Say what counts as watched in the federation register, not which issue will decide it

[iderex]

The issue this belongs to

Closes #489

What changed

The WhatWasPlayed item of SharedItem in src/server/federation.rs stops
describing part of what a federation act may share as "whatever #60 decides
counts as watched". It says what counts as watched is 0060's rule and names
crate::playback::watched as where the core applies it. A second paragraph on
the item records what it said and which of the two states it was in.

Nothing else moves. No behaviour, signature, variant or refusal, and no member is
added to or removed from the set.

What failure it prevents

SharedItem is the closed set a federation act enumerates, and this module's own
header says the enumeration is what the core is bound by afterwards. It is
therefore the register somebody opens to find out exactly what leaves the device
when an act is performed, and one member of it answered with an open question. A
person deciding whether to perform an act cannot look up an issue that closed
three weeks ago to learn what they are consenting to, and the natural reading of
a closed issue is that the answer exists somewhere this file does not name.

#60 closed as completed on 2026-08-27, nine hours after the sentence landed, and
src/playback/watched.rs arrived two hours after that applying the rule. So the
sentence went stale within hours rather than landing refuted, because the change
that decided the rule had no reason to open the federation register.

It was found by reading every issue number this tree names outside
docs/decisions/ against the state of that issue on the tracker.

The means

Doc comments in the Rust source that carries the claim, which is the only means
that puts the correction where the sentence a reader meets is. A record under
docs/decisions/ would leave the open question standing in the register somebody
opens to find the answer. No language, runtime or dependency is added, and the
suites that already exist judge the result, because cargo doc resolves the link
the change adds.

Evidence

The commit being pushed:

git rev-parse HEAD
758ce422c230b71153681e77cb208282d51c8a22

What the item said, at the parent:

git show 758ce42^:src/server/federation.rs | sed -n '104,110p'
    /// Titles, identifiers, artwork and any metadata that came back about what
    /// is on that server.
    WhatIsInTheLibrary,
    /// What was played, when, how far it got, and whatever #60 decides counts as
    /// watched. 0068 places this closest to the sensitive kind, because a
    /// viewing history says a great deal about a person.
    WhatWasPlayed,

#60 is closed as completed:

gh issue view 60 --repo Flowfin/core --json number,state,closedAt,title --jq '"\(.number) \(.state) \(.closedAt) \(.title)"'
60 CLOSED 2026-08-27T04:20:15Z Decide what counts as watched

The rule it decided is in this tree, and the module says so of itself:

git show 758ce42^:src/playback/watched.rs | sed -n '1,10p'
//! What counts as watched, and who said so.
//!
//! 0060 is the record and #60 is the issue.
//!
//! # There is one number and this module does not hold it
//!
//! 0060 states no boundary of its own. The core marks an item watched at exactly
//! the boundary 0058 stops offering a resume at, and this module asks
//! [`Resume::of`] rather than comparing anything, so the two cannot disagree
//! because there is only one comparison in the tree.

carried by a type and the call that applies it, in library code:

git show 758ce42^:src/playback/watched.rs | sed -n '77,82p'
pub enum Marked {
    /// Nothing has marked this item watched.
    NotWatched,
    /// It is watched, and this is who said so.
    Watched(MarkedBy),
}
git show 758ce42^:src/playback/watched.rs | sed -n '85,90p'
    /// What the core makes of a recorded position.
    ///
    /// It asks [`Resume::of`] rather than comparing against a boundary of its
    /// own, which is 0060's whole decision: an item the resume rule calls
    /// finished is watched, and there is no second number that could drift from
    /// that one.

Why the register is where this matters, in the module's own words:

git show 758ce42^:src/server/federation.rs | sed -n '25,28p'
//! Named before shared: an act carries the items it enumerated, from the closed
//! set in [`SharedItem`], and the enumeration is what the core is bound by
//! afterwards. An act naming nothing is refused rather than recorded, because a
//! partner that shares nothing is a permission with no enumeration behind it,

The dates. The sentence arrived with the module that carries it, nine hours
before #60 closed, and the module applying the rule two hours after that:

git log --format='%h %cI %s' --diff-filter=A 758ce42^ -- src/server/federation.rs
c314629 2026-08-26T21:38:29+02:00 Make a second host reachable only through an act somebody performed
git blame -L 107,107 --date=short 758ce42^ -- src/server/federation.rs | cat
c314629e (Nils Lehnen 2026-08-26 107)     /// What was played, when, how far it got, and whatever #60 decides counts as
git log --format='%h %cI %s' --diff-filter=A 758ce42^ -- src/playback/watched.rs
ac702ad 2026-08-27T06:14:38+02:00 Take 0058's boundary as the completion rule, and carry who made each mark

What the item says now:

git show HEAD:src/server/federation.rs | sed -n '107,117p'
    /// What was played, when, how far it got, and what counts as watched, which
    /// is 0060's rule and is applied in [`crate::playback::watched`]. 0068 places
    /// this closest to the sensitive kind, because a viewing history says a great
    /// deal about a person.
    ///
    /// THIS ITEM SAID "whatever #60 decides counts as watched". That issue
    /// decided it and closed as completed on 2026-08-27, nine hours after this
    /// sentence landed, and the module applying the rule arrived two hours after
    /// that. So the sentence went stale rather than landing refuted, which is the
    /// milder of the two states. #489 is where it was found.
    WhatWasPlayed,

What the change is:

git diff --stat origin/main...HEAD
 src/server/federation.rs | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
git diff --name-only origin/main...HEAD
src/server/federation.rs

The two commands the gate runs, at this commit. The build was run first and
exited 0; its own summary line is not pasted, because this board's hygiene check
reads the word in it as a speed claim:

cargo build --locked --all-targets ; echo "exit=$?"
exit=0
cargo test --locked ; echo "exit=$?"
exit=0
cargo test --locked 2>&1 | grep -c '^test result: ok'
10
cargo test --locked 2>&1 | grep -c 'test result: FAILED'
0

The link the item adds resolves, which the ordinary build does not judge:

cargo doc --no-deps --locked ; echo "exit=$?"
exit=0

Four of this board's own legs, run on this machine at this commit:

bash .github/invariants/invariants.sh check | tail -1
Every rule above was applied to its subject and refused nothing.
bash .github/format/format.sh check | tail -1
Every tracked source file above is written the way the formatter would write it.
bash .github/doc-paths/doc-paths.sh check | tail -1
Every path these documents name resolves against the tracked set.
bash .github/lint/lint.sh check | tail -1
Every lint the groups above carry was refused, outside the register printed with it.

What this does not cover

• src/playback/watched.rs. It is read as evidence and not edited. It
  already says what holds.

• The other issue numbers this file names. #36, #47, #69 and #72 are
  named elsewhere in it and none of them is examined here, in either direction.

• The rest of SharedItem. No other member's wording is judged, and the set
  itself is not touched.

• 0060, 0068 and 0072. The records are referred to and none is edited. A
  record is added or superseded rather than edited in place, which
  docs/decisions/0001-decision-records.md fixes.

• Whether a federation act exists to perform. Nothing in this tree reaches a
  second host. This is the register of acts rather than a route, and nothing is
  claimed about when one arrives.

• A check that would refuse this. Nothing in this tree reads a doc comment's
  hand-off against the state of the issue it names, and the document check reads
  only .md files. This adds no rule, so the next sentence of this shape is
  caught by a reader or not at all.

• The shell analysis. It was not run on this machine, because the analyser is
  not on this machine's path:

    command -v shellcheck ; echo "exit=$?"
    exit=1
  

  What the run on this pull request reports is the reading, and nothing is
  claimed for it from here. This change touches no shell file.

Who has read it

Nobody other than the author. There is no second reader on this board tonight,
and the readings pasted above stand in place of one rather than a review having
happened.