Persistence

Persistence in this chapter is a non-normative host-owned example, not an AnswerUp database schema. The host is responsible for durable storage, retention, access control, encryption, backups, recovery, and tenant isolation.

Minimum record categories

A host record should preserve proposal and evidence provenance, grounded referent, authorization decision and policy revision, operation/effect/execution/attempt identities, dispatch-boundary observation, provider acknowledgment, verifier observations, finality decision, original and reconciled outcomes, claim permission, timestamps, schema version, and supersession or terminal status. Store references and bounded redactions rather than raw credentials or unrestricted provider payloads.

Recovery boundary

Operational logs and Trace are not the authoritative business database. A durable action record is host-owned and should be sufficient to investigate an ambiguous result without assuming that a private in-memory handle survives process loss. The current package evidence does not provide a proven restart-safe persistence or exactly-once implementation, so recovery after process loss remains an integration and operator decision. Never use persistence as permission to blindly redispatch an unresolved effect.