issue 974: review 1: a verb's end, a provisioner client's word and a failed key read each ask or retry a look; the silent bucket ages; the acceptance test starts the rollout through the serving wiring

internal/broker/controller_buckets.go

@@ -97,6 +97,11 @@ const MergeWindowMarkerTTL = time.Minute
 // RolloutSilentMarkerTTL is how long the marker an expired silent key leaves is kept, for the same reason.
 const RolloutSilentMarkerTTL = time.Minute
 
+// RolloutSilentKeptFor is the age of the silent keys' bucket: every report deletes a key and the delete leaves a marker, which
+// with one value per key would stay for ever and fill the bucket. A key lives a quarter of an hour at most, so an hour
+// takes nothing live.
+const RolloutSilentKeptFor = time.Hour
+
 // AskedKeptFor is how long an ask is kept after it was made: a month, as the router keeps its own.
 const AskedKeptFor = 30 * 24 * time.Hour
 
@@ -251,6 +256,7 @@ func (j *JetStream) EnsureControllerBuckets() error {
 			"lives the time a machine may stay silent and is deleted by its report; one that expires names the " +
 			"machine silent; written by the controller alone",
 		History:        1,
+		TTL:            RolloutSilentKeptFor,
 		MaxValueSize:   4 << 10,
 		MaxBytes:       8 << 20,
 		Storage:        jetstream.FileStorage,

internal/broker/controller_buckets_test.go

@@ -389,6 +389,42 @@ func TestTheRolloutsSilentKeysExpireAsAPurgeAndAReportsDeleteIsNot(t *testing.T)
 	}
 }
 
+// **The silent keys' bucket ages**, or its delete markers would fill it (issue 974, review 1): every report deletes a key,
+// the delete leaves a marker, and with one value per key and no age the markers stay for ever. A bucket made before the
+// age was set is brought to it by the next start, which the server accepts as an update of an existing bucket.
+func TestTheSilentKeysBucketAgesAndAnOlderOneIsBroughtToIt(t *testing.T) {
+	js, err := Dial(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer js.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+	api, err := jetstream.New(js.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	// As the first build made it: no age.
+	if _, err := api.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: RolloutSilentBucket, History: 1,
+		MaxValueSize: 4 << 10, MaxBytes: 8 << 20, Storage: jetstream.FileStorage, LimitMarkerTTL: RolloutSilentMarkerTTL}); err != nil {
+		t.Fatal(err)
+	}
+	if err := js.EnsureControllerBuckets(); err != nil {
+		t.Fatalf("a bucket made without the age is not brought to it: %v", err)
+	}
+	kv, err := api.KeyValue(ctx, RolloutSilentBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	status, err := kv.Status(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if status.TTL() != RolloutSilentKeptFor {
+		t.Errorf("the bucket ages at %v; want %v", status.TTL(), RolloutSilentKeptFor)
+	}
+}
+
 // **The merges have a consumer of their own, which a reset of the events consumer leaves alone** (issue 973, novox/hq
 // ADR 0407 decision 3): healer H4 re-makes the events consumer from now, dropping what it holds pending; a merge
 // waiting in the merges consumer is not that consumer's, and nothing would catch it up.