Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

A refusal of a send the mesh never recorded went only to stderr; it is now kept
with its sender said to be unknown, and raised. A counter behind the machine (a
store put back) is raised and the condition names push, since the receive loop
must not push. The node's digest and generation are one transaction, and a send
record that fails is said loudly without failing the send. The trigger ignores
an update that changes nothing, and the put-back mark is dropped: a put-back is
composed afresh with the current generation.

cmd/mesh-controller/generation.go

@@ -33,15 +33,20 @@ const kindOlderGeneration = "older-generation"
 // generationRefusalsSaid is how long a refused send is said after its refusal: an hour, as an advisory is.
 const generationRefusalsSaid = advisoryQuiet
 
-// stamp gives a composed declaration the order allotted to it before it was composed: its sequence, the
-// epoch and generation when the machine reads them, and the put-back mark beside a generation — and keeps
-// the generation and acting epoch for the record of the send whether or not the machine is sent them.
+// stamp gives a composed declaration the order allotted to it before it was composed: its sequence, and
+// the epoch and generation when the machine reads them — and keeps the generation and acting epoch for the
+// record of the send whether or not the machine is sent them.
+//
+// **No put-back mark is sent.** A gate puts a machine back by composing it again (sendRollout), so its
+// declaration is allotted here like any other and carries the generation as it stands — never older than
+// what the machine applied. The node-engine reads a `put_back` key (mesh-host#82); this controller never
+// needs to send one.
 func (o order) stamp(d *sendable) {
 	d.Sequence, d.Epoch = o.sequence, o.epoch
-	d.composedFrom, d.actingEpoch, d.putBackSend = o.generation, o.acting, o.putBack
-	d.Generation, d.PutBack = 0, false
+	d.composedFrom, d.actingEpoch = o.generation, o.acting
+	d.Generation = 0
 	if o.readsGeneration && o.generation > 0 {
-		d.Generation, d.PutBack = o.generation, o.putBack
+		d.Generation = o.generation
 	}
 }
 
@@ -50,18 +55,17 @@ type sentRecord struct {
 	sequence   int64
 	epoch      uint64
 	generation int64
-	putBack    bool
-	// told is the generation and put-back mark on the wire, which the would-send is stamped with.
+	// toldGeneration is the generation on the wire, which the would-send is stamped with: zero for a machine
+	// whose node-engine has not said it reads one.
 	toldGeneration int64
-	toldPutBack    bool
 	sender         string
 	modules        []string
 }
 
 // sentRecordOf is a composed send's record: its sender is the caller this process acts for.
 func sentRecordOf(ctx context.Context, d sendable) sentRecord {
-	return sentRecord{sequence: d.Sequence, epoch: d.actingEpoch, generation: d.composedFrom, putBack: d.putBackSend,
-		toldGeneration: d.Generation, toldPutBack: d.PutBack, sender: senderOf(callerOf(ctx)), modules: d.modules}
+	return sentRecord{sequence: d.Sequence, epoch: d.actingEpoch, generation: d.composedFrom,
+		toldGeneration: d.Generation, sender: senderOf(callerOf(ctx)), modules: d.modules}
 }
 
 // callerOf is who asked for what this process does: the seat call's caller when ctx belongs to one, the
@@ -92,13 +96,19 @@ func namedModules(plan catalogue.Resolution, leftOut map[string]string) []string
 	return out
 }
 
-// heardGenerationRefusal keeps a machine's refusal of a send for its generation on the send it refused,
-// so S20 names its sender, and says it (novox/hq issue 234).
+// heardGenerationRefusal keeps a machine's refusal of a send for its generation, so S20 names its sender
+// and says it (novox/hq issue 234): on the send it refused or — when the mesh has no record of sending that
+// sequence — as a refusal of its own, naming the sender as unknown. Either way S20 is raised: a refusal the
+// mesh cannot attribute is the louder fact, not a quieter one.
 //
 // **And raises the mesh's counter past what the machine applied, when the refused send was composed from
-// the counter as it stands**: then the sender's view was not stale — the counter is behind the machine,
-// which is a store put back from a backup — and every send after would be refused for ever. A stale
-// sender's generation is below the counter, and the counter is left alone for it.
+// the counter as it stands** (counterBehind): then the sender's view was not stale — the counter is behind
+// the machine, which is a store put back from a backup — and every send after would be refused for ever. A
+// stale sender's generation is below the counter, and the counter is left alone for it.
+//
+// Nothing is sent from here. This runs in the controller's receive loop, and a push from it would hold that
+// loop, and the machine's hold, for as long as the push takes — the deaf controller of issues 184 and 185.
+// S20 names `push <node>` for that case instead.
 func heardGenerationRefusal(ctx context.Context, inv *inventory.Inventory, report link.Report) {
 	r := report.OlderGeneration
 	if r == nil || inv == nil || report.Node == "" {
@@ -106,35 +116,44 @@ func heardGenerationRefusal(ctx context.Context, inv *inventory.Inventory, repor
 	}
 	node, err := inv.NodeByName(ctx, report.Node)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "mesh-controller: %s refused a send for its generation, and the machine cannot be read: %v\n",
-			report.Node, err)
+		fmt.Fprintf(os.Stderr, "mesh-controller: %s refused a send for its generation, and the machine cannot be "+
+			"read, so it is not raised: %v\n", report.Node, err)
 		return
 	}
-	send, found, err := inv.RefusedSend(ctx, node.ID, report.Sequence, r.Applied)
-	switch {
-	case err != nil:
-		fmt.Fprintf(os.Stderr, "mesh-controller: %s refused send %d for its generation, and the refusal could not be "+
-			"kept: %v\n", report.Node, report.Sequence, err)
-	case !found:
-		fmt.Fprintf(os.Stderr, "mesh-controller: %s refused send %d (generation %d; it applied %d), which the mesh "+
-			"has no record of sending\n", report.Node, report.Sequence, r.Generation, r.Applied)
-	default:
-		fmt.Fprintf(os.Stderr, "mesh-controller: %s refused send %d from %s: composed from assignment generation %d, "+
-			"and it applied %d\n", report.Node, report.Sequence, send.Sender, r.Generation, r.Applied)
+	var raised int64
+	if now, err := inv.AssignmentGeneration(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "mesh-controller: %s refused a send for its generation, and the mesh's own cannot be "+
+			"read: %v\n", report.Node, err)
+	} else if counterBehind(*r, now) {
+		if raised, err = inv.RaiseAssignmentGeneration(ctx, r.Applied); err != nil {
+			fmt.Fprintf(os.Stderr, "mesh-controller: the assignment generation (%d) is behind what %s applied (%d), "+
+				"and could not be raised: %v\n", now, report.Node, r.Applied, err)
+			raised = 0
+		} else {
+			fmt.Fprintf(os.Stderr, "mesh-controller: the assignment generation was %d, behind what %s applied (%d) — "+
+				"a store put back from a backup — and is raised to %d; `push %s` sends it what the mesh holds now\n",
+				now, report.Node, r.Applied, raised, report.Node)
+		}
 	}
-	now, err := inv.AssignmentGeneration(ctx)
-	if err != nil || r.Generation < now || r.Applied < now {
-		return
+	send, found, err := inv.RefusedSend(ctx, node.ID, report.Sequence, r.Applied, raised)
+	if err == nil && !found {
+		send, err = inv.RecordUnrecordedRefusal(ctx, inventory.Send{Node: node.ID, Sequence: report.Sequence,
+			Epoch: report.Epoch, Generation: r.Generation, Digest: report.Declared, RefusedApplied: r.Applied,
+			CounterRaisedTo: raised})
 	}
-	raised, err := inv.RaiseAssignmentGeneration(ctx, r.Applied)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "mesh-controller: the assignment generation (%d) is behind what %s applied (%d), and "+
-			"could not be raised: %v\n", now, report.Node, r.Applied, err)
+		fmt.Fprintf(os.Stderr, "mesh-controller: %s refused send %d for its generation, and the refusal could not be "+
+			"kept, so it is not raised: %v\n", report.Node, report.Sequence, err)
 		return
 	}
-	fmt.Fprintf(os.Stderr, "mesh-controller: the assignment generation was %d, behind what %s applied (%d) — a store "+
-		"put back from a backup — and is raised to %d, so the next send is not refused\n", now, report.Node, r.Applied,
-		raised)
+	fmt.Fprintf(os.Stderr, "mesh-controller: %s refused send %d from %s: composed from assignment generation %d, "+
+		"and it applied %d\n", report.Node, report.Sequence, send.Sender, r.Generation, r.Applied)
+}
+
+// counterBehind says a refusal shows the mesh's counter behind the machine rather than a stale sender: the
+// refused send carried the counter as it stands now, and the machine applied more than that.
+func counterBehind(r link.GenerationRefusal, now int64) bool {
+	return r.Generation >= now && r.Applied > r.Generation
 }
 
 // watchGenerationRefusals is S20: every send a machine refused within the hour for the generation it was
@@ -147,7 +166,7 @@ func watchGenerationRefusals(f *signalFacts) []conditions.Observation {
 			continue
 		}
 		seen[s.NodeName] = true
-		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: s.NodeName, Kind: kindOlderGeneration,
+		o := conditions.Observation{Scope: conditions.ScopeMachine, ID: s.NodeName, Kind: kindOlderGeneration,
 			Machine: s.NodeName, Severity: conditions.Warning,
 			Summary: fmt.Sprintf("%s refused sequence %d from %s: it was composed from assignment generation %d, and "+
 				"%s applied generation %d — a sender composing from a view of the assignments the mesh has moved "+
@@ -157,7 +176,20 @@ func watchGenerationRefusals(f *signalFacts) []conditions.Observation {
 			Headline: fmt.Sprintf("%s refused an out-of-date update", s.NodeName),
 			Explanation: fmt.Sprintf("Something sent %s an update made from an older list of what runs there. %s "+
 				"refused it, so nothing was removed. Nothing for you to do unless it repeats.", s.NodeName, s.NodeName),
-			Resolved: fmt.Sprintf("%s has had no out-of-date update for an hour", s.NodeName)})
+			Resolved: fmt.Sprintf("%s has had no out-of-date update for an hour", s.NodeName)}
+		if s.CounterRaisedTo > 0 {
+			// Not a stale sender: the mesh's counter was behind the machine (a store put back from a backup) and
+			// was raised; nothing has sent the machine its declaration since, so a person is asked to.
+			o.Summary = fmt.Sprintf("%s refused sequence %d from %s: it was composed from assignment generation %d, "+
+				"the mesh's own, and %s applied generation %d — the mesh's counter was behind the machine (a store "+
+				"put back from a backup?) and is raised to %d; `push %s` sends it what the mesh holds now",
+				s.NodeName, s.Sequence, s.Sender, s.Generation, s.NodeName, s.RefusedApplied, s.CounterRaisedTo,
+				s.NodeName)
+			o.Explanation = fmt.Sprintf("Needs you: push %s. The mesh's record was older than %s, so %s refused its "+
+				"update and kept what it had. The record is repaired; a push sends the update again.",
+				s.NodeName, s.NodeName, s.NodeName)
+		}
+		out = append(out, o)
 	}
 	return out
 }
@@ -181,12 +213,7 @@ func writeLastSend(ctx context.Context, w io.Writer, inv *inventory.Inventory, n
 	if s.Generation > 0 {
 		generation = fmt.Sprintf("assignment generation %d", s.Generation)
 	}
-	kind := "sent"
-	if s.PutBack {
-		kind = "put back"
-	}
-	fmt.Fprintf(w, "%s was last %s sequence %d at %s by %s, composed from %s, naming %s\n", node, kind,
-		s.Sequence, s.SentAt.Local().Format("2006-01-02 15:04:05"), s.Sender, generation, modulesWords(s.Modules))
+	fmt.Fprintf(w, "%s was last sent sequence %d at %s by %s, composed from %s, naming %s\n", node, s.Sequence, s.SentAt.Local().Format("2006-01-02 15:04:05"), s.Sender, generation, modulesWords(s.Modules))
 	if s.RefusedAt != nil {
 		fmt.Fprintf(w, "  and refused it at %s: it had applied generation %d\n",
 			s.RefusedAt.Local().Format("2006-01-02 15:04:05"), s.RefusedApplied)