Evidence off the machine at the end of the phases that produced it (R-320). Teardown follows.
PHASE 2 — the two database engines, through the REAL Update button:
- MariaDB 11.6 -> 12.3 on nextcloud: PROVEN, and pressed through the button for the first time.
All four SPIKE-r459 observables: the datadir's own record moved 11.6.2 -> 12.3.3; the engine
itself says "already upgraded ... no need to run mariadb-upgrade again"; the entrypoint says
"Major version upgrade detected ... Check required!" and then STARTED and FINISHED it (not the
`skipped due to $MARIADB_AUTO_UPGRADE` line R-459 feared); and the engine took its own
pre-upgrade backup, 631 905 B. The seeded Nextcloud account read back.
- PostgreSQL 16 -> 17 on docmost: FAILED exactly as R-463 predicted and nobody had measured.
5.1 s to held; the pin named 17 while nothing ran; the restore brought it back in 29.1 s.
The engine's REFUSAL LINE was destroyed by failAndHold before any probe could read it, so it
was REPRODUCED INDEPENDENTLY with a control on every step (R-320).
PHASE 3 — the bad days. B1 produced THE UNATTENDED HOLD, which this project has never had: the
caller pressed once with nobody watching, the app held after 312.9 s, and passes 2 and 3 pressed
nothing. B2 put the pin back on a pull failure in 1.0 s. B3 refused `busy` six times. B4 showed
there is NO single-flight — 5 of 5 updates ran at once and all ended honest. B5 cut the power in
`backing-up` and the box recovered itself and said so. B7 refused under the 2 GB floor. B9 found
R-458's risk narrower than the row states.
PHASE 4 — every badge on the box is TRUE, and the held app answers all four of Q4's questions.
FINDINGS, five new and three corrections to existing rows. The one that matters: R-618 is P1 —
two templates name a health probe the app does not answer, and because the guarded update waits
on that same probe, a SUCCESSFUL update ends by STOPPING a working app. Measured: tandoor served
HTTP 200 on the new version at four samples across five minutes and was then stopped.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
INTERIM CHECKPOINT — evidence off the machine at the end of the phase that produced it (R-320),
not at the end of the session. Phases 2-5 follow in a later commit.
Phase 0, all three mechanisms proven with their controls:
- the fleet floor to 0.261.0 with its declared MinAgent — both demo boxes in 13 s, the hub
logging `managed floor SERVED ... from declared (golden 0.258.0)`.
- a PRIVATE DRILL CATALOG (admin/app-catalog-drill), so that broken, dummy, cross-repo and
engine-major edges can be measured without the live catalog ever carrying one. Positive
control quoted, and two negative controls: the live catalog's main and both real boxes'
caches unchanged.
- a throwaway image store on the scratch guest, which is what makes an UNATTENDED HOLD
measurable at all: an edge that PASSES the within-a-major test and still fails.
CompareImageRefs was proven to order host:port/ references by RUNNING it (4 positive cases
+ 1 negative control), not by reading it.
Phase 1: real within-a-major upstream edges walked on guest 9202 through the product's own
guarded Update, each app seeded and read back through its OWN front door (R-156), with a
per-edge verdict record in 09's shape. `inconclusive` is never collapsed into `failed`.
TWO INSTRUMENT FIXES, both in this repo's own evidence code:
- 00-api-recipe.md said the app page is /app/<n>; it is /apps/<n>, and every call it described
404s. Corrected, with the session-expiry note that cost the same time.
- unattended-caller.py's follow() read update_phase/updating off the API ENVELOPE, so both were
always None and EVERY followed update ran to its 900 s timeout and was then recorded
`timeout` and never-press-again. Fixed before B1 relied on it. R-623.
No controller, agent or hub code was written. The live catalog carries no broken reference.
Gates: repo_gates.py --fast — all 15 OK, exit 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
admin