kyle/tines
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(spec): amend decision G — plain wall time at open, derived marker wall time

Browse Source
This commit is contained in:
kyle
2026-10-20 01:39:10 -07:00
parent 9558917b70
commit 2d9d549815
1 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/specs/2026-10-18-tines-1-0-design.md
+20 -8
View File
@@ -616,16 +616,24 @@ the new `Observation` encoding. There is no migration:
that names the fix (delete the log). Silently misparsing an old log is that names the fix (delete the log). Silently misparsing an old log is
not allowed. not allowed.
- **Ages across downtime (decision G).** The same format bump adds a - **Ages across downtime (decision G).** The same format bump adds a
wall-clock reading to the clock marker `flush` writes: the host's trusted wall-clock reading to the clock marker `flush` writes: the trusted wall
wall time in milliseconds since the Unix epoch, or none. time in milliseconds since the Unix epoch.
- `LogStore::open` takes the host's current trusted wall time, - **A host doesn't open the store until it has a trusted time source**
`Option<u64>`. The host passes `None` if its clock isn't trusted, for (Kyle, 2026-10-20), for example an RTC it trusts or a GPS fix. Until
example a dead RTC battery with no GPS fix yet. then the robot runs no tines. That's acceptable because sharing is
- **Downtime known:** both readings are present and now ≥ the marker. opportunistic. `LogStore::open` therefore takes the trusted wall time
as a plain `u64` (ms since the Unix epoch), not an `Option`.
- **The marker's wall time is derived, not passed in.** `flush(now)`
keeps its `Tick`-only signature (decision F). `LogStore` records the
wall time and tick at `open`, and each clock marker carries
`wall_at_open + (now − tick_at_open)`. Because the store is never open
without trusted time, every marker this format writes has a wall time.
- **Downtime known:** the log has a marker with a wall time, and the wall
time at open is ≥ it.
`open` adds `now − marker` to every held observation's age, `open` adds `now − marker` to every held observation's age,
saturating, on top of the tick fold it already does. saturating, on top of the tick fold it already does.
- **Downtime unknown:** either reading is missing, or the clock went - **Downtime unknown:** the log has no clock marker (the previous run
backwards. `open` treats every held **addressed** observation as never flushed), or the wall clock went backwards. `open` treats every held **addressed** observation as
expired: its age is set past `lifetime_ms`, so core never delivers or expired: its age is set past `lifetime_ms`, so core never delivers or
forwards it, and `open` reports the count once. A custodian that can't forwards it, and `open` reports the count once. A custodian that can't
tell how long it slept must not deliver a directive that may have tell how long it slept must not deliver a directive that may have
@@ -774,6 +782,10 @@ The review's other fixes are applied too:
for robots that sleep through charge cycles. for robots that sleep through charge cycles.
- Stores add power-off time on open, using a wall-clock reading in the - Stores add power-off time on open, using a wall-clock reading in the
flush marker. flush marker.
- Hosts don't open the store until they have a trusted time source, so
`LogStore::open` takes a plain `u64` wall time. The marker's wall time
is derived from the wall time and tick at open, so `Store::flush(now)`
stays `Tick`-only.
- When downtime can't be known, held addressed messages are expired: - When downtime can't be known, held addressed messages are expired:
possibly delivering an expired directive is worse than possibly possibly delivering an expired directive is worse than possibly
dropping a valid one, since sharing is opportunistic. dropping a valid one, since sharing is opportunistic.