Refine recovery guidance and explore navigation and rendering

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0cffe-206f-7323-89d3-b20ca4cf4bf9
This commit is contained in:
tegwick 2026-09-26 21:22:53 +02:00
parent 21030784b1
commit 642163a1ed
21 changed files with 407 additions and 15 deletions

View file

@ -56,3 +56,19 @@ from domain evidence. Cancelling a local pending record does not revoke a remote
accepted operation; issuing a new identity afterward can duplicate logical intent.
This is one partial implementation observation in the Element/Matrix family, not
independent recurrence or proof of real-server deduplication.
## Recovery contract — 2026-09-26
Before retrying, record how to recover the original operation identity, look up its
outcome, and determine the receiver's deduplication scope and retention window.
Outside that window, replay may create a second effect; lookup or reconciliation
must resolve the original outcome before fresh submission of the same logical
intent. If neither can resolve it, keep uncertainty visible and escalate the domain
decision rather than describing a fresh identity as safe.
Distinguish stopping a local wait, cancelling a pending remote action, and reversing
an accepted effect. State the authority's cancellation preconditions and race behavior;
if acceptance wins, only a separately authorized reversal/compensation can undo its
domain effect, and some effects have no reversal. Track that operation's outcome too.
These are design requirements prompted by the [submitted review](../evaluations/language-pilot-01/submitted-review-01/adjudication.md),
not new observations of provider guarantees.