A missed rotation no longer strands a bucket-only sibling: the self-addressed chain drop - #118
Merged
Conversation
…ddressed chain drop Issue #110's strand, closed at the mechanism: a us-doc name-key rotation left a lagging bucket-only sibling reading the rotator's stale old-epoch manifest forever — the new epoch's objects sit under names only the new chain derives, and the chain lives in the very document those names gate. store_revoke on the us-doc now writes every non-revoked account device a sealed copy of the new chain at kp_location(us, member, member) — the K_p machinery self-addressed: one derivable location per member, any rotator writes it, payload sealed to the member's prekeys exactly like a grantee K_p. The S3 sibling pull probes its own drop before deriving any name and adopts a strictly longer chain (idempotent; chains only extend). The revoked member's drop is deleted beside its K_p. The rotator writes its own drop too — it may be the lagging sibling next time, resumed from a checkpoint predating somebody else's rotation. Drive neither writes nor probes drops, and the absence is the ruling: its store-revoke arm never rotates (names there are not access control), so a probe would bill every us pull for an object that cannot exist; the reading half is provider-neutral and the re-add is three lines per side if a trigger ever arrives. Gates: the recover battery grows act 9 — one pull across a missed rotation (epochs 2 to 3, profile and registry both current), the revoked kit's pickup AND drop gone as exactly two objects, with a runnable PM_NO_CHAIN_DROP negative control reproducing the strand; devstore row 67 asserts the same claim through the worker's own pull path against a pair that HAS crossed a revocation, retiring row 63's no-revocation constraint as historical; check/pair/resume green; SYNC.md carries the design amendment.
lannbot
enabled auto-merge
August 25, 2026 13:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #110.
The strand: a us-doc name-key rotation leaves a bucket-only lagging sibling reading the rotator's stale old-epoch manifest forever — the new epoch's objects sit under names only the new chain derives, and the chain lives in the very document those names gate. Kit revocation made it reachable from a sheet button.
The fix: the self-addressed chain drop —
store_revokeon the us-doc writes every non-revoked account device a sealed copy of the new chain atkp_location(us, member, member)(the K_p machinery pointed at itself: one derivable location per member, any rotator writes it, sealed to the member's prekeys exactly like a grantee K_p), and the S3 sibling pull probes its own drop before deriving any name, adopting a strictly longer chain. Revoked member's drop deleted beside its K_p. Concurrent rotators LWW the drop exactly as the chain register itself does — best-effort freshness channel, wire sync stays truth. Drive neither writes nor probes (its revoke arm never rotates, by its own ruling; the reading half is provider-neutral and a re-add is three lines per side).Gates: recover battery act 9 (one pull across a missed rotation, runnable
PM_NO_CHAIN_DROPnegative control reproducing the strand, revoked kit's pickup+drop gone as exactly two objects); devstore row 67 (same claim through the worker's pull path; row 63's no-revocation pair constraint retired as historical); check/pair/resume green; SYNC.md amended.Note: devstore rows 65/66 are left as a numbering gap for #117's unmerged rows — whichever PR merges second will need a trivial append-region conflict resolution in run.ts, handled at automerge time.
Automerge is armed.