# macltok design decisions the contract the working tree actually implements. if the code disagrees with this, one of them is lying and it should be fixed ## two ways in, one way out state changes are commands. `ClientHandle::send` queues one and hands back a `Pending`, `execute` queues and waits, and there's an awaited convenience method for every command. each command answers exactly once with `Result`. drop the `Pending` if you don't care, the command still runs pure reads skip the engine and ask the sdk directly through the handle. rooms, members, power levels, account data, devices, push notification resolution, and media bytes all live here the event stream carries state and only state. timelines, history, typing, rooms, connection, encryption, verification, upload progress, session. no command results ride on it. drain it from its own task, it's bounded and the engine waits for you one error type for everything, `Error { kind, message, challenge }`. match on `kind`. `Interrupted` means the engine stopped, the room closed, or the task doing the work died before it could answer. `challenge` turns up with `InteractiveAuthRequired` ## engine the run loop routes and does nothing slow. every task it spawns is registered with a context. a command task that panics costs its caller an `Interrupted` and gets logged. a watcher or a room actor that panics takes the engine down, emitting `Failed` then `Stopped` sync restarts itself with backoff after an error or an unexpected stop, and `ConnectionChanged` shows `Offline` meanwhile. every return to `Online` re-arms the send queues, since the sdk parks a room's queue on any send failure and never unparks it. a recoverable failure while online gets the room another go after a few seconds logout and a rejected token both stop the engine. `Shutdown` answers once `Stopped` has gone out ## rooms one actor per open room. the engine holds a slot per room, `Active` with a sender or `Closing` with a fifo of opens and closes that arrived while it wound down. those replay in order once the actor exits. a room you leave, or get kicked or banned from, closes itself opening sends `TimelineReset` on the stream before it answers. opening an already open room sends a fresh reset, so a second frontend gets a snapshot sends, edits and replies run on the actor in order, so they reach the send queue in the order they were asked for. redactions, reactions and read receipts are network calls, so they run beside the actor and a slow one doesn't queue the room behind it. closing lets them finish rather than lie threads belong to their room's actor. commands for a thread that's still opening wait behind the open, up to the actor's queue capacity pagination runs one request at a time per timeline and emits `HistoryChanged` around each. the sdk remembers where history starts, we don't, because a gappy sync can unload it again every task inside an actor is supervised, and a panic in any of them panics the actor ## timelines `TimelineDiff::try_apply` refuses a diff whose indices don't fit your snapshot and leaves the snapshot alone. stop applying, `resync`, and carry on from the next `TimelineReset`. resync kills the old watcher before the new reset goes out, so no stale diff can land after it `TimelineId` tells a room from a thread by its root event ## mutations membership, moderation, power levels, room creation and account data writes go through one keyed fifo scheduler. same room, same alias, same dm partner or same account data type run in order, everything else runs at once. `create_direct` hands back the existing dm when there is one notifications and encryption each get one serial worker. the encryption worker owns the verification controller outright power level changes build one state event from the local mapping, since the sdk's own patcher is private ## media media is a read. `ClientHandle::media` takes a `MediaId` a retained timeline handed you, `mxc_media` takes any plain mxc uri. both share one bounded download path with the byte cap the sdk's own download lacks, and concurrent asks for the same bytes share one flight the cache holds plaintext, keyed like the sdk keys it, so the sdk and macltok can read each other's entries. that's how your own encrypted uploads come back media ids are registered as timelines render and forgotten when their timeline closes, least recently seen first once the cap is hit uploads are commands that answer once the send queue has them. progress and failure arrive as events from one watcher on the sdk's global send queue ## sessions and secrets `Session::login_password`, `begin_oauth` and `restore` share one client builder with encrypted sqlite, refresh tokens and threads. secret-bearing inputs don't derive `Clone` the caller owns the saved record. save `Session::record()` after login and replace it atomically with `ClientHandle::session_record()` on every `SessionTokensChanged`. logout and a hard rejection kill the record and the store. a soft logout keeps the store for a same-device login, or the e2ee keys go with it. a bare `Stopped` kills nothing. one store directory per login ## notifications and room data the notification client is built lazily and shares the engine's sync service. sdk ui types stay behind the boundary `rooms` normalises on demand with bounded concurrency and sorts by latest event, then name, then id. `RoomsChanged` is an invalidation, coalesced so one sync touching fifty rooms is one event ## verification `Confirm`, `Reject` and `Cancel`. reject tells the other side the emoji didn't match. the watcher and the action paths claim the terminal event, so a racing cancel can't turn `Done` into `Cancelled` ## public model owned ruma ids and typed data wherever there's a stable shape, `Raw` where arbitrary content has to survive. anything expected to grow is `#[non_exhaustive]`. `Engine::from_client` stays public for people who built their own client