From e4f7445ec1da7781cef63cf2e508564ee4b9bfd1 Mon Sep 17 00:00:00 2001
From: pavel <pavel.larkin@ikeja.co.za>
Date: Wed, 5 Nov 2025 12:27:03 +0200
Subject: [PATCH] 12:27

---
 files/ansible-playbooks/update-indoor.yml | 30 +++++++----------------
 1 file changed, 9 insertions(+), 21 deletions(-)

diff --git a/files/ansible-playbooks/update-indoor.yml b/files/ansible-playbooks/update-indoor.yml
index 62d859a..c5d4e7f 100644
--- a/files/ansible-playbooks/update-indoor.yml
+++ b/files/ansible-playbooks/update-indoor.yml
@@ -1,4 +1,3 @@
----
 # update-indoor.yml  (conservative, minimal fixes)
 - name: Second-line indoor upgrade via DEV1 → tunnel → DEV2 (non-invasive control path)
   hosts: all
@@ -157,9 +156,8 @@
                         echo "$p"; return 0
                     fi
                 fi
-            done
-            return 1
-        }
+            endfor=false
+            }
         pick
       register: pick_port
       changed_when: false
@@ -559,13 +557,6 @@
         _prep_blocked: false
         _blocked: false
 
-    # >>> NEW: soft-block on auth failure (no valid credentials) <<<
-    - name: Soft-block if DEV2 auth failed (no valid credentials)
-      when: dev2_passfile_used == "NONE"
-      ansible.builtin.set_fact:
-        _blocked: true
-        _journal: "{{ (_journal | default([])) + [ 'No valid credentials for DEV2; skipping staging/write/flip' ] }}"
-
     - name: Build specific image marker path on DEV2 (/tmp/prepared_for_<image>)
       ansible.builtin.set_fact:
         _marker_specific: "/tmp/prepared_for_{{ image_filename | regex_replace('\\.bin$','') }}"
@@ -631,11 +622,13 @@
       ansible.builtin.set_fact:
         expected_fw_core_early: "{{ (image_filename | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')) | default('', true) }}"
 
-    - name: Parse current firmware core from DEV2 firmux (early)
+    # >>> CHANGE 1: Robust parse/normalize current firmware core from firmux <<<
+    - name: Parse current firmware core from DEV2 firmux (early, normalize 'rev' → '-r')
       when: dev2_firmux is defined
       delegate_to: localhost
       ansible.builtin.set_fact:
-        current_fw_core: "{{ (dev2_firmux.stdout | default('') | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')) | default('', true) }}"
+        _firmux_norm: "{{ (dev2_firmux.stdout | default('') | trim | lower | regex_replace('\\s*rev\\s*','-r')) }}"
+        current_fw_core: "{{ (_firmux_norm | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')) | default('', true) }}"
 
     - name: Soft-block if current firmware already matches target (skip staging/write/flip)
       when:
@@ -765,18 +758,13 @@
       register: local_md5
       changed_when: false
 
-    # >>> CHANGED: soft-block on local md5 mismatch; debug on match <<<
-    - name: Local md5 matches expected (debug)
-      when: local_img.stat.exists and ((local_md5.stdout | trim) == image_md5)
-      delegate_to: localhost
-      ansible.builtin.debug:
-        msg: "Local md5 matches expected"
-
+    # >>> CHANGE 2: Local md5 mismatch is a SOFT-BLOCK, not a hard assert <<<
     - name: Soft-block if local md5 does not match expected
       when: local_img.stat.exists and ((local_md5.stdout | trim) != image_md5)
       ansible.builtin.set_fact:
+        _prep_blocked: true
         _blocked: true
-        _journal: "{{ (_journal | default([])) + [ 'Local md5 mismatch: have=' ~ (local_md5.stdout | trim) ~ ' expected=' ~ image_md5 ] }}"
+        _journal: "{{ _journal + [ 'Local md5 mismatch: have=' ~ (local_md5.stdout | trim) ~ ' expected=' ~ image_md5 ] }}"
 
     # Optional SHA256 local
     - name: Compute local sha256 of the image (if provided)