Files
felhom.eu/documentation/audits/update-night-2026-09-21/20-refusals-in-english.txt
T
admin 9c69b3ff07
gates / gates (push) Successful in 27s
Update night: Phases 2-4 evidence — both engines, the unattended HOLD, and five new findings
Evidence off the machine at the end of the phases that produced it (R-320). Teardown follows.

PHASE 2 — the two database engines, through the REAL Update button:
- MariaDB 11.6 -> 12.3 on nextcloud: PROVEN, and pressed through the button for the first time.
  All four SPIKE-r459 observables: the datadir's own record moved 11.6.2 -> 12.3.3; the engine
  itself says "already upgraded ... no need to run mariadb-upgrade again"; the entrypoint says
  "Major version upgrade detected ... Check required!" and then STARTED and FINISHED it (not the
  `skipped due to $MARIADB_AUTO_UPGRADE` line R-459 feared); and the engine took its own
  pre-upgrade backup, 631 905 B. The seeded Nextcloud account read back.
- PostgreSQL 16 -> 17 on docmost: FAILED exactly as R-463 predicted and nobody had measured.
  5.1 s to held; the pin named 17 while nothing ran; the restore brought it back in 29.1 s.
  The engine's REFUSAL LINE was destroyed by failAndHold before any probe could read it, so it
  was REPRODUCED INDEPENDENTLY with a control on every step (R-320).

PHASE 3 — the bad days. B1 produced THE UNATTENDED HOLD, which this project has never had: the
caller pressed once with nobody watching, the app held after 312.9 s, and passes 2 and 3 pressed
nothing. B2 put the pin back on a pull failure in 1.0 s. B3 refused `busy` six times. B4 showed
there is NO single-flight — 5 of 5 updates ran at once and all ended honest. B5 cut the power in
`backing-up` and the box recovered itself and said so. B7 refused under the 2 GB floor. B9 found
R-458's risk narrower than the row states.

PHASE 4 — every badge on the box is TRUE, and the held app answers all four of Q4's questions.

FINDINGS, five new and three corrections to existing rows. The one that matters: R-618 is P1 —
two templates name a health probe the app does not answer, and because the guarded update waits
on that same probe, a SUCCESSFUL update ends by STOPPING a working app. Measured: tandoor served
HTTP 200 on the new version at four samples across five minutes and was then stopped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-21 22:13:57 +02:00

41 lines
2.7 KiB
Plaintext

WHICH UPDATE REFUSALS ACTUALLY REACH AN ENGLISH HOUSEHOLD IN ENGLISH
2026-09-21, guest 9202, controller v0.261.0. `langFor` DOES honour ?lang= (api/i18n_api.go:30).
glance hu http=409 reason=held :: A(z) glance frissítése 2026-09-21 21:53-kor nem sikerült, és az alkalmazás nem indult el az új verzióval. Az alkalmazás biztonsági okból leállítva mar
glance en http=409 reason=held :: A(z) glance frissítése 2026-09-21 21:53-kor nem sikerült, és az alkalmazás nem indult el az új verzióval. Az alkalmazás biztonsági okból leállítva mar
adventurelog hu http=409 reason=not_deployed :: Az alkalmazás nincs telepítve, ezért nem frissíthető.
adventurelog en http=409 reason=not_deployed :: Az alkalmazás nincs telepítve, ezért nem frissíthető.
nosuchapp hu http=404 reason=not_found :: stack "nosuchapp" not found
nosuchapp en http=404 reason=not_found :: stack "nosuchapp" not found
WHAT THIS CORRECTS
==================
R-606's own text records that controller v0.260.0 "routed the 409 REFUSAL through `errText` (so the
pre-flight refusals reach an English household in English)". **That is measured FALSE for at least
three refusals**, and the reason is mechanical rather than a regression:
* the ROUTING is there — `Router.langFor` honours `?lang=` (`api/i18n_api.go:30-40`) and
`errText` calls it, so an English request IS asked for in English;
* but the SENTENCES are not keys. `MsgUpdateDiskFmt`, `MsgUpdateNotDeployed`, `MsgUpdateBusy` and
their siblings (`stacks/update.go` L81-96) are **finished Hungarian string constants**, raised
with `fmt.Sprintf` into `refuseUpdate`. `errText` renders "its own text" for an error that
carries no bundle message — which is exactly right, and which means routing them through it
changes nothing at all.
So v0.260.0 built the pipe and the old sentences never entered it. Only the sentences BORN as keys
(v0.260.0's `downgrade`, v0.261.0's `self_updating`) actually translate.
**Why this matters more than a cosmetic:** the `held` refusal is the one that tells a household
which copy can bring their data back and what is inside it. An English household pressing Update on
a held app is told, in Hungarian, why they cannot.
MEASURED, all three with the Hungarian request as the control:
held -> identical Hungarian in both languages
not_deployed -> identical Hungarian in both languages
disk -> identical Hungarian in both languages ("Nincs eleg szabad hely a frissiteshez:
1.4 GB szabad, az uj verzio letolteshez legalabb 2 GB szukseges.")
not_found -> English in both, because it is a Go error and not ours (correct)