- F: Store::flush(now) with a no-op default; Node::flush(now) replaces
Node::store_mut. The caller's now anchors ages (fixes LogStore's stale
clock marker, F18).
- G: age_ms is documented as a lower bound. Robots are assumed to have a
trusted wall clock (RTC or GPS); LogStore adds power-off time on open
from a wall-clock flush marker. Unknown downtime expires held addressed
messages and floors held broadcasts' age at unknown_downtime_age_ms.
Hosts set observed_at.
- AGENTS.md: specs and plans change only to record decisions Kyle has
discussed and agreed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- README: custody chain and receipts replace epidemic forwarding; Ack
frame; running on a robot (host crates, current limits); security;
crate layout, constants and reading list.
- AGENTS.md: current spec list, receipt constraints and review focus
7-8, first_seq rule, constants, host crates and the ros2 gate.
- THREAT_MODEL.md: re-checked at 89041ea. F1, F2, F5, F17 fixed; F3
(single configured peer) and F4 partly fixed; new F18 (no scheduled
flush, stale clock marker).
- CHANGELOG: Unreleased section for the fleet milestone and fixes.
- tines-bt README: single-peer limit; manual BLE check not yet recorded.
- tines service rustdoc: oversized-frame behaviour, JSON tagging, clock.
- 1.0 spec: approved (2026-10-20), including §10 and the adversarial
fuzz mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kyle
