docs: pin custody count bound (lifetime + max_count) in addressed-delivery spec

This commit is contained in:
2026-10-18 01:19:40 -07:00
parent 0e737e3f4c
commit 720835de2f
@@ -113,6 +113,11 @@ computes its current age with the existing machinery
per hop (each relay re-encodes the age-adjusted observation), so a lifetime per hop (each relay re-encodes the age-adjusted observation), so a lifetime
measured from observation is consistent across every carrier. measured from observation is consistent across every carrier.
Lifetime bounds *time*, not *count*: a node's custody is additionally bounded by
the store's `max_count` trim — when retained addressed messages exceed the cap,
the oldest are dropped. Together, lifetime + `max_count` bound custody memory in
both dimensions.
## Cancellation ## Cancellation
A node that is done with a message — the recipient, or a carrier that no longer A node that is done with a message — the recipient, or a carrier that no longer
@@ -124,7 +129,8 @@ network.
**Kyle decided:** `to` is part of identity (content ID); multi-hop epidemic **Kyle decided:** `to` is part of identity (content ID); multi-hop epidemic
forwarding; lifetime (per-message, time-based) rather than hop-count; best-effort forwarding; lifetime (per-message, time-based) rather than hop-count; best-effort
with no ack; local-drop cancellation; "about" stays the topic; `observer` is with no ack; local-drop cancellation; "about" stays the topic; `observer` is
"from whom." "from whom"; custody retention is bounded by lifetime plus the store's
`max_count` trim.
**My calls** (the builder-check surfaced five open questions; all resolved below **My calls** (the builder-check surfaced five open questions; all resolved below
without needing further input — none changed a Kyle decision): without needing further input — none changed a Kyle decision):