Events

kubectl describe ptahschema orders prints these under the status, and they are the fastest way to see what the operator has just done. They are diagnostic text: read them to understand, and match on Conditions to decide. Condition reasons is the interface for deciding, and says why.

An Event is recorded on the resource a person would look at, which is not always the one the operator was working on: an approval that went stale carries the Event, because that is the object whose author has to act.

Event messages are bounded. A failure long enough to be truncated is recorded in full on the resource’s own status and in the operation’s Job.

Result reads use the transport recorded on the Job. With the default durable delivery, the controller reads PtahResultRecord objects through the Kubernetes API. Check API availability and the manager’s read permissions when those reads fail. Logs and termination summaries cannot replace a missing durable receipt. The log-loss window and summary fallback apply only to legacy result reads.

Reason	Type	Recorded on	What it says
AdmissionSnapshotRefreshed	Normal	PtahSchema, PtahMigration	A claim that had not dispatched found the Pod template it would dispatch different from the one its admission snapshot recorded, usually because a new manager release took over. The claim stands, and the snapshot is resolved again before its Job is created. This happens once per claim; a template that changes again retires the claim.
ApplyOutcomeUnknown	Warning	PtahSchema	An Apply ended with no proof of whether it changed the database, so a read-only observation starts to establish what happened.
ApprovalAccepted	Normal	PtahSchema	An authenticated approval was accepted for the current immutable plan.
ApprovalRequired	Normal	PtahSchema	The current immutable plan needs an approval before anything applies it.
ApprovalRevoked	Warning	PtahSchema	The recorded approval became invalid before the Apply Job was created, so no Job was created.
ApprovalStale	Warning	PtahSchemaApproval	This approval no longer matches the plan it was written for, and will not be consumed.
ArtifactVerificationRefused	Warning	PtahSchema	Verification refused the resolved artifact, so no plan is produced from it.
ExecutionBindingChanged	Warning	PtahSchema, PtahMigration	The execution binding the evidence was produced under was retired: the executor image, the Ptah version, the runner protocol or the controller-state version changed. A schema closes the approval boundary and refreshes read-only; a migration discards the operation claim. A manager release that changes none of them records no such Event.
LeaseContinuityLost	Warning	PtahSchema	Database lock ownership was not continuous, so the result it covered is discarded and the proof restarts.
MigrationJobCleanupDeferred	Warning	PtahMigration	A Job’s cleanup could not be scheduled, so the Job keeps its own deadline rather than relying on one.
MigrationRunFinished	Normal or Warning	PtahMigration	An Apply finished and the message names what it did. The type follows the outcome: Applied and UpToDate are Normal, and Failed, Partial and Unknown are Warnings.
MigrationRunUncertain	Warning	PtahMigration	A migration run ended without establishing what it committed, and the resource records that until something resolves it.
OperationCompleted	Normal	PtahSchema	An operation finished and its result was accepted.
OperationFailed	Warning	PtahSchema, PtahMigration	An operation failed. The message carries the failure.
OperationRetried	Warning	PtahMigration	An attempt failed and another will follow. The message names the attempt number.
OperationStarted	Normal	PtahSchema, PtahMigration	A Job was created for the named operation.
PlanPublicationRefused	Warning	PtahSchema	The API server refused to store the plan a Plan operation computed, and the message carries the refusal: an admission policy or webhook, a quota, RBAC, or the object’s size. The Plan runs again after the failure interval, so a policy or quota that stops refusing lets the next plan through.
PlanStale	Warning	PtahSchema	The plan stopped matching what it was computed against, so nothing applies it.
PodAdmissionRefused	Warning	PtahSchema, PtahMigration	The Job controller could not create the operation Pod because the API server refused it, and the message carries the refusal: a policy the namespace runs, a mutating admission whose change the operator’s own Pod webhook refused, a quota. The Job keeps its deadline and the Job controller keeps trying; declare what the Pod has to carry in spec.execution.podMetadata, or change the policy. Execution says what a Pod may carry.
ProtectedTableRefused	Warning	PtahSchema	A plan would change a table spec.policy.protectedTables fences off, so no plan is published.
ReadRequested	Normal	PtahSchema, PtahMigration	A read request was answered, and the read the interval would have started starts now instead.
ReadRequestInvalid	Warning	PtahSchema, PtahMigration	The operator.ptah.run/read-requested-at annotation holds a value that is not an RFC 3339 instant, which the message names. It is recorded as answered and starts nothing, so this is said once; set an instant to ask for a read. Reading again on request has the rules.
ResultCredentialFailed	Warning	PtahSchema, PtahMigration	Issuing the operation-bound delivery credential failed and will be retried. Check receiver trust readiness, the enrollment policy, and admission refusals. The runner waits for its credential before executing.
ResultReadFailed	Warning	PtahSchema, PtahMigration	Reading an operation’s result failed and will be retried. The message identifies the failed read; check the Job’s result transport before investigating storage or container logs.
ResultReadTimedOut	Warning	PtahSchema, PtahMigration	Reading an operation’s result exceeded its time bound and will be retried. This can affect either durable result storage or legacy container-log reads.
RunnerProtocolMismatch	Warning	PtahSchema, PtahMigration	The runner from execution.runnerImage speaks another protocol than this manager and refused the Job before starting the executor. A read-only operation is tried again after the failure interval; an Apply still owes its read-only proof.
SourceSnapshotRetirementFailed	Warning	PtahSchema, PtahMigration	A snapshot of an earlier ConfigMap source that nothing names any more could not be deleted. Nothing reads it, and the next resolution of the source, whatever its kind, deletes it. The message carries the API server’s refusal.
TargetLockReleaseOwed	Warning	PtahMigration	The database lock was not released, and the release the claim owes will be retried.
TerminationSummaryRefused	Warning	PtahMigration	A legacy Apply’s log held no readable result, and the summary in its Pod’s termination message was not read in its place. The message says why: another attempt, a summary cut short, or a log that holds a different frame. The run is recorded as unknown.
UnresolvedRunAcknowledged	Normal	PtahMigration	A person’s PtahMigrationRunAcknowledgment settled the run this resource recorded as unresolved. The message names who, the outcome and the operation, and the resource reads its database again before it plans.
UnresolvedRunDiscarded	Warning	PtahMigration	Deleting this resource discarded the record of a run nobody accounted for. The message names the outcome, the version, and the database.
UnresolvedRunRestored	Warning	PtahMigration	The resource came back without the record of a run nobody accounted for in its status – a restore that dropped status – and the manager put it back from the copy in its operator.ptah.run/unresolved-run annotation. Nothing is planned until a reading or an acknowledgment settles it.
VerificationPolicyInvalidated	Warning	PtahSchema	The verification policy stopped matching the plan, so artifact and plan verification were invalidated.

A Warning is not always a fault

Most of these say the operator refused to proceed, which is the behavior they are there for: ProtectedTableRefused, ApprovalRevoked and PlanStale are each a decision not to change a database on evidence that no longer holds.

The ones that ask for a person are MigrationRunUncertain, ApplyOutcomeUnknown and TargetLockReleaseOwed: each says something about the database is not yet established, and each has a page saying what settles it – the mutation lifecycle for the first two, and Operations for the lock.