deploy 2026.08.30.03: 7 of 7 hosts, fofos plugins:update back to 5/5

deploy/2026.08.30.03.report.md

@@ -0,0 +1,55 @@
+# 2026.08.30.03 — report
+
+**7 of 7 target hosts succeeded.** `officer-dev` skipped entirely, as the host the rollout ran on.
+
+Every target went `816f8695` → `c97da029` by `git merge --ff-only deploy/2026.08.30.03`. No host was
+dirty in tracked files, none had to be skipped, and no merge was anything other than a fast-forward.
+
+**The release did what it was cut for.** `fofos` went 4/5 → **5/5, exit 0**, with `fofos-admin` reading
+`packages: installed and resolvable`. That was the one check that mattered and it passed.
+
+**No schema step and no `bun install` step** — the plan has neither, and neither was improvised. So there
+is no per-host schema query in this report, because this release introduced nothing to query for.
+
+## Per host
+
+| Host | HEAD before → after | `plugins:update` | `officer` restart_time | health |
+| --- | --- | --- | --- | --- |
+| `officer-dev` | — | — | — | **SKIPPED** — the host this ran on |
+| `alpha` | `816f8695` → `c97da029` | 15/15 | 7 → 8, online | `401` (9000) |
+| `fofos` | `816f8695` → `c97da029` | **5/5, exit 0** | 4 → 5, online | `401` (9000) |
+| `macbookpro` | `816f8695` → `c97da029` | no plugins installed | 7 → 8, online | `401` (9010) |
+| `macbruno` | `816f8695` → `c97da029` | 1/1 | 10 → 11, online | `401` (9000) |
+| `production-pertento-bridge` | `816f8695` → `c97da029` | 1/1 | 8 → 9, online | `401` (9010) |
+| `edge-pertento-bridge` | `816f8695` → `c97da029` | 2/2 | 9 → 10, online | `401` (9000) |
+| `deadpool-rezio-bridge` | `816f8695` → `c97da029` | 2/2 | 26 → 27, online | `401` (9000) |
+
+`401` on `/api/health` is healthy — the endpoint is behind auth.
+
+## What is worth reading
+
+- **`fofos` is fixed.** `plugins:update` there had failed 4/5 on every rollout since `@tiptap/pm` was
+  installed, and it now exits 0. The plugin step of the next deploy should be unremarkable on that host.
+- **`macbookpro` needed a fetch retry.** The first `git fetch` failed with
+  `Connection closed by 77.42.39.155 port 22` — gitea's public SSH, rate-limited at the proxy. That host
+  resolves `gitea.officer.dev` to the public address where `alpha` reaches it over the tailnet. The first
+  retry succeeded and the rollout continued normally. A later probe was refused again, so the window is
+  intermittent rather than closed. **Nothing to fix in the deploy; the remote on that host is the thing
+  that is wrong**, and pointing it at the tailnet address would remove a class of failure that costs a
+  retry on every release.
+- **`scripts/chk.ts` is still untracked on `fofos`.** Noted, not a skip, exactly as the plan said. It has
+  survived two rollouts now; somebody may want to commit it or delete it.
+- **`plugins:update` restarted sidecars on several hosts** before the `pm2 restart officer` the plan
+  asked for — `officer-music` on `alpha`, `officer-gitea` on `production-pertento-bridge`,
+  `officer-offscale` on `edge-pertento-bridge`, `officer-email` on `deadpool-rezio-bridge`. That is the
+  documented behaviour of the plugins step, not something this rollout chose.
+- **On `production-pertento-bridge` only `officer` was restarted.** Pertento's eight production processes
+  were not touched.
+
+## What was not done
+
+- `officer-dev` was not pulled, not updated and not restarted. It already holds `c97da029` and its
+  `officer` was restarted by hand at 11:23. **The owner restarts this host deliberately, as the last
+  step**, once happy with the rest.
+- No `bun db:push`, no `bun install`, no direct SQL. The plan called for none.
+- No file-browser check, per the plan.