Design 42 zfs-owns-zfs: A-36 corrects A-30's remove, A-37 the root processes reach the bus through a keeper

2026-11-13 01:00:37 +01:00
parent 4001fd3515
commit 53c407350f
1 changed files with 15 additions and 0 deletions
@@ -121,3 +121,18 @@ settles it (`00-META/principles.md`), cited as "design 42 zfs-owns-zfs A-n". The
 - **A-35** (§21, §22, met in develop; principle 3 and the operator's "we may absolutely not lose any data") A kind's
  keep count of 0 is that kind's `none`: none is taken, its existing scheduled ZFS snapshots are kept and a warning
  names them; only a count above 0 prunes past it.
+- **A-36** (corrects A-30, §26, met in develop; ADR 0597; principle 7) The ledger's `remove` effect names a map and a
+  key (the validator refuses one without), so the instance is one per dataset and kind:
+  `snapshot/<kind>-<dataset>` (the dataset's `/` written `~`), its state a map `taken` keyed by the ZFS snapshot's
+  name; `taken` is the effect `set-entry` into `taken` under the field `name`, with `dataset`, `name`, `kind` and `at`;
+  `removed` is the effect `remove` from `taken` under `name`. A kind's live ZFS snapshots are the instance's map, its
+  last the newest `at` there, so no index is declared.
+- **A-37** (§18, §20, §26, §27, A-6, A-20, met in develop; ADR 0436 §1, §2; principle 7) A process's bus account is a
+  user the module makes, never root, so the three root processes (the apply, the run, the follower) declare no `bus`.
+  The module makes a user `zfs-keeper` and one process `zfs-keeper` running as it, which holds the module's one process
+  bus account (its events, its states `applied`, `schedule` and `findings`, and its invokes of
+  `zfs.zfs_snapshots_record`, `zfs.zfs_snapshots_schedule` and `seat:node-service-manager.start`). It serves a unix
+  socket in the module's state directory that only root may open (the peer's uid checked), with a closed list of
+  calls: emit an event, put or delete a key of those states, and invoke one of those three. The root processes say
+  everything they say on the bus through it; with the keeper not answering they act as with the bus down (A-8), and
+  warn. The module's tools keep their own account as today.