Files
felhom.eu/documentation/audits/update-arc-2026-09-21/18-r524-409-refusal.txt
T
admin 0c263c77f2
gates / gates (push) Successful in 24s
Update arc resumed: the state measured, R-524/R-520/R-589/R-469 closed, seven questions put to the operator
Phase 0 — measured, never estimated:
- both demo boxes: 10 apps, 0 behind, 0 unknown
- 46 of 58 exact catalog pins are behind upstream; 39 within a major, 7 across
- 6 of 7 measurable floating pins have been repushed since the catalog set them
  (R-446 is no longer theoretical)
- the "23 of 66 floating pins" figure repeated in four places was STALE; recounted
  to 10, with the definition written down beside it

Three claims in the brief corrected, named first:
- R-589 was NOT open — it shipped in v0.258.0; only the row was stale
- the chaos-night canary is NOT a defect — both gates refused to certify by design
- the hub half of the report confirmed, with the nuance that the raw payload is
  stored whole, so Slice 7 is cheaper than the row implies

Closed: R-524 (controller v0.260.0, proven live in both languages), R-520 (power cut
during a REAL version change — the pin goes back, the app runs, the page says so),
R-589, R-469 (MariaDB half). Filed: R-605, R-606. R-462's stale scope corrected.

09 gains §3 decision 10 (decided by CC unattended — operator may reverse), §3b with
the seven questions in the decision shape, §6.2/6.3 the two open slices, and §6.4 an
update night costed from R-462's real numbers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-21 13:13:23 +02:00

33 lines
2.4 KiB
Plaintext

### R-524 — THE GUARDED UPDATE MUST REFUSE (409), both languages
== 3a. POST /api/stacks/uptime-kuma/update (Hungarian, the box's saved language) ==
{"ok":false,"error":"Ez a változat újabb a katalógusban lévőnél — visszalépés csak az üzemeltető kérésére."}
HTTPCODE:409
== 3b. POST /api/stacks/uptime-kuma/update?lang=en (English) ==
{"ok":false,"error":"This version is newer than the one in the catalog — moving back needs the operator."}
HTTPCODE:409
== 3c. control — ?lang=hu explicitly ==
{"ok":false,"error":"Ez a változat újabb a katalógusban lévőnél — visszalépés csak az üzemeltető kérésére."}
HTTPCODE:409
== 4. The controller log line for the refusal (verbatim, names BOTH image maps) ==
2026/09/21 11:11:06 update.go:292: [ERROR] [stacks] update uptime-kuma REFUSED (downgrade): installed is provably NEWER than the catalog on every differing service (installed=map[uptime-kuma:{louislam/uptime-kuma:2.5.0 sha256:a8610b3b4c38077922ba51b036691e06887d7cefd91fe620fd3d6d23d03dc240 2026-09-21T11:09:07Z}] catalog=map[uptime-kuma:louislam/uptime-kuma:2.4.0])
2026/09/21 11:11:07 update.go:292: [ERROR] [stacks] update uptime-kuma REFUSED (downgrade): installed is provably NEWER than the catalog on every differing service (installed=map[uptime-kuma:{louislam/uptime-kuma:2.5.0 sha256:a8610b3b4c38077922ba51b036691e06887d7cefd91fe620fd3d6d23d03dc240 2026-09-21T11:09:07Z}] catalog=map[uptime-kuma:louislam/uptime-kuma:2.4.0])
2026/09/21 11:11:08 update.go:292: [ERROR] [stacks] update uptime-kuma REFUSED (downgrade): installed is provably NEWER than the catalog on every differing service (installed=map[uptime-kuma:{louislam/uptime-kuma:2.5.0 sha256:a8610b3b4c38077922ba51b036691e06887d7cefd91fe620fd3d6d23d03dc240 2026-09-21T11:09:07Z}] catalog=map[uptime-kuma:louislam/uptime-kuma:2.4.0])
-- controls --
POSITIVE 'downgrade' in the log : 3 (expect >0)
POSITIVE 'REFUSED' in the log : 3 (expect 3 = the three POSTs)
NEGATIVE 'ZZZ-not-present' : 0 (expect 0)
-- proof nothing moved: the app is untouched by the three refused POSTs --
uptime-kuma | louislam/uptime-kuma:2.5.0 | Up 2 minutes (healthy)
image: louislam/uptime-kuma:2.5.0
update-journal.json present (should be ABSENT — a refused update records nothing): ABSENT
(positive control that this path is real — catalog-cache is beside it:)
catalog-cache debug-ring.log encryption.key metrics.db metrics.db-shm metrics.db-wal settings.json settings.json.bak