docs(adr): ADR-0030 — shipped systemd units never use RequiredBy= enablement - #67
Merged
Merged
Conversation
…blement First-boot presets persist [Install] enablement into each machine's /etc, where it outlives the image that created it. A persisted .wants link dangles harmlessly when its unit is later retired; a persisted .requires link (from RequiredBy=) becomes a Requires= on a unit that fails to load and invalidates PID 1's very first transaction — the machine dies at "Failed to isolate default target" before any service runs, so no runtime migration can ever fire. This bricked updates on real hardware 2026-08-12 (snosi e08311f retired snow-linux-live-setup.service; image 20260812205454 failed all counted boots on every install first-booted before the retirement, while fresh installs and therefore all CI passed). Decision: WantedBy= is the only [Install] enablement in Frostyard-shipped units; hard dependencies are declared from the dependent unit's [Unit] section or via static wants in /usr. Repos shipping unit payloads enforce this in CI (snosi ADR-0013: check-required-by-guard.sh), and image boot paths that can do so prune stale .requires links defensively (snosi's native A/B initrd), since distro packages may still ship RequiredBy=. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records the org-wide policy arising from the 2026-08-12 snosi boot-brick incident: first-boot presets persist
[Install]enablement into each machine's/etc, where it outlives the image that created it. A persisted.wantslink dangles harmlessly when its unit is later retired; a persisted.requireslink (fromRequiredBy=) becomes aRequires=on a unit that fails to load and invalidates PID 1's very first transaction — "Failed to isolate default target" before any service runs, so no runtime migration can ever fire. snosi image20260812205454failed all counted boots on every install first-booted before the retirement ofsnow-linux-live-setup.service, while fresh installs (and therefore all CI) passed.Decision:
WantedBy=is the only[Install]enablement in Frostyard-shipped units. Hard dependencies are declared from the dependent unit's[Unit]section or via static wants in/usr— mechanisms that update atomically with the image. Shipping repos enforce this in CI, and image boot paths that can do so prune stale.requireslinks defensively, since distro packages may still shipRequiredBy=.Implementation + repo-local ADR: frostyard/snosi#710 (ADR-0013,
check-required-by-guard.sh, initrdetc-overlay-prune.sh).🤖 Generated with Claude Code