Module probe_failures 

Per-(rollout, host) typed denormalization of enforce-mode probe failures. Source of truth is event_log (canonical, append-only); this table is a derived projection providing the indexed columns the compliance-wave gate needs cheaply.

RFC-0007 §7.2 shape:

• event_log_seq — FK back to the source event_log row
• rollout_id — gate aggregates per rollout
• host_id — gate aggregates per host
• probe_name — operator-facing probe identifier
• control_id — set for evidence-kind sub-result rows; NULL for non-evidence enforce-mode probe failures
• framework — set for evidence sub-result rows; NULL otherwise
• observed_at — agent-supplied observation timestamp

Indexed on (rollout_id, host_id, control_id) so the compliance-wave gate’s distinct-control count query is cheap.

Phase 9a state (stub)

The schema lands in this commit. The writer side (single-transaction co-write from the applier’s RemoteAppendEventLog handler on enforce-mode ProbeResult { status = Fail } events) lands in 9b. Until then the table is unwritten and every projection returns the empty map — outstanding_failing_enforce_probes_by_rollout exposes the SHAPE that 9b will fill with data.

Structs

ProbeFailureInsert

One probe_failures row insert. Borrowed for ergonomics — the applier’s hot path passes references off the inbound payload.

ProbeFailures