cache: make the switch whole, and say that instance scope bounds authority #105

Merged

PerishFire merged 1 commit from whole-switch into main

2026-07-21 08:06:11 +00:00

PerishFire commented

2026-07-21 08:04:27 +00:00

Owner

No description provided.

PerishFire added 1 commit

2026-07-21 08:04:27 +00:00

cache: make the switch whole, and say that instance scope bounds authority

guard / guard (pull_request) Successful in 1m34s

Details

5ce4fbfaf6

Found while listing what should be closed before the helm arc, and it is
a defect I introduced in #93. bare() turned off Stash and left Deeds
running, so "cache off" still held grant rows. The switch did not switch.
Single-instance behaviour was unaffected — Deeds invalidates on every
write, which is why stash::twin stayed green — but the escape hatch the
cache law offers was not there for anyone who reached for it.

Deeds now carries the same `on` as Stash and bare() clears both.
tests/query/probe::bared pins it: with the cache off, a second operation
re-reads the grants. Removing the one line fails that test and only that
test.

The docs gap was the larger half. cache.md already said validity is
scoped to one engine instance, buried in Conformance and written as a
freshness concern. Since #93 that scope also bounds AUTHORITY: a second
instance keeps honouring a grant this one revoked, until it writes and
bumps its own generation. That is a security property, so it now has its
own section, a settled row (H-8), and two must-nots — never cache
authority while claiming the cache is off, and never run two instances
over one store with the cache on.

Both charts carry the constraint at the line where someone would change
it: ensign's values.yaml api.replicas and codehull's hardcoded 1. helm
lint clean on both. The helm arc is precisely the thing that hands that
knob to an operator, so the note belongs there and not in a task file.

guard clean, negentropy clean, 47 tests green on sqlite and on real
postgres.

PerishFire merged commit 28eb36984a into main

2026-07-21 08:06:11 +00:00

PerishFire deleted branch whole-switch

2026-07-21 08:06:11 +00:00

PerishFire referenced this pull request from a commit

2026-07-21 08:06:13 +00:00

cache: make the switch whole, and say that instance scope bounds authority (#105)