admin
805ad1e962
- 09 §3: decisions 11 (one window = a leg of the backup chain), 12 (automatic, per-box switch on by default), 13 (the test decides, not the tag - replaces decision 3's "never across a major"), 14 (the ladder), 15 (the box undoes a failed update - replaces §6.1's no-auto-undo), 16 (Postgres majors converted by the box), 17 (digests), 18 (fleet view, later). - 09 §3b marked ANSWERED with a pointer per question; kept as the reasoning. - 09 §6.2 rewritten to the ruled shape; §6.1 abort paragraph and §4 point at 15. - Register: R-450, R-451, R-446, R-463 cite the decisions. - STATUS: the seven questions no longer wait on the operator. Documents only. No product code. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
3.6 KiB
STATUS — what works, what's broken, what's next
Updated 2026-09-23 (morning) — your seven answers on automatic updates are written into the design notes as rulings. No later session will ask them again. The two new pieces your answers need — the automatic undo and the step-by-step climb — are being tested by hand on the scratch machine today, before anyone builds them. The build plan comes back to you part by part.
Updated 2026-09-22 (late) — I fixed the six faults the two drill nights found in the update, delete and hold machinery, and shipped the six app versions you approved. One thing needs your word: whether the fleet moves to the new controller.
Decisions I took on my own: none.
The one that mattered most is fixed and proven. An app with no health check used to be shut down by a successful update — the machine waited five minutes for a check that could never arrive, then stopped a working app. Paperless-ngx, same app, same button: before, it failed after 5 minutes and the app went dark. Now it finishes in 53 seconds and keeps running.
Five more, all proven on the test machine.
- Deleting an app while it is being backed up or restored is now refused, with a plain sentence telling you to wait — instead of quietly tearing it down and leaving a ghost behind.
- A delete now checks its own work. The machine watches for 25 seconds afterwards and removes anything that comes back, and says whether it verified.
- An app the machine has lost track of can now be deleted. Before, if its record went wrong, no button worked and only a command line could clear it.
- A failed update now keeps the app's own log before shutting it down. Twice we lost the only evidence of why.
- Deleting an app clears its old update status, so a fresh install of the same app no longer shows a stale "Updated".
The six versions you approved are live on the catalogue — Emby, Ghost, Immich, Radarr, Sonarr, Termix. None of them is installed on either demo machine, so nothing updated; they simply show as available.
What I did not do, and it is on purpose. Two items from the plan are untouched and named rather than half-finished: finding out why an app's record goes wrong in the first place (I fixed the consequence, not the cause), and making a held app stop offering an Update button it will refuse.
What went wrong on my side. I lost 44 minutes to my own progress-watchers: they waited for a build that had already succeeded, because each was watching for a name its own command contained. The same bug cost me a pile of stuck watchers earlier in the day. It is now written down as a rule so it does not happen a third time. I also nearly recorded one test as passing when it had proved nothing — the refusal I saw came from an older rule, not the new one. I caught it and re-ran it properly.
Rows opened and closed. Four closed, one narrowed to what is still unknown. The list stands at 325.
The fleet is on the new controller — you said yes and it is done. I raised the floor to 0.262.1 with the required agent version declared alongside it. Both demo machines picked it up in under twenty seconds and are running healthy. The drill machine is switched off and is held back on purpose: its helper software is older than the new controller needs, so the machine refuses to give it a version it cannot run. That is the guard working, not a failure. Peti's machine is parked and would take it only if it ever comes back online.
What needs you: nothing.
Nothing on your own machine or the off-site box was touched. The demo machines were not touched — they only see the six new version badges.