Reconcile loop

DonkeyFleet separates observation, policy, authorization, and mutation. Every run holds one PostgreSQL advisory lock; with multiple replicas, only the lock holder reconciles.

Triggers and cadence

Trigger	Default	Purpose
Scheduled reconcile	5m	Full inventory, policy evaluation, drift, and baseline monitoring
Approval or policy change	Immediate, coalesced	Re-observe and evaluate without waiting for the schedule
Active provisioning follow-up	15s	Advance persisted create-volume and create-relationship checkpoints safely

The fast follow-up is not a shortcut around Observe. It acquires the same lock, reads complete state, checks the stored ONTAP job, and advances only after the previous step is proven complete. After initialize is accepted, the long baseline returns to the normal five-minute observation cadence.

This means a queue does not wait five minutes between destination-volume creation, relationship creation, and initialization. Baseline admission remains controlled separately by max_concurrent_initializes and intercluster_budget_kbps.

Complete observation

Pagination is driven to exhaustion. Any non-success response, pagination failure, or mismatch with ONTAP's record count aborts the run as skipped_observe_incomplete. DonkeyFleet never evaluates a partial fleet as complete.

Transition-based plans

Plan items represent meaningful changes, not reconcile frequency. Repeated observation of the same entity, action, and reason increments occurrences. No-op results are not persisted.

Baseline serialization

The default maximum concurrent initialization count is one. Raising it permits more baselines only when their estimated throttles fit the automation profile's intercluster budget. Destination volume and relationship preparation can overlap within max_actions_per_run; initialization is the bandwidth-heavy gate.