From 0f9b29a19adbe2d58ef5a2fbecde62afc4286e64 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 21 Jul 2026 09:31:17 +0200 Subject: [PATCH] docs(report): correct two overstated claims; 30-min check passed clean; doc rows flipped --- REPORT.md | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/REPORT.md b/REPORT.md index 00d5703..861da77 100644 --- a/REPORT.md +++ b/REPORT.md @@ -9,7 +9,7 @@ Session date: **2026-07-21**. Executed on DooPlex as `kisfenyo`. | **Part 1 — R-48 restore wizard (v0.154.0)** | **SHIPPED** `3a9d744`, image published, deployed via the floor save. | | **v0.155.0 — follow-up fix** | **SHIPPED + DEPLOYED** `9d1b498`. Fixes a real defect in v0.154.0 found by the operator on the first live click-through. | | **Part 2 — capability-map cell** | **DONE** `ce8c539`. | -| **STOP-1 — floor save + single-fire** | **BANKED.** Exactly one swap, no rollback, healthy. §6. | +| **STOP-1 — floor save + single-fire** | **BANKED.** Exactly one swap over a 39-min window, no rollback, healthy. §6. Doc rows flipped `11ead4b`. | | **Live click-through + Ellenőrzés** | **DONE by the operator**, and re-run endpoint-level after the v0.155.0 fix. §7. | | **Part 3 — agent 0.90.1** | **STOPPED, ruled.** Not published, not deployed. §8. | @@ -144,7 +144,12 @@ Operator saved global floor → v0.154.0. Timeline (host CEST / guest UTC, 2 h o | `new controller healthy` | **1** | | rollback / swap-failed / unhealthy | **0** | | container `RestartCount` | **0** | -| bootstrap unit `NRestarts` / `Result` | **0** / `success` | +| bootstrap unit `Result` | `success` | + +> **Correction — I over-claimed one line.** I originally cited the bootstrap unit's `NRestarts=0` as +> no-storm evidence. It isn't: the unit is `Restart=no`, so `NRestarts` is 0 by construction and would +> read 0 during a storm too. Dropped. The real no-storm evidence is the agent-side swap count and the +> container's own `RestartCount=0`. `UpdateState` persisted `status: success`, `0.153.0 → 0.154.0`, `initiated_by: auto-floor`. `VerifyStartup` banked it on the next boot (`Post-update startup: update successful`), and the 06:57:52 @@ -152,12 +157,20 @@ periodic check reported `Current version 0.154.0 is up to date` — the anti-fla now that current ≥ floor. **Exactly one swap, no storm, no rollback.** This closes the leg R-23(a) was missing: the earlier floor save proved nothing because it targeted an already-running version. -> **Methodological caveat, disclosed:** the 30-minute no-re-attempt window was **contaminated by my own -> action** — I hand-deployed v0.155.0 at ~07:16Z, mid-window, which restarted the container and the -> bootstrap unit. The *agent-side* counters are unaffected and remain the load-bearing evidence (a -> hand-deploy writes `/etc/felhom-controller-image` and restarts the unit directly via `pct exec`, never -> through `SwapController`), but the *container-side* counters after 07:16Z reflect my deploy, not the -> self-update. Between 06:57 and 07:16 — 19 uninterrupted minutes — there was no second attempt. +**30-minute no-re-attempt check — PASSED, and my earlier caveat was broader than the facts.** Recounted +over 06:50 → 07:29 (39 min): `controller swap requested` = **1**, agent-driven bootstrap restarts = **1**. + +I hand-deployed v0.155.0 at `07:17:10Z`, inside the observation window, and flagged that as +contaminating the result. Having checked the scope: it contaminates **`StartedAt` only**. A hand-deploy +writes `/etc/felhom-controller-image` and restarts the unit directly via `pct exec` — it never goes +through `SwapController` — so the swap-count assertions, which are the actual evidence, hold +uncontaminated across the whole window. I was right to flag it and wrong about how much it cost; the +window is clean, not merely the 19 minutes I claimed. + +**An unplanned bonus confirmation came with it.** After the hand-deploy the box ran **0.155.0 against a +0.154.0 floor** — i.e. above the floor — and the updater logged `Current version 0.155.0 is up to date` +and did nothing. That is Scenario B ("at/above floor does NOTHING — must not chase latest") confirmed +live, which no test in this session set out to produce. ## 7. Live validation @@ -210,9 +223,10 @@ this host?" is unanswerable from any manifest. - Capability map row 61 → **PROVEN-LIVE** (`ce8c539`). - ROADMAP: **R-48 → SHIPPED**; R-39 cheap half recorded as closed-in-field with the publish cancelled; **R-50b** filed (`c35da9d`). -- **Not flipped:** the R-23(a) map row and the "config/state round-trips in seconds" row — the - evidence now exists (§6), so these are ready to flip; held only because the 30-min window carries the - disclosed caveat above. Recommend flipping with the 19-minute clean interval cited explicitly. +- **FLIPPED** (`11ead4b`): R-23(a) → **BANKED in full** (only the cosmetic (b) leg remains), and the + capability-map row "Config/state change round-trips in **seconds**" → **PROVEN-LIVE (2026-07-21)**. + That row's residual PARTIAL was explicitly "the R-23 operator-UI save→apply leg alone", which §6 + closes. Both rows carry the hand-deploy disclosure and the bonus at/above-floor confirmation. ## 10. Remaining — human