amadan
zdd-readiness: plan, Task 11 gains the scheduler's shutdown join (Task 5 review)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+1
−0
docs/superpowers/plans/2026-10-11-zero-downtime-flag-readiness.md+1 −0
diff --git a/docs/superpowers/plans/2026-10-11-zero-downtime-flag-readiness.md b/docs/superpowers/plans/2026-10-11-zero-downtime-flag-readiness.md| index 409195599..91e41c25d 100644 |
| --- a/docs/superpowers/plans/2026-10-11-zero-downtime-flag-readiness.md |
| +++ b/docs/superpowers/plans/2026-10-11-zero-downtime-flag-readiness.md |
| @@ -892,6 +892,7 @@ Rules (Astra R2 ruling 194 "startup-only records"): |
| **Corrections (plan review round 1; these override the text below):** |
| - **Ack order is fixed at the transition** (plan review #10). `configTrack.activate` (called under `m.mu`) hands back the ack together with a per-host sequence taken under `m.mu`; the writer (`Manager.acks`) keeps the newest pending ack per host (latest sequence wins, older ones are dropped, never written after a newer one), submission never blocks, and one drain goroutine writes. When the manager's context ends, the drain finishes the write in progress and stops. |
| - **Flag off keeps `configAckFunc` as it is** (plan review #11): put the 10 s bound in the armed path only (the writer wraps each write in `context.WithTimeout`), not in `configAckFunc`. |
| +- **A graceful stop joins the scheduler** (Task 5 review; spec §8.6 "Shutdown cancels and joins the whole operation set"). Add `func (m *Manager) Close(ctx context.Context)`: it stops admitting attempts, then waits (bounded by ctx) for every in-flight `execute` goroutine to finish its `done()` (including the book write and the intent `End`) and for every in-flight `OnGen` call to return, then stops the ack writer as above. `internal/host/agent.go` calls it right after `svc.Shutdown(ctx)` (~line 732), with the same 60 s context, when a manager is armed. Test: an attempt whose `Swap` is cancelled by shutdown has its outcome and `End` on disk when `Close` returns (no intent left in the file), so a planned agent restart mid-swap reconciles nothing. |
| **Files:** |
| - Modify: `internal/rollout/policy.go:~60-117` (`policyCache`) |