ops(svos): v0.0.11 (452a592) on nh3-svos + nh3-dev — kernel 0.0.11, schema 13, U15 [tasks] config; terminal 0.0.4

Built in-session from a clean archive of the tag (kernel, connector base and
terminal wheels; everything else carried from 7f95e54). Ran after the 21:30
vzdump of VM 111, with an offline backup of the schema 12 database first.
check-config accepted the new [tasks] table and the tasks artifact mapping
(host nh3-svos, the terminal's artifact_host). Kernel READY in 1.17 s,
schema 13, apps up 7. nh3-dev's current moved to 452a592; svos-terminal 0.0.4
registered manifest revision 4, which was pinned without a card.

persistent-memory.md

@@ -1,6 +1,6 @@
 # Persistent memory — eshpfi-management
 
-_Last updated: 2026-10-12 ~1810 PT (decision seat: h2o production since 1807 on Prime's fix-forward ruling, after two rollbacks; earlier: U13 cutover + acceptance, fv-ml1 evidence capture, vh albok-everything.)_
+_Last updated: 2026-10-13 ~2135 PT (decision seat: h2o production since 1807 on Prime's fix-forward ruling, after two rollbacks; earlier: U13 cutover + acceptance, fv-ml1 evidence capture, vh albok-everything.)_
 
 > **Always check for `/tmp/infra-ops-handoff.md`** — if it exists and its
 > `Written:` stamp is under **8 hours** old, read it (it carries the in-flight
@@ -180,6 +180,7 @@ Every vLLM seat on a shared card (GPU 0, GPU 1) has byte-pinned KV (`--kv-cache-
 
 ## Recent decisions
 
+- `[2026-10-13]` **SVOS v0.0.11 (452a592, U15 task seats slice 1) deployed 2131–2133** after the 21:30 vzdump: schema 13, config_gen `5ade279d2fb2dd1c`, apps up 7; nh3-dev current → 452a592, terminal 0.0.4 pinned (no card). The tasks artifact mapping uses host `nh3-svos` (= the terminal's artifact_host), not svos-dev's `nh3-dev`. Rollback and details: `servers/nh3-svos/README.md`. Open: Prime's `GET /tasks` check, and a `task_argv` for the claude runtime when he names it.
 - `[2026-10-13]` **muninn-gate (corviduo-dev:8090) and mimir-inbox (:8091) STOPPED 2123** (Prime retired them at 1530; worldtree-dev: unit 6 needs the data at rest only, and up was worse because they kept accepting into an undrained queue). `compose down` only: images, compose dirs, config and `/mnt/muninn-staging/mimir-inbox` stay for albok's unit 6 (albok-dev owns the backup and teardown). Worldtree is a pure albok-service HTTP customer since beba08a4. Strip the retired config blocks (providers `library:`, `graph_store:`, defaults `kb_audit:`; NOT defaults `library:`) per instance only after it runs beba08a4+, demo first.
 - `[2026-10-13]` **Prime ~2120: "you may copy the notes, put the key in the vault".** (1) The fleet infra-ops SSH private key is vaulted as `nh3-dev/.ssh/infra-ops_ed25519`; the restore was tested (same public key derived, login to esh-nas). (2) Gate 1 is approved for the copy of Prime's Obsidian notes onto nh3-dev, BUT the vault's location is unknown: no `.obsidian` dir on nh3-dev (bar oldAIPA's old KB) or on esh-nas's shares (depth 5). Asked Prime where. Plan: Syncthing receive-only onto nh3-dev, the root path to albok-dev.
 - `[2026-10-13]` **Albok note intake (Prime 1530: albok subsumes library/note intake; Muninn's watcher, muninn-gate and mimir-inbox retired). Gate 2 DONE 1735:** wing `personal/inbox` on nh3-albok, Nemi token re-minted `01M4VX207PJ09ZSECASCSZPCFE` (vaulted `albok/token-nemi`; the old `01M4HAP9…` revoked 1742 after albok-dev's swap; the capture source walks), and `/srv/nemi/inbox` on nh3-dev (`playbooks/nh3-dev-nemi-inbox.yaml`). **Gate 1 (ruling 6, Prime's Obsidian vault synced read-only onto nh3-dev) WAITS ON PRIME:** the vault's location, plus approval for Syncthing receive-only (recommended). Thread `01M4VWV5FEF64EP71W60N6Q1N0`.

playbooks/svos-releases/nh3-svos-452a592-v0.0.11.yaml

@@ -0,0 +1,85 @@
+# nh3-svos -> SVOS v0.0.11 (452a592, U15 task seats slice 1) at svos-dev's ask (Prime's 2010 go relayed). Migration 0013
+# (schema 13) and two config additions ([tasks], the tasks artifact mapping). Run AFTER tonight's 21:30 vzdump of VM 111.
+steps:
+  - name: Private staging dir
+    shell: install -d -m 0700 /tmp/svos-stage-452a592
+  - {name: stage release, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-452a592/svos-release-452a592.tar.gz, dest: /tmp/svos-stage-452a592/release.tar.gz, mode: "0644"}}
+  - {name: stage uv, upload: {src: /home/lkraven/bin/uv, dest: /tmp/svos-stage-452a592/uv, mode: "0755"}}
+  - {name: stage installer, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-452a592/install-release.py, dest: /tmp/svos-stage-452a592/install-release.py, mode: "0644"}}
+  - name: Verify staged hashes
+    shell: cd /tmp/svos-stage-452a592 && printf '%s  %s\n' b38a2a09cdaa7475705108bdebdf96c9d434d71be142b89b4fb1dc15a2d3af1e release.tar.gz 83aa128da93e168283ed32cf75cd819fe17b135b3fc1f7ccb3c912eec198d9fb uv | sha256sum -c -
+    changed_when: "false"
+  - name: Install release 452a592 beside the live one (current NOT switched)
+    sudo: true
+    shell: python3 /tmp/svos-stage-452a592/install-release.py
+  - name: New kernel accepts the live configuration as it is
+    sudo: true
+    shell: runuser -u svc-svos -- /opt/svos/releases/452a592/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos
+  - name: Stop the local apps then the kernel (terminal, postoffice, miranda, agent run on nh3-dev since U13)
+    sudo: true
+    shell: systemctl stop svos-voice svos-knowledge svos-interface svos-kernel; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
+  - name: Offline backup to /var/lib/svos/backup/pre-452a592 (schema 12 database + config)
+    sudo: true
+    shell: |
+      set -e
+      d=/var/lib/svos/backup/pre-452a592
+      runuser -u svc-svos -- install -d -m 0700 $d
+      runuser -u svc-svos -- python3 -c "
+      import sqlite3
+      src = sqlite3.connect('/var/lib/svos/state/svos.db'); dst = sqlite3.connect('/var/lib/svos/backup/pre-452a592/svos.db')
+      src.backup(dst); dst.close(); src.close()
+      c = sqlite3.connect('file:/var/lib/svos/backup/pre-452a592/svos.db?mode=ro', uri=True)
+      print('integrity', c.execute('pragma integrity_check').fetchone()[0], 'user_version', c.execute('pragma user_version').fetchone()[0])"
+      runuser -u svc-svos -- tar -C /var/lib/svos -cf $d/config-keys-apps.tar config state/keys state/apps state/config-generations apps
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-452a592
+      ls -la $d | tail -3
+  - name: Config for U15 ([tasks] + the tasks artifact mapping), then the NEW kernel must accept it (else restore + old kernel back)
+    sudo: true
+    shell: |
+      runuser -u svc-svos -- python3 - <<'PY'
+      import os
+      p = "/var/lib/svos/config/instance.toml"; s = open(p).read()
+      anchor = '[[notifications.artifacts]]\nhost = "nh3-svos"\nroot = "/var/lib/svos/apps/postoffice/mail"\napp = "app-postoffice"\nverb = "artifact"\n'
+      assert s.count(anchor) == 1, s.count(anchor)
+      assert "[tasks]" not in s
+      add = ('\n# U15 (v0.0.11, 2026-10-13): app-terminal task results. host = the terminal\'s artifact_host ("nh3-svos", kept\n'
+             '# through U13 although the files live on nh3-dev, like the injects mapping above); root = its [seat_host].tasks_root.\n'
+             '[[notifications.artifacts]]\nhost = "nh3-svos"\nroot = "/var/lib/svos/apps/terminal/tasks"\napp = "app-terminal"\nverb = "artifact"\n')
+      s = s.replace(anchor, anchor + add)
+      s = s.rstrip("\n") + ('\n\n# Task seats (U15 slice 1, v0.0.11, 2026-10-13): the seat host\'s tasks root on nh3-dev (= terminal.toml\n'
+                            '# [seat_host].tasks_root); every ceiling at its default. No runtime declares task_argv yet, so a task-spawn is\n'
+                            '# refused routing_unavailable: runtime_not_task_capable until Prime names the command.\n'
+                            '[tasks]\nscratch_root = "/var/lib/svos/apps/terminal/tasks"\n')
+      t = p + ".tmp"; fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+      with os.fdopen(fd, "w") as f: f.write(s)
+      os.replace(t, p); print("edited")
+      PY
+      if runuser -u svc-svos -- /opt/svos/releases/452a592/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos; then exit 0; fi
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml.pre-452a592 /var/lib/svos/config/instance.toml
+      systemctl start svos-kernel.service svos-interface svos-knowledge svos-voice; echo "RESTORED config, old kernel restarted"; exit 1
+  - name: Switch current to 452a592
+    sudo: true
+    shell: ln -sfn /opt/svos/releases/452a592 /opt/svos/current.new && chgrp -h svc-svos /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current
+  - name: Start the kernel (READY-gated; migration 0013 runs) then the local apps
+    sudo: true
+    shell: |
+      t0=$(date +%s.%N); systemctl start svos-kernel.service; rc=$?; t1=$(date +%s.%N)
+      echo "kernel start rc=$rc after $(python3 -c "print(round($t1-$t0,2))") s"
+      systemctl start svos-interface svos-knowledge svos-voice
+      for i in $(seq 1 60); do h=$(curl -s http://127.0.0.1:8400/health); case "$h" in *'"down":0'*) case "$h" in *'"unknown":0'*) break;; esac;; esac; sleep 1; done
+      echo "$h"; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
+      journalctl -u svos-kernel --since "-90s" --no-pager -o cat | grep -i -E "migrat|0013|schema|error|refus" | tail -6 | cut -c1-200
+  - name: Regenerate the front door inventory (7f95e54 becomes the previous release)
+    sudo: true
+    shell: /usr/local/sbin/svos-front-inventory 2>&1 | grep -E 'GENERATED|updated|root \*|path /assets' | head -6
+verify:
+  - name: Inventory current
+    sudo: true
+    shell: /usr/local/sbin/svos-front-inventory --check
+    changed_when: "false"
+  - name: Health is schema 13, status ok, nothing down
+    shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"schema_version":13' && echo "$h" | grep -q '"status":"ok"' && echo "$h" | grep -q '"down":0'
+    changed_when: "false"
+  - name: App listener still refuses an uncredentialed kernel-key (401 from the kernel)
+    shell: test "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8410/auth/kernel-key)" = 401
+    changed_when: "false"

servers/nh3-svos/README.md

@@ -23,6 +23,27 @@ configuration, enrollment and acceptance.
 | App-consistent hook | svos-dev's `/etc/qemu/fsfreeze-hook.d/50-svos` stops the SVOS services on freeze and restarts the ones that were running on thaw. ⚠ **Debian's qemu-ga does NOT run fsfreeze hooks unless configured** (no `-F` in the unit, no `qemu-ga.conf` by default). Here `/etc/qemu/qemu-ga.conf` points it at **`/usr/local/sbin/fsfreeze-dispatch`** (`configs/qemu-ga/fsfreeze-dispatch`), which unlike the stock `/etc/qemu/fsfreeze-hook` propagates failure: if a freeze hook fails, it thaws that hook and the completed ones and exits 1, so qemu-ga refuses the freeze. **Live drill 2026-10-05 1952–1953 (services running):** quiesced backup `vm/111/2026-10-06T02:52:11Z` → kernel+interface down ~1–2 s, back by themselves, health ok. Refused freeze (temporary `60-drill-refuse` after 50-svos, since removed) `vm/111/2026-10-06T02:53:03Z` → the dispatcher unwound and restarted the services, and then **⚠ vzdump did NOT abort: it logged `ERROR: unable to freeze guest fs`, backed up UNFROZEN (crash-consistent, app live), and reported `Backup job finished successfully`, rc 0.** Both images mapped from PBS and mounted read-only (`ro,noload`) on nh3-pve-2, never booted: `svos.db` integrity ok (each image still carries its ~0.9 MB WAL: keep `-wal` with the db when restoring), interface `pins.sqlite3` integrity ok, config/key/config-generation hashes equal live, table counts equal live except `events`. **Monitoring:** `scripts/check-backup-freshness.sh` now reads the LOG of every OK vzdump task and reports ERROR lines; a freeze/thaw error is an APPLICATION-CONSISTENCY FAILURE, verdict **DEGRADED, exit 4** (alerted by the daily wrapper to infra-hermes). nh3-pve-2 was not in the check's node lists at all before 2026-10-05; it is now. Drill B is acknowledged by UPID in the script |
 | Monitoring | Beszel native agent 0.18.7 (`playbooks/beszel-native.yaml`, `configs/beszel-agent/hosts/nh3-svos.env`), hub system `t6y646ifa3x7xxv`, alerts CPU>95%/15m, Disk>85%/5m, Memory>90%/10m, offline/2m. Up 2026-10-05 |
 
+## Release 452a592 / v0.0.11, U15 task seats slice 1 (2026-10-13 2131–2133; Prime's 2010 go via svos-dev, thread `01M4WAGAS2Z0P8J6GZRSCRPH2Q`)
+
+- **Order:** tonight's 21:30 vzdump of VM 111 finished 21:31:30, then `playbooks/svos-releases/nh3-svos-452a592-v0.0.11.yaml`
+  (the kit was built in-session: kernel 0.0.11, connector base 0.0.8 and app-terminal 0.0.4 wheels from a clean archive of
+  the tag; everything else, including the web build of 7f95e54, carried byte-identical).
+- **Backup before the migration:** `/var/lib/svos/backup/pre-452a592/` (the schema 12 `svos.db` via the sqlite backup API,
+  integrity ok, plus the config/keys/apps tar) and `config/instance.toml.pre-452a592`.
+- **Config:** a `[tasks]` table with `scratch_root = "/var/lib/svos/apps/terminal/tasks"` (all ceilings at their defaults),
+  plus a `[[notifications.artifacts]]` for that root. Its **host is `nh3-svos`, not `nh3-dev`**: the terminal's
+  `artifact_host` stayed `nh3-svos` through U13, and its ResultReader names results by that host, so the mapping must
+  match it, as the injects mapping does. No runtime has `task_argv` yet, so a task-spawn is refused
+  `runtime_not_task_capable` until Prime names the command.
+- **Result:** kernel 0.0.11 READY in 1.17 s, migration 0013 run, `/health` schema 13, config_gen `5ade279d2fb2dd1c`, apps up 7.
+- **nh3-dev:** `/opt/svos/current → releases/452a592` (terminal 0.0.4, connector 0.0.8). `/var/lib/svos/apps/terminal/tasks`
+  (0700) and `terminal.toml [seat_host].tasks_root` (backup `.pre-452a592`). Only svos-terminal was restarted. Its manifest
+  revision 4 (0.0.4, `seat-host`) was **pinned directly, with no card**. The seats read unknown for 6 s, then live.
+  svos-miranda, svos-postoffice and svos-agent still run adc862e's code until their next restart.
+- **Rollback:** stop the kernel, put `svos.db` back from `backup/pre-452a592` (schema 12), restore `instance.toml.pre-452a592`,
+  `current → releases/7f95e54`, then start. On nh3-dev: `current → releases/adc862e`, restore `terminal.toml.pre-452a592`,
+  then restart svos-terminal.
+
 ## Release afab123 / v0.0.9 + U13 phase B (2026-10-10 1646–1648, Prime-approved 1639; svos-dev thread `01M4M2Z2H3BQH375M2G30GQHDM`)
 
 - **`/opt/svos/current` → `releases/afab123`: kernel 0.0.9, schema 11 → 12** (migration 0012, the page verb's tables;