Conditions

Conditions are the operator’s stable machine interface. Evaluate the complete type, status and reason, and use observedGeneration to decide whether what you read describes the current spec.

Condition reasons says what every reason means. This page says which Conditions each kind publishes, which is what a consumer matching on one needs to know before it can wait for it. Messages are bounded diagnostic text and may become more detailed without an API version change; Events are the other diagnostic surface.

Three statuses are used. Unknown is not an error: it is the operator saying it has no current evidence, most often while a proof is outstanding or after a retired execution binding made the last evidence historical.

PtahSchema

Condition	What it says
Applying	True while the exact current plan is applying. False when no Apply is authorized – a contested realm, a realm that does not admit the resource, an unsupported engine, an uncertain outcome, a retired binding, or a completed Job whose convergence proof is pending.
ApprovalRequired	True while the current plan needs an approval bound to its fingerprint. False when policy does not require one for this plan, or refuses the plan outright, and when the database converged and left no plan to approve.
ArtifactResolved	True when the desired OCI reference resolved to immutable content. False when it could not be resolved. Unknown while a refresh is outstanding, or when the retained digest belongs to a retired execution binding.
ArtifactVerified	True when the artifact’s type and verification policy were satisfied. False when policy refused it, when resolved content is not verified yet, or when the policy changed under it.
DatabaseReachable	True when the target answered the last operation that opened it: an Observe, a Plan or an Apply. False when an operation’s result named why it could not open the target, with one reason per kind. Unknown for an unsupported engine, and when the retained observation belongs to a retired execution binding. It describes the last operation that reported on the target and not the target now: a failure that names no kind leaves it as it was, and so does suspending the resource.
DriftDetected	True when the authoritative managed scope differs from desired state, false when it has no changes. Unknown until drift is observed under the current execution binding.
EngineSupported	True when the selected engine has an implemented operator lifecycle. False when it does not, and then no plan is produced and no database is reached.
InSync	True when independent read-only planning proved convergence. False when the managed scope differs from the verified artifact, or newer desired inputs arrived after older work converged. Unknown while scoped planning, a source refresh or a restarted proof is outstanding.
PlanReady	True when exact plan bytes are stored in immutable chunks. False for each refusal that prevents a plan – an unverified artifact, a fenced table, a stale generation, a changed policy, a lost lock epoch. Unknown while source freshness is unestablished.
Ready	True when the schema is in sync. False carrying the reason that holds it, which is the field to read first.
ReconciliationFailed	True when an operation failed, carrying the failure text. False when the latest operation completed.
Suspended	True when the spec requests suspension and no new database operation may start. False when reconciliation is active.

DriftDetected and InSync answer for what the login can see.

PtahMigration

Condition	What it says
ApprovalRequired	True while a plan waits for the exact approval its policy requires. False when the requirements are satisfied, when the apply policy is Never, while the verification policy refuses the artifact, or while the realm is contested or does not admit the resource and nothing is approvable. A read past such a refusal leaves it False with the reason that ended it: OperationInProgress for a realm, from the claim of that read, or OperationFailed when that read fails before it is claimed, and PolicySatisfied, DigestPinned, CommitResolved or SnapshotTaken for the verification policy. A reading that publishes no plan leaves it False with the reason that reading wrote on Ready, such as HistoryMatched or HistoryDirty, so a plan that waited does not stay asked for once it is gone.
ArtifactVerified	True when the resolved artifact satisfied its verification policy. False when the policy refused it, with the requirements it found unmet. Unknown when it resolved to a digest and has not been verified yet.
Blocked	True for a history this artifact cannot continue, which the controller never resolves by writing to the database, and for an artifact its verification policy refused or a realm that does not admit the resource. False when the history continues the artifact, once a person’s acknowledgment settled a run nobody accounted for and the database is being read again, or once a realm admitted the resource, the artifact passed or the source changed after a refusal, with the reason that ended it, unless a run nobody accounted for still stands, which Blocked names again as ApplyOutcomeUnknown.
DatabaseReachable	True when the target answered the last operation that opened it: a history read, or an Apply that ran. False when an operation’s result named why it could not open the target, with one reason per kind. Unknown for an unsupported engine, and when the last reading belongs to a retired execution binding. It describes the last operation that reported on the target and not the target now: a failure that names no kind leaves it as it was, and so does suspending the resource.
Progressing	True while work is in flight, including the read-back that confirms what a run did. False when nothing is pending, when operations are suspended, when the apply policy is Never, or when an operation was retired because an execution component changed.
Ready	True when the history matches the artifact and nothing is pending. False carrying what holds it: an artifact the verification policy refused, a dirty or modified revision row, a migration out of order or ahead of the artifact, a plan awaiting approval, a lost lock epoch, or an Apply whose outcome a person has to establish. After a refusal ended it carries the reason that ended it until the history read answers.

PtahSchemaApproval

Condition	What it says
Accepted	True when the approval exactly matches the current immutable plan. False when it does not, carrying the reason it was refused.
Consumed	True when the exact plan was committed to one Apply Job dispatch. An approval is consumed once and is never reused.
Stale	True when the plan this approval was written for is no longer current, so it will not be consumed. An approval an Apply already consumed is marked too, by the read after that Apply, so Consumed says which of the two it is. False while the approved plan is current.

PtahMigrationApproval

Condition	What it says
Consumed	True when the approved plan was dispatched.
Stale	True when a read ended anywhere but the plan this approval names, the verification policy refused the artifact, or a run spent another approval of the same plan, so it will not be consumed even if that plan comes back. The reason says which: PlanNoLongerCurrent, PolicyRefused or SupersededApproval. One already consumed is left as it is.

A migration approval publishes only these. Whether it matches the plan is reported on the PtahMigration through ApprovalRequired rather than on the approval, so a consumer waiting for a decision watches the migration.

PtahMigrationRunAcknowledgment

Condition	What it says
Consumed	True when the acknowledgment settled the unresolved run it names. The migration records it by UID in status.resolvedRun.
Stale	True when the acknowledgment named a run the migration was not waiting on, so it settled nothing: a reading or another acknowledgment settled that run first, or it was never this migration’s.

PtahSchemaPlan

Condition	What it says
Ready	True when the plan’s immutable chunks are stored and verified. Approval and Apply both require it.

PtahMigrationPlan

None. A migration plan is an immutable artifact, and whether it is still the plan to apply is reported on the PtahMigration that published it.

A Job finished but its result is unavailable

With default durable delivery, a successful database operation and a stored result are separate facts. Check the runner’s bounded diagnostic message, the manager and certificate-rotator health, the result Service endpoints, network policy from the operation namespace, and result-record quota or admission refusals. Do not dump result records or credential Secrets into tickets: they can contain SQL and private keys.

Restoring receiver/API connectivity lets the original runner retry delivery within its bounds. It does not rerun SQL. If the Pod was lost before publishing, follow the resource’s unknown-outcome recovery and inspect database history; do not recreate the Apply Job to obtain a result. An acknowledged result remains readable after Pod/log removal and manager restart, provided its persistent records are intact. Increasing kubelet log retention cannot repair a missing durable receipt. See Backup and recovery.