---
session_id: S-2026-0225-1857
timestamp: 2026-02-25T17:57:57Z
predecessor: S-2026-0225-1439
tasks_active: [T-261, T-262, T-263, T-265, T-266, T-267, T-268, T-269, T-271, T-273, T-274, T-275, T-276, T-277, T-278, T-280, T-281, T-282, T-283, T-284]
tasks_touched: [T-279, T-280, T-281, T-282, T-283, T-284]
tasks_completed: [T-279]
uncommitted_changes: 27
owner: claude-code
session_narrative: "Completed T-279 inception: deep research into Watchtower deployment model via 9 parallel agents. Pivoted from Docker Swarm to LXC on Proxmox (D-039). Docker's ephemeral/stateless model creates critical issues for Watchtower's filesystem-dependent design. Created 5 child tasks (T-280 through T-284) for LXC migration. Updated deployment runbook."
---

# Session Handover: S-2026-0225-1857

## Where We Are

T-279 inception completed with GO decision (D-039): deploy Watchtower as LXC container on Proxmox instead of Docker Swarm. Research proved Docker's isolation model fights Watchtower's filesystem-dependent design (18+ write endpoints, git integration, search/embeddings). Five child tasks created (T-280-T-284) for the migration. The existing Swarm deployment is live but shows empty data — the LXC deployment will fix this.

## Work in Progress

<!-- horizon: now -->

### T-261: "Q&A Phase 2 — model upgrade, RAG quality, framework integration, saved answers"
- **Status:** started-work (horizon: now, owner: human)
- **Last action:** All child tasks completed in prior sessions
- **Next step:** Human reviews all tasks in browser, marks human ACs
- **Blockers:** Owner: human (inception task)
- **Insight:** Full Phase 2 delivered and deployed to production

### T-262: "Replace LLM with Qwen3-14B + thinking mode toggle"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human verifies in browser
- **Blockers:** None
- **Insight:** Model names config-driven via web/config.py

### T-263: "RAG quick wins — prompt, embeddings, chunking"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human verifies in browser
- **Blockers:** None
- **Insight:** None

### T-265: "Saved answers — curated Q&A for retrieval flywheel"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human verifies in browser
- **Blockers:** None
- **Insight:** None

### T-266: "Streaming UX — marked.js, syntax highlighting, copy buttons"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human verifies in browser
- **Blockers:** None
- **Insight:** None

### T-267: "User feedback — thumbs up/down on Q&A answers"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human verifies in browser
- **Blockers:** None
- **Insight:** None

### T-271: "Fix budget-gate stale critical status trap"
- **Status:** started-work (horizon: now, owner: human)
- **Last action:** Fixed in prior session
- **Next step:** Human completes: `fw task update T-271 --status work-completed --force`
- **Blockers:** Human-owned task
- **Insight:** None

### T-273: "Production readiness — WSGI, health endpoint, config, error handling"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human verifies
- **Blockers:** None
- **Insight:** Health endpoint must never trigger index rebuild

### T-274: "Scaffold Watchtower deployment — Dockerfile, compose, Traefik routes"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session. Note: Docker deployment being superseded by LXC (T-279/D-039)
- **Next step:** Human verifies; deployment files remain in repo for reference
- **Blockers:** None
- **Insight:** Docker deployment superseded by LXC decision

### T-275: "Pre-deploy quality gate — audit section + gated fw deploy"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human verifies
- **Blockers:** None
- **Insight:** Deployment audit is opt-in only (--section deployment)

### T-276: "Deploy skills — /deploy-check, /rollback commands"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session. Skills may need updating for LXC model
- **Next step:** Human tests; may need adaptation for LXC workflow
- **Blockers:** None
- **Insight:** Skills will need updating after LXC migration (T-280-T-284)

### T-277: "First deployment — Watchtower to Ring20 production"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Deployed to Swarm in prior session. Being superseded by LXC (T-279/D-039)
- **Next step:** Human verifies current Swarm deployment; will be replaced by LXC
- **Blockers:** None
- **Insight:** First deployment proved Docker model is insufficient — led to T-279 pivot

### T-278: "Harvest deployment learnings — templates to learnings.yaml"
- **Status:** work-completed (horizon: now, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human reviews learning accuracy
- **Blockers:** None
- **Insight:** None

### T-280: "Provision Watchtower LXC on Proxmox"
- **Status:** started-work (horizon: now, owner: human)
- **Last action:** Task created this session. IP confirmed: 192.168.10.170
- **Next step:** Create DHCP reservation for .170, then provision LXC on proxmox2
- **Blockers:** None — ready to start
- **Insight:** .141 and .142 already taken; .170-.179 range is free

### T-281: "Deploy Watchtower to LXC — dev and prod services"
- **Status:** captured (horizon: now)
- **Last action:** Task created this session
- **Next step:** Start after T-280 (LXC provisioned)
- **Blockers:** Depends on T-280
- **Insight:** Two git checkouts + two systemd services on same LXC

### T-282: "Remap Traefik routes from Swarm to LXC"
- **Status:** captured (horizon: now)
- **Last action:** Task created this session
- **Next step:** Start after T-281 (services running on LXC)
- **Blockers:** Depends on T-281
- **Insight:** Update traefik-routes.yml from .201/.202 to .170, sync both nodes

### T-283: "Set up dev auto-update mechanism for Watchtower LXC"
- **Status:** captured (horizon: now)
- **Last action:** Task created this session
- **Next step:** Start after T-281 (services deployed)
- **Blockers:** Depends on T-281
- **Insight:** OneDev webhook or cron for automatic dev pulls

### T-284: "Decommission Swarm watchtower stack"
- **Status:** captured (horizon: now)
- **Last action:** Task created this session
- **Next step:** Start after T-282 (Traefik remapped and verified)
- **Blockers:** Depends on T-282
- **Insight:** Keep Docker files in repo history, just remove running stack

<!-- horizon: next -->

### T-268: "Multi-turn Q&A conversation"
- **Status:** work-completed (horizon: next, partial-complete: human ACs pending)
- **Last action:** Completed in prior session
- **Next step:** Human tests multi-turn in browser
- **Blockers:** None
- **Insight:** One-way door: EventSource to fetch+ReadableStream

### T-269: "Cross-encoder reranking with Qwen3-Reranker"
- **Status:** work-completed (horizon: next, partial-complete: human AC pending)
- **Last action:** Infrastructure built with graceful fallback
- **Next step:** Install reranker model when available in Ollama registry
- **Blockers:** Model not in Ollama registry
- **Insight:** Auto-activates via _rerank_available() check

## Inception Phases

No active inception tasks — T-279 completed with GO decision.

## Gaps Register

**2 spec-reality gap(s) being watched** — see `.context/project/gaps.yaml`

- **G-004** [low]: Multi-agent collaboration untested
- **G-011** [low]: PostToolUse hooks are advisory-only — cannot block actions

Run `fw audit` to check if any trigger conditions are met.

## Decisions Made This Session

1. **D-039: Deploy Watchtower as LXC on Proxmox, not Docker Swarm**
   - Why: Docker's ephemeral/stateless/replicated model creates 2 CRITICAL issues (write data loss + replica divergence, vector DB timeout) that fundamentally conflict with Watchtower's filesystem-dependent design
   - Alternatives rejected: Docker with read-only mode (loses command center vision), Docker with NFS (complexity), two LXCs (overkill), full VM (overkill)

2. **Single LXC with two systemd services (not two LXCs)**
   - Why: Lower resource cost, simpler management; dev crash risk acceptable for single-user dashboard
   - Alternatives rejected: Two separate LXCs (double resources, more management overhead)

3. **IP: 192.168.10.170 (not .141/.142)**
   - Why: .141 and .142 both respond to ping (already in use). Scanned .170-.179 — all free
   - DHCP reservation required before provisioning

## Things Tried That Failed

1. **Docker Swarm deployment (T-277)** — deployed successfully but shows empty dashboard. Container has no access to framework data (.tasks/, .context/, .fabric/). Docker model fundamentally wrong for this use case.
2. **Docker bake-data approach** — reviewed by 2 agents, found 2 CRITICAL issues (write data loss, vector DB timeout) and 2 HIGH issues (.dockerignore blocks data, no dev compose). Abandoned in favor of LXC.

## Open Questions / Blockers

1. T-280 chain (T-280→T-281→T-282→T-283→T-284) ready to execute in order
2. 13 Q&A Phase 2 tasks still awaiting human AC verification (T-262 through T-278)
3. T-271 needs human completion
4. Stale handover S-2026-0225-1519 has unfilled TODOs (auto-generated by pre-compact, never filled)

## Gotchas / Warnings for Next Session

- IP .170 needs DHCP reservation BEFORE provisioning the LXC
- Existing Swarm deployment is still live at watchtower.docker.ring20... (shows empty data)
- Don't decommission Swarm until LXC is verified and Traefik remapped (T-284 depends on T-282)
- /deploy-check and /rollback skills will need updating for LXC model after migration
- Health endpoint must never call index_stats() — triggers full index rebuild

## Suggested First Action

Start T-280: Create DHCP reservation for 192.168.10.170, then provision the Watchtower LXC on proxmox2. See `docs/reports/T-279-watchtower-deployment-model.md` for full architecture and `docs/deployment-runbook.md` for the target workflow.

## Files Changed This Session

- Created: `docs/reports/T-279-watchtower-deployment-model.md`, `.tasks/active/T-280..T-284`, `.context/episodic/T-279.yaml`, `.tasks/completed/T-279-*.md`
- Modified: `docs/deployment-runbook.md` (rewritten for LXC workflow), `.context/project/decisions.yaml` (+D-039)

## Recent Commits

- a0491b4 T-012: Session handover S-2026-0225-1857
- 3bf9a3e T-280: Fix LXC IP to 192.168.10.170 + add DHCP reservation
- 20ec766 T-279: Watchtower deployment model — GO decision: LXC on Proxmox
- 3f25f4b T-012: Session handover S-2026-0225-1519
- 80c21a3 T-012: Fill handover S-2026-0225-1439 TODOs

---

## Handover Quality Feedback (for next session to complete)

- Did this handover help? [ ]
- What was missing?
- What was unnecessary?
