v0.156.0: CHANGELOG release entry (sha, bundle, step bundle, tag)

CHANGELOG.md

@@ -1,3 +1,43 @@
+## v0.156.0 — after a power cut: the dead half-written backup is removed (R-1006); a backup task from before the boot is not „in flight" (R-1008) (2026-10-14)
+
+Released by `scripts/release-agent.sh`: binary sha256 `8db2278838dcb733d5201fba84b75a829b9adebdf899c89dd7de0939ec10d51a`, bundle
+`a21605217966ebc953d55a35157a9eb0243ca542c50dbd94fc9fa67257f27369` (tag `v0.156.0` = `a2f3aee`). Step bundle `0.156.0-step1` sha256
+`8be2bb8f3d54bff8e7140cf99714664df31adecf13aa721597323fb2b9d43db5` (the 0.155.0 bundle `795f2ab4…` with only `felhom-os-apply`
+replaced; `scripts/build-step-bundle.py`), published as package version `0.156.0-step1`. **Not vouched** (the operator's act).
+
+**Delivery: the agent binary AND the config bundle, and the bundle ADDS a path** (`/usr/local/sbin/felhom-vzdump-partial-clean`)
+— so per box: signed `agent_update 0.156.0` → `agent_config_update 0.156.0-step1` (the step bundle) → `agent_config_update
+0.156.0`. Evidence: felhom.eu `documentation/audits/power-cut-fixes-2026-10-14/` (the spike C1–C4, the red-proofs).
+
+- **R-1008 — one in-flight answer.** `staleLockController.BackupRunning` (the ONE implementation all four callers reach:
+  the start-up stale-lock pass, the guest-power watchdog, the household power-off guard, the controller supervisor) now
+  answers through `vzdumpInFlight`: a vzdump task for the vmid that started at or after the host's boot. Proxmox keeps a
+  dead task in `tasks?source=active` for ~30–60 s after a power cut (measured, C3) — the agent starts inside that window
+  and called it „genuinely in-flight". A task from before the boot is dead; logged once (vmid, UPID, start, boot). The
+  start time comes from the list or, if absent, the UPID; an unreadable boot time or start time FAILS SAFE (running), as
+  before. The boot time is `poweroff.ProcBtime` (no third /proc/stat parser).
+- **R-1006 — the half-written backup is removed.** New `internal/vzpartial`: on a `dir` backup target it finds exactly
+  `vzdump-(lxc|qemu)-<vmid>-YYYY_MM_DD-HH_MM_SS.(tar.dat|vma.dat|tmp)` of THAT guest (never a finished archive, a log,
+  another guest, a symlink, a wrong kind), and — only when no vzdump of the guest is in flight (R-1008) and the entry is
+  dead (modified before this boot, or untouched for 120 s) — asks the root helper to remove it. Runs at agent start (after
+  the stale-lock pass, every owned guest × every backup tier) and before every backup's space preflight
+  (`BackupRunner.SetBeforeBackup`). Any doubt leaves the entry and logs why.
+- **The root helper `configs/felhom-vzdump-partial-clean`** (config bundle; sudoers `FELHOM_VZPARTIAL`, one exact line: a
+  storage id, a vmid, one half-written name) re-checks everything as root: a `dir` storage from `/etc/pve/storage.cfg`; the
+  name of that vmid; not a symlink; directly in `<path>/dump`; **no vzdump on the host at all** (a job for several guests
+  carries no vmid in its task name); **no process holds the entry open** (C2: after a killed worker, `tar` and `zstd` kept
+  writing into the `.tar.dat` for 4 min 40 s, none named „vzdump"); dead (before this boot, or quiet 120 s).
+- **Not changed, by evidence (C4):** the space preflight's sizing (R-1006 part 2) — on „No space left" vzdump removes its
+  own partial on both its paths (rsync and tar); only a power cut leaves one.
+- **Tests:** `stalelock_inflight_test.go` (the helper, the production controller, three callers end to end, a structural
+  pin that every `BackupRunning` call goes through `s.staleLock` and there is one implementation), `vzpartial_test.go`
+  (removes; keeps in flight / unknown / non-dir / other names / recent / wrong kind / symlink / a helper refusal — each keep
+  with its positive control), `r685_space_test.go` (the cleanup runs BEFORE the preflight), the helper's own 21 Python
+  tests (`configs/test_felhom_vzdump_partial_clean.py`, run by the Go suite), 8 sudoers injection cases. **17 guards
+  red-proofed** by mutation (`power-cut-fixes-2026-10-14/redproof.txt`).
+- **Fixed without a row:** `internal/localapi/guestbind.go` and `controllersupervisor_test.go` were not gofmt-clean on
+  `main` (an import order and a struct alignment) — formatted.
+
 ## v0.155.0 — the household can turn the machine off: POST /host/poweroff (R-998); the escrow reply race fixed (2026-10-13)
 
 Released by `scripts/release-agent.sh`: binary sha256 `bb339e944eff4aa6d10ae09158e0943de2e5c3777f52bf993c796d57e46800c3`, bundle

REPORT.md

@@ -1,4 +1,4 @@
-# REPORT — v0.156.0: after a power cut the box clears up (R-1006, R-1008) — built, not yet released (2026-10-14)
+# REPORT — v0.156.0: after a power cut the box clears up (R-1006, R-1008) — released, not vouched (2026-10-14)
 
 Evidence: felhom.eu `documentation/audits/power-cut-fixes-2026-10-14/` — the spike (C1 the night's leftover, C2 a killed
 worker, C3 a real power cut, C4 a full disk), the 17 red-proofs.
@@ -26,5 +26,5 @@ config bundle tests (55) and the helper's tests (21) pass. 17 mutations, 17 red.
 
 ## Next
 
-Release (tag, publish, step bundle), the operator's vouch + floor, then the live proof on demo-hp (a cut mid-backup) and
+Released: tag `v0.156.0`, binary sha256 `8db22788…`, bundle `a2160521…`, step bundle `0.156.0-step1` `8be2bb8f…`. Then the operator's vouch + floor, then the live proof on demo-hp (a cut mid-backup) and
 delivery to Tester 1 and the N100.