amadan
zdd-readiness: final review round 2, roll notes qualify the epoch bound and mixed-version retries
Astra R2 item 9 and ledger rulings: the finding 5 closure cites fb55d199 and says what round 2 found; the reopen's 2^20 sequence advance is a bound, not a guarantee (and its enforcement is listed as still owed); an older box does not check the grant's book or epoch, so mixed-version retry sequencing stays a flag gate; a declined box's book saves (reconciliation, the reopen advance) are attempts whose failure is logged while the box continues.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+36
−10
docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md+36 −10
diff --git a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md| index 3ed3e5ea2..3e10f710f 100644 |
| --- a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| +++ b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| @@ -50,8 +50,8 @@ dormant and `CARLOS_SWAP` must stay unset until everything below is closed. |
| - N5 to N7: gaps in the hold-ran marker. N7 is a disagreement over how it |
| treats an existing failure record. Closed on zdd-flag-readiness (b402bc0e, |
| 42865b81; N6 with 0d6029b3, 3e875ff2; final review round 1: 1e842f89, |
| - c327f703, e72e68d2), pending merge. That covers markers keeping records, |
| - blocking the worker fallback and signed-rollback provenance, with marker = |
| + c327f703, e72e68d2; final review round 2: fb55d199), pending merge. That |
| + covers markers keeping records, blocking the worker fallback and signed-rollback provenance, with marker = |
| installed = good boots (ruling 205). N6 and the retry ordering use a |
| persisted book sequence and per-execution markers, so a pre-retry outcome |
| never undoes a retry. The round 1 fixes: an execution's identity carries |
| @@ -60,11 +60,22 @@ dormant and `CARLOS_SWAP` must stay unset until everything below is closed. |
| clears nothing of the new one (1e842f89); a retry that removes only a |
| marker still orders a late failure of an execution that began before it |
| (c327f703); and a host retry of a build the instance does not want yet |
| - keeps its canary for that build (e72e68d2). |
| + keeps its canary for that build (e72e68d2). Round 2 found e72e68d2 kept |
| + only one entitlement per host, so a retry of a second restricted build |
| + took away the first build's canary, and the first build could then never |
| + be retried again (the book already listed the host as retried for it). |
| + Since fb55d199 entitlements are kept per host and build: each is spent |
| + only by the adoption onto its own build, comes back if that adoption is |
| + proven to have run nothing, and is dropped once the book no longer lists |
| + the host as retried for that build. |
| - F5: failure-record durability across a failed write followed by a restart. |
| Closed on zdd-flag-readiness (8836e521: write-ahead intents, schema-2 book, |
| startup reconciliation; f46d3142, 4416872e: a shutdown join so planned |
| - restarts leave no intent), pending merge. |
| + restarts leave no intent), pending merge. A box that declined the flag |
| + also reconciles an armed run's intents into records, but its save of the |
| + reconciled book is an attempt: a failed save is logged and the box carries |
| + on with the records in memory, and reconciles the intents again on its |
| + next start. |
| - Ruling 206: an uncertain nested start is a hold failure. Closed on |
| zdd-flag-readiness (c453a798), pending merge. |
| - Boxes that declined to arm: worker restarts; refusals checked only at plan |
| @@ -170,9 +181,15 @@ on #272 too. |
| restriction's epoch and to the identity of the box's failure book, and |
| every box ignores an unsigned retry. The book identity (c12c35c3) stops a |
| grant for one book's restriction clearing another book's at the same |
| - epoch, and every open of the book moves its sequence past any epoch an |
| - earlier run handed out unsaved. A |
| - console with no signing key answers 503, and the text of that refusal is |
| + epoch. Every open of the book also advances its sequence by 2^20 (about a |
| + million), so a run does not hand out again an epoch an earlier run handed |
| + out but never saved. That is a bound, not a guarantee: an epoch could be |
| + reused only if an earlier run made more than a million book changes |
| + without one successful save, and nothing enforces that limit (see "Still |
| + owed"). An armed agent saves the advance when it opens the book, or |
| + refuses managed starts. A box that declined the flag keeps the advance in |
| + memory until its next write of the book, and that write is an attempt: a |
| + failed save is logged and the box continues. A console with no signing key answers 503, and the text of that refusal is |
| new copy awaiting review (`copy-review/strings.json`). |
| - `provision.ListRecords` silently skips unreadable instance records (Astra |
| plan 6 R3). A relevant fleet can then drop out of the deploy watch's |
| @@ -246,6 +263,11 @@ blocker, and the fix wave for that round did not close them. |
| A future feature. |
| - Spec section 11 still says a retry is a re-signed pointer. The spec needs a |
| revision for console-signed host-retry grants. |
| +- The reopen epoch bound (c12c35c3): the 2^20 advance is not enforced, so a |
| + run with more than a million unsaved book changes could let a later run |
| + reuse an epoch. Before the flag goes on, enforce the bound, reserve epochs |
| + durably, or get Paul's ruling that the limit is acceptable (Astra, final |
| + review round 2). |
| - Mixed-version retry sequencing: the order in which boxes and consoles take |
| the signed, book-bound grants needs writing down and checking on dev before |
| the flag goes on (see "Retries: boxes before consoles" below). |
| @@ -261,9 +283,13 @@ by 076bd9c0 (final review round 1), pending merge. |
| Since c12c35c3 a grant must also name the box's failure book: a box on |
| this branch drops a grant from a console that does not sign one, and the |
| log line says the grant is for book "". A box from before this branch |
| - handles a retry as it does today. Nothing is cleared that should not be, |
| - but a retry asked between the two rolls may have to be asked again once |
| - the console is updated. |
| + handles a retry as it does today: it does not check the grant's book or |
| + epoch, so receiving the extra field gives it none of this protection. Until |
| + every box runs this branch, an older box can apply a retry that a box on |
| + this branch would refuse (one for a stale epoch or for another book), so |
| + retry sequencing across a mixed-version roll stays a flag gate (see |
| + "Still owed"). A retry asked between the two rolls may also have to be |
| + asked again once the console is updated. |
| - **Schema 2 failure book.** The failure book file is written as schema 2. |
| Downgrading an agent with the flag on makes that box refuse managed starts. |
| Recover by upgrading the agent again. Do not delete the file to get past |