Implement plan §13.5 two-phase settings broadcast with verification and
drift reconciler background worker to close the correctness hole for
partial settings applies.
**Changes:**
- Add two-phase settings broadcast: propose (PATCH all nodes in parallel),
verify (GET settings, verify SHA256 fingerprints match), commit
(increment cluster-wide settings_version)
- Add drift reconciler background task: runs every 5 minutes (configurable),
hashes each node's settings and repairs mismatches via Mode B leader
election for horizontal scaling
- Add client-pinned freshness: X-Miroir-Min-Settings-Version header
excludes nodes with settings version below floor; returns 503
miroir_settings_version_stale if no covering set can be assembled
- Add covering_set_with_version_floor() to router for version-filtered
planning
- Add node_settings_version table to task store for persistent version
tracking per (index, node_id) pair
- Add settings broadcast metrics: miroir_settings_broadcast_phase,
miroir_settings_hash_mismatch_total, miroir_settings_drift_repair_total,
miroir_settings_version
- Add legacy strategy: sequential mode for rollback compatibility
**Acceptance:**
- Normal flow: add a synonym; both propose + verify succeed;
settings_version increments exactly once
- Mid-broadcast node failure: phase 2 verify fails on one node →
reissue succeeds after backoff; alert not raised
- Out-of-band drift: PATCH a node directly → drift reconciler detects
within interval_s and repairs
- X-Miroir-Min-Settings-Version floor excludes stale nodes from
covering set; returns 503 when no floor-satisfying covering set exists
- Legacy strategy: sequential still works for rollback compatibility
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
64b436f085