4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	65cd7b4787	Retire a daemon's running build instead of deleting it before the restart (issue 734) ... A process no witness judges had its directory removed before the new bundle was unpacked and the unit restarted, so the old process ran on in a deleted working directory: mesh-build-go's `go version` probe failed with "getwd: no such file or directory" and refused three checks on ace on 2026-10-26, each in the second a new build of it arrived. Every process is now replaced the way a judged one is: its build is renamed under .witness/<name>/retired/ and deleted only once nothing runs from it. "Runs from it" now counts a process's working directory as well as its image, so the children a daemon starts keep the directory too. Forget keeps a retired build that still drains, and the witness's sweep covers every process it keeps a directory for, judged or not. Two unit-file tests are folded into one, so the unit count goes down by one.	2026-10-26 15:01:55 +01:00
jschoubben	11a635796d	Bound a key's history read to 10 s and test it on a real bus; the witness test waits for its process to run from its image (issue 1945)	2026-10-25 12:51:00 +01:00
jochen	3a117c2d2b	Keep a replaced build reachable, and delete it only once no process runs from it (hq issue 289) ... The witness moved a running controller's build into a 0700 directory and deleted it on proof, while the old process could still be serving. Its directories are now 0711, and a build without a reader is retired and swept once /proc shows nothing runs from it.	2026-10-07 02:45:08 +02:00
jochen	0c405b70cc	Roll a core build back by a witness that is not the new build (hq to-be 45 Phase 4) ... The launcher trusted a counter only a by-hand reconcile ever cleared and a known-good nothing in the daemon wrote, so no machine could roll its host back; the controller and the node tools were replaced in place with nothing kept. - The launcher runs a delivered host that is not known-good on trial: one that crashes, stops for nothing, or does not report within ten minutes goes back to known-good, once per version, recorded in rolled-back. The host proves itself when the mesh takes a report under its own build, says every standing verdict on its reports, never stands aside for a rolled-back version, and restarts its service once when its launcher was replaced on disk. - The engine keeps the controller's and the node tools' previous build beside the new one and judges the new one: the lease taken by the controller it started (read-only direct get of mesh-controller_lease/holder), or this machine's runtime answering $SRV.PING.node-tools.<node>, within sixty seconds of time it could ask. Not healthy: the previous restored, once, said. Proved: the previous deleted. A build declared not-reversible is never rolled back. - Retire never removes a version newer than the running one.	2026-10-06 18:23:56 +02:00