Serve central configuration to fleet members from a hand-edited,
hierarchical tree of JSON files. Editing redundant options in UI forms
was rejected as too tedious, so humans author the tree directly; because
options are shared, config is resolved by deep-merging from broad to
specific (global -> service_type -> cluster -> host, with the cluster
layer skipped for infra-scope members) so a value set once high in the
tree is inherited and only overridden where it differs.
Pulls never touch the filesystem. A loader parses the whole tree into an
immutable snapshot published by an atomic pointer swap, which keeps the
hot path allocation-light and lock-free and gives two guarantees while
the tree is being edited: a file caught mid-write fails to parse (or its
size/mtime changes across the read) so that scan is discarded and the
previous good snapshot keeps serving, and a broken edit therefore never
reaches running services -- they keep the last known-good generation
until the tree parses cleanly again.
The revision is an fnv-1a content hash of the merged result, so it
changes exactly when the config changes, needs no counter kept in sync
with the files, and fits both the config_revision INTEGER column and the
existing AckConfig(int64) handshake.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
