felhom-agent/REPORT.md

REPORT — storage lifecycle completion + acceptance sweep (agent half) → v0.36.7 (2026-06-15)

Type

Lifecycle fixes + a full live acceptance sweep (incl. a real HOST REBOOT) on the intermediary-mount foundation. Built + Linux-gated + deployed to felhom-pve per commit. Pairs with controller v0.68.1. Full audit: felhom.eu/documentation/audits/storage-lifecycle-acceptance-2026-06-15.md.

Shipped (agent), each green-gated + deployed

• v0.36.0 — guest boot-id on /disks. guest_boot_id = <host-btime>-<guest-init-starttime>: changes on every guest/host boot, stable across a controller-only restart. Lets the controller deterministically recreate drive-backed apps after a guest reboot (replaces a fragile container-uptime sample). Pure parser test + companion.
• v0.36.1 — decommission keeps the raw mounted. Decommission is now a LOGICAL retire (DetachDrive the bind under the parent; LEAVE the raw /mnt/<name> mounted), so one-click re-enroll re-binds the real drive. The old raw-unmount orphaned a non-removable drive (re-enroll bound an empty dir). Caught live in E10.
• v0.36.2 — eject also keeps the raw mounted (same fix, for the H1 disconnect→reconnect roundtrip).
• v0.36.3 — DetachDrive loop-umounts ALL stacked binds (full detach → fail-close intact).
• v0.36.4 — mutex serializes AttachDrive/DetachDrive (no TOCTOU double-bind race).
• v0.36.5 — AttachDrive normalizes to exactly one bind (countHostMounts).
• v0.36.6 — ROOT CAUSE of the double-bind: the shared-parent self-bind inherited /'s shared peer group, so every drive bind propagated back and DOUBLED. make-private (own group) BEFORE make-shared.
• v0.36.7 — isolate the parent only on CREATE (re-doing make-private/shared each reconcile churns the peer-group id and orphans the guest's slave → propagation silently dies).

Non-hollow tests + companions updated: decommission/eject keep the raw mounted (d.unmountCalls==0 + DetachDrive called); the boot-id parser; etc.

Acceptance sweep highlights (live)

• HOST REBOOT live-validated (×2): journalctl -b proves felhom-shared-parent FINISHED before pve-guests STARTED; the guest auto-started (onboot=1); both drives re-propagated; all 8 apps converged via the gate with no manual intervention; data intact.
• Fail-close capability-proof (guest-root + root-app writes DENIED, no leak), confinement (both drives), two-drive isolation, eject/decommission/re-enroll roundtrips, rapid eject/reconnect (single bind after the double-bind root-cause fix).

End state

Both external drives on the intermediary model, single bind each, propagation live, 25 containers healthy, felhom-flash default. agent v0.36.7 deployed (backups at /usr/local/bin/felhom-agent.bak-*).

Known residuals

• Pre-start hook vs an agent restart can race the parent-bind churn (exit 255) — resolved by the on-create-only isolation (parent no longer churned); operationally, don't restart the agent and reboot the guest in the same instant.
• "Safely removable" fs-flush before a physical pull is the separate "remove from system" action's job.