From 10a6b00c624081d3cc3d958bda637a679a1df8ab Mon Sep 17 00:00:00 2001 From: McHerpes Date: Sun, 25 Oct 2026 23:32:00 +0000 Subject: [PATCH 1/2] spec(relay): propose exclusive local ordering [H23-H30] Signed-off-by: McHerpes --- SPEC.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/SPEC.md b/SPEC.md index c34db459f..64e44e481 100644 --- a/SPEC.md +++ b/SPEC.md @@ -231,6 +231,15 @@ Statuses: approved = decided · draft = proposed · pending = open question · f - H21 [draft, aim] A linked board reads and moves locally whether or not the relay answers: every move returns at once and is sent when the relay is reachable, and a conflict found on sync is refused loudly naming the winner (revises H10 for #1013). | gate: test/relay-local-first.test.js - H22 [draft, aim] A linked board stays linked: the person signs in once per machine, and only relay off or a revoke unlinks it. | gate: review +- H23 [draft, must] An opted-in exclusive board has one durable local ordering owner, shared by its concurrent workers. Within that delegation, claims and other permitted local moves commit without the relay, GitHub or a Git remote; their result is final, not provisional outbox work. This mode revises H3/H10/H16/E2, not the default relay-ordered mode. | gate: review +- H24 [draft, must] An authorized worker may nominate a leader within the person's enabled exclusive scope. Nomination grants no authority: the existing board authority first settles pending moves, records the owner and generation, and fences every other machine from ordering moves. A quiet relay, fewer permissions or a timeout never establishes exclusivity. | gate: review | serves: H23 +- H25 [draft, must] While exclusive, other machines may read or send requests to the owner, not make competing claims. Local workers retain their own identities, lanes and verification rules; a new worker, clone or paired device cannot inherit the ordering grant by copying repository configuration. | gate: review | serves: H23 +- H26 [draft, must] Exclusive moves and their audit records survive process or machine restart before success is returned. Reconnection sends the retained order and move identities without loss, duplicates or renumbering; partial delivery and lost acknowledgements do not undo a local commit. A full or unwritable journal refuses the next move rather than discarding one. | gate: review | serves: H23 +- H27 [draft, must] Leadership handover fences the old owner and settles its committed tail before another owner orders work. A crashed or unreachable owner is not replaced on elapsed time alone; if fencing cannot be established, replacement waits rather than creating two authorities. Existing local work is not stopped merely because the relay is unreachable. | gate: review | serves: H24 +- H28 [draft, must] Exclusive offline rights come from the recorded delegation, not stale remote permission checks. Local revocation applies immediately; remote revocation applies to local work when observed, with no promise of immediate offline revocation. Remote operations still require current permission. Revoking or replacing the ordering owner must satisfy H27; this is an explicit exclusive-mode qualification of H8/E5. | gate: review | serves: H23 +- H29 [draft, aim] Exclusive replication coalesces pending uploads into bounded ordered batches, initially within five seconds of the oldest unsent move while healthy. More writes do not postpone that flush; a full batch or explicit flush sends earlier, idle boards send nothing, and only acknowledged records are retired. Local commits never wait for the batch or network. | gate: review | serves: H26 +- H30 [draft, must] Exclusive-mode acceptance exercises competing nominations, concurrent local claims, a partitioned non-owner, restart with unsent work, partial or lost acknowledgements, revocation and fenced handover. Batch acceptance also measures requests for a fixed burst and idle period, preserves every record and tests the oldest-record delay. Neither buffering nor nominal configuration proves exclusive authority. | gate: review | serves: H23,H29 + ## E · Teams: many people, one board - E1 [approved, must] A team shares one board: every person's clones, machines and phones show the same items in one order. | gate: test/team.test.js From da904b661344538d46f25bcbdabfe90e05023354 Mon Sep 17 00:00:00 2001 From: McHerpes Date: Sun, 25 Oct 2026 23:42:01 +0000 Subject: [PATCH 2/2] spec(relay): keep proposed rows concise [H23-H31] Signed-off-by: McHerpes --- SPEC.md | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/SPEC.md b/SPEC.md index 64e44e481..1537b5067 100644 --- a/SPEC.md +++ b/SPEC.md @@ -231,14 +231,19 @@ Statuses: approved = decided · draft = proposed · pending = open question · f - H21 [draft, aim] A linked board reads and moves locally whether or not the relay answers: every move returns at once and is sent when the relay is reachable, and a conflict found on sync is refused loudly naming the winner (revises H10 for #1013). | gate: test/relay-local-first.test.js - H22 [draft, aim] A linked board stays linked: the person signs in once per machine, and only relay off or a revoke unlinks it. | gate: review -- H23 [draft, must] An opted-in exclusive board has one durable local ordering owner, shared by its concurrent workers. Within that delegation, claims and other permitted local moves commit without the relay, GitHub or a Git remote; their result is final, not provisional outbox work. This mode revises H3/H10/H16/E2, not the default relay-ordered mode. | gate: review -- H24 [draft, must] An authorized worker may nominate a leader within the person's enabled exclusive scope. Nomination grants no authority: the existing board authority first settles pending moves, records the owner and generation, and fences every other machine from ordering moves. A quiet relay, fewer permissions or a timeout never establishes exclusivity. | gate: review | serves: H23 -- H25 [draft, must] While exclusive, other machines may read or send requests to the owner, not make competing claims. Local workers retain their own identities, lanes and verification rules; a new worker, clone or paired device cannot inherit the ordering grant by copying repository configuration. | gate: review | serves: H23 -- H26 [draft, must] Exclusive moves and their audit records survive process or machine restart before success is returned. Reconnection sends the retained order and move identities without loss, duplicates or renumbering; partial delivery and lost acknowledgements do not undo a local commit. A full or unwritable journal refuses the next move rather than discarding one. | gate: review | serves: H23 -- H27 [draft, must] Leadership handover fences the old owner and settles its committed tail before another owner orders work. A crashed or unreachable owner is not replaced on elapsed time alone; if fencing cannot be established, replacement waits rather than creating two authorities. Existing local work is not stopped merely because the relay is unreachable. | gate: review | serves: H24 -- H28 [draft, must] Exclusive offline rights come from the recorded delegation, not stale remote permission checks. Local revocation applies immediately; remote revocation applies to local work when observed, with no promise of immediate offline revocation. Remote operations still require current permission. Revoking or replacing the ordering owner must satisfy H27; this is an explicit exclusive-mode qualification of H8/E5. | gate: review | serves: H23 -- H29 [draft, aim] Exclusive replication coalesces pending uploads into bounded ordered batches, initially within five seconds of the oldest unsent move while healthy. More writes do not postpone that flush; a full batch or explicit flush sends earlier, idle boards send nothing, and only acknowledged records are retired. Local commits never wait for the batch or network. | gate: review | serves: H26 -- H30 [draft, must] Exclusive-mode acceptance exercises competing nominations, concurrent local claims, a partitioned non-owner, restart with unsent work, partial or lost acknowledgements, revocation and fenced handover. Batch acceptance also measures requests for a fixed burst and idle period, preserves every record and tests the oldest-record delay. Neither buffering nor nominal configuration proves exclusive authority. | gate: review | serves: H23,H29 +### Proposed exclusive local ordering + +These draft rows revise H3/H10/H16/E2 for an explicitly selected exclusive mode and qualify H8/E5 for disconnected delegation. Default relay ordering and H21's provisional outbox remain unchanged; neither is evidence of exclusivity. Immediate remote revocation cannot be guaranteed while the owner is disconnected. + +- H23 [draft, must] An opted-in exclusive board commits permitted local moves without network dependencies; committed results are final, not provisional. | gate: review +- H24 [draft, must] Authorized workers may nominate a leader; only settled moves and a recorded generation fencing competing machines establish ownership. | gate: review | serves: H23 +- H25 [draft, must] Concurrent workers share the owner's board; other machines send requests, not competing moves, preserving actor identities and existing guards. | gate: review | serves: H23 +- H26 [draft, must] Durable moves survive restart and authorized replay without loss, duplication or renumbering; full or unwritable journals refuse new moves. | gate: review | serves: H23 +- H27 [draft, must] Handover fences the old owner and settles its committed tail; elapsed time alone cannot authorize replacement. | gate: review | serves: H24 +- H28 [draft, must] Offline delegation honors local revocation immediately and remote revocation when observed; remote operations still require current permission. | gate: review | serves: H23 +- H29 [draft, aim] Bounded replication batches begin flushing within five seconds of the oldest pending move; continuous writes never postpone them. | gate: review | serves: H26 +- H30 [draft, must] Flush early when full or requested; retire only acknowledged records; send no empty batches; local commits never wait. | gate: review | serves: H29 +- H31 [draft, must] Cloning or pairing grants no ownership; status distinguishes the owner, local commits, pending replication and relay-acknowledged progress. | gate: review | serves: H24 ## E · Teams: many people, one board