docs: record program execution rollout

This commit is contained in:
fy59 2026-09-18 22:09:33 +02:00
parent 949ace6301
commit 894c944636
4 changed files with 110 additions and 11 deletions

View file

@ -11,6 +11,14 @@
mobile export V3, `programs-v1`, or `TRAINLOG_FORMAT_V1`. Web also exposes
`À faire`, `Préparée`, `En cours`, and `Effectuée` session states, while the
existing logical Program deletion and confirmation semantics remain intact.
The coordinated private deployment advanced the daily Android installation
from versionCode 16/schema v24 to versionCode 17/schema v25 and desktop from
schema v26 to v27 without uninstalling, clearing, or losing user data. A
disposable Program session was started, resumed, completed, synchronized and
displayed as completed on Android and Web. Correlated ACKs, a second
idempotence exchange, store/component restart, exact old-generation replay,
causal Program deletion, tombstone acknowledgement and non-resurrection all
passed while the real 24-session/164-entry Program remained unchanged.
- Completed the private coordinated deployment of
`TRAINLOG_PROGRAMS_PRESENTATION_ANDROID_DELETE_V1`. Desktop schema v26 adds

View file

@ -4,8 +4,8 @@ The opt-in full-generation path is operational on the private daily
installation. The loopback Web control and foreground Android coordinator use
the production direct-libmtp adapter, correlated manifest/ACK V1 objects, and
persistent peer identities. The latest controlled rollout verified real
desktop and Android backups, populated-copy migration, desktop schema v25 to
v26, and an in-place private Android update from versionCode 15 to 16. The
desktop and Android backups, desktop schema v26 to v27, and an in-place private
Android update from versionCode 16 to 17 with schema v24 to v25. The
installed APK remains `com.labfytools.trainlog` 0.1.2, is
non-debuggable, and retains certificate SHA-256
`aa56c97f2781a0d01f007f4444c3970deb58ad8327ca3da7b0b90f37dbe2ad25`.
@ -82,7 +82,7 @@ parallel implementation of its rules.
| Web Sessions V1 | `TRAINLOG_WEB_SESSIONS_V1=PASS/FROZEN` (controlled desktop/Android deployment validated) |
| Web Sessions deletion and Programs V1 | `TRAINLOG_WEB_SESSIONS_DELETE_AND_PROGRAMS_V1=PASS` (private grouped rollout validated) |
| Programs presentation, Android projection, and deletion | `TRAINLOG_PROGRAMS_PRESENTATION_ANDROID_DELETE_V1=PASS` (private coordinated deployment and restart/replay validated) |
| Program execution flow | `TRAINLOG_PROGRAM_EXECUTION_FLOW_V1=IMPLEMENTED_VALIDATED_AWAITING_ROLLOUT` |
| Program execution flow | `TRAINLOG_PROGRAM_EXECUTION_FLOW_V1=PASS` (private coordinated deployment, real execution, correlated ACK, restart, replay, and deletion validated) |
| Sync orchestrator/report V1 | `TRAINLOG_SYNC_ORCHESTRATOR_REPORT_V1=PASS/FROZEN` |
| Web sync API V1 | `TRAINLOG_WEB_SYNC_API_V1=PASS/FROZEN` |
| Web sync button V1 | `TRAINLOG_WEB_SYNC_BUTTON_V1=PASS/FROZEN` |
@ -281,6 +281,23 @@ against desktop schema v27 without transferring ownership of Program
definitions. Web and Android derive their session state from these persisted
identities; no display-field heuristic is used.
The private Program execution rollout installed desktop schema v27 and the
signed nondebuggable Android versionCode 17/schema v25 update without
uninstalling or clearing application data. A strictly disposable Program was
synchronized to Android, started, left and resumed through the durable
singleton, and completed as session
`se_6bb66f59-a6fb-4759-a75d-c1a79ea107e8`. Android displayed `Effectuée` and
desktop/Web received the same completed provenance through the real
`program-executions-v1` producer and consumer. A second exchange created no
duplicate and no second active draft. The disposable Program was then deleted
through the revision-guarded Web command; Android retained exactly one
tombstone and desktop retained exactly one acknowledged deletion ledger row.
After both stores and the Trainlog components were reopened, exact replay of
the preserved pre-deletion Android generation returned its production durable
ACK without duplicating the execution or resurrecting the Program. A final
correlated exchange remained completed with no missing capability. The real
Program remains active and unique with 24 sessions and 164 ordered entries.
The private Programs rollout migrated desktop schema v25 to v26 and Android
schema v23 to v24 after verified backups, then installed the signed
non-debuggable versionCode 16 APK without uninstalling or clearing data. The

View file

@ -1,10 +1,9 @@
# Program execution flow V1 validation evidence
Status: `IMPLEMENTED_VALIDATED_AWAITING_ROLLOUT`
Status: `PASS`
This record covers the isolated `program-execution-flow-v1` worktree. It does
not claim installation, user-database migration, service restart, device smoke
testing, tag creation, or public release.
This record covers both the isolated implementation evidence and the completed
private coordinated rollout. It does not claim a tag or public release.
## Functional evidence
@ -36,9 +35,78 @@ testing, tag creation, or public release.
- JSON/import validators, `git diff --check`, and
`tools/check_changed_c_format.sh main` passed.
## Private deployment evidence
- Source commit: `949ace63013feb714657f81cf809029276ec8e79`.
- Desktop candidate SHA-256:
`a6aa6745fe3f8cf55c25272d9b92c97b2ab3242041764d07555536733f04ab12`.
Its 49-file inventory, source commit, desktop schema v27 and
`program-executions-v1` companion were verified before installation.
- Android private release SHA-256:
`7ce6aaa0e6bd889b4e369c4dac3785c6344515ba4ea8190daa78c01ad271ecdf`.
Official Android tools verified application ID
`com.labfytools.trainlog`, versionName 0.1.2, versionCode 17,
nondebuggable release metadata, and certificate SHA-256
`aa56c97f2781a0d01f007f4444c3970deb58ad8327ca3da7b0b90f37dbe2ad25`.
The previous installed package was the same application and certificate at
versionCode 16. Installation used `adb install -r`; no uninstall or data
clear occurred.
- Verified pre-install backups are stored outside the repository under
`program-flow-v17-rollout-20260918T193800Z`. The desktop snapshot is schema
v26 with integrity `ok`; the Android archive is schema v24 and contains the
complete SQLite store and preferences. A post-migration Android archive and
the final post-replay archive both verify as schema v25 with integrity `ok`.
- Desktop migrated from schema v26 to v27 with integrity `ok` and an empty
foreign-key check. Android migrated from schema v24 to v25 with integrity
`ok`, an empty foreign-key check, no active draft invented, and its nine
pre-existing completed sessions retained.
## Real execution, synchronization, and deletion
The rollout used only disposable Program
`pg_17a00000-0000-4000-8000-000000000001`. Its single projected session was
started on Android, left and resumed, then completed as
`se_6bb66f59-a6fb-4759-a75d-c1a79ea107e8`. Android displayed `Effectuée`.
The correlated execution exchange completed as run
`sy_b9c2e545-ec63-4836-beea-cff1aa7c5115`, consuming Android generation
`gen_9a0b7968-eeee-49ba-895b-36aa1783e412` and acknowledging desktop
generation `gen_0b52e009-f654-4da4-8f1b-f23665c97784`. The inbound generation
contained the production `program-executions-v1.json`; desktop and Web exposed
the same completed Program provenance.
The second idempotence exchange completed as run
`sy_81d12965-846d-4502-a864-8ded4d5f1f1d`, with inbound generation
`gen_60e615b9-d06f-43ca-8280-c3bd96cebe63` and outbound generation
`gen_55dd9234-0f8c-4a1a-9b57-d6d549888e82`. It retained one execution link,
one completed session, and no active draft.
The revision-guarded Web deletion created exactly one durable Program deletion.
Run `sy_fa74a008-6767-40e2-b973-7bda38eaad68` consumed Android generation
`gen_598eff4b-4b3d-4b8f-8202-1e0c153568ff`, published desktop generation
`gen_36f3dbbd-1610-463e-ab0d-f43c10392117`, and recorded its correlated
acknowledgement. Android retained exactly one tombstone and no live disposable
Program.
After Trainlog services and both stores were closed and reopened, the real
desktop production consumer replayed the preserved pre-deletion generation
`gen_9a0b7968-eeee-49ba-895b-36aa1783e412`. It returned the exact stored
`sqlite-commit-full` consumed ACK and changed no execution, session, deletion,
or Program cardinality. The final correlated run
`sy_ffb11cba-fa2a-43a4-89dc-7395b8a6cbc3` completed with inbound generation
`gen_020b4747-9260-4cd7-ac92-8381b93bfa73`, outbound generation
`gen_ff13e95b-274e-4abd-a006-c8bbddf6ded1`, zero reconciled sessions, and no
missing capability. The deleted Program did not reappear.
The protected Program
`Renforcement 4 semaines — priorité ceinture abdominale` remains active and
unique with its original identity, 24 sessions, 164 ordered entries, and no
`deleted_at`. Real Firefox loaded the deployed C server at 1440×1000 and exact
390×844 viewports; both had no document overflow, showed the protected Program,
and excluded the disposable Program. `trainlog-web.service` and
`trainlog-syncd.service` were active at closeout.
## Candidate boundary
The coordinated candidates are built only after the final source commit. Their
exact paths, source commit, hashes, Android package metadata and signing digest
belong in the consent-gate report so the archive inventory can bind to the exact
final HEAD without circular documentation changes.
The candidates were built from the exact functional source commit before this
deployment-only evidence update. This documentation commit changes no runtime
artifact; no tag or public release was created.

View file

@ -64,6 +64,12 @@ its coordinated private desktop/Android deployment, correlated deletion ACK,
and post-restart non-resurrection validation. It must not be reopened by the
Exercises contract.
`TRAINLOG_PROGRAM_EXECUTION_FLOW_V1=PASS` after its coordinated private
desktop/Android rollout, real start/resume/completion, correlated
`program-executions-v1` exchange, idempotence exchange, component restart,
preserved-generation replay, and disposable-Program deletion proof. It also
must not be reopened by the Exercises contract.
`TRAINLOG_SYNC_GAP_CONTRACT_V1=CONTRACT_FROZEN / IMPLEMENTATION_IN_PROGRESS`
defines the complete-sync target and its bounded dependency order.
`TRAINLOG_SYNC_TEST_ENV_V1=PASS/FROZEN` supplies the reproducible isolated