Archived
jschoubben
d0a9abcb1c
introduces Step 3.4, the consume side's hard part. The guarantee (ADR 0083) is that a push the controller cannot record because its store is restarting is held and retried — never dropped, never falsely acknowledged. Keeping the delivery unacknowledged in memory becomes a nak with a delay: the server holds it, the controller keeps no list of parked messages, and a controller that restarts mid-window loses nothing it was holding. That is a plain win and it introduces one problem. Holding in memory let the controller drop an older report when a newer one for the same node arrived, "because acting on it after the newer would undo the newer". A naked message is the server's and comes back whatever happened meanwhile, so the older report is redelivered after the newer was applied. The answer was already in the message. A report carries `Declared`, the digest of the declaration it is about, which exists because an earlier attempt to order reports by time lost the race it invited. So supersession stops being something the controller remembers and becomes something it checks — the same shape as a node refusing a superseded declaration by sequence (issue 107): ordering settled by what a message says, not by when it arrived. Pure, so the guarantee is testable without a bus, a store or a clock. Nine tests, including that staleness is decided before the store is waited on — a redelivery that lost its race must not hold a slot a current message needs.