agcoord 0.7.2__tar.gz → 0.7.3__tar.gz

{agcoord-0.7.2 → agcoord-0.7.3}/CHANGELOG.md

@@ -5,6 +5,16 @@ versioning; dates use ISO 8601.
 
 ## Unreleased
 
+## 0.7.3 — 2026-10-02
+
+- Recover a normal drain stranded behind a dead or unstartable managed broker without losing
+  accepted work or maintenance intent. Host repair preserves the original drain ID and
+  metadata, keeps submissions continuously guarded, and restores the drain after the bound
+  replacement-host proof. Accepted queued jobs finish normally; new submissions remain blocked
+  until explicit resume with the original drain ID after maintenance. Completion retries retain
+  that restoration result and audit instead of always opening the spool; malformed metadata
+  and live or ambiguous workers refuse, and proof attempts are never reset (#244).
+
 ## 0.7.2 — 2026-10-01
 
 - Add `agc host recover PACKAGE` and `agc host recover --download` for a dead managed owner

{agcoord-0.7.2 → agcoord-0.7.3}/Cargo.lock

@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "agcoord-broker"
-version = "0.7.2"
+version = "0.7.3"
 dependencies = [
  "libc",
  "rusqlite",

{agcoord-0.7.2 → agcoord-0.7.3}/Cargo.toml

@@ -3,7 +3,7 @@ members = ["native/agcoord-broker"]
 resolver = "2"
 
 [workspace.package]
-version = "0.7.2"
+version = "0.7.3"
 edition = "2024"
 rust-version = "1.94.1"
 license = "MIT"

{agcoord-0.7.2 → agcoord-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agcoord
-Version: 0.7.2
+Version: 0.7.3
 Summary: Local CI and merge queue for coding agents that share one machine
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/xu-hao/agcoord

{agcoord-0.7.2 → agcoord-0.7.3}/conformance/manifest-v3.json

@@ -385,7 +385,10 @@
           "host_recovery::a_successful_unenforced_proof_cannot_complete_or_resume_recovery",
           "host_recovery::mismatched_recovery_identity_and_changed_helper_preserve_the_guard",
           "host_recovery::failed_proofs_retry_with_the_same_identity_and_park_at_the_attempt_bound",
-          "host_recovery::parking_cancels_only_the_active_proof_and_allows_a_bounded_retry"
+          "host_recovery::parking_cancels_only_the_active_proof_and_allows_a_bounded_retry",
+          "host_recovery::stranded_normal_drain_can_enter_recovery_without_releasing_accepted_work",
+          "host_recovery::verified_recovery_restores_original_drain_and_replays_without_an_owner",
+          "host_recovery::malformed_original_drain_cannot_be_read_or_reused_as_a_recovery_guard"
         ]
       }
     }

{agcoord-0.7.2 → agcoord-0.7.3}/docs/coordinator.md

@@ -99,6 +99,20 @@ in one transaction and returns the spool to `open`; a wrong or stale identifier
 submissions. Migration and rollback preserve the current marker across the protocol boundary
 and never resurrect a marker already removed by a successful resume.
 
+A normal drain stranded behind a dead or unstartable managed owner may be repaired through
+[guarded managed host recovery](native_host.md#guarded-recovery-when-the-outgoing-broker-cannot-drain).
+The original drain ID, state, reason, and start time remain durable maintenance
+intent. Submission guards stay continuous while the temporary recovery guard admits only its
+bound host proof. After verification, recovery atomically restores the original drain;
+accepted queued work finishes normally, and the owner yields after the last accepted row
+becomes terminal. New submissions remain refused until explicit `resume` with the exact
+original drain ID after the intended maintenance succeeds. Repair and proof do not authorize that resume.
+Recovery completion and its retry receipt retain the original drain audit rather than always
+reporting `open`. Invalid maintenance metadata or live/ambiguous worker identities refuse;
+retries never reset proof attempts. Repeating a stranded drain alone cannot make an
+unstartable broker progress, and raw spool edits or cancellation of accepted work are not a
+repair path.
+
 ## Repository lanes and resources
 
 Each submission belongs to a stable repository lane and records its resolved worktree. A

{agcoord-0.7.2 → agcoord-0.7.3}/docs/native_broker.md

@@ -251,6 +251,17 @@ start only while the marker is `draining` and live rows remain; it adopts or saf
 those rows and completes the handoff. A `drained` marker prevents activity writes and ordinary
 autostart until exact-ID `resume` holds the owner lock and removes every guard.
 
+Guarded managed-host recovery may temporarily suspend a stranded normal drain's accepted-job
+admission to verify a pinned replacement, without relaxing its submission guards. It retains
+the original drain ID, state, reason, and start time in its durable recovery audit.
+Successful host proof restores that drain atomically instead of opening submissions: accepted
+queued rows finish normally and the owner yields when the drain completes. Only explicit
+`resume` with the exact original drain ID after maintenance reopens submissions. Completion retries preserve
+the same restoration result and never reset proof attempts or perform an implicit resume.
+Malformed maintenance metadata and live or ambiguous worker identities refuse repair. The
+[host recovery contract](native_host.md#guarded-recovery-when-the-outgoing-broker-cannot-drain)
+defines the verification-only admission, bounded failure, and parking rules.
+
 ### Implemented worker boundary
 
 The native owner now forks its launcher path directly without an internal command-line mode.

{agcoord-0.7.2 → agcoord-0.7.3}/docs/native_host.md

@@ -410,6 +410,12 @@ recovery refuses a live owner, live or ambiguous recorded workers, unavailable i
 evidence, and an invalid package. It never substitutes a forced activation or deletion of the
 spool. Normal `agc host upgrade` and its drain flow remain unchanged.
 
+An existing normal drain is maintenance intent, not permission to reopen submissions. Recovery
+preserves its original drain ID, state, reason, and start time as durable audit
+metadata within the shared protocol-5 recovery contract. Its submission guards remain continuous
+while the recovery guard temporarily blocks ordinary accepted-job admission for host verification. Malformed original maintenance metadata
+refuses recovery; neither a retry nor repair may replace its identity or reset proof attempts.
+
 The command stages the verified replacement and stops the failed service. The staged native
 holder takes the exclusive owner/maintenance lock, proves every recorded worker identity is
 gone, and establishes a durable `recovery-` ID followed by 12 hexadecimal digits. It holds the
@@ -422,8 +428,15 @@ The durable guard blocks new submissions and ordinary queued-job admission throu
 and restart. Recovery admits only the exact bound enforcement helper, with `cpu=1` and
 `jobs=1`, while ordinary work stays blocked. Completion requires that proof to pass with exit
 status zero, a receipt with requested and applied CPU both 1 and observed peak CPU at least 1,
-the unchanged helper digest, and no running rows. Only successful completion clears the guard.
-A process exit, service restart, normal `agc drain`, or `agc resume` cannot clear it.
+the unchanged helper digest, and no running rows. Only successful completion ends the
+verification-only guard. If no normal drain existed, completion returns the spool to `open`.
+If recovery inherited a normal drain, completion atomically restores that original drain and
+its submission guards. Accepted queued jobs then finish through their normal state machines;
+proven-dead running rows remain interrupted. The owner reaches `drained` and yields when no
+accepted work remains. New submissions stay blocked until explicit `agc resume` with the exact
+original drain ID after the intended maintenance succeeds. Host proof never performs that
+resume. A process exit, service restart, normal `agc drain`, or `agc resume` cannot clear an
+active recovery guard.
 
 If the verified replacement is already running under the same active recovery guard, rerunning
 `agc host recover` continues that guard instead of stopping or reactivating the service. The
@@ -432,7 +445,8 @@ a mismatched guard still refuses. Continuation reuses a queued, running, or pass
 that recovery is verifying; it does not submit a duplicate or spend another proof attempt.
 
 The native hold, status, proof, completion, and park operations retain the exact recovery ID,
-replacement identity, helper path and digest, proof job ID, attempt count, phase, and incident.
+replacement identity, helper path and digest, proof job ID, attempt count, phase, incident,
+and any original drain metadata. The completed recovery audit retains that original drain.
 Each host phase and enforcement proof is bounded to 120 seconds; owner acquisition and dead-row
 settlement waits are each bounded to 30 seconds. At most three proof attempts are allowed
 across retries. Retrying must use the same exact verified replacement package and helper path;
@@ -447,9 +461,23 @@ recovery ID and address the reported incident before retrying the same package.
 
 Completion retries up to three times with the exact recovery ID. If completion committed but
 its reply was lost, the native operation validates the retained completed identity and passed
-CPU proof, then returns the same open receipt without another proof or recovery operation.
-If completion still cannot be confirmed, the error says to inspect the durable receipt; it
-does not claim the guard remains when completion may already have cleared it.
+CPU proof, then returns the same completion receipt without another proof or recovery
+operation. The completion receipt carries `state`, `recovery_id`, `proof_run_id`, and `drain_id`.
+Without an inherited drain, its state is `open` and `drain_id` is null. With an inherited drain,
+it retains that original ID and reports `draining` if accepted work remains, or `drained` if
+none remains. Completion retries return that recorded result and never implicitly resume it.
+The public host result reports service `verified` for a retained drain, since the broker may
+finish the accepted work and yield before the command returns; `active` applies to recovery
+that opens the spool.
+If completion still cannot be confirmed, inspect the durable recovery and original drain
+receipts. Do not assume submissions reopened or that the verification-only guard remains.
+
+A stranded drain has an original marker plus accepted queued or running rows, while the
+outgoing broker is dead or cannot start. Repeating the normal drain returns the same marker
+but cannot make those rows progress. Earlier recovery refused this state with `normal
+maintenance is active; recovery cannot replace its identity`. Use the verified recovery path
+above; retain both IDs and the original maintenance metadata. Raw database edits, premature
+resume, or cancelling accepted work are not repair workarounds.
 
 ### Normal restart and rollback
 

{agcoord-0.7.2 → agcoord-0.7.3}/docs/releasing.md

@@ -160,6 +160,9 @@ interface and must be smoke-tested from the built wheel.
    [guarded managed recovery path](native_host.md#guarded-recovery-when-the-outgoing-broker-cannot-drain)
    with the exact pinned replacement. Retain its recovery ID and proof receipt; ordinary work
    stays blocked until verified completion, and normal drain/resume cannot clear that guard.
+   If recovery inherited a normal drain, completion restores its original ID and metadata;
+   accepted work finishes under that drain while new submissions remain blocked. Retain both
+   receipts and resume the exact original drain only after its intended maintenance succeeds.
    Keep `kernel.apparmor_restrict_unprivileged_userns=1`, start the ordinary unprivileged managed
    service, and retain the shipped `cpu=1` receipt proving its AppArmor transition, cgroup
    namespace root, exact CPU control, and durable applied/peak evidence. A spool left below

{agcoord-0.7.2 → agcoord-0.7.3}/docs/troubleshooting.md

@@ -70,7 +70,9 @@ These arrive as a failed row. `failure_reason` is stable; the log has the detail
 | --- | --- | --- |
 | `agc drain --reason …` | Installs a durable guard, waits for admitted work, then the owner yields. The receipt's `drain_id` is the only key that reopens the spool. | Save the ID. `--no-wait` returns after installing the guard. Repeating `drain` returns the original receipt. |
 | `agc resume <id>` refused with `broker-drain-id-mismatch` or `broker-drain-id-invalid` | Not the exact `drain-…` identifier the drain printed. | Use the receipt's ID; `agc list` prints it in its header while drained. |
-| `broker-drain-live-work` | Resume was asked while rows are still queued or running. | Wait for the rows to end, or cancel them. |
+| `broker-drain-live-work` | Resume was asked while rows are still queued or running. | Let accepted work finish. If the outgoing broker cannot start, use guarded host recovery preserving the original drain; cancelling accepted work is not a repair workaround. |
+| Normal drain marker with queued/running rows, outgoing broker dead or unable to start; earlier recovery says `normal maintenance is active; recovery cannot replace its identity` | The drain is stranded: repeating it preserves its marker but cannot progress accepted work. | Use [guarded host recovery](native_host.md#guarded-recovery-when-the-outgoing-broker-cannot-drain) with the matching client and pinned replacement. Preserve original drain metadata and both IDs; do not raw-edit the spool, prematurely resume, or cancel accepted work to bypass repair. |
+| Host recovery completes with retained normal maintenance | Host proof succeeded and restored the original drain as `draining` or `drained`; submissions stay blocked. Public service status `verified` permits the owner to finish accepted work and yield. | Keep the original drain and recovery receipts. Complete intended maintenance, wait for the drain to yield, then explicitly resume its exact original ID. Host completion does not authorize an automatic resume. |
 | `broker-resume-owner-live` | A broker still holds the ownership lock. | Let it exit; on a managed host, stop the service first. |
 | `broker-not-draining` | Nothing to resume. | No action. |
 | `agc avoid` refused with `avoid-sha-invalid` | The commit must be the full 40-character SHA. | Pass the full SHA; `--list` shows the stored set and `--remove SHA` deletes one. |
@@ -111,9 +113,9 @@ These arrive as a failed row. `failure_reason` is stable; the log has the detail
 | `native-host-user-live-broker` from recovery | A broker owns the spool without a matching active recovery identity/helper; recovery refuses to replace it. | Use the normal drain/upgrade flow for a working owner. A verified replacement under the exact matching guard may continue without stop or reactivation; retry the same package/helper. |
 | `host-recovery-worker-live`, `host-recovery-owner-invalid`, `host-recovery-invalid` | Worker absence, spool ownership, recovery metadata, or the bound replacement/helper cannot be proven. | Resolve the stated cause without deleting the spool or changing the recovery identity. Retry the same exact verified package and helper path. |
 | `host-recovery-settling` | Dead running rows have not yet settled; the enforcement proof cannot be admitted. | The command waits up to 30 seconds. If it parks, inspect the reported phase and repair before retrying. Ordinary queued work remains blocked. |
-| `host-recovery-proof-failed`, `host-recovery-proof-timeout` | The bound proof did not produce a passed enforced CPU receipt within its 120-second bound. | Repair the enforcement failure and retry the same package/helper. Only a successful applied/peak receipt permits completion. |
+| `host-recovery-proof-failed`, `host-recovery-proof-timeout` | The bound proof did not produce a passed enforced CPU receipt within its 120-second bound. | Repair the enforcement failure and retry the same package/helper. Only a successful applied/peak receipt permits completion; an inherited normal drain is restored, not resumed. |
 | `host-recovery-exhausted` | Three proof attempts have already been used across retries. | Operator repair is required. Do not delete or reset the guard, identity, or attempt budget to bypass exhaustion. |
-| `native-host-recovery-incomplete` | A bounded recovery phase failed. Before completion, any established guard remains; a completion error instead reports whether its durable result could be confirmed. Service state is reported as unchanged, stopped, or stop unconfirmed. | Preserve the recovery ID and incident evidence. Inspect the durable completion receipt if the reply was lost; exact-ID completion retries return the same validated open receipt after a committed completion. Otherwise repair and retry the same package/helper; drain/resume cannot clear an active recovery guard. |
+| `native-host-recovery-incomplete` | A bounded recovery phase failed. Before completion, any established guard remains; a completion error instead reports whether its durable result could be confirmed. Service state is reported as unchanged, stopped, or stop unconfirmed. | Preserve the recovery ID and incident evidence. Inspect the durable completion receipt if the reply was lost; exact-ID completion retries return the same validated result after a committed completion, including retained original drain metadata rather than always `open`. Otherwise repair and retry the same package/helper; drain/resume cannot clear an active recovery guard. |
 | `native-host-upgrade-drain-invalid` | The drain receipt the upgrade needs is missing or malformed. | Rerun `agc drain`, then the upgrade. |
 | `systemctl --user stop` or `restart` does not return | A graceful stop waits for running jobs, up to `stop_grace` (600 seconds by default). | Wait, or interrupt them now with `systemctl --user kill --kill-whom=main --signal=SIGTERM agcoord-broker.service`; they end `interrupted` (`broker-stopped`). Never use a plain `systemctl kill`, which signals the jobs too. |
 

{agcoord-0.7.2 → agcoord-0.7.3}/native/agcoord-broker/src/recovery.rs

@@ -49,31 +49,27 @@ fn probe_digest(path: &Path) -> Result<String> {
     Ok(sha256_prefix(&bytes, 32))
 }
 
-pub fn record(connection: &Connection) -> Result<Option<Value>> {
-    // Read the marker, its guards, and its target from one snapshot even when completion
-    // concurrently removes them. Existing write transactions already provide that snapshot.
-    let _snapshot = if connection.is_autocommit() {
-        Some(
-            connection
-                .unchecked_transaction()
-                .map_err(map_database_error)?,
-        )
-    } else {
-        None
-    };
-    let raw = store::metadata(connection, KEY)?;
-    let maintenance = store::maintenance_record(connection)?;
-    let recovering = maintenance
-        .as_ref()
-        .is_some_and(|m| m.state == "recovering");
-    let Some(raw) = raw else {
-        if recovering {
-            return Err(refused("recovery guard has no recovery record"));
-        }
-        return Ok(None);
-    };
-    let value: Value = serde_json::from_str(&raw).map_err(|_| refused("invalid recovery JSON"))?;
-    let keys = [
+fn original_drain_valid(value: &Value) -> bool {
+    if value.is_null() {
+        return true;
+    }
+    let keys = ["state", "drain_id", "reason", "started_at"];
+    value.as_object().is_some_and(|o| {
+        o.keys().map(String::as_str).collect::<BTreeSet<_>>() == keys.into_iter().collect()
+    }) && matches!(value["state"].as_str(), Some("draining" | "drained"))
+        && value["drain_id"]
+            .as_str()
+            .is_some_and(store::drain_id_valid)
+        && value["reason"]
+            .as_str()
+            .is_some_and(|r| !r.is_empty() && r.chars().count() <= 256 && !r.contains('\0'))
+        && value["started_at"]
+            .as_str()
+            .is_some_and(store::maintenance_time_valid)
+}
+
+fn validate_record(value: &Value, completed: bool) -> Result<()> {
+    let mut keys = BTreeSet::from([
         "format",
         "recovery_id",
         "identity",
@@ -83,14 +79,16 @@ pub fn record(connection: &Connection) -> Result<Option<Value>> {
         "attempts",
         "phase",
         "incident",
-    ];
-    if !recovering
-        || !value.as_object().is_some_and(|o| {
-            o.keys().map(String::as_str).collect::<BTreeSet<_>>() == keys.into_iter().collect()
-        })
-        || value["format"] != 1
+        "original_drain",
+    ]);
+    if completed {
+        keys.insert("completion");
+    }
+    if value
+        .as_object()
+        .is_none_or(|o| o.keys().map(String::as_str).collect::<BTreeSet<_>>() != keys)
+        || value["format"] != 2
         || !value["recovery_id"].as_str().is_some_and(valid_id)
-        || value["recovery_id"] != maintenance.unwrap().drain_id
         || value["identity"] != identity()
         || !value["probe"]
             .as_str()
@@ -105,19 +103,78 @@ pub fn record(connection: &Connection) -> Result<Option<Value>> {
                 .as_str()
                 .is_some_and(|s| !s.is_empty()))
         || value["attempts"].as_u64().is_none_or(|n| n > MAX_ATTEMPTS)
-        || !matches!(
-            value["phase"].as_str(),
-            Some("guarded" | "verifying" | "parked")
-        )
+        || !(if completed {
+            value["phase"] == "complete"
+        } else {
+            matches!(
+                value["phase"].as_str(),
+                Some("guarded" | "verifying" | "parked")
+            )
+        })
         || !(value["incident"].is_null()
             || value["incident"]
                 .as_str()
                 .is_some_and(|s| !s.is_empty() && s.len() <= 256))
+        || !original_drain_valid(&value["original_drain"])
     {
         return Err(refused(
             "recovery record or replacement identity does not match",
         ));
     }
+    if completed {
+        let receipt = &value["completion"];
+        let keys = BTreeSet::from(["state", "recovery_id", "proof_run_id", "drain_id"]);
+        let drain = &value["original_drain"];
+        if receipt
+            .as_object()
+            .is_none_or(|o| o.keys().map(String::as_str).collect::<BTreeSet<_>>() != keys)
+            || receipt["recovery_id"] != value["recovery_id"]
+            || receipt["proof_run_id"] != value["proof_run_id"]
+            || !(if drain.is_null() {
+                receipt["state"] == "open" && receipt["drain_id"].is_null()
+            } else {
+                matches!(receipt["state"].as_str(), Some("draining" | "drained"))
+                    && receipt["drain_id"] == drain["drain_id"]
+            })
+        {
+            return Err(refused(
+                "completed recovery receipt does not match its retained drain",
+            ));
+        }
+    }
+    Ok(())
+}
+
+pub fn record(connection: &Connection) -> Result<Option<Value>> {
+    // Read the marker, its guards, and its target from one snapshot even when completion
+    // concurrently restores the drain or removes them.
+    let _snapshot = if connection.is_autocommit() {
+        Some(
+            connection
+                .unchecked_transaction()
+                .map_err(map_database_error)?,
+        )
+    } else {
+        None
+    };
+    let raw = store::metadata(connection, KEY)?;
+    let maintenance = store::maintenance_record(connection)?;
+    let recovering = maintenance
+        .as_ref()
+        .is_some_and(|m| m.state == "recovering");
+    let Some(raw) = raw else {
+        if recovering {
+            return Err(refused("recovery guard has no recovery record"));
+        }
+        return Ok(None);
+    };
+    let value: Value = serde_json::from_str(&raw).map_err(|_| refused("invalid recovery JSON"))?;
+    validate_record(&value, false)?;
+    if !recovering || value["recovery_id"] != maintenance.unwrap().drain_id {
+        return Err(refused(
+            "recovery record does not match its maintenance guard",
+        ));
+    }
     Ok(Some(value))
 }
 
@@ -255,11 +312,16 @@ pub fn prepare(paths: &Paths, probe: &Path) -> Result<Value> {
             .map_err(map_database_error)?;
         return Ok(receipt(&value));
     }
-    if store::maintenance_record(&connection)?.is_some() {
-        return Err(refused(
-            "normal maintenance is active; recovery cannot replace its identity",
-        ));
-    }
+    let original_drain = match store::maintenance_record(&connection)? {
+        Some(drain) => {
+            if drain.state == "drained" && !load_live_runs(&connection)?.is_empty() {
+                return Err(refused("drained maintenance still contains accepted work"));
+            }
+            json!({"state":drain.state,"drain_id":drain.drain_id,
+                "reason":drain.reason,"started_at":drain.started_at})
+        }
+        None => Value::Null,
+    };
     let mut random = [0u8; 6];
     fs::File::open("/dev/urandom")
         .and_then(|mut f| f.read_exact(&mut random))
@@ -271,8 +333,10 @@ pub fn prepare(paths: &Paths, probe: &Path) -> Result<Value> {
             .map(|b| format!("{b:02x}"))
             .collect::<String>()
     );
-    let value = json!({"format":1,"recovery_id":recovery_id,"identity":identity(),"probe":probe,"probe_sha256":digest,"proof_run_id":null,"attempts":0,"phase":"guarded","incident":null});
-    store::install_maintenance_guards(&connection)?;
+    let value = json!({"format":2,"recovery_id":recovery_id,"identity":identity(),"probe":probe,"probe_sha256":digest,"proof_run_id":null,"attempts":0,"phase":"guarded","incident":null,"original_drain":original_drain});
+    if original_drain.is_null() {
+        store::install_maintenance_guards(&connection)?;
+    }
     for (key, value) in [
         ("maintenance_state", "recovering".to_owned()),
         ("maintenance_id", recovery_id),
@@ -382,7 +446,6 @@ pub fn submit_proof(paths: &Paths, recovery_id: &str, request: &SubmitRequest) -
 }
 
 pub fn complete(paths: &Paths, recovery_id: &str) -> Result<Value> {
-    store::owner_info(paths)?;
     let connection = store::open_protocol5(paths)?;
     connection
         .execute_batch("BEGIN IMMEDIATE")
@@ -392,11 +455,8 @@ pub fn complete(paths: &Paths, recovery_id: &str) -> Result<Value> {
             .ok_or_else(|| refused("no matching completed recovery exists"))?;
         let last: Value =
             serde_json::from_str(&raw).map_err(|_| refused("invalid completed recovery record"))?;
-        if last["format"] != 1
-            || last["phase"] != "complete"
-            || last["recovery_id"] != recovery_id
-            || last["identity"] != identity()
-        {
+        validate_record(&last, true)?;
+        if last["recovery_id"] != recovery_id {
             return Err(refused("completed recovery identity does not match"));
         }
         let proof_id = last["proof_run_id"]
@@ -413,8 +473,9 @@ pub fn complete(paths: &Paths, recovery_id: &str) -> Result<Value> {
         {
             return Err(refused("completed recovery proof is invalid"));
         }
-        return Ok(json!({"state":"open","recovery_id":recovery_id,"proof_run_id":proof_id}));
+        return Ok(last["completion"].clone());
     }
+    store::owner_info(paths)?;
     let mut value = required(&connection, recovery_id)?;
     let proof_id = value["proof_run_id"]
         .as_str()
@@ -438,14 +499,43 @@ pub fn complete(paths: &Paths, recovery_id: &str) -> Result<Value> {
             "a passed enforced cpu=1 receipt is required; recovery remains guarded",
         ));
     }
+    let drain = &value["original_drain"];
+    let completed = if drain.is_null() {
+        store::remove_maintenance_guards(&connection)?;
+        connection.execute("DELETE FROM coordinator_meta WHERE key IN ('maintenance_state','maintenance_id','maintenance_reason','maintenance_started_at')", []).map_err(map_database_error)?;
+        json!({"state":"open","recovery_id":recovery_id,"proof_run_id":proof.run_id,"drain_id":null})
+    } else {
+        let state = if load_live_runs(&connection)?.is_empty() {
+            "drained"
+        } else {
+            "draining"
+        };
+        for (key, retained) in [
+            ("maintenance_state", state),
+            ("maintenance_id", drain["drain_id"].as_str().unwrap()),
+            ("maintenance_reason", drain["reason"].as_str().unwrap()),
+            (
+                "maintenance_started_at",
+                drain["started_at"].as_str().unwrap(),
+            ),
+        ] {
+            store::set_metadata(&connection, key, retained)?;
+        }
+        json!({"state":state,"recovery_id":recovery_id,"proof_run_id":proof.run_id,"drain_id":drain["drain_id"]})
+    };
     value["phase"] = json!("complete");
+    value["completion"] = completed.clone();
     store::set_metadata(&connection, "host_recovery_last", &value.to_string())?;
-    store::remove_maintenance_guards(&connection)?;
-    connection.execute("DELETE FROM coordinator_meta WHERE key IN ('host_recovery','maintenance_state','maintenance_id','maintenance_reason','maintenance_started_at')", []).map_err(map_database_error)?;
+    connection
+        .execute(
+            "DELETE FROM coordinator_meta WHERE key = 'host_recovery'",
+            [],
+        )
+        .map_err(map_database_error)?;
     connection
         .execute_batch("COMMIT")
         .map_err(map_database_error)?;
-    Ok(json!({"state":"open","recovery_id":recovery_id,"proof_run_id":proof.run_id}))
+    Ok(completed)
 }
 
 pub fn park(paths: &Paths, recovery_id: &str, reason: &str) -> Result<Value> {

{agcoord-0.7.2 → agcoord-0.7.3}/native/agcoord-broker/src/store.rs

@@ -686,7 +686,7 @@ pub(crate) fn set_metadata(connection: &Connection, key: &str, value: &str) -> R
     Ok(())
 }
 
-fn drain_id_valid(value: &str) -> bool {
+pub(crate) fn drain_id_valid(value: &str) -> bool {
     value.len() == 18
         && value.starts_with("drain-")
         && value[6..]
@@ -694,7 +694,7 @@ fn drain_id_valid(value: &str) -> bool {
             .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
 }
 
-fn maintenance_time_valid(value: &str) -> bool {
+pub(crate) fn maintenance_time_valid(value: &str) -> bool {
     let bytes = value.as_bytes();
     let zone_start = if bytes.ends_with(b"Z") {
         bytes.len().checked_sub(1)