{
  "schema_version": "contextra.field-diagnosis.v1",
  "observed_at": "2026-09-30T14:05:24+09:00",
  "lifecycle": "temporary",
  "cleanup_candidate_at": "manual-review",
  "scope": "read-only existing HTTP400 diagnosis; no new HTTP/login request",
  "repo_head": "f5b8b978e08311e8c5410e62320851ed5fb28c7e",
  "log_evidence": {
    "owner": "Web101 running application via Gradle daemon 74257",
    "bounded_tail_bytes": 12582912,
    "window_start_kst": "2026-09-30T13:37:30+09:00",
    "window_end_kst": "2026-09-30T13:38:05+09:00",
    "window_lines": 129,
    "event_time_kst": "2026-09-30T13:37:47+09:00",
    "event": "ai_connection_validation_failed",
    "code": "CONNECTION_VERSION_CONFLICT",
    "field": null,
    "following_api_error": "INVALID_PARAMS"
  },
  "connection_comparison": {
    "web_stored": {
      "serverId": "AI-01",
      "connectionConfigVersion": 1,
      "advertisedIp": "<SITE_IP>",
      "controlPort": 38443,
      "redisHost": "<SITE_IP>",
      "redisPort": 16379,
      "redisDb": 0,
      "redisUsername": "contextra_reader",
      "redisTls": false,
      "bboxStreamKey": "contextra:metadata:v1:channels",
      "createdAtWallMs": 1789704434000,
      "updatedAtWallMs": 1789704434000
    },
    "stopped_test_body": {
      "connectionConfigVersion": 1,
      "advertisedIp": "<SITE_IP>",
      "redisHost": "<SITE_IP>",
      "other_nonsecret_connection_fields_match_web": true
    },
    "icerti_pending_body": {
      "connectionConfigVersion": 1,
      "advertisedIp": "<SITE_IP>",
      "redisHost": "<SITE_IP>",
      "other_nonsecret_connection_fields_match_web": true
    },
    "icerti_previous_body": {
      "connectionConfigVersion": 1,
      "advertisedIp": "<SITE_IP>",
      "redisHost": "<SITE_IP>"
    },
    "note": "Connection fingerprints also include Redis credentials; credential equality was not asserted or logged. Address differences alone explain changed content."
  },
  "confirmed_code_contract": {
    "web": "AiControlMapper.AiConnectionOutcome.decide: same version plus different fingerprint -> CONFLICT; strictly newer version -> UPDATED",
    "web_registration": "DefaultAiConnectionRegistrar.register rejects CONFLICT without overwriting the stored connection",
    "error_mapping": "ManagedTokenService.aiConnectionFailed returns INVALID_PARAMS with safe details.aiConnection code; HTTP400",
    "ai_gap": "network_prepare.prepare copies old login-body, changes advertisedIp/controlPort/redis host and port, but does not advance connectionConfigVersion",
    "prepare_source_and_installed_sha256": "7a44189974d12e60bbaa8fdf219ccb6443706ea16d5e9ab8d1301eb6a281b6bb",
    "diagnostic_gap": "control_sidecar.auth collapses non200 login details to LOGIN_REJECTED plus status",
    "profile_schema_version": "office.json version=1 is the profile schema, not the connection registration version; do not change it as a workaround"
  },
  "current_state": {
    "icerti_running_contextra_containers": 0,
    "test_sidecar_running": false,
    "pending_result": "LOGIN_REJECTED",
    "pending_http_status": 400,
    "login_attempts_this_diagnosis": 0,
    "web_mutations": 0,
    "runtime_or_auth_mutations": 0,
    "source_changes": 0
  },
  "recommended_next": "Propose ct connection-version lifecycle and sanitized error details fix. Preserve failed stage and prepare a new request using version2 against current verified Web version1, after user approval. No blind increment/retry. test startup comparison deferred as unnecessary for this failure.",
  "user_observations": [
    "test and Web101 reportedly stayed connected for several days before today's noon password change",
    "ICERTI reportedly worked with its own Web after prior deployment; apart from today's tool work and yesterday's manual edits, configuration was largely unchanged",
    "These are user observations, not newly repeated acceptance tests; exact deployment date is not re-audited here"
  ]
}