ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Separate lease-loss release and finalize session terminals

Browse source
This commit is contained in:
ms2k 2026-07-12 01:27:19 +09:00
commit eded0faa7a
2 changed files with 316 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/protocol/Lazaret.cfg
View file

@ -102,3 +102,4 @@ PROPERTIES
PromptEventuallyRestoresTerminal
EmptyDomainEventuallyStops
FailedDomainEventuallyRecovers
LeaseLossUnmountRetainsPreparedLowerLease

64
docs/protocol/Lazaret.tla
View file

@ -919,7 +919,6 @@ UnmountStateAnchor(d) ==
/\ sidecarState[d] = "Stopped"
/\ stateAnchorState[d] = "Mounted"
/\ stateAnchorState' = [stateAnchorState EXCEPT ![d] = "Unmounted"]
/\ preparedLowerLeased' = [preparedLowerLeased EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
domainPhase, sidecarState, sandboxState, trustReady,
lockOwner, published, registered, connected, sessionPhase,
@ -929,6 +928,24 @@ UnmountStateAnchor(d) ==
runtimeCausalEdge, supervisorLease, runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, networkReady, preparedLowerLeased, helperProc
>>
ReleasePreparedLowerLease(d) ==
/\ domainPhase[d] = "Stopping"
/\ HostCoordinatorAlive(d)
/\ stateAnchorState[d] = "Unmounted"
/\ preparedLowerLeased[d]
/\ preparedLowerLeased' = [preparedLowerLeased EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
domainPhase, stateAnchorState, sidecarState, sandboxState, trustReady,
lockOwner, published, registered, connected, sessionPhase,
terminalRoute, connectionState, activeRequest, requestPhase,
approvalSource, approvedCommand, hostRunning, domainLockHeld,
hostCoordinatorProc, runtimeSupervisorProc, attachedRunscProc,
runtimeCausalEdge, supervisorLease, runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, networkReady, helperProc
>>
@ -940,6 +957,7 @@ GracefulSupervisorExit(d) ==
/\ sandboxState[d] = "Stopped"
/\ sidecarState[d] = "Stopped"
/\ stateAnchorState[d] = "Unmounted"
/\ ~preparedLowerLeased[d]
/\ attachedRunscProc[d] = "Absent"
/\ runtimeCausalEdge[d] = "Unarmed"
/\ runtimeSupervisorProc' = [runtimeSupervisorProc EXCEPT ![d] = "Dead"]
@ -963,6 +981,7 @@ FinishTeardown(d) ==
/\ domainPhase[d] = "Stopping"
/\ HostCoordinatorAlive(d)
/\ stateAnchorState[d] = "Unmounted"
/\ ~preparedLowerLeased[d]
/\ sidecarState[d] = "Stopped"
/\ sandboxState[d] = "Stopped"
/\ supervisorLease[d] = "Unarmed"
@ -1266,8 +1285,9 @@ Failure, Host Coordinator lease loss, and recovery
Hard Host Coordinator loss withdraws publication and marks the generation
Failed without itself stopping the sandbox. The surviving Runtime Supervisor
observes supervisorLease = Lost and performs ordered teardown, then exits.
External recovery begins only after the supervisor is no longer present.
observes supervisorLease = Lost, stops runtime use, unmounts the State Anchor,
and exits while retaining the prepared-lower lease. External recovery begins
only after the supervisor is no longer present and releases that lease.
***************************************************************************)
FailDomain(d) ==
@ -1526,7 +1546,6 @@ LeaseTeardownUnmountStateAnchor(d) ==
/\ sidecarState[d] = "Stopped"
/\ stateAnchorState[d] = "Mounted"
/\ stateAnchorState' = [stateAnchorState EXCEPT ![d] = "Unmounted"]
/\ preparedLowerLeased' = [preparedLowerLeased EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
domainPhase, sidecarState, sandboxState, trustReady,
lockOwner, published, registered, connected, sessionPhase,
@ -1535,7 +1554,8 @@ LeaseTeardownUnmountStateAnchor(d) ==
hostCoordinatorProc, runtimeSupervisorProc, attachedRunscProc,
runtimeCausalEdge, supervisorLease, runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId, genSidecarId, genSandboxId, networkReady, helperProc
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, networkReady, preparedLowerLeased, helperProc
>>
LeaseTeardownSupervisorExit(d) ==
@ -1693,7 +1713,6 @@ RecoverStateAnchor(d) ==
/\ sidecarState[d] = "Stopped"
/\ stateAnchorState[d] = "Mounted"
/\ stateAnchorState' = [stateAnchorState EXCEPT ![d] = "Unmounted"]
/\ preparedLowerLeased' = [preparedLowerLeased EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
domainPhase, sidecarState, sandboxState, trustReady,
lockOwner, published, registered, connected, sessionPhase,
@ -1703,6 +1722,29 @@ RecoverStateAnchor(d) ==
runtimeCausalEdge, supervisorLease, runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, networkReady, preparedLowerLeased, helperProc
>>
RecoverPreparedLowerLease(d) ==
/\ domainPhase[d] = "Recovering"
/\ HostCoordinatorAlive(d)
/\ sandboxState[d] = "Stopped"
/\ attachedRunscProc[d] \in {"Absent", "Dead"}
/\ runtimeCausalEdge[d] = "Unarmed"
/\ ~ProcessPresent(runtimeSupervisorProc[d])
/\ sidecarState[d] = "Stopped"
/\ stateAnchorState[d] = "Unmounted"
/\ preparedLowerLeased[d]
/\ preparedLowerLeased' = [preparedLowerLeased EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
domainPhase, stateAnchorState, sidecarState, sandboxState, trustReady,
lockOwner, published, registered, connected, sessionPhase,
terminalRoute, connectionState, activeRequest, requestPhase,
approvalSource, approvedCommand, hostRunning, domainLockHeld,
hostCoordinatorProc, runtimeSupervisorProc, attachedRunscProc,
runtimeCausalEdge, supervisorLease, runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, networkReady, helperProc
>>
@ -1710,6 +1752,7 @@ FinishRecovery(d) ==
/\ domainPhase[d] = "Recovering"
/\ HostCoordinatorAlive(d)
/\ stateAnchorState[d] = "Unmounted"
/\ ~preparedLowerLeased[d]
/\ sidecarState[d] = "Stopped"
/\ sandboxState[d] = "Stopped"
/\ attachedRunscProc[d] \in {"Absent", "Dead"}
@ -1871,6 +1914,7 @@ DomainServiceProgress(d) ==
\/ StopSandbox(d)
\/ StopSidecar(d)
\/ UnmountStateAnchor(d)
\/ ReleasePreparedLowerLease(d)
\/ GracefulSupervisorExit(d)
\/ FinishTeardown(d)
\/ HostCoordinatorTerminateUnresponsiveRuntime(d)
@ -1884,6 +1928,7 @@ DomainServiceProgress(d) ==
\/ RecoverSandbox(d)
\/ RecoverSidecar(d)
\/ RecoverStateAnchor(d)
\/ RecoverPreparedLowerLease(d)
\/ FinishRecovery(d)
RuntimePhysicalInterleaving(d) ==
@ -2255,6 +2300,13 @@ PreparedLowerLeaseBeforeMount ==
/\ preparedLowerLeased[d]
/\ durableIntent[d]["prepared_lower"]
LeaseLossUnmountRetainsPreparedLowerLeaseAction ==
\A d \in Domains :
LeaseTeardownUnmountStateAnchor(d) => preparedLowerLeased'[d]
LeaseLossUnmountRetainsPreparedLowerLease ==
[][LeaseLossUnmountRetainsPreparedLowerLeaseAction]_vars
HelperUnderSupervisor ==
\A d \in Domains :
helperProc[d] = "Alive" =>