From 19fdffe8bd15a39981d7f6ee238453765c31f795 Mon Sep 17 00:00:00 2001 From: Frank Date: Fri, 30 Oct 2026 15:34:10 -0700 Subject: [PATCH] docs(agents): a start-only quadlet handler no-ops an image bump The law today's authentik bump paid for: start on an active unit is a no-op, so the new digest installs and the old container keeps serving behind three green gates. Restart applies a pin. --- AGENTS.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 08d178d..c7c952f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -741,6 +741,13 @@ linked runbooks. `/etc/default/grub`. It replaced `amd_iommu=off`, and the local A/B on byte-identical traffic says identity mode costs nothing, so the XDNA2 NPU returned for free. [[dankclaw-iommu-translation-off]] +- **A deploy handler that only `start`s a quadlet no-ops an image bump.** + `systemctl --user start` on an already-active unit does nothing, so installing + a new digest under a running service keeps the OLD container serving while the + deploy, its health gate and the Playwright suite all pass — the authentik + handler did exactly that on 2026-10-30 (2026.8.3 → 2026.8.5 moved only the + outpost, the one handler that restarted). A pin change is applied by + `restart`, never `start`. - **Rootless Quadlet containers run with `--replace --rm`**: `podman logs` covers only the CURRENT instance; history across recreations lives in `journalctl --user -u .service`. Read rootless storage WITHOUT sudo — it is per-user storage, so `sudo podman logs` finds nothing.