A queue that survives a power cut, and why durable storage is not the same as a safe read
An offline audit queue held in memory lost six audits on a single bench power-down with no indication anything had been lost, so the queue moved onto the USB stick itself — and a month later the same component's read path proved destructive, rewriting as empty a queue file it had merely failed to parse.
Status
Shipped, 9 August 2026.
The durable queue
keep the offline queue on the stick so a power-off cannot lose an audit.
The station held queued audit records in memory. A technician who audited six machines with no network and then powered down lost all six, with no indication that anything had been lost. On a bench where machines are powered off as a matter of course, this was a question of when, not whether.
The queue moved onto the USB stick itself. The stick is the one thing guaranteed to still be there after a power cut.
This is also the component whose read path was found to be destructive a month later: a queue file that existed but could not be fully read was treated as empty and then rewritten, destroying the records it had failed to parse. Making storage durable and making it safe to read are two different jobs.
Boot speed, and honest instrumentation
** — fast-boot.ps1**, which skips the GRUB menu on an
audit stick, split into its own script from the boot-message work so each does
one thing.
make a silent restore visibly alive, not indistinguishable from a dead one. An OS restore writes several gigabytes with no output. The operator sees a still screen and cannot tell a working restore from a hung one. Same class as the network check: the system knew it was working and was not saying so.
sync-usb gains watch mode, a cache flush, and a version stamp on the stick.
The version stamp is the important part. Before it, nobody could tell which build a given stick was running, so a bug report could not be tied to a version. The cache flush matters because Windows reports a file copy to removable media as complete before the data has left the buffer — pulling the stick immediately leaves a truncated file that verifies as present.
stop blaming the internet when ping is filtered. The check tested one address by ICMP. A site that filters ping — or blocks that one address, as this one does — produced a red failure on a station that was uploading audits perfectly well. The check now tries several addresses and both protocols, and shows the routing table.
judge the station by whether it can reach Xorkbench. The decisive correction. Every other layer exists to explain a failure, not to be one: treated as failures in their own right they cried wolf, and operators went looking for network faults that were not there.
Also on this day — name an OS image by what it is, let the operator name
each one, and say when the install finished. — strip three pieces of kiosk chrome that were not earning
their space.
the golden-image guide as a PDF in the web app.
mark binary assets binary before autocrlf corrupts one. Git on
Windows rewrites line endings; a PDF or a .deb that goes through that
transformation is silently destroyed.
What was deliberately not built
No server-side queue mirror. The stick is the durable store, and the record stays there until the server confirms it.
Open questions
Boot time was measured properly in September and found to be I/O-bound at 34 MB/s, which redirected the optimisation work entirely.
A published copy. Commit references and internal identifiers have been removed and the operator is not named; the engineering, the counts and the stated limits are unchanged.