@cc [owner:Yassimba] connection.interaction-boundary
Applies only to `DatasourceConnectionOpener.open` in `connection_opener.py`.

An opener denies interactive authentication by default. If the effective config requires interaction,
refuse before calling the driver unless this operation explicitly permits interaction.
A usable native cache does not bypass this rule, and refusal does not select another profile.

@cc [owner:Yassimba] connection.single-open-context
Applies only to `DatasourceConnectionOpener.open` in `connection_opener.py`.

One open operation uses the profile and environment captured by its single resolution and passes that
resulting config to the existing driver. Driver availability and local-file policy remain preconditions
for opening; timeout and time zone retain their existing meanings. The operation does not select another
profile or re-read another environment halfway through opening.

@cc [owner:Yassimba] connection.authentication-failure
Applies only to `DatasourceConnectionOpener.open` in `connection_opener.py`.

Authentication failure returns a safe, actionable error using the existing driver-fault boundary.
An expired native credential can require the caller to rerun; failure does not silently change profiles or
automatically replay completed Check Run work. Missing cache storage or blocked account policy is reported
without an unbounded retry or hidden credential store.

@cc [owner:Yassimba] connection.environment-scope
Applies only to `DatasourceConnectionOpener.resolve` in `connection_opener.py`.

Connection resolution reads this Project's .env values and overlays process environment values without changing os.environ.
Each later resolution can observe changed Project environment values without leaking values between Projects or openers.

@cc [owner:Yassimba] connection.secret-safe-failure
Applies only to `DatasourceConnectionOpener.resolve` in `connection_opener.py`.

Before a resolution result or failure reaches a host output channel, register every resolved effective secret it can expose through the existing SecretSink.
Diagnostics and exposed cause chains do not disclose resolved credentials, including when complete-model validation fails.

@cc [owner:Yassimba] run-history.result-work-atomic
Applies only to `RunAudit.save_dataset_result` in `ports.py` and its adapters.

The Dataset Result and any work the caller runs alongside it commit in one transaction.
When either fails, neither remains and the run stays RUNNING. The alongside work commits nothing itself.

@cc [owner:Yassimba] run-history.rebuilt-result-unflagged
Applies only to `RunAudit.finish_run` in `ports.py` and its adapters.

A Dataset Result that finishing rebuilds after a failed save records that its Row Flags were not recorded,
so a later flagged run does not start its window after that result.

@cc [owner:Yassimba,test:test_durable_completion_external_contract_at_commit_ack_seam_keeps_saved_flags_recorded] run-history.saved-result-wins
Applies only to `RunAudit.finish_run` in `ports.py` and its adapters.

A save can commit and then lose its acknowledgement. When a saved Dataset Result differs from the
finished result only in `flags_recorded`, the saved value wins, and `finish_run` gives back the
stored Run Result. Any other difference is a conflict and leaves the run RUNNING.

@cc [owner:Yassimba] run-history.open-changes-nothing
Applies only to `RunHistoryOpener.open` in `ports.py` and its adapters.

Opening a Run History store never creates, changes, or drops a database object, including Scratch Tables.
Only `migrate` changes tables; cleanup of Scratch Tables happens while staging Row Flags.

@cc [owner:Yassimba] row-flags.measurements-unchanged
Applies only to `run_dataset_checks` in `dataset_checks.py`.

A run with Row Flags gives the same measurements as the same run without them.
A failure to plan, stage, or record Row Flags adds one finding and never removes or changes a measurement.

@cc [owner:Yassimba] row-flags.one-scan
Applies only to `run_dataset_checks` in `dataset_checks.py`.

Each engine group of a Dataset with Row Flags runs the same engine statement as without them, plus
one keys statement.
The keys statement reads the source table one time, keeps only the rows that can change a Streak,
and never aggregates or sorts every row.
For an engine whose `flag_rows` gives a `VerdictRun`, the engine's rows statement carries the
key, and Run Execution adds no keys statement.

@cc [owner:Yassimba] run-execution.verdict-split
Applies only to `run_dataset_checks` in `dataset_checks.py`.

Each check of an engine group whose `flag_rows` gives a `VerdictRun` is measured once: by
`flag_rows` when `VerdictRun.checks` names it, otherwise by `CheckEngine.run`.

@cc [owner:Yassimba,test:test_collect_engine_isolation_workflow_retries_each_check_when_run_fails_first] check-engine.isolation
Applies only to `collect_engine`, `_collect_each_alone`, and `can_isolate` in `dataset_checks.py`.

When `run` raises before its first result, core calls `run((check,), context)` once for each
check alone, so one bad check does not hide its siblings. Core never calls `evaluate`
directly; for an engine that implements `evaluate`, the base `run` calls it. Core does not
retry after a timeout or after an AUTH, LOCK_HELD, TLS, or UNREACHABLE connection fault.

@cc [owner:Yassimba,test:test_run_planned_fires_once_before_any_engine_runs] run.one-entry
Applies only to `RunVerbs.check` in `turbine/core/app/runs.py`.

Every host runs checks through `runs.check`. `run_planned` fires once, before any engine runs.

@cc [owner:Yassimba,test:test_lookback_decision_table_at_cli_seam_reads_earlier_rows_and_judges_only_the_window] check-lookback.rows-are-never-judged
Applies only to `window.py` and `dataset_checks.py`.

A check with a `lookback` reads earlier rows than it judges. The rows it reads end where its
Check Window ends. They start a `lookback` duration before the start of that window, or have no
start for a `lookback` in rows. `rows_tested`, `rows_failed`, and the Flag Scope count only the
rows of the Check Window.

@cc [owner:Yassimba] check-window.only-from-the-request
Applies only to `window.py`.

The Check Window of a run comes only from `since` and `until` of the request. No earlier run
moves a bound, so the same request reads the same rows each time. An orchestrator gives the
period of each task.
