From 4bad6e06c9f32928d35316d537c285cf81eafd4e Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 2 Aug 2026 20:17:24 +0200 Subject: [PATCH] CHANGELOG: the boot window's sample refreshes first --- CHANGELOG.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 501d7af..e4a84af 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -46,7 +46,15 @@ at 95 s. Extending the grace to fit was rejected outright (§8.3) — that hides of reporting it. A window that genuinely overruns now emits a **`LATE RECOVERY` WARN naming the apps**, so a stale alarm never stands without counter-evidence. -**Sampling is read-only and there is still exactly ONE sweep.** Sweeping per sample was rejected: the +**The sample REFRESHES first, and that was found by live validation rather than review.** +`GetStacks()` returns the Manager's in-memory map, which the scheduler refreshes on its own **10 s** +cadence — so sampling it every 5 s without refreshing means two consecutive samples can be identical +because *the cache did not update*, not because the fleet settled. Observed on 9201: a container +removed ~5 s before the window closed was still in the sampled fleet, and the sweep logged +`no boot-orphaned apps` for an app that had none. `sampleBootFleet` now calls `RefreshStatus()` first +(≈10 extra cheap `docker ps` calls per boot); a refresh error degrades rather than aborting. + +**Sampling is otherwise read-only and there is still exactly ONE sweep.** Sweeping per sample was rejected: the sweep's own `StartStack` changes the fleet, so it would never observe a settled one. The per-app attempt bound is untouched — this widens a bounded window, it does not remove the bound.