REPORT + CONTEXT: v0.171.0 released and vouched; R-1344 restart proven live

CHANGELOG.md

@@ -1,4 +1,4 @@
-## Unreleased — R-1344 decided from the night's measurement: a controller that runs but does not answer is RESTARTED
+## v0.171.0 (2026-10-30) — R-1344 decided from the night's measurement: a controller that runs but does not answer is RESTARTED — RELEASED (release-agent.sh from a clean clone of `bd18347`; agent sha256 c888ca7ba22a1f689059081575814a725e2edcecbb6bcc56829e9d9de88202a5, config bundle 95f977f6dc827185f2b5a2aa9e1c829db41a9f425d49eb40f317286d13c83d2b; binary-only signed agent_update on Tester 1, demo-hp, demo-felhom; vouched by the operator 2026-10-30 10:47:36 CET; `pinned.day0_agent` = 0.171.0). Live on Tester 1: the controller frozen (SIGSTOP) 09:24:50 UTC → Docker „unhealthy" 09:26:36 → the alarm 09:29:21 → the restart 09:31:22 → healthy 09:31:24; the hub mailed `controller_unresponsive` and `controller_unresponsive_restart` (hub 0.178.0), not `controller_restarted_by_agent`
 
 - **The measurement (operator brief 2026-10-29 Part 2, read 2026-10-30).** Docker's own health record of the controller
   on Tester 1 and demo-hp, every probe from 2026-10-29 11:12 to 2026-10-30 07:00 UTC: 4 733 probes through the night

CONTEXT.md

@@ -1,12 +1,22 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-10-30 (day, attended) — v0.171.0 RELEASED and VOUCHED (10:47:36 CET): R-1344 decided — a controller that runs
+> but does not answer is RESTARTED.** The night's measurement (4 733 probes, slowest 303 ms, no failure) licensed it:
+> alarm at `controllerUnresponsiveConfirm` = 6 unhealthy sweeps, restart at `controllerUnresponsiveRestart` = 10 —
+> refused by a fresh/unreadable busy file (`controllerBusy`, shared with D65's reboot) or the brake
+> (`supervisorBrakeAllows`, now shared with the not-running restart; `recordSupervisorRestart` records both). The stanza
+> carries `unresponsive_restart_after_s` and `unresponsive_restart_at` (hub 0.178.0 mails
+> `controller_unresponsive_restart`). Built from `bd18347` (`c888ca7b…`, bundle `95f977f6…`), binary-only signed
+> updates on the three test boxes; live on Tester 1 (SIGSTOP → alarm 4.5 min → restart 6.5 min → healthy).
+> `pinned.day0_agent` = 0.171.0. felhom.eu `REPORT-release-2026-10-30.md`.
+
 > **2026-10-29 (evening, attended) — v0.170.0 RELEASED and VOUCHED (18:57:48 CET): `reboot_guest` (D65 = A).**
 > `da8d12a0…`, bundle `03f2ff64…`, tag `v0.170.0`, from a clean clone of `ca15a31`; configs/ changed (one new read-only
 > sudo vector: `cat` of the controller's `data/ctl/busy`), so per box a signed `agent_config_update` + `agent_update`
 > (Tester 1, demo-hp, demo-felhom; capability probe 76/76). The agent's closed list is `restart_controller` +
 > `reboot_guest` (`opreboot.go`; guards in felhom.eu `03`/`04` §6.1). Proven on Tester 1: refused during an off-site run
 > (the controller's busy file), done in 67 s / 79 s, refused a second time inside the hour. `pinned.day0_agent` = 0.170.0.
-> **R-1344 (the stuck-controller restart) is still ALARM ONLY** — the night's health log is read on 2026-10-30.
+> **R-1344 decided 2026-10-30: RESTART** (see the 2026-10-30 entry above).
 
 > **2026-10-29 (afternoon, attended) — v0.169.0 RELEASED and VOUCHED (14:06:09 CET).** `fc066de6…`, bundle `3ca33f9c…`,
 > from `637c92c`; `pinned.day0_agent` 0.169.0 (`db25eb0`). The agent's own closed operator-action list:

REPORT.md

@@ -1,36 +1,28 @@
-# REPORT — v0.170.0 released and vouched: „Reboot guest" from the hub (D65 = A, 2026-10-29 evening, attended)
+# REPORT — v0.171.0 released and vouched: a controller that runs but does not answer is restarted (R-1344, 2026-10-30, attended)
 
-**Plain words first.** The operator can now reboot a box's guest from the hub's host page, beside „Restart controller".
+**Plain words first.** The night's health log showed that a busy night (backups, dumps, updates) never makes the
-The agent does it (`pct reboot` of that guest — never the host). It refuses during a backup, a restore, an update or a
+controller miss even one health check — the slowest answer was 0.3 s against a 5 s limit. So the agent no longer only
-controller swap, more than once an hour, and under the restart brake. The result says when the guest and the controller
+alarms about a controller that runs but does not answer: 2 minutes after the alarm it restarts it, unless the
-were back. The controller that starts after the reboot tells the household for a day that Felhom support restarted
+controller is busy with a backup, a restore or an update, or the restart brake holds.
-the box.
 
 ## Commits
 
 | Commit | CI (job id) | What |
 |---|---|---|
-| `ca15a31` | 2520, 2524 green | `reboot_guest` in the closed list (`opreboot.go`): guards (provisioned, running, not locked, not parked; the heavy-operation gate held until the guest is up; `jobBlocker`; the controller's busy file, fresh ≤ 90 s, fail closed on any read error but „no file"; one per hour per guest, persisted; the restart brake counts it); `rebootInFlight` keeps the guest-power watchdog and the supervisor away; the result with both times; `GET /guest/operator-reboot` for the household line; one new read-only sudo vector (`cat` of the controller's busy file) + capability `controller-busy-read`. 19 mutants, each killed (one survivor found and fixed: a duplicate swap check). |
+| `bd18347` | 2532 green | `controllerUnresponsiveRestart` = 10 sweeps; `restartUnresponsive` (busy file, then the brake); the brake and the restart record shared with the not-running restart (`supervisorBrakeAllows`, `recordSupervisorRestart`); stanza `unresponsive_restart_after_s`, `unresponsive_restart_at`. Tests red first (build failure, then 3 behaviour failures); 7 mutants, one survivor (the count reset after a restart) pinned by a new assertion. |
-| `6578a8b` | 2525 green | v0.170.0 CHANGELOG heading; `pinned.day0_agent` = 0.170.0 (D50), after the vouch. |
+| `84726c9` | (read at the close-out) | v0.171.0 heading; `pinned.day0_agent` = 0.171.0. |
 
 ## Release
 
-- `release-agent.sh 0.170.0` from a clean clone of `ca15a31`: sha256 `da8d12a05ef607c338b9ba307e7a81b18253a3188721bbd8421ba36658a22404`,
+- `release-agent.sh 0.171.0` from a clean clone of `bd18347`: sha256 `c888ca7ba22a1f689059081575814a725e2edcecbb6bcc56829e9d9de88202a5`,
-  bundle `03f2ff6442fc3ca600b1f25f26767ce4da466a770a258f3e362cf95f6e76b543`, tag `v0.170.0`, verified by download.
+  bundle `95f977f6dc827185f2b5a2aa9e1c829db41a9f425d49eb40f317286d13c83d2b`, tag `v0.171.0`, verified by download.
-- configs/ changed, so per box a signed `agent_config_update` AND `agent_update` (Tester 1, demo-hp, demo-felhom): all
+- configs/ unchanged → one signed `agent_update` per box (Tester 1, demo-hp, demo-felhom): all COMPLETED and
-  six COMPLETED; each box „config bundle INSTALLED", capability probe 76/76 ok, „update committed".
+  „update committed" (10:12–10:20 CET); no new error lines.
-- Vouched by the operator 2026-10-29 18:57:48 CET (the save took 38.3 s — felhom.eu R-1346).
+- Vouched by the operator 2026-10-30 10:47:36 CET (the save took 132 ms — felhom.eu R-1346, hub 0.178.0).
 
-## Live proofs (Tester 1, through the hub endpoint the button posts, CC's `cc-hosts` token; controller 0.349.0-rc.1)
+## Live proof (Tester 1, controller 0.349.0)
 
-- **Refused during an off-site run:** `offsite_backup_now` pressed 18:03:36 UTC → the controller's busy file 11 s later →
+`docker kill --signal=SIGSTOP felhom-controller` 09:24:50 UTC → Docker „unhealthy" 09:26:36 → the agent's alarm
-  „Reboot guest" → „refused: the controller is busy — a backup, a restore or an off-site run is running"; the guest kept
+09:29:21 (6 sweeps) → „the controller does not answer — restarting the bootstrap unit" 09:31:22 (10 sweeps) → healthy
-  its 13 h uptime.
+09:31:24. The hub mailed `controller_unresponsive_restart` and `controller_unresponsive` (09:42:56, with the next report)
-- **The reboot:** pressed 18:05:08 UTC → „done — rebooted; the guest was up after 67 s, the controller answered after
+and not `controller_restarted_by_agent`. Evidence: felhom.eu `documentation/audits/release-2026-10-30/p1-r1344/`.
-  79 s", on the hub 88 s after the press. Box walk after: 10 containers, none unhealthy, 0 errors, login and file manager
-  200. The household dashboard: „A Felhom ügyfélszolgálata 19:05-kor újraindította a dobozt."
-- **A second press inside the hour:** „refused: guest 9201 was rebooted from the hub at 18:05 UTC — at most one reboot
-  per hour (next from 19:05 UTC)".
-- The release-build reboot: see felhom.eu `REPORT-release-2026-10-29c.md`.
-
-Evidence: felhom.eu `documentation/audits/release-2026-10-29c/`.

scripts/retention-policy.json

@@ -25,9 +25,9 @@
     "scripts/check-published-versions.py — asserts the newest N versions plus every pinned version"
   ],
   "recorded": "2026-10-29",
-  "recorded_by": "CC 2026-10-29: day0_agent 0.170.0 (operator vouch 2026-10-29 18:57:48 CET, read from the hub log: agent=0.170.0, bundle 03f2ff64… = the release; the save took 38.3 s, R-1346); earlier 0.169.0 (operator vouch 2026-10-29 14:06:09 CET, read from the hub log: agent=0.169.0, bundle 3ca33f9c… = the release; his browser got a 504 but the save went through); earlier 0.168.0 (vouch 10:21:56 CET); 0.167.0 (vouch 2026-10-27); 0.166.0 (vouch 2026-10-26 10:04:55 CET); D50 = A (operator 2026-10-25); earlier history: R-287 (2026-08-09), R-291 (2026-10-05)",
+  "recorded_by": "CC 2026-10-30: day0_agent 0.171.0 (operator vouch 2026-10-30 10:47:36 CET, read from the hub log: agent=0.171.0, bundle 95f977f6… = the release; the save took 132 ms with hub 0.178.0, R-1346); earlier 0.170.0 (operator vouch 2026-10-29 18:57:48 CET, read from the hub log: agent=0.170.0, bundle 03f2ff64… = the release; the save took 38.3 s, R-1346); earlier 0.169.0 (operator vouch 2026-10-29 14:06:09 CET, read from the hub log: agent=0.169.0, bundle 3ca33f9c… = the release; his browser got a 504 but the save went through); earlier 0.168.0 (vouch 10:21:56 CET); 0.167.0 (vouch 2026-10-27); 0.166.0 (vouch 2026-10-26 10:04:55 CET); D50 = A (operator 2026-10-25); earlier history: R-287 (2026-08-09), R-291 (2026-10-05)",
   "pinned": {
     "hub_min_agent": "0.158.1",
-    "day0_agent": "0.170.0"
+    "day0_agent": "0.171.0"
   }
 }