admin
bc47dd4ef9
gates / gates (push) Successful in 18s
The operator looked at demo-felhom and found OpenGist - up 15 hours, running exactly the catalog pin, showing no badge at all. 09-update-architecture.md had recorded that as an accepted limitation the day before: 'the fleet view fills in gradually'. On a quiet box gradually means never, and a feature that fills itself in on an event nobody triggers is, on the quiet installations, not shipped. That limitation row is now struck with the reason kept. The living document gains slice 1b, the two admission rules of the backfill (it never overwrites, and it refuses to seed a partial observation because the badge reads a service-count mismatch as BEHIND), and the note that the same field having two writers with two different admission rules is deliberate. Live evidence added: all nine apps already had records by the time 0.234.0 was ready, so the natural fleet state could no longer exercise the new code - said plainly rather than papered over. The pre-0.233.0 shape was recreated on demo-hp by stripping two records; the backfill re-seeded exactly those two with digests matching independently-read ground truth and left the other seven alone. The refusal half was deliberately NOT staged live: it needs a degraded app, and manufacturing one risks the false-customer-email class that already cost 61 mails (R-330). Unit-tested with a red-proof, and recorded as unproven-live. R-457: a test that hardcodes a date and asserts an age derived from it is green only on the day it is written. Mine was, and it went red overnight. Six other files carry both a date literal and time.Now() - named as candidates, not accused.
76 lines
5.4 KiB
Markdown
76 lines
5.4 KiB
Markdown
# REPORT — update arc slices 1, 1b & 2: documents, register, roadmap, capability map (2026-09-03)
|
|
|
|
*Overwritten each session. Nothing durable lives only here.*
|
|
|
|
## What this session changed in THIS repo
|
|
|
|
| file | change |
|
|
|---|---|
|
|
| **`documentation/architecture/09-update-architecture.md`** | **CREATED — the deliverable.** Its absence was R-438. A LIVING document: every slice of this arc updates it in the same session. |
|
|
| `documentation/tests/VALIDATION-update-slice12-2026-09-02.md` | CREATED — the live evidence, copied off demo-hp at the end of the phase that produced it. |
|
|
| `documentation/backlog/OPEN-ITEMS.md` | R-438 and R-440 amended (both stay OPEN); **8 new rows: R-446..R-453**. |
|
|
| `documentation/backlog/ROADMAP.md` | the update arc added as one item, naming the capability-map rows it flips. |
|
|
| `documentation/architecture/00-capability-map.md` | one new row: what version a box runs, and whether it is behind. |
|
|
| `STATUS.md` | one new operator item (9) and a new lead paragraph. |
|
|
|
|
## The architecture document — what it settles
|
|
|
|
1. **How an update works today, as measured** — `UpdateStack` is `pull` then `up -d --remove-orphans`;
|
|
the syncer overwrites a deployed app's compose on a 15-minute cycle with no deployed check;
|
|
**thirteen** non-API call sites end in `compose up -d`.
|
|
2. **What was chosen, and by whom** — `RestartStack`'s own comment, quoted. **A design decision is not
|
|
a defect.** What was never decided is what the syncer does underneath a deployed app.
|
|
3. **The three operator rulings of 2026-09-02** — verified backup as a precondition; the support window
|
|
runs on how far behind the CATALOG a box is; automatic within a major, never across one.
|
|
4. **The vocabulary ruling** — "rollback" is struck. The available shapes are ABORT and RESTORE.
|
|
5. **The target shape** — the live compose file becomes derived from a pin in `app.yaml`.
|
|
6. **The seven slices**, each with a status line. 1 and 2 are shipped.
|
|
7. **Known limitations**, including the floating-tag one.
|
|
|
|
## Register
|
|
|
|
**194 rows before, 206 after** (205 on 2026-09-02, plus R-457 on 2026-09-03). Nothing closed, and that is stated rather than implied: R-438 and
|
|
R-440 are **amended and stay OPEN** — the mechanism is now documented, not changed — so nothing moved
|
|
to `CLOSED-ITEMS.md` and that file is untouched.
|
|
|
|
| row | what | state |
|
|
|---|---|---|
|
|
| R-446 | „Naprakész" can be FALSE for the 23 floating pins | OPEN, P2-MEDIUM, CC |
|
|
| R-447 | slice 3 — make the live compose DERIVED | **BLOCKED** on an operator ruling, P1-HIGH |
|
|
| R-448 | slice 4 — a guarded update (subsumes R-443) | READY, P2-MEDIUM |
|
|
| R-449 | slice 5 — an upgrade test that runs again | READY, P2-MEDIUM |
|
|
| R-450 | slice 6 — version sequence; an engine change gets its own edge | READY, P2-MEDIUM |
|
|
| R-451 | slice 7 — a fleet sweep (needs a hub change: no image field is reported) | READY, P3-LOW |
|
|
| R-452 | no gate enforces `catalog_since` (`--depth 1` has no parent to diff) | READY, P3-LOW |
|
|
| R-453 | **CORRECTED** — the password was fine; `~/.config/credentials` uses SINGLE quotes and the strip was half-applied. The finding is the instrumentation lesson, not the typo | READY, P3-LOW |
|
|
| R-454 | five `gofmt`-unclean `internal/web` test files, and no gate notices | READY, P3-LOW |
|
|
| R-455 | **DooPlex has no Docker Hub login — the ceiling now blocks BUILDS, not just gates.** The mirror workaround is **MEASURED byte-identical** to Hub, so it is a sound fallback, not a hope | **WAITING-ON-OPERATOR**, P2-MEDIUM |
|
|
| R-456 | a partly-dead stack is not a boot orphan, and that rule is written down nowhere | READY, P3-LOW |
|
|
| R-457 | **a test that hardcodes a date and asserts an age is green only on the day it is written** — one proven, six candidate files named | READY, P3-LOW |
|
|
|
|
## Live validation
|
|
|
|
Full evidence: `documentation/tests/VALIDATION-update-slice12-2026-09-02.md`.
|
|
|
|
**PROVEN LIVE on demo-hp at controller 0.233.0**, through a real production caller (the boot
|
|
reconciler — no hand-set state): `bentopdf` recorded 1 service, `bookstack` recorded **2**, keyed by
|
|
compose service name, **all three digests matching ground truth read independently beforehand**.
|
|
Encrypted secrets byte-identical across the write. Both apps up and healthy; nothing provisioned.
|
|
|
|
**The badge is ALSO proven live**, on both surfaces and in three of its four states — including the
|
|
load-bearing one: a deployed app with **no record renders no badge at all**. „Frissítés elérhető —
|
|
**52 napja**" was produced by editing bentopdf's compose tag only (no restart, no `up -d`) and reverted
|
|
byte-identically. **One correction of my own is stated in §4.0 of the validation file rather than
|
|
buried: I first reported the vaulted password as stale on both boxes. It was not — I stripped only
|
|
double quotes from a single-quoted value.** The operator caught it in one line.
|
|
|
|
## Sibling repos
|
|
|
|
- `felhom-controller` **v0.233.0** — `8025304acc0a`, deployed to demo-hp and verified healthy.
|
|
- `felhom-controller` **v0.234.0** — `38d28b5b624c`, the startup backfill. Deployed to **both** demo
|
|
boxes and verified: 2 apps seeded on demo-hp with digests matching ground truth, 7 left untouched;
|
|
all 9 then badged. **Its cause is worth keeping: `09-update-architecture.md` §8.3 was written as an
|
|
accepted limitation on 2026-09-02 and was a defect by the next morning** — the operator found an app
|
|
that simply ran and therefore showed nothing.
|
|
- `app-catalog-felhom.eu` — `69761cf91bfc` (backfill) + `8220f8d` (REPORT).
|