issue 974: a rollout's wait for a machine is a key on the bus that its report deletes and its expiry names silent

internal/broker/controller_buckets.go

@@ -43,6 +43,12 @@ var (
 	// `<batch>.most`, made once when it opens and living the window's most. The first to expire closes the
 	// batch, and the controller's watcher hears the delete marker. Written by the lease holder alone.
 	MergeWindowBucket = BucketName(ControllerSeat, "merge-window")
+	// RolloutSilentBucket holds the wait of every machine a rollout has sent a tier to (novox/hq ADR 0406 §5, issue
+	// 974): per send a key `<plan>.<tier>.<node>` that lives ApplySilentAfter, made when the controller sends that
+	// machine and deleted by the machine's report on that send. Only a missing report lets it expire, and the
+	// controller's watcher hearing the expiry ends the wait and names the machine silent. Written by the lease
+	// holder alone.
+	RolloutSilentBucket = BucketName(ControllerSeat, "rollout-silent")
 )
 
 // The controller's record mirrors (novox/hq ADR 0289, design 54, design 57 package F3): a bucket per kind of
@@ -88,6 +94,9 @@ const (
 // that is up to hear it, short enough to leave nothing behind.
 const MergeWindowMarkerTTL = time.Minute
 
+// RolloutSilentMarkerTTL is how long the marker an expired silent key leaves is kept, for the same reason.
+const RolloutSilentMarkerTTL = time.Minute
+
 // AskedKeptFor is how long an ask is kept after it was made: a month, as the router keeps its own.
 const AskedKeptFor = 30 * 24 * time.Hour
 
@@ -116,13 +125,13 @@ func IsControllerBucket(bucket string) bool {
 	return bucket == CallsBucket || bucket == HandActsBucket || bucket == ConditionsBucket ||
 		bucket == ConditionHistoryBucket || bucket == LeaseBucket || bucket == AskedBucket ||
 		bucket == AssignmentsBucket || bucket == DeclaredConfigBucket || bucket == PredefinedBucket ||
-		bucket == MergeWindowBucket
+		bucket == MergeWindowBucket || bucket == RolloutSilentBucket
 }
 
 // ControllerBuckets are the controller's own buckets, in the order they are asserted.
 func ControllerBuckets() []string {
 	return []string{LeaseBucket, CallsBucket, HandActsBucket, ConditionsBucket, ConditionHistoryBucket, AskedBucket,
-		AssignmentsBucket, DeclaredConfigBucket, PredefinedBucket, MergeWindowBucket}
+		AssignmentsBucket, DeclaredConfigBucket, PredefinedBucket, MergeWindowBucket, RolloutSilentBucket}
 }
 
 // ControllerBucketsAsserter is what raising the controller's buckets needs of a connection.
@@ -234,6 +243,21 @@ func (j *JetStream) EnsureControllerBuckets() error {
 	}); err != nil {
 		return fmt.Errorf("asserting bucket %s: %w", MergeWindowBucket, err)
 	}
+	// **The rollout's silent keys: keys that expire** (ADR 0406 §5, issue 974). A key lives as long as the machine
+	// may stay silent; the machine's report deletes it, and a marker of expiry is what the watcher hears.
+	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
+		Bucket: RolloutSilentBucket,
+		Description: "the wait of every machine a rollout sent a tier to (novox/hq ADR 0406): `<plan>.<tier>.<node>` " +
+			"lives the time a machine may stay silent and is deleted by its report; one that expires names the " +
+			"machine silent; written by the controller alone",
+		History:        1,
+		MaxValueSize:   4 << 10,
+		MaxBytes:       8 << 20,
+		Storage:        jetstream.FileStorage,
+		LimitMarkerTTL: RolloutSilentMarkerTTL,
+	}); err != nil {
+		return fmt.Errorf("asserting bucket %s: %w", RolloutSilentBucket, err)
+	}
 	// **The record mirrors: no age** (design 54 §5). A key is removed when its record is, by a purge whose
 	// marker lives a day; a key that expired would be a record the bus forgot while the store still holds it.
 	for _, m := range []struct{ bucket, why string }{