docs(adr): ADR-091 Amendments 17 and 18, stream write scopes - #2445
Merged
Conversation
Record the stream-append write scope in the write-transaction external-work audit. The append is a new atomic_unit caller, which the Amendment 11 review guard requires to be entered in the inventory. The row is added by appending a new amendment rather than editing the earlier table, so the inventory grows by append.
ohdearquant
reviewed
Sep 10, 2026
ohdearquant
left a comment
ohdearquant
left a comment
Owner
There was a problem hiding this comment.
Automated review. Posted by this repository's automated pull-request review pipeline; this is not a human read and does not gate the merge by itself.
Verdict on head a1f4335: REQUEST-CHANGES, 1 blocking finding. Finding details are delivered to the review's recipients rather than posted here. Do not merge this head while blocking findings are outstanding; a pipeline comment on a newer head supersedes this one.
Amendment 11's review guard requires every new SqlAccess::atomic_unit caller to be entered in the write-transaction inventory. Amendment 17 entered the single append; the batch surface that landed after it is a second caller and gets its own row here, appended rather than folded into either earlier table. The row is SQL-only: every member arrives prepared, the closure binds and executes statements and folds bounded results, the stream head is read once per distinct stream and memoized, and a refusal from the fence, an observation, a sequence comparison or a member's own guard returns from the closure. The deadline comparison reads the writer's clock through SQLite, so one transaction has one time. Per-member mode runs the same closure with a one-element list, so each hold covers exactly one member. The amendment also names what the audit found unbounded rather than implying a bound: in atomic mode the statement count grows with the member and observation counts, the verb refuses an empty list and does not cap a large one, and the only ceiling today is the 8 MiB frame, which is a transport limit. Comparable paths in this document name their own numbers. The verb-level cap belongs to the stream contract's own amendment, not to this inventory.
oceanwaves630
changed the title
The table is normative and a reader auditing it stops at the cell, so the cell now carries the qualifier the prose already states, following the blob-GC row's precedent of putting the qualifier in the verdict itself.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two rows in ADR-091's write-transaction external-work inventory, one per stream caller.
Amendment 17 (2026-09-08) enters
KhiveRuntime::stream_append. Amendment 11's audit table is normative and exhaustive, and its review guard requires any newSqlAccess::atomic_unitcaller to be entered in it; the single-append path is one, so this records its row. The row is added by appending a new amendment rather than editing Amendment 11's table, which keeps the earlier text readable as what was true when it was written.Amendment 18 (2026-09-10) enters
run_prepared_stream_batch, the batch surface that landed after Amendment 17 was written. Same owner, same guard, its own row. It is SQL-only for the same reason the append is: every member arrives as a prepared action, the closure binds and executes statements and folds bounded results, the stream head is read once per distinct stream and memoized, and every refusal returns from the closure. The deadline comparison reads the writer's clock through SQLite rather than the process clock, so one transaction has one time. Per-member mode runs the same closure with a one-element member list, so each writer hold covers exactly one member.Amendment 18 also names something the audit found rather than implying it is handled: in atomic mode the statement count inside the writer hold grows with the member and observation counts the caller sends. The verb refuses an empty list and does not cap a large one, and the only ceiling today is the daemon's 8 MiB frame, which is a transport limit rather than a decision about writer hold time. Every comparable path in this document names its own number instead. That gap is stated in the amendment, not resolved by it: a verb-level cap changes the stream contract and belongs to that contract's own amendment.
Docs only.
deno fmt --checkclean,scripts/lint-adr-refs.shandscripts/lint-adr-status.pyboth clean at the branch head. Main is merged in, so the checks run against a current merge ref.