amadan
fix wave 2: an exhausted failure book's doc gives no unsafe recovery advice
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
1 file changed,
+11
−5
internal/rollout/failures.go+11 −5
diff --git a/internal/rollout/failures.go b/internal/rollout/failures.go| index bdaf63f65..c3933f8b1 100644 |
| --- a/internal/rollout/failures.go |
| +++ b/internal/rollout/failures.go |
| @@ -194,13 +194,19 @@ func wakeIntent(id string) bool { return strings.HasPrefix(id, "w") } |
| // for the host: an attempt's, or a wake's that an attempt would replace. Its |
| // outcome is not yet written, so replacing its intent would lose it across a |
| // failed save and a restart. |
| +var ErrIntentStands = errors.New("another execution on this instance has not recorded its outcome yet") |
| + |
| // ErrSeqExhausted is every save's answer once the book's sequence has run |
| // out (seqLimit, fix wave 1, item 5): the book is never saved or published |
| -// again, so no generation repeats under its identity. Recovery is a new |
| -// book: drop the file's "book" key, or the file, and restart the agent. |
| -var ErrSeqExhausted = errors.New("rollout: the failure book's sequence is exhausted; it is never saved or published again (give the box a new book)") |
| - |
| -var ErrIntentStands = errors.New("another execution on this instance has not recorded its outcome yet") |
| +// again, so no generation repeats under its identity. Rotating the book's |
| +// identity alone does not reset an exhausted sequence: a reopen keeps the |
| +// highest saved sequence (highestSaved), so the next allocation exhausts |
| +// again. There is no supported reset yet; an exhausted book refuses managed |
| +// starts on an armed box, as an unreadable book does. The file must not be |
| +// deleted: it holds the failure records and hold-ran markers that keep |
| +// instances off builds that failed or ran on them. Reaching the limit takes |
| +// about 1.8e19 book events, so this is a guard, not an operating condition. |
| +var ErrSeqExhausted = errors.New("rollout: the failure book's sequence is exhausted; it is never saved or published again") |
| // reconciledReason is a reconciled intent's Reason. reasonWord reads it as |
| // a failed health check (status.ReasonHealth): the execution's verdict was |