Third review round follow-through: enqueue_tx stamp source, sweep_expired handle form, with_tx signature, and B-block ambiguity pins
This commit is contained in:
glm-5.3-flash committed
1 parent
08dc1bf011
commit
83767e880b
11 files changed
+258
-101
No files matched your search
@@ -377,57 +377,6 @@ narrowed to the pinning work its own record already scoped.)*
|
||||
that removed the substrate's versioning surface), OQ-11 (the
|
||||
cherry-pick procedure governing the substrate-side non-events).
|
||||
|
||||
## Theme: Deployment and capabilities
|
||||
|
||||
### OQ-08: Where does the honest single-host/multi-host boundary live in the trait surface? *(== OQ-ST-08)* — **RESOLVED**
|
||||
|
||||
- **Origin**: [deployment.md](deployment.md)
|
||||
- **Status**: resolved (2026-10-06, Phase 1 —
|
||||
[ADR-016](decisions/016-deployment-honesty.md))
|
||||
- **Priority**: medium
|
||||
- **Resolution**: Pinned by
|
||||
[ADR-016](decisions/016-deployment-honesty.md): **no runtime
|
||||
capability surface — in v1 and by default ever**. The honest
|
||||
single-host/multi-host boundary lives in the two places it is
|
||||
already true, which compose rather than rival: (1)
|
||||
**compile-time engine identity** — the engine crate a binary
|
||||
depends on *is* the deployment statement (single-driver binaries,
|
||||
[ADR-001](decisions/001-crate-split.md); constructors in engine
|
||||
crates, [ADR-008](decisions/008-contract-v1-pinning.md) §6 —
|
||||
"the engine choice is a dependency-graph fact, not a runtime
|
||||
branch"); (2) **deployment.md's documented matrix** — the
|
||||
ops-facing facts of record, unchanged. Option 2
|
||||
(`Store::capabilities()`) rejected field-by-field under ADR-008
|
||||
§5's act-differently rule generalized to surface: host semantics
|
||||
admit no in-process action (a flag would invite the engine-type
|
||||
branch principle 4 bans); payload limits already have their runtime
|
||||
carriage — the universal, contract-wide matchable
|
||||
`PayloadTooLarge` variant (a `capabilities()` field would be a
|
||||
second normative home); wake cadence and knobs are engine-crate
|
||||
config (§6's split); and no consumer-inventory row names any
|
||||
runtime-adapt need. No `engine_name()`, no `#[cfg]` capability
|
||||
axes. The "must not pretend SQLite is multi-host" obligation
|
||||
resolves into three standing statements (contract text carries
|
||||
asymmetries via the taxonomy, engine-crate docs carry posture,
|
||||
deployment.md carries ops facts); the misconfiguration case
|
||||
(SQLite as shared network storage) follows the family's
|
||||
deployment-asserts-truth posture (alkblobs precedent) — documented
|
||||
boundary, no fabricated detection. Contract-suite row added:
|
||||
`PayloadTooLarge` occurrence asymmetry (pg client-side pre-round-
|
||||
trip, SQLite never) — with no capabilities API, the variant is the
|
||||
one runtime carriage of an engine asymmetry, so its matchability
|
||||
is pinned. Re-entry gate: a consumer-inventory row naming a
|
||||
runtime-adapt need.
|
||||
- **Cross-references**: OQ-04 (the pinning that parked this),
|
||||
OQ-10 (narrowed by this — no capability struct to govern), OQ-11,
|
||||
[ADR-001](decisions/001-crate-split.md),
|
||||
[ADR-006](decisions/006-wake-and-delivery-contract.md),
|
||||
[ADR-008](decisions/008-contract-v1-pinning.md) §1/§5/§6,
|
||||
[ADR-012](decisions/012-forked-substrate-design.md),
|
||||
[deployment.md](deployment.md).
|
||||
|
||||
|
||||
|
||||
## Theme: Core contract (Phase 1 review finds)
|
||||
|
||||
### OQ-12: Streams depth — key semantics, `StreamEvent` shape, ordering row, retention — **RESOLVED**
|
||||
@@ -512,8 +461,9 @@ narrowed to the pinning work its own record already scoped.)*
|
||||
like `store.outbox(name)` — `InvalidName`/`ReservedName`), derives
|
||||
the backing queue name `__alkstore_outbox:{outbox}` engine-side,
|
||||
and lands the job row in the caller's transaction with
|
||||
`EnqueueOpts` stamped per [ADR-010](decisions/010-queue-semantics-
|
||||
depth.md) §3a over the backing queue's derived `QueueOpts` —
|
||||
`EnqueueOpts` stamped per
|
||||
[ADR-010](decisions/010-queue-semantics-depth.md) §3a over the
|
||||
backing queue's derived `QueueOpts` —
|
||||
commit-atomic with the business write, rollback drops both (the
|
||||
no-ghosts property). The reserved-prefix rejection is unchanged: it
|
||||
governs directly-supplied names; the derivation is legitimate
|
||||
@@ -533,6 +483,55 @@ narrowed to the pinning work its own record already scoped.)*
|
||||
(outbox scope row), ADR-007/ADR-008 (the seam design), ADR-010 §3
|
||||
(the outbox's derived QueueOpts — unchanged by this).
|
||||
|
||||
## Theme: Deployment and capabilities
|
||||
|
||||
### OQ-08: Where does the honest single-host/multi-host boundary live in the trait surface? *(== OQ-ST-08)* — **RESOLVED**
|
||||
|
||||
- **Origin**: [deployment.md](deployment.md)
|
||||
- **Status**: resolved (2026-10-06, Phase 1 —
|
||||
[ADR-016](decisions/016-deployment-honesty.md))
|
||||
- **Priority**: medium
|
||||
- **Resolution**: Pinned by
|
||||
[ADR-016](decisions/016-deployment-honesty.md): **no runtime
|
||||
capability surface — in v1 and by default ever**. The honest
|
||||
single-host/multi-host boundary lives in the two places it is
|
||||
already true, which compose rather than rival: (1)
|
||||
**compile-time engine identity** — the engine crate a binary
|
||||
depends on *is* the deployment statement (single-driver binaries,
|
||||
[ADR-001](decisions/001-crate-split.md); constructors in engine
|
||||
crates, [ADR-008](decisions/008-contract-v1-pinning.md) §6 —
|
||||
"the engine choice is a dependency-graph fact, not a runtime
|
||||
branch"); (2) **deployment.md's documented matrix** — the
|
||||
ops-facing facts of record, unchanged. Option 2
|
||||
(`Store::capabilities()`) rejected field-by-field under ADR-008
|
||||
§5's act-differently rule generalized to surface: host semantics
|
||||
admit no in-process action (a flag would invite the engine-type
|
||||
branch principle 4 bans); payload limits already have their runtime
|
||||
carriage — the universal, contract-wide matchable
|
||||
`PayloadTooLarge` variant (a `capabilities()` field would be a
|
||||
second normative home); wake cadence and knobs are engine-crate
|
||||
config (§6's split); and no consumer-inventory row names any
|
||||
runtime-adapt need. No `engine_name()`, no `#[cfg]` capability
|
||||
axes. The "must not pretend SQLite is multi-host" obligation
|
||||
resolves into three standing statements (contract text carries
|
||||
asymmetries via the taxonomy, engine-crate docs carry posture,
|
||||
deployment.md carries ops facts); the misconfiguration case
|
||||
(SQLite as shared network storage) follows the family's
|
||||
deployment-asserts-truth posture (alkblobs precedent) — documented
|
||||
boundary, no fabricated detection. Contract-suite row added:
|
||||
`PayloadTooLarge` occurrence asymmetry (pg client-side pre-round-
|
||||
trip, SQLite never) — with no capabilities API, the variant is the
|
||||
one runtime carriage of an engine asymmetry, so its matchability
|
||||
is pinned. Re-entry gate: a consumer-inventory row naming a
|
||||
runtime-adapt need.
|
||||
- **Cross-references**: OQ-04 (the pinning that parked this),
|
||||
OQ-10 (narrowed by this — no capability struct to govern), OQ-11,
|
||||
[ADR-001](decisions/001-crate-split.md),
|
||||
[ADR-006](decisions/006-wake-and-delivery-contract.md),
|
||||
[ADR-008](decisions/008-contract-v1-pinning.md) §1/§5/§6,
|
||||
[ADR-012](decisions/012-forked-substrate-design.md),
|
||||
[deployment.md](deployment.md).
|
||||
|
||||
## Deferred / Blocked
|
||||
|
||||
None. **The open question set is empty** — every OQ above is resolved
|
||||
|
||||
Reference in new issue
Block a user