Module derive 

Deriving policy facts (I14): from the evaluated generations and the unit definitions, never from a proposal.

Structs

DeriveInput

Constants

CORE_UNITS

Functions

already_failed 🔒

§11 as amended in #22 (owner decision, Nov 2): “A unit that has already failed (observed Failed, or not running while it is desired running, when the facts are derived) contributes no disruption of its own”. Read from s, the observation this derivation is made against, never from an incident or from evidence past its stale_after (status ignores that). Unknown counts as running (§10: “Unknown, never Failed”), so a probe that timed out, errored or was abandoned buys no exemption; so does Degraded, Transitioning, an override, or a unit not desired Running.

changes_desired 🔒

derive

diff

floor_fact

§12e: whether the generation a transition goes to is below the security floor. Planarian’s generation ids grow with time, so “below” is older.

hold_in_place 🔒

§11, §12d: whether u’s traffic is held now, in the observation s (lane-daemon’s ledger holds, reconciled with /run/planarian/hold/). §11 waives the RestartUnit row’s escalations because “its traffic is held”, so the waiver reads the hold itself, not the footprint that leads to it: §12d fails closed toward applying a hold, and with this a missing or stale footprint buys a waiver only once traffic is in fact blocked. SystemState.holds: the journal’s holds and the host’s, their union.

manifest_of

option_diff

The options two evaluated generations set differently (§11, §16).

removed_units 🔒

What a generation transition takes away (§11 Rollback row, §16): units present now and absent from the target, and units its activation stops, sorted, with their sensitivity. A removed user template’s definition is in the base manifest, not in defs (which holds the per-session instances), so it is looked up there: an unknown unit must not count as Routine (§11 sensitivity completeness, fail closed).

session_facts

§11 session facts, from logind’s sessions: which sessions the disruption lands on (sorted), and whether a system-scope session or connectivity loss reaches a session of another uid than the caller’s. A user unit lands on its own session, or every session of its uid; a disruptive system unit on every session.

stop_fact

§11: whether a RestartUnit restores a unit stopped outside Planarian and not attributed: stopped by systemctl stop or a termination signal (not a crash), under no override, and desired Running now. From systemd’s state, never from the proposal (I14).

touches_canonical 🔒

A generation tried to define a canonical probe differently from the core package, or dropped one from a unit that is still present (I10).

touches_manifest 🔒

C19 (§9, §11 ApplyChange row): whether the candidate’s manifest differs from the base’s in any part of any entry (desired, edges, sensitivity, restart_disruption, the user probes, synonyms, and the exported systemd_restart, startup_grace, runtime_repair, stops_are_faults), in user-scope entries as in system ones, or adds or removes an entry. Canonical probes are left out: they come from the core package, and redefining one is touches_canonical. So are the fields the module derives (holds; crate::host::declared).

unexplained

Whether the candidate differs from the running generation in ways a catalog change’s override cannot explain: services declared or removed (other than the one a service-enable names), flake inputs, or a package with known vulnerabilities that the running generation does not have.

unit_facts 🔒