Dispose the wave-6 class-1-window observations (release-contract-window-close)

The pre-release pass's last contract-text dispositions, each dated
in-place citing the 2026-10-11 close-out pass (ADR-017 §2's terminal
window):

- Publish→wake ordering tolerance: documented tolerance (decided with
  the user) — core-contract.md streams paragraph + delivery-obligations
  bullet, ADR-015 §4 companion annotation; the wake = offset-order
  ADR amendment declined (commit-ordered pg visibility; hint-shaped
  wake posture).
- ADR-023 §2: heartbeat(extend) and save_offset(offset) join the
  boundary/offset row (total — negatives well-defined), with the
  home rationale annotated; core-contract's domain paragraph
  mirrors; the backlog numeric-domain row registers the suite-duty
  follow-up.
- ADR-021 §5: EventReceiver::try_recv's closed shape pinned
  (Err(Closed), mirroring ADR-008 §3); core-contract subscribe arms
  sentence extended.
- get_job prose: core-contract queues section + queues.md's reads
  sentence now say the uniform id-global / get_job_tx-filtered split.
- Mem-arithmetic observation: no-action disposition recorded in the
  task Notes (byte-level transplants; equivalence suite-pinned
  three-way).

Suite stamps checked — no accumulation required (no cited § text
changed meaning). Docs-only; gates green: build, workspace tests,
clippy -D warnings, fmt, fuzz replay, rustdoc -D warnings,
taskgraph validate (79 tasks).
This commit is contained in:
glm-5.3-flash committed 2026-10-11 00:17:48 +00:00
1 parent 8e27f4b64b
commit a37c2887dc
6 files changed
+244 -31

No files matched your search

+106 -3
View File
@@ -1,7 +1,7 @@
---
id: release-contract-window-close
name: Class-1 window's last dispositions — the wave-6 recorded observations
status: pending
status: completed
depends_on: []
scope: moderate
risk: medium
@@ -92,8 +92,111 @@ accumulation.
## Notes
> To be filled by implementation agent
All five dispositions landed 2026-10-11 as dated in-place annotations
citing this pass (the pre-release class-1 close-out pass,
[ADR-017](../docs/architecture/decisions/017-contract-versioning.md)
§2's terminating window). Docs-only — no code change (item 1's
enforced-guarantee alternative was declined with the user, so no
follow-up code task spawns).
1. **Publish→wake ordering tolerance — decided with the user,
documented tolerance.** The two candidates were raised with the
user (2026-10-11) and the documented-tolerance posture was chosen
over the ADR amendment (wake order per stream = offset order) —
the amendment is arguably unachievable on Postgres while offsets
are sequence-assigned pre-commit (commit order inverts sequence
order; enforcement needs hole-filling/redesign) and contradicts
the wake mechanism's hint-shaped best-effort posture. Landed:
core-contract.md's streams section carries the tolerance paragraph
(the full text: the mem multithreaded-runtime shape, the pg
sequence/commit shape, the event-stays-in-the-log promise, the
consumer recipe — lagged checkpoints or direct `read_since` sweeps
below them), the delivery-guarantee obligations list carries the
consumer-obligation bullet, and ADR-015 §4 carries the dated
companion annotation (the ordering row pins *read* order only;
wake order unpinned).
2. **`heartbeat(extend)` + `save_offset(offset)` — both join the
ADR-023 §2 boundary/offset row**, annotated in place with the
home rationale: the duration row's rejection rationale never
applies (a non-positive `extend` is a relative instant like
`delay`, not a lease handout — a negative shortens/voids the
claim and the uniform validity predicate governs; the three
engines' arithmetic — `saturating_add`/SQL integer add — is total
over non-positive values, and the heartbeat reports `true` when
the row was processing and unexpired at call time), and
`save_offset`'s offset is literally an offset (negative stored,
reads resume forward, regressions are the ADR-019 §6 monotone
no-ops) — pinning rejection would have contradicted all three
engines. core-contract.md's numeric-domain paragraph mirrors the
extension. The verification-backlog numeric-domain row was
extended to register the suite-duty follow-up those two
classifications imply (their suite rows did not land here —
docs-only task); before release-readiness, the review-wave-8 gate
owns the audit.
3. **`EventReceiver::try_recv`'s closed shape — ADR-021 §5 dated
annotation**: `Err(Closed)` (terminal; the `None` arm's causes),
`Ok(None)` = idle, `Database` otherwise — mirroring
`WakeReceiver::try_recv` (ADR-008 §3). Home is §5 so one
normative section governs every receiver Err/close arm. Verified
uniform by code read (mem `stream.rs`, sqlite `stream.rs`, pg
`stream.rs` all map channel disconnect → `Err(Closed)`); core's
rustdoc carried the shape from landing; the mem suite pins it.
4. **`get_job` prose — core-contract.md's queues section now says
the uniform behavior**: id-global lookup on the handle (rows in
any queue), `get_job_tx(queue, job_id)` queue-filtered. queues.md's
reads sentence — which mischaracterized both as "name-taking pure
reads" — corrected in the same pass. Code read verified the
uniform shapes (mem `queue.rs`/`tx.rs`'s `merged_get_job`;
SQLite substrate `get_job(conn, id)` vs the tx path; pg). ADR-019
§1's "queue-scoped claim/maintenance ops" phrasing stands — it
names claim/maintenance ops only, and the corrected core-contract
text now disambiguates the neighborhood.
5. **Mem-arithmetic observation — no-action disposition, recorded**:
the mem copies are byte-level transplants of the SQLite
implementations (`resolution.rs`, `scheduler.rs`'s `@every`
parser and `skip_forward`); equivalence is suite-pinned three-way
(`backoff_curve_equivalence`, `enqueue_opts_resolution` green on
all three columns, re-verified this session). ADR-012 §2's
one-owner rule is satisfied exactly as written (mem owns its
modules; the suite is the honesty instrument) — no code or doc
change warranted; the record here is the disposition.
**Suite stamps checked** (the task's accumulation duty): no existing
row's cited § text changed meaning, so no stamp accumulates. The four
rows citing ADR-023 §2 (`extent_clamp_semantics`,
`duration_refusal_on_non_positive_ttl`, the enqueue-opts resolution
row, the backoff row) test classifications the amendments left
meaning-identical — rows were *added* to the §2 table and annotated,
existing cells' semantics untouched; the receiver-arms row citing
ADR-021 §5 tests `recv()`/`save_offset`/close arms the annotation
left verbatim. The two new classified behaviors' suite rows are the
registered follow-up (Notes 2).
## Summary
> To be filled on completion
`release-contract-window-close` completed 2026-10-11: all five
wave-6 recorded observations disposed as contract/ADR text with
dated annotations before ADR-017 §2's class-1 window terminates at
first release. Item 1 decided with the user — documented tolerance
for the publish→wake ordering observation, landed in core-contract.md
(streams tolerance paragraph + delivery-guarantee obligations bullet)
with the ADR-015 §4 companion annotation; the wake = offset-order ADR
amendment was presented and declined (unachievable against commit-
ordered pg visibility without redesign; contradictorily sharpen a
hint-shaped mechanism). Items 2–3: ADR-023 §2's boundary/offset row
gained `heartbeat(extend)` and `save_offset(offset)` (total —
negatives well-defined, with the homes' rationale annotated, the
core-contract domain paragraph mirrored, and the backlog numeric-
domain row registering the suite-duty follow-up); ADR-021 §5 gained
the `EventReceiver::try_recv` closed-shape annotation (`Err(Closed)`,
mirroring ADR-008 §3). Item 4: core-contract.md's `get_job` prose now
says the uniform id-global/`get_job_tx`-filtered split (queues.md's
mischaracterizing reads sentence corrected alongside). Item 5: the
mem-arithmetic observation's no-action disposition recorded above.
Suite-stamp accumulation checked — none required (no cited § text
changed meaning). Verified docs-only: `cargo build`, workspace tests
green (mem 102+25, SQLite 192+25, pg 125+25+9, core 25 — three-way
equivalence rows green), clippy `--all-targets -D warnings` clean,
`cargo fmt --check` clean, fuzz corpus replay green (6/6),
`RUSTDOCFLAGS="-D warnings" cargo doc --no-deps` zero warnings,
`taskgraph validate` green (79 tasks).