runner v0.23.0

Runner v0.23.0: a stored profile the current form refuses no longer stops the store from opening; it is set aside, kept byte for byte, reported, and never bound. Set-level failures and configured profiles still refuse to start.

What an operator must do

• Nothing, unless v0.22.0 refused to open your store (registered input profile "<id>" is refused: …). Upgrade: the store opens, and the named profile is set aside. Every other registered profile works as before.
• What you then see. One line per set-aside profile on standard error at start (runner: the registered input profile "<id>" is set aside, kept and never bound: <reason>), and the profile in GET /v1/input-profiles with "state": "set-aside" and its reason. Any job, run, preview, import or trigger that names it is refused as 422 input_profile_set_aside, naming the profile. A run queued before the upgrade ends failed without starting, with reason profile-set-aside. The profile's id stays taken, and it still counts toward the bound of 16.
• To move a job on, upgrade it to a release that does not name the profile. Cancel its occurrences left needs-attention and pause its triggers first, as any upgrade requires. The job's earlier runs and exports stay served; verify-run given that profile still reads them as input-malformed.
• A Gateway connection configured for a set-aside profile refuses to start, naming the profile. Remove it or point it at another profile; the connection comes from the installation's own configuration.
• Configured profiles are unchanged. One the form refuses still refuses to start (configured input profile "<id>" is refused: …); edit the configuration.
• Under the Desk, you see neither signal until a binding is refused: the Desk reads the listing's entries as ordinary profiles until judgment-pack-desk#480 lands.

A stored profile the form refuses is set aside (#156, closes #154)

• At open, a registered profile that admission refuses on its own is set aside: kept, reported, never bound. The others load. Set-level failures still refuse to open the store: a row over its storage bound, unreadable, or holding an element that is not a profile in its exact form (null and {} included); more than 16 stored profiles, or more than 16 with the configured ones; an id stored twice; a stored profile with the id of a configured profile of another definition.
• A set-aside profile's stored bytes never change. A registration rewrites the row from the stored bytes, in order, with the new profile appended; registering the set-aside id again is 409 input_profile_conflict; a registration that would push the row past its storage bound is 422 input_profile_limit.
• GET /v1/input-profiles lists each set-aside profile after the installed ones, with its digest, state and reason; the items are oneOf InstalledInputProfile and the new SetAsideInputProfile, and installations with no set-aside profile get unchanged bytes. The run's reason enum gains profile-set-aside, and the error input_profile_set_aside is documented.
• Wherever the Runner resolves the installation's profiles, every id the input names is checked first: input and release previews, /v1/inputs/next, occurrence preparation, background acquisition, trigger readiness, Gateway mappings, job creation and upgrade, and run submission. Repeating the creation of a job made before the upgrade returns the job, and an identical retry of a mapping run keeps its original acceptance; an identical retry of an import run is refused.
• The offline verifier is unchanged: verify-run --profiles and verify-preparation still read a refused profile as input-malformed, as the specification does.

Verification

CI ran formatting, vet, the race tests and the real-Runtime integration tests on Linux and macOS at the pull request's head and again at the tag, against Runtime 09206e7 (released as v0.34.0).

• #156: one clean-room round by Claude Opus over a Claude Opus build, recorded on the pull request; the same vendor at the maintainer's direction while the OpenAI reviewer was unavailable, so not a cross-vendor review. It found no way to bind a set-aside profile on any production path and confirmed the stored bytes survive a registration and a reopen. Its three MEDIUM and three LOW findings were all fixed before merge: two surviving mutants (the row rewritten through a struct; the registration bound check removed) each got a test; a null or {} row element now refuses to open the store; job creation stays idempotent across the upgrade; a dead workflow method was dropped; words. Mutation checks: the builder's nineteen and four on the fixes, each caught; the coordinator reproduced the row-element one.

See releasing for how a download is verified.