commit 322dd2ebad21db11c5c2539a9027687a9cc8a049
parent 98c18ddc2d09df4dff6df7c53f3cad1edc44abd5
Author: bohdan-potuzhnyi <bohdan.potuzhnyi@gmail.com>
Date: Mon, 7 Sep 2026 22:26:54 +0200
dd98 small fixes
Diffstat:
2 files changed, 7 insertions(+), 9 deletions(-)
diff --git a/core/merchant/post-fountain-withdraw.rst b/core/merchant/post-fountain-withdraw.rst
@@ -18,11 +18,10 @@
unchanged when retrying; JSON whitespace and object member order do
not matter.
- A completed result stays available for as long as the tokens it covers
- can still be used, that is until the issue keys it was signed with stop
- being valid. This holds across changes to the grants or the key window
- of the fountain. Afterwards the result is garbage collected along with
- the withdrawal counters it accounts for, and a repeated request is
+ A completed result is retained in full until the latest issue-key expiry
+ among all entries of that withdrawal, even if some entries expire earlier.
+ This holds across changes to the grants or the key window of the fountain.
+ Afterwards the result may be garbage collected, and a repeated request is
treated as a new one; deleting the fountain drops its results at once.
Quota consumption, issued-token records and the replay result are
committed together before a successful response is sent.
diff --git a/design-documents/098-token-fountains.rst b/design-documents/098-token-fountains.rst
@@ -239,10 +239,9 @@ hash. Retrying with the same ``grants`` array returns the original result
without consuming quota or signing again, even if the grants or key window
have changed. Quota consumption, issued-token records and replay data are
committed in one transaction so a failed operation does not consume quota.
-Replay data is retained until the issue keys of the stored signatures expire:
-past that point the tokens it would hand back are worthless and the quota it
-protects has been collected as well, so it is garbage collected together with
-the withdrawal counters. Deleting a fountain drops its replay data at once.
+Replay data is retained as a complete response until the latest issue-key
+expiry in the withdrawal, even if some entries expire earlier. Deleting a
+fountain drops its replay data at once.
Deletion invalidates future requests using the credential. It does not
invalidate tokens that the wallet already withdrew.
