|
| 1 | +# Reserved settlement input and custom decision-scope disposition |
| 2 | + |
| 3 | +Source baseline: `323c3053128e41e16df27e6b6498f83c37e81f5e`. |
| 4 | +Refs [#4447](https://github.com/loopx-project/loopx/issues/4447), original |
| 5 | +Stage 2a/2b source treatment and Stage 3 owner disposition. This is a concrete |
| 6 | +proposal for review and integration, not a record of an earlier maintainer |
| 7 | +approval. It does not close the issue or replace the 26-entry inventory in |
| 8 | +[#6270](https://github.com/loopx-project/loopx/pull/6270). |
| 9 | + |
| 10 | +## `settlement_failure_kind.cancelled` |
| 11 | + |
| 12 | +Keep `cancelled` as a reader-reserved wire value in the existing vocabulary. |
| 13 | +The Python and TypeScript decoders already admit it. Current built-in settlement |
| 14 | +branches do not produce it; cancellation in Host, chat, lease or usage contracts |
| 15 | +must not be counted as its producer. No new runtime cancellation mechanism is |
| 16 | +introduced to make the value appear live. |
| 17 | + |
| 18 | +The existing `compatibility_only` metadata now states why that admitted input |
| 19 | +is retained and the exit condition. This is a compatibility commitment, not |
| 20 | +proof that any historical producer emitted the value. A supplied `cancelled` |
| 21 | +envelope remains a failure: bind must stop before the next callback and preserve |
| 22 | +prior receipts and failure details. It neither erases an already committed |
| 23 | +step nor proves an in-flight provider effect stopped. It grants no automatic |
| 24 | +retry, rollback, resume or quota authority. A provider outcome that is actually |
| 25 | +unknown continues to use its owning observation/reconciliation contract; |
| 26 | +`cancelled` cannot settle that uncertainty by relabeling it. |
| 27 | + |
| 28 | +Replace the reservation only through one of these owner-reviewed changes: |
| 29 | + |
| 30 | +- a real typed cancellation contract that distinguishes before-dispatch |
| 31 | + cancellation from ambiguous after-dispatch effects, with producer and real |
| 32 | + caller witnesses plus updated source treatment; or |
| 33 | +- explicit versioned reader migration/removal with caller and stored-envelope |
| 34 | + compatibility evidence. |
| 35 | + |
| 36 | +There is no automatic expiry, invented external canceller, decoder narrowing, |
| 37 | +or forced vocabulary retirement. F1/F2 remains the existing six-entry domain. |
| 38 | + |
| 39 | +## `todo_decision_scope_kind.other` |
| 40 | + |
| 41 | +`other` is explicitly authored custom decision authority when none of the six |
| 42 | +named kinds describes the actual approval. Prefer a named kind whenever it |
| 43 | +applies; uncertainty about the intended decision is not a reason to select |
| 44 | +`other`. The existing task text explains the decision and a stable public-safe |
| 45 | +scope key identifies it for both gate and dependent work. See the |
| 46 | +[authoring rule and example](../../../../reference/protocols/decision-scope-v0.md#choosing-kindother). |
| 47 | + |
| 48 | +For example, `other:action:study_conflict_review` may name an owner-required |
| 49 | +conflict-of-interest review. It is independent of private source access, |
| 50 | +resource spend, direction changes or public publication, which keep their |
| 51 | +named kinds. `other:action:study_method_review` is another custom decision, |
| 52 | +not a synonym or fallback. |
| 53 | + |
| 54 | +Matching uses the same typed owner as every other kind. Exact kind is always |
| 55 | +required, so even `other:global:*` cannot cover a named kind. Key, granularity, |
| 56 | +recipient and exact Todo target rules remain intact. Unknown/misspelled kinds |
| 57 | +still reject; no parser fallback converts them to `other`. Declaring a kind is |
| 58 | +not approval: existing linked-gate completion or standing authority consumes |
| 59 | +only the scopes it actually covers. |
| 60 | + |
| 61 | +## Evidence and remaining acceptance |
| 62 | + |
| 63 | +Reuse the existing all-value settlement decoder, unknown-input and bind |
| 64 | +short-circuit witnesses. Extend their actual IPC/decoder path to preserve a |
| 65 | +supplied reserved failure with prior committed receipts and details; this is |
| 66 | +reader coverage, never internal producer evidence. Reuse existing Todo |
| 67 | +lifecycle helpers and native TypeScript matching to exercise a custom approval |
| 68 | +alongside a different custom requirement and a named permission requirement. |
| 69 | +Only the selected custom scope may be consumed. A broad custom scope cannot |
| 70 | +cover any named kind, and malformed input cannot become custom authority. |
| 71 | + |
| 72 | +The registry still has 26 entries and the same values/owners. No budgets, |
| 73 | +formal proof domains, wire schemas, runtime defaults or persisted formats are |
| 74 | +changed. Tests alone do not approve these dispositions. Final #4447 acceptance |
| 75 | +still requires owner review/integration of this proposal, the current source |
| 76 | +inventory, and passed/failed/untested evidence on the final integrated revision. |
| 77 | +Earlier records of unresolved meaning remain historical; they are not rewritten |
| 78 | +as if this decision had already existed. |
0 commit comments