From 4937fd6e62aceb01c2a234a788e582e03638967c Mon Sep 17 00:00:00 2001
From: fisher <fisher-claude@fisher.hu>
Date: Sun, 23 Aug 2026 07:52:17 +0000
Subject: [PATCH] Match house writing style, add docs/hints.md

---
 bin/__pycache__/cd-targetcpython-312.pyc | Bin 0 -> 9226 bytes
 bin/cd-deploy                            |   2 +-
 bin/cd-status                            |   2 +-
 bin/cd-target                            |   2 +-
 docs/OPERATIONS.md                       |   4 +--
 docs/hints.md                            |  32 +++++++++++++++++++++++
 6 files changed, 37 insertions(+), 5 deletions(-)
 create mode 100644 bin/__pycache__/cd-targetcpython-312.pyc
 create mode 100644 docs/hints.md

diff --git a/bin/__pycache__/cd-targetcpython-312.pyc b/bin/__pycache__/cd-targetcpython-312.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..bef1e657d045244b49921b9c173ffa5309b9acd8
GIT binary patch
literal 9226
zcmcgyTTmNUn(kJ&q?WoR0mgvwg*MpO;^qW9H=Nju4K|KrVH<LRIIA@31_VMP-7PRg
zWSFVh8c4hgo}>yg@m84K%q-cYYMrX78qd?lGY^}peGwK6Ooy#<YM$~&f_H1yyAS*S
zr@MuW6=&vUyGrMrKK-Bj|9}7G=-+)lF9lD_FW(+$E2XGE;*0&b%>upoW16DoD4FV}
zWLkE_=pje9gT^uwW4alVv)wGoo!w57ySiN@cXzu<&UJH;voX(*x7$lo4odMV{3p;a
zJ_EbVJU9KsdKoCstu@Q}>bm`;Pv^kCJoNh?u9KaLUv`c26!nS2{A$mpyHIv_7s<sk
z_hYtuhrCnvKwd1D$X>{I%B3<7d5K&m3y_z}yJR2aWsv(J-vxO9@^Z)vAm1&Q%Y~5d
zk$1~QkndIY$vXxQQ<Pc;^W_FkJUla~-)pblo)b-tF=I?{kMtEoQJ0d6IwtCp+NbDR
z!+@5EH+a3B{famw#iPB7ri)Qc)Zsl5kBy1LF)5<JtE7vA@x-Vm_9sR~Nj$77!-+bv
zN0s7{{-8K4MOA1&tU)6^Axhr<gr?U4T_iCyoX`|e)1}CuD8*&?iP0gcPiYWaM_?j)
ze>C1FDlwp`uP4LG%5W?(CTbBiIt+clOrW>KpxCFx6;;v`Dyb8rap*G^Q&emxX@fXt
zn0UVu8-_X{?1v2I9f!%O8V>S&M|;Q{)iov7TPJD>>{(TCvC35`qQhDfad;gXjwwS*
zT$l7{A}%I+kqnlmN619gWK7XuzdDjVur$~)S!?o&@TiKGh>hSPaA(B!mqV?WkA#{p
zv_g%!OX8`^&7sq6;;Z%bxI1E7dq?MMq%F3;s7B+usKNAO^=~8-x+06`Tf3fnsriK$
zTg6y3u4rO!0vD7s8S@MqvVF8(jq2i2akO8Fi}8fHvt;Jb_^<?3>W~zxgFIfZs4DaZ
zlTOC;CJ~wqBsD$T(U2m=t^FKMYW=uJ(4Uw{s!$8Z8-a2>2-|=&k40fIk6IMYIW7$W
zL-mRZp1G*RrJfk9&|H9+7>&bA&luT~I&utnhPY~L4BS)gdk2wWCeb)dj*v%zRidzR
z+-K2bDlKp4cpCMQM7%fJ_sAh0IGj`GLM=xwwqNcf$AV*6Q^nqJwOV#J&7-w<!P?g$
z2^mTOanME;b6XF~QK>Hu&7%<wH`khYuLNgA_8q&3B_dJ`_|a?~jaxgaW%;qe`!#|>
zkT!TJ4yQ)=SPQ{Bdl7`f2%K&ScQ#)>+uGR?K6CDc)^Q;h3cdz_pdz`bf-nx1^yWnZ
z<GKa90J|3O<r3S#(@#%O9x6o*ICH<6<(wW|4}Z0L_{18ArgYw>N>O%g3-wwpMNQB$
zouWr5jlRa^A1g%<`0UnOIj9nc4cjt<+QaUbrmoeqFz*&>#u0J!QxV5&J7FA0$^m1z
zQjUSZRxftRp7Bo|*GgGvG2!T-swkbazaOAfhNilxYsx5fmFc2J=?JJlq#LDztn?}@
zlpvugBLu|k;|1_dYSA8mrY$zH*sKlsL<0~6L;&gRjVX#QN&si7(hIVUvXwxII&-Nd
zWK!kedr#675fz#cF4g)IP$n|kt0soT*KH<#od9JIU<tDMkVdc;K%8)*BFPA=F{ww1
zp=?X>G140u6F|9N0z8CiL=s7WHc10@K+vc`Jgev+sD0+#N7V!r5xPOMV8@A=O!@%~
zs2^4n0}4pAsSN<C<1(x*IV_GwVNMdrwIpv%SKR-cs5QPW_9Z1%HgWMj-S9QCl8W3K
z<P4XVhzu&a!Grd*S7|VkEE{g9>3u_v8}9awR)j}`MQAge+HfoiSu6p98e|M7k#2*<
z%%I~M2nPi)c;D9(jUS1~^`<x(0V1hkdkjr20lG%`Y4eawQuhidfAOlXV#!yL@$F9w
zm6NR-4#w$Q<9suoY0rDra}C!UGDVfkT-7}nRk(BZ#drB{DTlLuie2OVvj^Tjz9tmT
zoSQy3E6)vFA6VG2AZ1DpFBUG9)UF718&06ya8csH-}5!|`~R7qYMwbeefDq9-QjD}
zY|WqU@szORTZ(r2{=f+v4CMd&t(OvNwY@O8xvEpe)a|F-r>fZ7CyOBcZL#N+$o#f~
zhBT5Z_AF2naJYiaP~fxh02S6_3&;d~M{&JMYo#>O;?8Y*9u`e((E)-IQc<E*4<_U+
z9cm$#3m^$P4Bp&!vfpYE)M-crdKu)GG6Xz^u%!!Cl=xO8c?yzAYOQGRYEjivQB|hs
z;N<x=zGVJjny<LSw=EoBtva?;b?j!xt^Jv*XK!6vsyg}k6X~k9G~2cbO&<hGggUYp
ze%OOKfWI7|%iS|<2#=0?N1g%8QnueQxA)8jriUP<A{Q73gxt1fS*Eu}_<;I*husrG
z(HNy?8w~if#cTl}t8yX-c=Pt}NKxDSm8l8pE$H3MM`;`If=p<<A}bnA00Wk#iB?4~
zz=PZ*jvvZLU|Aj`QY<PH1FlH~A!gBPMTwMT&EPIHht8d8?dUW-Dxg7FSFY+t;hAVm
z2_^J1*tsdqj5ekjtO7QY5kOP0MTsP2g?t0$$S7AM8ZxiNF)Vhj9)ybL;inBkGD&SX
zoX%79dSJ)Q`1JUV!>i?WOXYQ$@`g;{NSZtHr*(c0iqy$<j-TPCx%7_4Up;-ZCSCa4
z@3|A}d|;KYSmG;?0{XB?nr<DvbueA{SF2p}64(4cD2k`(``T_8??=@^>f?i_Smt&?
z5vG-8%_o`LC!J7!KnSyp_Z~C?A*5ADitfl^Kbx6Ak9~*GMYC=UXjYJ(2}Z|W$&+GI
zS#1egupkAa(;$*8rDqv;Agk@{R$D9#!s{46eOb|yDr&1OJ#<JDBN7;+QM71G<zrd6
zD6Qfs7)PMcz}Q4pA!!YU6YI60lR&A#0A3SOR?!Dlc}Rk+!P&fJaLQEx?nqQ8aA2^c
zF$x`kwROmz;b>&ggp4})&;dW~1xO~TuiSyPK<QLqUD%xw_D;606_m{h*M<3)7kV-U
zLB!#*DR!MNooDBj75>25j?%Z!Bj%Rf0~9S<<@YY}doz4RnypaL1C8XuB2Je8#Wg5=
zA85jPJWf$p06-?_35TAA%oP0rxX@dtG?2%Z(h)4l11D(Bz|KK*8M_Qt&rue{Hs}c5
zr=JTt4QEtWhBU)Dj7|wC!2XzW)o>EG#9%a?XhC%OG=mvb#tbKjXHu~hp^3PxG6Xx1
z0Q)-pv}Yj!q%GM!H+X&U-60f$#%b>qGxg#+=bPOz>zuvxUUKfu>u-K^bRqeVO_|b$
zbjgvl|FISB@ozvR8qHnIh0*LTo`TxB9Bxn1z~#A=Ff=~4#Ydzd&v(tcwVSrY#LM&d
z^(e>&+m`{mGrRZZ=$Oj%mYhwn-$CQ(%gz+e{+Dp>&XhB6Z;Z^^YXZ3}NjYUFYBrcL
z?#;Gm5RO7C0veY^lSgGBjY?lTu4k=Wpm!5`CTFDcQ7Xm$f=)SqK~I29oN~z=9<Pq-
zm^>-hzz(~-mD_s?wzYePi!f2Nu4^scc296A_W<hZZIA4+xfEtrCVPRZbQ=l0+I^!!
zN^$Qx(29>R6WoN`ZcS4V1mOX*%Iwx1Fh1DfgbFNiA!Kl}Vme!f+wzGFx8<sK8Z0`M
zhRgKjRhTzr_$;SiCJ<uKVS@qZ%Ct^=Dk2J@BXDIJD-gM%RNO4}IZSYCiHxX6pk#O<
zqM_;<nzn{BISlr%!G+qx7n(ayw*@^03n3d#4PqM{p1_*=3^sIGHm7SyfvApb(1Qj&
zq9F$&){)1QN<K0qhpkzw=is{nKMmXy5YBbJc=nZf{ll^M$1;3yvSsaH@SnQ=q3c@v
zvat7N=dZgy>-u&0vvB5#GwEYz0T2VFGpXs+{PT;BOrUnM?QT)|T;27$`LV^yOi}%}
z6z?pYa;*h+qNbb=E_5yjYSx6}HNJ4RdiunC=Z9VIcirKu7prfUE!8yLlK*w^H-mR-
z&H>4KVE6o)g(u$+Ew(NP8lmED;i1{Kbm5@|7bMVUW%ZP6>IX|)#X2V}j{HmN<J2c_
zt@>X6xxVnm;{MMs{o9q>SJIbXTxor2mYHpyJA3`?yXR()r~MTRg-ia*jPK=T?v+0T
z3N}h%hWE-Tp?I?Wzc<~K{}oz8k@#Ktu9n@x?~au~nqSNQ7f=z@hJ5=27?MS3n<oi|
zY$t^Ge7>>W1~3G4cs`Vo=?C!PDC+7Ilb6yV=Spo!jy3?~AX1&H*Q;~<Y{o>AE!nyD
z1n37>&>d2nVCL#^NIFd>L_s$>-j$cx35!1lL_t<<L0ZDUXrQaDkZ3F<$e<>Fa>$?P
zb*bl}ejEvUApy<tXlC5Td=6(NFbZEd(=^>Q8(k<~;j2G=_Ll3`$Zz~#I9F;z>jJRh
ze985O6=6SW?Mm>J1mD9tCTm$e4-)eKaprw^nt#r@H^aHJDfTZscQ)U-r&vpGFe5bR
zkp|!<9`=0OV^ihu#A!g&Y;;9-<%^A^vNpz6yD@i=dzg<96z|hs%T51IRx(@?;9^`>
zk)^;7NJQgc4?f6P2CFGb++;62L1Zu6;4|?Lf{E%S`0^w8X@3XF_cB;X835uoE@PdC
z^FSOLg|7LL_x+2`6~5u-leelrJMl&Foue1lgo2s#)91~PE5e}-4|D+LqSHHdU?w;n
zoNamM$TC~L#tRQKA{uwZWV{1~ztGsB^8rn+DU$E|mcfYdGP&!~roIdTvJU`ma!tw{
zIB}$Gz_EZucHPJ_2B>Ai5Qku8;{`cBAaMf5&p;Rnqt6ie(IIk-0k52!3-J)K>JK%D
z&9Y1a$2|%JsvwMS-VUJWfKmPigN5jfY_P)+=z<uI8}u}WS4jawxuk&MTpP=_v^UY&
z`(bu!B_?RnK7eJlP+_>t`0+M43n07U48!JUwF_vG-z<OfA(iXfIdf(D%KV{)#*D9e
z)mO9Rt64mj@jW(qX3g!Je9Q70*ZlkD_4)n{iayi;iLc=v!+5;+ILhgn?Of<xeCg-$
z&r7~=-QKt4xwy<;%F9vcun~^xhC(h!$#lNB%$8}q#R;~uvPFA)4kzmX&;LFxnw!cJ
zp;g;qKn%mFaK}MRBZ%HO!)V(W9thExk%0%IH$HnCN#sopLkB;DpN4mJV7IWIsj8X7
z(}&-C^2U)&d2MD#UB+9#%r<1#4P@CT3+b<b3y{0+d@h4bf0}iiFnX0wQe@!mPo1`T
zJOKgeyrAr|cLx-^Bd<B{hJHA^ABd0Tr}F$+R9<^D(oY^Z*R$sTr`dZ{xRVw1Y&59X
zA^UU;u8{}c{5ooF>#dgo=LBp|;+QhTnaKtNY$|X?vQqw?tNz}Zrr6vWUONuq`TRQ^
zu-8n+%D3iXduF*k!l^#Op&-r|+A!OmlvBqL4SBM1U^$f#@F)n4@3HP#A>eVk#lGpX
z*&A<XWW@|>!!@Jfwk{JpK^9o}pc|a3ypfDTAm4CX_WHQXyju*?stn_fbN0m|en61H
zE1uqDJffoeW;n?u*f@`0tlKTagD*sgf_{Sok;AJ|#qc+)eM!9Yyoj%=;fHW|7;cov
zS8(#Z_-?)!0+yjAp*I9g(ZjaaL>vlYxDn+_z>Wy3;U$fUjH_tRk+@pWWw@+P85qo<
zhgD)s5(3od8frbFyzQ9WkQ9xp8q|J>pDnk=w{z8ZV99qN{doJb?;;?jw_w#<vE;2-
z=(<&$_Eu!PCnitdg?O8P+CMv%;r359ud&Xbgnk&BeR@Hj3@x*@_IuMJi|_UJ`_s$p
z9;<wV$1ex&mhJn9OP2;0&;F__U3+q^?BGW~NS8hZVY||2zNJ`aB?L9tDfzAtm<dgX
z=8t6raf)8!JY?{z%baMH=Ub-yE8Kpx0V+2H$|DehH#1ySc6K*>IAZl(zHpV_v&8So
z@cY09;R7?zOg}T*dE?jzPiFYaG+Rlm1%nF%c1GjjFmRAdCBe4)9GuRpU`xLibgAg}
zs^BeHZsQ1+l8}I6OeA7KhxH;yBRWtMBmFAU)Ic&0j;Si9#1LGN6FSlnD8Xa+u@Kwf
zFmSorgO@e0S$!cn5N-8E#$zC)1hs#Sos$u;Rz*|anuJ*v4R<&!CnDjn;SGm-lMp>r
z!eJG?D>aJA9!Lxa7;+FEqs$N>Drv(#47Z%IXphR`8*EE2M1rBEg0IMMz~_eNa_hzR
z@a6V)umF_!NEEK1RHElmrKqPd!Rs2+K|hEkVh^D1|4uF^jEMuHfWd%hEqqLo(;?2y
zeeT(zgbe>5IHCRxd;*Vx(msa-c!#FHVasXuKcA-Psy|YJFDd>@%JU^9d`bDfq`dz@
zm3<`?%$B_qS`{jngvyL?U{$DH5^7h4#wDR~((?_(91CV0bKdLTIsbKky5g~$!CUdA
z#uqXL7czWklDo?blia4OfUe!FcF^bOO|OeSMQ;{)X>qgMK{sxCi|FFb8Yk`BEbu^5
tMiK{<yv20YMgzqPQ{#7-U2Ci`dHN@9KWv-seCMSVws?b~*mAPM{{tP@^3ebQ

literal 0
HcmV?d00001

diff --git a/bin/cd-deploy b/bin/cd-deploy
index cfdd226..dcde5b9 100755
--- a/bin/cd-deploy
+++ b/bin/cd-deploy
@@ -134,7 +134,7 @@ notify() {
         -H "Title: ${CD_NAME} deploy" \
         -d "${icon} ${CD_NAME} (${CD_ENV}): ${message}" \
         "${CD_NTFY_BASE_URL}/${topic}" >/dev/null 2>&1 \
-        || warn "ntfy notification failed (deploy outcome itself is unaffected)"
+        || warn "ntfy notification failed (the deploy itself is unaffected)"
 }
 
 # ------------------------------------------------------------------- lock ---
diff --git a/bin/cd-status b/bin/cd-status
index aeed84a..4ea600f 100755
--- a/bin/cd-status
+++ b/bin/cd-status
@@ -4,7 +4,7 @@
 #
 # Written because "the timer is active" was never proof of anything in this
 # fleet -- the same lesson the uas-ng updater documents. This shows the daemon,
-# the socket, and the outcome of the last deploy for each target.
+# the socket, and how the last deploy for each target ended.
 
 set -Eeuo pipefail
 
diff --git a/bin/cd-target b/bin/cd-target
index c710b37..07947a6 100755
--- a/bin/cd-target
+++ b/bin/cd-target
@@ -9,7 +9,7 @@ itself, so there is exactly one implementation of the matching rules.
 Subcommands:
     resolve --repo OWNER/NAME --branch BRANCH [--host HOST]
         Print shell-quoted KEY=VALUE lines for the matching target.
-        Exit 3 when nothing matches (a normal, non-error outcome: it just
+        Exit 3 when nothing matches (a normal, non-error result: it just
         means this push is not ours to act on).
 
     list [--host HOST]
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index 40fc6b8..a98aaac 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -11,8 +11,8 @@ design.
 
 An active service is not proof of anything on its own — the same lesson the
 `uas-ng` updater documents. `cd-status` shows the daemon state, whether the port
-is genuinely listening, the hook endpoints, and the outcome of the last deploy
-per target.
+is genuinely listening, the hook endpoints, and how each target's last
+deploy ended.
 
 ## Where things are
 
diff --git a/docs/hints.md b/docs/hints.md
new file mode 100644
index 0000000..16ac692
--- /dev/null
+++ b/docs/hints.md
@@ -0,0 +1,32 @@
+# Hints
+
+Short notes on things that were not obvious. Prune stale ones.
+
+- **`bin/cd-target` cannot be imported normally.** The hyphen in the filename is
+  not a valid Python identifier, so `bin/cd-render-hooks` loads it through
+  `importlib.machinery.SourceFileLoader`. Importing `importlib.util` alone is
+  not enough — `importlib.machinery` needs its own import.
+
+- **`docker/metadata-action`'s `type=sha,format=short` produces 7 characters.**
+  That is why `image_tag_template` uses `{short7}`. domaindingo's `build.yml`
+  prefixes it with the branch, giving `test-sha-abc1234` / `prod-sha-abc1234`.
+
+- **domaindingo's compose stacks are not in the domaindingo repo.** Test and
+  prod both live in `sysadmin/uas-ng` at
+  `docker/domaindingo/s5.fisher.hu/` (`docker-compose.yml` and
+  `docker-compose-prod.yml`). The `scripts/deploy-*.sh` files still in the
+  application repo point at compose files that do not exist on s5 — they are
+  dead code for both environments that matter.
+
+- **domaindingo test and prod both run on s5, not s2.** Only dev is still on s2.
+  The `hostname != s2` guard in the old scripts therefore matched nothing and
+  `exit 0`d, which reads as success.
+
+- **Registry tags in this fleet have drifted before.** `domaindingo:0.1.149`
+  once resolved to a different image than the one running, with a broken
+  `/login`. This is why `cd-deploy` checks
+  `org.opencontainers.image.revision` and deploys by digest.
+
+- **`docker compose down -v` destroys the data volumes** for these stacks. The
+  retired paradicsomleves test script used it. `cd-deploy` only ever runs
+  `up -d`.