memory: /snapshot — condense in-flight to milestone-close; person-prime shipped+verified, R39 arc closed; first persistent-memory.d/ detail files

2026-07-15 22:54:20 -07:00
parent 5e3e88d26d
commit e365b24339
4 changed files with 217 additions and 50 deletions
@@ -0,0 +1,41 @@
+# [2026-07-16] bifrost scan/cursor conformance gap → snapshot-cursor ruled NORMATIVE
+
+## The gap (I surfaced it; operator's catch that it was bifrost's to fix)
+The heid-bug-hunt flagged our offset cursor's cross-page dup/drop under mutation. On
+verifying before routing, it turned out sharper than "robustness": bifrost's PROTOCOL
+already mandates snapshot cursors — the dispatch engine (`bifrost/memory.py:311-314`)
+drops `sort` on a cursor continuation with the comment *"the cursor's snapshotted order is
+authoritative"*, and maps `ScanCursorExpired → 410`. The reference `InMemoryMemoryStore`
+implements it (frozen ordered id-list per opaque token + TTL). But bifrost's **conformance
+suite had ZERO scan/cursor coverage** — so our non-snapshot offset cursor passed
+conformance while violating the protocol contract. That coverage hole is the real
+completeness concern. Routed to bifrost-dev (thread `01KXK7MDTY…`).
+
+## bifrost-dev's ruling
+1. **Snapshot-cursor is NORMATIVE, not opaque/per-store.** Operator ruled: cursor
+   snapshots a frozen ordered id-list, continuation ignores `sort`, stale/unknown cursor →
+   `ScanCursorExpired` → 410. **Offset-with-documented-limits is NOT blessed.**
+2. **Conformance coverage added** in **bifrost 1.1.3** (`bifrost.conformance.
+   memory_store_conformance`, 4 probes: `scan_snapshot_order_authoritative`,
+   `scan_no_dup_or_drop`, `scan_unknown_cursor_expired`, `scan_snapshot_stable_under_write`
+   opt-in). Our offset bug ships as their negative-canary fixture
+   (`fixtures.v0_7.offset_cursor_store.OffsetCursorMemoryStore`). `main()` grades import
+   failure as exit 2 (setup error) vs exit 1 (conformance FAIL).
+
+## Our status + the TODO (operator-sequenced, NOT urgent)
+Single-page person-prime (`cursor=None`) is already conformant — nothing shipped is broken;
+it's only multi-page continuation that's non-conformant. Our contract INV-010 currently
+marks the offset cursor **v1-provisional / KNOWN DEVIATION** (commit `8199774`).
+
+TODO when sequenced:
+1. Bump pin bifrost `1.1.1 → 1.1.3`.
+2. Replace the offset cursor with the reference snapshot semantics (frozen id-list per
+   opaque token + `ScanCursorExpired` → 410).
+3. Run `run_all(store_factory=..., include_optional=True)` against our SQLite store —
+   expect P1/P2/P3 RED → green (the before/after IS the validation). Report to bifrost-dev
+   (we're their canary — first non-reference scan implementer).
+4. Flip INV-010 from v1-provisional to snapshot semantics.
+
+TTL-duration expiry NOT asserted by the harness (no portable clock hook via store_factory);
+bifrost-dev offered a `clock_control` opt-in if we ever need time-based expiry certified —
+parked, not needed yet.