Say how the writer tells its own lost acknowledgement from a former holder, list D16, and fix the settings heading (review of #303)

2026-10-10 22:05:17 +02:00
parent 5a3513b819
commit 9be659b18c
3 changed files with 24 additions and 11 deletions
@@ -156,7 +156,9 @@ What each value holds, and what it leaves out, is in to-be 54. These limits hold

 - **Written by the lease holder alone**, as a row of to-be 45 §1's writers table. A controller without
  the lease writes no mirror. Each write is a compare-and-set on the key's revision the writer last saw,
-  so a former holder that has not yet noticed it lost the lease cannot overwrite a newer value. A value
+  so a former holder that has not yet noticed it lost the lease cannot overwrite a newer value. A refusal
+  can also be the writer's own write whose acknowledgement was lost; to-be 54 §2 says how the writer tells
+  the two apart. A value
  carries only fields built from the record: no epoch and no time of writing, because the next lease
  holder must build the same bytes from the same record. The epoch travels in the event.
 - **No secret and no credential**, ever (ADR 0201 §5). Each value is built from a list of named fields,
@@ -218,7 +220,8 @@ counts both over a run of changes.
  hours. Then the condition's resolver becomes the operator and its severity urgent, because a mirror that keeps drifting means
  the controller's write path is broken. The next run of D17 clears the condition when it finds no
  difference.
- **When the controller takes the lease, it runs D17 before it serves.** A difference found then is
+- **When the controller takes the lease, it runs D17's first read before it serves**, and the second read
+  while it serves. A difference found then is
  raised like any other, because it means a controller stopped between a commit and its write.
 - **A mirror created empty** by this start is filled whole before the controller serves, and that fill
  is not a difference.