Pull request #59 · stacks/drone

Summary

Add explicit continuation after an unresolved metadata attempt, such as a signature rejection followed by a corrected repository. updates:maintain requires the exact active attempt, independently retained pins, a trusted current clock and unresolved-input acknowledgement. It retains the original phase/inputs and every committed security floor, then requires full fresh signed verification.

unresolved attempt A
  -> atomic format-4 handoff + pending successor B
  -> fresh signed verification from committed trust and floors
  -> verified B, with unresolved A still retained

A rejected or interrupted successor keeps normal operations blocked. Historical recovery addresses only the active successor. Public status retains the handoff chain and input digests/counts. Formats 1/2/3 migrate atomically; previous known-good files and slot roles are preserved. Native Buddy and the compiled CLI share the coordinator. Builds on #58. Refs #42 and #9.

Evidence

RED: the new public maintenance export was absent. This establishes feature absence, not an existing production regression.
158 adjacent tests pass, one Linux-only skip, 1,220 assertions across 22 files at the final production code. The additional format-2 migration case then passes on minimum Bun 1.4.2; all three maintenance policy cases have 49 assertions.
Actual three-boundary SIGKILL campaign verifies competing writers, retained predecessors, fresh-process successor recovery, a journaled valid root advancing during recovery, and later fresh verification/reservation. Rejected successors preserve floors and require another explicit action.
Actual host sessions verify known-good preservation and fresh format-4 boot/session health. Copied minimum-Bun executable outside the checkout passes 10 operations, including acknowledgement rejection, maintenance, fresh trial and fresh-policy rollback. Retained format-3 executable rejects format 4 with both database hashes unchanged.
Pickier, application/runtime/test types, docs, roadmap and parity pass. Rendered docs: 90 pages, 6,556 local links and 90 assets without missing targets. Separate independent Spec and Standards reviews found no actionable defects. Remaining coverage limits include handoff corruption/exhaustion, in-commit storage faults and Linux older-reader qualification; actual older-reader rejection is qualified separately on Mac.
Exact-head CI 39737879757 passed all five jobs, including the full Linux Buddy suite (1,498 pass, 0 fail), actual process cuts in both early and full-suite campaigns, copied CLI, both browsers, firmware and namespace qualification. Downloaded cut/CLI archives were independently read back, including stored input/metadata hashes and distinct actual boot IDs. The Mac full Buddy run stopped without a terminal receipt after lifetime failures and later explicit ENOSPC errors; it is not a full pass. Both unchanged focused lifetime cases subsequently pass at their original guards. The unresolved failure is tracked in 60. The separate main run for parent 6d3a9ad failed the known nominal-completion browser symptom in #44; its other four jobs passed. Original logs/artifacts and unresolved cause are retained.

Merge Danger

Door: two-way for code; format 4 requires a compatible reader. Older readers refuse the upgraded store, and supported operations preserve its history rather than downgrading it.

Blast Radius: update metadata protocol. This adds no root replacement, clock-floor decrease, corrupt-history repair, image selection from caller receipts or physical endpoint. Lost-root/clock repair, remaining storage faults and board image/install/boot/power-loss/anti-rollback qualification remain open. Issue #42 stays open and physical deployment remains disabled.