- let users disable automatic OTA merging for a sync or globally
- a sync can be set to manual, automatic or global default
- unapproved non-auto updates must be approved by the user
This adds a %kiln-change-source poke that changes the sync source
for all syncs from the given remote ship/desk to a new ship/source.
This poke works remotely iff it comes from the publisher, allowing
publishers to migrate app distribution.
A %kiln-change-publisher poke is also added to kiln which sends this out
to all desk subscribers with the let+1 %w %sing that %kiln uses.
+on-kroc was cluttered with ad-hoc logic to indentify stale flows from
failed resubscriptions that were not properly %corked. Here we move
that logic to a generator that, if not in dry mode, will call %ames with a
(list [ship bone]) to %cork them.
Another option would be to move the logic in the generator to a state
update in ames, which will trigger possibly thousands of %ames messages
to be sent, on every ship that runs the state migration—these flows are
not causing a problem that neds to be addressed, and only take extra
space.
If we decide that this needs to be run by everyone, one solution could be
to set up a timer (maybe taking advantage of the fact that ships don't get
the OTA a the same time) that will eventually poke %hood with a
%helm-ames-kroc task.
We were retrying failed kelvin upgrades as many times as we had apps
that needed to be suspended, because suspending an app triggers an
attempt to run the next kelvin upgrade. This suspends all those apps in
one batch move, and then tries the next kelvin upgrade only once at the
end.
Fixes#6407
Partially addresses #6285
This should no longer go into dill, but instead be controlled by drum
directly, since that's where system output gets rendered now (in the
common/default case).
