Idunn/docs/route-continuity-target.md

Route continuity and admission: target

Status: target, Self, 2026-09-29. The cut map will live in route-continuity-cut.md once Imagination has produced it. This document states the ends. It does not specify the means.

Why

On 2026-09-27 and 28 an agent spent 24 hours failing to deploy StreamPixels' web app and service through Idunn v2. The live evidence is on Yggdrasil:

• Admitted route continuity rewrites and reloads nginx whenever a route observation is older than 30 s. The config is usually byte-identical when it does so (supervise_admitted_route → restore_admitted_membership → reload, since 391a7e2 on 2026-09-04). The result is ~115 reloads/h per routed target when healthy. Once the StreamPixels routes were failing it reached ~3,000/h, and 475 nginx workers were left shutting down.
• Every reload moves nginx's UDP listener for Odin (10.77.0.1:17871 → 127.0.0.1:17973) to new workers. That breaks the CultNet RUDP sessions of Idunn's route observer and of every runtime-presence publisher. The timeouts fail the route checks, and the failed checks cause more reloads. Odin continuity restarts followed on 2026-09-28 at 16:26 and 21:27. Each left Odin refusing every provider until its new lease was picked up.
• The web app could not be admitted without the shared Odin RUDP path. It published signed presence to Odin, and its HTTP snapshot route returned 503 whenever that publication timed out.
• The web transaction stayed in Committing for more than 12 hours. After fencing nothing has a deadline: errors are resumable forever, AwaitingReady waits forever, and no command recovers a continuity or stateful transaction.
• The weekend fixes worked around symptoms. a148802 relaxes rollback to demote whatever activation is projected, and 9f00e7a authenticates Ready and provider receipts at admission time instead of now.

Invariants

1. Observation never actuates routing. Refreshing a route observation is a challenge through the stable endpoint and nothing else. Idunn writes an nginx fragment or reloads nginx only when the fragment on disk differs from the admitted or candidate membership, or when a route is installed or withdrawn. A healthy steady state performs zero reloads.
2. Failure never accelerates actuation. Repairing a failed route or unit is bounded and backs off. No failure mode can raise the reload rate or the restart rate above a fixed ceiling per target.
3. A web app proves itself over its own HTTP route (operator, 2026-09-29: "web apps prove over HTTP; Odin can observe a web app, but a web app has no reason to be aware of Odin"). Its admission and continuity depend only on Idunn, its own stable HTTP route, and its declared host inputs. A web app needs no Odin client, no RUDP publisher and no Odin trust anchor. Odin may observe it. Observation is never admission authority.
4. Route proof binds the exact incarnation and is fresh. Traffic reaches only the admitted incarnation. The proof answers an Idunn challenge and is signed with the credential Idunn issued to that launch. Invariant 3 changes where the proof travels, not what it proves.
5. Every post-fencing phase has a deadline and is never a silent wait. A deployment's stateless phase that passes its deadline aborts to its incumbent. A continuity past its deadline is left to the operator (operator-required incident) and retries its phase forward on a capped backoff, because aborting it would stop the only running copy of the admitted body (ruling post-fence-forward-retry), until a deployment that the deployment brake has released awaits the handover of its target and the continuity's route proof has not succeeded: then it yields through its own post-fencing abort, and the deployment fences what is admitted (rulings continuity-yields-to-deploy, c2d-yield-only-unproven-to-movable). A continuity that has proven its route is serving and never yields. A stateful deployment is left to the operator.
6. The admitted receipt describes the running incarnation. Continuity commits update the admitted generation atomically, so the rollback path never meets drift between the receipt and the projection. Rollback demotes the exact admitted activation (a148802 reverted). Readiness and provider checks authenticate current evidence at the current time (9f00e7a reverted).
7. Idunn stays independent (existing, authority-map.md): Idunn starts and recovers its own admitted state without Odin or any managed target.

Scope

In:

• Admitted route supervision.
• nginx route actuation.
• The HTTP route proof for web targets.
• Post-fencing deadlines and resolution.
• Stuck-lease recovery.
• Reverting a148802 and 9f00e7a.
• Reviewing the other weekend commits: ae8ac45 and 29946bb in particular.
• The app-side cost of invariant 3 in CultLib's Idunn runtime-authority packages.
• The StreamPixels web binding that proves invariant 3 end to end.

Out, and not consumers of this change:

• The verify-transaction campaign (verify-transaction-cut.md, branch idunn/cut1-fix5). It is a separate foundation. Coordinate merges, do not bundle.
• Heimdall's failed Idunn onboarding.
• The Windows host actuator.
• Operator-owned nginx settings (worker_shutdown_timeout) and host retention of dead transient units and activation directories. These are ops follow-ups recorded in the map.
• StreamPixels' public cutover. It resumes after this lands, through the ordinary path.