The exported SVG's 4 edge labels (no/yes/approve/decline) had two extra,
non-adaptive background-color declarations stamped onto their wrapper
divs by the draw.io exporter (flat #ffffff, and an undefined
var(--ge-adaptive-bg) CSS variable that falls back to #ffffff) -
independent of both the .drawio source content and the export dialog's
Appearance setting (tested Automatic and Light, both showed it).
Surgically stripped just those two declarations from the exported SVG,
verified count (4+4 removed, 0 remaining), confirmed the correct
adaptive span background (light-dark(white, #1C1D1E)) and every other
color in the diagram were untouched, confirmed still valid XML.
Live-checked every flow's actual Kestra definition for a Pause task.
Only app-update has one; the other 6 main flows (os-update-vms,
container-update, disk-cleanup, os-update-pbs, os-update-pve,
os-update-pve-verify) run fully automatically with no human checkpoint
at all - their safety net is the automated health-check/rollback path,
not human approval. The doc previously presented check->pause->approve
as the universal pattern for all 13 flows and stated outright that
'nothing gets changed on the fleet without a human explicitly resuming
a paused flow', which was false for the flows that actually change
the fleet. The KB was already correct on this point.
Also replaced the mermaid diagram (broke this repo's established
Nextcloud-SVG convention) with a real diagram showing both patterns,
plus live evidence of the Pause-task check itself.
thesabear
