manta-node 0.6b5.dev773__py3-none-any.whl → 0.6b5.dev783__py3-none-any.whl

manta_node/cli/_version_generated.py

@@ -4,7 +4,7 @@ This file is auto-generated at build time by scripts/generate_version.py.
 Do not edit manually.
 """
 
-__version__ = "2026.10.08.22eaa34f"
+__version__ = "2026.10.08.05fbabb8"
 __build_date__ = "2026.10.08"
-__commit_id__ = "22eaa34f"
+__commit_id__ = "05fbabb8"
 __package_version__ = "0.6b5"  # release-series base, moved by scripts/bump_version.py

manta_node/infrastructure/mqtt/command_handler.py

@@ -62,6 +62,11 @@ MAX_MQTT_CONNECT_FAILURES = 3
 REPLAY_POLL_SECONDS = 2.0
 REPLAY_TIMEOUT_SECONDS = 120.0
 
+# Every update must end in one outcome (B-24, mechanism §6.6): these name the
+# reasons the node reports for a malformed command and an unavailable supervisor.
+MALFORMED_COMMAND_REASON = "malformed command"
+SUPERVISOR_UNAVAILABLE_REASON = "the node's supervisor is unavailable"
+
 
 def _node_update_state(state) -> NodeUpdateState:
     """Map a seam state to the wire enum; they mirror 1:1 (manta-common#291)."""
@@ -759,8 +764,18 @@ class CommandHandler(Collector, MqttBase):
         before relaying (ADR-0042 D5) and reports the refusal, so the platform's
         one-path rule holds even if a command reaches a host- or fleet-updated
         node, or one whose path is unknown.
+
+        Every ending is reported (B-24, mechanism §6.6): a malformed command is
+        `REFUSED` "malformed command" when a request id can be read, and a
+        missing or failing seam is `FAILED` "the node's supervisor is
+        unavailable". Neither raises: nothing changed (NF-3), and the platform
+        must see one outcome rather than wait out its deadline.
         """
-        request = self._parse_update(payload)
+        try:
+            request = self._parse_update(payload)
+        except MantaMQTTError as exc:
+            await self._refuse_malformed(payload, exc)
+            return
         # One update path per node (ADR-0042 D5). Only a platform-path node takes
         # a platform command; the platform fails closed on every other path, and
         # if one arrives anyway, refuse it here and report the refusal rather
@@ -774,13 +789,61 @@ class CommandHandler(Collector, MqttBase):
                 )
             )
             return
-        outcome = await self.relay_update(request)
+        try:
+            outcome = await self.relay_update(request)
+        except MantaNodeError:
+            await self._publish_failed(
+                request.request_id, SUPERVISOR_UNAVAILABLE_REASON
+            )
+            return
         if outcome is None:
-            raise MantaNodeError(
-                "update_node received but no supervisor serves the seam"
+            await self._publish_failed(
+                request.request_id, SUPERVISOR_UNAVAILABLE_REASON
             )
+            return
         await self.publish_update_status(outcome)
 
+    async def _refuse_malformed(self, payload: bytes, exc: Exception) -> None:
+        """Report a malformed command as `REFUSED`, when a request id can be read.
+
+        The Manager correlates the outcome by request id, so a command we cannot
+        accept still gets a `REFUSED` "malformed command" when the id survived
+        the parse. A payload that carries none has nothing to correlate and is
+        dropped with a log line.
+        """
+        request_id = self._recover_request_id(payload)
+        if request_id is None:
+            self.tracer.warning(
+                f"Dropping a malformed update_node payload with no readable"
+                f" request id: {exc}"
+            )
+            return
+        self.tracer.warning(
+            f"Refusing a malformed update_node command {request_id}: {exc}"
+        )
+        await self.publish_update_status(
+            SwitchOutcome(
+                request_id=request_id,
+                state=SeamState.REFUSED,
+                reason=MALFORMED_COMMAND_REASON,
+            )
+        )
+
+    @staticmethod
+    def _recover_request_id(payload: bytes) -> str | None:
+        """The request id from a payload we could not accept, if one is readable."""
+        try:
+            command = MqNodeUpdate().parse(payload)
+        except Exception:
+            return None
+        return command.request_id or None
+
+    async def _publish_failed(self, request_id: str, reason: str) -> None:
+        """Report a `FAILED` outcome for a request that changed nothing (NF-3)."""
+        await self.publish_update_status(
+            SwitchOutcome(request_id=request_id, state=SeamState.FAILED, reason=reason)
+        )
+
     @staticmethod
     def _parse_update(payload: bytes) -> UpdateRequest:
         """Validate an `MqNodeUpdate` and turn it into the seam's request.

manta_node/supervisor/executor.py

@@ -96,6 +96,7 @@ def make_executor(
     bounds: Bounds | None = None,
     verify: Callable[[str, str | None], None] = verify_candidate,
     install: Callable[[str], str] = version_tree.install_version,
+    switch_lock: threading.Lock | None = None,
 ) -> Callable[[UpdateRequest], Awaitable[SwitchOutcome]]:
     """Build the seam handler: a request in, the lifecycle's outcome out.
 
@@ -108,11 +109,15 @@ def make_executor(
     concurrent switches would race both. ``SeamServer`` dedupes by ``request_id``
     only; a second, differently-ided request while one is switching is refused
     here rather than run.
+
+    ``switch_lock`` lets the supervisor share this "a switch is in flight" fact:
+    its crash-loop revert takes the same lock, so a switch's outcome and a
+    crash-loop revert never both decide the same update.
     """
     bounds = bounds or load_bounds()
     # One switch at a time. Held across the whole lifecycle, so a second request
     # (any request_id) is refused while one is in flight, not run concurrently.
-    switching = threading.Lock()
+    switching = switch_lock if switch_lock is not None else threading.Lock()
 
     def fetch(target: str) -> str:
         # Pull-only (NF-10). A version dir the fleet path already materialised

manta_node/supervisor/inflight.py

@@ -18,7 +18,7 @@ import time
 from dataclasses import dataclass
 from pathlib import Path
 
-from .records import read_json, write_json_atomic
+from .records import TREE_LOCK, read_json, write_json_atomic
 
 INFLIGHT_NAME = "inflight.json"
 # The last terminal outcome, written when a switch resolves and read when a
@@ -69,7 +69,8 @@ class InFlight:
 
 
 def write_inflight(record: InFlight, path: Path | None = None) -> None:
-    write_json_atomic(path or inflight_path(), record.to_dict())
+    with TREE_LOCK:
+        write_json_atomic(path or inflight_path(), record.to_dict())
 
 
 def read_inflight(path: Path | None = None) -> InFlight | None:
@@ -84,7 +85,8 @@ def read_inflight(path: Path | None = None) -> InFlight | None:
 
 
 def clear_inflight(path: Path | None = None) -> None:
-    (path or inflight_path()).unlink(missing_ok=True)
+    with TREE_LOCK:
+        (path or inflight_path()).unlink(missing_ok=True)
 
 
 def deadline_from_now(window: float) -> float:
@@ -125,7 +127,8 @@ class UpdateOutcome:
 
 
 def write_outcome(outcome: UpdateOutcome, path: Path | None = None) -> None:
-    write_json_atomic(path or outcome_path(), outcome.to_dict())
+    with TREE_LOCK:
+        write_json_atomic(path or outcome_path(), outcome.to_dict())
 
 
 def read_outcome(path: Path | None = None) -> UpdateOutcome | None:

manta_node/supervisor/process.py

@@ -44,15 +44,27 @@ from ..seam import (
 from . import switch as version_tree
 from .bounds import load_bounds
 from .executor import ChildControl, make_executor
-from .inflight import read_inflight
+from .inflight import (
+    InFlight,
+    UpdateOutcome,
+    clear_inflight,
+    read_inflight,
+    write_outcome,
+)
 from .lifecycle import MIN_FREE_BYTES
 from .records import (
+    TREE_LOCK,
     supervisor_record,
     supervisor_record_path,
     write_json_atomic,
 )
 from .seam import SeamServer, SocketSeamClient
-from .switch import boot_python, bootstrap_current, installed_node_version
+from .switch import (
+    VersionTreeError,
+    boot_python,
+    bootstrap_current,
+    installed_node_version,
+)
 
 # A child that exits more than RESTART_LIMIT times within RESTART_WINDOW_SECONDS
 # is a crash loop: the supervisor stops restarting and exits non-zero, so systemd
@@ -112,6 +124,11 @@ class Supervisor:
         # a replay-capable child reports the outcome either way. Consumed by the
         # one planned respawn it belongs to.
         self._pending_update_request_id: str | None = None
+        # The executor's single-switch lock, held for the whole lifecycle. The
+        # crash-loop branch takes it non-blocking to tell "a seam switch is in
+        # flight": then that switch owns the update and polls the child itself,
+        # so the revert must not race its decision.
+        self._switch_lock = threading.Lock()
         # The seam server, served in a background thread while the child runs.
         self._seam_thread: threading.Thread | None = None
         self._seam_server: SeamServer | None = None
@@ -168,6 +185,74 @@ class Supervisor:
         if record is not None:
             self._pending_update_request_id = record.request_id
 
+    def _resume_or_revert_on_start(self) -> None:
+        """Act on a left-over in-flight record when the supervisor starts (D9).
+
+        An expired window means the return was never observed while nothing
+        supervised: revert to the last good and record it. An open window keeps
+        the candidate current — the boot that follows carries the request id and
+        replays (NF-8) — and the return is observed at the platform's deadline
+        (mechanism §6.6); a later start past the window reverts.
+        """
+        record = read_inflight()
+        if record is None:
+            return
+        if record.expired():
+            self._revert(record, "the window passed before the supervisor came back")
+            return
+        self._pending_update_request_id = record.request_id
+
+    def _revert(self, record: InFlight, reason: str) -> bool:
+        """Commit the last good version and record a REVERTED outcome (D9/D12).
+
+        The boot that follows carries the request id, so a replay-capable node
+        reports the revert (NF-8). Returns False when the record was already
+        resolved by another path, when there is no valid last good to revert to,
+        or when the commit fails; the outcome is then DOWN, since the node
+        cannot be confirmed on any known-good version. Held under the shared
+        ``TREE_LOCK`` (the same lock ``version_tree.commit`` and the record
+        writers take, so a seam switch on the executor thread cannot interleave)
+        and re-reading the record inside it, so a stale snapshot can never commit
+        or overwrite a record another path already resolved.
+        """
+        with TREE_LOCK:
+            current = read_inflight()
+            if current is None or current.request_id != record.request_id:
+                return False  # already resolved by another path
+            record = current
+            self._pending_update_request_id = record.request_id
+            last_good = record.last_good
+            target = version_tree.versions_dir() / last_good if last_good else None
+            if target is None or version_tree.read_manifest(target) is None:
+                self._record_outcome(
+                    record, SeamState.DOWN, "no last-good version to revert to"
+                )
+                return False
+            try:
+                version_tree.commit(target)
+            except (VersionTreeError, OSError) as exc:
+                self._record_outcome(record, SeamState.DOWN, f"revert failed: {exc}")
+                return False
+            self._record_outcome(
+                record, SeamState.REVERTED, reason, reverted_to=last_good
+            )
+            return True
+
+    @staticmethod
+    def _record_outcome(
+        record: InFlight, state: SeamState, reason: str, **detail
+    ) -> None:
+        """Write the request's terminal outcome and clear the in-flight record."""
+        write_outcome(
+            UpdateOutcome(
+                request_id=record.request_id,
+                state=state.value,
+                reason=reason,
+                detail=detail,
+            )
+        )
+        clear_inflight()
+
     def _restart_child(self) -> None:
         """The seam executor's restart: wind the child down so the loop respawns it.
 
@@ -192,6 +277,7 @@ class Supervisor:
         handler = make_executor(
             self._child_control(),
             bounds=load_bounds(),
+            switch_lock=self._switch_lock,
         )
         server = SeamServer()
         self._seam_server = server
@@ -277,9 +363,10 @@ class Supervisor:
     def run(self) -> int:
         signal.signal(signal.SIGTERM, self._on_signal)
         signal.signal(signal.SIGINT, self._on_signal)
-        # A supervisor restart mid-update: the in-flight record survives (D9), so
-        # the child booted here still carries the request id and can replay.
-        self._capture_updating_request()
+        # D9: re-evaluate a left-over in-flight record when the supervisor starts.
+        # An expired window reverts to the last good; an open one keeps the
+        # candidate and lets the boot replay. Either way the boot carries the id.
+        self._resume_or_revert_on_start()
         # 2c no-op switch: materialise the current code as the first version dir
         # and commit it, so the child boots from `current`. Idempotent across
         # restarts; a host with no version skips this entirely.
@@ -320,6 +407,31 @@ class Supervisor:
             ]
             self._restarts.append(now)
             if len(self._restarts) > RESTART_LIMIT:
+                # D12: a candidate that crash-loops is reverted at once rather
+                # than left down on the bad build. An update is in flight only
+                # while the in-flight record is present.
+                if not self._switch_lock.acquire(blocking=False):
+                    # A seam switch is in flight: it owns the update and its
+                    # return probe decides, so keep the child supervised rather
+                    # than reverting under it. Its is_back sees the dead child and
+                    # reverts quickly; do not enforce the limit here.
+                    self._restarts = []
+                    self._write_record(None, "restarting")
+                    time.sleep(RESTART_BACKOFF_SECONDS)
+                    continue
+                try:
+                    record = read_inflight()
+                    reverted = record is not None and self._revert(
+                        record, "the candidate crash-looped past the restart limit"
+                    )
+                finally:
+                    self._switch_lock.release()
+                if reverted:
+                    # The revert landed; respawn onto the last good with a fresh
+                    # budget. A revert that could not land (DOWN) falls through:
+                    # a fresh budget would only repeat a known-bad build.
+                    self._restarts = []
+                    continue
                 self._write_record(None, "crash-loop")
                 print(
                     f"supervisor: child exited {len(self._restarts)} times in "

manta_node/supervisor/records.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 
 import json
 import os
+import threading
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -25,6 +26,14 @@ INSTANCE_DIR = Path.home() / ".manta" / "nodes" / "instances"
 
 SUPERVISOR_SUFFIX = ".supervisor.json"
 
+# Guards the shared version-tree state two threads can touch at once: the
+# supervisor's supervision loop (its crash-loop / start revert) and a seam
+# switch running on the executor's worker thread. Every commit of `current` and
+# every write to the in-flight/outcome records takes it, so their filesystem
+# sequences never interleave. Re-entrant: a caller may hold it across several
+# locked operations.
+TREE_LOCK = threading.RLock()
+
 
 def supervisor_record_path(alias: str) -> Path:
     """The supervisor record for ``alias`` (the pid of record)."""

manta_node/supervisor/switch.py

@@ -31,7 +31,7 @@ from importlib.metadata import PackageNotFoundError, version
 from pathlib import Path
 
 from ..seam import is_safe_version_name
-from .records import read_json, write_json_atomic
+from .records import TREE_LOCK, read_json, write_json_atomic
 
 # The version tree and the pointer live under the node's state dir, beside the
 # instances, never inside a version dir (NF-6).
@@ -253,13 +253,14 @@ def commit(target: Path) -> None:
     """
     if read_manifest(target) is None:
         raise VersionTreeError(f"refusing to commit an invalid version dir: {target}")
-    versions_dir().mkdir(parents=True, exist_ok=True)
-    link = current_link()
-    link.parent.mkdir(parents=True, exist_ok=True)
-    tmp = link.with_name(link.name + ".tmp")
-    tmp.unlink(missing_ok=True)
-    os.symlink(_link_target(target), tmp)
-    os.replace(tmp, link)
+    with TREE_LOCK:
+        versions_dir().mkdir(parents=True, exist_ok=True)
+        link = current_link()
+        link.parent.mkdir(parents=True, exist_ok=True)
+        tmp = link.with_name(link.name + ".tmp")
+        tmp.unlink(missing_ok=True)
+        os.symlink(_link_target(target), tmp)
+        os.replace(tmp, link)
 
 
 def selected() -> Path | None:

{manta_node-0.6b5.dev773.dist-info → manta_node-0.6b5.dev783.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: manta_node
-Version: 0.6b5.dev773
+Version: 0.6b5.dev783
 Summary: Node side software of the Manta platform. It is responsible for the communication with the Manta Core and the execution of the tasks.
 Author-email: Hugo Miralles <hugo.miralles@manta-tech.io>, Matthew Thompson <matthew.thompson@manta-tech.io>
 License-Expression: AGPL-3.0-or-later

{manta_node-0.6b5.dev773.dist-info → manta_node-0.6b5.dev783.dist-info}/RECORD

@@ -7,7 +7,7 @@ manta_node/tasks.py,sha256=o837Hi-KFVJg9LF5iOtE8oD6UuTOfrEPWR-JOdhRGeY,6983
 manta_node/update_path.py,sha256=6N_bN9z8MqnyWWfGTe1-aJFijf2tSy_IvO6VHvNSQVU,1667
 manta_node/utils.py,sha256=Hw4Iw2jYQYsfVLVJuBMt-_rMFBeml3nCDE2jiiXc8YM,1155
 manta_node/cli/__init__.py,sha256=arzO3mXDJ-E2yeeytbZfN7mCswwxdQ43_QjyeL2E5yE,134
-manta_node/cli/_version_generated.py,sha256=u15js_niq-wLlcE1Hitgt0MvKozxGxx0dZjNV-EhUfc,332
+manta_node/cli/_version_generated.py,sha256=m3MylUbtMYYQiLv0mYdjiR_-m2XdvXi3nndOIIDTPI0,332
 manta_node/cli/config_manager.py,sha256=BCju9zqzraviL3KrzRnB-vZQUY__Q5kuEqb7EdB8YdI,4409
 manta_node/cli/main.py,sha256=dZa6zrypWBvpN8hd4qpxevvlyNFhxKINCg1537NJ36w,4318
 manta_node/cli/version.py,sha256=L4lNTz-Uw_ejumy1tXJcJhcjhb-5FRcRQ6ogZM5N1Xo,5136
@@ -42,7 +42,7 @@ manta_node/infrastructure/metrics/__init__.py,sha256=ODGAj9s63F5jba2c3dQRMfNK6I4
 manta_node/infrastructure/metrics/collector.py,sha256=9ESw__Pc2tV6ldG5yhos2IS7T5Td59KxTIwDRZc_G4w,3067
 manta_node/infrastructure/metrics/metrics_collector.py,sha256=osIYrNzU3g9WCAxVQ14isM9YEQ3eJ7F3QgKBbpgeMJs,13077
 manta_node/infrastructure/mqtt/__init__.py,sha256=riXo1sXgO4YV6DHCmWRqK61BAmuGLdHiVdQFunAJadA,140
-manta_node/infrastructure/mqtt/command_handler.py,sha256=GDKlQGq9IL7HKkQTWCML7K2i75W5b7wdo5pEDYUYuzQ,35862
+manta_node/infrastructure/mqtt/command_handler.py,sha256=rEXdIK3EYQJibi9-2xczsmrgJDMznK_v0Dfszu-LOzM,38517
 manta_node/infrastructure/network/__init__.py,sha256=On3XLgycFQoc-fBCa5hFuFDfEJjmFy7Wl2CK3D2LkdI,478
 manta_node/infrastructure/network/event_registry.py,sha256=iWEfUJRzDnWjOrDinpYqVyIUpGKJjp7RZkjMDPfpplM,1661
 manta_node/infrastructure/network/factory.py,sha256=-LvHbBp5nBpQ7fyQT1T0pvK3aczZqWc9QNDW37brBeU,3897
@@ -55,17 +55,17 @@ manta_node/infrastructure/security/auth_agent.py,sha256=WkPTg_g0gix7xomb_on_Ft3T
 manta_node/infrastructure/security/token_provider.py,sha256=u3bcbQYNBskFzunO-wOSZpGkDN_CU1BCB5HUbZTC4Vg,1832
 manta_node/supervisor/__init__.py,sha256=kgdoNce1tM4e7jvdxkdmnNJV1L92-NI2cRfYSdm9vsw,542
 manta_node/supervisor/bounds.py,sha256=MlUfj0tYY-US348JsxYA-Ph5pSpgoOPlRdVTwmrPtZA,3181
-manta_node/supervisor/executor.py,sha256=HwER4Q9uFI4cYTBEn5BFtRhU69Wdj9fj8-RQZ6u8T8o,8171
-manta_node/supervisor/inflight.py,sha256=GhngTFmFKi0P3yqu5P5XeRP5G-H8vG-uQcAzdjATdm0,4515
+manta_node/supervisor/executor.py,sha256=S4X7SyaRzYXwj4XD3yS-KNyWfvqUpbCVHHZzejG7trs,8476
+manta_node/supervisor/inflight.py,sha256=mM8qNoBqTwg0WP-SHxkPznwSF8gIlyA28dDUtVFaLl8,4598
 manta_node/supervisor/lifecycle.py,sha256=_-Tzb3Ipu_RERC5T8DeHyy7BS5RypIc8rIz2GvKRG2s,12000
-manta_node/supervisor/process.py,sha256=frbbgvhLsveXMzwmRkNmB3FEKKgqiEdG6UhffRrE_Bw,20741
-manta_node/supervisor/records.py,sha256=fUlL1SfmWpGnCbJ9956cuy0H3a7-aEF-B-naqbJiYoU,6405
+manta_node/supervisor/process.py,sha256=7cy1OtwNtu6K3lbiBMRA4fzb25a0hE4AADDb-xUmXjA,25896
+manta_node/supervisor/records.py,sha256=O1YjNN2bH1xzOJo_3l1G6FRvWo1CmdAfvSDJBj6sKIM,6858
 manta_node/supervisor/seam.py,sha256=4kczRku5Ctn4xRvXS-pyzaDFau7LnX5bYOn6IRNKRyE,9665
 manta_node/supervisor/sequence.py,sha256=eYu7rrk1ecc4Y2jQhhJ7CopPz3m0lOsFLJj5lT2PwBw,1685
-manta_node/supervisor/switch.py,sha256=ansCCmxru9bmmLggq8b68gmnyqbPgXF_u2Z6fo_xSMo,22283
-manta_node-0.6b5.dev773.dist-info/licenses/LICENSE,sha256=9mBgLhiB9goQPQjg9XQJ6FjgVxYw9Q8lyOZYkPGwF_c,34484
-manta_node-0.6b5.dev773.dist-info/METADATA,sha256=soD8Yq0AvgXQSmpobHn-TAuOENMsdutClUYPOKjZXk4,4937
-manta_node-0.6b5.dev773.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-manta_node-0.6b5.dev773.dist-info/entry_points.txt,sha256=uCwggRApalLEsYs1YxwTBN0-e9oMJAkMoBp01HaSdoY,110
-manta_node-0.6b5.dev773.dist-info/top_level.txt,sha256=nbT5J5WETuXM9UPoQckl29uUOq8wMYdRb9QDx5kAFeo,11
-manta_node-0.6b5.dev773.dist-info/RECORD,,
+manta_node/supervisor/switch.py,sha256=PbWLNnRwQFhOBDAUSLcDwZsIW5jPHq_zNKIyS7Hd8C0,22342
+manta_node-0.6b5.dev783.dist-info/licenses/LICENSE,sha256=9mBgLhiB9goQPQjg9XQJ6FjgVxYw9Q8lyOZYkPGwF_c,34484
+manta_node-0.6b5.dev783.dist-info/METADATA,sha256=QpF9kkPRM3JA3cONAHjq9DZQqmIYjsvhCueElWJjGb0,4937
+manta_node-0.6b5.dev783.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+manta_node-0.6b5.dev783.dist-info/entry_points.txt,sha256=uCwggRApalLEsYs1YxwTBN0-e9oMJAkMoBp01HaSdoY,110
+manta_node-0.6b5.dev783.dist-info/top_level.txt,sha256=nbT5J5WETuXM9UPoQckl29uUOq8wMYdRb9QDx5kAFeo,11
+manta_node-0.6b5.dev783.dist-info/RECORD,,