[shipmill-romamo]

Summary

Parts 1 and 3 of #144.

A failed pg_hba.conf reload is no longer forgotten. When the check or pg_reload_conf() failed, the rescue removed the Cloudfall block and stopped; the next converge saw an unchanged file and never reloaded, so PostgreSQL kept the old hostssl lines live until a restart. The rescue now writes a marker, {{ cloudfall_postgresql_state_directory }}/<service id>.pg_hba-reload-pending (new role default /var/lib/cloudfall/postgresql, root 0700, file 0600), before it touches the file. The check and reload run when the block changed or the marker exists, and the marker is removed once the reload returns t. A run with neither a change nor a marker stays unchanged. The marker is per service id, so two PostgreSQL services on one host never share it. Check mode stays as before: the stat runs, the check, reload and marker removal are skipped.

Keyword names refused at validate. cloudfall config validate now refuses an owned database (or its owner) named all, sameuser, samerole, samegroup or replication when the service declares remoteAccess, as CONFIG_INVALID with code service_remote_access_name_reserved and the field path of the database's name or owner. The role keeps its own guard as the second layer. Without remoteAccess the names still validate. Spec 006's prose and S-006-11 list the new code.

Part 2 of the issue (removing a whole Service leaves the block and listener) moved to #146.

Test plan

• engine/tests/test_postgresql_remote_access.py: the stand-in psql can fail the reload; new tests run the real block on localhost: a failed reload on removal writes the marker, a later converge with an unchanged file reloads and clears it, a third converge reloads nothing and reports changed=0; a pg_hba.conf PostgreSQL cannot read also leaves the marker
• sdk/tests/test_owned_postgresql.py: each keyword as a database name and as an owner is refused with service_remote_access_name_reserved and the right field; the same names without remoteAccess validate
• uv run ruff check ., uv run mypy, uv run cloudfall config validate --project config/examples pass; uv run pytest on the three touched test files (SDK and engine) passes, 80 tests
• uv run ansible-lint engine/ansible passes when run from engine/ansible (where its ansible.cfg sets roles_path); from the repo root of this agent worktree it reports role-not-found syntax errors in five untouched playbooks, an environment issue of the worktree path, so CI's run is the authority
• The full suite is left to CI

Fixes #144

🤖 Generated with Claude Code