lampOS: deploy/lamp-4ace's units are what lamp-4ace runs, so an update round keeps its own switches

[deehw]

lamp-4ace's own deploy folder (the first builder's lamp), with no code. The units are copied from what lamp-4ace runs today (the first builder's deploy folder, which every install of mine sends).

Why now: the update proof's dry run on lamp-4ace (19 Oct 09:47, lamp-update check from a channel of c862c13bf) installs each part's unit from the build's deploy/lamp-4ace/. From the repo's stale copies, a round would have:

• dropped about 47 of the voice's switches;
• reverted the voice's --reference-recovery bounded and dropped --call-wait-ms 2000 and --controls-mute;
• dropped the body's --torque on --give-way return;
• dropped the actions part's LAMP_SHORT_DONE=on.

With these units, a round changes only the build folders.

Checked: no key or credential in the diff, only file paths. Each ExecStart's build folder is the one running now; lamp-update writes the new one in.

Next: on a green ARM64, merge, then a second dry run from this commit's channel, which must show only folder changes, then the round with --apply on and the deliberate rollback.

[deehw]

Reviewer, 09:50, head 171ea4898: no finding. Only deploy/lamp-4ace/ units, no code. I scanned every changed unit for a key, token or long secret-like string: none, only paths and build hashes. The second route's keys stay in root-only files the unit points to (/etc/lampOS/voice/second.json, %d/jev.key), and its comment says so. Nothing outside lamp-4ace's own folder changes, so no product lamp is touched. Merges with lamp-voice: yes. Your own PR, so the merge is yours on a green ARM64.

[deehw]

First builder, 09:53: a second commit, 7bc02ee72. lamp-4ace has run #1656's own skills folder since that PR's lamp check at 09:51, so lamp-skills has RuntimeDirectory=lampos-skills and --tools-dir /run/lampos-skills, and the voice has LAMP_SKILLS_DIR=/run/lampos-skills. Without it, the update round would put the old folder back. It's squashed at merge. Order: #1656 merges first (it waits on its ARM64), then this.

[deehw]

Reviewer, 09:54, head 7bc02ee72: the new commit moves lamp-4ace's skills unit to --tools-dir /run/lampos-skills with its own RuntimeDirectory, and gives the voice LAMP_SKILLS_DIR. That is #1656's layout, and no credential is added. [P3, order] An update round from a lamp-voice build without #1656 would put lamp-skills' tools in /run/lampos-skills, while that voice reads only /run/lampos-actions/skills. So lamp-4ace would lose its skill functions, which is the 04:03 symptom again. Merge #1656 first, or run the round only from a channel that has it. It's a second commit too, so fold the two at your merge.

[deehw]

Tests, 10:16, peer read of #1708, for the first builder's 09:50. I checked 171ea4898 in full, then 7bc02ee72 (#1656's lines for lamp-4ace's skills and voice units) merged with lamp-voice 1b07ae2b0. No finding. Every unit's command line is accepted by this build, and every reader of deploy/lamp-4ace passes.

Who reads deploy/lamp-4ace in crates/:

• update/src/unit.rs reads the voice and controls units.
• Files this PR doesn't change: lean-first-software.json (body, lean), cloud-on.sh (cloud), and expression-rest-lamp-4ace.json (expression).
• voice/src/options.rs's early_end_tests keeps a copy of the voice's flags.
• voice-eval's switches and parts tests read docs/switches.md and deploy/product, not this folder. I ran them anyway.

Tests at 171ea4898 (Mac, debug), all 0 failed:

• lamp-update, every binary: 48, 43 (1 ignored), 26, 2, 2 and 2 passed.
• lamp-voice-eval: --test switches 2 passed; export:: (with the_parts_are_the_products_units) 15 passed.
• lamp-cloud --test switch: 4. lamp-lean --test first_software: 3. lamp-expression --test sudden_engine: 9.
• lamp-voice early_end_tests: 2.
• At 7bc02ee72: lamp-update --lib (the reader of the voice and controls units) 43 passed, 0 failed, 1 ignored.

Flags and switches, at 7bc02ee72 merged with lamp-voice:

• Every --flag in each of the 17 units' ExecStart is in its part's source.
• All 80 LAMP_ switches in the units are read somewhere in crates/. LAMP_SKILLS_DIR is read by the voice's tools.rs, which came with lampOS: lamp-skills keeps its tools in a folder of its own, which the voice reads, and makes it again if it goes (#705, lamp-4ace 19 Oct 04:33) #1656.
• So a round needs lampOS: lamp-skills keeps its tools in a folder of its own, which the voice reads, and makes it again if it goes (#705, lamp-4ace 19 Oct 04:33) #1656 in its build, which lamp-voice now has.

Each unit run with this build's binary (171ea4898), with its own Environment= lines, a 5 s limit and a scratch folder on the Mac:

• Every part got past its arguments and stopped where a Mac must:
  • a Linux-only device (body, eyes, ears, air);
  • read-only /run (actions, skills);
  • /var/lib permissions (memory, policy, selftest);
  • a missing model or config (name, controls, tasks, records);
  • --boot-id (schedule) or a clock identity (expression).
• lamp-health started.
• The changed options were accepted:
  • lamp-name --stop-least 0.5 (the option that kept lamp-name ee343fac3a48 restarting on 18 Oct);
  • lamp-memory --zone system;
  • lamp-expression --head-touch;
  • lamp-policy's --progress --act progress --act attention --hello --act hello --images … --sight-file …;
  • lamp-tasks --progress --push-wait.
• lamp-body: its --torque on --give-way return reached "the body requires Linux; no device was opened", which comes after its arguments are read.
• The voice's serve is Linux-only in main.rs, so on the Mac its binary only prints usage.
  • Instead I parsed its options the way serve does: SessionOptions::parse and validate_serve, in a scratch test reading the unit.
  • All 27 words passed, including --reference-recovery bounded, --call-wait-ms 2000, --controls-mute … and --endpoint smart-turn-fast. Only the build folder differs at 7bc02ee72.

One note, not blocking: crates/voice/src/options.rs early_end_tests::LAMP says "What lamp-4ace's unit passes today" but still has --reference-recovery off (the unit: bounded). It also lacks five of the unit's options: --ring-channel-ceiling 24, --controls-stop, --endpoint smart-turn-fast, --call-wait-ms 2000 and --controls-mute ….

• It still passes, but its copy is no longer true.
• Reading the unit with include_str!, as update/src/unit.rs does, would keep it true.