5cc8660f
docs: M16-a record — both deletions, and the readoption design lands where the commit body pointed
a73x 2026-08-13 06:58
Commit message
docs/decisions.md
| Old | New | ||
|---|---|---|---|
| @@ -1729,10 +1729,11 @@ represent**, and rows 7 and 18 are branches **no fixture can reach**. | |||
| 1729 | reading, not from a failing sample — **no spurious contradiction | 1729 | reading, not from a failing sample — **no spurious contradiction |
| 1730 | actually occurred** in this milestone, and the raw-mode expiry | 1730 | actually occurred** in this milestone, and the raw-mode expiry |
| 1731 | behaviour was proven correct by the styled leg. It touches the retired | 1731 | behaviour was proven correct by the styled leg. It touches the retired |
| 1732 | repaint list and the ordering of the poll loop, so it needs its own | 1732 | repaint list *(deleted in M16-a — see that section; a design pass here |
| 1733 | design pass rather than a patch; it is plausibly the same territory as | 1733 | would need to restore it)* and the ordering of the poll loop, so it |
| 1734 | M9's banked input-ack item, which remains the proper fix if spurious | 1734 | needs its own design pass rather than a patch; it is plausibly the same |
| 1735 | contradiction ever does appear. | 1735 | territory as M9's banked input-ack item, which remains the proper fix |
| 1736 | if spurious contradiction ever does appear. | ||
| 1736 | - **ASAN or valgrind over the QUIC tests** — carried from M9 unchanged, | 1737 | - **ASAN or valgrind over the QUIC tests** — carried from M9 unchanged, |
| 1737 | and unchanged is the point: this campaign was an e2e mutation campaign | 1738 | and unchanged is the point: this campaign was an e2e mutation campaign |
| 1738 | and says nothing about use-after-free. M9's two reasoned-not-pinned | 1739 | and says nothing about use-after-free. M9's two reasoned-not-pinned |
| @@ -2817,3 +2818,41 @@ session epoch, blocking per-client writes, hand-rolled wire format). | |||
| 2817 | *(M6 closed the first two of those three and put the protocol on a real | 2818 | *(M6 closed the first two of those three and put the protocol on a real |
| 2818 | WAN link; the hand-rolled wire format stands, and its tripwire has still | 2819 | WAN link; the hand-rolled wire format stands, and its tripwire has still |
| 2819 | not tripped. See the M6 section and its transport verdict.)* | 2820 | not tripped. See the M6 section and its transport verdict.)* |
| 2821 | |||
| 2822 | ## 2026-08-13 (M16-a — two adopt-or-delete rulings, both delete) | ||
| 2823 | |||
| 2824 | The first two issues filed in the new git-collab tracker, closed the | ||
| 2825 | same day (a3848ce2 → 9db679f, cf18fe67 → 3d4e3f0). Both were "the code | ||
| 2826 | offers something the product doesn't use," and both rulings were delete. | ||
| 2827 | |||
| 2828 | - **`Pty.write`** had zero production callers — the daemon writes the | ||
| 2829 | master fd through `proto.writeAllFd` at both of its sites — and | ||
| 2830 | survived M15's `Pty.read` deletion only because four of pty.zig's own | ||
| 2831 | tests called it: an abstraction kept alive exclusively by its own test | ||
| 2832 | suite. The tests now write `std.posix.write(pty.master, …)`, | ||
| 2833 | byte-identical to the deleted body, and so drive the pty the way | ||
| 2834 | production does. | ||
| 2835 | - **`predict.zig`'s retired channel** (`retired`/`retiredCount`/ | ||
| 2836 | `retiredAt`) was designed as a targeted-rollback repaint list and read | ||
| 2837 | by nobody: on contradiction the client full-repaints, a rollback that | ||
| 2838 | is certainly right on a path M9's design works to make rare. Deleted | ||
| 2839 | with its three self-tests (none of the judging surface leaned on the | ||
| 2840 | recording — the STOP-and-check that established this found the brief | ||
| 2841 | had undercounted the channel's pins, one vs three, without the | ||
| 2842 | protective condition being realized). | ||
| 2843 | |||
| 2844 | **The readoption record, stated here because the design's only prose | ||
| 2845 | home was the doc comment the deletion removed** (the commit body said | ||
| 2846 | "survives in decisions.md M9", which the review found does not resolve — | ||
| 2847 | M9 banks the input-ack trigger but never described this mechanism): | ||
| 2848 | `reconcile` retired confirmed-or-contradicted predictions into a list | ||
| 2849 | the caller could repaint cell-by-cell instead of in full; and `expire`'s | ||
| 2850 | no-op pass deliberately did NOT clear that list, because the idle path | ||
| 2851 | runs between a reconcile and the repaint its list describes — clearing | ||
| 2852 | on a quiet pass would silently empty the list and leave confirmed | ||
| 2853 | predictions underlined with nothing to say which cells to fix. A | ||
| 2854 | readopter restores the mechanism, that rule, and the rule's test | ||
| 2855 | together; the trigger remains M9's banked input-ack item. | ||
| 2856 | |||
| 2857 | Process note: both issues closed through `git collab` with sha-naming | ||
| 2858 | comments — the tracker's first full lifecycle. | ||
docs/roadmap.md
| Old | New | ||
|---|---|---|---|
| @@ -198,11 +198,14 @@ next one that arrives outranks all of it. | |||
| 198 | is spelled three times and the tie between the copies is prose only. | 198 | is spelled three times and the tie between the copies is prose only. |
| 199 | - **Fold `Transport`'s `alloc`/`qout` into the `.quic` `Link` payload** — | 199 | - **Fold `Transport`'s `alloc`/`qout` into the `.quic` `Link` payload** — |
| 200 | deletes the struct's one remaining `undefined`. | 200 | deletes the struct's one remaining `undefined`. |
| 201 | - **`Pty.write` is dead in production** — adopt or delete. | 201 | - ~~**`Pty.write` is dead in production**~~ — deleted (M16-a, 9db679f); |
| 202 | pty.zig's tests now drive the master fd the way production does. | ||
| 202 | - **e2e scenario-naming legibility** — a scenario can die *unnamed*, | 203 | - **e2e scenario-naming legibility** — a scenario can die *unnamed*, |
| 203 | because under `set -eu` a failing client pipeline kills the script | 204 | because under `set -eu` a failing client pipeline kills the script |
| 204 | before its own `FAIL` line prints (decisions.md, M15, finding 7). | 205 | before its own `FAIL` line prints (decisions.md, M15, finding 7). |
| 205 | - **`predict.zig`'s retired channel** — adopt or delete. | 206 | - ~~**`predict.zig`'s retired channel**~~ — deleted (M16-a, 3d4e3f0); |
| 207 | full-repaint rollback is the adopted design, and the readoption record | ||
| 208 | (design + the expire-does-not-clear rule) is in decisions.md M16-a. | ||
| 206 | - **`keyRefusalBody`'s e2e coverage** — the announce-none path pins it | 209 | - **`keyRefusalBody`'s e2e coverage** — the announce-none path pins it |
| 207 | only loosely; M15's regrade caught that mutant on unit pins alone. | 210 | only loosely; M15's regrade caught that mutant on unit pins alone. |
| 208 | - **First-backoff tuning**: a reconnect after a tear can pay a 200ms–2s | 211 | - **First-backoff tuning**: a reconnect after a tear can pay a 200ms–2s |