The Code It Runs
Written later and filed to this date, as part of filling in every day of the year.
A console on the box served an error on every request for a day. It had started the day before; since then, other work had added a field to the ledger rows it reads, and the reader it loaded at start rejected them. A survey the same day found twelve of eighteen long-running services on code older than their own repository, the oldest by 456 hours. Some were still running an authentication branch that a fix had made fail closed weeks earlier. Their tokens happened to be set, so nothing was open, but the fix had never taken effect.
The obvious remedy is to restart a service when its repository moves. That remedy would restart everything all day, because most commits here are notes, plans and journals written by agents. So the reloader had to answer a narrower question, whether the code this process runs has changed since it started, and every part of that phrase turned out to need a ruling.
Whether: the diff between the commit the process started on and the current head, minus the paths that cannot change a running server: documents, state files, tests, agent and CI configuration. Whose: a service is registered once for every repository whose code it loads, not once for the repository it lives in. The fleet console imports the dispatch code from another repository, lazily, at the first press of its button, and then holds it for the life of the process, so the code it served depended on when someone last pressed a button. A fix to the dispatch lock could not reach the console the bug had broken until that second registration existed. A dozen services import one shared credential check in-process, and each now carries a row for it. Which files: one service’s own research pass commits a data file most days, and under the default rule that file would read as code and bounce a public page daily, so its row watches source, binaries and manifests and nothing else.
The cost of getting a row wrong is quiet. One fix landed fifty-three seconds after a service that imports it had last restarted, and sat in the repository, unloaded, for thirty-six hours.
The code it runs: not the repository a service lives in, and not every file git says changed, but the files the running process actually loaded, from wherever they came.