mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
DuncanandWill Pfleger
383db8a69a
The §3.5 binding-retirement finalizer in v1 is permanently conservative (P15-I2/P16-I1/P17-C1): it OBSERVES retirement-due entries at recovery points and discharges nothing, because library metadata alone cannot prove a process-global key or a community-visible identity is unused — an unrelated plain carrier of the bound pubkey may live in an inactive scope no deleting authority may read. The keyring entry, deferred rows, and tombstoned binding record persist as permanent journaled markers. Add LibraryEntry::is_retirement_due (derived condition: at least one projection, all terminal, a binding key or deferred row still names it) and LoadedLibrary::retirement_due_entries (the pure observer selector). The recovery-point wiring is Phase 4b. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>