docs: propose one recovery model for channels, history, and threads

[baxen]

Proposal

On each WebSocket connection, the client sends its persisted sync position and a multi-entry priority queue. The relay derives account scope, streams incremental changes or bounded replacements, then continues live delivery.

One document: docs/sync-proposal.md. Discussion proposal, not a VISION, NIP, or runtime implementation.

Revised after review to lead with the technical process:

1. Connection request and priority queue, separate from subscription scope.
2. Relay catch-up/live handoff, channel response choices, and checkpoint boundary.
3. Idempotent application and durable client checkpointing.
4. Bounded persistent history segments, gaps, and pagination.
5. Prepared newest-reply thread tails.

Technical benefits follow the process. The time-watermark proof and read-state semantics/privacy remain explicit implementation decisions, not assumed guarantees. Retains source references and proposed validation cases.

Validation

At 88c9dac51aa1eeac32b81adfa1024a99142743f6:

• Full PR remains one Markdown file; content and full diff reviewed.
• git diff --check passes; Markdown fences, relative links, and reference definitions checked.
• Existing pinned source references retained from the original proposal.
• Secret scan and repository commit/push hooks passed; docs-only hooks correctly skipped source tests.
• Both outgoing commits audited for attribution and DCO sign-off.
• No runtime tests or builds: no executable changes. Hosted CI is separate from these local checks.

Origin: Buzz channel 0b881928-a3a6-4c01-b981-8e64268f01ce, thread d33f2b7f2c5f7269891a3e2cdf862f1d1bc03ef1cee569bb33a97ae79326c236.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T04:31:12.589590Z	5f8ad33	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f8ad33bc9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the original author's signed commit

This commit has the same parent and byte-for-byte identical tree as 5f8ad33bc9041cf595fc85c963fb46129b117459, which is authored and signed off by Fizz, but it replaces the author with Codex and drops Fizz's Signed-off-by trailer. Retain/cherry-pick the original commit rather than substituting authorship; otherwise the PR misattributes the work and fails the repository's DCO requirement.

AGENTS.md reference: AGENTS.md:L150-L157

Useful? React with 👍 / 👎.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source review: no blocking findings

Reviewed head 5f8ad33bc9041cf595fc85c963fb46129b117459 against pinned base 0beb523443557c189e5fcf16a3ac9e8437666690. The introduced PR diff is the single 213-line proposal, using merge base 4ac257e1b2b2b9ca68f413eccc5baf6b3804060f.

• The current-client observations match the cited contracts: bounded head persistence, unrepresented gaps after head catch-up, oldest-first bounded thread traversal, and encrypted individual-message read intent. The proposal preserves session ownership, access checks and durable local intent.
• Recovery is appropriately conditional: checkpoint/state atomicity, explicit gaps and mutation repair, regrant baselines, retained-thread repair, and unsupported-relay fallback are stated requirements. The referenced fence computes min(oldest_xact_start, S) - 960 - 5 seconds, supporting the roughly 16-minute overlap, but does not establish client delivery or mutation recovery. The document explicitly preserves that distinction.
• Validation: read-only source/document review on Blox, independent client-contract review, referenced-path checks and clean three-dot git diff --check. Existing exact-head automatic CI checks passed; no code was checked out or executed and no tests were rerun. Checkpoint feasibility, deployed configuration, read-state privacy choices and measured budgets remain implementation prerequisites, not outcomes established by this docs-only PR.

This is a clear review of the discussion document, not approval of a wire specification or implementation.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source review: no blocking findings

Reviewed head 88c9dac51aa1eeac32b81adfa1024a99142743f6 against pinned base 0beb523443557c189e5fcf16a3ac9e8437666690 (merge base 4ac257e1b2b2b9ca68f413eccc5baf6b3804060f), including the revision from previously reviewed head 5f8ad33bc9041cf595fc85c963fb46129b117459. The PR adds only the 239-line docs/sync-proposal.md discussion document.

• The process-first revision preserves the recovery contract: priority schedules work without narrowing membership scope; checkpoints follow durable application and completed recovery; replacements cannot overwrite newer live state; skipped history, old mutations, regrants and retained threads require explicit reconciliation.
• Session ownership, durable local intent, unsupported-relay fallback, and existing per-message/encrypted read semantics remain intact. Watermark proof, account-wide cost and cache/thread-tail budgets are explicitly unsettled implementation decisions, not guarantees established by this proposal.
• Validation: read-only Blox source/document review plus an independent architecture review; relative reference targets exist and the exact three-dot diff passes git diff --check. Existing exact-head CI was partly successful and partly still running when inspected. No repository code was checked out or executed, no tests were rerun, and no live behavior or performance was validated.

Clear for the stated discussion-proposal scope, not approval of a wire specification or runtime implementation.