12:27

files/ansible-playbooks/update-indoor.yml

@@ -1,4 +1,3 @@
----
 # update-indoor.yml  (conservative, minimal fixes)
 - name: Second-line indoor upgrade via DEV1 → tunnel → DEV2 (non-invasive control path)
   hosts: all
@@ -157,9 +156,8 @@
                         echo "$p"; return 0
                     fi
                 fi
-            done
-            return 1
-        }
+            endfor=false
+            }
         pick
       register: pick_port
       changed_when: false
@@ -618,6 +616,29 @@
       ansible.builtin.debug:
         msg: "DEV2 firmux={{ (dev2_firmux.stdout | default('')) | trim }}"
 
+    # --- PRE-FLIGHT: derive target core and compare with current; block if equal ---
+    - name: Derive expected target_version core (early, from image filename)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        expected_fw_core_early: "{{ (image_filename | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')) | default('', true) }}"
+
+    # >>> CHANGE 1: Robust parse/normalize current firmware core from firmux <<<
+    - name: Parse current firmware core from DEV2 firmux (early, normalize 'rev' → '-r')
+      when: dev2_firmux is defined
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        _firmux_norm: "{{ (dev2_firmux.stdout | default('') | trim | lower | regex_replace('\\s*rev\\s*','-r')) }}"
+        current_fw_core: "{{ (_firmux_norm | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')) | default('', true) }}"
+
+    - name: Soft-block if current firmware already matches target (skip staging/write/flip)
+      when:
+        - (expected_fw_core_early | length) > 0
+        - (current_fw_core | length) > 0
+        - current_fw_core == expected_fw_core_early
+      ansible.builtin.set_fact:
+        _blocked: true
+        _journal: "{{ (_journal | default([])) + [ 'Device already running target image: ' ~ current_fw_core ~ ' — skipping write/flip' ] }}"
+
     # ---------------------------- Normalize rebootin early (HOURS) ----------------------------
     # Strict: rebootin is integer HOURS only. Always add +20s grace to the schedule.
 
@@ -737,14 +758,13 @@
       register: local_md5
       changed_when: false
 
-    - name: Verify local md5 matches expected
-      when: local_img.stat.exists
-      delegate_to: localhost
-      ansible.builtin.assert:
-        that:
-          - (local_md5.stdout | trim) == image_md5
-        fail_msg: "Local md5 does not match expected got {{ local_md5.stdout | trim }} expected {{ image_md5 }}"
-        success_msg: "Local md5 matches expected"
+    # >>> CHANGE 2: Local md5 mismatch is a SOFT-BLOCK, not a hard assert <<<
+    - name: Soft-block if local md5 does not match expected
+      when: local_img.stat.exists and ((local_md5.stdout | trim) != image_md5)
+      ansible.builtin.set_fact:
+        _prep_blocked: true
+        _blocked: true
+        _journal: "{{ _journal + [ 'Local md5 mismatch: have=' ~ (local_md5.stdout | trim) ~ ' expected=' ~ image_md5 ] }}"
 
     # Optional SHA256 local
     - name: Compute local sha256 of the image (if provided)