#411 dogfood fix: release the instance lock when the tripwire refuses to boot #416

Merged

Cordy merged 3 commits from kd-lockrelease into main

2026-09-03 21:10:11 +00:00

Cordy commented

2026-09-03 21:08:19 +00:00

Owner

Observed live on cairn-enc's first real discard: a boot refused by the key-rotation tripwire exited via os.Exit(1) while holding the state-backend instance lock, so the next boot — with the key restored or CAIRN_KEYDRAIN_FORCE=1 set — waited out the full 5-minute stale window in CrashLoopBackOff.

The tripwire and ledger-open exit paths now cancel the heartbeat and release the lock before exiting, same as the graceful-shutdown paths. A guardrail that refuses to start must leave the door unlocked behind it.

Observed live on cairn-enc's first real discard: a boot refused by the key-rotation tripwire exited via `os.Exit(1)` while holding the state-backend instance lock, so the *next* boot — with the key restored or `CAIRN_KEYDRAIN_FORCE=1` set — waited out the full 5-minute stale window in CrashLoopBackOff. The tripwire and ledger-open exit paths now cancel the heartbeat and release the lock before exiting, same as the graceful-shutdown paths. A guardrail that refuses to start must leave the door unlocked behind it.

Cordy added 3 commits

2026-09-03 21:08:20 +00:00