§24. Changes from v4.1

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

• §12: takeover requires confirmed quiescence (jobs cancelled and gone, workers reaped); a drain timeout ends in RecoveryFailed, never in proceeding; lease transfer is atomic via flock plus rename; the watchdog triggers on Published/Promoted too and, from Checking, completes the whole authorized commit path or reverts.
• §8/§12: per-transition Handler and RecoveryStrategy independent of tier; Rollback is a generation operation even at Runtime tier; BindDriver is a device operation with UnbindDevice recovery; the crash-recovery table branches on strategy.
• §9/§12b: transaction-specific base.nix with content-hash identities; promotion and restoration idempotent by hash comparison; no shared .prev; GC root created at Built and kept through approval; dirty-Git staging defined by Nix-visible bytes.
• §12c: length-prefixed CRC’d records with torn-tail handling; checkpoint-then-truncate compaction preserving all live state; filesystem contract for ext4/XFS/btrfs/ZFS with a sentinel fallback.
• §8/§10: SideEffects::Measurement permits bounded network/local I/O for Readiness probes; RemoteStateChange stays Diagnostic; external dependencies are units with edges.