Persistence

Persistence in this chapter is a non-normative host-owned example, not an AnswerUp database schema. The host is responsible for durable storage, retention, access control, encryption, backups, recovery, and tenant isolation.

Minimum record categories

A host record should preserve proposal and evidence provenance, grounded referent, authorization decision and policy revision, operation/effect/execution/attempt identities, dispatch-boundary observation, provider acknowledgment, verifier observations, finality decision, original and reconciled outcomes, claim permission, timestamps, schema version, and supersession or terminal status. Store references and bounded redactions rather than raw credentials or unrestricted provider payloads.

Recovery boundary

Operational logs and Trace are not the authoritative business database. A durable action record is host-owned and should be sufficient to investigate an ambiguous result without assuming that a private in-memory handle survives process loss. The current package evidence does not provide a proven restart-safe persistence or exactly-once implementation, so recovery after process loss remains an integration and operator decision. Never use persistence as permission to blindly redispatch an unresolved effect.

ProtectedActionStore is a design-level host contract and is not automatically wired to Runtime durable recovery. The host must explicitly map its lifecycle record and immutable original UNKNOWN to a closed DurableRecoveryRecordV2, independently retained authority and source digest, an atomic CAS commit, and the related reconciliation result. The package does not automatically persist, schedule recovery, acquire authority, or integrate the store. Actions preview.8 also returns an empty privacy-safe Trace envelope by design; retain bounded host-owned identities, observation categories, result relations, and dispatch/mutation/verifier/redispatch counters without raw payloads, credentials, callbacks, or private handles.