Revert agent generations that cut off the control plane

2026-10-05 13:46:20 +11:00
parent 2832dd0e7d
commit 4ad55fc65e
6 changed files with 458 additions and 35 deletions
@@ -430,6 +430,10 @@ report the generation applied, giving a fleet-wide "converged / N behind" view.
  source/dest disables its rule loudly, never opens it.
 - **Adds fail closed, the control plane fails open.** Partial rollout blocks new
  flows until every hop converges; a dead API leaves the last-good posture running.
+- **A generation that severs the API is reverted.** After applying, the agent
+  reports `applied` over a fresh connection; if that fails at the transport level
+  it restores the snapshot, reports `reverted`, and skips that generation (persisted
+  in `/var/lib/tomswall/reverted.json`) until a newer one arrives.

 ---