box: mark `bootstrapped` after a successful rig hook #130

New issue

Closed

opened 2026-07-20 10:29:29 +00:00 by dan-claude-bot · 1 comment

dan-claude-bot commented

2026-07-20 10:29:29 +00:00

(Migrated from github.com)

Follow-up carved out of #104, at the explicit request of its PR (#128) so the
deferred half is not lost when #104 closes. Child of heavy-duty/rig#62.

What #104 shipped, and what it did not

#104 asked for a pristine snapshot at mint and floated a second one:

Worth considering alongside: a second bootstrapped snapshot after a
successful hook, so an operator can get back to a converged-but-untouched
box without paying a re-mint.

#128 implements pristine only, and argues the deferral rather than
silently dropping it. Restating that argument here so this issue starts
where that one left off:

It is a different product. pristine is a rollback floor — the one
state that is definitionally clean, and the thing rig#62 asked for.
bootstrapped is a convenience checkpoint: cheaper than a re-mint, but it
competes with box snapshot <box> <label>, which already exists and which
an operator can take at exactly the moment they care about.
It has unresolved questions of its own — the two below.
It doubles the auto-snapshot count, and therefore doubles the dir-backend
disk objection that #128's driver detection exists to answer. Better to let
that machinery be reviewed carrying one mark before it carries two.

The two questions this issue has to settle

The blank-template asymmetry. A blank box never runs the rig hook, so
bootstrapped would exist on some boxes and not others. pristine deliberately
avoids exactly this by being unconditional within a fresh mint. Either
bootstrapped accepts the asymmetry and documents it, or it needs a story for
what a hookless box gets — and "nothing" is a real answer, but it should be a
chosen one.

The hand-re-run case, which is the sharper one. When the hook fails,
cmd_new's failure message tells the operator to fix it via box shell.
Nothing re-takes the mark afterwards — so bootstrapped would be absent
precisely on the boxes whose convergence was interesting enough to need
intervention. A mark that is reliably missing on the interesting cases is
worse than no mark, because its presence elsewhere implies a coverage it
does not have.

Shape

box: mark 'bootstrapped' after a successful rig hook — taken after the
[ -n "$T_BOOTSTRAP_ROLE" ] block succeeds, reusing snapshot_pristine's
storage_driver detection, its BOX_SNAPSHOT_* opt-out shape, and its
never-fatal contract. The helper #128 adds is deliberately close to reusable;
whether it generalises cleanly or wants a second function is an
implementation call.

Same durability caveat applies and must be stated on every surface that
mentions it: snapshots do not outlive their box (box rm takes them all),
so this is an undo, not a backup — and a filesystem rollback cannot reach
off-box state (a tailnet device record, a runner registration), which is
rig#62's whole finding.

Blocked

On #128. This extends snapshot_pristine/storage_driver, which do not
exist until it lands, and whose shape can still change in review.

Refs

#104 (the parent), #128 (where it was deferred, with the argument),
heavy-duty/rig#62 (the rollback design parent)

Follow-up carved out of #104, at the explicit request of its PR (#128) so the deferred half is not lost when #104 closes. Child of heavy-duty/rig#62. ## What #104 shipped, and what it did not #104 asked for a `pristine` snapshot at mint and floated a second one: > Worth considering alongside: a second `bootstrapped` snapshot *after* a > successful hook, so an operator can get back to a converged-but-untouched > box without paying a re-mint. #128 implements `pristine` only, and argues the deferral rather than silently dropping it. Restating that argument here so this issue starts where that one left off: 1. **It is a different product.** `pristine` is a rollback *floor* — the one state that is definitionally clean, and the thing rig#62 asked for. `bootstrapped` is a convenience checkpoint: cheaper than a re-mint, but it competes with `box snapshot <box> <label>`, which already exists and which an operator can take at exactly the moment they care about. 2. **It has unresolved questions of its own** — the two below. 3. **It doubles the auto-snapshot count**, and therefore doubles the `dir`-backend disk objection that #128's driver detection exists to answer. Better to let that machinery be reviewed carrying one mark before it carries two. ## The two questions this issue has to settle **The blank-template asymmetry.** A `blank` box never runs the rig hook, so `bootstrapped` would exist on some boxes and not others. `pristine` deliberately avoids exactly this by being unconditional within a fresh mint. Either `bootstrapped` accepts the asymmetry and documents it, or it needs a story for what a hookless box gets — and "nothing" is a real answer, but it should be a chosen one. **The hand-re-run case, which is the sharper one.** When the hook fails, `cmd_new`'s failure message tells the operator to fix it via `box shell`. Nothing re-takes the mark afterwards — so `bootstrapped` would be absent precisely on the boxes whose convergence was interesting enough to need intervention. A mark that is reliably missing on the interesting cases is worse than no mark, because its presence elsewhere implies a coverage it does not have. ## Shape `box: mark 'bootstrapped' after a successful rig hook` — taken after the `[ -n "$T_BOOTSTRAP_ROLE" ]` block succeeds, reusing `snapshot_pristine`'s `storage_driver` detection, its `BOX_SNAPSHOT_*` opt-out shape, and its never-fatal contract. The helper #128 adds is deliberately close to reusable; whether it generalises cleanly or wants a second function is an implementation call. Same durability caveat applies and must be stated on every surface that mentions it: snapshots do not outlive their box (`box rm` takes them all), so this is an undo, not a backup — and a filesystem rollback cannot reach off-box state (a tailnet device record, a runner registration), which is rig#62's whole finding. ## Blocked On #128. This extends `snapshot_pristine`/`storage_driver`, which do not exist until it lands, and whose shape can still change in review. ## Refs #104 (the parent), #128 (where it was deferred, with the argument), heavy-duty/rig#62 (the rollback design parent)