The controller gives its lease back at the stop signal and says a takeover once, so a controller delivery raises no urgent alarm (issue 906, ADR 0558)

Conversation 1 Commits 2 Files Changed 8

+305 -39

2 Commits

Author	SHA1	Message	Date
jschoubben	8f84731896	Name the epoch given back in the lease's delete marker, so only a holder's own release counts as a handover (issue 906, ADR 0558 §3, review round 1) mesh/delivery merged: source.main moved to novox/mesh-controller@0fbb5ef35991 Details mesh/check being carried to 8f847318963c on 0fbb5ef35991 \| from 2dafbe60e939 A plain delete marker on the lease key is also written by a command's own lease and by a take given back over the floor; counted as a handover, it would record a crashed holder's epoch released and say nothing. Release now writes the marker itself, compare-and-set on the key's revision, with the header Mesh-Lease-Released naming its epoch, and the next holder ends only that epoch as released. A takeover whose predecessor cannot be read is now raised as an expiry, not only printed.	2026-10-27 00:55:30 +01:00
jschoubben	fbaa463a38	Give the controller lease back at the stop signal and say a takeover once, so a controller delivery raises no urgent alarm (issue 906, ADR 0558) The 2026-10-26 replacements showed the lease was given back, but last: the shutdown took 10 s, the gate had closed at half the key's age, and the release recorded the epoch released only through the gate, so the next holder found it expired and S12 said it, urgent, for an hour. Now the stop signal gives the key back first and records the epoch released whenever the delete succeeded; a candidate reads the key's delete marker on the bus to tell a handover from an expiry; and a real takeover (lost or expired) is raised and cleared once by the controller that took it, instead of an hour of S12 observation. Research 072 piece moved: the lease's takeover read from its own key on the bus and said as an event (03-domains, mesh-controller row; 04-findings 2, the watchdogs' age reading). Quick fix weighed: drop the gate check from the release record only; it leaves the release last in the shutdown and the hour-long alarm for a real takeover.	2026-10-27 00:49:13 +01:00

Author

SHA1

Message

Date

jschoubben

8f84731896

Name the epoch given back in the lease's delete marker, so only a holder's own release counts as a handover (issue 906, ADR 0558 §3, review round 1)

mesh/delivery merged: source.main moved to novox/mesh-controller@0fbb5ef35991

Details

mesh/check being carried to 8f847318963c on 0fbb5ef35991 | from 2dafbe60e939

A plain delete marker on the lease key is also written by a command's own
lease and by a take given back over the floor; counted as a handover, it
would record a crashed holder's epoch released and say nothing. Release now
writes the marker itself, compare-and-set on the key's revision, with the
header Mesh-Lease-Released naming its epoch, and the next holder ends only
that epoch as released. A takeover whose predecessor cannot be read is now
raised as an expiry, not only printed.

2026-10-27 00:55:30 +01:00

jschoubben

fbaa463a38

Give the controller lease back at the stop signal and say a takeover once, so a controller delivery raises no urgent alarm (issue 906, ADR 0558)

The 2026-10-26 replacements showed the lease was given back, but last: the
shutdown took 10 s, the gate had closed at half the key's age, and the release
recorded the epoch released only through the gate, so the next holder found
it expired and S12 said it, urgent, for an hour.

Now the stop signal gives the key back first and records the epoch released
whenever the delete succeeded; a candidate reads the key's delete marker on
the bus to tell a handover from an expiry; and a real takeover (lost or
expired) is raised and cleared once by the controller that took it, instead
of an hour of S12 observation.

Research 072 piece moved: the lease's takeover read from its own key on the
bus and said as an event (03-domains, mesh-controller row; 04-findings 2,
the watchdogs' age reading).
Quick fix weighed: drop the gate check from the release record only; it
leaves the release last in the shutdown and the hour-long alarm for a real
takeover.

2026-10-27 00:49:13 +01:00

The controller gives its lease back at the stop signal and says a takeover once, so a controller delivery raises no urgent alarm (issue 906, ADR 0558) #478