassified IncidentReason = 0
	// IncidentOverBudget marks an element that was activated but never ran, because
	// its token had used up the execution budget for this run
	// (ADR-0272). Resolving it runs the behavior that never ran.
	IncidentOverBudget IncidentReason = 1
	// IncidentTooManyIterations marks a multi-instance activity that asked for more
	// iterations than the instance budget allows (ADR-0276). Like
	// IncidentOverBudget it names an element that never ran, so resolving it runs the
	// behavior — which re-evaluates the count, and parks again if it is still too
	// large.
	IncidentTooManyIterations IncidentReason = 2
	// IncidentVariableTooLarge marks an element whose write was refused because the
	// value was past the budget for a variable, or for a multi-instance activity's
	// output collection (ADR-0294). Unlike the two above it
	// names an element that *did* run: the work happened and its result is the thing
	// that will not fit. Resolving it does not write the value again: nothing re-runs
	// the element's write, so the incident goes and the element stays where it stopped
	// (#1123).
	IncidentVariableTooLarge IncidentReason = 3
	// IncidentPersonalInTheClear marks an element whose write was refused because it
	// carried a value the process declared personal (ADR-0314) and carried it in the
	// clear. Such a value is enciphered where it enters Atlas — a form, a worker's
	// result, an operator's write — and the engine cannot do it: it holds no key, by
	// the same invariant that keeps applyToState free of side effects (I4).
	//
	// So a write that arrives readable came from a path with no edge to seal at, and
	// the honest outcome is to refuse it: writing it would put a value in the log that
	// no erasure could ever reach, while the model said the opposite. Resolving retries
	// the write, so re-delivering the value through a path that does seal lets it
	// through.
	IncidentPersonalInTheClear IncidentReason = 4
	// IncidentDataSubjectMoved marks an element whose write was refused because it
	// would have changed the instance's data subject after values were already sealed
	// under the previous one (ADR-0314).
	//
	// Allowing it would split one person's data across two keys, and then erasing
	// either of them would leave the other half readable — silently, which is the
	// failure the whole mechanism exists to prevent. Before anything is sealed the
	// change is harmless and goes through; afterwards the honest remedy is a new
	// instance with the right subject, so this does not become a retry somebody can
	// resolve their way out of.
	IncidentDataSubjectMoved IncidentReason = 5
	// IncidentPersonalOfAnotherSubject marks an element whose write was refused because it
	// carried a sealed personal value enciphered for a different data subject than the one
	// the target scope names (ADR-0314). A value only reaches a scope sealed for someone
	// else by being copied there — an output mapping handing a value out of a subprocess
	// that shadowed the subject, say. It would still open under its own subject's key, so
	// nothing would look wrong, but erasing the instance's subject would leave it readable.
	// The same reason refuses the other order: the data subject's first write into a scope
	// that already holds such a copy, which a call activity seeding its child produces.
	IncidentPersonalOfAnotherSubject IncidentReason = 6
	// IncidentUnhandledError marks a BPMN error that no handler caught (ADR-0089): a
	// worker's thrown error, an error end event, a mockup task's simulated one. The
	// element did not finish what it was doing, so resolving retries the thing that
	// threw — the job, which an uncaught worker error leaves in place with its retries
	// spent, or the throw itself — and an error still uncaught parks again on a fresh
	// incident rather than leaving the token parked behind none.
	IncidentUnhandledError IncidentReason = 7
	// IncidentAuthorizationDenied marks a job whose external action a policy refused
	// (ADR-0475 §5): the decision is recorded beside it
	// and its message names the reason and the decision. Retrying would only be refused
	// again, so the job parks here with its retries spent; resolving it re-offers the
	// job, and the next lease is decided afresh — under whatever the policies, the
	// account and the connection say by then.
	IncidentAuthorizationDenied IncidentReason = 8
)

const (
	// ElementInstance lifecycle (every BPMN element goes through this).
	IntentActivating Intent = iota
	IntentActivated
	IntentCompleting
	IntentCompleted
	IntentTerminating
	IntentTerminated

	// SequenceFlow.
	IntentSequenceFlowTaken

	// Job.
	IntentJobCreated
	IntentJobActivated // picked up by a worker
	IntentJobCompleted
	IntentJobFailed
	IntentJobTimedOut
	IntentJobAssigned // user-task assignee set/changed/cleared (claim/unclaim, ADR-0042)

	// Timer.
	IntentTimerCreated
	IntentTimerTriggered

	// Message / Signal.
	IntentSubscriptionCreated
	IntentSubscriptionCorrelated
	IntentMessagePublished

	// Variable.
	IntentVariableCreated
	IntentVariableUpdated

	// Incident.
	IntentIncidentCreated
	IntentIncidentResolved

	// IntentJobCanceled retires a job whose element was interrupted (e.g. by an
	// interrupting boundary event) rather than completed by a worker. It applies
	// like JobCompleted/JobFailed (the job is deleted), and is appended here rather
	// than beside the other job intents so the existing intents keep their numeric
	// values on the log.
	IntentJobCanceled

	// IntentTimerCanceled retires a timer without firing it — used when a new
	// version of a process supersedes a prior version's timer start event, so the
	// old schedule stops (ADR-0051). It applies like TimerTriggered (the timer is
	// deleted from the due-date index) but, unlike it, drives no side effect: no
	// instance is created. Appended at the end so existing intents keep their log
	// values.
	IntentTimerCanceled

	// IntentTimerStartArm is a command-only intent (never persisted as an event):
	// it directs the processor to arm a freshly deployed definition's timer start
	// events, creating their durable timers and retiring any that a prior version
	// left armed (ADR-0051). Because commands are not replayed (invariant I6), its
	// numeric value never reaches the log.
	IntentTimerStartArm

	// DataObject. Appended after the existing intents so every prior intent keeps
	// its numeric value on the log (ADR-0053). Created seeds a data object under a
	// scope with its declared initial data state; StateChanged transitions the data
	// state (and, later, the value) as an activity writes to it.
	IntentDataObjectCreated
	IntentDataObjectStateChanged

	// IntentDecisionEvaluated records that a business rule task's DMN decision was
	// evaluated (ADR-0066). Appended after the existing intents so every prior
	// intent keeps its numeric value on the log. It is a pure history event: the
	// worker has already evaluated the decision off the processor goroutine, and the
	// resulting inputs/outputs/trace are frozen into the event so replay re-applies
	// them without re-evaluating (invariant I6).
	IntentDecisionEvaluated

	// IntentVariableDeleted removes a variable from its scope. It applies like the
	// inverse of VariableCreated (the variable is deleted rather than put), and is
	// appended at the end so every prior intent keeps its numeric value on the log.
	// Its use is dropping an activity-local variable scope when the activity
	// completes, after I/O output mappings have promoted the values that escape
	// (ADR-0068): the drop is emitted as one VariableDeleted per local variable, so
	// replay reproduces it exactly (invariant I6) rather than recomputing it.
	IntentVariableDeleted

	// IntentInboundDeliveryApplied advances an external source's inbound high-water
	// mark (ADR-0075). It applies by upserting the source's last-applied sequence,
	// and is appended at the end so every prior intent keeps its numeric value on the
	// log. It rides in the same batch as the message publish it guards, so the
	// dedup mark and the correlate/start effects it authorizes commit atomically.
	IntentInboundDeliveryApplied

	// IntentVariableModify is a command-only intent (never persisted as an event),
	// like IntentTimerStartArm: it directs the processor to set or overwrite
	// variables on a running instance's scope from outside the model — an operator
	// correction to a live instance (ADR-0095). The handler validates the target
	// scope, then emits a VariableCreated event for a new name or a VariableUpdated
	// event for an existing one, so the change is a durable, replayable fact recorded
	// in the instance's variable timeline (the audit trail), not a raw store write.
	// Because commands are not replayed (invariant I6), its numeric value never
	// reaches the log, so it is appended at the end without disturbing the persisted
	// intents' values.
	IntentVariableModify

	// IntentVariableAudited records that an external actor set a variable on a running
	// instance (ADR-0098). It is a pure history event, like IntentDecisionEvaluated:
	// emitted alongside the VariableCreated/VariableUpdated the override produces, it
	// freezes who made the change into the log so replay rebuilds the identical audit
	// trail without re-running the command (invariant I6). Appended at the end so every
	// prior intent keeps its numeric value on the log.
	IntentVariableAudited

	// IntentJobErrorThrown is a command-only intent (never persisted as an event): a
	// worker reports that its job threw a BPMN error code (ADR-0089). Its handler cancels
	// the job and propagates the error from the job's element to the nearest matching error
	// handler — so, unlike IntentJobFailed, it is control flow, not a retry/incident.
	// Because commands are not replayed (invariant I6), its numeric value never reaches the
	// log. Appended at the end so every prior intent keeps its numeric value.
	IntentJobErrorThrown

	// IntentCompensableRecorded records that a compensable activity (one bearing a
	// compensation boundary) completed successfully, so a later compensation throw can
	// run its handler (ADR-0103). It is a pure state event, keyed under the activity's
	// scope in completion order: applyToState writes it into the compensable index off
	// the completion event, so recovery rebuilds the identical index (invariant I6).
	// Appended at the end so every prior intent keeps its numeric value on the log.
	IntentCompensableRecorded
	// IntentCompensableConsumed removes a compensable record once its activity has been
	// compensated (the handler was activated), so it is compensated at most once (ADR-0103).
	// It carries the record's scope and sequence; applyToState deletes that index entry.
	IntentCompensableConsumed

	// IntentOperatorActed records that an operator intervened on a running instance —
	// completing a parked job by hand, say (ADR-0159). Like IntentVariableAudited it is a
	// pure history event emitted alongside the events the intervention produces, freezing
	// who acted and why into the log so replay rebuilds the identical audit trail without
	// re-running the command (invariant I6). Appended at the end so every prior intent
	// keeps its numeric value on the log.
	IntentOperatorActed

	// IntentPurging is a command-only intent (never persisted as an event), like
	// IntentTimerStartArm: the retention sweep directs the processor to hard-delete a
	// finished instance's history (ADR-0115). Its handler emits IntentPurged for the
	// instance it carries. Because commands are not replayed (invariant I6), its numeric
	// value never reaches the log. Appended at the end so every prior intent keeps its
	// numeric value.
	IntentPurging
	// IntentPurged removes a finished process instance's history from the state store —
	// the terminal record and every per-instance family (ADR-0115). It is the durable
	// delete: applyToState folds it into the removals, so recovery reproduces the purge
	// (invariants I4/I6). Appended at the end so every prior intent keeps its numeric
	// value on the log.
	IntentPurged

	// IntentConditionRecheck is a command-only intent (never persisted as an event), like
	// IntentJobErrorThrown: after a batch writes one or more variables in an instance, the
	// processor schedules a re-check of that instance's armed conditional events (ADR-0137).
	// Its handler evaluates each armed conditional's FEEL condition over its scope chain and
	// drives the ones now true to Completing. Because commands are not replayed (invariant
	// I6) — the fire is the persisted Completing→Completed chain — its numeric value never
	// reaches the log. Appended at the end so every prior intent keeps its numeric value.
	IntentConditionRecheck

	// IntentMigrating is a command-only intent (never persisted as an event), like
	// IntentPurging: an operator directs the processor to rebind a running instance to
	// another deployed version of its process (ADR-0162). Its handler re-checks what the
	// API validated, then emits IntentMigrated for the instance it carries. Because
	// commands are not replayed (invariant I6), its numeric value never reaches the log.
	// Appended at the end so every prior intent keeps its numeric value.
	IntentMigrating
	// IntentMigrated rebinds a running instance to another deployed version: the
	// durable fact applyToState folds, carrying both definition keys and the element
	// mapping it rewrites the instance's live records through (ADR-0162). Appended at
	// the end so every prior intent keeps its numeric value on the log.
	IntentMigrated

	// IntentVariableReindex is a command-only intent (never persisted as an event), like
	// IntentMigrating: an operator asks that one instance's variable-index membership be
	// brought back in line with what its process declares searchable (ADR-0244). Its
	// handler compares the instance's root-scope variables against the declaration and
	// emits IntentVariableIndexed for each one whose membership differs — none, on an
	// instance already in step. Because commands are not replayed (invariant I6), its
	// numeric value never reaches the log. Appended at the end so every prior intent
	// keeps its numeric value.
	IntentVariableReindex
	// IntentVariableIndexed changes one variable's membership in the value index without
	// touching its value: the durable fact applyToState folds when a migration or a
	// reindex moves an instance to a declaration that differs from the one its values
	// were stamped under. Appended at the end so every prior intent keeps its numeric
	// value on the log.
	IntentVariableIndexed

	// IntentVariableElementSet sets one element of a list variable, naming the element
	// rather than carrying the whole list. It is what a multi-instance activity emits
	// per finished iteration, and it exists because the alternative grows with the
	// square of the iteration count: writing the collection each round put the growing
	// list into the log and into the variable timeline once per round
	// (ADR-0296).
	//
	// It folds by reading the collection, setting the element and writing it back —
	// deterministic, a function of the batch's own state, so replay reaches the same
	// list (I4). It records no snapshot: a loop's half-filled collection is scratch at
	// the body scope until the loop promotes it, the same reasoning that keeps the
	// dropping of an activity-local scope out of the timeline. Appended at the end so
	// every prior intent keeps its numeric value on the log.
	IntentVariableElementSet

	// IntentForking is a command-only intent (never persisted as an event), like
	// IntentMigrating: an operator directs the processor to end a running instance and
	// continue its work in a *new* instance of another deployed version, at resume
	// points they named (ADR-0389). It is the answer to the
	// migration ADR-0162's validator has to refuse — a token whose element the target
	// version no longer has cannot be rebound, but the instance's data and the decision
	// about where to pick it up again can still cross.
	//
	// Its handler re-checks what the API validated and then emits only events that
	// already exist: the successor's IntentActivated (carrying PredecessorInstanceKey),
	// the predecessor's IntentTerminated (carrying SuccessorInstanceKey), and an
	// operator action on each. Because commands are not replayed (invariant I6), its
	// numeric value never reaches the log. Appended at the end so every prior intent
	// keeps its numeric value.
	IntentForking

	// IntentEntitlementGranted and IntentEntitlementRevoked record that somebody
	// started or stopped holding a catalogue item
	// (ADR-0312).
	//
	// They are the inventory's only two events, and there is deliberately no third
	// for editing one. An entitlement is observed or derived, never authored: the
	// day somebody can edit one directly is the day the inventory stops being
	// evidence and becomes an opinion. A correction is a revoke and a grant, both of
	// which say when they happened.
	//
	// Appended at the end so every prior intent keeps its numeric value on the log.
	IntentEntitlementGranted
	IntentEntitlementRevoked

	// IntentTriggering is a command-only intent (never persisted, like IntentForking):
	// a directed trigger asks to start one deployed process at one of its message
	// start events (ADR-0425). Its handler answers from a receipt when the sender
	// already delivered this trigger, and otherwise creates the instance and records
	// IntentTriggerReceived in the same batch, so the instance and the fact that it
	// answered this trigger are durable together or not at all (I2).
	IntentTriggering
	// IntentTriggerReceived records a trigger's receipt: sender, trigger id, the
	// instance that answered and when.
	IntentTriggerReceived
	// IntentTriggerReceiptsPruning is a command-only intent: drop the receipts older
	// than a cutoff. IntentTriggerReceiptsPruned is its event, carrying that cutoff, so
	// replay drops exactly what was dropped live (I6). Appended at the end so every
	// prior intent keeps its numeric value on the log.
	IntentTriggerReceiptsPruning
	IntentTriggerReceiptsPruned
	// IntentDelivering is a command-only intent: a directed delivery asks to hand one
	// message to one running instance — the instance a product's lifecycle runs in
	// for one order position (ADR-0428).
	// Its handler correlates the instance's open subscriptions for that message and
	// records IntentTriggerReceived in the same batch, so a retry answers from the
	// receipt instead of delivering twice. Appended at the end so every prior intent
	// keeps its numeric value on the log.
	IntentDelivering
	// IntentActionReporting is a command-only intent: somebody reports how an action
	// asked of a position ended (ADR-0429 §3). Its handler answers a repeated
	// identical report from state and refuses a different outcome for the same
	// command, so only a first report becomes IntentActionCompleted.
	IntentActionReporting
	// IntentActionCompleted is the fact that an action ended, with its outcome.
	IntentActionCompleted
	// IntentFeedPruning is a command-only intent: the retention sweep asks the event
	// feed to drop its rows through a log position (ADR-0429 §5).
	IntentFeedPruning
	// IntentFeedPruned is the fact that it did, with the position it was pruned
	// through, which a feed reader is answered 410 below.
	IntentFeedPruned
	// IntentMessageBuffered is the fact that a message published with a time to live
	// correlated nothing and is kept, payload and all, for the subscription that opens
	// for it later (ADR-0370). Appended at the end so every prior intent keeps its
	// numeric value on the log.
	IntentMessageBuffered
	// IntentMessageIdRecorded is the fact that a message carrying an id was delivered
	// at once: the id is remembered until the message would have expired, so a repeat
	// of it is recognised as the same message (ADR-0370 idempotency).
	IntentMessageIdRecorded
	// IntentMessageConsumed is the fact that a buffered message was delivered to a
	// subscription that opened after it was published.
	IntentMessageConsumed
	// IntentMessageExpiring is a command-only intent: the timer sweep asks that a
	// message whose time to live has passed be dropped.
	IntentMessageExpiring
	// IntentMessageExpired is the fact that it was: the buffered message, if it still
	// waited, and its id are gone.
	IntentMessageExpired
	// IntentDispatched is the fact that a signal was broadcast or a message published
	// (VTDispatch, ADR-0472 §1). Appended at the end so every prior intent
	// keeps its numeric value on the log.
	IntentDispatched
	// IntentSignalStarted is the fact that a broadcast started an instance of a
	// definition with a matching signal start event: the definition, its start
	// element, the signal and the sender (VTSignal, ADR-0472 §2). It changes
	// no subscription; the event log folds a row from it.
	IntentSignalStarted
	// IntentEventLogPruning is a command-only intent: the retention sweep asks the event
	// log to drop its rows through a log position (ADR-0472 §4).
	IntentEventLogPruning
	// IntentEventLogPruned is the fact that it did, with the position it was pruned
	// through (VTFeedRetention).
	IntentEventLogPruned

	// IntentAuthorizationDeciding is a command-only intent: an enforcement point asks
	// that a decision it made be recorded for a job it holds a lease on
	// (ADR-0475 §5). Its handler re-checks the lease,
	// records IntentAuthorizationDecided and, for an enforced refusal, fails the job or
	// asks for approval in the same batch, so the decision and its consequence are
	// durable together (I2). Appended at the end so every prior intent keeps its value.
	IntentAuthorizationDeciding
	// IntentAuthorizationDecided is the decision, as a fact.
	IntentAuthorizationDecided
	// IntentApprovalDeciding is a command-only intent: an approver answers an approval,
	// or withdraws an answer. Its handler checks the approval is open and records
	// IntentApprovalRecorded.
	IntentApprovalDeciding
	// IntentApprovalRecorded is one fact about an approval — requested, answered or
	// withdrawn; the value's Kind says which.
	IntentApprovalRecorded
)

const (
	// JobTimerRetry releases a retry backoff (ADR-0111). Zero so pre-existing records,
	// which are all retry timers, decode correctly.
	JobTimerRetry JobTimerKind = 0
	// JobTimerLease releases a worker's lease when it expires (ADR-0007).
	JobTimerLease JobTimerKind = 1
)

const (
	// OperatorActionCompleteJob is an operator completing a parked job by hand, the
	// job a worker would otherwise have completed (ADR-0159).
	OperatorActionCompleteJob OperatorActionKind = iota + 1
	// OperatorActionMigrate is an operator rebinding a running instance to another
	// deployed version of its process (ADR-0162). It is the audit half of the
	// migration: the rebinding itself is VTProcessMigration, and this record is what
	// makes it visible — who, why, and at which log position the instance stopped being
	// the old version and started being the new one, which is what lets the replay
	// resolve each step through the definition that was in force at it.
	OperatorActionMigrate
	// OperatorActionForkedTo is written on the instance an operator forked *away from*:
	// its tokens could not be rebound onto the target version, so it was terminated and
	// its work continued in a new instance of that version
	// (ADR-0389). Which instance that is, is on the record —
	// SuccessorInstanceKey — so this kind carries only who ended it and why.
	OperatorActionForkedTo
	// OperatorActionForkedFrom is the same fork seen from the successor: the instance
	// did not begin at a start event but continued another instance's work at resume
	// points an operator named. Its predecessor is on its record; this is what makes the
	// successor's timeline open with the reason it exists rather than with a token
	// appearing in the middle of the diagram.
	OperatorActionForkedFrom
	// OperatorActionThrowJobError is an operator throwing a BPMN error from a parked job
	// by hand, the error a worker would otherwise have thrown (ADR-0089, ADR-0159). Like a
	// completion by hand it forces a path the engine did not take on its own — here the
	// error flow — so it is recorded with who and why, and with the code it threw.
	OperatorActionThrowJobError
)

const (
	PIActive     ProcessInstanceState = iota // running
	PICompleted                              // reached its end normally
	PITerminated                             // ended by termination
)

const (
	// RecordCommand is an intention submitted to the processor. It may be
	// rejected and is never persisted.
	RecordCommand RecordType = iota
	// RecordEvent is a fact that already happened. It is appended to the log
	// and is the only record type that is persisted.
	RecordEvent
	// RecordCommandRejection records that a command was refused. It is not
	// persisted; it is surfaced to the submitter.
	RecordCommandRejection
)

const (
	VTProcessInstance     ValueType = iota // the running instance as a whole
	VTElementInstance                      // a single active BPMN element instance (token carrier)
	VTJob                                  // service-task work for external workers
	VTTimer                                // timer-event subscription
	VTMessageSubscription                  // waiting for a message (receive task, message event)
	VTMessage                              // an incoming message (buffered)
	VTVariable                             // a process variable
	VTIncident                             // a fault state (job failed, expression error)
	VTSignal
	VTError             // error-event propagation
	VTProcessDefinition // a deployed definition
	// VTMessageFlow is a delivered message flow retained for history: one record
	// per message that correlated to a catch event or instantiated a message-start
	// process. Unlike VTMessageSubscription (an open wait, deleted on correlation)
	// it is never deleted, so the Operations collaboration view can replay the
	// exchange between pools after the fact (ADR-0038).
	VTMessageFlow
	// VTDataObject is a BPMN data object: a typed, named, scope-owned datum with a
	// declared lifecycle state. Unlike a plain variable it carries a data state
	// (order [received] → [approved]) whose every transition is a durable event,
	// so its state history and provenance rebuild from the log (ADR-0053).
	VTDataObject
	// VTDecisionEvaluation is one business rule task's DMN decision evaluation
	// retained for debugging: the input context it was given, the outputs it
	// produced, and the temis trace explaining which rules fired. Like VTMessageFlow
	// it is append-only history (one record per evaluation, never deleted), so an
	// operator can inspect after the fact exactly how a decision was made (ADR-0066).
	VTDecisionEvaluation
	// VTInboundDelivery is a per-source high-water mark for an at-least-once inbound
	// event bridge (ADR-0075): it records that an external source's deliveries up to
	// a sequence have been applied, so a replayed publish is skipped rather than
	// re-correlated (which would double-start a message-start process). It is generic
	// — the engine never interprets the opaque source id — and appended last so every
	// prior value type keeps its numeric value on the log.
	VTInboundDelivery
	// VTVariableAudit is one external variable override retained for audit (ADR-0098):
	// who set which variable, to what value, on which scope, keyed under its process
	// instance. Like VTMessageFlow and VTDecisionEvaluation it is append-only history
	// (one record per variable an operator sets, never deleted), so the "who changed
	// it" trail survives the instance and rebuilds from the log. Appended last so every
	// prior value type keeps its numeric value on the log.
	VTVariableAudit
	// VTCompensable is one completed compensable activity retained so a later
	// compensation throw can run its handler (ADR-0103). Written on the activity's
	// successful completion, keyed under its scope in completion order, and deleted when
	// compensated or when its scope tears down. Appended last so every prior value type
	// keeps its numeric value on the log.
	VTCompensable
	// VTOperatorAction is one operator intervention on a running instance retained for
	// audit (ADR-0159): who completed a parked job by hand, on which element, and why.
	// Like VTVariableAudit it is append-only history keyed under its process instance —
	// never deleted — so a step a person forced is always distinguishable from one the
	// engine drove, and the trail rebuilds from the log. Appended last so every prior
	// value type keeps its numeric value on the log.
	VTOperatorAction

	// VTProcessMigration is a running instance being rebound from one deployed version
	// of its process to another (ADR-0162). It is the only value that rewrites live
	// state in bulk rather than describing one entity's transition: the instance's
	// definition key and every element index its live records carry are translated
	// through the mapping the value holds. That mapping is *in the event* — never
	// derived during the fold — because a fold that recomputed it would depend on the
	// matching algorithm's code, so improving that algorithm would silently replay an
	// old log into a different state (invariants I4/I6). Appended last so every prior
	// value type keeps its numeric value on the log.
	VTProcessMigration

	// VTVariableIndex is one variable's membership in the value index changing after
	// the fact: the instance's process now declares that name searchable, or no longer
	// does (ADR-0244, ADR-0295). It carries no
	// value — the variable holds that — only the name and the membership, because the
	// point is that the value did not change. It exists because a variable's membership
	// is stamped by the version that wrote it (I6), and an instance can change version
	// under an operator's hand: a migration (ADR-0162) or an explicit reindex. Appended
	// last so every prior value type keeps its numeric value on the log.
	VTVariableIndex

	// VTEntitlement is what somebody holds: a principal, a catalogue item, since
	// when, and where the knowledge came from
	// (ADR-0312).
	//
	// It is engine state rather than a sidecar record for one reason that decides
	// it: an entitlement outlives the process instance that produced it, by years.
	// The instance is eligible for retention deletion long before somebody stops
	// holding their VPN access, so the fact cannot live in the instance's history —
	// and a sidecar file would put an access record outside the log that every
	// other engine fact rebuilds from.
	//
	// It carries a principal *reference* and nothing else about a person. That is
	// what keeps applyToState free of any key access, and it is what makes erasure
	// possible at all: an append-only log cannot forget what it was given in the
	// clear. Appended last so every prior value type keeps its numeric value on the
	// log.
	VTEntitlement

	// VTEntitlementHistory is a hold that has ended: the inventory row as it stood,
	// plus when and why it stopped being recorded
	// (ADR-0346).
	//
	// A separate type rather than a flag on VTEntitlement, because the two answer
	// different questions and a value that means one thing on one event and another
	// on another is one nobody can read. It is also the only value type in the
	// portal that is written and never updated: a hold ends once.
	//
	// Appended last so every prior value type keeps its numeric value on the log.
	VTEntitlementHistory

	// VTTriggerReceipt records that a directed trigger was applied: the sender, its
	// trigger id and the instance that answered (ADR-0425). It is what lets an
	// at-least-once sender retry without starting a second instance. Receipts are
	// dropped by an explicit prune event once they are older than the retention, so
	// the set stays bounded. Appended last so every prior value type keeps its
	// numeric value on the log.
	VTTriggerReceipt

	// VTActionOutcome records how one action asked of an order position ended —
	// completed, rejected or failed — with the event type it is published under
	// (ADR-0429 §3). It outlives the order it came from, as an entitlement does.
	// Appended last so every prior value type keeps its numeric value on the log.
	VTActionOutcome

	// VTFeedRetention records how far a table folded from facts has been pruned: the
	// event feed (ADR-0429 §5) with IntentFeedPruned, the event log (ADR-0472)
	// with IntentEventLogPruned. Every row of the partition at or before Through is
	// gone. Such a table is shortened by a fact of its own rather than by a delete
	// nobody replays (I4). Appended last so every prior value type keeps its numeric
	// value on the log.
	VTFeedRetention

	// VTDispatch is the fact that a signal was broadcast or a message published: by
	// whom, under which name, and how far it reached (ADR-0472 §1). One
	// record per send, a send that reached nobody included. It carries no payload.
	// Appended last so every prior value type keeps its numeric value on the log; a
	// version before it decodes it to no value and skips it on replay.
	VTDispatch
	// VTAuthorization is one policy decision about one external Worker action — the
	// evidence written before anything the action needs is released
	// (ADR-0475 §12). Append-only history keyed under
	// its process instance, like VTOperatorAction. Appended last so every prior value
	// type keeps its numeric value on the log.
	VTAuthorization
	// VTActionApproval is one fact about the approval of one action digest: requested,
	// answered, or withdrawn (§9). A separate type from VTAuthorization because the two
	// answer different questions — what was decided, and who agreed to what. Appended
	// last so every prior value type keeps its numeric value on the log.
	VTActionApproval
)

const (
	VarNull   VarKind = iota // no value
	VarBool                  // Bool is meaningful
	VarNumber                // Text is the canonical decimal string
	VarString                // Text is the string contents
	// VarJSON is a structured value (object or array). Text is its canonical
	// JSON encoding; it is re-parsed into a FEEL context/list when bound into an
	// evaluation. Kept as text so the durable record format is unchanged — a new
	// kind byte over the same length-prefixed Text (ADR-0009, ADR-0037).
	VarJSON
)