Files
felhom.eu/documentation/audits/update-arc-2026-09-21/12-journal-path-provenance.txt
T
admin 0c263c77f2
gates / gates (push) Successful in 24s
Update arc resumed: the state measured, R-524/R-520/R-589/R-469 closed, seven questions put to the operator
Phase 0 — measured, never estimated:
- both demo boxes: 10 apps, 0 behind, 0 unknown
- 46 of 58 exact catalog pins are behind upstream; 39 within a major, 7 across
- 6 of 7 measurable floating pins have been repushed since the catalog set them
  (R-446 is no longer theoretical)
- the "23 of 66 floating pins" figure repeated in four places was STALE; recounted
  to 10, with the definition written down beside it

Three claims in the brief corrected, named first:
- R-589 was NOT open — it shipped in v0.258.0; only the row was stale
- the chaos-night canary is NOT a defect — both gates refused to certify by design
- the hub half of the report confirmed, with the nuance that the raw payload is
  stored whole, so Slice 7 is cheaper than the row implies

Closed: R-524 (controller v0.260.0, proven live in both languages), R-520 (power cut
during a REAL version change — the pin goes back, the app runs, the page says so),
R-589, R-469 (MariaDB half). Filed: R-605, R-606. R-462's stale scope corrected.

09 gains §3 decision 10 (decided by CC unattended — operator may reverse), §3b with
the seven questions in the decision shape, §6.2/6.3 the two open slices, and §6.4 an
update night costed from R-462's real numbers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-21 13:13:23 +02:00

67 lines
3.4 KiB
Plaintext

### PATH PROVENANCE — exactly where I looked, with positive controls
== A. What /var/lib/docker actually IS inside the running guest ==
drwx--x--- 12 root root 4096 Sep 21 11:06 /var/lib/docker
drwx--x--- 12 root root 4096 Sep 21 11:06 /var/lib/felhom/docker
/var/lib/docker
== B. Configured data_dir (controller.yaml, path INSIDE the container) ==
== C. POSITIVE CONTROL — the directory I searched really is the controller data dir.
Listing it via the RUNNING guest, where the symlink resolves correctly:
total 9540
drwxr-xr-x 3 root root 4096 Sep 21 11:06 .
drwxr-xr-x 3 root root 4096 Sep 13 20:20 ..
drwxr-xr-x 9 root root 4096 Sep 21 11:04 catalog-cache
-rw-r--r-- 1 root root 870169 Sep 21 11:06 debug-ring.log
-rw------- 1 root root 32 Sep 13 20:22 encryption.key
-rw-r--r-- 1 root root 4673536 Sep 21 09:22 metrics.db
-rw-r--r-- 1 root root 32768 Sep 21 11:06 metrics.db-shm
-rw-r--r-- 1 root root 4157112 Sep 21 11:06 metrics.db-wal
-rw-r--r-- 1 root root 572 Sep 16 19:18 settings.json
-rw-r--r-- 1 root root 784 Sep 16 19:17 settings.json.bak
...and the SAME directory by its physical path (no symlink):
total 9540
drwxr-xr-x 3 root root 4096 Sep 21 11:06 .
drwxr-xr-x 3 root root 4096 Sep 13 20:20 ..
drwxr-xr-x 9 root root 4096 Sep 21 11:04 catalog-cache
-rw-r--r-- 1 root root 870169 Sep 21 11:06 debug-ring.log
-rw------- 1 root root 32 Sep 13 20:22 encryption.key
-rw-r--r-- 1 root root 4673536 Sep 21 09:22 metrics.db
-rw-r--r-- 1 root root 32768 Sep 21 11:06 metrics.db-shm
-rw-r--r-- 1 root root 4157112 Sep 21 11:06 metrics.db-wal
-rw-r--r-- 1 root root 572 Sep 16 19:18 settings.json
-rw-r--r-- 1 root root 784 Sep 16 19:17 settings.json.bak
== D. WHY the host-side read missed it: it is a BIND MOUNT, not a symlink ==
-- guest 9202 LXC config mountpoints (from the host) --
mp0: nvme-scratch:9202/vm-9202-disk-1.raw,mp=/var/lib/felhom,backup=1,size=70G
mp8: /mnt/hdd_1/scratch-drives/scratch_hdd,mp=/mnt/felhom-drives/scratch_hdd
mp9: /var/lib/felhom-agent/guests/9202/bootstrap,mp=/etc/felhom-bootstrap,ro=1
rootfs: nvme-scratch:9202/vm-9202-disk-0.raw,size=32G
-- inside the guest: is /var/lib/docker its own mount? --
/dev/loop1[/docker] /var/lib/docker ext4
-- readlink -f says it is NOT a symlink --
/var/lib/docker
CONCLUSION ON PATHS:
* INSIDE the running guest the coordinator's path is correct and is what I used for every
live read: /var/lib/docker/volumes/felhom-controller-data/_data/data/
* FROM THE HOST, reading the STOPPED guest via 'pct mount 9202', that same path is an EMPTY
mountpoint stub, because pct mount maps only the rootfs and does not apply the guest's
internal bind mounts. The bytes live at
/var/lib/lxc/9202/rootfs/var/lib/felhom/docker/volumes/felhom-controller-data/_data/data/
* My FIRST host-side read used the stub path and reported ABSENT. That was a FALSE NEGATIVE,
found by running 'find' over the whole rootfs rather than trusting the one path.
== E. controller.yaml location (the /etc/felhom guess was wrong too) ==
/mnt -> /mnt
/etc/felhom-bootstrap -> /etc/felhom-bootstrap
/var/lib/docker/volumes/felhom-controller-data/_data -> /opt/docker/felhom-controller
/opt/docker/stacks -> /opt/docker/stacks
/var/run/docker.sock -> /var/run/docker.sock
/var/lib/docker/volumes/felhom-controller-data/_data/controller.yaml
/var/lib/felhom/docker/volumes/felhom-controller-data/_data/controller.yaml