Pointer & meta
archive.toml
The rotation manifest, at
.working/toml/archive/<YYYY>/archive.toml, one per calendar-year bucket.
About
Rotation is relocation, never deletion, and never ID reuse. Records in unqualified terminal
states may rotate into calendar-year buckets on manifest-declared age or size thresholds, and
each rotation writes the year's archive.toml, enumerating every moved ID (and,
for the worklog, every moved span) with its destination.
Why
Active indexes should stay small without history getting quietly thinner. The enumeration is what makes a silent removal detectable: every movement is recorded, so a record cannot vanish under the name of rotation, and validation can confirm that every ID exists in exactly one active or archived location.
Description
A closed three-key shape: schema, moved (rows of
{id, type, destination}), and worklog_moved (rows of
{span, destination}). The archive directory also carries the rotated record and
worklog files themselves, preserved byte for byte.
How it works
Open records, active blocks, unresolved decisions, unresolved fragments, unexpired waivers,
the current handoff, and the unreleased worklog tail never rotate; worklog records rotate
solely under the release rule (only released, frozen spans). Coverage gates read active and
archive together, so rotation never changes any gate's answer, and counters.toml
is untouched, preserving ID permanence. Retention is indefinite by default; an adopter bound
by a retention policy applies it as a recorded maintainer decision governing archival, never
as deletion of a record.
Generated view
None of its own; archived records surface through the same gates and coverage checks as active ones, read together.
Value
A store that stays fast to read without ever forgetting, with rotation that is provably lossless: the enumeration plus the one-location invariant helps prevent quiet disappearance of history.
Usage
- Created by: the first rotation into a year bucket; not scaffolded.
- Updated by: each rotation, appending the moved IDs and spans.
- Read by:
opf doctor(archive integrity, the exactly-one-location rule, ID partition); every coverage gate, which reads active and archive together.