Boundaries charter: what Replicator is allowed to become (+ CI-enforced invariants)

[gregoryfoster]

Why

docs/contracts/content-fetch-issuer-contract.md settles the wire: what an issuer must
do so a fact is never lost. It says nothing about the service — what Replicator is
allowed to become. Those are different documents and only one of them exists.

The gap matters now because Phase 4 (CannObserv/watcher#241) is the first time capability
gets reallocated across the boundary, and the reallocation is not one-directional:
politeness enforcement wants to move in, alternate fetch drivers want to move in, and
per-URL validator state must be kept out. Every one of those arrives as a
reasonable-looking field or a small settings table, and the cumulative result — a
Replicator with a database, domain vocabulary, and an admin API — is reached one
defensible step at a time. Nothing in the repo today would stop it or even flag it.

The invariants are all currently true: 8 dependencies, none of them a database; one
route, /health; every wire model imported from co-core. This is drift prevention from a
good position, not remediation.

Sibling to the issuer contract, same posture: normative, lives with the code it describes,
linked rather than copied.

---

Draft: docs/contracts/replicator-boundaries.md

The rule

Replicator owns the mechanics of acquiring bytes from a network and holding them
briefly. It never owns why, when, or what they mean.

The three tests

Any proposed capability, field, or setting runs these in order:

1. Does it need durable per-resource history? → issuer. Replicator's state must be
   exactly one of: content-addressed on disk (rebuildable by re-fetch), in-memory derived
   (rebuildable by replay), or in the broker (PEL, dedupe keys). State outside those three
   is a database, whatever it is called.
2. Does it need cross-command coordination over a resource only the fetcher can see?
   (a host's tolerance, the disk, a connection pool, a browser pool) → Replicator.
   Nobody else can see it, and N issuers being polite independently is a fiction.
3. Can it be expressed without domain vocabulary? If it needs the words InfoSource,
   InfoItem, WatchedItem, aspect, tenant → issuer, always.

Tests 1 and 2 can both fire. Politeness is the case: cross-command state (→ Replicator)
plus per-host operator config (→ issuer). The resolution generalizes:

Mechanism to Replicator. Policy to the issuer. Config travels over the bus.

Worked example — conditional GET

ETag/Last-Modified look like fetcher state. Test 1 sends them to the issuer: they are
durable per-resource history. So the fact returns them (CannObserv/cannobserv#271) and the
next command replays them as request headers (CannObserv/cannobserv#272). Replicator gains
conditional GET while holding zero bytes of per-URL history. Cite this one when a proposal
argues that some small table would be simpler.

Where things live

Replicator (mechanism): fetch execution, redirect following, retry cadence,
fingerprinting, temp storage and its lifetime, disk ceiling, per-host pacing
enforcement, and — future — alternate fetch drivers (browser, archival capture) and
escalation between them.

Issuer (policy/domain): scheduling and cadence, extraction specs, change semantics,
notification, correlation, pending maps and reapers, per-URL validator state, and the
politeness numbers.

Never Replicator's: domain identity, extraction specs, change decisions, notification,
InfoSource correlation, scheduling. Named explicitly so a proposal has to argue against a
written line rather than into a vacuum.

Config taxonomy

Channel	Carries	Examples
env	facts about this host	blob TTL, disk ceiling, claim cadence, dedupe TTL
command	this occasion	headers, timeout_seconds, later a fetch strategy
config stream	cluster policy needing cross-command state	per-host politeness

The fourth channel is rejected by name: an inbound admin HTTP API. It is the easy path
for every future config need and it ends the property that makes this service testable and
relocatable. Ingress stays health-only, as an enforced invariant rather than a habit.

The policy stream (agreed, not yet built)

content.fetch.policy — last-write-wins per host key. Replicator replays it from 0-0 at
boot into memory and tails it thereafter. No DB, rebuildable, no inbound calls, and the
data stays owned by its producer.

Two properties that must hold or the design fails quietly:

• the owner republishes the full set periodically and on change, so boot replay never
  depends on broker retention
• an unknown host resolves to a conservative default, never to unlimited

Producer: Watcher for Phase 4 (the numbers live in its Domain table today). Because it is
bus-delivered, the producer can later move to Archiver — the natural home if a second
issuer ever exists — with no Replicator change at all. That portability is the reason for
the indirection.

Enforcement mechanism: when a host's bucket is dry, leave the message in the PEL and let
the reclaim bring it back. That is already the idiom for the disk ceiling — a policy check
in the handler, not new machinery.

Reviewing a proposed payload field

One question: does this name a domain concept? politeness_key: str passes — opaque to
Replicator. info_source_id fails. The wire's domain-agnosticism is the property the whole
issuer contract is built on; it erodes one plausible field at a time.

Known violation, tracked

blob_uri is a host-local file:// path and nothing on the wire says so. Any consumer
must live on Replicator's VM — a shared-filesystem data-plane coupling in a service
otherwise reached only through the broker, and a constraint on the issuer's deployment
topology that the issuer never agreed to. Tracked in #7 (object-store blob backend).

Recorded here as a violation rather than omitted: a charter that asserts an isolation the
code does not have teaches its readers that the document is decorative.

Cluster-side corollary

The single-fetcher invariant is only true if issuers hold up their end. Watcher's
create-time probe_url currently fetches origins outside Replicator's politeness envelope;
Phase 4 resolves it by making create asynchronous (item enters a probing state, a normal
content.fetch is issued, final_url on the fact fills in the resolved URL). After that,
no service but Replicator fetches watched content. Worth stating here because the
invariant is the cluster's, not this repo's alone — and worth an issuer-side test, in the
issuer's repo.

---

Enforcement — tests/test_boundaries.py

Six assertions, ~120 lines, all currently passing. The point is failing a PR, not
documenting an intention.

Invariant	Test
No database	no persistence dep resolves in the lock (sqlalchemy, asyncpg, psycopg, alembic); no sqlite3 import
No domain vocabulary	grep/AST over src/: info_source, info_item, watched_item, watch, tenant, aspect never appear
Ingress is health-only	app.routes equals an allowlist
No locally-defined wire models	no Pydantic model in src/ declares an event_type field — every wire payload comes from co-core
No issuer SDK	no dependency on archiver-client, notifier-client, or any sibling repo
Config surface	every Settings field is REPLICATOR_*-prefixed; no file or network reads at import time

The domain-vocabulary grep is the load-bearing one. It is crude, and it catches the exact
regression no type checker and no reviewer reliably catches, because that regression always
arrives as one reasonable-looking field.

Link the charter from the test module's docstring, so whoever trips an assertion reads the
reasoning before deciding whether to delete it.

Follow-on, not filed yet

The policy stream needs a co-core model (cannobserv), a consumer here, and a producer in
Watcher. Held until CannObserv/cannobserv#270–272 land, to keep one co-core release in
flight at a time.

Refs

• docs/contracts/content-fetch-issuer-contract.md (the wire contract this sits beside)
• Object-store blob backend (claim-check) — remove the shared-filesystem data-plane coupling #7 — object-store blob backend (the tracked violation)
• Publish fetch_failed facts so permanent failures stop being silent (cannobserv#270) #9, Emit the enriched BlobAvailableEvent fields (cannobserv#271) #10, Honour ContentFetchCommand request options: headers, timeout_seconds (cannobserv#272) #11 — the Phase 4 contract additions
• Phase 4: build the content.fetch producer against Replicator's issuer contract watcher#241 — Phase 4 issuer
• Observer cluster integration strategy: co-core substrate + bus paradigm + Replicator seams archiver#72 — cluster integration strategy (the boundary reallocation this formalizes)

[gregoryfoster]

Endorsed — plus three of the six assertions don't pass yet, and politeness deserves the worked-example slot

Came at this from the opposite direction: while closing out #9 I traced what happens to per-domain rate limiting at the Phase 4 cutover, reached "this should move to Replicator," and then found the charter had already answered it — better than I had.

Reviewed the six invariants by running them as specified against main at f7328ec. The doc and tests/test_boundaries.py don't exist yet, so this is a dry run of the spec, not a regression report.

---

1. Three assertions would fail as written

All three are pre-existing — each predates this issue, and none was introduced by #9. The claim "all currently passing" is the thing to fix, not the code.

🔴 Assertion 2 (no domain vocabulary) fails on an English verb.

$ grep -rniE "info_source|info_item|watched_item|\bwatch\b|tenant|aspect" --include=*.py src/
src/worker/main.py:203:    ``_run_until_first_exit``. Ties are common: both tasks watch one stop event.

One hit, and it is prose in a docstring. This matters more than the other two because it is the assertion the issue itself calls load-bearing: "it catches the exact regression no type checker and no reviewer reliably catches." A test that fails on the ordinary English verb "watch" is a test whose first tripper weakens it, deletes it, or # noqas the line — and then it is not catching anything.

Two changes keep the tooth: drop the bare watch (keep watched_item, which is the actual domain noun), and scope the scan to identifiers, not comments and docstrings. ast.walk over Name/Attribute/arg/FunctionDef/ClassDef/assignment targets gets there and is barely longer than the grep. The domain regression this is built to catch always arrives as a field or parameter name, never as a comment — so narrowing to identifiers loses nothing real and removes the whole false-positive class.

🟡 Assertion 6 (config surface) fails by a decision already taken.

build_id    alias=BUILD_ID

Every other Settings field is REPLICATOR_*. BUILD_ID is deliberately unprefixed — AGENTS.md: "BUILD_ID is deliberately unprefixed — the systemd unit stamps it generically." So the assertion as written encodes a rule the repo has consciously departed from. Needs a named exemption in both the test and the charter, otherwise the first person to run it concludes the charter is wrong about the codebase.

🟡 Assertion 3 (ingress is health-only) is under-specified in two ways.

The live surface is not one path:

/health  /docs  /docs/oauth2-redirect  /redoc  /openapi.json

The three FastAPI introspection endpoints are read-only and are not the "inbound admin HTTP API" the charter rejects by name — so I do not think they violate the intent. But "Ingress stays health-only, as an enforced invariant rather than a habit" does not admit them, and a charter should not need a reader to infer the exception.

Second: app.routes does not flatten to a comparable list. /health is registered through include_router, so it appears as an _IncludedRouter, not a Route — a naive equality check against ["/health"] fails while also not seeing /health. The test needs to recurse into included routers and compare starlette.routing.Route paths.

Pick one: allowlist the three introspection paths explicitly (and say why in the charter), or pass docs_url=None, redoc_url=None, openapi_url=None when not in dev and assert the surface is exactly /health. I lean to the second — it makes the invariant literally true, and the dev app can keep them behind the same flag that already distinguishes port 8041 from 8040.

💭 Assertion 4's spec is right; guard against the wrong implementation. "No Pydantic model in src/ declares an event_type field" is exactly the right test and it passes. But a grep for event_type returns two legitimate hits in loop.py — a comment, and command.event_type reading a co-core model's own field. Worth a line in the test saying it is an AST check on ClassDef bases/annotations, so nobody "simplifies" it into the grep that cries wolf.

💭 One vocabulary question #9 created after this issue was filed. src/core/errors.py::FailureReason is a locally-defined StrEnum of wire tokens — the reason values on fetch_failed. co-core deliberately types reason as a plain str rather than a Literal so a producer adding a token cannot crash an older extra="ignore" consumer, which puts the vocabulary on the producer by design. I believe that is correct and it passes assertion 4 (not a Pydantic model, no event_type). But "no locally-defined wire models" reads as forbidding it, and someone will eventually argue the enum belongs upstream. One clarifying line — the rule governs payload shapes, not producer-owned token vocabularies — closes that off before it costs a review round.

Related: CannObserv/cannobserv#277 asks co-core to strike wrong_payload_type from its documented token list (it has no safe implementation — see #9's first review round), which makes this repo's enum the more accurate list, not the less.

---

2. Politeness deserves the worked-example slot, not a sentence

The charter currently gives politeness one line — "Politeness is the case: cross-command state (→ Replicator) plus per-host operator config (→ issuer)" — and gives conditional GET the full worked treatment. I would swap the emphasis, for three reasons.

It is the harder case, so it is the one that teaches the rule. Conditional GET resolves on test 1 alone and stops: durable per-resource history → issuer, done. Politeness is the case where the tests do not resolve to one side —

Test	Politeness
1 — durable per-resource history?	No. Per-host, and rebuildable from replay. Not the issuer on this test.
2 — cross-command coordination over a resource only the fetcher can see?	Yes. A host's tolerance. "N issuers being polite independently is a fiction" is exactly this row.
3 — expressible without domain vocabulary?	Yes. A hostname is a network fact, not an InfoSource.

— and the resolution requires the mechanism/policy split rather than a verdict. That split is the charter's most generalizable idea and right now it is stated as an aside. A reader who only skims the worked example learns the easy pattern and misses the general one.

It is about to be exercised for real, which conditional GET is not to the same degree.

And there is a concrete failure mode to cite, which is the strongest thing a worked example can have. See below.

---

3. The gap: an ordering constraint, not a follow-on

This is the one thing I would add that is not already here.

The charter files the policy stream under "Follow-on, not filed yet — held until CannObserv/cannobserv#270–272 land." Two updates: #270 has landed (co-core v0.7.2; producer side shipped as #9 today). And more importantly, "held until those land" is a dependency, not a deadline — nothing ties the policy stream to the Phase 4 cutover, and that is where it bites.

Traced through the Watcher checkout:

• src/workers/tasks.py:141 reads fetch_result.status_code == 429 off Watcher's own fetch, then report_rate_limited_for_domain → _persist_backoff → Domain.current_interval.
• src/core/rate_limiter.py::acquire_for_domain sleeps on current_interval — so it is not bookkeeping, it is the live throttle on Watcher's outbound requests.
• Replicator has no rate limiting. Verified: the only match for rate_limit|throttle|per_domain|acquire_for in src/ is a comment I wrote in handler.py last week.

So at the moment tasks.py stops fetching and starts issuing content.fetch:

	Watcher's limiter	Replicator's pacing
today	live	none
cutover, policy stream not built	dead — paces command publication, not origin requests; 429s never seen, so nothing feeds current_interval	none
after the policy stream	config producer	enforcement

The middle row is a window in which the cluster has no per-domain politeness at all, against real origins, and nothing in either repo would report it — Watcher's limiter does not fail, it just becomes decorative.

That is not a charter question; the charter settles who owns what. It is a cutover blocker, so I filed it on the issuer side rather than adding it to the follow-on list here: CannObserv/watcher#245.

Suggested charter wording, in the policy-stream section:

The policy stream is a precondition of the Phase 4 cutover, not a follow-on to it. Watcher's limiter is load-bearing today and stops functioning the moment its fetch path becomes a publish path — it does not fail, it silently becomes decorative. Either the stream ships first, or the cutover carries a conservative per-host default in Replicator as an interim.

The second option is worth keeping on the table: a single conservative default, env-configured, is far less work than the stream and closes the window. It also fits the charter cleanly — a default is mechanism, not policy.

---

Summary

The charter is right, and it answered a question I had reached independently and worse. Three changes I would make before it ships:

1. Fix the three assertions so "all currently passing" is true — the identifier-scoping fix on assertion 2 is the important one.
2. Promote politeness to a full worked example; it teaches mechanism-vs-policy, which conditional GET does not.
3. State the policy stream as a cutover precondition, with the conservative-default interim as the cheap alternative.

Happy to implement all three, plus tests/test_boundaries.py, if you want it picked up.

[gregoryfoster]

Endorsed, with seven assertions rather than six — and the ingress one currently guards the wrong process

Ran the six assertions against main independently before reading the review above. All three of its failures reproduce exactly:

Assertion	Result
2 — domain vocabulary	fails: src/worker/main.py:203, both tasks watch one stop event — prose, one hit
6 — config surface	fails: src/core/config.py:202, build_id → BUILD_ID, deliberate per AGENTS.md
3 — ingress health-only	fails: live routes are /openapi.json, /docs, /docs/oauth2-redirect, /redoc, plus an _IncludedRouter whose path is None. /health is invisible to a flat comparison
1, 4, 5	pass

Two corrections to the review, neither of which changes its conclusions:

• There is no politeness comment in handler.py — rate.?limit|throttle|polite|per_domain returns zero matches across src/. The underlying claim holds and is if anything stronger: Replicator has no pacing of any kind.
• CI already exists. .github/workflows/ci.yml runs pytest on every PR to main, so "CI-enforced" is accurate today and tests/test_boundaries.py gets teeth with no workflow change.

---

1. The ingress assertion guards a process that is not deployed

This is the one structural problem I would fix before the charter ships, because it makes the document assert an isolation the enforcement does not have — the same failure mode the blob_uri section is careful to avoid.

"Ingress stays health-only, as an enforced invariant rather than a habit" is tested against app.routes — that is src/api/main.py, which AGENTS.md calls dev-only and which nothing deploys. The deployed artifact is the worker, and its relevant property is that it binds no port at all. As specified, assertion 3 could keep passing forever while someone adds an aiohttp admin listener to src/worker/, and nothing fires.

Add a seventh assertion covering the deployed process. tests/test_deploy.py already parses the unit, so it is nearly free there: ExecStart is the worker module, no uvicorn and no --port anywhere in the unit, and no server framework is importable from src/worker/. The rejected fourth channel is an inbound HTTP API; the test should be about the process that would host one.

2. Scoping the vocabulary scan to identifiers closes one false-positive class and opens one blind spot

Agreed on dropping bare watch (keep watched_item) and on skipping comments and docstrings — the English-verb hit is exactly the tripper that gets a test deleted.

But identifiers alone are not where all of the regression lives. Domain leakage also arrives as a string literal: a dict key {"info_source_id": ...} in a detail payload, a stream name, a log field. Those are the ones a reviewer skims past.

Scan Name / Attribute / arg / FunctionDef / ClassDef / assignment targets and ast.Constant string values, excluding the docstring Expr at module, class and function head. Same false-positive class closed, one real class kept.

3. Route allowlist — I would take the opposite option

The review leans toward docs_url=None, redoc_url=None, openapi_url=None outside dev so the surface is literally /health. I would allowlist instead, for two reasons:

• it introduces a dev/prod flag, which is a new config knob the charter's own taxonomy then has to place — for a surface no deployment serves;
• it makes the app under test differ from the app that ships, which is the property the charter is otherwise trying to protect.

Recurse into _IncludedRouter, compare starlette.routing.Route paths against an explicit allowlist of the four introspection paths plus /health, and restate the invariant as what it actually is:

No route accepts state-changing input. Ingress is read-only liveness and self-description.

That is the rule the "no inbound admin HTTP API" paragraph is really making, and it admits /docs without needing a reader to infer the exception.

4. "No database" needs the rest of stdlib

sqlite3 alone misses shelve, dbm, and pickle-to-disk. Assert against uv.lock package names — declarative, so a dirty local env cannot make it pass — plus an AST import check over the wider set.

5. The policy stream has three mechanism problems the draft does not cover

All three constrain the numbers Watcher will publish, so they belong in the charter rather than in the follow-on issue.

Boot replay from 0-0 over a stream nothing trims is unbounded. This is the exact growth argument #9 §3 used to defer non-terminal facts, and here it costs boot time as well as memory — replay length grows with policy history, not with host count. The "owner republishes the full set periodically" property is what causes it, so the two must be specified together: the producer XADDs with MAXLEN ~ N, N sized above the host count.

Say why a Redis hash was rejected, or it gets re-litigated on the first review. Broker state is explicitly permitted by test 1, so a reader will reach for HGETALL and it is a genuinely reasonable reach. The answer — no schema_version, no co-core model, and Replicator coupling to a key name instead of a payload contract — is good; it just needs to be written down.

Park-and-reclaim has a rate floor, and it is 60 seconds. Enforcement via TransientFetchError → PEL → reclaim is the right idiom and the delivery-ceiling interaction is safe (transient is exempt, same as _raise_for_ceiling). But retry granularity is REPLICATOR_CLAIM_MIN_IDLE_MS, default 60000. A policy asking for 10s per-host spacing cannot be honoured — the mechanism will be more polite than requested. That is safe in the right direction, but it silently throttles the cluster below its configured rate, and Domain.current_interval in Watcher is where the mismatch will first show. The floor needs stating in the charter, next to the enforcement idiom.

6. Conservative default as the interim — endorsed

One env var over the existing ceiling idiom, mechanism rather than policy, closes the cutover window described in watcher#245. It inherits the same 60s floor, which is acceptable for an interim and worth a sentence so nobody tunes it below that expecting an effect.

7. Pin the tracked violation with a test

A characterization assertion that blob_uri starts file:// today, docstring-linked to #7, so the object-store backend flips a written line rather than quietly satisfying an unstated one. A known violation recorded in prose and not in the suite drifts the same way an unwritten invariant does.

---

Agreed without changes

Politeness promoted to the full worked example — it is the case that teaches mechanism-vs-policy, which conditional GET does not. Policy stream as a precondition of cutover rather than a follow-on. The FailureReason clarification, though rather than new wording I would cite src/core/errors.py::FailureReason, whose docstring already makes the argument that co-core's str-typed reason puts the token vocabulary on the producer by design.

Sequencing

1. Charter + tests/test_boundaries.py, seven assertions, fixed so "all currently passing" is true. No co-core dependency; ships now.
2. Conservative per-host default — small, and unblocks the cutover independently of the stream.
3. Policy stream — after the co-core model lands, tracked against Phase 4 cutover blocker: per-domain rate limiting stops working the moment Watcher stops fetching watcher#245.

Picking up step 1.

[gregoryfoster]

Shipped — 24a9b1b (PR #18), charter + 8 enforced invariants + the interim default

Merged to main. CI green on a9266cb; 397 passed, coverage 99.73%.

What landed

• docs/contracts/replicator-boundaries.md — the charter as drafted here, with the three amendments from the review above: politeness promoted to the full worked example, the policy stream stated as a Phase 4 cutover precondition rather than a follow-on, and the FailureReason clarification (citing src/core/errors.py, whose docstring already makes the argument rather than restating it).
• tests/test_boundaries.py — 8 invariants, not 6, run by the existing CI on every PR to main. All pass, and each corpus scan was verified red against a planted violating module before commit.
• src/worker/pacing.py + handler.py::_pace — the conservative-default interim, which closes the cutover window without waiting on the stream.
• CannObserv/cannobserv#285 — the upstream model this issue listed as "follow-on, not filed yet".

Departures from the spec in this issue

Each because the assertion as drafted would not have held, or would not have held for long:

Drafted	Shipped	Why
grep for domain vocabulary	AST over identifiers and string literals, docstrings/comments skipped; bare watch dropped, watched_item kept	the grep matched both tasks watch one stop event. String literals are in scope because leakage arrives as a dict key (detail={"info_source_id": ...}) as often as an attribute
ingress is health-only	ingress is read-only: allowlisted paths, GET/HEAD only, recursive walk	FastAPI's introspection routes are not the admin API this rejects; a dev/prod docs flag would make the app under test differ from the app that ships
6 assertions	8 — added the deployed process has no ingress and the tracked violation is pinned	the drafted ingress test covered src/api, which nothing deploys. An admin listener could have grown inside src/worker/ with the invariant still green
every Settings field is REPLICATOR_*	plus BUILD_ID exempted by name, with a second test pinning the exemption list at one entry	the repo departed from the rule deliberately; an unnamed exemption reads as the charter being wrong about the code

Two review rounds applied on top (16d84f3, 380b3d7). The one worth naming: the ingress route walk failed open twice — a Mount carries its prefix on .path, so a sub-app mounted at /admin reported its children's bare paths (GET /admin/health passed the allowlist as /health), and a WebSocketRoute contributed nothing at all. Mounting a sub-app is the shape an admin API would actually arrive in. Both are now planted as tests.

The interim default, and one number worth recording

REPLICATOR_MIN_HOST_INTERVAL_SECONDS, default 1.0 — Watcher's own DEFAULT_MIN_INTERVAL, chosen because it invents nothing: the numbers are the issuer's under this charter, so the least-wrong stand-in is the one the cluster already commits to.

Park-only would have been wrong by 60×. A parked wait cannot be shorter than REPLICATOR_CLAIM_MIN_IDLE_MS (60 s) while the normal interval is 1 s, so every host would have been paced at 1/60th of today's rate — silently, and in the safe direction, which is what would have made it easy to ship. The wait is therefore split by duration: <= REPLICATOR_READ_BLOCK_MS sleeps in the handler, longer parks for claim_stale. The bound is derived from the poll window rather than given its own knob, and tests/test_deploy.py pins the third term of the TimeoutStopSec sum.

Known limitations, recorded rather than omitted

• blob_uri is still host-local file:// — the charter's tracked violation, now pinned by a characterization test so Object-store blob backend (claim-check) — remove the shared-filesystem data-plane coupling #7 flips a written line.
• Pacing keys on the host asked for, not the host reached. httpx follows redirects inside the driver, so URLs funnelling into one portal hit it at N× the intended rate. final_url is available where the fix would go, but recording the landing host breaks "one request, one record", so it belongs to the policy stream's design. In the charter under Known limitation.

Follow-up, not in scope here

• CannObserv/cannobserv#285 — the policy-stream model, plus two gaps filing it surfaced: BusPublish cannot carry a MAXLEN (so the trimming the charter requires is currently unexpressible through co-core), and AsyncBusConsumer is group-only (no seam for a replay-then-tail read).
• Phase 4 cutover blocker: per-domain rate limiting stops working the moment Watcher stops fetching watcher#245 — the issuer-side cutover work.
• The issuer contract gained a does not guarantee line about burst pacing; announcing that on Phase 4: build the content.fetch producer against Replicator's issuer contract watcher#241 per the contract's own change rule is still outstanding.