• feat(cluster): quiet steady-state Raft log — identity freeze + approval queue, stream-only liveness, docker wire delta
    Release / version (push) Canceled after 0s
    Release / frontend (push) Canceled after 0s
    Release / linux (amd64) (push) Canceled after 0s
    Release / linux (arm64) (push) Canceled after 0s
    Release / windows (push) Canceled after 0s
    Release / macos (push) Canceled after 0s
    Release / release (push) Canceled after 0s
    Build and Push Docker Image / build-and-push (push) Canceled after 0s

    LastSkywalker released this 2026-08-31 22:15:04 +03:00 | 85 commits to main since this release

    Three changes that together stop the cluster from re-writing unchanged
    host/service state on every cycle:

    1. Liveness off the durable Raft log. last_seen now rides the best-effort
      metric stream only (MetricSink already bumps it per batch; connector
      pollers bump their guests locally each cycle). The per-host
      CmdHostUpsert/CmdConnectorHostUpsert heartbeat becomes a rare 10-min
      record RESYNC (was 15s/60s liveness), and the self-advertise loop
      republishes the URL catalog only on change or the same 10-min resync
      (was every 30s per node). A failed submit resets the change-throttle so
      the next tick retries — without this, a join-window failure left the
      host record missing on peers until the resync (observed live).
      Measured on a 2-node cluster: raft last_index fully static for 4+ min
      while every host stays online on every node.

    2. Identity freeze + pending-change approval (полумануальный режим).
      Past a 10-min discovery grace window a connector never rewrites an
      existing connector-owned row's name/MAC in place: the diff parks as a
      Raft-replicated host_pending_changes row (one per host+source,
      deterministic change_id; CmdHostPendingUpsert/Delete/Apply) that an
      admin approves or rejects in admin → Nodes (amber dot on the machine
      card). Reject pins the fingerprint so the same value is never
      re-proposed; a source revert withdraws the proposal automatically.
      Topology/state (parent_mac, external_id, guest_status, IP) keeps
      flowing — PVE migrations change them legitimately. This also ends
      connector-vs-agent identity flip-flop wars structurally.

    3. Docker wire delta. The static-heavy container inventory rides the peer
      metric batch only when its stable projection (minus per-tick stats and
      the "Up N minutes" status) changes, or every 30s as a resync
      (docker.WireGate) — wire-compatible, receivers unchanged.

    Co-Authored-By: Claude Fable 5 noreply@anthropic.com

    Downloads