GameCult/Idunn
Watch
9
0
Fork
You've already forked Idunn
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stop asking the durable Ready receipt to be live at commit

Browse source 
Deploying the invariant fix cleared the equality gate and immediately
surfaced the next one wearing the same clothes: "Odin topology
correlation is outside the trusted observation window".

advance_committing called rehydrate_ready_token with require_current,
which authenticates the stored Ready receipt using `now` as the trusted
receive time. The receipt is durable evidence -- once it is older than
DEFAULT_TOPOLOGY_MAXIMUM_AGE_MILLIS (30s) it can never satisfy that,
which is the same unsatisfiable demand as the equality: a record that
does not change being asked to keep up with one that does.

Route admission at :3906 refreshes the receipt to the latest observation
before requiring currency, so `true` is right there and stays. By
Committing the receipt is history. Mirroring the refresh here would
livelock instead: refresh-then-return cannot converge against a publisher
emitting several correlations a second. Currency at commit is answered by
the latest observation, which is authenticated and checked for semantic
readiness immediately above.

Settled tx-65574579 on yggdrasil. Before: phase Committing, waiting on
the observation window. After: phase Complete, command succeeded, no
transactions in flight. Odin was never touched -- same PID 3911519, unit
ActiveEnterTimestamp still 2026-09-07 23:36:41. Idunn 0 restarts.

  cargo test --locked -> test result: ok. 102 passed; 0 failed; 1 ignored

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-09-09 23:40:05 +02:00
commit b7caaefb61
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/control_plane.rs
View file

@ -4008,7 +4008,14 @@ impl Engine {
is_semantic_ready(&authenticated),
"latest Odin observation is not Ready at admission commit"
);
self.rehydrate_ready_token(&ready_current.value, now_millis()?, true)?;
// Not require_current: the Ready receipt is durable evidence, so
// authenticating it against `now` asks a stored record to be live and
// refuses it once it ages past the 30s observation window. Route
// admission (:3906) refreshes the receipt to the latest observation and
// can therefore demand currency; by Committing the receipt is history.
// Currency here is answered by the latest observation, authenticated
// and checked for semantic readiness immediately above.
self.rehydrate_ready_token(&ready_current.value, now_millis()?, false)?;
validate_live_providers_for_deploy(ready_current.value.command_kind, || {
self.validate_selected_providers_current(
required(&ready_current.value.plan, "transaction plan")?,
@ -4076,7 +4083,7 @@ impl Engine {
"latest Odin observation is not Ready after the final admission challenge"
);
let now = now_millis()?;
self.rehydrate_ready_token(&commit_current.value, now, true)?;
self.rehydrate_ready_token(&commit_current.value, now, false)?;
validate_live_providers_for_deploy(commit_current.value.command_kind, || {
self.validate_selected_providers_current(
required(&commit_current.value.plan, "transaction plan")?,