As the owner of a change-safety standard, what evidence would you require before any broker cluster node is stopped for maintenance?

## What makes a standard a control rather than a wish Most restart standards fail the same way: they are prose. Prose is read once, by the person who wrote the script, and thereafter the script is the standard. So the first design rule is that every requirement must be something a tool can evaluate and refuse on. If a clause cannot be expressed as a precondition, it is guidance, and it should be labelled as such so nobody mistakes it for protection. ## The evidence to require before any stop 1. **No unit of ownership is short of its expected current copies**, evaluated cluster-side and freshly, including units this node merely holds a copy of rather than serves. 2. **The previous step has been paid back** - the copies of the node restarted last are back in the caught-up set - rather than a fixed interval having elapsed. 3. **The view the check read is fresh**, so that a check run immediately after a stop cannot pass on a picture from before it. 4. **The stop is scoped**: which node, which units it holds, and what the expected exposure is if the step goes badly. The first two are the whole of the safety; the last two stop the first two being satisfied vacuously or blindly. ## Where the authority sits | decision | who should hold it | why | |---|---|---| | whether the gate passed | the tool, from cluster-side state | a human judging it re-introduces the guess the gate replaced | | waiving a gate that will not pass | someone other than the operator running the change | the person under time pressure is the worst placed to weigh the risk | | proceeding while a unit is permanently short | nobody, without fixing the shortage first | a gate that can never pass is a defect report, not an obstacle | | accepting the risk for a stream that tolerates loss | the stream's owner, recorded in advance | it is their data, and the decision should predate the incident | ## What to do about the clause everyone wants Every standard eventually meets the night the gate will not pass and the maintenance must happen anyway - an expiring certificate, a host being reclaimed, a security patch with a deadline. Refusing to write an exception does not remove it; it just means the exception is taken informally at 2am. Write it down instead: - the exception names the units that will be exposed and for roughly how long; - it is authorised by someone not executing the change; - it is recorded where an incident review will find it; - and it expires - it authorises this maintenance, not this script forever. ## The structural questions behind the standard A standard is a workaround for a cost, so it is worth asking what would remove the cost: - **Would detached storage remove the wait?** Where records live on shared or remote storage, a returning node has little to re-fetch, and the whole class of exposure shrinks. That is an estate-level architectural choice with its own costs - latency, dependence on a storage service - but it is the only answer that makes the gate cheap rather than merely enforced. - **Is the restart necessary at all?** Some maintenance is a setting change that does not need a process bounce; separating those from the ones that do shortens the loop and the exposure. Where and how settings change without a restart is its own subject. - **Is the redundancy right?** A cluster that keeps just enough copies to survive one loss cannot survive a maintenance loop with any margin. The standard may be telling you the copy count is too low for the operational tempo. - **Is the same shape running elsewhere?** Any tool that walks a set of nodes - patching, reprovisioning, re-imaging hosts - has the same risk. A standard that covers only the maintenance script covers one of several paths to the same loss. ## The one-line version The standard's job is to make the last current copy of every unit of ownership something that no routine procedure can remove by accident. Everything it requires should be traceable back to that sentence, and anything that cannot be is documentation rather than control.