b7c22e1 shipped without the RestartPending check in the snapshot selection:
a mutation test on the tests' own predicate failed to restore the file before
the commit. A snapshot is open again while an instance is unrestored or its
restart has not succeeded, so -Rollback -RestartInstances retries it.
Pester green on this exact file: PowerShell 7.6 (63) and 5.1 (62, 1 skipped).
The three retry tests fail without the check (mutation run on a copy).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- A rollback record now says which restarts succeeded. A snapshot stays open
while an instance is unrestored or its restart failed (or was declined), so
-Rollback -RestartInstances retries exactly those instead of reporting done
or stepping back to an older deployment.
- Running dependents (SQL Server Agent) are written to dependents-<service>.json
before the stop and removed once they run again, so a failed restart does not
leave Agent stopped for good.
- GetRegValue returns $null only for a value confirmed absent; a missing key or
read error throws, so it is never snapshotted or verified as absent.
- Instances come from the value names of Instance Names\SQL; the 'PS*' filter
dropped names such as PSREPORTING.
Tests for each, including the real registry operations on an HKCU test key.
Pester green on PowerShell 7.6 (63) and Windows PowerShell 5.1 (62, 1 skipped).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Admin check uses -not (IsAdmin); the old call passed -eq $false as arguments.
- Named instances: WQL filter Name='MSSQL$DEV' unescaped, lookup errors surface.
- SANs decoded from the raw extension (DER walk) and matched as whole names.
- Immutable deploy-, request- and rollback- records; already-bound instances
get no snapshot; -Rollback takes the newest snapshot not yet rolled back,
-Snapshot picks one.
- certreq -new, -submit, -accept and the key grants go through ShouldProcess;
a declined or failed prerequisite binds nothing.
- Rollback and automatic restore work per instance, read back, report failures.
Also found while testing: PowerShell 7 returns RSACng for a CSP key, so the
provider check now reads CERT_KEY_PROV_INFO; ForEach-Object member form returned
nothing under -WhatIf; stderr capture under Stop threw on 5.1; LocalSystem and
NetworkService accounts go to icacls as SIDs; SQL Agent is started again after
a restart; signature checked by OID.
DEPLOY.md gains the run procedure: preflight, DEV, docker-1 checks, production, rollback.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.
- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
SECURITY rewritten for the server with the requirement ID table, DEPLOY,
stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
healthcheck. Settings from the environment with secret files. Stack guard
(test never points at VISUAL production). Security headers and CSP.
Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
index only), compose base, proxy overlay for npm_default, CI overlay,
postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
database checks pass, 77 server tests pass against PostgreSQL.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
spencermandClaude Opus 5.5