Retire only once the same answer has held ten minutes as well as five passes

Five passes are twenty-five seconds, shorter than a controller restart, a store
reconnecting or a file half written; the operator asked for both (hq ADR 0230).

modules/postgres/cmd/postgres-provider/retirement.go

@@ -12,10 +12,12 @@ package main
 //  3. DELETED, only through `cleanup delete`, a person's act, which this provider executes because it
 //     owns its backend.
 //
-// **Stable removals.** A consumer is retired only after the same set of consumers has gone unasked in
-// StablePasses (5) consecutive passes that read the file. A pass that could not read it is not a
-// result and starts the count again; so does a different set. At a pass every five seconds that is
-// twenty seconds after the first pass that saw the set. Additions and changes are never delayed.
+// **Stable removals.** A consumer is retired only once the same set of consumers has gone unasked BOTH
+// in StablePasses (5) consecutive passes that read the file AND for at least StableFor (10 minutes)
+// since the first pass that saw it. Five passes alone are twenty-five seconds — shorter than a
+// controller restart, a store reconnecting or a file half written. A pass that could not read the file
+// is not a result and starts both again; so does a different set. Additions and changes are never
+// delayed.
 //
 // **Too many is a person.** A stable set of more than RetireAtOnce (3), or — where more than one is
 // held — of more than RetireFraction (half) of those held, retires nothing: it WAITS, said in the
@@ -62,6 +64,10 @@ const (
 	ChangeAdopted   = "adopted"   // found disabled without the mark, now retired on record
 )
 
+// StableFor is the least time the same unasked set must hold before it is retired (novox/hq ADR 0230):
+// longer than a controller restart, a store reconnecting or a file half written.
+const StableFor = 10 * time.Minute
+
 // KindConsumer is a retired consumer. A backend may list other things set aside for deletion under a
 // word of its own (postgres: a database renamed aside).
 const KindConsumer = "consumer"
@@ -139,7 +145,7 @@ func (h *Harness) seed(ctx context.Context, want map[string]bool) {
 			// No hash: asked for again, it is applied again, which is harmless and marks it.
 			h.applied[as] = appliedEntry{}
 			h.say("%s: held by the backend and no longer asked for; retired once that holds for %d passes "+
-				"(novox/hq ADR 0230)", as, h.StablePasses)
+				"and %s (novox/hq ADR 0230)", as, h.StablePasses, h.StableFor)
 		}
 	}
 	now := h.Now()
@@ -190,20 +196,20 @@ func (h *Harness) retireUnasked(ctx context.Context, want map[string]bool) {
 			h.settle("the set the mesh no longer asks for changed")
 		}
 		h.r.key, h.r.count, h.r.firstSeen = key, 1, now
-		h.say("no longer asked for: %s; retired once the same set holds for %d passes", strings.Join(unasked, ", "),
-			h.StablePasses)
+		h.say("no longer asked for: %s; retired once the same set holds for %d passes and %s",
+			strings.Join(unasked, ", "), h.StablePasses, h.StableFor)
 	default:
 		h.r.count++
 	}
-	if h.r.rejected != nil || h.r.count < h.StablePasses {
+	if h.r.rejected != nil || h.r.count < h.StablePasses || now.Sub(h.r.firstSeen) < h.StableFor {
 		return
 	}
 	if h.overTheBound(len(unasked), len(h.applied)) {
 		h.wait(unasked)
 		return
 	}
-	why := fmt.Sprintf("the mesh stopped asking for it: the same result in %d consecutive passes from %s",
-		h.StablePasses, stamp(h.r.firstSeen))
+	why := fmt.Sprintf("the mesh stopped asking for it: the same result in %d consecutive passes over %s, from %s",
+		h.r.count, now.Sub(h.r.firstSeen).Round(time.Second), stamp(h.r.firstSeen))
 	h.retire(ctx, unasked, why, nil)
 }
 
@@ -416,7 +422,7 @@ func (h *Harness) Retirement(ctx context.Context) (map[string]any, error) {
 			"retired_at": stampOr(r.RetiredAt), "why": r.Why, "size_bytes": r.SizeBytes, "kind": kindOf(r)})
 	}
 	out := map[string]any{"resource": h.Resource, "node": h.Node, "held": orEmptyList(held),
-		"stable_passes": h.StablePasses, "bound": h.bound(len(h.applied)), "waiting": nil, "rejected": nil,
+		"stable_passes": h.StablePasses, "stable_for_seconds": int(h.StableFor.Seconds()), "bound": h.bound(len(h.applied)), "waiting": nil, "rejected": nil,
 		"retired": retired}
 	if w := h.r.waiting; w != nil {
 		out["waiting"] = map[string]any{"consumers": h.named(w.set), "since": stamp(w.since), "held": w.held}