A locus initializes once, then refreshes in the background. Boot needs no network, relay silence never removes a guardian's policy, and staleness is measured and visible.
A locus initializes once, then refreshes in the background. Boot needs no network, relay silence never removes a guardian's policy, and staleness is measured and visible.
Initialization The first assembly for a subject — and again only if the store is lost. It fills the known world from the network.
InitializationThe first assembly for a subject — and againonly if the store is lost. It fills the known worldfrom the network.
A refresh tick At boot, on regaining connectivity, then on the locus's cadence — hourly is recommended.
A refresh tickAt boot, on regaining connectivity, then on thelocus's cadence — hourly is recommended.
1
1
Query the fetch graph The association; each guardian's open and sealed coordinates; live lists; unresolved profiles; every extension source.
Query the fetch graphThe association; each guardian's open andsealed coordinates; live lists; unresolved profiles;every extension source.
2
2
Knowledge advances Newer verified material is stored — even from an attempt that fails elsewhere. An empty answer removes nothing.
Knowledge advancesNewer verified material is stored — even from anattempt that fails elsewhere. An empty answerremoves nothing.
3
3
A new snapshot The construct is re-derived and swapped in atomically. Every evaluation runs against one immutable snapshot.
A new snapshotThe construct is re-derived and swapped inatomically. Every evaluation runs against oneimmutable snapshot.
4
4
next tick
next tick
Anti-rollback
Anti-rollback
Every coordinate the store accepts an event at carries a high-water mark: the newest (created_at, id) it has accepted there.
With the store intact, a copy older than what is held is simply discarded: a relay serving yesterday's policy cannot roll the household back.
The marks of the association and of the guardians' binding coordinates even survive the loss of the store: if afterwards the newest copy on offer sits below the mark, the assembly refuses — regression.
The marks refuse relays, not the key: whoever holds the subject's key can sign a newer association — a loud, public act every locus follows.
Every coordinate the store accepts an event at carries a high-water mark: thenewest (created_at, id) it has accepted there.With the store intact, a copy older than what is held is simply discarded: a relayserving yesterday's policy cannot roll the household back.The marks of the association and of the guardians' binding coordinates evensurvive the loss of the store: if afterwards the newest copy on offer sits below themark, the assembly refuses — regression.The marks refuse relays, not the key: whoever holds the subject's key can sign anewer association — a loud, public act every locus follows.
Construct age: stale is visible, never a refusal
Construct age: stale is visible, never a refusal
fresh
fresh
past 24 h: every verdict carries an age finding
past 24 h: every verdict carries an age finding
past 7 days: signing and encrypting first await one refresh attempt
past 7 days: signing and encrypting first await one refresh attempt
last successful refresh
last successful refresh
constructAgeWarn · 86 400 s by default
constructAgeWarn · 86 400 s by default
constructAgeHard · 604 800 s by default
constructAgeHard · 604 800 s by default
A locus whose refresh keeps failing goes on enforcing what it holds. If the awaited attempt fails, the request is evaluated anyway, the age finding standing. Age never gates reading — neither input nor the decrypt oracle.
A locus whose refresh keeps failing goes on enforcing what it holds. If the awaited attempt fails, the request is evaluated anyway, the age finding standing. Age never gates reading — neither input nor the decrypt oracle.
What has not loaded Retried at every tick and surfaced to the subject. Once it has stood 24 hours (by default) a notice goes to every guardian — coordinates and ids, never content — again each period; the notice is itself a policed send.
What has not loadedRetried at every tick and surfaced to the subject. Once it hasstood 24 hours (by default) a notice goes to every guardian —coordinates and ids, never content — again each period; thenotice is itself a policed send.
When a narrowing lands A newer carrier applies at the first refresh that reaches a relay holding it. Partial connectivity widens before it narrows: a stated limit, measured by construct age.
When a narrowing landsA newer carrier applies at the first refresh that reaches a relayholding it. Partial connectivity widens before it narrows: a statedlimit, measured by construct age.
Mis-dated material A carrier dated beyond the clock tolerance (900 s by default) is admitted anyway — the guardian's act applies in full and pins its coordinate — and a future-dated finding goes to the guardians, who made the mistake.
Mis-dated materialA carrier dated beyond the clock tolerance (900 s by default) isadmitted anyway — the guardian's act applies in full and pins itscoordinate — and a future-dated finding goes to the guardians,who made the mistake.
Losing the store Back to initialization, under the marks that survive. A key whose discovery finds nothing is unbound — nothing signed, every verdict denied — exactly like a fresh key.
Losing the storeBack to initialization, under the marks that survive. A key whosediscovery finds nothing is unbound — nothing signed, everyverdict denied — exactly like a fresh key.