2.4 KiB
Organization archive and restore
Archive and restore add the archived registry state and increment the
revision. Archive takes the existing lifecycle lock, verifies the revision,
stops and verifies the bus through the caller-injected stop function, then
checks the revision again before changing state. The registry lock is not held
while stopping the bus. A concurrent update during the stop causes a revision
conflict and leaves the organization active, although its bus has stopped.
Restore uses the same lifecycle lock, changes the state back to active and does
not start the bus. Files remain in place; delete remains available.
The lifecycle log is append-only and private. Its line is appended under the registry lock immediately before registry publication. A crash or a failed registry publication in that narrow interval can leave a log line for an operation whose state change was not published; reconciliation or a durable transaction journal is a follow-up. A failed or uncertain stop never records a completed archive.
Archived organizations remain available to the owner-only administration
routes, but ordinary organization resolution rejects them with org-archived.
The UI shares delete's reply verification, organization refresh and current-org
switch logic. Archived documents are read-only, setup controls are hidden with
an explanatory notice, and restore does not start the bus. Screenshots are
untracked under shots/.
The service, CLI, route and browser regressions and the requested existing checks passed in clean scratch homes. The full business suite passed. An additional routing check first caught a too-broad admin-hook exemption; it was narrowed to the built-in handler and the web checks passed again.
Review fix: lifecycle fences
The internal host now takes the organization lifecycle lock before checking registry state and holds it through host readiness. The parent takes a short separate lock around its own host-directory preparation, then releases it before spawning the child, avoiding a parent/child deadlock. If archive wins between those two lock acquisitions, the child rechecks state and refuses; a competing start or archive may therefore need a retry. Queue and project setup hold the same lock through their receipt publication. A FIFO lifecycle log is opened nonblocking and refused; the regular-file ownership and mode checks remain. The log-before-registry publication crash interval remains the follow-up above.