Recorded upstream wish, not actively pursued — our own system handles expiry (gate-level enforcement, FelineStateMachine/lofi-node#12).
What the vendor surface would be, if jazz ever ships it: an optional client-asserted expiresAt on the sealed batch submission's cleartext envelope (covered by the batch digest), compared against arrival time at first adjudication only, rejecting through the existing batch-settlement path with a stable expired code carrying the same three properties permission_denied satisfies today (batch-id correlation, reconnect re-derivation, determinism). Full drafted spec: docs/upstream-write-expiry.md in FelineStateMachine/lofi-node#13.
Why it would still be preferable to gate-level enforcement if it existed: soundness would be protocol-scoped (expiry gates first acceptance at the store; accepted batches replicate freely) rather than deployment-scoped (every sync path must pass a filtering gate, forever), with no coupling to wire-format stability and no parallel verdict channel.
Client readiness is already in place either way: expired is registered permanent in the verdict taxonomy, and the effect system's cause: "denied" | "expired" union activates compensation with no API change once any enforcement exists.
Recorded upstream wish, not actively pursued — our own system handles expiry (gate-level enforcement, FelineStateMachine/lofi-node#12).
What the vendor surface would be, if jazz ever ships it: an optional client-asserted
expiresAton the sealed batch submission's cleartext envelope (covered by the batch digest), compared against arrival time at first adjudication only, rejecting through the existing batch-settlement path with a stableexpiredcode carrying the same three propertiespermission_deniedsatisfies today (batch-id correlation, reconnect re-derivation, determinism). Full drafted spec:docs/upstream-write-expiry.mdin FelineStateMachine/lofi-node#13.Why it would still be preferable to gate-level enforcement if it existed: soundness would be protocol-scoped (expiry gates first acceptance at the store; accepted batches replicate freely) rather than deployment-scoped (every sync path must pass a filtering gate, forever), with no coupling to wire-format stability and no parallel verdict channel.
Client readiness is already in place either way:
expiredis registered permanent in the verdict taxonomy, and the effect system'scause: "denied" | "expired"union activates compensation with no API change once any enforcement exists.