pub struct PendingSentinel {
pub verb: String,
pub consumed_mtime_unix_ns: u128,
pub consumed_at: u64,
pub nonces: Vec<String>,
pub note: Option<String>,
pub scope: Option<Vec<String>>,
pub torn: bool,
pub whole_tree: bool,
pub id: String,
}Expand description
A consumed sentinel awaiting honor (.flint-sync/<verb>.pending.json).
Fields§
§verb: String§consumed_mtime_unix_ns: u128The latest covered touch, in nanoseconds — bare-touch agents match their boundary on this.
consumed_at: u64§nonces: Vec<String>EVERY coalesced nonce, oldest dropped past MAX_NONCES.
note: Option<String>§scope: Option<Vec<String>>§torn: boolAn unparsable or oversize body was honored as a bare touch — a warning conflict record names it. Never a wedge, never a silent drop.
whole_tree: boolA coalesced touch asked for the WHOLE tree (no scope); later
scoped touches must not narrow it (review 2026-09-12, inbox-7).
id: StringMinted when the record is created and kept across every fold, so
the carrier (IntentJournal::carrier) of an install that carried
an EARLIER touch of this record still answers when a later touch
coalesces with it. Fresh on every fold, it orphaned that carrier:
a peer’s delete of a path the first touch declared, between that
touch’s install and its ack, was answered ok once a second touch
folded in (row 15 plan, D7, 2026-10-14). A retired record takes its
id with it, so a carrier left from it matches nothing. Empty on a
record written before the field: then nothing matches it and the
ack reads the honoring barrier’s own report.