oficina / home Public

Home routes hibernate despite the always-awake design requirement open

The current supported console API reports hibernate=true for home.bds.oncarlos.com, overnight-home-id.bds.oncarlos.com and overnight-home.bds.oncarlos.com (observed 2026-09-08T16:17:58Z). The preview instance records omit hibernate, so the platform derives true for their exec-instance shape. Filtered receipts are saved under /home/paulca/.cache/oficina-home-maintenance-eligibility.

Home's authoritative design section 2.1 and AGENTS require that Home does not hibernate because new sign-in and membership freshness depend on its availability. The platform maintenance first slice in carlos/platform discussion117 only supports hibernating activator-managed exec instances and explicitly refuses non-hibernating instances. These are different completion requirements: the current preview shape can satisfy the first slice's shape check while failing Home readiness.

Acceptance: provide supported always-awake credential and directory deployments; prove behavior beyond the normal idle window; provide a checked maintenance/provisioning path for that supported topology; preserve existing databases, keys and sign-in origins. Do not infer full eligibility from a Running status or silently relax the Home requirement. No production changes have been made for this finding.

Source follow-up at platform af52: HibernateOrDefault derives true for exec instances. activator.sweepOnce sleeps idle entries unless existing schedule/activity holds apply; those incidental holds are not an always-awake policy. RetireExcept explicitly stops a live activator child when Hibernate is disabled and releases its lease for a separately managed systemd unit. Therefore toggling hibernate=false on the current exec routes alone is not a supported fix and could remove their process owner. A real always-awake topology/lifecycle is needed, and must include startup, crash and deploy convergence rather than periodic HTTP pings or an invented sidecar.

Read-only Home topology audit complete: /home/paulca/.cache/oficina-home-topology-audit/topology.json (SHA256 f70d564df4027925cbc18cd6b0aadcff80f922b3d15809da462ffead1aef16fc). Exact Home 7e282e2 and platform af52 sources, plus supplied API receipts. Existing ordinary unit service can satisfy no-hibernation if the SERVICE starts at boot; a socket alone cannot. However UnitBackend lease/replication are inert and data/config ownership differs, so it is outside approved maintenance6a and does not supply an in-place migration from current exec state. Recommended smallest complete proposal for current state: explicit always-awake activator-managed exec policy, proactive boot/crash/adoption reconciliation, independent ownership/sleep predicates, and reviewed extension of maintenance eligibility. Root litestream exclusion currently keys on Hibernate: must include all activator-owned DBs or the new mode risks two replicators. Twenty-one source excerpts, eight interface amendment areas and fourteen acceptance tests included. No pings/timers/sidecar workaround; no config/service mutation, implementation, Fable invocation or new contract approval.

Concrete design amendment ready for later independent review: platform branch design-always-awake-exec, 0cb329b7ba065d54bd05c6af8dc55bf28043e8ce. Preserves Home no-hibernation and current exec DB/process/config/lease ownership. Adds explicit always-awake policy, proactive startup/crash/adoption recovery, shared management versus sleep predicates and root-replication exclusion. Activation is proposed as a fixed platform maintenance action with fresh owner approval, stopped/fenced policy update and explicit resume; new action/recovery authority is NOT approved. Existing-only transition does not cover clean installation/new Home roles; those remain suite work. Exact three observed primaries remain preflight identity inputs, not permission to migrate. No code or live config changes, and no Fable invocation during quota exhaustion.

Latest design-only revision is platform d3b8b6a4dc5f53b59f1c76e7a2332b65eed796f9. It explicitly blocks fresh maintenance lease takeover until the previous maintenance executor is proved quiescent/dead and exclusive execution ownership transfers; stopping Home alone is insufficient. The fixed residency action and eligible-class change remain proposals awaiting independent review. Existing-only migration still leaves clean installation/new Home roles outstanding. No implementation or live route changes.

Reviewable platform lifecycle design now frozen at 80f61699e577a83089c43ebb08fd75f9f724983d, exact CI green. Resume explicitly retains the fresh selected-release non-serving compatibility checker under fence/lease; absent Home checker is a separate consumer dependency, not covered by operator preparation or HTTP health. Existing-only always-awake migration and fixed-action/executor recovery remain proposals requiring Fable review. No implementation or live changes.

Home checker audit at exact7e282e2 confirms no complete or mounted compatibility checker. Source-bound audit: /home/paulca/.cache/oficina-home-compatibility-audit/audit.json. Complete design is being drafted; a config-facts helper alone will not count as delivery. Root ran an isolated synthetic hot-WAL probe against the existing pinned connector through a test-only Go overlay. newBoundDatabase + PRAGMA queryonly=ON + SELECT count(*) + close changed the main DB bytes and removed WAL/SHM files. Observation and reproducible source: /home/paulca/.cache/oficina-home-compatibility-audit/probe/observation.json and readonlyprobe_test.go. The passing observational test disproves a byte-level no-change claim; it does not approve a checker. No repository source or production state changed. The new proposal must resolve a verified read-only opening path, exact manifest digest production, public-key role reporting and schema/key compatibility. No Fable invocation; independent review remains pending.