From b1268544e0461fd93dc01e075c2ff5a9dc3faacb Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Mon, 13 Jul 2026 17:53:32 -0400 Subject: [PATCH] =?UTF-8?q?docs(archreview):=20record=20docker-dev=20live-?= =?UTF-8?q?/run=20pass=20=E2=80=94=204=20R2=20gates=20live-confirmed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R2-02 (S-6 range warning + S-8 disabled cells), R2-11 (Writable checkbox), R2-07 (PureAdd + PureRemove, rebuild=False — F10b MUST), R2-04 (younger-crash keep-oldest survives sole primary; oldest-crash reproduced the documented SBR asymmetry, not an R2 regression). R2-05 partial (deny unobservable under DisableLogin). R2-10/R2-03 unit-verified, live-trigger constrained. --- archreview/plans/STATUS.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/archreview/plans/STATUS.md b/archreview/plans/STATUS.md index 0c875b87..f0a89d71 100644 --- a/archreview/plans/STATUS.md +++ b/archreview/plans/STATUS.md @@ -229,3 +229,36 @@ shared docker-dev rig / VPN infra isn't contended. To run one-at-a-time: ### Deferred behavior-change follow-up (deliberately not shipped) **R2-11 Phase C** — flip the runtime driver parsers to strict (typo'd enum ⇒ `BadNodeIdUnknown` instead of a wrong-width `Good`). Land only after fleets have run `Deployment:TagConfigValidationMode=Error` clean. + +## docker-dev live-`/run` pass (2026-07-13) — 4 gates LIVE-confirmed on the built-from-source `6aeb53a9` rig + +Brought up the 2-node central cluster (`central-1`+`central-2`, SQL, traefik) from source at merged master `6aeb53a9` +(single-tenant rig; drove the `:9200` AdminUI via browser + Client.CLI on `:4840`/`:4841`). + +- **R2-02 (S-6 High) ✅ LIVE** — on the Modbus driver's *Resilience overrides*, entering `timeoutSeconds:0` renders the + exact range-validation banner: *"Out-of-range values will be clamped to a safe value on deploy: Read timeout must be + between 1 and 86400 seconds (got 0)."* **S-8 ✅** — the Write and AlarmAcknowledge RETRIES cells are disabled ("never"). +- **R2-11 (T22) ✅ LIVE** — the typed Modbus tag editor shows the **Writable** toggle; saving persists `writable: yes`. +- **R2-07 (P1 — F10b MUST) ✅ LIVE** — central-1 boot apply logged `AddressSpaceApplier: applied plan + (kind=PureAdd, added=91, removed=0, changed=0, rebuild=False)`; deleting a UNS virtual-tag + redeploy logged + `(kind=PureRemove, added=0, removed=1, changed=0, rebuild=False)` and the node vanished from the address space + (`capper-03` lost its `production-count` child). **Surgical add AND remove both execute in prod with no full rebuild — + the remove path's 3 new sink members are wired, not inert.** +- **R2-04 (S4 MUST) ✅ LIVE (achievable guarantee)** — **younger-crash** (kill `central-2`): `SBR took decision + DownUnreachable and is downing [central-2]`, `Member removed`, `central-1` stays Up, AdminUI serving, ServiceLevel + **250** (sole primary, no split-brain). **Oldest-crash** (kill `central-1`) reproduced the **documented keep-oldest + asymmetry** live: the survivor took `SBR … DownReachable … including myself` and CoordinatedShutdown (ExitCode 3) — + i.e. crashing the *oldest* node does **not** fail over. This is the pre-registered SBR topology gap (a deferred USER + strategy decision), **not** an R2 regression; R2-04's `PrimaryGatePolicy` write-gate change is orthogonal + unit-verified. +- **R2-05 (T15) ✅ (partial, as expected)** — every config/read page renders under the all-roles `multi-role-test` session + (named-policy gating didn't over-gate a legitimate admin); deny is unobservable under docker-dev `DisableLogin=true`, as documented. +- **R2-10 (T10) / R2-03 (T12) — unit-verified; live-trigger constrained, not forced.** R2-10's breaker needs a wrapped + subscribe/discover/write exception (Modbus's cheap paths don't throw wrapped — the known trigger is an idempotent + write-to-dead-endpoint or S7). R2-03's live observable is a Client.CLI `read` StatusCode, but the CLI `read` throws a + `FetchValueAsync` stack trace even on valid nodes on this rig, so quality wasn't cleanly observable via CLI. Both are + solidly covered by unit suites (Core resilience 128, publisher/guard 6; Runtime 372, RoslynVTEvaluator 20). + +**Rig note:** the pass mutated the persisted ConfigDb (added a `drv-modbus-line3-01` Modbus driver on MAIN; removed +`capper-03`'s `production-count` virtual tag for the PureRemove test). Reset with +`docker compose -f docker-dev/docker-compose.yml down -v`. The remaining integration-suite sweep + genuinely-external +gates (R2-06 VPN, R2-08 live LDAP, R2-01 S7 blackhole) still need their infra.