amadan
Design: acks stay change-only
The every-pass ack was a Get and a Put per route per pass on every box, and on a fleet-door box it could never succeed: control/config-ack/ is outside the door's read and write scopes, so each pass would fail, log, and still leave the console with nothing. It also made the ack's At stop describing the etag beside it. Delivery stays decidable where it matters, because writing an instance's credential always changes that instance's file. The capability question belongs to the box record's agent version.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 file changed,
+25
−6
docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md+25 −6
diff --git a/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md b/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md| index 0c2403b01..614acc3bc 100644 |
| --- a/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md |
| +++ b/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md |
| @@ -458,12 +458,31 @@ route with no mail vars. |
| An ack is written only when a pass changes a file (`configack.go:66`), |
| so a fresh instance, or one whose config has not moved since its agent |
| -was rolled, has no ack at all — absence cannot mean "old agent". Two |
| -changes follow: the agent rewrites the ack with its `Schema` on every |
| -pass, changed or not, and the enable-time check reads the box record's |
| -agent version, so its refusal names the box and the version rather than |
| -guessing. `carlos email status --instance <host>` reports delivered, |
| -stale or never delivered. |
| +was rolled, has no ack at all — absence cannot mean "old agent". |
| + |
| +**The capability question is answered by the box record's agent version, |
| +not by the ack.** An earlier draft had the agent rewrite the ack on every |
| +pass so that absence became decidable. That is the wrong trade: it is a |
| +Get and a Put per converged route per pass on every box in the fleet, |
| +where today it is one write per changed file, and on a fleet-door box it |
| +is worse than useless — `control/config-ack/` is outside the door's read |
| +and write scopes (`edge/storedoor.go:389`, `:489`), so every one of those |
| +passes would fail, log, and still leave the console with nothing. It also |
| +forces the ack's `At` to stop describing the delivery it sits beside. |
| + |
| +So acks stay change-only. The enable-time refusal reads the agent version |
| +and names the box and the version. Delivery is still decidable where it |
| +matters, because writing an instance's credential always changes that |
| +instance's file, so it always produces an ack carrying the |
| +`InstanceConfigETag` to compare. A missing ack reads as "not yet |
| +delivered", never as "old agent". `carlos email status --instance <host>` |
| +reports delivered, stale or not yet delivered. |
| + |
| +**A fleet-door box cannot confirm delivery at all**, because it cannot |
| +write the ack. Until that door grants `control/config-ack/<box>/`, an |
| +instance sender on such a box can be enabled but its delivery will read |
| +as unconfirmed. The roll note says so, and the door grant is its own |
| +piece of work. |
| ## 7. #147: a sender under an identity CARLOS does not own |