rdmsm4x — replicantDB: fleet brought whole, a silent version defect fixed, update/resume docs written

2026-08-28 15:45:49 EDT · rdmsm4x · ~/dev/apps/replicantDB Third entry in this thread. Prior: …20260826-1910-replicantdb-releases-and-handoffs, …20260827-1457-replicantdb-v1.4.0-reference.

State

v1.4.0 (5) "Reference" on 5 of 6 hosts. 340 tests, 0 failures, 0 warnings. Tree clean. HEAD 13c0e57. Tags v1.1.0 · v1.2.0 · v1.3.0 · v1.4.0. Nothing pushed to any remote — D-26 remains Rich's call.

rdmbair15m5 recovered, and yesterday's hypothesis is CONFIRMED

Yesterday I recorded, explicitly as unproven, that the host was FileVault-locked after a reboot. It returned today and was inspected directly:

Diagnosis stands. sshd serves from the system volume, so it answers and presents a matching host key; ~/.ssh/authorized_keys lives in the user's home, which is not mounted until first unlock — so the key is offered and rejected, and user-level agents like Tailscale never start.

Rule now recorded in FLEET.md: a scripted reboot of a fleet host must use sudo fdesetup authrestart, never plain reboot — it pre-authorizes the unlock so the machine returns with its home mounted. Plain reboot locks a remote maintenance run out of the machine it was maintaining. Worth auditing update_mac.zsh.

The host was still on v1.3.0; updated and verified.

A defect that shipped silently through the whole of v1.4.0

Running a pipelined MCP initialize against the freshly updated host returned serverInfo.version = "1.3.0" while the CLI reported 1.4.0 (5). ReplicantDBMCP/main.swift hardcoded the string, so every MCP client on five hosts was told the wrong version for an entire release. Nothing failed, nothing warned — a second copy of a version does not announce itself, it just disagrees. This is exactly the failure Version.swift was created to prevent, and it was reintroduced two files away from it.

Fixed at the source. VersionSingleSourceTests now walks Sources/ and fails, naming the offending file, if the literal reappears. I verified the test genuinely catches it by reintroducing the hardcode and watching it fail — a guard test that has never been seen to fail is not evidence of anything.

A second, smaller lesson from the same hour: my first fleet verification used sed to pull the version out of the handshake JSON and silently confirmed only one host of five, because serverInfo key order is not stable. It looked like a pass. Parse JSON; do not pattern-match it.

Documentation written (the ask)

• UPDATING.md (new, 195 lines) — cutting a release and updating the fleet. Every step names the defect that justifies it rather than asserting ceremony: single-source versioning; the four build.sh output lines that must be read rather than assumed (including the Metadata.appintents count, without which Siri sees nothing); universal2, because two hosts are Intel and a wrong-arch binary only fails at exec; executing rather than copying as the definition of "deployed"; the pipelined MCP handshake parsed as JSON; the back-up-then-dry-run-then-hand-sample protocol before any corpus repair; and a table that distinguishes a powered-off host from a FileVault-locked one from a reimaged one.
• RESUME.md (rewritten) — cold-start entry point, organised around the single most useful fact about this codebase: every defect that has mattered was found by running the product against real data, and several were invisible to a green 300+ test suite. It lists them beside what the suite said at the time, so the next session spends effort on execution rather than an eighth review.

Next — a decision before code

The classifier residual is now images classified from OCR prose: 19 png receipts, 17 png contracts, and oops_photos/IMG_3805.jpeg filed as a credential. Whether a photo of a receipt IS a receipt is a genuine design question, not a defect — both answers are defensible and the wrong one is expensive to reverse across 61k rows. It belongs in DECISIONS.md first.

Then: two cheap non-design fixes (reports missing from documentationDirectoryComponents; 15 .md stems outside the vocabulary), widen index roots to ~/Documents, ask Siri to actually run an intent, publish the dashboard, and deploy to rdmpw3265m when it returns.

Still waiting on Rich: Full Disk Access click · CloudKit container (team-permanent) · D-26 before anything is pushed · daemon registration.