RuntimeHandler.catalogProjectOnOutbox

Consumed document

A Firestore trigger has no client request. The fields below are read from the created document the platform delivers; the handler re-verifies authority from server-written state and never trusts the delivered payload.

Response schema

Promise<void>; outcome PROJECTED | WITHDRAWN | SKIPPED_DUPLICATE | SKIPPED_TYPE | REFUSED recorded in catalogProjections/{outboxId}

States, consistency and recovery

State path

DOCUMENT_CREATED → TYPE_FILTER → RECEIPT_COMPARE_AND_SET → SERVER_STATE_REVERIFICATION → PROJECTED_OR_WITHDRAWN → REFUSED_WITH_OPERATOR_SIGNAL → EXECUTION_FAILURE_LOGGED

Reads

the outbox row, its catalogProjections receipt, the listing, the organization, the existing experience and at most 366 availability days, all inside one transaction

Writes

experiences/{slug}, searchProjection/{slug}, the catalogProjections/{outboxId} receipt and an audit row; a refusal writes outbox/catalog-refused-{id} instead

Transaction

one Firestore transaction: receipt compare-and-set, re-verification of server-written state, then the catalogue writes

Idempotency

outbox document id through the catalogProjections receipt; a redelivery is SKIPPED_DUPLICATE and rewrites nothing

Concurrency

receipt compare-and-set inside the projection transaction

Retry/replay

at-least-once delivery is safe; retry is disabled (retry: false) and refusals are signalled rather than retried

Rate limits

Platform trigger only; there is no public caller quota.

Audit

traveler_trigger metric with outcome, outbox id and latency plus a catalogProject audit row; never listing copy

Error contract

No public error envelope; a row that does not re-verify is REFUSED with a durable catalog.projection_refused outbox signal and trigger retry is disabled, so nothing is looped or guessed. Never treat an unknown error as success.

No public error code is exposed by this managed trigger.

Producer test references

Evidence tier: SEMANTIC_CORE_REFERENCE.

Reviewer-mapped semantic/core references

• functions/test/catalog-projection-source-anchors.test.js
  • catalogProjectOnOutbox is a us-west4 Firestore v2 create trigger on outbox/{id}, retry off, no HTTP surface
  • projection.ts never marks an outbox row dispatched and never updates the row it consumed
  • projectOutboxEvent ignores every non-catalogue event before touching the store
  • the projection takes its availability badge from the capacity ledger (WP-03) and carries no copy of the rule
• functions/test/recovery-catalog-projection.test.js
  • S1.a CORE: listing.published projects experiences/{slug} with exactly the §3.1 keys, remainingCapacity 5, serviceDate, startsAt in UTC
  • S1.b CORE: replaying the same outbox id is SKIPPED_DUPLICATE — nothing is rewritten
  • S1.c CORE: DRAFT listing / slug mismatch / unverified org / payouts disabled are REFUSED with one signal each and no catalogue write
  • S1.c2 CORE: an inconsistent availability day (held+booked > capacity) is refused, never clamped
  • S1.c3 CORE: a listing with no future capacity projects as SOLD_OUT with serviceDate null (honest, not invented)
  • S1.d CORE: listing.review_required withdraws — search doc gone, SOLD_OUT / IN_REVIEW / withdrawnAt, remainingCapacity untouched
  • S1.e CORE: re-publication re-projects the same slug (withdrawnAt cleared, PUBLISHED, new version)
  • S2.e WIRING: an outbox listing.published row written through the Admin SDK is projected by catalogProjectOnOutbox within 15 s
  • S2.4 JOURNEY: listingPublish -> outbox listing.published -> catalogProjectOnOutbox -> experiences/{slug} (polled <= 15 s)
  • S2.6 JOURNEY: listingUpdate on the live listing -> listing.review_required -> trigger withdraws (search gone, SOLD_OUT)

Each cited test name is checked against the referenced file by the documentation suite, so a renamed or removed producer test breaks this page instead of leaving a stale claim.

Protocol or inventory references

• functions/test/estate-service-inventory.js
• functions/test/recovery-traveler-journey.test.js

These references prove export, wrapper or protocol behavior only. They are not counted as complete operation semantics.

Example availability

NOT_PUBLIC_TRANSPORT: This handler is provider- or platform-invoked and has no public client invocation.