amadan
docs: carlos fleets ls proves registration, not a heartbeat
1 file changed,
+21
−8
infra/no-inbound-box.md+21 −8
diff --git a/infra/no-inbound-box.md b/infra/no-inbound-box.md| index d35f7cfb0..bc34495bf 100644 |
| --- a/infra/no-inbound-box.md |
| +++ b/infra/no-inbound-box.md |
| @@ -252,12 +252,25 @@ with no box access of any kind: |
| chain end to end in one command — the box booted, dialed out, adopted |
| the record, spawned the child, and the child called back over the |
| agent socket. This is the check that matters most; do it first. |
| -2. **`carlos fleets ls -account <acct>`** (or the fleet page, |
| - `/a/<account-sqid>/fleets/<fleet name>`) shows this box `active` with a |
| - fresh heartbeat — proof the tunnel itself is up, independent of whether |
| - any sidecar has adopted yet. Useful to isolate "box never came up" from |
| - "box is up but the record hasn't minted." |
| -3. **`aws ec2 get-console-output --instance-id <id>`** if 1 and 2 both |
| +2. **`carlos fleets ls -account <acct>`** proves the box is |
| + **registered**, nothing more. Its `STATUS` column is |
| + `registry.FleetBox.Status` — an `active`/`detached` membership flag set |
| + at `add-box` time (`internal/console/fleets.go`), not a heartbeat. |
| + `infra/eleven-fleet.md`'s own Step 2 shows this plainly: it reads |
| + `active` immediately after `add-box`, before the box has ever booted. |
| + Reading `active` here tells you the token exists and hasn't been |
| + detached; it tells you nothing about whether the box has ever dialed |
| + in. Do not stop at this step and conclude the box came up. |
| +3. **The console fleet page** |
| + (`/a/<account-sqid>/fleets/<fleet name>`) is the one surface that |
| + actually renders heartbeat freshness — `internal/console/fleets.go` |
| + joins each box's registry row to its own heartbeat by label and shows |
| + it Reachable (a fresh heartbeat joined) or gives its Age (a heartbeat |
| + joined but has gone stale) or neither (no heartbeat has ever joined at |
| + all). This is a browser-only check — no CLI verb surfaces it as of this |
| + branch — but it needs no box access, only a signed-in session, so it |
| + still fits this runbook's "no box commands" constraint. |
| +4. **`aws ec2 get-console-output --instance-id <id>`** if 1 and 3 both |
| stay stale past a reasonable wait and you need to see the box actually |
| trying to boot. This is the one channel that needs no reachable surface |
| on the box at all — it reads whatever the instance wrote to its serial |
| @@ -267,7 +280,7 @@ with no box access of any kind: |
| logging on rather than quieting it for this box class. |
| There is no honest check for "did the provisioning pass log a mint-time |
| -refusal or success" from off the box — if 1 and 2 both look right but the |
| +refusal or success" from off the box — if 1 and 3 both look right but the |
| record still isn't where you expect, the *Abort* below is the next step, |
| not a log line to go find. |
| @@ -280,7 +293,7 @@ environment on this box (no shell, no SSM) — treat `CARLOS_INBOUND` as |
| unfalsifiable in place. The fix is the same one Rollback summary's last |
| entry describes for this box class: there is no in-place restage, so |
| terminate the instance and re-apply Step 4 with the value double-checked |
| -in its user-data, then re-run checks 1-2 above against the replacement. |
| +in its user-data, then re-run checks 1 and 3 above against the replacement. |
| ## Flipping an EXISTING box to `CARLOS_INBOUND=none` |