Function check

Reads every stored entity of program, as an activation of the deploy would, and gives those the program would not run, with the cause of each: an entity whose rows a migration or a schema dies on, and an entity whose activation would suspend it. That covers work, project, the indexes and the topics on the stored state, the operations under way against the new work, and the unknown of an at-most-once operation. A suspended entity is checked as a resume would activate it.

Nothing is activated, held or written, so it runs on the database another version holds. On SQLite the client is opened readonly, since a writable client begins each transaction with BEGIN IMMEDIATE, which waits for the other version's steps even where it only reads (decision 0267). Each entity is read from a snapshot of its own, as inspect reads it, and at the caller's level within a transaction the caller left open. The entities are read by pages of their ids. So the check is a reading of a moment: an entity created while it runs is read or not by its id, and an operation under way that ends before the deploy fails nothing then.

limit, a non-negative integer, is how many failures each kind gives at most. renames are the launch's: the entities of each name renamed to the program's are read as the program's too, as the launch would rename them. A program that cannot run as written, a limit or renames the launch would refuse, and tables a migration of another release made are the caller's defect, as is what the runtime throws, a corrupted row included (decisions 0122, 0247). The program's functions run on live data, and must be pure, as they must anyway.