Hold 0116's rule per kind, and the window no listener may lengthen

.github/coverage/pinned-surface

@@ -85,6 +85,7 @@ module  src/cache/mod.rs            The store interface, the one failure it may
 module  src/cache/key.rs            How that key is built. 0041 makes a collision here a disclosure rather than a stale answer, because part of the input came from a server 0101 does not trust.
 module  src/cache/bound.rs          What the core asks the store to hold, what it evicts, and what it does when the device refuses.
 module  src/cache/envelope.rs       The envelope every entry is written inside and the four readings a read takes before the payload is looked at. 0105 makes a wrong answer here an entry another build wrote, or a write a power cut left unfinished, read as though this build had written it, which is a wrong field shown to somebody rather than an error.
+module  src/cache/notification.rs  0116's second of the three ways an entry stops being trusted: which entries a change the server reported invalidates, which it shortens to zero, which it leaves where 0043 put them, and that no state of a listener lengthens a window. A defect here empties a tile wall on every notification, lets one account on a shared device move another's entries, or holds a library for a day because something was connected and silent.
 module  src/cache/freshness.rs      Whether what the store handed back may be shown and how old it is. 0043 makes a wrong answer here a person seeing something that is not there any more, and the two guards on the age are what stop a wrong device clock making an entry fresh forever.
 module  src/diagnostics/mod.rs      The event a client's sink receives, the level it is judged against, and the point 0071's treatment is applied at, which 0101 places outside the boundary.
 module  src/diagnostics/redaction.rs Which of 0071's three treatments a field name carries and what a reduced value becomes. A defect here is a value 0068 calls personal reaching a sink whole.

src/cache/mod.rs

@@ -39,6 +39,13 @@
 //! which is #27. Nothing in this tree fetches bytes out of a store and hands
 //! them anywhere.
 //!
+//! [`notification`] holds 0116, which is the second of the three ways 0006 says
+//! an entry stops being trusted and the one [`freshness`] is not: which entries
+//! a change the server reported invalidates, which it shortens to zero, which it
+//! leaves where the table put them, and the prohibition that no state of a
+//! listener ever lengthens a window. It listens to nothing, for the same reason
+//! the demand for freshness has no caller.
+//!
 //! The rest of the sentence is unchanged. The cold-start path is #46, and the
 //! index that survives a restart is #105, so every entry [`freshness`] describes
 //! is one this version wrote completely. Nothing here decides either of those.
@@ -47,6 +54,7 @@ pub mod bound;
 pub mod envelope;
 pub mod freshness;
 pub mod key;
+pub mod notification;
 
 /// The name one cache entry is kept under.
 ///