docs: make the queue reconstructible; durability a performance property
commit
2ea9761docs: make the queue reconstructible; durability a performance property
The set of pending obligations must be derivable from repository state alone, per the existing work-set formula in query.workset. An EventSink may lose queued events on crash as long as the composition root reconciles from repository state at startup; a durable queue is an optimization, not a correctness requirement.
feat: add receive.reconstructible requirement Assisted-by: Claude:claude-sonnet-5
Reviews
No reviews of this commit yet — record a verdict below.
Start a review
docs/spec/receive.adoc
@@ -95,6 +95,20 @@
state kept outside the repository.
--
+[role="requirement", id="receive.reconstructible"]
+.The Queue Is Reconstructible From Repository State
+--
+The set of pending obligations an `EventSink` enqueues MUST be derivable
+from repository state alone, per the work set defined in
+<<query.workset>>.
+An `EventSink` implementation MAY lose queued events on crash, provided
+the composition root reconciles obligations from repository state at
+startup before serving further pushes.
+A durable queue MUST be treated as a performance optimization, never a
+correctness requirement; the dedup key in <<receive.dedup>> is unchanged
+by reconciliation.
+--
+
[role="requirement", id="receive.redaction-admin-only"]
.Redaction Records Are Admin-Only
--