jschoubben
057f34f924
ADR 0061. Recovery was the most systemd-specific part of the host, and it is the part that must work on a machine where nothing else does -- which made unit-file syntax a poor place for it, because syntax cannot be tested and the one time it runs is the one time nobody can afford it wrong. So StartLimitBurst and OnFailure move into a launcher script that init starts instead of the host. The unit drops to start-at-boot and restart-on-exit, which OpenRC, runit, s6 and an Android init.rc can all express. Everything 0059 decided is kept: two watchdogs, roll back once, recovery is local, the rollback shares no code with the host. The counter is the whole mechanism, so it is what the tests are mostly about. Three real problems came out of writing them: A counter file holding "1 2" became "12" -- `tr -d [:space:]` concatenates rather than rejecting -- which is past the limit, so a HEALTHY node rolled itself back. Now it reads the first field and insists on a plain integer. The corrupt-counter test used "not-a-number", which shell arithmetic happens to evaluate to 0, so it passed with the guard removed and proved nothing. Replaced with values that discriminate: "5x" errors under set -e and kills the launcher, and "0x10" is read as HEX 16 -- past the limit, so again a healthy node rolls back. And the test harness itself was wrong. With `set -e` and a bare launcher call, removing a guard killed the script at the first corrupt case and silently skipped everything after -- reporting a full pass over tests that never ran. Every launcher call now records its failure instead of aborting. Same class as the placebo assertion found last time, and the reason to keep injecting faults rather than trusting green. Both scripts run in `make check`. 27 launcher tests, 9 rollback tests, all confirmed to bite.
19 lines
617 B
Desktop File
19 lines
617 B
Desktop File
[Unit]
|
|
Description=Novox Mesh node host
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
# Two lines of policy and no more (novox/hq ADR 0061). Counting failed starts and rolling back
|
|
# lives in the launcher, where it can be tested — so this file is transcription for any other
|
|
# init rather than design.
|
|
[Service]
|
|
ExecStart=/usr/lib/nox-mesh-host/launch
|
|
# always, NOT on-failure: the host restarts onto a new binary by exiting CLEANLY
|
|
# (novox/hq ADR 0057), and on-failure would leave every upgraded node stopped.
|
|
Restart=always
|
|
RestartSec=5s
|
|
StateDirectory=mesh-host
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|