diff options
| author | tv <tv@krebsco.de> | 2026-11-08 18:20:13 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 19:29:15 +0100 |
| commit | ff9e7c244c270853a8a8f58ee950859866358e1d (patch) | |
| tree | 78070114c1bc0d48814d1ef260d1c8c7a70a92c0 /docs | |
| parent | 96ba15cf1a6f8725f70f429695a5a9661f706eb0 (diff) | |
remake: aborts written as the user who asks; no abort by time
Review 2, N3: 1150 let any member write an abort decision once a remake
had expired a grace period ago, judged by the change's own time, the
writer's word. A member could race the coordinator's legitimate commit
with an abort dated as it liked; both taken, Automerge shows
one, and nodes that acted on the commit split from those that didn't.
The two writers of such aborts are operator requests whose endpoints
already need write on _continuum/remakes: aborting an expired remake
(DELETE /admin/remakes/{id}) and superseding one (POST
/admin/remakes?force=supersede). Both now commit as the user who asks
(the proposal and its vote with them, for a supersede), which the rules
take as one who may write the decision. The clause judging an abort by
its time goes, and with it the time the rules carried. An expired
remake is still aborted through any member, by an operator.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 11 | ||||
| -rw-r--r-- | docs/remakes.md | 5 |
2 files changed, 8 insertions, 8 deletions
diff --git a/docs/access.md b/docs/access.md index d7e05ab..4400b91 100644 --- a/docs/access.md +++ b/docs/access.md @@ -245,12 +245,11 @@ stays as it is, wherever it comes from later (a joining node catching up, say). change only (the genesis change, a remake's snapshot). * A remake's record and its proposal by whichever member proposes, where there are none; its decision by the coordinator its proposal names, or a user who may write - there; an abort by any member once the remake expired a grace period ago, by the - time the change says it was made (its writer's word: a member could abort a remake - early, never commit one); an abort asked for by any member, which the coordinator - applies. The record of the remake that made an epoch, carried into it whole, by the - coordinator its snapshot names, where there is none. Replacing or removing a record or its proposal, by a user who may write - there. + there (an operator aborting an expired remake through any member, `DELETE + /admin/remakes/{id}`, or superseding it); an abort asked for by any member, which the + coordinator applies. The record of the remake that made an epoch, carried into it + whole, by the coordinator its snapshot names, where there is none. Replacing or + removing a record or its proposal, by a user who may write there. * What holds the members' entries, votes and remake records (`_continuum/members`, `_continuum/votes`, `_continuum/remakes`) made by whichever member first writes in it, where there is none; replaced or removed by a user who may write there only. diff --git a/docs/remakes.md b/docs/remakes.md index fc938c7..ab808e5 100644 --- a/docs/remakes.md +++ b/docs/remakes.md @@ -255,8 +255,9 @@ aborts it itself, under three conditions that keep it from crossing a late commi Clocks): whether the remake expired is judged by it, and a node ahead would abort a remake its coordinator may still commit. Otherwise `409`, unless `?force=clock`. -With a policy ([`access.md`](access.md)), the other nodes take that abort by the time -it says it was written: a grace period after the expiry at least. +The abort is written as the user who asks, who may write remakes: with a policy +([`access.md`](access.md)), the other nodes take a decision from the coordinator or +from such a user only. A member that saw a remake expire before it voted for it says so in its log, once (`Didn't vote for a remake`, warn if its clock is off: it then misses remakes others |