From a5cdbdf2b9a60ba0881368d8542e16cc19b4ff45 Mon Sep 17 00:00:00 2001 From: fy59 Date: Thu, 17 Sep 2026 19:47:03 +0200 Subject: [PATCH] Document controlled generation archive rollout --- CHANGELOG.md | 9 +++++++++ docs/current_state.md | 20 +++++++++++--------- docs/sync_exchange.md | 6 ++++-- docs/tests.md | 15 +++++++++++++++ tui/meson.build | 5 +++++ 5 files changed, 44 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ee065e9..247a088 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,15 @@ and the prepared-items tile can inspect every proposal rather than only its first compact summary. +- Completed the controlled schema-v22/schema-v21 rollout without uninstalling + or clearing Android data. The production Android archive uses a supported + post-rename file durability barrier on emulated external storage, and the + desktop publishes each complete MTP generation before its correlated + reference. Two real post-migration bidirectional exchanges, separated by a + Trainlog-service restart, completed with durable ACKs and no session + duplication. The expected AI proposal retained its identity, six entries, + and `pending` state on Android and remained independently visible in Web. + - Fixed a production full-generation timeout caused by recursively uploading retained staging and unrelated transport history on every MTP push. Each phase now publishes a private bounded outbox containing only its request, diff --git a/docs/current_state.md b/docs/current_state.md index e120df8..04b464e 100644 --- a/docs/current_state.md +++ b/docs/current_state.md @@ -341,9 +341,11 @@ Android resource-parity, language-owner, typed sync-presentation, and stable-data presentation tests. A real-device/manual visual language-switch smoke remains a manual validation; it does not change the validated status. -Hardware-dependent MTP and the final real Drive plus Android-triggered AI-draft -smoke test are not automated. The latter is why -`TRAINLOG_AI_SESSION_DRAFT_V1` remains `VALIDATION_PENDING`. +Hardware-dependent MTP is not automated. The controlled real-device rollout +validated two consecutive full-generation exchanges around a Trainlog-service +restart. The expected AI proposal was verified in the persistent Android store +and the read-only Web proposal projection with its original identity and +content; no proposal-to-execution-draft conversion was performed. ## Active limitations @@ -351,16 +353,18 @@ smoke test are not automated. The latter is why desktop producers/consumers for `trainlog-causal-deletions` V1. All contracted domains are durably protected; exact replay is idempotent and unprovable or concurrent ancestry conflicts before mutation. Protected legacy snapshots are -refused before resurrection. Staged generation acknowledgement is implemented, -but active synchronization still selects V3: no staged-service activation, -deployment, or user-data migration occurred. +refused before resurrection. The default automatic daemon path remains V3, +while the trusted local Web opt-in now runs the deployed full-generation path. +Its acknowledged generations can leave the active admission window only +through the verified schema-v22/schema-v21 archive ledger; pending, rejected +and ambiguous generations remain protected. The focused causal closeout additionally proves child-data delete/update conflicts including change-and-revert, imported built-in and alias protection, active/pending/desktop draft-revision equivalence, protected companion refusal, current-view retirement and bounded pre-effect admission. The later generation slice additively advances schemas to desktop v22/Android v21 without changing -active V3 transport selection. +default automatic V3 selection. The residual causal evidence also proves legitimate Android and desktop producer directions separately for exercise retirement, populated body @@ -378,8 +382,6 @@ pre-existing GCC 16.2.1 Web warning gate remains documented rather than green. remain shell placeholders until their Core/API ownership and implementation order are explicitly contracted. - `APP_SHELL_V1` still awaits the recorded human visual/accessibility review. -- AI proposal exchange still awaits one real Drive plus Android-triggered - bidirectional smoke test. - Session Generator V1 is hidden while V2 planning semantics are developed. - Hardware MTP validation requires a connected unlocked Android device. - Scientific knowledge is bounded to reviewed catalog entries; unknown custom diff --git a/docs/sync_exchange.md b/docs/sync_exchange.md index 5c17565..9b7d2a3 100644 --- a/docs/sync_exchange.md +++ b/docs/sync_exchange.md @@ -824,8 +824,10 @@ object double; the same compiled transport algorithm remains under test. Each worker push is additionally scoped by a private disposable outbox. The first push contains only the correlated request; the post-import push adds the -desktop consumption ACK; the publication push adds the current desktop -generation reference and exactly its referenced generation directory. The +desktop consumption ACK. Publication uses two causally ordered bounded pushes: +the immutable current desktop generation directory is committed first, with +its manifest last, and only then is its run-correlated reference made visible. +Android therefore cannot consume a reference to an in-progress MTP directory. The durable transport root remains the owner of retained generations, staging, legacy compatibility artifacts, and evidence, but those unrelated objects are not recursively sent on every phase. Constructing an outbox does not delete or diff --git a/docs/tests.md b/docs/tests.md index 26f49ea..188fe51 100644 --- a/docs/tests.md +++ b/docs/tests.md @@ -1340,6 +1340,21 @@ Focused archive tests cover interrupted-copy resume, invalid archives, simulated insufficient space, missing and late ACKs, and idempotent ACK replay after archival. +The controlled Samsung SM-G990B rollout migrated the authentic Android backup +from schema v20 to v21 and an authentic desktop copy from v21 to v22 before +installation. The installed release retained its existing certificate and +advanced from versionCode 6 through 7 to 8 without uninstalling or clearing +data. Real MTP validation preserved the failed-run evidence that exposed an +Android external-storage directory-fsync incompatibility and an early desktop +generation reference. After their bounded repairs, run +`sy_06200dd7-0d51-4f33-b80d-9976822ba87d` completed, the two Trainlog services +were restarted, and run `sy_783014b0-f3f0-4f1e-8f4f-723acfc02dbc` completed. +Both exchanged distinct generations and durable ACKs with zero session +reconciliation. The final Android backup passed integrity and foreign-key +checks at schema v21 with 13 generations, five verified archives, 13 ACKs, +five consumed generations, and six active generations. The expected AI +proposal remained `pending` with its original identity and six entries. + ## Readability validation The normalized C scope is checked non-mutatively with the explicit diff --git a/tui/meson.build b/tui/meson.build index 4fd449a..cdcde4f 100644 --- a/tui/meson.build +++ b/tui/meson.build @@ -786,6 +786,11 @@ test( find_program('python3'), args: [meson.project_source_root() / 'tests/test_sync_deployment_tools.py'], ) +test( + 'sync_error_classification', + find_program('python3'), + args: [meson.project_source_root() / 'tests/test_sync_error_classification.py'], +) test( 'schema_v21_migration', executable('test_schema_v21_migration', 'tests/test_schema_v21_migration.c', dependencies: trainlog_core_dep),