From a71cc583272a14cab797333cf9a4215df279dc8f Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 24 Jul 2026 07:53:49 +0200 Subject: [PATCH] =?UTF-8?q?docs(R-71a):=20live=20evidence=20=E2=80=94=200.?= =?UTF-8?q?162.0=20deployed=20both=20boxes,=20settle-gate=20GO=20captured?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit demo-felhom 9201 + demo-hp 9201 (G1 break-glass, secret shredded) both clean + healthy on 0.162.0 with the settle-gate GO line. Honest B' accounting recorded: the floor is in-memory (not persisted) so both above-floor boxes logged "awaiting floor knowledge" then GOed ~10s later once the report ACK landed — the report-ACK latency the 90s sub-bound is sized to, not a regression. The zero-wait-when-floor-known invariant stays unit-proven (test E). Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01N7Drmtm2RzoqbkJZCNSFNQ --- CONTEXT.md | 8 +++++++- REPORT.md | 33 +++++++++++++++++++++++++++------ 2 files changed, 34 insertions(+), 7 deletions(-) diff --git a/CONTEXT.md b/CONTEXT.md index 6d3ee11..62db8d4 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -9,7 +9,13 @@ Last updated: 2026-07-24 (v0.162.0 — R-71a: the apply-bridge settle-gate) -> **2026-07-24 — v0.162.0 (R-71a), CODE COMPLETE + green; deploy/live-verify on the publish train.** +> **2026-07-24 — v0.162.0 (R-71a), SHIPPED + deployed BOTH boxes (demo-felhom 9201 + demo-hp 9201 +> via G1 break-glass), clean+healthy, settle-gate GO line captured on both.** B′ live note: both +> above-floor boxes GOed correctly but NOT literally first-poll — the floor is in-memory (not +> persisted), unknown at t=0, so the gate logged `awaiting floor knowledge` then GOed ~10 s later the +> instant the report ACK landed (report-ACK latency = exactly what the 90 s sub-bound is sized to; +> zero-wait-when-floor-known is unit-proven, test E). The gate correctly did NOT burn the one-time +> password before the update picture was clear. > The structural fix for the F10 day-0 race (DIAG-f10): the apply-bridge no longer consumes the > single-use offsite password while a managed floor-update is in flight or imminent (below floor). > New seam `offsiteapply.SettleProvider.SettleState()` + `SettleFunc` adapter over the updater's own diff --git a/REPORT.md b/REPORT.md index 07510ba..83219c3 100644 --- a/REPORT.md +++ b/REPORT.md @@ -62,10 +62,31 @@ Injectable clock (no real sleeps), fake `SettleState`, recorded `Consumer` ## Ship / honesty The deferral paths ship **unit-proven + red-proofed, NOT live-fired** — their precondition is now -structurally prevented by the v1.25.0 golden≥floor build gate, which is the point. The -live-observable leg is the **B′ first-poll GO line on both above-floor demo boxes** (proving zero -added latency on the common restart shape). **Layering: gate prevents, (a) defers, (c) heals.** -R-71 → SHIPPED with (a)+(c); (b) recorded rejected-by-design. +structurally prevented by the v1.25.0 golden≥floor build gate, which is the point. **Layering: gate +prevents, (a) defers, (c) heals.** R-71 → SHIPPED with (a)+(c); (b) recorded rejected-by-design. -_(Build/deploy to both boxes + the two first-poll GO log lines appended on completion of the publish -train.)_ +## Build + deploy + LIVE (2026-07-24) + +Image `gitea.dooplex.hu/admin/felhom-controller:0.162.0` (sha `e6e1146f…`, 145M) built + pushed. +Deployed to **both** boxes, clean start, healthy: + +- **demo-felhom (guest 9201, `ssh felhom-pve`)** — `Up (healthy)`: + ``` + 05:50:44 [INFO] [offsite-apply] settle-gate: awaiting floor knowledge (first report ACK) before offsite apply + 05:50:54 [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.156.0 (we are 0.162.0), no managed update running + ``` +- **demo-hp (guest 9201, G1 break-glass; secret extracted file→file + shredded)** — `Up (healthy)`: + ``` + 05:52:53 [INFO] [offsite-apply] settle-gate: awaiting floor knowledge (first report ACK) before offsite apply + 05:53:03 [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.156.0 (we are 0.162.0), no managed update running + ``` + +**Honest accounting of the B′ live leg:** both above-floor boxes GOed correctly, but NOT literally on +the first poll — because the floor is **in-memory, not persisted**, it is unknown at the very first +poll (the report ACK hasn't landed) so the gate logged `awaiting floor knowledge`, then GOed on the +next poll (~10 s later) the instant the floor became known and confirmed at/above. This is exactly +the documented finding, not a regression: the gate correctly refused to consume while the floor was +unknown, and added ~10 s to a background reconcile (invisible to any user). The B′ zero-wait-when- +floor-known invariant is unit-proven (test E); the ~10 s live wait is the report-ACK latency the 90 s +sub-bound was sized against. The important live proof holds: **the gate did not burn the one-time +password before the managed-update picture was clear.**