From b7caaefb610ff55197bca4e3ead03e86aef0ccb7 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Wed, 9 Sep 2026 23:40:05 +0200 Subject: [PATCH] Stop asking the durable Ready receipt to be live at commit Deploying the invariant fix cleared the equality gate and immediately surfaced the next one wearing the same clothes: "Odin topology correlation is outside the trusted observation window". advance_committing called rehydrate_ready_token with require_current, which authenticates the stored Ready receipt using `now` as the trusted receive time. The receipt is durable evidence -- once it is older than DEFAULT_TOPOLOGY_MAXIMUM_AGE_MILLIS (30s) it can never satisfy that, which is the same unsatisfiable demand as the equality: a record that does not change being asked to keep up with one that does. Route admission at :3906 refreshes the receipt to the latest observation before requiring currency, so `true` is right there and stays. By Committing the receipt is history. Mirroring the refresh here would livelock instead: refresh-then-return cannot converge against a publisher emitting several correlations a second. Currency at commit is answered by the latest observation, which is authenticated and checked for semantic readiness immediately above. Settled tx-65574579 on yggdrasil. Before: phase Committing, waiting on the observation window. After: phase Complete, command succeeded, no transactions in flight. Odin was never touched -- same PID 3911519, unit ActiveEnterTimestamp still 2026-09-07 23:36:41. Idunn 0 restarts. cargo test --locked -> test result: ok. 102 passed; 0 failed; 1 ignored Co-Authored-By: Claude Opus 5 --- src/control_plane.rs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/control_plane.rs b/src/control_plane.rs index 5bcc303..9c89d5c 100644 --- a/src/control_plane.rs +++ b/src/control_plane.rs @@ -4008,7 +4008,14 @@ impl Engine { is_semantic_ready(&authenticated), "latest Odin observation is not Ready at admission commit" ); - self.rehydrate_ready_token(&ready_current.value, now_millis()?, true)?; + // Not require_current: the Ready receipt is durable evidence, so + // authenticating it against `now` asks a stored record to be live and + // refuses it once it ages past the 30s observation window. Route + // admission (:3906) refreshes the receipt to the latest observation and + // can therefore demand currency; by Committing the receipt is history. + // Currency here is answered by the latest observation, authenticated + // and checked for semantic readiness immediately above. + self.rehydrate_ready_token(&ready_current.value, now_millis()?, false)?; validate_live_providers_for_deploy(ready_current.value.command_kind, || { self.validate_selected_providers_current( required(&ready_current.value.plan, "transaction plan")?, @@ -4076,7 +4083,7 @@ impl Engine { "latest Odin observation is not Ready after the final admission challenge" ); let now = now_millis()?; - self.rehydrate_ready_token(&commit_current.value, now, true)?; + self.rehydrate_ready_token(&commit_current.value, now, false)?; validate_live_providers_for_deploy(commit_current.value.command_kind, || { self.validate_selected_providers_current( required(&commit_current.value.plan, "transaction plan")?,