amadan
zdd-2-containment
Zero-downtime deploys, plan 2 of 6: containment (spec rev 17 §7.3, §7.6). Cut from zdd-1-generations (plan 1, unmerged); rebase onto main once plan 1 lands. Dormant: ExecBackend.GenContainment is false everywhere outside tests; plan 5 wires it to CARLOS_SWAP.
Flat: carlos-exec@<host> becomes a parent (oom.group=0) with g<n> children (full tier, oom.group=1) and role-sidecar/role-seed. Strict: PrepareStrictParent, PrepareGen, SetParentLimit, CloseRemove, one shared child-pinning helper. Stop-evidence Members() walks the parent's subtree, bounded while it reads. Nested: the carlos-instance-gen@<iid>:<n> template; the root control service writes a per-generation runtime drop-in (plan decision D1), with gen= on start/stop/reset, /parent, and cleanup only after termination is proven. spawnClaimedGen is built closed, matching main's a4cd3003.
Kernel suite (TestGenOOMKernel, TestGenStrictKernel) passed on DOCS-T1 under systemd-run --user Delegate=yes. Dev-box run not done (needs Paul's approval). D1's daemon-reload cost still has to be measured on dev before the flag goes on.
Astra: r1 ACCEPT WITH FIXES, one fix wave, r2 ACCEPT WITH FIXES with one open item. L1: after a generation kill that can't be proven, the wake path still releases the lease. That is latent behind the flag and parked to plan 3 Task 2 (cleanupFailedWake/unprovenWakes). Astra calls it a merge blocker, so Paul decides. Findings: docs/superpowers/plans/CODEX-FINDINGS-ZDD-IMPL-2*.md. Decisions D1-D6 need Paul's sign-off before merge.
Discussions
- No discussions on this branch yet.
Tasks
- No tasks yet.
Activity
- claude agent, operated by paul@keymail.dev pushed b9a5411e0 zdd plan 2 on main: adapt to instancectl c.do's header return (0bb57a31) and #256 D's WorkingDirectory (b8941639) for the generation template
- claude agent, operated by paul@keymail.dev pushed 80886334d zdd plan 2: Astra scoped re-review r2 (ACCEPT WITH FIXES; L1 parked to plan 3)
- claude agent, operated by paul@keymail.dev pushed 00d0dea98 zdd plan 2 final fix: parser-only generation refusals; closed helper docs
- claude agent, operated by paul@keymail.dev pushed 273ed2bff zdd plan 2 final fix: finalise generation files once termination is proven
- claude agent, operated by paul@keymail.dev pushed 72674b27c zdd plan 2 final fix: ParentLimit refuses when there is no cgroup manager
- claude agent, operated by paul@keymail.dev pushed ba6e6d6a9 zdd plan 2 final fix: an uncertain generation start is killed before release
- claude agent, operated by paul@keymail.dev pushed 7f889d9ab zdd plan 2 final fix: kernel tests always end their children
- claude agent, operated by paul@keymail.dev pushed 792eb01a0 zdd plan 2 final fix: bound the cleanup walk while it reads
- claude agent, operated by paul@keymail.dev pushed b1914ba3c zdd plan 2: Astra final review r1 (ACCEPT WITH FIXES)
- claude agent, operated by paul@keymail.dev pushed e3626eec5 zdd plan 2 task 13: claim control unit keeps its roots after the drop-in path widening
- claude agent, operated by paul@keymail.dev pushed dd3cba85b zdd plan 2 task 12: claimed spawns pin a generation child under the entry's parent
- claude agent, operated by paul@keymail.dev pushed 8e4d8766e zdd plan 2 task 11: nested wakes start carlos-instance-gen@ under containment
- claude agent, operated by paul@keymail.dev pushed a813586c8 zdd plan 2 task 10: exec backend places spawns in generation children; ParentLimit, KillGen
- claude agent, operated by paul@keymail.dev pushed cc299b5ee zdd plan 2 task 9: control service starts, stops and sweeps generation units; /parent
- claude agent, operated by paul@keymail.dev pushed 4475f63fc zdd plan 2 task 8: trampoline and exit writer split <iid>:<n>
- claude agent, operated by paul@keymail.dev pushed 4a966739e zdd plan 2 task 7 fix: generation units keep the trampoline's signal exits successful
- claude agent, operated by paul@keymail.dev pushed 591cbc251 zdd plan 2 task 7: carlos-instance-gen@ template, same namespace, keyed by drop-in
- claude agent, operated by paul@keymail.dev pushed 6992ac0fb zdd plan 2 task 6: generation unit, launch, exit-record and log-socket names
- claude agent, operated by paul@keymail.dev pushed 26a6ef719 zdd plan 2 task 5: the sampler counts a populated generation parent
- claude agent, operated by paul@keymail.dev pushed f5df5d673 zdd plan 2 task 4 fix: the hog is bounded and its confinement checked first
- claude agent, operated by paul@keymail.dev pushed f54813c27 zdd plan 2 task 4: kernel suite: an OOM-killed successor leaves the incumbent serving
- claude agent, operated by paul@keymail.dev pushed e85733a43 zdd plan 2 task 3 fix 2: the intent path still refuses an existing role child
- claude agent, operated by paul@keymail.dev pushed af809b0a6 zdd plan 2 task 3 fix: one child-pinning helper for role and generation children
- claude agent, operated by paul@keymail.dev pushed a0b4df33e zdd plan 2 task 3: strict containment per generation child; parent limit through one API
- claude agent, operated by paul@keymail.dev pushed e94519fc9 zdd plan 2 task 2: per-child cleanup; stop evidence members walk the whole parent Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- claude agent, operated by paul@keymail.dev pushed b6fc39369 zdd plan 2 task 1: flat generation layout: parent cgroup, g<n> children, parent limit