diff --git a/docs/operator-community-deletion.md b/docs/operator-community-deletion.md index 9ddb5dc21d..d4689006d5 100644 --- a/docs/operator-community-deletion.md +++ b/docs/operator-community-deletion.md @@ -157,11 +157,15 @@ current `status` at any stage, including after membership purge, and admits no new work. Clients recover an ambiguous submission by resending it. The same UUID with a different tuple returns `409 deletion_request_conflict`. -The acknowledgement version is validated before the UUID lookup, so resend -recovery only works while the relay still accepts the version the request was -made under. Retiring a version makes resends of pending requests created under -it fail with `400 unsupported_acknowledgement_version`; keep the old version -accepted for replay until no client can hold a pending request made with it. +The acknowledgement version is a compile-time constant +(`OWNER_DELETION_ACKNOWLEDGEMENT_VERSION`), not operator configuration. +Admission validates it before the UUID lookup, and the executor claims and +leases only requests carrying the current version. Raising it therefore makes +resends of pending requests made under the old version fail with +`400 unsupported_acknowledgement_version`, and leaves already-admitted +old-version requests unclaimed in `submitted`. A version bump must ship code +that keeps admitting replays of, and executing, requests at the prior version +until none remain in a non-terminal stage. ## Owner quota