---
id: w3/m5/t005
title: Acceptance — pod restart loses nothing; bounded time-range queries over REST + MCP
worker: worker3
status: todo
estimate: 25m
depends_on: [w3/m5/t003, w3/m5/t004]
---

## Objective

Prove the milestone's point live: generate distinctive log lines from a running app, kill/restart its pod, and show the pre-restart lines still come back — over REST (`GET /v1/logs`-shaped query) and MCP `list_logs` — plus a bounded time-range query that excludes lines outside the range. _2026-07-11: retargeted from "the mock cluster" to prod — `scripts/mock-cluster.sh` installs no Argo CD/GitOps, so Loki can never sync there; prod runs Loki + log-shipper live on the platform pool with `BEX_LOKI_URL` wired._

## Context

- Access path: `HCLOUD_TOKEN=… scripts/fetch-app-kubeconfig.sh <path>` (the canonical prod access path — post-pivot there is no mgmt cluster), then `KUBECONFIG=<path> scripts/logs-verify.sh` — the script is kubeconfig-agnostic.
- Prod safety: the test App `whoami-logs` pulls the public Docker Hub image `traefik/whoami` (a normal outbound pull — the node-local ctr-import constraint only affects bex-built images since zot is empty), lands on the untainted tenant pool, lives in ns `default` (outside the CP projector's namespace), and is deleted on cleanup.
- Operator: prod's in-cluster manager watches cluster-wide and reconciles the App CR — no host operator needed. On the mock the script would hang at the Running wait: its header claims it launches a host operator but it never does (`OP_PID` declared and killed, never assigned).
- Code prerequisite (outside .pm): fix `scripts/logs-verify.sh`'s header/requirements — drop the "bex-api AND the operator run on the host" + "scripts/mock-cluster.sh + GitOps" claims; requirement is "a cluster with Loki synced and an operator reconciling Apps (prod: the in-cluster manager; mock: run `make run` separately)".

## Steps

1. `scripts/fetch-app-kubeconfig.sh` → run `scripts/logs-verify.sh` against prod: it deploys `whoami-logs`, curls it to produce marked lines, and notes the timestamp window.
2. The script's restart phase: `kubectl delete pod` → wait for the replacement → query both surfaces for the pre-restart window; assert the marked lines return.
3. Its fallback phase reruns with `BEX_LOKI_URL` unset to confirm the truthful degraded answer (live logs only).
4. Confirm cleanup left nothing in `default` (the App and its Deployment/Service deleted).

## Files

- `scripts/logs-verify.sh` (header/requirements fix per Context; the script body already fits prod)

## Acceptance criteria

- [ ] Pre-restart lines retrievable after restart via REST and MCP; time-range bounds respected.
- [ ] Unset-fallback verified live.

## Out of scope

- Load testing ingest volume.
