From 5a80378132eaa493fde1a6f2f0d061056cf931eb Mon Sep 17 00:00:00 2001 From: zzstoatzz Date: Mon, 27 Jul 2026 12:28:48 -0500 Subject: [PATCH] docs: the recycled-IP trap broke a provision, not just manual ssh Co-Authored-By: Claude Opus 5 (1M context) --- docs/gotchas.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/docs/gotchas.md b/docs/gotchas.md index b730963..9e566b3 100644 --- a/docs/gotchas.md +++ b/docs/gotchas.md @@ -66,8 +66,15 @@ are correct and both exit non-zero. Pin the invariant — a fatal cause reaches experiment and the next one can be handed an address a previous run used — `65.109.0.222` came back as a build host having been experiment 3's watchdog, and SSH refused with REMOTE HOST IDENTIFICATION HAS CHANGED. It is ordinary -address reuse, not an interception: `ssh-keygen -R ` clears it. Worth -knowing before the warning arrives mid-provision and reads as something worse. +address reuse, not an interception. + +This is not just a manual-SSH nuisance: it broke a real provision. The watchdog +landed on a build host's recycled address, `arm_watchdog.sh` could not connect, +and the failed-apply trap tore the run down. `StrictHostKeyChecking=accept-new` +admits an *unknown* host but hard-fails a *changed* one, so it does not help +here. `provision.sh` and `arm_watchdog.sh` now scrub the host keys of the +servers they just created, which is safe precisely because those servers are +seconds old. **Build the deploy artifact natively.** Emulating linux/amd64 on an arm64 workstation turns an 8-minute compile into 40-plus and yields a cross-emulated -- 2.51.2