felhom.eu/documentation/audits/update-arc-gaps-2026-09-21/09-unattended-night.md

09 — THE UNATTENDED NIGHT: an app updates with nobody pressing anything

This is the phase the previous session's brief contained and did not run, and did not say so

(R-611). It runs here. The caller is unattended-caller.py in this directory — EVIDENCE, NOT

PRODUCT: it presses exactly POST /api/stacks/<n>/update, the same button a person presses, and

nothing else. No controller code was added for it. Guest 9202, controller v0.261.0.

Scenario F — the success night: PROVEN

uptime-kuma 2.5.0 → 2.5.1 was applied by the caller with no human action, against a real one-step catalog edge (DRILL 2, ae08a037fd68). Confirmed on the box afterwards:

uptime-kuma  installed = louislam/uptime-kuma:2.5.1   catalog = louislam/uptime-kuma:2.5.1
             updating  = False   update_phase = done   hold = none

HONEST GAP, and it is the coordinator's own instrumentation error: that first run's stdout was piped through tail, which buffers, and the run was later killed — so the caller's own log lines for the F press were lost. The OUTCOME is solid (the box moved 2.5.0 → 2.5.1 and only the caller pressed it), but the per-pass log for F is gone. The second run below was written straight to a file for exactly this reason. Recorded rather than quietly omitted.

Scenario G — two results, and the first one is the more interesting

G-a. The deliberately broken edge was NEVER ATTEMPTED — the safety rule filtered it first

The C3-class negative control was vikunja: 2.6.0 → alpine:3.20. The caller skipped it, because alpine:3.20 and vikunja/vikunja:2.6.0 are different repositories and therefore cannot be ordered, so the edge is "across" and belongs to a human (09 §3 decision 3, §3b Q3). The box was never asked to run it: vikunja ended the night still on 2.6.0, no update, no hold, untouched.

That is a real finding for Slice 6 and it cuts both ways. The within-a-major rule is the FIRST line of defence and it works — a catalog edge that cannot be ordered never reaches the guarded update unattended. But it also means this shape of broken edge cannot be used to measure the unattended HOLD path, because the rule that makes automatic updates safe is the same rule that refuses it.

G-b. The no-retry property, PROVEN over three passes

Reverting the catalog (f5f6a152b513) left all four apps running something NEWER than the catalog — R-524's Ahead state. The caller then had a genuine TERMINAL refusal to react to:

pass 1/3  glance      BEHIND and within a major — pressing Update
          glance      REFUSED reason=downgrade TERMINAL — will not press again.
                      „Ez a változat újabb a katalógusban lévőnél — visszalépés csak az
                       üzemeltető kérésére."
          ... the same for uptime-kuma, vikunja and wishlist ...
pass 2/3  (nothing)
pass 3/3  (nothing)
summary   outcomes={}  never_again=['glance','uptime-kuma','vikunja','wishlist']

Four apps, pressed exactly once each, then never again across two further passes. Nothing on the box changed: no update ran, no hold was set, no journal was written.

This is R-524 and R-609 working together end to end, unattended. Before R-609 put reason on the wire the caller would have had only a Hungarian sentence to parse, and the only safe readings were "give up on everything" or "press for ever". The full log is 09-unattended-night.log.

What Slice 6's design now knows that it did not

question	answer, from measurement
how long does one app take end to end, unattended?	51 s – 1 m 26 s for these four small apps, including the health wait — see 04/05/07
does the caller need new controller code?	No. It presses the existing guarded Update and reads the existing state.
can it tell "wait" from "never"?	Yes, since v0.261.0 — and not before
does the within-a-major rule hold?	Yes, and it is the first thing that fires — G-a
what does a held app look like the next morning?	STILL UNKNOWN unattended — see below

NOT MEASURED, stated plainly

The unattended HOLD path. 09 §3b Q4 asks who is told when an automatic update ends HELD. This night never produced a hold, because the only failing edge available was one the safety rule correctly refused (G-a). Measuring it needs an edge that passes the within-a-major test and still fails its health check — same repository, same major version, a tag that starts and does not serve. Real images rarely offer one, so this probably needs a purpose-built image rather than a catalog move. Q4 therefore still rests on the ATTENDED hold measured in slice 4 (v0.238.0, Scenario F), not on an unattended one. Recorded as the gap it is.