Idunn/docs/reincarnation-target.md

# Reincarnation after reboot: target

Status: target, Self, 2026-10-18 (campaign `idunn-reincarnation` in Eureka's
mind). It states the ends. The body facts, model page and cut sequence will
live in `reincarnation-map.md`.

## Why

Yggdrasil rebooted at 11:46 UTC on 2026-10-18. Admitted bodies run as
transient systemd units under `/run/systemd/transient`, and the reboot wiped
them all. nginx failed at boot, because it bound `10.77.0.1:17871` before
`wg-gamecult` carried that address. Every stable route, Idunn's own
`127.0.0.1:8831-8833` included, stayed down until a manual
`systemctl restart nginx` at about 19:46.

What Idunn did:

- From 11:50 onward continuity spent streampixels-service's whole restart
  budget (6 per hour) and logged "The target is free for a deployment to
  replace it: systemd unit … is absent". The log repeated in hourly bursts as
  the window slid.
- When nginx returned, ghostlight and streampixels-web were re-incarnated, and
  streampixels-service was not.
- An operator-approved `idunn up streampixels-service` (tx-e69f5402) sat in
  Sealing for about 15 minutes. It then failed with "admitted incumbent failed
  before candidate fencing; deployment yielded to continuity". Continuity had
  freed the target for a deployment. The deployment handed it back to
  continuity. Neither actuated.
- At 20:46:43 continuity re-incarnated the service under generation
  tx-0804185a, once the window had slid to 4/6. So the outage was not ended by
  the deployment the operator approved. The restart window bounded it, a full
  hour after its cause had cleared.
- Throughout, several times a second: "preserved admitted … after rejecting
  topology observation: topology correlation does not bind the current
  activation", and "rejected admitted streampixels-service route continuity:
  admitted process write lease is no longer exact".

## Invariants

1. **A reboot is not a fault of the body.** If an admitted body's unit is
   absent because the host lost its transient units, continuity
   re-materializes it from the installed body. It needs no deployment, no
   operator, and no part of the restart budget for that absence.
2. **The restart budget measures the body.** A failure caused by a shared host
   dependency, such as nginx, the stable route's listener or Odin, never
   charges a target's restart budget. A dependency outage can never exhaust
   the budget of every target behind it.
3. **Exactly one authority owns each slot at every instant, and nothing
   waits on an owner that has stopped.** Continuity never stops (operator,
   2026-10-18: capped backoff, and the 6 per hour count only pages). It never
   aborts a deployment. Before Fencing a deployment owns only its candidate,
   and continuity owns the incumbent slot. At Fencing the deployment takes the
   target and fences whatever is admitted then; an absent incumbent fences as
   nothing. Every continuity attempt leaves a free gap in which a queued
   deployment can be admitted. There is no reachable state in which
   continuity waits for a deployment while that deployment waits for
   continuity. A negative test proves it.
4. **Continuity is daemon survival; deployment is change** (`F:\Projects\CLAUDE.md`).
   Restarting the admitted installed body never needs a deployment and is
   never gated by a deployment brake. A deployment brake gates only artifact,
   revision, configuration, schema, unit or authority changes.
5. **Rejections of stale observations are not a log stream.** An observation
   that cannot bind the current activation is either resolved by the owner
   that can refresh it, or reported once as an incident. It is never
   re-rejected several times a second.
6. **Existing invariants hold.** `route-continuity-target.md` 1 to 7 (in
   particular no actuation from observation, bounded backoff, every
   post-fencing phase ends) and `authority-map.md` (Idunn's own recovery
   depends on no managed target).

## Scope

In:

- Idunn's continuity of admitted bodies across a reboot: absent units, the
  restart budget and what charges it.
- The handover between continuity and deployment, in both directions.
- Classifying the topology-correlation and write-lease rejections: the same
  fault, or a separate one with its own cut.
- Re-admitting streampixels-service on Yggdrasil. It is running again under
  tx-0804185a, and the closing proof checks that it survives the fix's
  install.

Out, and not consumers of this change:

- **nginx's boot order on Yggdrasil.** It is host configuration, owned by
  `gamecult-ops`. It gets its own operator-approved change and record, not an
  Idunn cut.
- **Ghostlight's degraded route** (53 consecutive failures, incident open) is
  in scope only if the map shows the same fault. Otherwise it is a follow-up.
- **Heimdall's onboarding failures and its environment.**
- **Retention of the ~130 dead transient units** on Yggdrasil. It is an ops
  follow-up already recorded under route continuity.
- **Luna's 2026-09-27 weekend patches** are not foundation to build on. Where
  this map meets them, it cuts them.