Problem
The live updater performs one immediate gateway status --deep --require-rpc after restarting the managed Gateway. On clawmac, a healthy Gateway took longer than that first 10-second RPC timeout while startup warmup was active. The updater exited update_failed, but the identical probe passed eight seconds later without another restart.
Impact
Successful live updates can be reported as failures, leaving maintenance state noisy and encouraging unnecessary reruns even though the exact-head Gateway is healthy.
Evidence
- Exact deployed head:
8e2ddd60ad8865a2c27624eec05951a234bcdf76
- First deep RPC probe: timeout after 10 seconds; service running and health marked healthy.
- Same probe eight seconds later: RPC/admin capability/version all healthy.
- Current updater has no bounded post-restart readiness retry.
Desired behavior
Retry only the post-restart readiness proof for a bounded startup window, while preserving exact-build assertions, restart-window log auditing, and fail-closed behavior after the retry budget is exhausted.
Problem
The live updater performs one immediate
gateway status --deep --require-rpcafter restarting the managed Gateway. On clawmac, a healthy Gateway took longer than that first 10-second RPC timeout while startup warmup was active. The updater exitedupdate_failed, but the identical probe passed eight seconds later without another restart.Impact
Successful live updates can be reported as failures, leaving maintenance state noisy and encouraging unnecessary reruns even though the exact-head Gateway is healthy.
Evidence
8e2ddd60ad8865a2c27624eec05951a234bcdf76Desired behavior
Retry only the post-restart readiness proof for a bounded startup window, while preserving exact-build assertions, restart-window log auditing, and fail-closed behavior after the retry budget is exhausted.