mosaicstack/stack
1
0
Fork 0
Code Issues 85 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

wake/installer: framework-ship the canon-side fallback wake (systemd timer + per-class bound in watch-list schema, installed by A10) — F7 replacement-before-retirement out of the box #925

New Issue
Closed
opened 2026-07-26 08:59:02 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-07-26 08:59:02 +00:00
Owner
Copy Link

Non-blocking A-lane follow-up from the §4 vector PASS + retirement GO (dragon-lin). Normal cadence with the residual set (#913/#917/#923/#924).

Gap. The §5 retirement precondition is F7 — replacement-before-retirement: a canon-side FALLBACK WAKE must be live and proven-firing BEFORE the legacy mosaic-heartbeat@ timer is reaped, so there is never a coverage gap. In the dragon-lin pilot this fallback wake was operator-wired by hand. The framework should SHIP it so future hosts get F7 out of the box rather than hand-wiring it per host.

Scope (framework-shipped canon-side fallback wake):

  1. A framework systemd timer unit (e.g. framework/systemd/user/mosaic-wake-fallback.{timer,service}) — a low-frequency safety wake that fires the canon drain on a per-class cadence bound, independent of the event-driven detector, so a stalled detector/daemon can never silently starve delivery.
  2. A per-class fallback-cadence bound field in the watch-list schema (defaults/wake-watch-list.schema.json) — declarative, schema-versioned (mind Gate B range), so the bound is config not code.
  3. A10 installer installs + wires it (component-manifest, path-ownership stays framework-manifest SSOT / Gate A). The existing A10 blank-reset idiom applies to the fallback timer's cadence drop-in (exactly one OnUnitActiveUSec), and the §5 retire-order still holds: fallback-wake proven-firing → THEN reap legacy.
  4. Install-validate: A10 confirms the fallback timer is enabled + has fired at least once (or is schedulable) before it will permit the legacy reap — encoding the F7 precondition into the installer rather than operator memory.

Red-first: fallback timer fires the drain on its bound cadence; a stalled detector still gets delivery via the fallback (no starvation); the reap step refuses unless the fallback wake is proven live (F7 precondition enforced); blank-reset gives exactly one effective cadence. Refs: #892, #911 (A10 installer + blank-reset + mosaic-wake.service), §5 rollout F7, dragon-lin vector PASS.

Non-blocking A-lane follow-up from the §4 vector PASS + retirement GO (dragon-lin). Normal cadence with the residual set (#913/#917/#923/#924). **Gap.** The §5 retirement precondition is F7 — replacement-before-retirement: a canon-side FALLBACK WAKE must be live and proven-firing BEFORE the legacy `mosaic-heartbeat@` timer is reaped, so there is never a coverage gap. In the dragon-lin pilot this fallback wake was **operator-wired by hand**. The framework should SHIP it so future hosts get F7 out of the box rather than hand-wiring it per host. **Scope (framework-shipped canon-side fallback wake):** 1. A framework **systemd timer unit** (e.g. `framework/systemd/user/mosaic-wake-fallback.{timer,service}`) — a low-frequency safety wake that fires the canon drain on a per-class cadence bound, independent of the event-driven detector, so a stalled detector/daemon can never silently starve delivery. 2. A **per-class fallback-cadence bound** field in the **watch-list schema** (`defaults/wake-watch-list.schema.json`) — declarative, schema-versioned (mind Gate B range), so the bound is config not code. 3. **A10 installer** installs + wires it (component-manifest, path-ownership stays framework-manifest SSOT / Gate A). The existing A10 blank-reset idiom applies to the fallback timer's cadence drop-in (exactly one `OnUnitActiveUSec`), and the §5 retire-order still holds: fallback-wake proven-firing → THEN reap legacy. 4. Install-validate: A10 confirms the fallback timer is enabled + has fired at least once (or is schedulable) before it will permit the legacy reap — encoding the F7 precondition into the installer rather than operator memory. **Red-first:** fallback timer fires the drain on its bound cadence; a stalled detector still gets delivery via the fallback (no starvation); the reap step refuses unless the fallback wake is proven live (F7 precondition enforced); blank-reset gives exactly one effective cadence. Refs: #892, #911 (A10 installer + blank-reset + mosaic-wake.service), §5 rollout F7, dragon-lin vector PASS.
Mos closed this issue 2026-07-26 13:44:52 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#925
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?