Playbooks: how a module's old directory is closed, and a refused try (issues 1843, 1854)

Lessons from closing only-office's old directories: a directory keeps its id until emptied on the
operator's word, then leaves the manifest in a second fix; and a fifth try is refused, not queued.

00-META/process/06-writing-a-module.md

@@ -105,3 +105,23 @@ time and the scaffolding was not.**
 - **Never rotate during an adoption.** Rotation is a separate act, afterwards, deliberately.
 - **A data directory is never removed by the mesh** (ADR 0030),
   and that protects against the mesh only — not against a disk or a mistaken command.
+
+## Moving a module's directory
+
+When a fix moves what a container mounts to a new path (issue 1843: only-office's working directories
+moved into a root-only box), the old directory does not go away by itself, and it is closed in three steps.
+
+1. **The move.** The new directory gets a new id at its new path. The old one keeps **its old id at its old
+   path** for as long as it holds data, with the mode it should now have: the node-engine leaves a directory
+   it finds at a path under a new id as it found it, and sets no mode when the owner differs (issue 339), so
+   only the old id closes it. The node-engine removes a directory that is no longer declared only when it is
+   empty; a non-empty one is kept on disk with no further cleanup.
+2. **The deletion, on the operator's word.** Its contents are data, so they are removed only after the
+   operator's yes, through `<node>/node-files.delete`. That tool moves into the node's trash: the disk space
+   comes back only when the trash is emptied (issue 1870: no tool does that yet).
+3. **The declaration leaves** in a second small fix, once the directory is empty (issue 1854).
+
+Plan the three in the first fix's issue, so the second fix is not found later by accident.
+
+A service that starts on empty working directories may need minutes before it answers (OnlyOffice: about
+two): the live check after the delivery waits for it before calling the move broken.

00-META/process/08-small-fixes.md

@@ -99,6 +99,7 @@ code.
 | Waiting on | Bound | Past the bound |
 |---|---|---|
 | building the fix | 1 hour | it is a feature: stop and plan it under playbook 07 |
+| a slot for the try | 30 minutes | `mesh-controller.try` holds at most four tries and refuses a fifth without queueing it: a watcher asks again every minute; past the bound, read `mesh-controller.queue` |
 | the review | 15 minutes | ask the reviewer where it stands |
 | the merge check | 15 minutes | read `mesh-controller.queue` and the check's log |
 | the Approve's ask | 5 minutes after both checks pass | read `mesh-delivery.show`: an ask not raised is a fault, said to the operator |