From 4e308227fbb460ca763d4b0ebe493d2973ac8323 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Thu, 30 Jul 2026 16:44:45 -0500 Subject: [PATCH] docs(wake): #953 dead-letter retention recorded as load-bearing at the write site MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The RETENTION IS LOAD-BEARING comment sits directly above _quarantine_entry() in digest.sh — the actual writer of dead-letter.jsonl (issue #953 names store.sh, but store.sh only READS the ledger; the write site is here). The ledger is append-only history AND the sole evidence base for store.sh quarantine-audit's conviction predicate (#946). Rotation/pruning/caps would silently convert provable rows into unprovable ones with no signal at either end — the audit's clean sweep reads identically before and after evidence disappears. The comment records the requirements any future retention limit must ship with (loud prune-time signal + audit residual-class reporting updated in the same change), and that nothing pruning this file is a recorded decision, not an omission. Comment-only: zero behavior delta. manifest.txt deliberately NOT touched — keeps the declared #964/#967 version collision two-way. Closes #953 Written-by: pepper (sb-it-1-dt) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB --- packages/mosaic/framework/tools/wake/digest.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/packages/mosaic/framework/tools/wake/digest.sh b/packages/mosaic/framework/tools/wake/digest.sh index fbbab01f..7d7173d2 100755 --- a/packages/mosaic/framework/tools/wake/digest.sh +++ b/packages/mosaic/framework/tools/wake/digest.sh @@ -488,6 +488,19 @@ _dlq_alarm_offhost() { # A dead-letter write failure is itself alarmed (both legs) but never aborts the # drain — the good entries MUST still deliver (availability is the whole point of # #920). +# +# RETENTION IS LOAD-BEARING (#953) — read BEFORE adding rotation/pruning/caps: +# this ledger is append-only history AND the SOLE evidence base for +# store.sh quarantine-audit's conviction predicate (#946): a false +# consumed-hashes witness row is provable ONLY while its matching entry +# survives HERE. Any rotation, pruning, or size cap — however locally correct +# — silently converts provable rows into unprovable ones, and the audit's +# clean sweep reads IDENTICALLY before and after the evidence disappears (no +# signal at either end; the audit never guesses, by design). If retention +# limits ever become genuinely necessary, they MUST ship with (a) a loud +# signal at prune time naming what evidence is being given up, and (b) the +# audit's residual-class reporting updated IN THE SAME CHANGE. Until then: +# nothing prunes this file, and that is a recorded decision, not an omission. _quarantine_entry() { local line="$1" seq="$2" dlq="$STATE_DIR/dead-letter.jsonl" if [ ! -f "$dlq" ] || ! grep -qxF "$line" "$dlq" 2>/dev/null; then -- 2.54.0