GameCult/Idunn
Watch
9
0
Fork
You've already forked Idunn
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close the B1 transition: lift, precondition, boot reconciliation, closed history

Browse source 
Soul found B1's rule sound and its transition unsafe. This makes the rule's
old inputs impossible to reintroduce a stuck state from.

- The control store's legacy lift owns the transition. A pre-B1 continuity
  abort that issued an activation lifts with topology_reconciliation Pending,
  so the one resolution demotes its own activation. A record already terminal
  under the old rule is reopened at Starting, since a terminal record cannot
  owe work. History lifts records as written. Before this, one resident
  record of that shape failed validation and ControlSnapshot::read refused the
  whole store, so Idunn could not boot.
- Supervision owns the Expected-only precondition. When its pre-restart
  demotion fails it mints no continuity and writes next_restart_at_unix_millis
  on the generation's ContinuityBackoff (attempts and window untouched), so it
  neither restarts over an undemotable projection nor retries every tick.
- Boot reconciles once: a projected activation that exactly matches the
  activation a failed continuity in history (or a resident terminal record)
  issued is demoted. Nothing is adopted; an activation no admitted generation,
  live transaction or failed issuer accounts for is reported and left alone.
  New read-only CultCacheTopologyDriver::projected_activation.
- Unreadable history.cc fails closed. The continuity restart ceiling and the
  consumed-command check no longer read an empty history; they stop, and the
  fault is reported once while it lasts (ReportOnce). The undecodable-record
  report is a pure function, pinned.
- docs/deployment-authority.md no longer says the projection never drifts.

Tests: legacy fixtures written by the 9001b58 encoder for the three abort
shapes (a second throwaway generator, see the fixtures README), driven through
the Engine; the seeded-transaction helper now takes a command kind and an
incumbent, and a Deploy carries a frozen-source receipt and a signed brake
release, so Deploy commit, Deploy pre- and post-fence aborts and a continuity
abort over an incumbent run through the real phase machine.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-09-29 06:11:29 +02:00
commit 9e5b7f84fd
8 changed files with 1433 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/deployment-authority.md
View file

@ -314,9 +314,19 @@ window.
A failed continuity restart leaves its own candidate activation projected under
the shared Expected key. Its abort demotes that key to Expected-only with the
exact activation the transaction issued, so the projection never drifts from the
admitted receipt. Rollback after fencing demotes the admitted generation's exact
activation. No path adopts an activation the transaction did not issue.
exact activation the transaction issued. Rollback after fencing demotes the
admitted generation's exact activation. No path adopts an activation the
transaction did not issue.
A projection can still hold an activation the abort never resolved: a failure
between preparing a candidate and publishing its observation, an abort written
by an earlier Idunn, or an operator edit. Continuity therefore restarts a
generation only from an Expected-only projection: when its own demotion is
refused it mints no restart, records the deferral in the generation's
continuity backoff, and tries again after it. At boot, Idunn demotes an
activation still projected for a failed continuity in history, by that
transaction's exact activation, and only reports one no failed transaction
issued.
Idunn starts and recovers from its own durable admitted state. Odin is the first
managed semantic daemon, never an Idunn bootstrap dependency. Odin's initial