Journal posture

Journal posture is the fast health view for BMO’s Journal subsystem. It tells you whether the Journal read path is available, correctly partitioned, and recently healthy without loading or rendering a session’s narrative entries.

It complements, rather than replaces:

/journal and bmo journal export for session-specific dated narrative
Journal annotations for operator-authored notes on specific entries

What it reports

Every surface reads the same journal.PostureSnapshot, which includes:

state and available
whether the runtime is shared-capable
whether a mesh partition is bound
the hashed partition identifier when present
the recent journal.fired / journal.action ring size, capacity, and saturation
an action × outcome histogram over recent Journal operations
capture timestamps plus oldest/newest event timestamps when the ring is non-empty

The built-in posture builder currently emits:

State	Meaning
`disabled`	Journal-backed storage is not available in this runtime.
`up`	Journal posture is available and, when needed, correctly partition-bound.
`degraded`	The runtime is shared-capable but not partition-bound, so posture is surfaced as unavailable instead of risking cross-tenant reads.

Operator surfaces

Surface	Purpose
`bmo config show-journal` (`--format=text\|json`)	Headless posture summary for scripts, terminals, and support workflows
`/journal-status` (`/journal_status`)	Inline posture report in the TUI transcript
`GET /v1/posture/journal`	Auth-gated HTTP view of the same JSON snapshot
`bmo_get_journal_posture`	MCP parity surface for cross-process agents
`/journal` and `bmo journal export`	Session narrative and export surfaces; use these when you need entries rather than posture

All four posture surfaces share the same read model and metadata-only envelope. They do not stream entry bodies, tool output, or raw identifiers.

Partition discipline

Journal posture exists partly to make the fail-closed partition rule obvious before an operator hits a session export path.

When BMO runs in a shared-capable runtime, options.mesh.partition_id must be set. If the runtime is shared but not partition-bound:

state becomes degraded
available becomes false
the posture still reports ring and partition metadata so the operator can see why the Journal is unavailable

This matches the Journal topic’s broader rule that shared runtimes must not serve cross-tenant Journal reads.

Recent-event ring and redaction

Journal posture includes a process-local recent-event ring with fixed capacity 16. Each record is metadata only:

event kind (journal.fired or journal.action)
hashed session or partition identifiers
scope and source labels
bounded action, outcome, reason, result-count, and latency metadata

Raw session IDs, partition IDs, entry bodies, prompt text, and annotation text do not enter the posture surface.

When to use it

Use bmo config show-journal --format=json in scripts or support tooling.
Use /journal-status when the TUI operator needs a quick Journal health check without leaving the conversation.
Use GET /v1/posture/journal for service-level diagnostics.
Use bmo_get_journal_posture when an MCP-connected agent needs the same posture envelope a human operator would see.