Safety model

DonkeyFleet treats safety requirements as executable boundaries, not operator reminders.

Non-negotiable invariants

1. Source-role clusters are read-only. All mutating clients are guarded by destination role.
2. Identity is the volume UUID. A reused name with a new UUID is never treated as the same volume, and is never auto-remediated. A replacement is detected automatically and surfaced as source_replaced drift for operator review, never as an orphan.
3. Partial observation stops the run. Failed requests, unfinished pagination, and record-count mismatches produce skipped_observe_incomplete.
4. Adopted and suspended relationships are structurally excluded from mutating queries.
5. Intent is persisted before ONTAP work. Long-running ONTAP job UUIDs are persisted and polled; unresolved jobs are never blindly re-issued.
6. Initializations are serialized. The default concurrent-baseline limit is one, and the bandwidth budget is checked.
7. Deletion always requires a person. Orphans never auto-delete.
8. Apply is gated by effective dry-run. The one-way emergency stop wins over configuration and the UI override.
9. Ambiguity is a refusal. Colliding destination names, ambiguous aggregates, and a missing named schedule produce an actionable skip instead of a guess.

Approval is not execution

Approval records authorization and the expected action payload. The reconcile loop re-checks the current volume UUID, policy, destination, and guardrails before executing.

Read the indicators correctly

An initializing baseline can remain uninitialized and unhealthy for many hours. This is expected while the ONTAP job is still active; it is not the same state as suspended.