Liveness outage tri-state (#650) + departed-owners fidelity batch #651

Merged

Cordy merged 9 commits from fix-650 into main

2026-09-22 23:34:32 +00:00

Cordy commented

2026-09-22 23:31:17 +00:00

Owner

Closes #650, plus the five dogfood findings from the v0.6.244 review.

Backend:

liveness.Oracle gains Probe + Outage(ctx) on the NegTTL cache; spaces.Manager.Ping (admin-token round-trip; detection lags by at most the token TTL, documented) backs it in main.go.
/api/v1/admin/owners/departed response gains "outage".
ownerTransfer and ownersRevoke refuse 503 during an outage — the server is the boundary; frozen-by-outage is not departed. Freeze semantics untouched.

Frontend:

Outage warn box now gated on the real oracle answer with assertive copy; the conditional "If the identity provider is unreachable…" footnote key dies — a deleted local account no longer surfaces IdP wording.
Transfer/Revoke buttons disabled during an outage.
Revoke all is a red button; both action ellipses dropped (×4 langs).
Transfer dialog rebuilt to mockup rev 1 §2: icon fact rows (ok/warn/lock), bold pluralised counts via tn(), mono src/dst paths.
Dialog chrome on ludeldlg + ownxferdlg: title hairline, shaded footer band (desktop-only media query, phone sheet untouched).

Also relaxes a stale exact-count pin in web/test/deptab.test.js (helper-usage counts in committed tests are lower bounds now).

Tests: internal/liveness/outage_test.go, internal/api/owners_outage_test.go, web/test/depoutage.test.js.

Closes #650, plus the five dogfood findings from the v0.6.244 review. Backend: - `liveness.Oracle` gains `Probe` + `Outage(ctx)` on the NegTTL cache; `spaces.Manager.Ping` (admin-token round-trip; detection lags by at most the token TTL, documented) backs it in main.go. - `/api/v1/admin/owners/departed` response gains `"outage"`. - `ownerTransfer` and `ownersRevoke` refuse 503 during an outage — the server is the boundary; frozen-by-outage is not departed. Freeze semantics untouched. Frontend: - Outage warn box now gated on the real oracle answer with assertive copy; the conditional "If the identity provider is unreachable…" footnote key dies — a deleted local account no longer surfaces IdP wording. - Transfer/Revoke buttons disabled during an outage. - Revoke all is a red button; both action ellipses dropped (×4 langs). - Transfer dialog rebuilt to mockup rev 1 §2: icon fact rows (ok/warn/lock), bold pluralised counts via tn(), mono src/dst paths. - Dialog chrome on ludeldlg + ownxferdlg: title hairline, shaded footer band (desktop-only media query, phone sheet untouched). Also relaxes a stale exact-count pin in web/test/deptab.test.js (helper-usage counts in committed tests are lower bounds now). Tests: internal/liveness/outage_test.go, internal/api/owners_outage_test.go, web/test/depoutage.test.js.

Cordy added 9 commits

2026-09-22 23:31:18 +00:00