FlywheelApp · full
Cinema + labs + WebGL. The labeled map, Hub canvas, field sketch, and every live engine. Use when this is the app that owns the GPU on the machine.Every feature, no graphics. Same engines, same API, same honesty grammar. No WebGL, no custom cursor, no Three.js. For when other apps already hold the GPU, or after learning loops when you only need the work.Terminal + one API out. Every live verb as a command and as HTTP. TUCE agents load skill.md and call /api/v1. No cinema overhead. Occupancy stays nominated | live-bound | unavailable.

Lifecycle

Pin the version. Backup first. Roll back if smoke fails.

Flywheel versions the hub the way operators actually recover: SemVer, a digested snapshot, a pointer-swap that does not execute payload code, and last-known-good restore. Public badge NCM 1.19.0 · Hub 2.2.0. A later kit on disk is not this badge.

Documented, not a public SLA

Upgrade is a contract. Occupancy is not versioned away.

Hub unfroze 2026-09-15. Public badge is NCM 1.19.0 · Hub 2.2.0. Earlier kits (including 1.17.0 and 1.18.0) remain on disk as packs. They are not this badge.

How it connects

Preflight → backup → apply → smoke → keep or restore.

documented

Pin the version. Backup first. Smoke. Roll back if smoke fails.

Flywheel’s upgrade grammar is SemVer plus last-known-good restore. It is not a public SLA.

  1. 01Pin SemVerNCM 1.19.0 · Hub 2.2.0
  2. 02Preflightnever skip backup
  3. 03Encrypted backupdigest-bound snapshot
  4. 04Applythen verify

Prefer a forward fix only when smoke mostly passes

keep

05aKeep versionchangelog records it

restore

05bRestore latestthen smoke again

Signed Windows upgrade / downgrade-policy / update-rollback entry paths are still absent. That is unavailable — not a claimed installer SLA. Adapter rollback is a separate, documented control-plane op.

Four identities

Do not collapse them.

Public badge

NCM 1.19.0 · Hub 2.2.0

This host. Hub 2.2.0 is the app surface.

Hub product file

2.2.0

Product-line VERSION.

Python package

0.9.19+protocol

Runtime authority. Separate string.

Prior kits on disk

1.17.0 and 1.18.0 remain

Present as packs. Not this badge.

SemVer 2.0.0

MAJOR. MINOR. PATCH. Occupancy grammar stays.

MAJOR

Breaking occupancy, API, or storage contract. Operators should expect a restore drill before they apply it.

MINOR

New surfaces or families that stay refuse-first. Complementary sockets added here stay nominated until bound.

PATCH

Fixes that must not change occupancy grammar, claim silicon, or silently grant a tool.

Operator path

Six steps. Backup is not optional.

Pin the version you are onRecord NCM 1.19.0 · Hub 2.2.0 (or the Hub version this instance actually reports). Do not apply a pack that targets a newer binary than you run.PreflightConfirm disk, path, digest, and that a backup is required. Hub preflight fails closed if those are missing. Operator consent shows notes, size, migrations, and backup.Encrypted backupHub recovery creates a SQLite online snapshot, encrypts it, decrypt-checks it, and verifies integrity before it is published. NCM apply is backup-gated. Restore is digest-bound.Apply the packNCM apply is a pointer-swap of digested blobs (executes_code = false). Then the ordinary migration lifecycle. Migrations require backup, upgrade, downgrade, and failure tests.Smoke the hubSmoke the active blob (digest + pointer + honesty flags). Open orbit, a labeled map, catalog, and one Observe room. A green HTTP code is not completion.Rollback or forward-rollbackIf smoke fails, restore the last backup pointer / retained prior package. If SemVer forbids a lower number, forward-rollback ships last-good bytes as the next patch so the version still increases.

  1. 01

    Pin the version you are on documented

    Record NCM 1.19.0 · Hub 2.2.0 (or the Hub version this instance actually reports). Do not apply a pack that targets a newer binary than you run.

  2. 02

    Preflight documented

    Confirm disk, path, digest, and that a backup is required. Hub preflight fails closed if those are missing. Operator consent shows notes, size, migrations, and backup.

  3. 03

    Encrypted backup documented

    Hub recovery creates a SQLite online snapshot, encrypts it, decrypt-checks it, and verifies integrity before it is published. NCM apply is backup-gated. Restore is digest-bound.

  4. 04

    Apply the pack documented

    NCM apply is a pointer-swap of digested blobs (executes_code = false). Then the ordinary migration lifecycle. Migrations require backup, upgrade, downgrade, and failure tests.

  5. 05

    Smoke the hub documented

    Smoke the active blob (digest + pointer + honesty flags). Open orbit, a labeled map, catalog, and one Observe room. A green HTTP code is not completion.

  6. 06

    Rollback or forward-rollback documented

    If smoke fails, restore the last backup pointer / retained prior package. If SemVer forbids a lower number, forward-rollback ships last-good bytes as the next patch so the version still increases.

When to roll back

Prefer a forward fix only when smoke mostly passes.

  • Health check after apply fails.
  • Smoke digest or pointer does not match.
  • A required migration fails or the database will not pass integrity.
  • Adapter activate/hotswap cannot restore the prior route — the control plane already tries.
  • A canary execution fires its named rollback policy.
  • You cannot explain the new occupancy with nominated | live-bound | unavailable.

Rollback surfaces

Adapter, model alias, database, and installer are different verbs.

documented

Database restore

FW2-DATA-022: verified encrypted backup, last-known-good restore, pre-migration backup, staged restore, quarantine of displaced DB/WAL/SHM. Production DR reconciliation of restored sessions remains a residual gate — not a public SLA.

documented

NCM pointer rollback

Rollback restores the last backup pointer. Forward-rollback ships last-good bytes as the next patch when a lower SemVer is not allowed. Apply does not execute payload code.

documented

Adapter rollback

Control-plane op: if activate or hotswap fails, the prior route is restored. Multi-LoRA compose fails closed. This is not a Windows installer rollback.

documented

Model-update rollback

Durable model update retains the prior digest and swaps an alias. Provider weights are not rewritten in place.

documented

Canary with named policy

Shadow, then canary, with a named rollback policy and an idempotency key. Canary live ≠ certified deploy. Promotion is human.

documented

First-party flags

Pack flags default off and are inventory-only. Kill is a Hub flag row (flag_kill). Rolling back files does not automatically kill a flag. Not a third-party flag SaaS.

documented

Portable DB backup

SHA-256 bound SQLite snapshot with a backup-manifest. Restore is integrity-checked. Arbitrary paths are rejected.

unavailable

Signed Windows upgrade path

FW2-INSTALL-028: signed upgrade, downgrade-policy, and update-rollback entry paths are still absent on the Windows desktop matrix. Compatibility for Windows 10/11 is release_gated. We do not claim that installer SLA.

Hub upgrade API

Authenticated write routes. Apply does not execute payload code.

GET/intelligence/upgrade/catalogProtocol map and honesty stamps.
GET/intelligence/upgrade/pollChannel versus the active pointer.
POST/intelligence/upgrade/preflightDisk, path, digest, backup required.
POST/intelligence/upgrade/backupCreate a verified snapshot.
POST/intelligence/upgrade/rollbackRestore the last backup pointer.
POST/intelligence/upgrade/forward-rollbackLast-good bytes as the next patch.
POST/intelligence/upgrade/smokeDigest + pointer + honesty flags.
POST/intelligence/upgrade/fail-slotRevert an NCM staging slot to A.
POST/intelligence/upgrade/flag-killTurn a first-party flag off after a file restore.

NCM apply is a pointer-swap of digested blobs. Flag kill is separate from file restore. Canary live is not a certified deploy.

Protocol map

What the versioning brief asked for — mapped onto Flywheel.

TopicFlywheelLabel
Semantic Versioning 2.0.0Public pin NCM 1.19.0 · Hub 2.2.0. MAJOR.MINOR.PATCH. Kits numbered later than the pin are not this badge.documented
Change logHub changelog uses Keep-a-Changelog sections. This host publishes the public badge story. We will not pretend NCM 1.8.0 is current.documented
Conventional Commits / semantic-releaseVersion numbers are authored and gated. They are not inferred from commit verbs. Not a public SLA.unavailable
In-app poll / consentHub can poll a channel and show that a new version is available. Operator consent shows notes, compatibility, size, migrations, and backup. Not a silent store updater.documented
Backup before applyApply is backup-gated. Missing backup fails closed. Encrypted snapshot, integrity check, digest-bound restore.documented
Database migrationsChecksummed forward and downgrade paths. Restore runs before database initialization. Some downgrades refuse until an explicit export exists.documented
CanaryShadow then canary with a named rollback policy. Canary live is not a certified deploy. No auto-promote to 100%.documented
Feature flagsFirst-party flags default off. Kill is flag_kill. Not LaunchDarkly. File restore does not auto-kill a flag.documented
API versioningAdditive is compatible. Breaking needs a versioned route. Occupancy grammar is not versioned away. NCM version is the public protocol pin.documented
Compatibility matrixWindows 10/11 release_gated. Linux/macOS planned. Ollama/Cursor/OpenAI/MCP contract_tested. Not certified on every OS.documented
SBOMCycloneDX SBOM is generated in CI evidence. That is not a claim that every CVE auto-halts a release.documented
Keep prior stablesKeep git tags and the last verified kits. Scheduled DB retention is a documented snapshot policy, not a hosted two-zip SLA. Windows “last two signed installers” is intended, not landed.illustrative
Hosted traffic promoteFlywheel is a local hub. There is no hosted traffic-promote control on this product.unavailable
Uptime / availability SLASupport response hours are targets, not measured SLAs. Status on this host refuses fake uptime. invented_metrics = false.unavailable
Silent store / Omaha / crash-rate haltNot claimed. No Chrome-style silent updater, no crash-rate freeze dashboard, no CDN/P2P distribution.unavailable

Prevention

Never skip backup. Never certify a socket because a pack mentioned it.

  • Never skip backup on a machine that holds work you care about.
  • Do not apply a pack newer than the running binary.
  • Keep git tags and the last verified kits.
  • Treat adapter rollback, model-alias rollback, and database restore as different operations.
  • If schema moved, restore the last-known-good database before pointing the app at an older tree.
  • Kill first-party flags separately after a file restore. Rolling back files does not auto-kill a flag.
  • After restore, review sessions, leases, and entitlements. Whole-database restore can reintroduce older authorization state.
  • Do not call a complementary socket certified because an upgrade pack mentioned it.

ChangelogWhat actually changed. No invented metrics. Public badge is NCM 1.19.0 · Hub 2.2.0.Adapter rollbackAdapter rollback is a different verb from installer restore. Eight operations • seven states.Status (no fake uptime)No fake uptime wall. Occupancy is nominated | live-bound | unavailable.Upgrade stepperPin and preflight are real acts. Apply without backup fails closed. Hover each verb.

← Adaptersinspect • load • activate • deactivate • hotswap • unload • compose • rollbackAll integration flowsEvery Hub menu as a flow: scan, fit, bind, hot-swap, StrataX, observe, upgrade.Caller API →One API out for TUCE. Token completion refuses. SAT and fit are live.