step-evidence

Step 2 — Gather evidence

This is the data-source catalogue for Untether debugging. Run the relevant sources for the classified issue type (Step 1). Don't skip — each surfaces different context.

Replace ${HOURS} with the window (default 24 for sweep, sized to fit the issue's reported window in targeted mode).

2a. journalctl (lba-1 — five services)

Untether runs five services on lba-1:

Service	Bot	Source
untether.service	@hetz_lba1_bot (staging)	PyPI / TestPyPI wheel
untether-dev.service	@untether_dev_bot (dev)	Local editable /home/nathan/untether/src/
untether-demo.service	demo bot	Local editable, demo config
untether-dev-hf.service	handoff dev	Local editable, handoff config
untether-dev-ws.service	workspace dev	Local editable, workspace config

# Per-service error/warning lines
for unit in untether untether-dev untether-demo untether-dev-hf untether-dev-ws; do
  systemctl --user is-active "$unit.service" >/dev/null 2>&1 || continue
  echo "=== $unit ==="
  journalctl --user -u "$unit" --since "${HOURS}h ago" --output=cat \
    | grep -E 'level=(error|warning)|"level":\s*"(error|warning)"' | head -200
done

For targeted mode, restrict to the affected service. Most issues live in untether-dev (development) or untether (staging-PyPI); the demo/handoff/ws services rarely surface novel bugs.

2b. Fleet — four remote hosts (nsd, channelo, sl, mac)

The fleet runs one untether.service per host (the PyPI wheel). SSH from lba-1 via the tailnet:

for host in nsd channelo mac; do
  echo "=== $host ==="
  ssh "$host" "journalctl --user -u untether --since '${HOURS}h ago' --output=cat \
    | grep -E 'level=(error|warning)|\"level\":\\s*\"(error|warning)\"'" 2>/dev/null \
    | head -200 || echo "(host unreachable)"
done

If a host is unreachable, never silently drop it — log "partial scope: unreachable" in the report. The mac host uses OpenSSH only (Tailscale ACL forbids tag:server → user-owned); ensure ssh mac works from lba-1 before debugging.