Engineering notes

Six short notes on how the plane stays honest under reclaim, streaming races, admission, concurrent spend, cursed jobs, and one real Postgres gotcha. Skim before an interview or an ops incident — not a second copy of the architecture docs.

• 1 · Generation fencing — A stale runner cannot overwrite the winner after reclaim.
• 2 · Subscribe-before-enqueue — Listen on the event broker before dispatch so early tokens are not lost.
• 3 · createRunCtx / fail-closed serve — One admission funnel; production serve refuses an insecure posture.
• 4 · Poison pill / reclaim ceiling — Crash-loop jobs stop reclaiming after a hard max_retries ceiling.
• 5 · Optimistic spend holds — Reserve an estimate at create time so concurrent runs can't all pass a terminal-only budget check at once.
• 6 · The RLS grant that can't grant itself — A Postgres 16 circular-grant gotcha that only shows up on a non-superuser DSN.

Opening a note uses the long-form story layout (Product / Docs / Notes header). This index stays inside the Docs sidebar so handbook navigation does not vanish. Related: decision write-ups · public chapters · Ops