diff --git a/03-DESIGN/01-to-be/47-milestones/G-12-develop-answers-fourth.md b/03-DESIGN/01-to-be/47-milestones/G-12-develop-answers-fourth.md index 746b2cc5..25a6d6e5 100644 --- a/03-DESIGN/01-to-be/47-milestones/G-12-develop-answers-fourth.md +++ b/03-DESIGN/01-to-be/47-milestones/G-12-develop-answers-fourth.md @@ -47,8 +47,9 @@ that round are written into the lines they name, here. Questions that an earlier kept data's local name), `form`, `fingerprint`, `why` and `catch-up` as `{tool, arguments}` (§451); its point (the module, the kept data, its form, the fingerprint, `snapshot`, `consumers` with each durable consumer's stream, name and acknowledged sequence, `size` in bytes, `at` and `catch-up`) comes on its event `ended` (§554); `restore-kept` takes - `module`, `kept`, `form`, `fingerprint`, `why`, `from-backup` (yes or no) and one of `snapshot` (the restore point's - name), `aside-only` (the operator's hand tool alone, §554) or `discard-aside` (an aside's `id`), and its result (`restored`, `aside`, `missing`, true when the + `module`, `kept`, `form`, `fingerprint`, `why`, `from-backup` (yes or no) and `snapshot` (the restore point's name), + and refuses `aside-only` and `discard-aside`, answering `error` naming them: setting aside without restoring and + discarding an aside are the operator's hand tools alone (§554); its result (`restored`, `aside`, `missing`, true when the point is not in the recovery module's directory, and `error`) comes on its event `restored`. Both verbs answer only `accepted`, `busy` or `error` (§554). No argument `local-name` or `from` is taken, and a catch-up is never text. @@ -74,14 +75,15 @@ that round are written into the lines they name, here. Questions that an earlier restores the aside under the live names and sets the consumers back before it answers `failed`, and at its start the recovery module does the same for every aside whose record ends at `removed`, so a failed or stopped restore never leaves the kept data gone. The aside's `id` is that directory's name, its `name` the bus name it was live - under, its `size` its bytes on disk; nothing of an aside stays on the bus. `discard-aside` removes that directory + under, its `size` its bytes on disk; nothing of an aside stays on the bus. `recovery_discard_aside` (§554) removes that directory and nothing else, an `id` holding `.`, `..` or `/` refused. A restore point is removed only as §551 says. This completes §405 and §406. Why: the operator's answer of 12:55 CET (§554) puts the taking and restoring of a module's kept data on the live bus on a module of its own; the server restores a stream only where no stream of that name exists, so the live data is set aside as a snapshot before the point takes its name (develop questions BKP1, BKP3 and NATS4's argument names; review round 1, running and testing 1, seams and tools' notes). How it is checked: - unit (mesh-recovery's contract), each verb's input and answer read, an input naming `from` refused; whole (recovery + unit (mesh-recovery's contract), each verb's input and answer read, an input naming `from` refused; a node-engine's + `restore-kept` with `aside-only` or `discard-aside` refused, naming them; whole (recovery module, backup holder, bus), a point is taken, its directory removed, brought back with `from-backup` and restored, the live data's aside listed with its size and the consumer at its recorded sequence; a point missing from both says `restore point missing`; a restore made to fail after the removal, and one stopped there and started again, leave @@ -95,7 +97,7 @@ that round are written into the lines they name, here. Questions that an earlier made. Why: a module's tools read everything it holds (*Tools are how a module is spoken to*), and the list is the holder's own fact (ADR 0596 §2; develop question BKP2; review round 1, seams and tools 4). How it is checked: whole (recovery module), `kept-points` lists a point and an aside with their sizes, an aside is gone after - `discard-aside`, and a restart lists the same. + `recovery_discard_aside`, and a restart lists the same. - §523 **A seat event whose subject has parts.** A seat definition's `subject` with `` tokens (§397), such as `mesh-recovery`'s `ended..` and `node-backup`'s `item-started..` (§554), is said on `mesh.seat..event.` followed by the subject, each part filled in the definition's order: the seat @@ -537,7 +539,7 @@ that round are written into the lines they name, here. Questions that an earlier beside a `restore-kept` (§554). Each removal is written in the hand-act log of the seat `mesh-hand-acts` and said as `mesh-recovery`'s event `point-removed` on `mesh.seat.mesh-recovery.event.point-removed..` (`module`, `kept`, `form`, `fingerprint`, `snapshot`, `at`), kept 90 days (§396). The backup holder's copies go by its - repository's own rotation (ADR 0235 §4). Data set aside is removed only by `discard-aside` (§516). This completes + repository's own rotation (ADR 0235 §4). Data set aside is removed only by `recovery_discard_aside` (§554). This completes §516 and answers issue 1921's note on the retention of restore points. Why: the operator's answer; the event, the checks and their order are the design's. How it is checked: whole (recovery module), a point older than 90 days is removed and said, the newest point of a kept data older than 90 days stays, and a removal due during a restore runs diff --git a/03-DESIGN/01-to-be/47-milestones/G-14-recovery-module-and-review.md b/03-DESIGN/01-to-be/47-milestones/G-14-recovery-module-and-review.md index 8c05ee45..927cab97 100644 --- a/03-DESIGN/01-to-be/47-milestones/G-14-recovery-module-and-review.md +++ b/03-DESIGN/01-to-be/47-milestones/G-14-recovery-module-and-review.md @@ -76,15 +76,15 @@ are written into the lines of G-12 they name.* 2026-11-11 13:10 CET: "if something asks for a restore, you should do it; he'll have his reasons". `kept-points` takes the default of a read (§391). The operator, 2026-11-11 13:06 CET at lead-47's terminal: setting aside is a move, not a removal, so deleting the live objects once their aside is whole and checked (§516) needs - no person's warrant, the data staying in the aside until `discard-aside`; `aside-only` is the operator's hand tool - alone, `recovery_aside` (class `act`, callers `operator`); and `discard-aside` and the hand tools are checked by the - identity of who asked: they are taken only from the operator's account as the bus proves it, and from sessions + no person's warrant, the data staying in the aside until the operator discards it; setting aside without restoring is + the operator's hand tool `recovery_aside`, and discarding an aside the hand tool `recovery_discard_aside`, both of + class `act`, callers `operator` and `sessions`, written in the hand-act log first; `restore-kept` refuses + `aside-only` and `discard-aside`, naming them (§516). The hand tools are checked by the identity of who asked: they are taken only from the operator's account as the bus proves it, and from sessions acting on it as for every `act` tool (§391), with no warrant asked per act. Each act is written in the hand-act log of the seat `mesh-hand-acts` first, with the caller the bus proved and `why`; an act whose log write fails does nothing and answers `error`, naming the log (as §480). - **The operator's hand tools.** `recovery_take` (take a point of one module and kept data now), `recovery_restore` (restore one point) and `recovery_retry` (ask again the last failed act of a module and kept data), each of class - `act`, callers `operator` and `sessions` (§391), written in the hand-act log; they skip the want check, since the - operator's call is the reason. + `act`, callers `operator` and `sessions` (§391), written in the hand-act log; they are checked by identity, as above. - **Its account.** Composed by the grants part from the seat's definition and the manifest: the bus's stream snapshot and restore subjects with their chunk subjects, a stream's deletion and a durable consumer's creation, only for the bus names of a module's kept data; the subjects its seat says and its hand-act log write; its @@ -129,17 +129,18 @@ are written into the lines of G-12 they name.* account's hold no restore; whole (recovery module), a call from an account that is no node-engine's refused, a `busy` answer then the act on the other's `ended`, a second form change not woken by the first's `ended`, a dump asked during a restore starting after `restored`, a restart during the dump starting no restore, an act whose - hand-act log write fails doing nothing, and an unrestored aside failing the health check. + hand-act log write fails doing nothing, an unrestored aside failing the health check, a node-engine's `restore-kept` with `aside-only` or `discard-aside` + refused, and the operator's `recovery_discard_aside` removing the aside and writing the log. - §555 **What moves to the recovery module.** §296 asks `mesh-recovery`'s `snapshot-kept` and waits for its `ended`, never the seat `node-backup`; §297 asks its `restore-kept` and waits for its `restored`; §302's `backed-up` lists the recovery module's data item as any item, and the restore points and asides are listed by `kept-points` (§517), - `discard-aside` being `restore-kept`'s; §303 and test 36 name the recovery module where they named the backup + an aside discarded by the hand tool `recovery_discard_aside` (§554); §303 and test 36 name the recovery module where they named the backup holder and the bus module; §337's and §405's callers `holder:node-backup@same-node` go with the two verbs of `mesh-broker`, which gains none; the seat `node-backup` gains nothing for kept data on the bus: its `aside` and `discard-aside`, the arguments `kept`, `form` and `fingerprint` of its `now` and `restore`, and its events `ended...` and `restored...` go from its definition in mesh-contracts, and it gains only `item-started` and `item-ended` with their `` token, and names `holder:mesh-recovery@same-node` - among `restore`'s callers for the recovery module's own item (§554); §450's `aside` answer is `restore-kept`'s with `aside-only`; + among `restore`'s callers for the recovery module's own item (§554); §450's `aside` answer is `recovery_aside`'s; §406's catch-up is recorded in the point as before. Why: one owner of the acts (§554). How it is checked: unit (definitions), `node-backup` and `mesh-broker` hold none of the moved verbs; test 36.