From 94dea451e502e4450fbff9e64e64f1b251cb08f1 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 7 Sep 2026 01:59:07 +0200 Subject: [PATCH] Record that a post-fence transaction cannot be abandoned Co-Authored-By: Claude Opus 5 --- docs/migration.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/docs/migration.md b/docs/migration.md index 375bae1..972f2a0 100644 --- a/docs/migration.md +++ b/docs/migration.md @@ -496,6 +496,27 @@ world-readable, integrity protected by signature rather than by mode. is writable by the workload, and a daemon that can rewrite its own signing identity does not have one. Odin's topology identity moved to the runtime root. +## A transaction past Fencing cannot be abandoned + +`begin_pre_fencing_abort` is gated on `phase < DeploymentPhase::Fencing`. After +the fence, every error goes to `record_resumable_error` and the transaction +retries forever. There is no operator verb to cancel one, and no server-side +expiry -- `--timeout-seconds` bounds the `idunn up` client's wait, not the +transaction. + +That is correct while a candidate can still recover. It is a trap when the +candidate never can: a transient unit with `Restart=no` that has failed will not +come back on its own, so the transaction holds the target and every later +command for it stays `queued` indefinitely. + +Found the hard way during Odin's first deployment, and made unrecoverable by +deleting the target's write-lease record to fix its mode while a transaction +held it -- `observe_exact` then reports "physical write lease disappeared after +Granted became durable", which is exactly the tamper it is there to catch. Do +not remove a lease record, projection record or brake store belonging to a +transaction that is not terminal; change the mode in place, or fix the shape +that produced the mode and redeploy. + ## Cutting over the authority Idunn last, and not by deploying Idunn with Idunn.