C#: database server answers writes with write_admitted / error.v1 (write-receipt spec) #61

Merged

libby merged 14 commits from libby/cs-write-receipt-server into main 2026-11-08 19:51:53 +00:00

Conversation 0 Commits 14 Files changed 15 +2602 -53

2026-11-08

Libby

C#: a put or delete with an empty or blank schemaId or recordKey is refused message_invalid (as an unreadable frame, like the Rust server) and not applied ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

1a228349f1

• View at this point in history

2026-11-08 19:46:45 +00:00

Libby

C#: test kills the schema id detail-value mutant ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

34bf7aa0ee

• View at this point in history

2026-11-08 17:03:36 +00:00

Libby

C#: receipt writes need a reliable, non-sequenced channel; a refusal without a record key or schema id carries a null detail value ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

40b34295e3

• View at this point in history

2026-11-08 17:01:59 +00:00

Libby

C#: tests kill the replay-details and unreliable non-write mutants ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

48cf3b3323

• View at this point in history

2026-11-08 16:45:29 +00:00

Libby

C#: a remembered refusal keeps its code and field, never the write's strings, and replays in fixed text; a write on an unreliable channel of a receipt session is refused message_invalid (channel) ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

0a67b4d8aa

• View at this point in history

2026-11-08 16:42:22 +00:00

Libby

C#: v0 errors for snapshot, shard log and variant refusals carry fixed text, never an exception's message ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ef5cd88111

• View at this point in history

2026-11-08 15:13:58 +00:00

Libby

C#: tests kill the refusal-set bound and abandoned-rehash mutants ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

d654cb2b99

• View at this point in history

2026-11-08 15:12:31 +00:00

Libby

C#: receipt ids capped at 256 bytes and held as digests; limit refusals remembered, no slot freed; required fields refused with fixed text; RUDP server advertises no receipt frames ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

c4d1efe000

• View at this point in history

2026-11-08 15:07:23 +00:00

Libby

C#: a forward is retryable only when provably not sent; unconfirmed otherwise; refusals carry fixed text ...

CultNetWriteNotSentException names the pre-send boundary (connect, hello, no endpoint,
or a send port that proves nothing was written). Every other forwarding failure keeps
the session claim. ForUnownedSchema and the routing refusal no longer carry exception text.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

541d734675

• View at this point in history

2026-11-08 15:02:56 +00:00

Libby

C#: loopback test for the unreadable-frame answer; Server.Port seam; the answer now reaches the wire ...

An undecodable frame is classed legacy by Decode, so the schema-side guard was unreachable
and a receipt peer was never answered. The guard moves to the legacy decode.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2e5df24e96

• View at this point in history

2026-11-08 14:58:17 +00:00

Libby

C#: drop the redundant Silent state of a write claim (a silent claim is an unanswered one) ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

74b8a4cbf8

• View at this point in history

2026-11-08 14:53:05 +00:00

Libby

C#: receipt server follows Heimdall's review of #61 ...

Look the id up first and authorize only on first sighting; remember refusals within the cap; never re-forward an id whose primary stayed silent; end the connection when an answer cannot be queued; fixed refusal texts; limit_reached cap refusal; commit-point doc on ApplyPut/Delete.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ed5f9d30d1

• View at this point in history

2026-11-08 14:32:39 +00:00

Libby

C#: database server answers writes with write_admitted / error.v1 (write-receipt spec) ...

Opt-in per connection by the first hello (or first write); the server answers a
capable hello with its own. A put or delete commits, then gets write_admitted under
its id; every refusal is error.v1 with the id (an unreadable frame carries the id
when it still holds one). (actor, messageId) dedupe is bound to the content hash and
asked only after the write authority grants; same id other content is message_invalid.
The shard write forwarder says hello, waits for the primary's receipt, and the server
relays only what the primary answered under the original id.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

b0ea18371f

• View at this point in history

2026-11-08 14:04:37 +00:00

Libby

WIP C# write-receipt server (not built, not tested): messages, content hash, per-peer dedupe state, receipt-aware wait ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

45e95984e5

• View at this point in history

2026-11-08 13:41:14 +00:00