This is a systematic reference for the on-disk/on-wire shape of the event log: the envelope every codec wraps a fact in, and every payload type the log can carry. For the concepts behind event sourcing in jaque, see Event sourcing instead.

1. The envelope

Every persisted event is a Payload plus the fields the log itself owns: the Envelope.

Field Type Meaning
Version int Envelope version, bumped only for envelope-shape changes. Currently 2.
Seq uint64 Assigned by the transport on append; 0 until then.
Epoch uint64 The membership epoch the appending engine held at append time.
Writer string The member id of the appending engine; empty for a standalone engine, the notifier and the reload service.
Payload Payload The domain fact itself: one of the types in section 2.

The default codec frames the envelope, payload included, as one JSON object per line:

{"v":2,"type":"state_changed","seq":42,"epoch":1,"writer":"engine-1","object_id":"web1/http","occurred_at":"2026-08-04T10:00:00Z","data":{...}}

The keys are short and snake_case: v, type, seq, epoch (omitted when zero), writer (omitted when empty), object_id, occurred_at, data. This is a public contract read by jq and by ClickHouse rather than internal struct field names leaking through a serializer's defaults. type is the wire discriminator; a codec other than JSON is free to use a different discriminator shape (an integer tag, a protobuf oneof). Nothing above is JSON-specific except the object itself.

2. Payload types

One row per payload type, transcribed from the implementation. Every payload implements ObjectID() and OccurredAt(); ObjectID() is empty for the two reload events, which are not about one object.

Type Wire type Emitted when Key fields
StateChanged state_changed Status, Type, Attempt, or Flapping changed on an object. ID, From State, To State, At
ReachabilityChanged reachability_changed Once per object the reachability graph marks affected when a host goes down or comes back up. ID, Reachable bool, At
CheckExecuted check_executed Every completed check. Result CheckResult, Origin (active/passive/stale)
NotificationRequested notification_requested Before any delivery attempt: the intent to notify is durable before the attempt exists. ID, NotificationID, Kind NotifyKind, Level, Contacts []string, At
NotificationSent notification_sent Delivery for a prior NotificationRequested succeeds. ID, NotificationID, Contact, At
NotificationFailed notification_failed A delivery attempt for a prior NotificationRequested fails. ID, NotificationID, Contact, Attempt, Err string, Terminal bool, At
AcknowledgementSet acknowledgement_set Operator runs ACKNOWLEDGE_HOST_PROBLEM/ACKNOWLEDGE_SVC_PROBLEM. ID, Author, Comment, Sticky bool, At
AcknowledgementCleared acknowledgement_cleared Operator runs REMOVE_HOST_ACKNOWLEDGEMENT/REMOVE_SVC_ACKNOWLEDGEMENT. ID, Author, At
DowntimeScheduled downtime_scheduled Operator schedules a fixed downtime. ID, DowntimeID string, Author, Comment, Start, End, At
FlexibleDowntimeScheduled flexible_downtime_scheduled Operator schedules a flexible downtime. ID, DowntimeID string, Author, Comment, Start, End, Duration, At
TriggeredDowntimeScheduled triggered_downtime_scheduled Operator schedules a triggered downtime. ID, DowntimeID string, By string, Author, Comment, Start, End, At
DowntimeStarted downtime_started A downtime actually takes effect: a fixed downtime's start timer fires, a flexible downtime's object enters a problem status inside its window, or a triggered downtime's trigger takes effect. ID, DowntimeID string, At, Until
DowntimeCancelled downtime_cancelled Operator runs DEL_HOST_DOWNTIME/DEL_SVC_DOWNTIME, or a triggered downtime's trigger is cancelled. ID, DowntimeID string, Author string, At
ConfigReloaded config_reloaded A SIGHUP-triggered reload applies successfully. Added, Removed, Changed, Unchanged int, Generation string, At (no ID)
ConfigReloadRejected config_reload_rejected A SIGHUP-triggered reload fails validation; the old config keeps running. Err string, At (no ID)
ObjectRetired object_retired A reload removes an object from the config. ID, At
HandlerExecuted handler_executed An event handler ran, or failed to expand, for a state change. Never folded: replay and every projection ignore it. ID, Handler string, Trigger HandlerTrigger, Result CheckResult
ProgramToggleSet program_toggle_set Operator flips one program-wide switch: active checks per kind, flap detection, event handlers. Toggle, Enabled bool, Author, At (no ID)
ObjectToggleSet object_toggle_set Operator flips one of those same switches for one object. ID, Toggle, Enabled bool, Author, At

3. Why the archive is readable without jaque

Every field above is a plain string, number, bool, or timestamp. There is no opaque blob and no jaque-internal type leaking onto the wire, and the codec is the only thing that knows how to turn a Payload into bytes, so the shape above is the format rather than an approximation of it. That is what lets the archive sink hand its zstd-compressed JSON lines to jq, ClickHouse, or DuckDB directly: reading the log back never requires running jaque or linking against its code, only knowing the table above.

4. Security considerations

The event log, -events-out, -snapshot-out and the archive all carry the same plaintext payload fields listed in section 2. There is no field-level encryption or redaction in the codec. Comment on AcknowledgementSet, DowntimeScheduled, FlexibleDowntimeScheduled and TriggeredDowntimeScheduled, and Err on NotificationFailed and ConfigReloadRejected, are free-form operator-supplied or upstream-error strings: avoid putting a credential in an acknowledgement comment or a check command's error output, because it will be written to the log, to any configured archive sink, and to whatever reads the archive downstream. Author on the acknowledgement and downtime events is whatever the command API caller supplied and is not an authenticated identity beyond the -api-token bearer check on CommandService (see CLI flags, section 10, and Command and query service). It is an audit label rather than a verified principal.