A disk budget the gate refuses against, and an envelope that admits what the uploader sends #17

Merged

LNK merged 1 commit from claude/disk-budget-and-envelope into main

2026-09-04 21:21:45 +00:00

LNK commented

2026-09-04 21:21:45 +00:00

Contributor

The review's last two cheap items.

Disk budget. None by default. With one set on the Account tab, the gate measures what the store occupies on disk before writing a frame's pixels and at the budget suppresses them under L1.disk_budget: the record keeps its timing, the reason is in the gate log and on a card, timing records are untouched. Setting the budget is itself logged. The Account tab shows what the store occupies and the budget it is held to.

Envelope. The uploader always sent signal_id and the schema never admitted it. It does now, and a test parses every built line with the generated envelope type, which refuses unknown fields.

Proof. Size is measured from the disk and grows with an image; a store at its budget refuses pixels and keeps the timing, and that fails with the check removed; every built line is a valid envelope. Linux verifier green on the pinned toolchain. Not run here: the Tauri window and the Windows verifier.

The review's last two cheap items. **Disk budget.** None by default. With one set on the Account tab, the gate measures what the store occupies on disk before writing a frame's pixels and at the budget suppresses them under `L1.disk_budget`: the record keeps its timing, the reason is in the gate log and on a card, timing records are untouched. Setting the budget is itself logged. The Account tab shows what the store occupies and the budget it is held to. **Envelope.** The uploader always sent `signal_id` and the schema never admitted it. It does now, and a test parses every built line with the generated envelope type, which refuses unknown fields. **Proof.** Size is measured from the disk and grows with an image; a store at its budget refuses pixels and keeps the timing, and that fails with the check removed; every built line is a valid envelope. Linux verifier green on the pinned toolchain. Not run here: the Tauri window and the Windows verifier.

LNK added 1 commit

2026-09-04 21:21:45 +00:00

A disk budget the gate refuses against, and an envelope that admits what the uploader sends a7075b3977

Two of the review's cheap items, the last two.

A store had no budget. Retention now expires records, and a person can delete, but between
those a busy machine writes images until the disk is full, and a full disk is a crash with
no record in it. A budget can be set on the Account tab now — none by default, because a
limit nobody chose is a limit nobody expects — and with one set the gate measures what the
store occupies on disk, the database and its log and every image, before it writes a frame's
pixels. At the budget it refuses them under `L1.disk_budget`: the frame's record is stored
with its timing and no image, the reason is in the gate log and on a card, and timing
records are untouched, because pixels are what fill a disk. So a full store is a stretch the
timeline can name, and it un-fills itself the way everything else leaves. Setting or removing
the budget is written to the gate log like a scope change; narrowing what is kept is not a
thing to do quietly either.

The envelope schema said `additionalProperties: false` and the uploader had sent `signal_id`
on every line since it existed, so a consumer that validated against the schema would have
refused every batch. The schema admits it now, and a test builds a batch and parses every
line with the contract's own generated envelope type — which refuses unknown fields — so the
next field the uploader learns to send cannot outrun the schema again.

Tests: what the store occupies is measured from the disk and grows with an image; a budget
reads back as set and an unreadable one is no budget rather than a tiny one; a store at its
budget refuses pixels, keeps the timing, records the reason, leaves timing records alone, and
lets pixels through again when the budget is lifted — which fails against a gate that does
not check, checked by removing the check; every line the uploader builds is a valid envelope,
which would have failed on day one.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

LNK merged commit 267cc7a5cc into main

2026-09-04 21:21:45 +00:00

LNK referenced this pull request from a commit

2026-09-04 21:21:46 +00:00

Merge pull request #17 from claude/disk-budget-and-envelope

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

mikebrandon/here-telemetry-rnd!17

No description provided.

Rows
Columns