4 Commits

Include renames

Author	SHA1	Message	Date
mrhid6	dabe6fe3aa	feat: Updated package path to match repo	2026-07-28 10:01:40 +01:00
mrhid6andClaude Opus 5	a940390791	feat(admin): reconciler marks reaped instances deleted ... Without this the row stays active forever, the reconciler re-logs the same miss every fifteen minutes, and the lifecycle sweep keeps emailing about an instance that no longer exists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-26 13:24:44 +01:00
mrhid6andClaude Opus 5	b7221d8111	fix(admin): reconcile once at boot, not only on the ticker ... StartReconciler only fired on its 15-minute ticker, so nothing reconciled until a full interval had passed and restarting admin repaired nothing. Injection failures are most likely around a deploy or a crash, which is exactly when the backstop was asleep -- a paying customer could sit read-only for 15 minutes with the repair already computable. A restart is now also a supported way to force reconciliation. Found by the plan's own Step 8, which assumed this behaviour: verified by tampering with a control-plane blob, confirming the instance went invalid, and watching the boot pass restore it (checked 1, repaired 1). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:21:16 +01:00
mrhid6andClaude Opus 5	a636a48e07	feat(admin): cloud injection and the 15-minute reconciler ... Injection is a single UpdateOne of three licence fields, so it is idempotent and safe to re-run. The control plane caches licence state for 60 seconds, so an injected licence takes effect within a minute with no restart. Deliver never fails its caller. The reconciler, not the issuance path, is what actually guarantees a cloud instance ends up holding the licence admin says it holds -- injection at issue time is best-effort and this is the backstop. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:02:45 +01:00