diff --git a/controller/docs/operation-model-roadmap.svg b/controller/docs/operation-model-roadmap.svg index 3203c791..6595d0d7 100644 --- a/controller/docs/operation-model-roadmap.svg +++ b/controller/docs/operation-model-roadmap.svg @@ -1,4 +1,4 @@ - + Operation model — ticket map, dependencies, and the standing directive Three columns that mean delivered / in flight / next, with arrows for what directs what. Teal cards are hubs: arrows leave them because the rest of the board reads them. The band at the top is the standing directive and its ledger of facts — every change that touches a fact updates a row. Flip a dot's class as work lands: s-done, s-doing, s-todo. diff --git a/controller/docs/state-spine.svg b/controller/docs/state-spine.svg index a990b0c0..59a77762 100644 --- a/controller/docs/state-spine.svg +++ b/controller/docs/state-spine.svg @@ -40,7 +40,7 @@ System lifecycle — where a user gets stuck -A state is a combination of facts, never a screen. Verified against the working tree, 13 Aug — after ADFA-5137 deleted setup_complete. Every edge cites the guard that allows it. +A state is a combination of facts, never a screen. Verified against the working tree, 15 Aug — findings 4 and 7 closed since (ADFA-5147, ADFA-5150). Every edge cites the guard that allows it. LEGEND @@ -213,17 +213,17 @@ reached another way - -S5′ · Damaged, never diagnosed -If a lock is held, or an install or a queue -is running, the recovery branch never runs. -Lands on S1's screen: no dialog, no Retry, -and no mention of damage anywhere. + +S5′ · Damaged — now diagnosed on Home +Was a dead end: a held lock or a running +queue skipped the recovery branch and Home +read "no system". ADFA-5147: Home now asks +InterruptedInstallDetector → "needs repair". DEAD ENDS, WORST FIRST — traps, then one-way doors, then exits nobody can find, then controls that do nothing -Ranked by how hard the state is to escape, not by how ugly it looks. As of 14 Aug: findings 1, 3, 5 and 8 are closed, and 4 lost one of its three blind spots. Finding 8 was found by using the app, not by reading it — and one of its claims turned out to be wrong for the same reason. -Findings 1, 2, 3 and 4 are one sentence four times: a fact nobody clears. They are rows in the standing directive's ledger at the top of operation-model-roadmap.svg — fix them there, not here. +Ranked by how hard the state is to escape, not by how ugly it looks. As of 15 Aug: findings 1, 3, 4, 5, 7 and 8 are closed. Two remain: 2 — the release blocker, a stale busy flag nobody clears — and 6, a banked order with no home and no owner yet. +Findings 1–4 were one sentence four times: a fact nobody clears. 1, 3 and 4 are closed; only 2 remains, a row in the standing directive's ledger at the top of operation-model-roadmap.svg — fix it there, not here. 1 · CLOSED (13 Aug, ADFA-5119) — the boot gate no longer holds an install nobody can influence @@ -236,7 +236,7 @@ is still a trap — rarer, and unbounded. And the kiwix index (:478-479) and maps (:545-546) still send exit AND error onward, so a failed companion run reports as a finished install. Maps → ADFA-4898, the rest under ADFA-4893. -2 · HIDDEN EXIT — a stale "busy" flag refuses every deep operation, and the way out has no name +2 · HIDDEN EXIT · RELEASE BLOCKER — a stale "busy" flag refuses every deep operation, and the way out has no name A download service killed before reaching a terminal state leaves EnvironmentLock.isBusyNow() true. Clone, backup, restore, module install and the dashboard rebuild all refuse, all with the same message — "An install is already running" — while nothing is running. It is not durable: every source it reads is in-memory, so closing the app clears it. That is the whole problem. The exit exists and nobody will find it, because no one closes an app to unblock a button. @@ -279,12 +279,12 @@ anywhere in the UI. LibraryHomeFragment.java:518-529 (anyRunning gates the button), :337-342 (isScheduled ignores three of the five wishlists). - -7 · DEAD CONTROL — Connect hands out a QR for a box that may not exist -ConnectFragment reads no system fact at all: not isSystemInstalled, not the server state, not the lock. With no system, a damaged one, or the server stopped, the whole -tab behaves normally and prints a QR pointing at a dead port. It is the largest visible-but-useless surface in the app, and the only one that says nothing at all about -why it will not work. -redesign/ConnectFragment.java — browseUrl():126; no reference to SystemFacts, ServerStateRepository or EnvironmentLock anywhere in the file. + +7 · CLOSED (ADFA-5150) — Connect and Clone Send read the system fact and offer Recover, not a dead QR +Was: ConnectFragment read no system fact at all — not isSystemInstalled, not the server, not the lock — so with no system, a damaged one, or the server stopped, it printed +a QR pointing at a dead port. Now both Connect and Clone Send check the fact on entry and on resume; a systemless surface shows an empty state whose one action is Recover, +homogenized across the two tabs, instead of a control that leads nowhere. +ConnectFragment.java:117,146 (isSystemInstalled on entry/resume), :173-175 (Recover) · CloneFragment (Send no-system empty state) · SetupLibraryActivity.recover().