#89 asked for a decision. This is it, and it is the laziest of the three options listed there: purge the whole pull zone by hand after a repair, one call, documented in the repair procedure.
Why not the other two:
Purging from emit --verify needs a CDN credential emit deliberately does not hold, and emit reports how many blobs it wrote, never which ones — so it could not target the keys anyway.
Waiting out the TTL means 30 days.
Whole-zone rather than per-key costs a cold cache on a zone whose objects are mostly cold, and a repair scatters thousands of keys across the tree regardless.
Also answers the question #89 left open: the zone does not negative-cache. A missing key answers 404 with cache-control: no-cache and cdn-cache: MISS, still MISS on an immediate retry (checked credential-free, 2026-08-01).
Docs only — docs/command-surface.md and nwsync's usage text. The procedure itself lives in sow-platform's NWSync runbook, next to the zone it acts on.
#89 asked for a decision. This is it, and it is the laziest of the three options listed there: **purge the whole pull zone by hand after a repair, one call, documented in the repair procedure.**
Why not the other two:
- Purging from `emit --verify` needs a CDN credential `emit` deliberately does not hold, and `emit` reports how many blobs it wrote, never which ones — so it could not target the keys anyway.
- Waiting out the TTL means 30 days.
Whole-zone rather than per-key costs a cold cache on a zone whose objects are mostly cold, and a repair scatters thousands of keys across the tree regardless.
Also answers the question #89 left open: **the zone does not negative-cache.** A missing key answers 404 with `cache-control: no-cache` and `cdn-cache: MISS`, still MISS on an immediate retry (checked credential-free, 2026-08-01).
Docs only — `docs/command-surface.md` and `nwsync`'s usage text. The procedure itself lives in sow-platform's NWSync runbook, next to the zone it acts on.
Closes #89.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
emit --verify repairs the storage zone; verify reads the pull zone in
front of it, on purpose, because the edge is what a player gets. A repair
is the first thing that ever makes a content-addressed key serve
different bytes, so between the two a warm PoP still answers with the old
blob and a cold one with the new — and verify's verdict settles nothing
until the zone is purged.
The purge stays out of emit: it is one call for the whole zone after a
repair, against a CDN credential emit deliberately does not hold. The
procedure itself lives in sow-platform's NWSync runbook.
Closes#89.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
xtul
#89 asked for a decision. This is it, and it is the laziest of the three options listed there: purge the whole pull zone by hand after a repair, one call, documented in the repair procedure.
Why not the other two:
emit --verifyneeds a CDN credentialemitdeliberately does not hold, andemitreports how many blobs it wrote, never which ones — so it could not target the keys anyway.Whole-zone rather than per-key costs a cold cache on a zone whose objects are mostly cold, and a repair scatters thousands of keys across the tree regardless.
Also answers the question #89 left open: the zone does not negative-cache. A missing key answers 404 with
cache-control: no-cacheandcdn-cache: MISS, still MISS on an immediate retry (checked credential-free, 2026-08-01).Docs only —
docs/command-surface.mdandnwsync's usage text. The procedure itself lives in sow-platform's NWSync runbook, next to the zone it acts on.Closes #89.
🤖 Generated with Claude Code