In WD16
Section 3.2.1.4 Clean Session should refer to Section 4.1 for a description of the limitations of stored state.
Remove
"State could be lost by either the client or server due to the storage mechanism used, or an administrator action. This could result in the loss or duplication of messages regardless of the QoS used. "
Change
"After disconnection, the Server MUST accumulate further QoS 1 and QoS 2 messages that match any subscriptions that the client had at the time of disconnection [MQTT-3.1.2-4]. It MAY accumulate QoS 0 messages that meet the same criteria."
to
After disconnection, the Server MUST store further QoS 1 and QoS 2 messages that match any subscriptions that the client had at the time of disconnection as part of the Session state [MQTT-3.1.2-4]. It MAY also store QoS 0 messages that meet the same criteria.
Change
"The Session state in the client consists of:
• QoS 1 and QoS 2 messages for which transmission to the server is incomplete.
• The client MAY store QoS 0 messages for transmission after the CONNECT Packet has flowed.
The Session state in the server consists of:
• The client's subscriptions.
• All QoS 1 and QoS 2 messages for which transmission to the client is incomplete or where transmission to the client has not yet been started.
• The server MAY store QoS 0 messages for which transmission is incomplete or where transmission to the client has not yet been started."
to
"The Session state in the client consists of:
• QoS 1 and QoS 2 messages for which transmission to the server is incomplete.
• The client MAY store QoS 0 messages for later transmission.
The Session state in the server consists of:
• The client's subscriptions.
• All QoS 1 and QoS 2 messages for which transmission to the client is incomplete or where transmission to the client has not yet been started.
• The server MAY store QoS 0 messages for which transmission to the client has not yet been started.
"
In section 4.1 add:
Non normative comment
Normal operation of the Client of Server may mean that stored state is lost or corrupted because of administrator action,
hardware failure or software failure. An administrator action could be an automated response to defined conditions.
These actions might be prompted by resource constraints or for other operational reasons.
For example the server may determine that based on external knowledge, a message or messages can no longer be delivered to any current or future client.