diff options
Diffstat (limited to 'docs/refactor-groups.md')
| -rw-r--r-- | docs/refactor-groups.md | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/docs/refactor-groups.md b/docs/refactor-groups.md index f94a18b..f16f2f2 100644 --- a/docs/refactor-groups.md +++ b/docs/refactor-groups.md @@ -776,12 +776,25 @@ no syntax check at all before, which is how the file was committed. ### Done differently -- **No migration script.** The plan (§4.3) called for one to rename +- **Almost no migration script.** The plan (§4.3) called for one to rename `video_root` → `video_directories` in `roster.db`. Instead the roster falls back to the old key when the new one is unset, and the first save through the new path leaves it behind. A script that has to be run by hand on the machine where it matters is a step that does not happen; a fallback is one that - cannot be skipped. + cannot be skipped. `node.toml` needs nothing either — `upload = true` is read + as `writable`. + + **One transformation genuinely cannot be a fallback**, and an earlier draft + of this section wrongly said the script was unnecessary altogether. A group + whose operator had turned `member_upload` *off* has that switch ignored after + the upgrade, because nothing consults it any more — and its root still says + `upload = true`, so it accepts uploads from every member again. Nobody is + told. "Uploads are off for this group" and "this root is writable" are two + different sentences that happened to disagree, and only the operator knows + which they meant; there is nothing to infer. `QE/migration/check_upload_policy.py` + reads both files, reports the groups affected, and prints the `root set + --no-writable` line for each. Read-only, exits non-zero when something needs + a decision, so it can gate a deploy. - **`music`, not `audio`.** The app's registry key was `music` while its storage said `audio_root` and its ops said `set_audio_root`. One identifier per app now — the registry key — with the correspondence in exactly one |