253eb44b

By: Tom Sydney Kerckhove <syd@cs-syd.eu>

Everything the review found

A half that is not there was read as a half that is empty, so a mistyped
path would have reset the router into the first half and reported success.
Missing, empty and has-content are three things now, and the first is
fatal.

settle held one session for the whole wait, right after a reboot, and any
read failure aborted the deployment after the import had succeeded. It
connects per attempt now and counts a failed read as one of the ways of
not having settled. Both waits are indefinite: every deadline here was a
guess about how long a router takes to come back, and one firing half way
through a deployment is worse than waiting.

apply had no test at all. Its parts were covered and its orchestration was
not, though it is the only thing that ever runs against a router anybody
owns. Two now: the whole of it end to end, checking the record has all
three files, and a refusal to deploy when half of the configuration is
missing.

Every unwrap on the way to or from a router is a message and an exit code
now rather than a panic and a backtrace, and the reads inside an import
are reported rather than fatal, since a read that fails says nothing about
whether the import ran.

The anycast check only knew the literal ::, so ::0 and 0:0:0:0:0:0:0:0
went through. The example covers all three spellings.

The test harness told a router to stop without allowing for it already
being gone, which would have replaced a real failure with a broken pipe.
And a port chosen by letting go of one can be taken before qemu binds it,
which is indistinguishable from a router that would not boot, so both are
answered by trying again somewhere else.

apply names the command that finishes a half-applied deployment, the way
it already named the one that fixes a stale record.