20260924 - Install a fork of the docker-compose Update Module

[Purple10101]

Phase 2, item 3 of ClickUp OTA deployments miss part of the fleet on every release (123zgec4tmx). Draft until the acceptance evidence is complete; the full record lives in the ticket's Verification section.

Review commit by commit: 4462353 vendors upstream mender-docker-compose 1.0.0-1 byte for byte (sha256 5be40882...); 6bd2637 is the fork, so its diff is exactly our change (every hunk marked FORK:).

What the fork changes

Upstream behaviour	Fork
stops the running stack, then extracts and loads images (147-149 s outage)	loads first, then stop and start (10.7 s, measured 3 times)
an early failure (corrupt download, full disk) looks like "rollback after commit" and stops and moves the live stack	new/ created before anything can fail
rollback after a pre-stop failure runs down from new/, stopping the live stack (shared project name)	leaves the live stack running
nothing coordinates with the RSPduo watchdog	holds /data/retina-gui/restart.lock for install and rollback
new stack starts without .env, so tar1090 gets 0,0 and adsb.lol off	seeds .env from current/
cleanup fails a committed deployment over an image already removed	skips it

Install

Two tasks in roles/mender: dpkg-divert moves the packaged file to /usr/share/mender/docker-compose.upstream (outside modules/v3), then the fork is copied in, 0755. Undo is dpkg-divert --rename --remove. The artifact type stays docker-compose.

Tests

tests/update-modules/ runs the real module under dash with a stub docker and jq and real tar payloads; new Tests workflow runs it. 15 pass. Upstream fails 8; the first fork revision fails the 3 that caught its own regressions (watchdog race, destructive early-failure rollback).

Evidence on test nodes so far

• 3 installs on Josh Test Node 2: 10.7 s stop-to-start each; .env seeded; watchdog run by hand mid-load printed A stack restart is already in flight - skipping this check.
• Power cut (sysrq-b) during image load, twice: node rebooted into its previous stack, rollback leaving it running, deployment failure and retryable.
• Power cut right after Stopping previous: retina-node.service skipped, rollback restored previous and started it, deployment failure and retryable.

Still to prove before this leaves draft

Install whose new stack fails to start; node that skipped a release; normal upgrade on Josh Test Node (with RSPduo, radar health); this packaging through an os-v*-dev build.

🤖 Generated with Claude Code

[Purple10101]

Acceptance evidence, 2026-09-24 (full record: ClickUp 123zgec4tmx, Verification)

Test	Node	Result
Normal upgrade, real radar	Josh Test Node	11.0 s stop to start (upstream 147-149 s); blah2 0 restarts; /api/map 0 s old
Watchdog run by hand mid-load	Josh Test Node 2	A stack restart is already in flight - skipping this check
Power cut (sysrq-b) during image load, x2	Josh Test Node 2	rebooted into previous stack; rollback leaving it running; deployment failure, retryable
Power cut right after Stopping previous	Josh Test Node 2	retina-node.service skipped; rollback restored and started previous; deployment failure, retryable
New stack never healthy (deliberately broken v0.4.7.0-dev3)	Josh Test Node	120 s health wait, rollback restored v0.4.6.0, radar back (map 1 s old)
Skipped two releases (v0.4.4.0 to dev2)	Josh Test Node 2	success, 10.6 s, old images cleaned up
Packaging via os-v0.17.1-dev	both	diversion listed, module 8abfe66d 0755, upstream at /usr/share/mender/docker-compose.upstream (5be40882), modules/v3 unchanged, package still hold ok installed, stack back after reboot
retina-node install on the image-installed fork	Josh Test Node	10.8 s stop to start, .env seeded, blah2 0 restarts, map 1 s old
Image already removed during cleanup	unit test only	passes; not reproduced on a node

Known cost, upstream behaviour: a release whose stack never becomes healthy costs about 2 min 45 s of radar before rollback (the module's 120 s health wait).