From f0f7c27382df297ea3e1c275e695922567e048b3 Mon Sep 17 00:00:00 2001
From: Jesse_Chen <chen.yue@mevixaga.com>
Date: Wed, 29 Jul 2026 19:26:51 +0800
Subject: [PATCH] fix: verify semantic rollout runtime

---
 deploy/README.md                                  |  6 +++---
 deploy/configure-staging-rectification-rollout.sh | 12 ++++++++++++
 docs/BUG_HISTORY.md                               |  4 ++--
 frontend/tests/staging-backend-workflows.test.ts  |  3 ++-
 4 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/deploy/README.md b/deploy/README.md
index 32e69025..80bf1127 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -437,9 +437,9 @@ sequence. A plain HTTP `200` is not substitute evidence:
    event, then a clear event. Verify the ambiguous/future facts do not score.
 4. Pause, reload, and resume from a second authenticated browser session.
    Verify no second rectification charge.
-5. Reach a candidate, verify the prior active time is still in force, reject a
-   mismatched candidate confirmation, then explicitly confirm the exact
-   candidate. Verify the time changes atomically.
+5. Reach a stable candidate range and verify the prior active time remains in
+   force. Confirm that no exact minute can be accepted and that rectification
+   does not write `profiles.active_birth_time`.
 6. Explicitly continue the saved ordinary question. Verify one normal
    consultation reservation. Delete its chat and verify the account case still
    resumes/loads.
diff --git a/deploy/configure-staging-rectification-rollout.sh b/deploy/configure-staging-rectification-rollout.sh
index 1725d6c6..75cd5bd1 100755
--- a/deploy/configure-staging-rectification-rollout.sh
+++ b/deploy/configure-staging-rectification-rollout.sh
@@ -151,6 +151,18 @@ compose=(docker compose -p jyotisha-staging --env-file .env.staging "${compose_f
 "${compose[@]}" config --quiet
 "${compose[@]}" up -d --no-build --pull never --force-recreate --no-deps web rectification-v4-worker
 
+for service in web rectification-v4-worker; do
+  container="$(docker ps -q --filter 'label=com.docker.compose.project=jyotisha-staging' --filter "label=com.docker.compose.service=$service" | head -n 1)"
+  [ -n "$container" ] || {
+    echo "staging $service container is missing after rollout" >&2
+    false
+  }
+  runtime_env="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$container")"
+  grep -Fxq "RECTIFICATION_AGENT_V5_ENABLED=$creation_enabled" <<<"$runtime_env"
+  grep -Fxq "RECTIFICATION_AGENT_V5_SHADOW=false" <<<"$runtime_env"
+  grep -Fxq "RECTIFICATION_AGENT_V5_CANARY_PERCENT=100" <<<"$runtime_env"
+done
+
 health=""
 for _ in $(seq 1 30); do
   health="$(curl --fail --silent --show-error "$STAGING_URL/api/health" 2>/dev/null || true)"
diff --git a/docs/BUG_HISTORY.md b/docs/BUG_HISTORY.md
index 3daf8723..9ae1bb04 100644
--- a/docs/BUG_HISTORY.md
+++ b/docs/BUG_HISTORY.md
@@ -1644,7 +1644,7 @@
 - 用户现象：用户提交“2016 年 9 月离家去外地上大学”后，回复仍固定为“我记下了这段经历。接下来请继续讲另一件……”，没有进入 Semantic Question Renderer。
 - 根因：Case rollout 只写入 V3 创建门和 smoke 状态，没有写入 `RECTIFICATION_AGENT_V5_ENABLED`、`RECTIFICATION_AGENT_V5_SHADOW`、`RECTIFICATION_AGENT_V5_CANARY_PERCENT`；因此 `selectRectificationDeploymentMode()` 把新 Case 持久化为 `v4_legacy`，Orchestrator 必然调用 Legacy Projector。
 - 修复：受控 staging rollout 现在原子写入 V5 Agent 开关，public 与 smoke rollout 使用 `v5_agent`、100% canary，并重建 web/worker；staging 中唯一满足 V6 版本、未完成、无 open Job 条件的错误 Case 已原位升级为 `rectification-evidence-v5` / `v5_agent`，历史 Turn、Event、Job 与 Agent Run 保持不变。
-- 验证：rollout 脚本测试断言三项 V5 选择器只写一次；staging 运行容器已读取 `enabled=true`、`shadow=false`、`canary=100`；活跃 Case 聚合只剩 `v5_agent`；健康检查保持 exact SHA、public、ready。
-- 防复发：公开 Case rollout 必须同时控制创建门与 Agent deployment mode；仅有 `readyForNewCases=true` 不再视为新对话 Renderer 已启用的充分证据。
+- 验证：rollout 脚本测试断言三项 V5 选择器只写一次，并在成功前核对 web/worker 容器实际读取的 `enabled`、`shadow`、`canary`；staging 活跃 Case 聚合只剩 `v5_agent`；健康检查保持 exact SHA、public、ready。
+- 防复发：公开 Case rollout 必须同时控制创建门与 Agent deployment mode，并验证运行容器的实际环境；仅有 `readyForNewCases=true` 不再视为新对话 Renderer 已启用的充分证据。
 - 相关记录：BUG-085、BUG-086、BUG-087
 - 修复版本：`birth-time-rectification-v6` / `rectification-agent-v6-1`
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index 2a94a8b7..a9bde16d 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -458,7 +458,8 @@ test("public rectification rollout enables the semantic agent and recreates web
     [
       "#!/usr/bin/env bash",
       'if [ "$1" = ps ]; then echo web-container; exit 0; fi',
-      `if [ "$1" = inspect ]; then echo ghcr.io/jesse-ux/jyotisha-web@sha256:${"b".repeat(64)}; exit 0; fi`,
+      `if [ "$1" = inspect ] && [[ "$*" == *Config.Image* ]]; then echo ghcr.io/jesse-ux/jyotisha-web@sha256:${"b".repeat(64)}; exit 0; fi`,
+      'if [ "$1" = inspect ] && [[ "$*" == *Config.Env* ]]; then printf "%s\n" RECTIFICATION_AGENT_V5_ENABLED=true RECTIFICATION_AGENT_V5_SHADOW=false RECTIFICATION_AGENT_V5_CANARY_PERCENT=100; exit 0; fi',
       `printf '%s\n' "$*" >>${join(root, "docker.log")}`,
     ].join("\n"),
   );