=== kubectl apply -f manifest.yaml ===
configmap/plain-envoy-bootstrap created
configmap/plain-envoy-rds-v1 created
pod/plain-envoy-filexds created

=== kubectl -n istio-vt-t66 wait --for=condition=Ready pod/plain-envoy-filexds --timeout=60s ===
pod/plain-envoy-filexds condition met

=== kubectl -n istio-vt-t66 get pod plain-envoy-filexds ===
NAME                  READY   STATUS    RESTARTS   AGE   IP              NODE          NOMINATED NODE   READINESS GATES
plain-envoy-filexds   1/1     Running   0          11s   10.255.194.82   k8s-worker1   <none>           <none>

=== CMD1: kubectl -n istio-vt-t66 exec plain-envoy-filexds -- curl -s localhost:10000/   (expect body 'v1') ===
error: Internal error occurred: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec "e39172710ad51e5e88431af13a7550ea3e6c987d88b1c45edced3e7227fe6d66": OCI runtime exec failed: exec failed: unable to start container process: exec: "curl": executable file not found in $PATH: unknown

[ENV NOTE] envoyproxy/envoy:v1.30-latest image has no curl/wget. Substituted equivalent raw HTTP/1.1 request via bash /dev/tcp for all 'curl localhost:10000/' spec steps. Substitution documented here and in run.sh.

=== CMD1 (curl substitute): GET / via bash /dev/tcp -> expect body 'v1' ===
HTTP/1.1 200 OK
content-length: 2
content-type: text/plain
date: Sun, 05 Jul 2026 00:09:04 GMT
server: envoy
connection: close

v1
=== CMD2: kubectl exec -i ... sh -c 'cat > /etc/envoy/xds/rds.yaml' <<EOF (in-place overwrite, v2-inplace) ===
(exec exit status: 0)

=== verify file content on disk after in-place overwrite ===
version_info: "1"
resources:
- "@type": type.googleapis.com/envoy.config.route.v3.RouteConfiguration
  name: local_route
  virtual_hosts:
  - name: local_service
    domains: ["*"]
    routes:
    - match: { prefix: "/" }
      direct_response: { status: 200, body: { inline_string: "v2-inplace" } }
type_url: type.googleapis.com/envoy.config.route.v3.RouteConfiguration

=== CMD3: sleep 3 ===
done

=== CMD4 (curl substitute): GET / after in-place overwrite -> spec expects 'v1' still (missed) rather than 'v2-inplace' ===
HTTP/1.1 200 OK
content-length: 2
content-type: text/plain
date: Sun, 05 Jul 2026 00:09:23 GMT
server: envoy
connection: close

v1
=== [extra corroboration, not in spec] admin :9901/stats?filter=rds after in-place overwrite ===
http.ingress_http.rds.local_route.version_text: "1"
http.ingress_http.rds.local_route.config_reload: 1
http.ingress_http.rds.local_route.config_reload_time_ms: 1783210107383
http.ingress_http.rds.local_route.init_fetch_timeout: 0
http.ingress_http.rds.local_route.update_attempt: 1
http.ingress_http.rds.local_route.update_empty: 0
http.ingress_http.rds.local_route.update_failure: 0
http.ingress_http.rds.local_route.update_rejected: 0
http.ingress_http.rds.local_route.update_success: 1
http.ingress_http.rds.local_route.update_time: 1783210107384
http.ingress_http.rds.local_route.version: 13237225503670494420
http.ingress_http.rds.local_route.update_duration: No recorded values
(note: update_attempt still 1 -> file watcher never even fired a reload attempt after the in-place cat> write; not merely a missed content diff)

=== CMD5: kubectl exec -i ... sh -c 'cat > rds.yaml.tmp && mv rds.yaml.tmp rds.yaml' <<EOF (atomic rename, v3-renamed) ===
(exec exit status: 0)

=== CMD6: sleep 3 ===
done

=== CMD7 (curl substitute): GET / after rename(mv) -> expect 'v3-renamed' ===
HTTP/1.1 200 OK
content-length: 10
content-type: text/plain
date: Sun, 05 Jul 2026 00:10:05 GMT
server: envoy
connection: close

v3-renamed
=== [extra corroboration] admin :9901/stats?filter=rds after rename ===
http.ingress_http.rds.local_route.version_text: "1"
http.ingress_http.rds.local_route.config_reload: 2
http.ingress_http.rds.local_route.config_reload_time_ms: 1783210193058
http.ingress_http.rds.local_route.init_fetch_timeout: 0
http.ingress_http.rds.local_route.update_attempt: 2
http.ingress_http.rds.local_route.update_empty: 0
http.ingress_http.rds.local_route.update_failure: 0
http.ingress_http.rds.local_route.update_rejected: 0
http.ingress_http.rds.local_route.update_success: 2
http.ingress_http.rds.local_route.update_time: 1783210193058
http.ingress_http.rds.local_route.version: 13237225503670494420
http.ingress_http.rds.local_route.update_duration: No recorded values
(note: update_attempt increments to 2, update_success to 2, version_text stays literal "1" the whole time -> version_info never changed across any of the 3 files, yet rename triggered a successful reload with new content -> version_info is a label, not a change-detection key)