amadan
zdd-readiness: roll notes fix round 1
Mark the retry-signing note closed, say what the operator sees on a claims-on box, mark D1 done in Gate E, and tighten the intro and round-3 bullets.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
1 file changed,
+20
−11
docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md+20 −11
diff --git a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md| index dc385057c..447f68e82 100644 |
| --- a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| +++ b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| @@ -33,8 +33,8 @@ This is the flag-on precondition. It is copied from amadan discussion #272 |
| ("Zero-downtime deploys: owed before CARLOS_SWAP can go on", opened by |
| claude~paul@keymail.dev), as read on 2026-10-11, including its replies. |
| As of 2026-10-12, items this branch closes carry a line saying "closed on |
| -zdd-flag-readiness (refs), pending merge". Those are built and reviewed on |
| -the branch, not merged, not released and not rolled, and only Paul closes |
| +zdd-flag-readiness (refs), pending merge". Those are built and task-reviewed on |
| +the branch (the whole-branch review comes next), not merged, not released and not rolled, and only Paul closes |
| them on #272. Everything else is still open, and the open items are |
| collected under "Still owed" below. **The flag stays off on any box until |
| every item is closed or Paul waives it in writing.** Gates A to D do not |
| @@ -64,16 +64,18 @@ dormant and `CARLOS_SWAP` must stay unset until everything below is closed. |
| exec time, including workers, legacy sidecars, claims and move launches. It |
| honours markers, and signed retries and the pointer pass. Execution |
| admission (7daf32ac) adds a worker gate after cgroup prep, managed |
| - revalidation and no uncaptured live-link recycle. Two parts of this are |
| - still open, see "Still owed". |
| -- The 15-item list in round 3, section 5. The code defects are closed on |
| - zdd-flag-readiness, pending merge: policy cache, bounded reads and acks |
| + revalidation and no uncaptured live-link recycle. Closed except for the two |
| + items under "Still owed" (the nested live-link race and the seed exec). |
| +- The 15-item list in round 3, section 5. The code defects on the flag-on |
| + path are closed on zdd-flag-readiness, pending merge: policy cache, bounded reads and acks |
| (f46d3142, 4416872e); clean one-shot good, the WakeWorker budget and the |
| halt event (5ad55485); GoodVersion bucket retention and the hold build |
| published before its incumbent stops (d3d464cd); the stage relay give-up |
| (2c5adbe8); transient status (98c1763d, 61b83e27). The branch simulation |
| gained invariants I5 to I8 and mutants M7 to M12 (44800ab4). The 3000-seed |
| - sweep passed and M1 to M12 were all caught. |
| + sweep passed and M1 to M12 were all caught. The coverage-only items, |
| + reproducible replay and the real-box items stay deferred, as the plan's |
| + rulings say. |
| ### Carried from plans 2 and 3 |
| @@ -179,11 +181,14 @@ That reply found no claims check in `swapArming` |
| **Conclusion (2026-10-12): decline, do not close.** On zdd-flag-readiness |
| (cd7de723), pending merge, a box with host claims on declines |
| `CARLOS_SWAP=overlap` with the reason code `host-claims-on`. It runs today's |
| -stop-then-start paths, and the agent log says `REFUSING CARLOS_SWAP=overlap`. |
| +stop-then-start paths. |
| The four gaps above are not closed. They become the future feature "claims-on |
| swaps", which is not scheduled. The source for the four gaps is |
| `CODEX-FINDINGS-ZDD-IMPL-5-MERGE.md`. After Gate E on any claims-on box, |
| -expect a dash under SERVING and the `host-claims-on` reason, not an armed box. |
| +the operator sees a dash under SERVING and, in REASON, "its box cannot run |
| +two builds side by side, so it restarts instances the old way". The code |
| +`host-claims-on` is in the instance's JSON record (`rollout.unavailable`) and |
| +in the agent log line `REFUSING CARLOS_SWAP=overlap (host-claims-on)`. |
| ### Still owed (code), after zdd-flag-readiness |
| @@ -287,7 +292,9 @@ discussion's items. |
| (`internal/rollout/manager.go:501-515`) trusts any request that names a host |
| on that box. Only the app's record and the rollout report gate it, at the |
| console, not at the box. It is on the owed list above as a flag-on |
| - blocker. |
| + blocker. Closed on zdd-flag-readiness (d68a1dde), pending merge: retries |
| + are console-signed root grants bound to the host's restriction epoch, and |
| + every box ignores an unsigned retry. |
| - **`FailureBook` is not rendered anywhere.** The box publishes it |
| (`internal/status/snapshot.go:268-275`) but no `carlos` surface or console |
| page shows it. It is parked in #272. What `carlos` shows for a failed or |
| @@ -419,7 +426,9 @@ actions on dev: creating the `zdd-probe` app, flipping its swap policy to |
| "Before Gate E: owed" list has an open item that Paul has not waived.** |
| First the index's D1 guard: measure `systemctl daemon-reload` on a dev box |
| -carrying titogo-scale unit counts. |
| +carrying titogo-scale unit counts. **Done 2026-10-11 on dev:** median 309 to |
| +424 ms, so keep the drop-ins. Repeat it only if unit counts grow a lot; the |
| +commands are kept below for that case. |
| ```bash |
| aws --profile kass --region eu-west-1 ssm send-command --instance-ids i-046c7fe43620944bc \ |