Files
felhom.eu/documentation/audits/update-arc-gaps-2026-09-21/04-cut-after-start-coordinator-capture.txt
T
admin c85262111c
gates / gates (push) Successful in 23s
The update arc's two missing measurements, the lock, and the floor to 0.260.0
Part 0 — floor raised to 0.260.0, MinAgent 0.131.0 declared. 3 boxes below, all
down or blocked; both demo boxes SERVED.

Part 1 (R-610) — the DANGEROUS power cut, measured three times with three apps and
two cut mechanisms. All ended honest: resumed, completed, and pinned/installed/live
compose/docker inspect all agreed. vikunja's 2.6.0 migration had ALREADY run 0.64 s
after the cut decision and the seeded data read back intact — so the branch that is
one step from old-binary-on-migrated-database is now evidence, not argument.
Instrument limit stated: `starting` lasts under a second; all three landed in
`verifying`, which RecoverUpdates handles in the same branch.

Part 3 (R-611) — the night the previous session skipped without saying so. An app
updated with nobody pressing anything; a terminally-refused app was pressed exactly
once and never again over three passes. The unattended HOLD was NOT produced: the
within-a-major rule correctly refused the broken edge before it was attempted, so
Q4 still rests on the attended hold from slice 4. Said plainly rather than implied.

Rows: closed R-608/609/610/611; opened R-612 (P1 wishlist unusable on a fresh
install, and its error is a lie), R-613 (uptime-kuma healthy on its setup wizard),
R-614 (stale update phase survives a redeploy). R-520's pointer corrected.

Catalog: two drill pairs, both reverted; every image line byte-identical to
ff9717d3. The alpine:3.20 negative control a security review flagged is cleared.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-21 15:00:09 +02:00

30 lines
2.1 KiB
Plaintext

# 04b — INDEPENDENT CORROBORATION of scenario A, captured by the COORDINATOR
#
# WHY THIS FILE EXISTS, stated plainly: 25 minutes passed with no evidence written while the box
# already showed the update complete, so the main session took its own read-only capture rather than
# risk losing the measurement (R-320 — evidence off before it can be lost). The measuring agent's own
# file `04-scenarioA-starting-cut.txt` then landed and is FULLER and BETTER than this one: it has the
# timestamp table, the journal read off the stopped guest, and the seeded-data read-back.
#
# THIS FILE IS NOT A SECOND MEASUREMENT. It is the same box, read independently ~90 minutes later by
# a different reader with a different session. Its only value is that it agrees.
READ AT: 2026-09-21, after the scenario completed. Source: live guest 9202, read-only.
AGREES WITH 04-scenarioA-starting-cut.txt ON:
* the recovery line — interrupted in `verifying`, "the new version may have run; marking it
Updating and RESUMING the health wait", resumed, `up -d`, healthy after 0s, DONE in 1m26s;
* all FOUR version observables reading vikunja/vikunja:2.6.0 —
pinned_images, installed_images, the live compose `image:` line, and `docker inspect`
(created 2026-09-21T12:28:26Z, state running);
* end state: state=running, updating=False, update_phase=done, label 'Frissitve',
no update_error, no hold_reason, health_probe.healthy=True;
* the update journal ABSENT (cleared), with a positive control that the directory searched is the
real one — catalog-cache, debug-ring.log, encryption.key, metrics.db*, settings.json* beside it.
WHAT THIS FILE COULD NOT DO, and why — because a gap recorded is worth more than a gap hidden:
the seeded-data read-back. 02-seeding.txt records the canary task name but not the account it was
created under, and the coordinator would not guess credentials or read vikunja's database behind
the app's back. "Through the front door" is the condition the measurement is worth anything under.
The measuring agent had the credentials and did it: the task read back unchanged.