Glossary

This is the authoritative glossary: every official term in the architecture, defined once. The other pages introduce these terms in bold as the story reaches them; this is where you look any of them up.

Term	Definition
node	Edge process (--mode node); pulls and runs tasks and commands over interfaces; carries placement, heartbeat, bound credential.
node mode	The Storage Gateway’s placement-scoped write mode for node-driven ingest, between scoped and system: visibility is the node’s placement-derived visible_set, not all-visibility. See identity and access.
placement visible_set	The owners a node may write, derived from its materialized worklist (the owners of the tasks assigned to it). A node’s writes are confined to this set; an emitted owner outside it is an orphan / discovery candidate, never an authoritative write. See collection.
function	A trigger plus a DAG of steps, declared in a component template; the unit of edge collection. Triggered by a schedule (poll), incoming data (listen), or a command. See collection.
flow	A multi-step action (branching, parallel steps, waits); an escalation is the canonical case. See alarms and actions.
task	A node’s unit of collection: poll (we ask) or listen (we wait), over a stateless or stateful (session) interface. Content-addressed.
interface	A connection to a component, declared once per protocol; transport stateless or stateful (to a session).
interface_type	Protocol-and-style registry (ssh, http, snmp, mqtt, webhook…); built-flag + param schema.
session	A stateful interface’s live held-open connection; a current-state view over session_log.
collection.failed	The event emitted when a parse or validation rejects; carries the raw payload for diagnosis and backfill-after-fix. There is no stored telemetry table; raw is not otherwise persisted (a dev raw-mode taps it live).
raw_sample	An opt-in raw-retention policy, cascade-resolved on interface / task / template: off (default), all, or 1-in-N (sampled). Short TTL, range-partitioned and cold-tierable like metric partitions. The kept window is re-parsable against the immutable function version, so a corrected extractor re-derives it; outside the window a wrong-but-conforming parse is forward-fixable only. Bounded, sampled, short-lived: not a telemetry table. See collection.
datapoint	An observation: a key’s value on one owning entity at one time, with provenance + source + on-row lineage. Kinds: metric, state, log.
metric	Numeric (float8) datapoint. Continuous, aggregatable. The firehose.
state	Categorical/text/object datapoint. Discrete, dwell-measurable. Config is keyed to one as its observed side.
log_datapoint	A component’s own log lines; value = the line. A stream; also the holding pen for un-normalized occurrences.
kind	What a key is: metric, state, or log. Fixed per key at definition.
key	The identity of what is measured or asserted; registered in property_type.
canonical signal	A registered, owner-agnostic measurement name (power.state, not room.power); one comparable signal across every vendor.
owner / owner_kind	A datapoint/event/alarm’s subject, the exclusive-arc: owner_kind + the matching typed FK (component_id/system_id/location_id/node_id), or the singleton global (no FK), + CHECK.
property_type	Registry for datapoint keys: name, scope, kind, value_type, unit, fusion_policy, validation. scope (template / org / official) decides where the name is unique: (template_id, name) at template scope, name at org/official. Every datapoint is typed by one (the FK is non-null). Promotes template -> org -> official by re-scope/re-point.
canonical unit	The one unit a property_type stores in: stored values are always in it, so the firehose is single-unit and every threshold / calc / fusion compares like with like. Native unit is a collection-time fact (normalized in by the alignment value-transform), display unit a presentation fact (converted out on read); neither is stored. See datapoints.
unit registry	A unit registry grouped by family / dimension (temperature, data-size, bitrate…), each family one canonical unit plus alternates; each alternate carries a to_canonical / from_canonical transform, affine (factor + offset) or an Expr (the rare nonlinear case, dB). Official / org scoped. Drives both edge normalization and read-side display conversion. See datapoints.
convert(value, "<unit>")	The expression stdlib conversion fn: returns the value in a registered same-family unit (a compile error otherwise). Source unit inferred from the bound key’s canonical unit, target looked up in the unit registry, so convert(value, "fahrenheit") > 100 authors a threshold in F while storage stays C. Available wherever expressions run (event_rule / alarm criteria, calc leaves, list filters). See expressions.
scope	A key’s uniqueness-and-trust axis on property_type: template ((template_id, name), the template author’s, local), org (name within the deployment, the operator’s custom canonical), official (name globally, shipped with the distro). official = the top scope (folds in the prior official boolean).
template-scoped / org-scoped	A key minted at scope=template (local to one template, (template_id, name)) or scope=org (a deployment’s own canonical, unique by name). The promotion ladder lifts template -> org -> official.
event_type	Registry for event keys: name, display_name, payload_schema, scope. Supports the same template / org / official scope as property_type (a template can define a template-local event).
provenance	How we know a value: observed, calculated, intended. Per row. Declared intent is config.
observed	Measured from a component. On-row lineage: source_rule (+ version), the edge function.
calculated	Derived from other datapoints by a calc_rule. On-row lineage: source_rule (+ version), the calc_rule. Distinguished from observed by the provenance column.
intended	A command’s declared effect, pending reconciliation. Lineage: the command event_id. Only commands set it.
source	Which sensor/path produced an observed value; distinct from provenance; enables multi-source rows + fusion. A source registry carries default weights.
correlation_id (datapoint) / caused_by_event_id	Nullable trace columns on the datapoint tables, orthogonal to the exclusive-lineage CHECK (not lineage pointers). A command propagates its originating correlation_id onto the adaptive-poll’s observed datapoint, so the event_rule that fires off it inherits the id and the cycle-guard walk crosses the command -> device -> observed round trip. Distinct from the read-side correlation id trace. See datapoints.
perspectives	The source-tagged observed rows for one signal: multiple sources reporting one value, all preserved; a reduce-on-read policy produces the effective value, while every perspective stays queryable.
fusion_policy	Per-key reduce-on-read default/hint for multi-source observations (mode + tie-break + source weights), not a mandate: a policy may default from the type but can be source-weighted, per-instance, or left to read time (keep all perspectives, decide on read). Applied on read.
fusion	Reading one effective value from multiple perspectives on a signal: same-key multi-source reduces by a policy (read-time, defaulting from the key’s fusion_policy); cross-key/system-level = a calc_rule. Perspectives are always preserved.
config	The declared side of a canonical signal: an operator-set value keyed to a property_type, reconciled against the observed datapoint via the template’s get/set functions and a per-item reconcile policy. See config and credentials.
credential	An access secret with a structured shape, a pluggable SecretProvider (inline or external), and a lifecycle (refresh / rotation / expiry); read is secret:read-gated and every decrypt audited. Template-driven.
variable	A free interpolated value (a macro): $var:<name>, resolved platform→template→instance down the cascade; org-keyed, not signal-bound, no observed side.
drift	The gap between config’s declared value and its observed datapoint, on one signal key.
reconcile	Per-config item policy for drift, one of three modes: observe (record drift, no alarm), warn (alarm at warning severity), enforce (call the set function to converge, alarm on set failure). Adopting the observed value as declared is a separate one-shot import action, not a mode.
cascade	Resolves the effective config / variable value by folding bindings (things somebody decided): platform, component_template, system_template, then the location / system / component trees (weight-free, pure depth); most-specific (deepest) wins. Falls through to the type’s default when no rung bound anything. Type is not a layer (it resolves via a group filter); groups are placed by weight on the same specificity scale.
segmented precedence key	The cascade’s precedence comparator as a segmented / lexicographic key (segment_rank, depth, group_weight, creation_order), so a structural segment never overruns into another regardless of tree depth or stacked group weights. The presentation numbers (e.g. 0 / 100 / 300s / 400s) are presentation-only, not the comparison key. See cascade.
platform	The cascade’s least-specific binding tier, on both the estate axis (owner_kind = platform, no FK) and the settings axis (the platform level): what an admin set for the whole install. segment_rank 0. A write there needs platform:<action> on top of the resource permission. Distinct from the global estate owner, from a “platform credential” (a vendor account secret), and from the settings platform domain (a namespace classifier: a namespace only ever set at this level, never further down the principal axis, named after the level but not the same thing as it). See cascade.
default	What a value is when nobody bound it: a column on a declaration row (a setting’s struct tag, a classifier contract’s default_value on product_property and its siblings), beside the unit and the kind. Not a cascade tier: it shadows nothing, nothing shadows it, and the fold falls through to it. A kind with no declaration row has none (variable, secret, tag: absent means absent).
edge parse	A function parses a raw payload into datapoints on the node, the edge half of collection. There is no server-side transform rule.
calc_rule	datapoint(s) to datapoint (calculated): cross-key / system-level derivation. (Same-key multi-source reconcile is the key’s fusion_policy.)
event_rule	datapoint change to event: fire_criteria + optional clear_criteria (clear makes events alarm-paired). No separate alarm or condition rule. Still Design: an alarm today is raised by a caller, not by a rule. The rule declares the capabilities its alarm degrades; it carries no health impact of its own, since impact now lives on the system role (ADR-0050).
for_clear	A recovery sustain on an event_rule, mirroring the fire-side for: clear_criteria must hold for for_clear before the alarm resolves, so a source flapping at the cadence boundary does not churn open/clear. Default 0 (immediate). See alarms and actions.
action_rule	A subscription (Expr over events; alarms via edge events) wiring occurrences to actions.
identity binding	How a shared-API / multiplexed source’s emitted rows bind to the right owner: a value->owner index (property_type, value) -> owner (an identity arc on identity config), resolved in a cascade scope. Precedence: a declared identity config value wins, falling back to the observed identity datapoint sharing its key. See collection.
discovery_rule	observed data creates components/systems/locations + their identity config; carries the official boolean. Input is the orphan / unmatched stream (including out-of-placement labels), idempotent on re-discovery (re-seeing the same identity does not duplicate). See collection.
event	A discrete semantic occurrence the action layer reacts to. Keyed, point-in-time, owned via the arc. Not a datapoint.
origin	How an event arose: caught, caused, derived, scheduled.
alarm	One raised condition on a component: a stateful row with a severity (info / warning / critical), a message, a raised_at, and a nullable cleared_at. Clearing keeps the row, so what was wrong and when survives the fix. It reaches a system only through the capabilities it degrades (below). Not event-sourced. The ITSM anchor. Design: the open-to-close lifecycle driven by an event_rule’s paired events, and an alarm owned by a system, location, or node rather than a component.
alarm capability	The capabilities one alarm degrades (alarm_capability). The single route out of a component: a component that provides a capability but has it degraded does not satisfy a role requiring it. An alarm naming none is a note on the device that reaches no system.
dependency suppression	Muting a child alarm whose owner’s parent entity (on the exclusive-arc structural tree) is itself down, so one upstream failure does not emit N child pages. Expressible over the exclusive-arc tree. See alarms and actions.
action grouping	Coalescing alarms sharing owner / label / correlation_id into one action dispatch (one ticket, N members), so a storm is one notification, not N. See alarms and actions.
severity	An alarm’s alert importance, set to a severity level by id; distinct from health (a different axis). It drives the component’s own verdict (any active alarm degrades it, a critical one is an outage) and nothing above: what reaches a system is the degraded capability set. Rules and action_rule predicates compare by level (resolved via the level’s order).
severity level	A registry row: id, label, color, and an integer order (for comparison only). Official defaults ship spaced; an operator can add, relabel, or recolor. Carries the official boolean.
action	An ordered sequence of steps (notify, command, wait, branch). A single-step notify or command is the simple case; a multi-step shape (including remediate-verify-escalate) is a flow.
command	A run-action declaration in a component_template version (not a table); an instance is an action with kind=command.
disagree(A,B)	A condition operator comparing two provenances or sources of one key. Drift, config drift, conflict. Keeps the DAG.
divergence	Any two provenances or sources of one key that disagree. The universal anomaly signal.
lineage (on-row)	A derived row carries its own lineage; no execution table. The rule version is the backtest hinge.
correlation id	A read-side trace id threading one causal chain end to end: the originating event through every downstream event and action it caused (event -> alarm -> flow/action -> command). Built on the causation lineage; alarm_id links one alarm’s open/clear events, the correlation id links the whole chain. DX/observability sugar, not a datapoint kind or a stored span subsystem.
schedule	Config: a recurring definition (cron/rrule + IANA tz + what it triggers).
timer	The clock singleton’s pending-fire working set (schedule-tick / for-sustain / runbook-wait / watchdog); a Postgres table scanned by the leader-elected clock, each fire realized onto its lane; not history.
component	A deployed instance (device/app/service); owns datapoints; a variable-depth tree; pins a component_template_version; points at the product it is, the source of its shape.
product	The concrete SKU (Cisco Room Bar): binds a vendor, a driver, a kind, the capabilities it provides, and the property contract its instances carry. Carries the official boolean.
capability	A flat catalog name for what a component can do (microphone, flat-panel-display). Claimed by a product (the default for its instances) and by a component (its own facts over that default), and required by a system role. Carries the official boolean.
product_property	One line of a product’s declared-property contract: a catalog property, an optional default, and whether an instance must set it.
standard	The blueprint a system conforms to (Huddle Room, Classroom): the system-side counterpart of product, carrying variants (parent_standard_id) and the property contract its systems inherit. Optional on a system.
standard_property / location_type_property	The same contract line as product_property, declared by a standard for its systems and by a location type for its locations.
system role	A slot a system needs filled (a table microphone, a main display), declared on a standard (inherited live by every conforming system) or directly on one system (ad-hoc), on the same exclusive arc property uses. Carries a quorum, a required capability set, and an impact. Not an IAM role (below). See core entities.
role (disambiguation)	The word is overloaded, and the two senses never cross. A system role is a slot in a system, filled by a component (system_role, system_role_assignment, storage methods ListSystemRoles / SetSystemRole / DeleteSystemRole). An IAM role is a capability set granted to a principal (viewer / operator / admin / owner; the role table, ListRoles / UpsertRole, the /roles routes). A health_role was a third, narrower sense (how a member counts in its system’s health rollup), now superseded by the system role’s quorum and impact.
role capability	One line of what a system role requires (system_role_capability). The set is conjunctive: a component must provide every listed capability to fill the role. A role that requires nothing admits anything.
component capability	A component’s own capability fact (component_capability), layered over the ones its product declares: present=true adds one the product does not claim, present=false suppresses one it does. What lets a productless component be staffed while the assignment guard stays strict.
effective capabilities	What a component actually provides: its product’s capabilities, UNION its present=true facts, MINUS its present=false facts. The single definition of “what this component can do” platform-wide, and the set the assignment guard checks.
role assignment	The row that puts a component in a role in one system (system_role_assignment). Refused (422) when the component’s effective capabilities do not cover the role’s requirement, and the refusal names the missing capabilities. The component FK is on delete restrict: a component staffing a role cannot be deleted out from under the system.
quorum	How many components a system role wants filling it, at least one. Two readings ride it: staffing (a role with quorum 2 and one assignment is understaffed by one, on operator-entered data alone) and health (a role with fewer satisfying components than its quorum is impaired). It is also the redundancy knob: quorum 1 with two assigned tolerates one failure.
impact	What an impaired system role means for its system: outage, degraded, or none (a column on system_role, defaulting to degraded). It lives on the role, not the alarm or the component, because the same broken box matters differently depending on the slot it was filling: a dead confidence monitor is not a dead main display. The one input the health rollup takes from the declaration side.
impaired	A system role with fewer satisfying components than its quorum. A component satisfies a role only when it provides every required capability and none of those is currently degraded by an active alarm. An impaired role contributes its impact.
effective roles	The resolved read for one system: the roles its standard declares (from_standard) UNION those declared on it directly, each with its required capabilities, quorum, impact, assignments, and its served assigned / understaffed counts. A one-off system resolves only the ad-hoc arm.
property	A stored value for a property_type on one arc owner (the latest-value store, was property_value), tagged with its provenance (observed / calculated / intended / declared).
component_template / _version	The device shape (collection, commands, property_types, defaults, alarms); the immutable version instances pin.
system	A composition of components/subsystems (the service tree); pins a system_template_version; located at a location; conforms to an optional standard.
system_template / _version	The system shape; the immutable version is the snapshot instances pin. Carries a frozen BOM: per role, its requirement (required canonical datapoints + commands) + health_role. Still Design, and both halves are superseded by the built system_role (a capability set, a quorum, and an impact).
template signature / attestation	An optional author signature on a template_version, verified on import; authenticity (who authored it), distinct from the content-hash integrity (that it is unaltered). The hosted / marketplace path verifies signatures regardless of the self-host runtime stance. See templates.
capability manifest	A declaration on a template of which write-commands and credential shapes it exercises; shown and approved at :apply, and the gate behind which latest / channel auto-update for device-mutating templates requires an explicit operator re-pin. See templates.
role requirement	What a system_template_member declares for a role: the canonical datapoints and commands a member must provide (plus health_role). A component qualifies when its template aligns the required set; pairing filters to qualifiers and the API validates on assign. No allow-list of templates: declare what you need, any qualifying component fills it. Still Design: the requirement that is built today is a system role’s capability set, declared on a standard or a system rather than frozen into a template version. See templates and ADR-0049.
location	A place tree; classified by location_type; no template.
global	The singleton estate owner: the top owner above every location where estate-wide health and KPIs roll up. One per deployment, no FK. Ownership only, not a cascade tier (that is platform) and not a location (the location tree has N unparented tops and no root).
operational mode	A cascade-resolved entity state: active / maintenance / disabled. Maintenance keeps collecting but suppresses consequences (no action dispatch, no drift enforce, no health rollup impact, no SLA count); disabled is the same suppression but also stops collecting (the Zabbix host-disable). Maintenance is windowed and audited. See core entities.
decommission / purge	Delete is decommission by default (soft delete: tombstone, retain history, re-commissionable, in-flight cleanup); purge is the privileged hard erase. The cascade does not delete members: a system delete unbinds members, an occupied location delete is refused (re-home first), a node delete re-places its tasks. See core entities.
KPI	A shipped derived datapoint (a calc / SLI) owned at system / location / global: availability (health over time) and the utilization family (occupancy, time, booking, ghost). An official default set with an escape hatch.
SLI	Service Level Indicator: a time_in_state calc datapoint over a window (e.g. system.availability). See health.
SLO	Service Level Objective: the target config value the SLI must hold (availability >= 99.9%). See health.
SLA	Service Level Agreement: meeting the SLO, an event_rule firing on breach; compliance over the window is itself an SLI. See health.
tag	An operator key: value label. The key is a tenant-wide governed vocabulary (the tag registry; new keys need tag:create, autocompleted in the UI); values bind per entity (tag_binding) and resolve union on key, override on value down the cascade. See config and credentials.
group	A named set (component/system/location/principal), static or dynamic, weighted; a cascade overlay + access scope. A principal_group is the principal-subject case.
health	The first-class operational state of every entity, carried as a calculated state on the owner arc (source_rule = health-rollup): an alarm degrades a capability, a role missing one falls below quorum and is impaired, its impact sinks its system, and a location takes the worst of its systems. A model, not just a rule. See health.
verdict	One health value: healthy < degraded < outage, ordered so “worst” has a meaning. outage rather than down, because a device is down and a room has an outage. Distinct from severity (a different axis).
health transition	One recorded edge: the moment an owner’s verdict changed and what it changed to. Health is written transition-only on state, so its history is edges and only edges, which is what makes “when did this break” answerable weeks later. See health.
recompute at the write	The rule that a verdict is recomputed by every mutation that can change it (alarm raise / clear, assign / unassign, role declare / withdraw, quorum or impact change, component capability or product change, system create, standard change, relocation), in the same transaction. A read never writes: computing on read keeps no history, and writing through on read stamps the edge at the moment somebody looked. See health.
health impact	Superseded by impact on a system role (above). The design hung an optional down / degraded tag on an event_rule; an alarm now reaches a system only through the capabilities it degrades (ADR-0050).
health_role	Superseded by quorum plus impact on a system role. The design tagged a member required / redundant / informational on the system_template_member; the same three cases are quorum 1 with impact outage, a quorum below the number assigned, and impact none, with no fourth vocabulary. A third sense of “role” (see the disambiguation above).
health coverage / uncovered	Design. Whether any health-impacting rule resolves against an entity’s properties. Covered + none firing + data fresh resolves healthy; uncovered resolves unknown, not falsely green. See health.
unknown reason	Design. A discriminator carried as metadata on health unknown, leaving the ordered domain (healthy < degraded < outage, unknown off-order) unchanged: stale (had data, went stale), uncovered (no health-impacting rule resolves), no-data (covered but never reported). See health.
baseline reachability alarm	Design. A reachability alarm seeded per collected component (via the collection / template default), so a freshly-collected device is covered immediately and resolves unknown -> healthy/outage on first poll; bare unknown(uncovered) is then the rare honest “you have not told me what failure looks like” state. See health.
view	A named query returning a uniform {columns, rows}; the read side, executed through the scoped gateway.
Storage Gateway	The single door to the database; every read and write goes through it, and scope is injected here.
audit_log	Who-did-what ground truth; one row per operator write, same-tx; the lineage target for operator writes, including config changes.
session_log	Connection-lifecycle transitions (node-reported, diagnostic).
internal_log	Platform self-narration (startup, reconcile, migration, node-reg, config-sync).
ground truth	Immutable append-only records: log_datapoint, audit_log, session_log, internal_log.
principal / role / grant	IAM subject (kind human / service / node; identity is an opaque uuid, never a name); an RBAC capability set crossed with a scope. The base principal holds identity + kind only; a human’s display_name lives on the human per-kind table. A principal_group is a group of principals used as a grant subject. An AI tool acts via OAuth as a human / service principal (first-class agent identity is deferred, identity and access). See identity and access.
secret:read	The IAM permission to read a credential in plaintext; gated per role, and every decrypt is audited.
file / blob	Searchable metadata over content-addressed bytes (pgblobs/S3/disk); dedup.