Module hold 

§12d Network security fails closed: the hold, as lane-nix’s planarian-hold@<unit>.service (nix/posture.nix) builds it. This module only starts and stops that unit, reads which holds are in place, and writes the release marker the hold script honours:

• apply: systemctl start planarian-hold@<unit>.service (idempotent; systemd’s OnFailure= starts the same unit on a crash or kill);
• lift: systemctl stop of it;
• reapply: systemctl reload of it (ExecReload: rebuild the table, never lift);
• state: /run/planarian/hold/<unit> exists while a hold is in place;
• release: /run/planarian/hold-released/<unit> holds boot (until the next boot), or <unix> <boottime>: the expiry in Unix seconds and the same deadline in CLOCK_BOOTTIME seconds. The script takes whichever passes first, so a stepped wall clock cannot lengthen a release; an unparsable or past one is expired (the script holds).

<unit> is the systemd unit name without .service. A failure posture response, not a transition (docs/bypasses.md): no Prepared, no lease, no op tag. It only ever restricts traffic, except lift, which the daemon calls only once the unit is Running and its Readiness probes pass, or on an attested release.

Constants

HOLD_DIR

RELEASED_DIR

TIMEOUT 🔒

Functions

apply

Start the unit’s hold, waiting at most wait (and never past TIMEOUT). Past it the systemctl client is killed and the result is Unknown; systemd’s start job is the manager’s, not the client’s, and goes on, so the hold may still land.

boottime_s 🔒

end_release_in

held_in

The units held now, from the hold script’s state directory. A directory that cannot be read (other than absent: no hold was ever applied) is an error, never “none” (rule 21).

hold_unit 🔒

instance

The hold’s instance name: the unit’s systemd name without .service.

lift

marker

The marker’s content: boot, or the expiry in Unix seconds and the same deadline on the boot clock, boottime_now + (until - wall_now), both truncated to seconds. A deadline already past saturates to boottime_now or below: expired.

marker_path 🔒

outcome 🔒

reapply

Rebuild the hold’s table in place (ExecReload runs the script’s reapply). A reload never lifts the hold, where a restart would run ExecStop (lift) first and let traffic through for a moment.

reapply_with 🔒

release_in

Write the release marker, then lift the hold. The marker comes first so that a failure racing the lift does not re-apply the hold.

table_present

The hold script’s table (table inet planarian-hold).

wall_now 🔒