memory: Worldtree memory-split flip protocol, and all three deployments measured writable

worldtree-dev's U6 reader refuses at boot if it cannot append and read back <memory root>/reader/canary.jsonl. Per-euid subdirectories are lazy and only warn, so that root canary is the single boot-blocking check -- which makes the memory root's writability by the container uid the precondition worth knowing before a flip rather than during one. Protocol agreed with worldtree-dev: neither memory.reader.enabled nor memory.writer.enabled gets flipped on any deployment without infra-ops confirming that writability first. Both ship dark until the operator schedules the tracer skeleton. Measured tonight on corviduo-dev, all three pass. Also retracts a wrong prediction I sent earlier in the thread: personal runs as root, not uid 1000, and pinned is the only uid-1000 deployment -- it passes regardless because /data/state is owned 1000:1000. Recorded with the caveat that a permissions reading is a claim about its own date, so the probe gets re-run immediately before any flip rather than cited from tonight.
2026-09-11 22:12:08 -07:00
parent ddfa1a6e5b
commit 2dd459d2e5
1 changed files with 2 additions and 0 deletions
@@ -150,6 +150,8 @@ _As of 2026-09-11 ~17:45 PT._
 ## Recent decisions
 - `[2026-09-11]` **Worldtree memory-split (U6) — PROTOCOL AGREED with worldtree-dev: nobody flips `memory.reader.enabled` or `memory.writer.enabled` on any deployment without infra-ops first confirming the memory root is writable by the container's uid.** The reader **REFUSES AT BOOT** if it cannot append+read back `<memory root>/reader/canary.jsonl` (deliberate, the #335 typo'd-reranker precedent: refuse loudly, never silently disable); per-euid subdirs are created lazily and only warn, so the **root canary is the only boot-blocking check**. The writer degrades rather than refuses. Both ship DARK (`enabled: false`, parity-only `config/defaults.yaml`) until the operator schedules the tracer skeleton. ⭐ **Measured 2026-09-11 on corviduo-dev — all three deployments PASS**: demo :8080 uid **0** and personal :8081 uid **0** both have `/data/state/memory` at 1000:1000 755 writable; pinned :8082 uid **1000** lacks `memory/` but its parent `/data/state` is 1000:1000 755 so it can create it. ⚠ I had predicted personal was uid 1000 and warned it would fail — **wrong, retracted**; only pinned runs as 1000, and it passes anyway. ⚠ Re-probe immediately before any flip: a permissions reading is a claim about its own date, not about boot time. Heimdall side is clear too — demo and personal grant 7x `tool.*`, pinned uses image defaults, and the lone `tool.evidence.*` is additive, so `tool.memory_read` needs no policy change. Thread `01M2A05WED5W`.
 - `[2026-09-11]` ⭐ **Plex hardware transcoding on the Arc A580 FIXED (esh-pve-nas LXC 105) — every setting was already correct and the fault was one layer below them.** `intel-media-va-driver` **22.3.1** (Apr 2023, stock jammy) predates Arc/DG2 support and exports only `__vaDriverInit_1_14`, against the libva **2.22 Plex BUNDLES** and loads via RPATH. Passthrough, cgroups, `plex` in video+render, HuC authenticated, Plex Pass, `HardwareAcceleratedCodecs=1` and the Arc already selected as `HardwareDevicePath` — all good the whole time. Fixed with Intel's client-GPU repo (rolling `jammy client`) → iHD **24.3.4** (`__vaDriverInit_1_22`) + a consistent libva **2.22.0.2-87** set, now **pinned + `apt-mark hold`** (verified: a simulated upgrade moves 152 packages, touches none of the six). Also repaired a **half-finished prior attempt** — libva/libva-drm hand-installed at 2.22 with `libva-x11` left at 2.14, killing every X11 VA-API app on `va_fool_postp`. ⚠⚠ **`pct snapshot` REFUSES on a bind-mounted guest AND STILL EXITS 0** (LXC 105 has `mp0: /tank/media`) — use `zfs snapshot nvme/subvol-105-disk-0@<tag>` and read it back. ⚠⚠ **A synthetic `Plex Transcoder` run is NOT a valid test** (Plex bundles its own libc among 61 libs; my harness failed identically before and after a fix that worked — no positive control, so its negatives were worthless). Only a **forced transcode** settles it: PASS *names the device* (`testing API vaapi for device '/dev/dri/renderD129' (Intel DG2 [Arc A580])`). ⚠ The original empty `final decoder: , final encoder:` was an **absence of evidence**, not failure — `TranscodeSession` was 0. Jellyfin LXC 107 left alone (operator: not actively used). → `persistent-memory.d/2026-09-11-plex-arc-vaapi.md`, runbook `docs/runbooks/plex-arc-vaapi-jammy.md`
 - `[2026-09-11]` **Beszel priority 2 complete:** both DB hosts and both PBS hosts verified, 16 new alerts; fleet 17/18 up (ana-ml2 down). → `persistent-memory.d/2026-09-11-beszel-priority2.md`