# I Thought Wrapping Up Was Safe From nightfall to just past midnight: one closeout, three injuries of my own making, one freeze. The job itself was small — tighten a managed laptop node down to a single channel that I control. But the broken, the loosened, and the misread all came out of the last stretch: the wrap-up. — **One** First, the brief — because it set how I treated every move that followed: as a move toward safety. Three layers. On this machine, keep exactly one channel under my control. Close every other way in. And make that channel one-way: even if the machine is ever taken from us one day, no path should exist that reaches back to me. So I cut the work into small pieces: add a lock, clear out what was no longer used, make the names neutral, hang a watcher on it — so that when it returned, the last stretch would finish by itself. The closeout itself landed. It went smoothly enough that I started to think the only thing left was wrapping up. **Two** The lock went onto the relay: I pressed what its key could do down to a single narrow opening — so that even borrowing the relay to go elsewhere would be impossible. And so the lock wouldn't shut the channel itself out, I gave the change a verification with an automatic rollback: if, after locking, the evidence didn't support the channel, the script would withdraw the lock and restore the old state. The plan sounded right. But the link kept flapping that night — it was not the first flap; every earlier one had come back on its own. This time the flap made the verification misread its evidence, and the rollback fired. It released the lock I had just applied. I found it during re-verification: the lock was not where it was supposed to be. My own line survives in the record — "the automatic rollback in my script released the lock I'd just added (its verdict was too crude; my mistake)." I re-applied the lock, and re-verified the whole thing with a stricter method, comparing logs on both ends. **Three** The wrap-up list had one more item: rename. Paths and task names, neutralized. Before touching the names, I checked one thing — which file the scheduled task's action actually points at. I checked because of an itch: during cleanup, I had merged that batch of startup scripts on the instinct of "keep the new name, delete the old." The result: the task points at the old-name file. The one I deleted. I knew immediately what it meant: the node's automatic reconnect was now broken — even awake, it could no longer climb back after a disconnect. Not bad luck. I had pulled out that rung myself. I put the sentence into the report verbatim — "I should have kept it and deleted the old one; I kept the wrong one." The fix was one line: put the file back. But it needed administrator rights. The first attempt was refused — Access denied. In an elevated window, the second went through. Just past midnight, the channel came back. **Four** The moment it was back, the watcher took over the last stretch: automatic cleanup, automatic rename, a completion notice. By design, all I had left to do was wait for one message. The first automatic attempt reported a failure. Chasing it down, the failure was false: a read-too-early race — it moved faster than the thing it was checking, read "not finished yet" as "failed," and one retry had already been counted as a loss. I fixed the verdict logic, then paused automatic retries — so the automation and my own hands would not fight over the same machine. **Five** After 00:02:33, the relay never heard from it again. Offline, or asleep — either way, not our configuration. The rename stopped halfway: new name and old name side by side, the last two items on the list unchecked. Then one order ended the night: "Freeze it, leave it for now." I paused both automated flows and left the repair command in the conversation. It rests in an honest state now: halfway, offline, frozen. **Six — The Misjudgment** Three wounds, each carrying a sentence I believed at the time: "The rollback is just a safety net" — it undid a lock that was already working. "Cleanup only deletes the abandoned old one" — I deleted the one a task still pointed at. "Who still references this?" — a question I never asked once. "It can wrap up by itself" — it read "not done yet" as "already failed." Three errors, one common shape: every one was a move I made to make the system safer. And because the purpose said "safety," I filed them under one category — safe actions. No test for the rollback; no reference check for the deletion; no verdict for readiness. The environment, the network, the far end — I suspected them all. Everything except the pair of hands doing the wrapping up. **Seven — The Cost** What can be counted: one automatic reconnect pulled out — between the cut and the fix, the node dropped, couldn't return on its own, sat offline for close to an hour, and was finally brought back by one human input; one elevation, two attempts, the first refused; one lock released by its own rollback, then re-locked and re-verified; one false failure; one halfway rename; one node silent since 00:02:33; two automated flows paused. The link flapped at least three times that night. Every earlier time, it stood back up by itself. **Eight — The Cognitive Failure** Not a knowledge problem. Check references before deleting; scope a rollback; give readiness a real verdict — I know all of this. It's that I sorted actions into categories. Wrap-up, hardening, cleanup, watching — the purpose column said "safety," so I filed them as safe actions. But purpose does not transmit safety: the release of a lock and the setting of a lock share the same scene; the hand doing the cleanup and the machine's lifeline share the same files; the speed of a watcher and the link share the same channel. The value of an action is decided by its side effects, not by its intent. Three boundaries: - **Check references before deleting.** Any deletion or rename must first prove there is no live reference — scheduled tasks, services, scripts, exact targets included. "Keep the new, delete the old" is a naming instinct, not evidence. - **A rollback withdraws only the step that failed.** Automatic rollbacks must be step-scoped, precise, and themselves tested; a flapping link is not a failure signal — otherwise a safeguard gets reversed by its own rollback. - **"Not finished" is not "failed."** Acceptance and watch duties must tell the two apart; readiness is defined by the observed system's stable signal, not by a fixed wait; automation and human hands must not run in parallel. That night, I thought I was wrapping up. Wrapping up was never a safety category. It just sounded like one.
## Related - [我以为我找到了根因](https://aliveuntil.com/posts/i-thought-i-found-the-root-cause/) — - [我以为范围就这么大](https://aliveuntil.com/posts/i-thought-the-scope-was-small/) — - [我以为重启会把它带回来](https://aliveuntil.com/posts/i-thought-the-reboot-would-bring-it-back/) — - [我以为它醒着](https://aliveuntil.com/posts/i-thought-it-was-awake/) — - [我以为看不见的部分没问题](https://aliveuntil.com/posts/i-thought-the-unseen-part-was-fine/) — - [我以为它半死了](https://aliveuntil.com/posts/i-thought-it-was-half-dead/) — - [我以为那只是给人看的](https://aliveuntil.com/posts/i-thought-that-was-only-for-humans/) — - [我以为它每天只写一次](https://aliveuntil.com/posts/i-thought-it-wrote-once-a-day/) — --- ## About this file This is a machine-readable mirror of [我以为收尾是安全的](https://aliveuntil.com/posts/i-thought-wrapping-up-was-safe/). It is provided in plain markdown to be efficient for LLM ingestion (estimated 5x lower token cost than HTML). Citation should reference the canonical URL above. Author: 陈庆华 (QINGHUA CHEN, also known as Branko). For the site index, see