fix: harden model catalog projections

2026-09-02 19:25:01 +02:00
parent ce4c31a6fb
commit a6a5bf2036
38 changed files with 573 additions and 83 deletions
@@ -166,6 +166,8 @@ Generation is deterministic and published only after every candidate artifact va
 generation aborts start before Compose is invoked. `tht doctor` recomputes expected bytes and reports
 differences; no digest manifest or separate apply command exists. When projection bytes change,
 `tht start` recreates the affected services so they cannot continue with an older bind mount.
+Pi-only restart, update, and rollback operations reject projection drift and direct the operator to
+`tht start`, because applying only the core-facing files could leave embedding services stale.

 Generated projections are not backed up. Restore validates the canonical installation descriptor,
 regenerates every projection, and only then starts services. Base Compose files and `operator.env`