feat(cluster): planned-failover control plane -- POST /cluster/stepdown (BACKLOG #1494) - #1004

Merged

wshallwshall merged 21 commits into

mainfrom

claude/manager-424d8b

Sep 10, 2026

Commits on Sep 10, 2026

feat(cluster): lift the voluntary lease release into a public stepdown seam

wshallwshall
and
claude
committed
e818930
feat(api): POST /cluster/stepdown, the planned-failover control plane (BACKLOG #1494)

wshallwshall
and
claude
committed
8bd61af
docs(adr): record ADR 0056's real build state in the index row (BACKLOG #1494)

wshallwshall
and
claude
committed
75bba9c
fix(cluster): serialize the stepdown release against the maintenance tick (BACKLOG #1494)

wshallwshall
and
claude
committed
ae7f7b3
fix(cluster): a stepdown that did not drain must not report one (BACKLOG #1494)

wshallwshall
and
claude
committed
bbf5ccf
docs: repair the ADR 0056 records and file its three open subjects (BACKLOG #1494)

wshallwshall
and
claude
committed
a4eb7a7
fix(cluster): split the two stepdown refusals, and make the retry re-send the write (BACKLOG #1494)

wshallwshall
and
claude
committed
0ad58d1
docs: repair three ADR 0056 records that a reader would act on wrongly (BACKLOG #1494)

wshallwshall
and
claude
committed
cf7867f
fix(cluster): say what the stepdown actually does, and close the cancellation hole (BACKLOG #1494)

wshallwshall
and
claude
committed
e98a263
docs(security): re-measure the counting-basis split rather than pick a merge side (BACKLOG #1494)

wshallwshall
and
claude
committed
851a40f
docs(cluster): trace each stepdown sentence to the branch it quantifies over (BACKLOG #1494)

wshallwshall
and
claude
committed
193c7f1
test(cluster): carry the rotated bearer past /me/reauth in the stepdown suite

wshallwshall
and
claude
committed
788046f
docs(cluster): the three demote phases each bound a SHARE, not the whole budget (BACKLOG #1494)

wshallwshall
and
claude
committed
847451b
docs(cluster): carry the teardown correction into the two places that still shipped it (BACKLOG #1494)

wshallwshall
and
claude
committed
a540940
docs(api): name both coordinators that reach the release-unconfirmed raise

wshallwshall
and
claude
committed
904602e
docs(api): quote the renew predicate for both backends, not just Postgres

wshallwshall
and
claude
committed
f629648
docs(api): the stepdown 503 list is "at least", not an enumeration (BACKLOG #1494)

wshallwshall
and
claude
committed
3c3fe03
fix(cluster): re-arm the stepdown claim pause after the release write returns

wshallwshall
and
claude
committed
81ef876
fix(api): keep the stepdown refusal when its own audit write fails, and narrow the 503 discriminator

wshallwshall
and
claude
committed
86c1bff
docs(clustering): two stepdown sentences the code contradicts

wshallwshall
and
claude
committed
64f3f25
docs(cluster): a stepdown retry never answers 200, and retrying re-arms the pause (BACKLOG #1494)

wshallwshall
and
claude
committed
c6b9e33

Navigation Menu

Uh oh!

feat(cluster): planned-failover control plane -- POST /cluster/stepdown (BACKLOG #1494) - #1004

feat(cluster): planned-failover control plane -- POST /cluster/stepdown (BACKLOG #1494)#1004
wshallwshall merged 21 commits into
mainfrom
claude/manager-424d8b

Commits on Sep 10, 2026

feat(cluster): lift the voluntary lease release into a public stepdown seam

feat(api): POST /cluster/stepdown, the planned-failover control plane (BACKLOG #1494)

docs(adr): record ADR 0056's real build state in the index row (BACKLOG #1494)

fix(cluster): serialize the stepdown release against the maintenance tick (BACKLOG #1494)

fix(cluster): a stepdown that did not drain must not report one (BACKLOG #1494)

docs: repair the ADR 0056 records and file its three open subjects (BACKLOG #1494)

fix(cluster): split the two stepdown refusals, and make the retry re-send the write (BACKLOG #1494)

docs: repair three ADR 0056 records that a reader would act on wrongly (BACKLOG #1494)

fix(cluster): say what the stepdown actually does, and close the cancellation hole (BACKLOG #1494)

docs(security): re-measure the counting-basis split rather than pick a merge side (BACKLOG #1494)

docs(cluster): trace each stepdown sentence to the branch it quantifies over (BACKLOG #1494)

test(cluster): carry the rotated bearer past /me/reauth in the stepdown suite

docs(cluster): the three demote phases each bound a SHARE, not the whole budget (BACKLOG #1494)

docs(cluster): carry the teardown correction into the two places that still shipped it (BACKLOG #1494)

docs(api): name both coordinators that reach the release-unconfirmed raise

docs(api): quote the renew predicate for both backends, not just Postgres

docs(api): the stepdown 503 list is "at least", not an enumeration (BACKLOG #1494)

fix(cluster): re-arm the stepdown claim pause after the release write returns

fix(api): keep the stepdown refusal when its own audit write fails, and narrow the 503 discriminator

docs(clustering): two stepdown sentences the code contradicts

docs(cluster): a stepdown retry never answers 200, and retrying re-arms the pause (BACKLOG #1494)