fix(vm): spare a stopped origin when the restore kill step fails#92
Merged
Conversation
KillForRestore marked the VM error on any non-ErrNotRunning failure, including WithRunningVM's fail-closed /proc-scan error. For a hibernated (stopped) VM the VMM is provably gone — hibernate marks error if its terminate fails — so a transient scan hiccup during wake bricked a perfectly restorable VM: ResolveForRestore refuses error state, and nothing on disk had been touched. Route the failure through FailRestore (#89's origin-aware helper): stopped origins stay stopped and the wake remains retryable; a failed kill of a genuinely live VMM on a running origin still quarantines. Closes #91
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #91.
What
KillForRestoremarked the VMerroron any non-ErrNotRunningfailure — includingWithRunningVM's fail-closed /proc-scan error, which is a false liveness-unknown for a hibernated VM (its VMM is provably gone: hibernate's own terminate failure already markserror, sostoppedimplies no VMM). A transient procfs hiccup at wake therefore bricked the VM permanently:ResolveForRestorerefuseserrorstate, and nothing on disk had been mutated. Route the failure throughFailRestore(#89's origin-aware helper) instead:stopped, wake retries convergePlus a one-word
FailRestoredoc fix ("post-kill" → "restore-path": it now also guards the kill step itself; the origin-provenance note is unchanged and still holds — the kill step is pre-kill).Deliberately accepted corner
A
stoppedrecord with a genuinely live VMM (half-failedvm start) whose kill fails is now also spared: restore aborts before any mutation either way (no double-VMM risk), and sparing lets the next wake retry the kill instead of welding shut a record that was already lying. A sentinel-error split inWithRunningVM(scan-error vs real kill failure) was evaluated and rejected as overdesign — it would touch a primitive shared by stop/delete/start to sharpen behavior only in this should-never-happen corner.Verification
TestKillForRestoreFailureKeepsOriginContract(reuses the stub-VMM harness; injects a failing terminate — the /proc-scan branch itself isn't unit-reachable, but both branches converge on the one changed marking site): stopped→stays stopped, running→errormake lint0 issues ×2 GOOS, full suite 25 pkgs green