Replaces the to-do list with the work itself. Eight layers, 42 concepts,
1200 lines, each with what it is, why it turns up here, how it fails, and
the command to check it.
Most values were read off the running system rather than recalled:
conntrack ESTABLISHED timeout 86400s — why A-1's injection sat unmatched
for 25 minutes was normal, not a fault
FORWARD chain position 1 KUBE-ROUTER-FORWARD — why -I FORWARD 1
counted zero packets
cgroup version v2, and the numbers in systemctl status
are read straight out of those files
nginx restart policy on-failure, 100ms, and it gives up after
5 failures in 10 seconds
Type and KillMode five units on this host, four different
combinations
Two facts could not be read locally and carry sources: Let's Encrypt
backdates notBefore by exactly one hour to tolerate client clock skew, and
Keycloak invalidates the whole SSO session on refresh token reuse. The
second one explains B-3 — the winning request's new token was not itself
rejected, the session it belonged to had just been deleted.
The systemd layer also explains the one CGroup line in systemctl status that
D-4 spent ps commands establishing: master 585 kept, worker replaced.
One item is marked as read rather than measured. Restart=on-failure comes
from the unit file; nginx has not been killed to watch it come back.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
