fix(site-runtime): deployment whose Instance Actor dies during init reports Failed, exactly-once reply (S6)

Success now requires BOTH persistence commit AND an InstanceActorInitialized
readiness signal from the actor's PreStart — persistence can commit before the
actor's async init has run or failed, so persistence alone must not report
Success. An actor that dies during init never signals readiness; the Terminated
fallback fails that deployment and rolls back the optimistic state. The
persisted-row rollback is deferred until the store commits so it cannot race the
optimistic write.

Deviation from plan Task 15: the plan's swallow-only guard did not handle the
persistence-first ordering (empirically the store commits before the Terminated
signal, so Success was reported for a dead actor). Added the readiness handshake
to make the join deterministic.
This commit is contained in:
Joseph Doherty
2026-07-09 00:33:40 -04:00
parent db5ad02cc9
commit 957db62df1
4 changed files with 237 additions and 18 deletions
@@ -262,6 +262,12 @@ public class InstanceActor : ReceiveActor
// Subscribe to DCL for data-sourced attributes
SubscribeToDcl();
// Init succeeded — tell the Deployment Manager so it can confirm the
// deployment (S6). If any step above throws, PreStart aborts before this
// line and the actor is stopped with ActorInitializationException instead,
// so the DM never sees a readiness signal for an instance that failed to init.
Context.Parent.Tell(new InstanceActorInitialized(_instanceUniqueName));
}
/// <inheritdoc />