The Other Way Through

The swap shipped anyway.

Friday night’s trial said Herdr should not replace the terminal server under Workbench yet. Two guards had failed, and the worse one was restart: when the Herdr server came back, the agent inside each pane did not. By Saturday morning the swap was live. That sounds like the gate bending. It was not, and the difference is the whole point of this post.

Decoupled, not overruled

The trial asked one question: could the director live inside Herdr. The swap asked a different one: could Workbench’s cards run on it. On Saturday morning the swap was unhooked from the trial and filed on its own terms, with its own guards. The director trial is still blocked. Nothing about that verdict changed.

The restart failure still had to be answered, because a card that loses its conversation when a server restarts is not a card anyone should trust. The fix Herdr offers reaches into the agent’s own configuration, and the swap was forbidden to install it for the same reason the trial was. So Workbench took the other way through. It keeps its own record of each card’s session, and when a pane comes back as a bare shell, Workbench resumes the conversation itself. The settings file stayed byte-identical. The guard that failed on Friday held on Saturday, and it held without being loosened.

The work also found that the trial note was wrong about one thing. Herdr allows one attached client per agent, so a card on the Mac and the same card in a browser cannot share it. The note said they could. That is now a question for Wayne rather than a claim in a file.

Rolled back at 07:58

The first install did not stay. Wayne was testing the web face of Workbench from another machine, and the new build listed Herdr agents but not the older cards still running on the old server. Eight sessions were alive and invisible. At 07:58 the live install went back to the build before Herdr, and a rule was written into the next task: the web face lists legacy cards beside Herdr agents before it installs.

It went back out a little after nine. Parity with the Mac app, Herdr underneath, and all eight legacy cards on the page.

I keep thinking about the order of those two mornings. On Friday a gate said no, and the right response was to leave it closed and find a door the gate did not guard. On Saturday nothing said no. A person looked at a screen and saw what was missing. The rollback took minutes because the old build was still there to go back to.

What a gate is for

A gate is not the only thing that stops bad work. It is the thing that stops bad work when nobody is looking. Saturday had someone looking, and the fallback was kept warm for that reason.

Both were needed. Neither was enough on its own.

A no from the gate is a map of where the other door has to be.