controller v0.271.0: automatic app updates — the update leg after the off-site copy, the backup gate waits, the switch (09 6.4 part 7; R-680, R-678, R-643)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-24 22:07:24 +02:00
parent 1495ca43fb
commit 9cf13a3add
33 changed files with 1672 additions and 14 deletions
@@ -20,6 +20,12 @@ const (
 	gateEndMin      = 360 // whole-guest gate closes (exclusive) at W+6h
 )

+// UpdateLegStopOffsetMin is W+5h: the automatic update leg starts no step at or after it, and the
+// full-system backup's gate stops waiting for the leg there, so that backup keeps at least one hour of
+// its [W+2h, W+6h) window (`09` §3 decision 20, v0.271.0). Read by stacks.LegDeadline AND the quiesce
+// gate — one constant, so the two can never disagree (TestLegDeadlineAndGateShareW5h).
+const UpdateLegStopOffsetMin = 300
+
 // ParseHHMM parses "HH:MM" (24h) into minutes-since-midnight. It rejects anything but a valid
 // hour:minute — the same contract as the scheduler's parseDailyTime, kept here so this package is
 // dependency-free and reusable by the quiesce gate.