# Pod boot the order is the product

**🔵 Expert · Lesson 01**

BOOTING A POD. Advanced 17-18 taught checkpoint and load as two verbs you call yourself. This is the operator's version: one entry point that runs the whole restart flow in a fixed sequence.

melder's own contract line is the lesson title:

"Contract (the ORDER is the product)"

Read that as a claim, because it is one. Every step below is something you could call by hand. The value CrystallizerBootstrap adds is not the calls - it is that they happen in THIS order, and the order encodes reasoning you would otherwise have to rediscover after a bad restart.

THE SEVEN STEPS 1. Activate the crystallizer (the persistence system comes up with it). 2. Attach the external manager, when one is configured. 3. Reload the profile's LOCAL cache. An empty cache is tolerated. 4. Pull the profile's REMOTE history when enabled AND a manager is attached - then RE-FLUSH the pulled ids so the local cache actually holds them. 5. Pull REMOTE FORMATIONS (mesh-aware boot). Default-on when the attached manager carries the generic fetch+list lanes; legacy-only managers skip SILENTLY. 6. Verify the chain. "broken" REFUSES loudly; anything else rides the report. 7. Load the most recent checkpoint by EXACT LEDGER INSERTION ORDER - not by timestamp.

WHY THE ORDER IS LOAD-BEARING Local before remote (3 before 4) means a pod that cannot reach the network still boots on what it has. The re-flush inside step 4 is the part people miss: pulling remote history does not by itself put it in the local cache, so a pod that pulled and then lost the network would have come back empty. Verify (6) sits BEFORE load (7) so a broken chain refuses instead of half-restoring a world. And insertion order rather than timestamp in step 7 means two checkpoints written in the same second still have one answer.

THE TWO REFUSAL SHAPES, BOTH DELIBERATE BROKEN CHAIN -> RuntimeError. Loud. There is no correct partial restore of a broken lineage. NO HISTORY AT ALL-> boots an EMPTY WORLD, `restored_checkpoint_id` is None. A first boot is not an error. That distinction is the whole difference between "nothing to restore" and "the thing I was going to restore is damaged", and melder refuses to collapse them into one outcome.

IT IS ONE-SHOT. bootstrap() consumes the object; calling it twice raises. Same law as AetherConfigurationBuilder.build() (advanced 07) and create_rift() consuming its configuration (advanced 09).

## Before you run

Use the [Expert guide](../../expert/index.md) for prerequisite concepts. Run from a checkout with Melder installed and Python 3.14 free-threading selected. The collection download includes the level's local helper modules.

## Run the saved script

```bash
python UX_and_AIX_experiences/04_expert/01_pod_boot_the_order_is_the_product.py
```

```powershell
py -3.14t UX_and_AIX_experiences/04_expert/01_pod_boot_the_order_is_the_product.py
```

{download}`Download this collection <../../downloads/expert-examples.zip>` · [Source on GitHub](https://github.com/Synaptic724/melder/blob/0895ce795453cd87e35d70665957b4e89aad3317/UX_and_AIX_experiences/04_expert/01_pod_boot_the_order_is_the_product.py)

## Public surface

md.CrystallizerBootstrap - with_profile,
                   with_pull_remote, with_formation_reload,
                   with_preflight_gate, bootstrap

## Code

```{literalinclude} ../../downloads/04_expert/01_pod_boot_the_order_is_the_product.py
:language: python
:linenos:
```

## Check the outcome

The script contains its own assertions or demonstrated refusal paths. Run it to evaluate those checks against your installed version. The code above is taken directly from the saved file; no run output is invented here.

[More expert examples](index.md) · [Level guide](../../expert/index.md)

## Related guides

- [Restore and cold boot](../../expert/restore.md)

## API contracts

- [CrystallizerBootstrap](../../reference/api/persistence/crystallizerbootstrap.md)