Require Explicit Containerlab Recovery Authority on Topology Drift¶

Status¶

Accepted: When the verified Containerlab recovery topology differs from the current controller source, deployment must select one authority explicitly.

Context¶

A retained recovery set and the current controller definition can identify different topology states. After preservation, controller intent may change before reconstruction. Automatically choosing either source can replay stale state or discard an intentional change.

Decision¶

The runtime compares the retained topology identity with the declared controller source before recovery. If they differ:

interactive execution asks the operator to choose;
unattended execution requires --restore-labs for the archive or --skip-lab-restore for the controller source;
active-lab replacement requires the separate --overwrite-labs authority.

The selected authority is retained through final dispatch so later input resolution cannot silently reverse the choice.

Consequences¶

Positive¶

Topology drift becomes an operator decision rather than hidden precedence.
Recovery and normal convergence remain distinguishable.
The run record states which source governed reconstruction.

Negative¶

Unattended deployment stops until authority is explicit.
Operators must understand whether retained runtime state or current source is the intended recovery point.

Alternatives considered¶

Always prefer the archive: rejected because it can replace a deliberate controller update.
Always prefer the controller: rejected because it can discard verified recovery state.