Skip to content

docs(implementation): deleted-parent and role-revocation parity caveat - #18

Merged
enmand merged 3 commits into
mainfrom
docs/deleted-parent-parity-caveat
Sep 13, 2026
Merged

enmand merged 3 commits into
mainfrom
docs/deleted-parent-parity-caveat

Conversation

@enmand

@enmand enmand commented Sep 13, 2026 •

Copy link
Copy Markdown
Contributor

What

Documents a parity caveat discovered while implementing #221's parent verification: a parent-bearing child whose parent has been deleted is a permanent dead letter, and replicas holding the same valid messages can converge to different Record state. Role revocation has the same shape.

Why it matters

  • Current Enbox (and Rust after #221 PR A) resolves a parent by its current, not-deleted state. A delete is terminal.
  • A child delivered after the parent's delete is rejected as a missing parent; repair can never succeed.
  • An earlier-delivered child is admitted and a later soft delete does not cascade to it.
  • This conflicts with DWN-REC-004 read as a global admission guarantee.

Contents

Adds a "Known parity caveat" section to implementation/dependency-resolution.md covering:

  • the arrival-order consequence and the DWN-REC-004 conflict (parents and role revocation);
  • why the timestamp-relative alternative is rejected (messageTimestamp is author-controlled, so an author could backdate a child past the parent's delete; late tombstones also prevent convergence on their own);
  • the chosen interim behaviour: the client-facing reply stays generic, and the receiver classifies a tombstoned parent as terminal (Invalid) locally, which does not restore convergence but avoids a tombstone-existence oracle;
  • an explicit Open decision block for the convergence mechanism.

Notes

This is documentation only. It does not change normative DWN semantics; it records current Enbox parity, the Rust interim classification, and the unresolved decision.

Update: ADR 0007 added

This PR now also records the decision as decisions/0007-retained-parent-ancestry.md and updates decisions/README.md, implementation/dependency-resolution.md, and DWN-REC-004 accordingly.

…y caveat

Parent lookup is current-state and deletes are terminal, so a child delivered after its parent's delete is a permanent dead letter and replicas can diverge. Documents the arrival-order consequence, why a timestamp-relative fix is rejected (author-controlled messageTimestamp), the interim missing-vs-tombstoned classification, and the open convergence decision.
Refines the deleted-parent caveat: the client-facing reply does not distinguish a tombstoned parent from one that has not arrived; the receiver classifies it terminal locally, which avoids a tombstone-existence oracle.
Structural parent existence is evaluated against the parent's retained initial write, not its current liveness. A soft delete does not remove ancestry or seal children; prune removes ancestry and is terminal. Records the decision, the rejected alternatives, and the Enbox/dwn-spec divergence follow-ups.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant