Problem
Availability cursor context currently binds the offering and requested range, but not the policy revision, facts revision, or runtime cursor format. A policy, records, or runtime change during the 15-minute cursor lifetime can therefore combine pages from different availability result sets.
Mutations remain protected by policy and facts revision fences, and availability is a live authorized listing, so this cannot commit stale capacity or expose a new trust boundary. The effect is bounded to skipped or repeated availability entries.
Small follow-up
- Add an explicit cursor-context format version.
- Bind availability cursors to the current policy and facts revisions.
- Return
cursor.invalid when any bound revision changes.
- Add regressions for policy publication, records replacement, and unchanged-revision continuation.
- Check other facts-backed listing cursors for the same binding rule.
PR #1092 narrows its upgrade documentation to the behavior implemented today; this issue restores strict continuation invalidation without blocking the beta.
Problem
Availability cursor context currently binds the offering and requested range, but not the policy revision, facts revision, or runtime cursor format. A policy, records, or runtime change during the 15-minute cursor lifetime can therefore combine pages from different availability result sets.
Mutations remain protected by policy and facts revision fences, and availability is a live authorized listing, so this cannot commit stale capacity or expose a new trust boundary. The effect is bounded to skipped or repeated availability entries.
Small follow-up
cursor.invalidwhen any bound revision changes.PR #1092 narrows its upgrade documentation to the behavior implemented today; this issue restores strict continuation invalidation without blocking the beta.