From 316de606717c74e7783e7b21517a72cabf2506a7 Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Wed, 2 Sep 2026 18:22:43 -0400 Subject: [PATCH] =?UTF-8?q?FABRIC-3.md=20=C2=A7H.10:=20close=20pin-authori?= =?UTF-8?q?ty=20choke=20point=20--=20session=20owns=20both=20directions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Decided: session_set_pinned()/session_is_pinned() (or equivalent) are the sole read AND write path for pin state -- nothing, including existing Stadium code, touches STADIUM_FLAG_PIN on the patron header directly anymore. Not just a write-side guard. Co-Authored-By: Claude Opus 5 --- FABRIC-3.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/FABRIC-3.md b/FABRIC-3.md index a93f936..1dbdc77 100644 --- a/FABRIC-3.md +++ b/FABRIC-3.md @@ -3749,10 +3749,13 @@ child each get their own separate dictionary — `DictEntry` ACL fields are alre scoped per-session. H.3's stack-of-cards model and H.5's word card/elevation trigger stand as decided, unchanged by this check. -Two smaller, lower-risk items flagged in the same pass, not yet acted on: -- **Pin-authority sync risk (H.2).** Session.pinned is authoritative over Stadium's - `STADIUM_FLAG_PIN` bit — needs a single choke-point API so nothing ever writes the Stadium - flag directly and lets the two drift out of sync. Not yet designed. +Two smaller, lower-risk items flagged in the same pass: +- **CLOSED 2026-09-02 — pin-authority choke point (H.2).** Session.pinned is authoritative + over Stadium's `STADIUM_FLAG_PIN` bit. Decided: **full choke point at the session level, + both directions** — both writing and reading pin state go exclusively through session-owned + functions (e.g. `session_set_pinned()` / `session_is_pinned()`); nothing, including existing + Stadium code, reads `STADIUM_FLAG_PIN` directly off the patron header anymore. Session is + the sole authority for both write and read, not just the write path. - **Elevation trigger not yet usable (H.5/H.7).** Rides Hermes messaging, which per this document's own standing completion criterion (D.1) isn't the real implementation yet. Correct on paper, not usable until that substrate exists — expected, not a flaw.