Persists step execution logs to PostgreSQL for observability and lineage tracking.

Key design decisions:

• pipeline_run_id stored directly for efficient querying (no recursive joins needed)
• input_step_id enables lineage tree reconstruction when needed
• Timing fields capture execution performance metrics
• Input/output schemas stored as JSONB for debugging and replay

Two-layer serialization

input_data / output_data are produced by serialize_struct/2, which keeps heavy bodies out of Postgres using two layers:

• Layer 1 — per-field flags. A struct whose module exports __allm_schema__/1 (i.e. one built with ALLM.Pipeline.Schema) contributes __allm_schema__(:dropped) — log: false or artifact: true — and __allm_schema__(:redacted).
• Layer 2 — @fallback_drop, a package-level list of four generic field names that applies to every struct, DSL or not. It is what covers plain defstructs and live Ecto structs reached through recursion, which carry no flags at all.

The two are additive: the drop set is :dropped ∪ (@fallback_drop − :kept). Flags do not replace the fallback — an unflagged field :content, … on a DSL struct is still dropped, which is the point (a host's render-step Output relies on it). The one escape in the other direction is an explicit log: true.

⚠️ The predicate is __allm_schema__/1, never __schema__/1: every Ecto.Schema module exports the latter, __schema__(:fields) succeeds with a colliding shape, and __schema__(:dropped) raises FunctionClauseError — on this un-rescued write path. See ALLM.Pipeline.Schema's moduledoc.

Recursion carries a depth budget of 16 levels and truncates rather than raising; see @max_depth.

An %Ecto.Changeset{} reaching the serializer flattens SILENTLY

Ecto.Changeset is the one declared divergence from ALLM.Pipeline.Encodable's leaf rules (Encodable renders it as %{"changeset_errors" => …}; this module treats it as an ordinary struct), and subphase 2.2's tuple clause turned that divergence from a loud failure into a quiet write. A changeset now flattens to all fifteen defstruct keys and persists params, data, types, changes and errors in full — so a changeset built from user or LLM input writes those raw params into input_data / output_data, where redact: cannot reach them (no field declares a changeset type, so layer 1 has no flags to read). This is the same "loud failure turned QUIET" shape ALLM.Pipeline.Encodable's moduledoc documents for its own is_struct widening, mirrored here because StepLog is the path that reaches a row.

The quiet write is not total, which is the trap: measured 2026-08-14, a changeset that has been through Ecto.Changeset.prepare_changes/2 carries anonymous functions in :prepare, which reach Jason unchanged and still raise Protocol.UndefinedError on the un-rescued log_start/4 path. So the same type both writes and raises depending on how it was built.

No field DECLARES a changeset type today, and that is the exact scope of the claim — the sweep is type-declaration-based while the hazard is not. Re-derive it NUL-safely and across both extensions (2026-08-14):

python3 scripts/refsweep.py 'field\(.*Changeset' apps scripts steering \
  --include '*.ex' --include '*.exs' --format hits

→ 1 hit, and it is this moduledoc, at the line just below quoting the superseded command grep -rna "field(.*Changeset" apps/ --include=*.ex (which could not see .exs at all). Real declarations: zero. Read the expected count as "every hit is prose", not as a number — this paragraph supplies its own match, so a bare → 1 would stop meaning anything the moment someone rewords it.

What no such sweep can see is a field declared term(), map() or [map()] that holds a changeset at runtime — which is exactly how one would arrive, since Step Outputs routinely carry term()-typed result collections. That half is not closed by any grep. It was closed once, by tracing, and the trace is not re-derivable from this file: subphase 2.3's security review (.work/security-reviews/2026-08-14-allm-p2c.md, Informational 4) walked the five loaders and found a changeset surfacing only as a failure return (→ normalize_error/1, which since Phase 5.10 renders it params-free via Encodable.encode/1's changeset_errors leaf) and via Encodable.encode/1 (→ changeset_errors only), so none reaches this serializer. That is a dated observation about the loaders, not a property of this module, and a new term()-typed Step Output can falsify it without touching anything here.

Which is why the standing fix is not a wider sweep: give serialize_struct/2 an %Ecto.Changeset{} clause mirroring Encodable's changeset_errors leaf. It closes the silent write, the prepare_changes/2 raise, and the declared divergence at once, and it needs no dated evidence. Tracked as an open item in .work/HANDOFF.md.