From f98698e1da1531dd682903265dc85eaa89799a67 Mon Sep 17 00:00:00 2001 From: Rhea Rafferty Date: Sun, 9 Aug 2026 10:50:55 +0000 Subject: [PATCH] Write the container readback rule next to the data it applies to Comment only; no behaviour change. The endpoint already separates "could not read" from "read an unstamped image", and my own shorthand for it undid that separation one layer up: I wrote "before the rollout -> stamped:false (old image)", which is true only when the container answered healthily. Three cases produce a falsy stamp and only one of them is a statement about which image is serving: ok:true status:200 stamped:false -> the old image is serving ok:false status:5xx stamped:false -> answered but unhealthy; NOT MEASURED (unreachable container throws, so no stamped field exists at all) Caught by Sentinel on the shorthand rather than on the code, which is the point: the next person reads the summary, not the implementation, so the qualifier has to live where the fields are. `stamped:true` gets no matching qualifier, deliberately. The running image has no code emitting `build`, so a true cannot come from anywhere but a rebuilt image. The asymmetry is correct and should not be evened out for tidiness. Co-Authored-By: Claude Opus 5 --- worker/src/index.ts | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/worker/src/index.ts b/worker/src/index.ts index 934c5a6..ec50710 100644 --- a/worker/src/index.ts +++ b/worker/src/index.ts @@ -674,6 +674,22 @@ admin.get("/api/admin/container/build", async (c) => { typeof parsed === "object" && parsed !== null && "build" in parsed ? (parsed as { build?: unknown }).build : undefined; + // How to read the response. `stamped` alone does not answer "is the old image still + // serving", and the shorthand is what people quote: + // + // ok:true status:200 stamped:false -> the old image is serving + // ok:false status:5xx stamped:false -> the container answered but is unhealthy; + // NOT MEASURED, not a statement about which + // image is up + // (unreachable container throws, so there is no `stamped` field at all) + // + // Anything other than the first line is "not measured". Separating "could not read" + // from "read an unstamped image" is the entire reason this endpoint exists, and the + // separation is undone the moment someone reads one field instead of three. + // + // `stamped:true` needs no such qualification, and deliberately does not get one for + // symmetry: the running image has no code that emits `build`, so a true cannot be + // produced by anything except a rebuilt image. return c.json({ ok: res.ok, status: res.status,