Update policy

A deployment without a module source gets a new self-pin of api only at its next deploy (see Default-source baseline freeze). The update policy tells who starts that deploy (FR-014 and FR-015 of 001):

• manual (the default): the operator, with a submit.
• automatic: api, when it finds a new default source.
• window: api, in a daily, weekly or monthly maintenance window that opens at a local time in an IANA time zone and stays open for 15 to 1440 minutes.

api does not know whether a deployment follows the default source, because the row keeps the concrete source of each deploy. Thus a policy other than manual applies only to the default source, and a submit with an explicit source is refused while the policy is not manual.

At regular intervals, api submits the stored configuration again without a source, for each due deployment that is active, not suspended, and whose last successful source is not the default. It tries each default source once, also when the try fails, so that a broken revision does not cause a loop; a new policy allows a new try. Each try is an audit event with no actor. A build without a self-pin starts no update.

Keep the deployed revision

A submit and a preview can ask to keep the deployed revision (FR-016 of 001). Then a submit without a source uses the source of the last successful deploy: it changes the configuration but not the revision. Without such a deploy, or with an explicit source, the request has no effect. A policy other than manual still updates the deployment later.