On this page
Pod boot the order is the product๏
๐ต Expert ยท Lesson 01
BOOTING A POD. Advanced 17-18 taught checkpoint and load as two verbs you call yourself. This is the operator's version: one entry point that runs the whole restart flow in a fixed sequence.
melder's own contract line is the lesson title:
"Contract (the ORDER is the product)"
Read that as a claim, because it is one. Every step below is something you could call by hand. The value CrystallizerBootstrap adds is not the calls - it is that they happen in THIS order, and the order encodes reasoning you would otherwise have to rediscover after a bad restart.
THE SEVEN STEPS 1. Activate the crystallizer (the persistence system comes up with it). 2. Attach the external manager, when one is configured. 3. Reload the profile's LOCAL cache. An empty cache is tolerated. 4. Pull the profile's REMOTE history when enabled AND a manager is attached - then RE-FLUSH the pulled ids so the local cache actually holds them. 5. Pull REMOTE FORMATIONS (mesh-aware boot). Default-on when the attached manager carries the generic fetch+list lanes; legacy-only managers skip SILENTLY. 6. Verify the chain. "broken" REFUSES loudly; anything else rides the report. 7. Load the most recent checkpoint by EXACT LEDGER INSERTION ORDER - not by timestamp.
WHY THE ORDER IS LOAD-BEARING Local before remote (3 before 4) means a pod that cannot reach the network still boots on what it has. The re-flush inside step 4 is the part people miss: pulling remote history does not by itself put it in the local cache, so a pod that pulled and then lost the network would have come back empty. Verify (6) sits BEFORE load (7) so a broken chain refuses instead of half-restoring a world. And insertion order rather than timestamp in step 7 means two checkpoints written in the same second still have one answer.
THE TWO REFUSAL SHAPES, BOTH DELIBERATE BROKEN CHAIN -> RuntimeError. Loud. There is no correct partial restore of a broken lineage. NO HISTORY AT ALL-> boots an EMPTY WORLD, restored_checkpoint_id is None. A first boot is not an error. That distinction is the whole difference between "nothing to restore" and "the thing I was going to restore is damaged", and melder refuses to collapse them into one outcome.
IT IS ONE-SHOT. bootstrap() consumes the object; calling it twice raises. Same law as AetherConfigurationBuilder.build() (advanced 07) and create_rift() consuming its configuration (advanced 09).
Before you run๏
Use the Expert guide for prerequisite concepts. Run from a checkout with Melder installed and Python 3.14 free-threading selected. The collection download includes the level's local helper modules.
Run the saved script๏
python UX_and_AIX_experiences/04_expert/01_pod_boot_the_order_is_the_product.py
py -3.14t UX_and_AIX_experiences/04_expert/01_pod_boot_the_order_is_the_product.py
Public surface๏
md.CrystallizerBootstrap - with_profile, with_pull_remote, with_formation_reload, with_preflight_gate, bootstrap
Code๏
1"""
2TIER: expert (01)
3GOAL: BOOTING A POD. Advanced 17-18 taught checkpoint and load as two
4 verbs you call yourself. This is the operator's version: one entry
5 point that runs the whole restart flow in a fixed sequence.
6
7 melder's own contract line is the lesson title:
8
9 "Contract (the ORDER is the product)"
10
11 Read that as a claim, because it is one. Every step below is
12 something you could call by hand. The value CrystallizerBootstrap
13 adds is not the calls - it is that they happen in THIS order, and
14 the order encodes reasoning you would otherwise have to rediscover
15 after a bad restart.
16
17 THE SEVEN STEPS
18 1. Activate the crystallizer (the persistence system comes up
19 with it).
20 2. Attach the external manager, when one is configured.
21 3. Reload the profile's LOCAL cache. An empty cache is tolerated.
22 4. Pull the profile's REMOTE history when enabled AND a manager
23 is attached - then RE-FLUSH the pulled ids so the local cache
24 actually holds them.
25 5. Pull REMOTE FORMATIONS (mesh-aware boot). Default-on when the
26 attached manager carries the generic fetch+list lanes;
27 legacy-only managers skip SILENTLY.
28 6. Verify the chain. "broken" REFUSES loudly; anything else rides
29 the report.
30 7. Load the most recent checkpoint by EXACT LEDGER INSERTION
31 ORDER - not by timestamp.
32
33 WHY THE ORDER IS LOAD-BEARING
34 Local before remote (3 before 4) means a pod that cannot reach the
35 network still boots on what it has. The re-flush inside step 4 is
36 the part people miss: pulling remote history does not by itself put
37 it in the local cache, so a pod that pulled and then lost the
38 network would have come back empty. Verify (6) sits BEFORE load (7)
39 so a broken chain refuses instead of half-restoring a world. And
40 insertion order rather than timestamp in step 7 means two
41 checkpoints written in the same second still have one answer.
42
43 THE TWO REFUSAL SHAPES, BOTH DELIBERATE
44 BROKEN CHAIN -> RuntimeError. Loud. There is no correct
45 partial restore of a broken lineage.
46 NO HISTORY AT ALL-> boots an EMPTY WORLD, `restored_checkpoint_id`
47 is None. A first boot is not an error.
48 That distinction is the whole difference between "nothing to
49 restore" and "the thing I was going to restore is damaged", and
50 melder refuses to collapse them into one outcome.
51
52 IT IS ONE-SHOT. bootstrap() consumes the object; calling it twice
53 raises. Same law as AetherConfigurationBuilder.build() (advanced 07)
54 and create_rift() consuming its configuration (advanced 09).
55SURFACE EXERCISED: md.CrystallizerBootstrap - with_profile,
56 with_pull_remote, with_formation_reload,
57 with_preflight_gate, bootstrap
58VERIFY: RUN GREEN 2026-08-03 on the owner's 3.14t harness.
59"""
60import melder as md
61
62
63REPORT_KEYS = (
64 "activated",
65 "profile_name",
66 "cache_reload",
67 "remote_reload",
68 "formation_reload",
69 "chain_report",
70 "restored_checkpoint_id",
71 "restore_report",
72)
73
74
75def main() -> None:
76 # THE FLUENT SETUP. Every with_* returns self, like every other
77 # configuration surface in melder.
78 boot = md.CrystallizerBootstrap()
79 assert boot.with_profile("expert-pod") is boot
80 assert boot.with_pull_remote(False) is boot
81 assert boot.with_formation_reload(False) is boot
82 assert boot.with_preflight_gate(True) is boot
83 print("boot staged for profile 'expert-pod'")
84
85 # No external manager attached, no remote pull requested - so steps 2,
86 # 4 and 5 have nothing to do. This is the offline restart case, and it
87 # is the one that must work when everything else is on fire.
88 report = boot.bootstrap()
89 assert isinstance(report, dict)
90 print("bootstrap ran; report keys:", len(report))
91
92 # THE REPORT IS THE RECORD. Every step reports, including the ones
93 # that did nothing - a None is "this step was not applicable", which
94 # is different from the key being absent.
95 for key in REPORT_KEYS:
96 assert key in report, f"{key} missing from the bootstrap report"
97 print(f" {key:24s} {report[key]!r}"[:88])
98
99 assert report["activated"] is True
100 assert report["profile_name"] == "expert-pod"
101
102 # A HISTORY-LESS PROCESS BOOTS AN EMPTY WORLD. Not an error - there
103 # was simply nothing to restore. This is the FIRST BOOT case.
104 print()
105 print("restored checkpoint:", report["restored_checkpoint_id"])
106 print("first boot restores nothing, and that is not a failure")
107
108 # Steps that had no work report None rather than a fake summary.
109 assert report["remote_reload"] is None, "no manager attached"
110 assert report["formation_reload"] is None, "formation reload disabled"
111 print("skipped steps reported None, not an invented summary")
112
113 # ONE-SHOT. The object is consumed by the run.
114 try:
115 boot.bootstrap()
116 raise AssertionError("expected a refusal - bootstrap is one-shot")
117 except RuntimeError as error:
118 print()
119 print("second bootstrap refused:", type(error).__name__)
120
121 print()
122 print("the ORDER is the product - local before remote, verify before load")
123 print("broken chain REFUSES; no history at all boots empty. not the same.")
124
125
126if __name__ == "__main__":
127 main()
Check the outcome๏
The script contains its own assertions or demonstrated refusal paths. Run it to evaluate those checks against your installed version. The code above is taken directly from the saved file; no run output is invented here.