Seal the event catalog
Each durable event kind has a portable name, a positive schema version, bounded canonical JSON, and a stable mapper identity. Sealing validates the complete catalog before any payload can enter a typed reducer.
- kind
- Stable application-owned event identity
- version
- Exact schema version carried by the envelope
- mapper
- Deterministic value-to-type admission identity
- limits
- Bounded kinds, payload bytes, depth, and remembered determinism pairs
Upcast only adjacent versions
A v1 payload reaches v3 only through explicit v1-to-v2 and v2-to-v3 edges. Gaps, cross-kind edges, duplicate steps, nondeterministic output, or an upcast beyond the current schema fail while the catalog is sealed.
task.created/v1 --title-to-priority/1--> task.created/v2
task.created/v2 --priority-to-origin/1--> task.created/v3Bind snapshot identity
A projection snapshot binds the exact event content head, sealed schema-set digest, reducer identity, codec identity and configuration, canonical state bytes, and snapshot format. Its SHA-256 protects integrity; it does not establish remote authority.
Restore fail closed
- 01
Verify
Decode bounded bytes and verify the snapshot digest and format
- 02
Match
Require the exact current schema, reducer, codec, and content-head contract
- 03
Replay
Apply only the exact contiguous tail after the captured cursor
- 04
Compare
Prove snapshot-tail and genesis replay produce identical canonical state