Land the Geo disaster-recovery paths, and reconcile them with per-pair state
What
Twenty commits of Geo disaster-recovery work that have been sitting on a local
branch since 1 August, plus a merge of main to reconcile them with the
per-pair state change that landed after them.
Why now
The branch existed only on one machine. It was found during a durability sweep, not by anyone looking for it, and twenty commits with no remote is one disk failure from gone. Nothing about the work is provisional: it is the archetype reaching the disaster-recovery states that no documented setup path reaches.
What is in it
| Area | Change |
|---|---|
| DR paths | rebuild-secondary, prefer-probe, bring-primary-back, and the mixed-backend probe: the states a customer runbook actually passes through |
| Probes | backend-matrix and notification-401 probes, plus fixes making the two registry probes able to measure what they claim |
| Correctness | geo_run_detached discarded every detached run's exit status; bring-primary-back swapped two of three role pairs and stopped the new primary; a second concurrent detached run on one site is now refused |
| Gates | a licensed secondary answers sign_in with 302 and the readiness gate demanded 200; the license gate's own suggested remedy could not be run, and up was not resumable |
| Hygiene | the secrets census wrote its artifacts into the checkout |
Several of those are the same shape: a step that reported success while doing nothing, or a probe that returned a verdict from an invalid run.
The merge
Two conflicts, both additive, both resolved by keeping each side.
geo.sh: the dispatcher and the usage block each gained a subcommand at the
same line, bring-primary-back from this branch and list from the per-pair
work already on main. They do not interact.
SKILL.md: the same shape in the Geo command block, plus one detail that would
have gone wrong quietly. This branch said "Three things to know before running
it" and main said "Four", because the per-pair merge added the pair-isolation
bullet. The combination kept is this branch's DR prose with main's count, and
the list under it does number four.
Testing
just ci and just sims-check both pass after the resolution, including the
description-hash gate, which confirms SKILL.md's frontmatter description is
unchanged and no fire-test re-record is needed.
The twenty commits themselves were written against a live 19.2.1 two-site run in late July; I did not re-run that lab for this merge, and the merge changes no behaviour beyond the two kept lines.
Review plan
Held open deliberately. An adversarial review pass runs against this branch before it merges.