amadan
fast-converge: fullPass should skip a held host whose channel head is still the failed version Issue open
Migrated from github.com/carlosframework/platform issue #294, opened 2026-08-25. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: fullPass should skip a held host whose channel head is still the failed version, to stop a restart flap at a 5s cadence.
---
Found during the console-as-an-app branch (Task 7 re-review), which handed us the design. Filed as the tightening for a residual that branch accepted deliberately.
Background
That branch bounded a restart flap it introduced: a persistently broken named-unit build would otherwise cycle the service every 2s. The bound is an agent-side restartHold memo — observeRestart records failures (it never suppresses a restart, only gates sweep membership), fastMembers skips held hosts, and success clears the hold at once.
fullPass is deliberately ungated, so a console-mediated recovery promote converges immediately rather than waiting out a backoff. Every serial bump comes from an HTTP handler (console.bumpSerial), so a serial move is always a human or CLI write — that is the right call and should stay.
The residual
fullPass is clamped to one per fastFullClamp (5s). So a console under sustained write pressure — a busy CI fleet making ≥1 mutating call per 5s — re-admits the flap at a 5s cadence rather than 2s. Reduced, not eliminated, in that regime.
The design (from the re-review)
The memo already records the failed version. So fullPass can skip a held host whose channel head still equals that version, while still converging any new version immediately — which preserves the recovery-promote property that made it ungated in the first place.
Priority
Low. Needs an unusual conjunction (sustained console writes + a broken named-unit head), and each attempt still doubles the sweep-side hold. Flagship and tito are immune anyway — on a hardened box the sandboxed agent's PointLive is refused and relayed to root, so the fast loop never reaches the restart.
🤖 Generated with Claude Code