From 7ecd63cd613793d269e15606f5fb83a9902e0b15 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 14 Oct 2026 11:30:46 +0200 Subject: [PATCH] v0.156.0: CHANGELOG release entry (sha, bundle, step bundle, tag) --- CHANGELOG.md | 40 ++++++++++++++++++++++++++++++++++++++++ REPORT.md | 4 ++-- 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b5ab87..cac3c78 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,43 @@ +## v0.156.0 — after a power cut: the dead half-written backup is removed (R-1006); a backup task from before the boot is not „in flight" (R-1008) (2026-10-14) + +Released by `scripts/release-agent.sh`: binary sha256 `8db2278838dcb733d5201fba84b75a829b9adebdf899c89dd7de0939ec10d51a`, bundle +`a21605217966ebc953d55a35157a9eb0243ca542c50dbd94fc9fa67257f27369` (tag `v0.156.0` = `a2f3aee`). Step bundle `0.156.0-step1` sha256 +`8be2bb8f3d54bff8e7140cf99714664df31adecf13aa721597323fb2b9d43db5` (the 0.155.0 bundle `795f2ab4…` with only `felhom-os-apply` +replaced; `scripts/build-step-bundle.py`), published as package version `0.156.0-step1`. **Not vouched** (the operator's act). + +**Delivery: the agent binary AND the config bundle, and the bundle ADDS a path** (`/usr/local/sbin/felhom-vzdump-partial-clean`) +— so per box: signed `agent_update 0.156.0` → `agent_config_update 0.156.0-step1` (the step bundle) → `agent_config_update +0.156.0`. Evidence: felhom.eu `documentation/audits/power-cut-fixes-2026-10-14/` (the spike C1–C4, the red-proofs). + +- **R-1008 — one in-flight answer.** `staleLockController.BackupRunning` (the ONE implementation all four callers reach: + the start-up stale-lock pass, the guest-power watchdog, the household power-off guard, the controller supervisor) now + answers through `vzdumpInFlight`: a vzdump task for the vmid that started at or after the host's boot. Proxmox keeps a + dead task in `tasks?source=active` for ~30–60 s after a power cut (measured, C3) — the agent starts inside that window + and called it „genuinely in-flight". A task from before the boot is dead; logged once (vmid, UPID, start, boot). The + start time comes from the list or, if absent, the UPID; an unreadable boot time or start time FAILS SAFE (running), as + before. The boot time is `poweroff.ProcBtime` (no third /proc/stat parser). +- **R-1006 — the half-written backup is removed.** New `internal/vzpartial`: on a `dir` backup target it finds exactly + `vzdump-(lxc|qemu)--YYYY_MM_DD-HH_MM_SS.(tar.dat|vma.dat|tmp)` of THAT guest (never a finished archive, a log, + another guest, a symlink, a wrong kind), and — only when no vzdump of the guest is in flight (R-1008) and the entry is + dead (modified before this boot, or untouched for 120 s) — asks the root helper to remove it. Runs at agent start (after + the stale-lock pass, every owned guest × every backup tier) and before every backup's space preflight + (`BackupRunner.SetBeforeBackup`). Any doubt leaves the entry and logs why. +- **The root helper `configs/felhom-vzdump-partial-clean`** (config bundle; sudoers `FELHOM_VZPARTIAL`, one exact line: a + storage id, a vmid, one half-written name) re-checks everything as root: a `dir` storage from `/etc/pve/storage.cfg`; the + name of that vmid; not a symlink; directly in `/dump`; **no vzdump on the host at all** (a job for several guests + carries no vmid in its task name); **no process holds the entry open** (C2: after a killed worker, `tar` and `zstd` kept + writing into the `.tar.dat` for 4 min 40 s, none named „vzdump"); dead (before this boot, or quiet 120 s). +- **Not changed, by evidence (C4):** the space preflight's sizing (R-1006 part 2) — on „No space left" vzdump removes its + own partial on both its paths (rsync and tar); only a power cut leaves one. +- **Tests:** `stalelock_inflight_test.go` (the helper, the production controller, three callers end to end, a structural + pin that every `BackupRunning` call goes through `s.staleLock` and there is one implementation), `vzpartial_test.go` + (removes; keeps in flight / unknown / non-dir / other names / recent / wrong kind / symlink / a helper refusal — each keep + with its positive control), `r685_space_test.go` (the cleanup runs BEFORE the preflight), the helper's own 21 Python + tests (`configs/test_felhom_vzdump_partial_clean.py`, run by the Go suite), 8 sudoers injection cases. **17 guards + red-proofed** by mutation (`power-cut-fixes-2026-10-14/redproof.txt`). +- **Fixed without a row:** `internal/localapi/guestbind.go` and `controllersupervisor_test.go` were not gofmt-clean on + `main` (an import order and a struct alignment) — formatted. + ## v0.155.0 — the household can turn the machine off: POST /host/poweroff (R-998); the escrow reply race fixed (2026-10-13) Released by `scripts/release-agent.sh`: binary sha256 `bb339e944eff4aa6d10ae09158e0943de2e5c3777f52bf993c796d57e46800c3`, bundle diff --git a/REPORT.md b/REPORT.md index 1d0eac2..6e12e6f 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,4 +1,4 @@ -# REPORT — v0.156.0: after a power cut the box clears up (R-1006, R-1008) — built, not yet released (2026-10-14) +# REPORT — v0.156.0: after a power cut the box clears up (R-1006, R-1008) — released, not vouched (2026-10-14) Evidence: felhom.eu `documentation/audits/power-cut-fixes-2026-10-14/` — the spike (C1 the night's leftover, C2 a killed worker, C3 a real power cut, C4 a full disk), the 17 red-proofs. @@ -26,5 +26,5 @@ config bundle tests (55) and the helper's tests (21) pass. 17 mutations, 17 red. ## Next -Release (tag, publish, step bundle), the operator's vouch + floor, then the live proof on demo-hp (a cut mid-backup) and +Released: tag `v0.156.0`, binary sha256 `8db22788…`, bundle `a2160521…`, step bundle `0.156.0-step1` `8be2bb8f…`. Then the operator's vouch + floor, then the live proof on demo-hp (a cut mid-backup) and delivery to Tester 1 and the N100.