docs(deckle-01): editor instances live and die with the control plane #499

Merged

dominik.polakovics merged 1 commit from afk/470 into main

2026-10-18 17:30:10 +02:00

dominik.polakovics commented

2026-10-18 17:21:45 +02:00

Owner

Closes #470

Changes

Unit comments (hosts/deckle-01/modules/deckle-hosted/default.nix):
- The podman comment now matches the cgroup layout seen on deckle-01. The containers run in the user manager's libpod-*.scope, while conmon stays in the system unit.
- The Delegate = true comment no longer claims the instance limits need it. It is now marked unverified for podman build. The setting is unchanged.
Pinned stop settings: KillMode = "control-group" and TimeoutStopSec = "90s" are now set explicitly. Both match the defaults the unit already had (systemctl show on deckle-01: KillMode=control-group, TimeoutStopUSec=1min 30s), so nothing changes at runtime.
- Why explicit: deckle-hosted's shutdownTimeout (45 s) plus its 10 s HTTP drain is sized against this 90 s. Its README names this unit as running with exactly these values. Pinning them keeps the bound from depending on the system-wide default.
ADR-0032:
- Decision 3 no longer says Delegate is what makes the resource limits apply.
- A new consequence records that editor instances live and die with the control plane, and why:
  - survival never held under the system unit (the race between systemd's final SIGTERM and conmon's --rm cleanup);
  - every deploy so far changed the harness hash anyway;
  - systemd-run --user --scope would add a second lifecycle authority.

The optional follow-up (why podman 5.8.8 creates no libpod-conmon-*.scope) is not addressed.

Verification

The dry-build of deckle-01 passes (scripts/test-configuration deckle-01).
deckle-hosted#123 is already deployed on deckle-01. The journal shows startup: reconciled leftover instance containers after the 16:56 start. The 16:39 stop logged shutdown: stopped editor instances before shutdown complete, with 0 instances open at the time.
Not done: the issue's full check. That means restarting with an editor open, then running podman ps -a --filter label=deckle-hosted.role=instance as deckle. It needs a production restart, and the Diag account cannot run podman as deckle, so it is left for a human.

Note

The worktree's pre-commit hook did not fire. In a lab worktree the hooks path is the bare repo's hooks/ directory, so the relative symlink ../../scripts/pre-commit points at a file that does not exist. The dry-build above was run by hand instead.

🤖 Generated with Claude Code

Closes #470 ## Changes - **Unit comments** (`hosts/deckle-01/modules/deckle-hosted/default.nix`): - The podman comment now matches the cgroup layout seen on deckle-01. The containers run in the user manager's `libpod-*.scope`, while conmon stays in the system unit. - The `Delegate = true` comment no longer claims the instance limits need it. It is now marked unverified for `podman build`. The setting is unchanged. - **Pinned stop settings**: `KillMode = "control-group"` and `TimeoutStopSec = "90s"` are now set explicitly. Both match the defaults the unit already had (`systemctl show` on deckle-01: `KillMode=control-group`, `TimeoutStopUSec=1min 30s`), so nothing changes at runtime. - Why explicit: deckle-hosted's `shutdownTimeout` (45 s) plus its 10 s HTTP drain is sized against this 90 s. Its README names this unit as running with exactly these values. Pinning them keeps the bound from depending on the system-wide default. - **ADR-0032**: - Decision 3 no longer says `Delegate` is what makes the resource limits apply. - A new consequence records that editor instances live and die with the control plane, and why: - survival never held under the system unit (the race between systemd's final SIGTERM and conmon's `--rm` cleanup); - every deploy so far changed the harness hash anyway; - `systemd-run --user --scope` would add a second lifecycle authority. The optional follow-up (why podman 5.8.8 creates no `libpod-conmon-*.scope`) is not addressed. ## Verification - The dry-build of `deckle-01` passes (`scripts/test-configuration deckle-01`). - deckle-hosted#123 is already deployed on deckle-01. The journal shows `startup: reconciled leftover instance containers` after the 16:56 start. The 16:39 stop logged `shutdown: stopped editor instances` before `shutdown complete`, with 0 instances open at the time. - **Not done:** the issue's full check. That means restarting with an editor open, then running `podman ps -a --filter label=deckle-hosted.role=instance` as `deckle`. It needs a production restart, and the Diag account cannot run podman as `deckle`, so it is left for a human. ## Note The worktree's pre-commit hook did not fire. In a lab worktree the hooks path is the bare repo's `hooks/` directory, so the relative symlink `../../scripts/pre-commit` points at a file that does not exist. The dry-build above was run by hand instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-10-18 17:21:45 +02:00

docs(deckle-01): editor instances live and die with the control plane 4a76a19aef

Correct the unit comments to the observed cgroup layout, pin KillMode and
TimeoutStopSec that deckle-hosted's shutdown bound relies on, mark the
Delegate rationale unverified, and record the lifecycle in ADR-0032.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

dominik.polakovics commented

2026-10-18 17:24:25 +02:00

Author

Owner

[autoland] verdict: pass

This was generated by AI while landing a PR.

Validated: CONCERNS (non-blocking).

Checks: no CI check covers this repo (labctl pr checks = none), and the author notes the pre-commit hook did not fire in the lab worktree. I re-ran the gate myself: scripts/test-configuration deckle-01 on 4a76a19a passed.
Conventions: the title follows Conventional Commits and the body has Closes #470. The diff touches only the deckle-hosted module and ADR-0032, as the issue asks.
Correctness: KillMode=control-group and TimeoutStopSec=90s match the unit's existing defaults, so runtime is unchanged. They agree with deckle-hosted: shutdownTimeout = 45s in instances/manager.go, the 10 s HTTP drain, and the README naming this unit with exactly these values. The module comments are short and point to the ADR.

CONCERN (non-blocking): the issue's own Verification step has not been run. That step is: restart the unit with an editor open, then check that podman ps -a --filter label=deckle-hosted.role=instance as deckle returns nothing. Merging auto-closes #470 while this check is still open, so a human should run it on deckle-01.

[autoland] verdict: pass > *This was generated by AI while landing a PR.* Validated: CONCERNS (non-blocking). - Checks: no CI check covers this repo (`labctl pr checks` = none), and the author notes the pre-commit hook did not fire in the lab worktree. I re-ran the gate myself: `scripts/test-configuration deckle-01` on 4a76a19a passed. - Conventions: the title follows Conventional Commits and the body has `Closes #470`. The diff touches only the deckle-hosted module and ADR-0032, as the issue asks. - Correctness: `KillMode=control-group` and `TimeoutStopSec=90s` match the unit's existing defaults, so runtime is unchanged. They agree with deckle-hosted: `shutdownTimeout = 45s` in `instances/manager.go`, the 10 s HTTP drain, and the README naming this unit with exactly these values. The module comments are short and point to the ADR. CONCERN (non-blocking): the issue's own Verification step has not been run. That step is: restart the unit with an editor open, then check that `podman ps -a --filter label=deckle-hosted.role=instance` as `deckle` returns nothing. Merging auto-closes #470 while this check is still open, so a human should run it on deckle-01.

dominik.polakovics merged commit a9a25d663d into main

2026-10-18 17:30:10 +02:00

dominik.polakovics referenced this pull request from a commit

2026-10-18 17:30:10 +02:00

Merge pull request 'docs(deckle-01): editor instances live and die with the control plane' (#499) from afk/470 into main