There is no seal, so there is no open region

[torstei]

Base is #183. Six commits, +528/−397 over 10 files. Two thirds of it is a design settled and written down; one third is code deleted because of it.

The headline: docs/plans/tally-design.md

This is the file to read — 212 lines stating the tally design rather than arguing it. The three notes beside it (tally-as-a-tally.md, tally-series-identity.md, tally-partials.md) are 2,834 lines of argument, every one of them touching a mechanism that has since been removed, so the design had to be reconstructed from the threads that reached it — and the tape-shaped answers are the ones that read as obvious.

⚠ Its centre is "What a tally is NOT", listing every tape mechanism that was in the design and was removed, each with its reason:

no seal · no open region · no immutability · no displacement · no revisions · no cardinality cap · no stored markers · no .bark declaration · no replication protocol · no grain index

The rest states it once: what a tally is, the on-disk shape, the write order, the three bounds, the two prunings, definitions, recovery, copying, what is measured, what is open. And it says that where an argument note disagrees, the statement wins.

The code: no seal, so no open region

Sealing is the tape's answer to getting one write per bucket. A block is a file replaced by temp-and-rename, addressed so a range can be re-stated — so the premise does not exist. And the seal is what manufactured the open region: a block assumed immutable needed the filling edge to live elsewhere, in a separate file with its own read path and the only bytes in the store that nothing vouched for.

Deleted: OPEN, checkpoint, read_open, Roller::open_buckets, five tests. query and --unpack now have one source instead of two. Verified after the deletion on a real day: 268,136 lines round-trip with zero value differences, and the query still prunes.

What the design settled, commit by commit

The bound on rewriting is Manifest::floor — not grace, and not the source's retention. The partials note said the latter and had it backwards: retention drops the oldest source bytes, while a late entry arrives from the newest end carrying an old stamp. So source retention bounds re-derivation and bounds lateness not at all.

No markers in the grid, which answers where they live by deletion. !meta is subsumed by the definitions, !cap goes with the cap, !late with displacement — and !drop counts lines a definition claimed and could not measure, so it exists only where a definition claims more than it can measure. A number that appears only when the definition is wrong does not belong in the storage format; the distinction lives in --try's report, where a loose capture is found and fixed. So Block::pack refusing markers is right by design rather than a placeholder.

Identity and retention live in the manifest. DECLARE is passed straight to bark::cmd_create, so it is bark's vocabulary — and a block store has no bark. That splits it three ways: index=true and timestamp_regex are meaningless, retain/retain_size have an analogue, and provenance and labels are essential and had nowhere to go. ⚠ Including the source store's id, which is load-bearing rather than decorative: a citation is an offset into that tape.

Retention drops whole blocks, so its granularity is the block range — a day. retain=730d is honest and anything finer is a rounding dressed as a setting. ⚠ And retain_size is the backstop the cardinality cap was standing in for.

And a consistency pass, because banners were not enough

Two sketches in tally-as-a-tally.md would have been copied as the design: a directory with a .bark, a b/ subdirectory and an open file, and a block whose series row carried a metric name, a unit and a definition id. Both now match what the prototype writes. The subdirectory existed only so 730 files would not sit beside a .bark — which no longer exists.

tally.md now leads with "this describes the TAPE, which ships and works… do not read this file as the direction", since it is the biggest note and every tape mechanism in it is true of what runs today.

Then a mechanical check: every rejected concept, in every argument note, paragraph by paragraph, asking whether each mention is marked as amended or scoped to the tape. Four flags remained, all legitimate — two measurement descriptions and two rejection paragraphs.

Corrections to my own text, kept visible

• !late was briefly "sharpened" rather than removed. It is removed: a marker is keyed by bucket, so recording one below the floor stores a fact about a bucket the store has forgotten.
• The manifest section listed identity beside the five fields that exist, which reads as a description of the struct. Now marked built-versus-designed.

486 lib tests, fmt and clippy -D warnings clean, man page corrected.

🤖 Generated with Claude Code