Core-1 Flow Preview

Status: normative preview; reducer, state machine, and durable journal implemented

C1-FLOW-001 — Surface. The canonical types are unforgeable Flow<Self>, FlowDefinition<Signature>, Activity<Signature>, FlowRun<Output,Error>, FlowOutcome<Output,Error>, and FlowEngine.

C1-FLOW-002 — Canonical history. History records runs, nodes, activity attempts, decisions, timers, signals, retries, cancellation, compensation, schemas, code epochs, and external-effect receipts. The contract is durable and replay-safe even when the first provider stores history in memory.

C1-FLOW-003 — Delivery and checkpoints. Activities are at-least-once unless checked deduplication or transactionally coupled authority strengthens them. Only owned Durable values cross checkpoints. Borrows, Txn, process capabilities, and address-dependent values reject. Dropping a local FlowRun handle does not cancel its run.

C1-FLOW-004 — Replay test. The simulator must serialize history, destroy all live process state, reload, and produce identical normalized next commands and outcomes.

C1-FLOW-005 — Executors. Preview conformance requires a pure history reducer and independent compiled resumable state machine. Stable Core-1 additionally requires an append-only file journal with framed checksummed records, durable commit before acknowledgement, atomic checkpoints, and kill/restart tests at every history/effect boundary.

The implemented source profile retains straight-line checked integer activity expressions as scalar signal regions and lowers Flow.activity definitions to a dedicated durable flow-history row. FlowEngine.start is a distinct checked algorithm boundary and requires live engine authority. Its reference reducer and compiled-machine evaluator return activity results to the orchestration boundary. The bounded recorded-activity adapter executes a polled scalar algorithm, state, or optimize source target whose domain and arity match the history command, then records its success or failure and any mandatory deduplication receipt through FlowEngine before returning. Tensor compute activities retain their explicit device boundary. Same-domain scalar calls with up to two arguments execute from local or package-linked regions under the common call-depth bound. Other unsupported source bodies remain unmaterialized.

The implemented source definition profile contains an acyclic ordered durable graph. Flow.activity records typed external work with an explicit durable node ID, schema version, maximum attempts, and deduplication policy. Flow.timer(id, duration) records a timer whose duration is a run input or a prior node result. Flow.signal(id, schema) records a typed signal wait; its received value becomes the node result. Nesting any value-producing durable node supplies its result as the input of the enclosing activity or timer; a direct parameter read remains a run input. Duplicate IDs, ordinary expressions between durable nodes, forward dependencies, and cycles reject. Both in-memory executors and the append-only file journal consume the same checked definition. ZLM2 round trips preserve kinds and dependencies, package closures relocate typed activity targets, and restart attachment verifies the definition/input digest recorded by the acknowledged start event before replay continues.

The file-journal provider exposes a non-reentrant durability hook for provider and conformance testing. Tests terminate child processes before, during, and after frame writes, after flush and fsync, and across checkpoint file fsync, rename, and parent-directory fsync. Recovery accepts only the last complete checksummed frame and never acknowledges an event before the journal fsync boundary.