Module hold 

§12d Network security fails closed, the daemon’s half (#35 part 1).

A network-security unit (interim, B-21: the module’s exported holds) that has failed has its traffic held. systemd’s OnFailure= holds it on a crash or kill; the daemon holds it for a stop outside Planarian that is not attributed, and journals either one (HoldApplied, before its own call). The daemon lifts the hold once the unit is Running and every Readiness probe passes (HoldLifted, before the call). If repair fails, the hold stays and administrators are notified. planarian hold release is an attested Override on the hold unit, through the executor like any override, so a non-administrator’s release asks an administrator.

The hold is a failure posture response, not a transaction (docs/bypasses.md).

Functions

alarm

The alarm when a held unit goes down (§12d, §11), word for word.

back

Back: Running, and every Readiness probe has fresh passing evidence. A unit with no Readiness probe is back when it is Running.

failed

It has failed in §12d’s sense: observed failed, or not running while it is desired running. A stop through an attested override is not a failure (the override makes it not expected).

held_by

The held unit a hold unit stands for, if u is one.

hold_def

The hold unit’s definition: known, so an override on it derives the held unit’s sensitivity (§11: releasing a hold that protects a Security unit needs an administrator), but never expected, so it is never watched, repaired or counted as an incident.

hold_unit

The systemd unit that holds unit’s traffic (lane-nix’s planarian-hold@<unit>.service; the instance is the unit’s name).

network_security

The units whose failure holds traffic (interim: the exported holds).

release_until

--until as the release marker takes it: None is the next boot. A release is never forever (§12d), so an explicit, unbounded one ends at the next boot too.