v1.9.0

Tisty 1.9.0

Take this build to every machine before any of them writes again.

The log moves to schema 11. A store written by this version is one an older
Tisty cannot read: a machine still on 1.8.2 meets what this one wrote, refuses
it and says to update rather than reading half of it. Two new events carry the
hand behind the writing, and every document now keeps the name it was written
under. Update them all — in any order, there is nothing to migrate by hand —
and then go on working. A shared folder holding a newer history stops the round
on the old machine instead of letting it write beside it.

Who wrote what

A store signs itself once, with an alias that lives in its own log rather than
in a settings file. Every document is sealed with the name in force the moment
it was written, so changing your alias later leaves yesterday alone; if you
want the old ones under the new name, Tisty offers once, by hand, to re-sign
what is yours — and only when the alias actually changed. What arrived from
somebody else keeps their name whatever you call yourself, and coming home
under your own name is not coming home a guest.

"Edited by" now reads the alias the save was written under instead of whoever
happens to be signing now, so a document brought in from somebody else no
longer claims your name without you ever opening it. Reading a document stamps
no hand on it. Authorship no longer depends on the order two machines happen
to replay in. The cache keeps the signature, so reopening does not forget who
you are, and signing does not bar undo from what came before it. The guide is
signed by Tisty.

A document that travels

A document goes to another Tisty and lands there as its own. Export and import
speak both ways — for Tisty and from Tisty — and Settings offers them beside
the backup instead of only behind a right click. What goes out and what comes
in are counted the same way, and a partial success says how much made it
rather than showing a red line with no figures. What could not come along is
named and counted, never dropped in silence. A parcel too big to fit says so
before it starts, and a landing that cannot be written down takes its bodies
back instead of leaving them loose.

A parcel is judged by the store it came from, not by the name written inside
it: one from somebody who never signed lands without an author instead of
under yours, and a document that arrived from somebody else says so in the
list. The PDF preview shows what the PDF will hold.

A name is not enough to write in a store's name

Anybody handed a parcel can read the name of the store that wrote it, and could
have put that name on one of their own so it landed as though it had been born
there. Every store now keeps a secret beside its name — one that never leaves
the machine — and seals the manifest with it. A parcel wearing the name without
the seal is a stranger's, and so is one with no seal at all. The cost is that
two machines that sync share a name but not a secret, which is what the number
below is for.

A parcel locked with a number

Exporting everything asks who it is for. Handed to somebody, it travels as it
always did and lands there as theirs. Meant for another machine of your own, it
is locked with six digits and lands there as yours, because only that machine
knows them — while whatever was already somebody else's stays theirs at the
other end. A single document is never locked, and an unlocked parcel is always
read as a stranger's.

The zip is sealed in blocks under a key scrypt grinds out of the number, each
block's nonce carrying its count and a last-block byte, so a parcel cut short
will not open as a whole one. It is built inside the store and dies with the
call, so the stick or the shared folder you are locking it away from never
holds it in the clear. The number is asked for in six boxes that take nothing
but digits. Lose it and the parcel is gone: there is no way back in.

Archiving

Archiving closes a document to writing — from the window, the terminal and an
assistant alike — through its own door, leaving the lock to mean what it always
meant. Syncing no longer calls every archived document a conflict.

The shared folder

A machine hands on every history it holds, not only its own. Until now the push
published store/ and nothing else, so everything written by an
assistant, by a machine since retired, or by one restored from a backup reached
the folder mute: its documents went up, its log did not, and whoever arrived
next could not name them. Handing those histories on is guarded the way taking
one back is — only ever longer, only along the same line, and only what can be
read whole. Removing a machine says it may not write any more, not that what it
wrote is erased. A machine that lost its own history takes it back from the
folder, under the same lock every writer to it takes.

Coming down, the log and the documents land before the attachments, and the
round says so as it goes, so the window fills from the log instead of waiting
on bytes nobody is reading. Going up it is the other way, so a round cut short
never leaves a pointer for a file that is not there. A folder whose history
cannot account for its documents hands over only what something still names,
and one that could not be read at all is told apart from one holding strays —
so a folder still arriving is not called broken. Choosing a folder that already
holds another history asks right there instead of sending you to Settings.

A document the folder has and this machine does not is on its way, not lost,
and says so where its body would be rather than in red. Two bodies of one
length that differ before their tail are no longer taken for equal.

The window

The first round on a cloud folder reads everything that is up there, and the
welcome used to wait on all of it — attachments included — without a word. It
now says what it is doing, and goes in on the first word the round sends back:
the log names the tasks and the documents, and the bodies land behind you.

The bar says what it is doing while it locks a parcel, and waits for you when
it is done instead of sitting at 100% with work still to do. A bare number is
what somebody numbered, not a tag.

What's Changed

• Export Tisty by @rgdevment in #23
• Fix/mac shared history by @rgdevment in #24

Full Changelog: v1.8.2...v1.9.0