The MannaLedger counted the day's consumption in memory. A restart
forgot it, and the next cycle gathered the same day's provision whole.
While manna was an emptyDir that took the kohen's hand; with the
provision on a volume (41a3e51) a crash loop alone would have refilled
the jar, once per crash. Ish l'fi ochlo — Shemot 16:18.
- After every cycle that eats, the day's consumption is written to
ledger.json beside the provision file (tmp + rename; on the manna
volume in production).
- A process that starts while today's record is on disk takes the day
up at once (handle_continue), so /kodesh/status never shows an
untouched jar that is half eaten; otherwise the first load of the day
resumes from it.
- Another day's record is ignored. A record that is not a ledger
(bad JSON, negative or non-integer counts) is ignored with a warning.
The record can only reduce what remains.
- At the day boundary the record goes with the surplus. A release
within the same day (the late-provision re-gather) lets go of the
allocation and keeps the record.
- If the file cannot be written the ledger says so and keeps counting
in memory; the cycle is not stopped by its own bookkeeping.
- MannaLedger.reset/0 (tests) forgets the record; test_helper clears
any record an interrupted run left behind.
test/manna_ledger_persistence_test.exs — 13 tests, restarting the
ledger under its real supervisor. All fail without the change.
Read before committing: Elixir 474/0 on seeds 0 7 42 99 191243. Built
image, real container restarts against a mounted manna directory:
3 of 5 units eaten → restart → status shows 3 before any request →
2 more served, the 6th refused → restart → still refused.
Found while writing the tests, not changed: killing the ledger more
than three times in five seconds takes the whole application down (OTP
restart intensity, one_for_one defaults). On the pod that is a
container restart — which now resumes the day instead of refilling it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
