From 53c407350f0568e8c9ea46e066b03d248bbd9261 Mon Sep 17 00:00:00 2001 From: jochens Date: Fri, 13 Nov 2026 01:00:37 +0100 Subject: [PATCH] Design 42 zfs-owns-zfs: A-36 corrects A-30's remove, A-37 the root processes reach the bus through a keeper --- .../42-milestones/zfs-owns-zfs-lead-answers.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/03-DESIGN/01-to-be/42-milestones/zfs-owns-zfs-lead-answers.md b/03-DESIGN/01-to-be/42-milestones/zfs-owns-zfs-lead-answers.md index 6498f9a2..619a85f7 100644 --- a/03-DESIGN/01-to-be/42-milestones/zfs-owns-zfs-lead-answers.md +++ b/03-DESIGN/01-to-be/42-milestones/zfs-owns-zfs-lead-answers.md @@ -121,3 +121,18 @@ settles it (`00-META/principles.md`), cited as "design 42 zfs-owns-zfs A-n". The - **A-35** (§21, §22, met in develop; principle 3 and the operator's "we may absolutely not lose any data") A kind's keep count of 0 is that kind's `none`: none is taken, its existing scheduled ZFS snapshots are kept and a warning names them; only a count above 0 prunes past it. +- **A-36** (corrects A-30, §26, met in develop; ADR 0597; principle 7) The ledger's `remove` effect names a map and a + key (the validator refuses one without), so the instance is one per dataset and kind: + `snapshot/-` (the dataset's `/` written `~`), its state a map `taken` keyed by the ZFS snapshot's + name; `taken` is the effect `set-entry` into `taken` under the field `name`, with `dataset`, `name`, `kind` and `at`; + `removed` is the effect `remove` from `taken` under `name`. A kind's live ZFS snapshots are the instance's map, its + last the newest `at` there, so no index is declared. +- **A-37** (§18, §20, §26, §27, A-6, A-20, met in develop; ADR 0436 §1, §2; principle 7) A process's bus account is a + user the module makes, never root, so the three root processes (the apply, the run, the follower) declare no `bus`. + The module makes a user `zfs-keeper` and one process `zfs-keeper` running as it, which holds the module's one process + bus account (its events, its states `applied`, `schedule` and `findings`, and its invokes of + `zfs.zfs_snapshots_record`, `zfs.zfs_snapshots_schedule` and `seat:node-service-manager.start`). It serves a unix + socket in the module's state directory that only root may open (the peer's uid checked), with a closed list of + calls: emit an event, put or delete a key of those states, and invoke one of those three. The root processes say + everything they say on the bus through it; with the keeper not answering they act as with the bus down (A-8), and + warn. The module's tools keep their own account as today.