model

const (
	// IncidentUnclassified is "not recorded": an older record, or a source whose
	// resolution the element's node type still decides.
	IncidentUnclassified IncidentReason = 0
	// IncidentOverBudget marks an element that was activated but never ran, because
	// its token had used up the execution budget for this run
	// (ADR-0272). Resolving it runs the behavior that never ran.
	IncidentOverBudget IncidentReason = 1
	// IncidentTooManyIterations marks a multi-instance activity that asked for more
	// iterations than the instance budget allows (ADR-0276). Like
	// IncidentOverBudget it names an element that never ran, so resolving it runs the
	// behavior — which re-evaluates the count, and parks again if it is still too
	// large.
	IncidentTooManyIterations IncidentReason = 2
)

const (
	// ElementInstance lifecycle (every BPMN element goes through this).
	IntentActivating Intent = iota
	IntentActivated
	IntentCompleting
	IntentCompleted
	IntentTerminating
	IntentTerminated

	// SequenceFlow.
	IntentSequenceFlowTaken

	// Job.
	IntentJobCreated
	IntentJobActivated // picked up by a worker
	IntentJobCompleted
	IntentJobFailed
	IntentJobTimedOut
	IntentJobAssigned // user-task assignee set/changed/cleared (claim/unclaim, ADR-0042)

	// Timer.
	IntentTimerCreated
	IntentTimerTriggered

	// Message / Signal.
	IntentSubscriptionCreated
	IntentSubscriptionCorrelated
	IntentMessagePublished

	// Variable.
	IntentVariableCreated
	IntentVariableUpdated

	// Incident.
	IntentIncidentCreated
	IntentIncidentResolved

	// IntentJobCanceled retires a job whose element was interrupted (e.g. by an
	// interrupting boundary event) rather than completed by a worker. It applies
	// like JobCompleted/JobFailed (the job is deleted), and is appended here rather
	// than beside the other job intents so the existing intents keep their numeric
	// values on the log.
	IntentJobCanceled

	// IntentTimerCanceled retires a timer without firing it — used when a new
	// version of a process supersedes a prior version's timer start event, so the
	// old schedule stops (ADR-0051). It applies like TimerTriggered (the timer is
	// deleted from the due-date index) but, unlike it, drives no side effect: no
	// instance is created. Appended at the end so existing intents keep their log
	// values.
	IntentTimerCanceled

	// IntentTimerStartArm is a command-only intent (never persisted as an event):
	// it directs the processor to arm a freshly deployed definition's timer start
	// events, creating their durable timers and retiring any that a prior version
	// left armed (ADR-0051). Because commands are not replayed (invariant I6), its
	// numeric value never reaches the log.
	IntentTimerStartArm

	// DataObject. Appended after the existing intents so every prior intent keeps
	// its numeric value on the log (ADR-0053). Created seeds a data object under a
	// scope with its declared initial data state; StateChanged transitions the data
	// state (and, later, the value) as an activity writes to it.
	IntentDataObjectCreated
	IntentDataObjectStateChanged

	// IntentDecisionEvaluated records that a business rule task's DMN decision was
	// evaluated (ADR-0066). Appended after the existing intents so every prior
	// intent keeps its numeric value on the log. It is a pure history event: the
	// worker has already evaluated the decision off the processor goroutine, and the
	// resulting inputs/outputs/trace are frozen into the event so replay re-applies
	// them without re-evaluating (invariant I6).
	IntentDecisionEvaluated

	// IntentVariableDeleted removes a variable from its scope. It applies like the
	// inverse of VariableCreated (the variable is deleted rather than put), and is
	// appended at the end so every prior intent keeps its numeric value on the log.
	// Its use is dropping an activity-local variable scope when the activity
	// completes, after I/O output mappings have promoted the values that escape
	// (ADR-0068): the drop is emitted as one VariableDeleted per local variable, so
	// replay reproduces it exactly (invariant I6) rather than recomputing it.
	IntentVariableDeleted

	// IntentInboundDeliveryApplied advances an external source's inbound high-water
	// mark (ADR-0075). It applies by upserting the source's last-applied sequence,
	// and is appended at the end so every prior intent keeps its numeric value on the
	// log. It rides in the same batch as the message publish it guards, so the
	// dedup mark and the correlate/start effects it authorizes commit atomically.
	IntentInboundDeliveryApplied

	// IntentVariableModify is a command-only intent (never persisted as an event),
	// like IntentTimerStartArm: it directs the processor to set or overwrite
	// variables on a running instance's scope from outside the model — an operator
	// correction to a live instance (ADR-0095). The handler validates the target
	// scope, then emits a VariableCreated event for a new name or a VariableUpdated
	// event for an existing one, so the change is a durable, replayable fact recorded
	// in the instance's variable timeline (the audit trail), not a raw store write.
	// Because commands are not replayed (invariant I6), its numeric value never
	// reaches the log, so it is appended at the end without disturbing the persisted
	// intents' values.
	IntentVariableModify

	// IntentVariableAudited records that an external actor set a variable on a running
	// instance (ADR-0098). It is a pure history event, like IntentDecisionEvaluated:
	// emitted alongside the VariableCreated/VariableUpdated the override produces, it
	// freezes who made the change into the log so replay rebuilds the identical audit
	// trail without re-running the command (invariant I6). Appended at the end so every
	// prior intent keeps its numeric value on the log.
	IntentVariableAudited

	// IntentJobErrorThrown is a command-only intent (never persisted as an event): a
	// worker reports that its job threw a BPMN error code (ADR-0089). Its handler cancels
	// the job and propagates the error from the job's element to the nearest matching error
	// handler — so, unlike IntentJobFailed, it is control flow, not a retry/incident.
	// Because commands are not replayed (invariant I6), its numeric value never reaches the
	// log. Appended at the end so every prior intent keeps its numeric value.
	IntentJobErrorThrown

	// IntentCompensableRecorded records that a compensable activity (one bearing a
	// compensation boundary) completed successfully, so a later compensation throw can
	// run its handler (ADR-0103). It is a pure state event, keyed under the activity's
	// scope in completion order: applyToState writes it into the compensable index off
	// the completion event, so recovery rebuilds the identical index (invariant I6).
	// Appended at the end so every prior intent keeps its numeric value on the log.
	IntentCompensableRecorded
	// IntentCompensableConsumed removes a compensable record once its activity has been
	// compensated (the handler was activated), so it is compensated at most once (ADR-0103).
	// It carries the record's scope and sequence; applyToState deletes that index entry.
	IntentCompensableConsumed

	// IntentOperatorActed records that an operator intervened on a running instance —
	// completing a parked job by hand, say (ADR-0159). Like IntentVariableAudited it is a
	// pure history event emitted alongside the events the intervention produces, freezing
	// who acted and why into the log so replay rebuilds the identical audit trail without
	// re-running the command (invariant I6). Appended at the end so every prior intent
	// keeps its numeric value on the log.
	IntentOperatorActed

	// IntentPurging is a command-only intent (never persisted as an event), like
	// IntentTimerStartArm: the retention sweep directs the processor to hard-delete a
	// finished instance's history (ADR-0115). Its handler emits IntentPurged for the
	// instance it carries. Because commands are not replayed (invariant I6), its numeric
	// value never reaches the log. Appended at the end so every prior intent keeps its
	// numeric value.
	IntentPurging
	// IntentPurged removes a finished process instance's history from the state store —
	// the terminal record and every per-instance family (ADR-0115). It is the durable
	// delete: applyToState folds it into the removals, so recovery reproduces the purge
	// (invariants I4/I6). Appended at the end so every prior intent keeps its numeric
	// value on the log.
	IntentPurged

	// IntentConditionRecheck is a command-only intent (never persisted as an event), like
	// IntentJobErrorThrown: after a batch writes one or more variables in an instance, the
	// processor schedules a re-check of that instance's armed conditional events (ADR-0137).
	// Its handler evaluates each armed conditional's FEEL condition over its scope chain and
	// drives the ones now true to Completing. Because commands are not replayed (invariant
	// I6) — the fire is the persisted Completing→Completed chain — its numeric value never
	// reaches the log. Appended at the end so every prior intent keeps its numeric value.
	IntentConditionRecheck

	// IntentMigrating is a command-only intent (never persisted as an event), like
	// IntentPurging: an operator directs the processor to rebind a running instance to
	// another deployed version of its process (ADR-0162). Its handler re-checks what the
	// API validated, then emits IntentMigrated for the instance it carries. Because
	// commands are not replayed (invariant I6), its numeric value never reaches the log.
	// Appended at the end so every prior intent keeps its numeric value.
	IntentMigrating
	// IntentMigrated rebinds a running instance to another deployed version: the
	// durable fact applyToState folds, carrying both definition keys and the element
	// mapping it rewrites the instance's live records through (ADR-0162). Appended at
	// the end so every prior intent keeps its numeric value on the log.
	IntentMigrated
)

const (
	// JobTimerRetry releases a retry backoff (ADR-0111). Zero so pre-existing records,
	// which are all retry timers, decode correctly.
	JobTimerRetry JobTimerKind = 0
	// JobTimerLease releases a worker's lease when it expires (ADR-0007).
	JobTimerLease JobTimerKind = 1
)

const (
	// OperatorActionCompleteJob is an operator completing a parked job by hand, the
	// job a worker would otherwise have completed (ADR-0159).
	OperatorActionCompleteJob OperatorActionKind = iota + 1
	// OperatorActionMigrate is an operator rebinding a running instance to another
	// deployed version of its process (ADR-0162). It is the audit half of the
	// migration: the rebinding itself is VTProcessMigration, and this record is what
	// makes it visible — who, why, and at which log position the instance stopped being
	// the old version and started being the new one, which is what lets the replay
	// resolve each step through the definition that was in force at it.
	OperatorActionMigrate
)

const (
	PIActive     ProcessInstanceState = iota // running
	PICompleted                              // reached its end normally
	PITerminated                             // ended by termination
)

const (
	// RecordCommand is an intention submitted to the processor. It may be
	// rejected and is never persisted.
	RecordCommand RecordType = iota
	// RecordEvent is a fact that already happened. It is appended to the log
	// and is the only record type that is persisted.
	RecordEvent
	// RecordCommandRejection records that a command was refused. It is not
	// persisted; it is surfaced to the submitter.
	RecordCommandRejection
)

const (
	VTProcessInstance     ValueType = iota // the running instance as a whole
	VTElementInstance                      // a single active BPMN element instance (token carrier)
	VTJob                                  // service-task work for external workers
	VTTimer                                // timer-event subscription
	VTMessageSubscription                  // waiting for a message (receive task, message event)
	VTMessage                              // an incoming message (buffered)
	VTVariable                             // a process variable
	VTIncident                             // a fault state (job failed, expression error)
	VTSignal
	VTError             // error-event propagation
	VTProcessDefinition // a deployed definition
	// VTMessageFlow is a delivered message flow retained for history: one record
	// per message that correlated to a catch event or instantiated a message-start
	// process. Unlike VTMessageSubscription (an open wait, deleted on correlation)
	// it is never deleted, so the Operations collaboration view can replay the
	// exchange between pools after the fact (ADR-0038).
	VTMessageFlow
	// VTDataObject is a BPMN data object: a typed, named, scope-owned datum with a
	// declared lifecycle state. Unlike a plain variable it carries a data state
	// (order [received] → [approved]) whose every transition is a durable event,
	// so its state history and provenance rebuild from the log (ADR-0053).
	VTDataObject
	// VTDecisionEvaluation is one business rule task's DMN decision evaluation
	// retained for debugging: the input context it was given, the outputs it
	// produced, and the temis trace explaining which rules fired. Like VTMessageFlow
	// it is append-only history (one record per evaluation, never deleted), so an
	// operator can inspect after the fact exactly how a decision was made (ADR-0066).
	VTDecisionEvaluation
	// VTInboundDelivery is a per-source high-water mark for an at-least-once inbound
	// event bridge (ADR-0075): it records that an external source's deliveries up to
	// a sequence have been applied, so a replayed publish is skipped rather than
	// re-correlated (which would double-start a message-start process). It is generic
	// — the engine never interprets the opaque source id — and appended last so every
	// prior value type keeps its numeric value on the log.
	VTInboundDelivery
	// VTVariableAudit is one external variable override retained for audit (ADR-0098):
	// who set which variable, to what value, on which scope, keyed under its process
	// instance. Like VTMessageFlow and VTDecisionEvaluation it is append-only history
	// (one record per variable an operator sets, never deleted), so the "who changed
	// it" trail survives the instance and rebuilds from the log. Appended last so every
	// prior value type keeps its numeric value on the log.
	VTVariableAudit
	// VTCompensable is one completed compensable activity retained so a later
	// compensation throw can run its handler (ADR-0103). Written on the activity's
	// successful completion, keyed under its scope in completion order, and deleted when
	// compensated or when its scope tears down. Appended last so every prior value type
	// keeps its numeric value on the log.
	VTCompensable
	// VTOperatorAction is one operator intervention on a running instance retained for
	// audit (ADR-0159): who completed a parked job by hand, on which element, and why.
	// Like VTVariableAudit it is append-only history keyed under its process instance —
	// never deleted — so a step a person forced is always distinguishable from one the
	// engine drove, and the trail rebuilds from the log. Appended last so every prior
	// value type keeps its numeric value on the log.
	VTOperatorAction

	// VTProcessMigration is a running instance being rebound from one deployed version
	// of its process to another (ADR-0162). It is the only value that rewrites live
	// state in bulk rather than describing one entity's transition: the instance's
	// definition key and every element index its live records carry are translated
	// through the mapping the value holds. That mapping is *in the event* — never
	// derived during the fold — because a fold that recomputed it would depend on the
	// matching algorithm's code, so improving that algorithm would silently replay an
	// old log into a different state (invariants I4/I6). Appended last so every prior
	// value type keeps its numeric value on the log.
	VTProcessMigration
)

const (
	VarNull   VarKind = iota // no value
	VarBool                  // Bool is meaningful
	VarNumber                // Text is the canonical decimal string
	VarString                // Text is the string contents
	// VarJSON is a structured value (object or array). Text is its canonical
	// JSON encoding; it is re-parsed into a FEEL context/list when bound into an
	// evaluation. Kept as text so the durable record format is unchanged — a new
	// kind byte over the same length-prefixed Text (ADR-0009, ADR-0037).
	VarJSON
)