46 lines
3.1 KiB
Markdown
46 lines
3.1 KiB
Markdown
# REPORT — storage lifecycle completion + acceptance sweep (agent half) → v0.36.7 (2026-06-15)
|
||
|
||
## Type
|
||
Lifecycle fixes + a full live acceptance sweep (incl. a real HOST REBOOT) on the intermediary-mount
|
||
foundation. Built + Linux-gated + deployed to felhom-pve per commit. Pairs with controller v0.68.1. Full
|
||
audit: `felhom.eu/documentation/audits/storage-lifecycle-acceptance-2026-06-15.md`.
|
||
|
||
## Shipped (agent), each green-gated + deployed
|
||
- **v0.36.0 — guest boot-id on /disks.** `guest_boot_id` = `<host-btime>-<guest-init-starttime>`: changes
|
||
on every guest/host boot, stable across a controller-only restart. Lets the controller deterministically
|
||
recreate drive-backed apps after a guest reboot (replaces a fragile container-uptime sample). Pure parser
|
||
test + companion.
|
||
- **v0.36.1 — decommission keeps the raw mounted.** Decommission is now a LOGICAL retire (DetachDrive the
|
||
bind under the parent; LEAVE the raw `/mnt/<name>` mounted), so one-click re-enroll re-binds the real
|
||
drive. The old raw-unmount orphaned a non-removable drive (re-enroll bound an empty dir). **Caught live
|
||
in E10.**
|
||
- **v0.36.2 — eject also keeps the raw mounted** (same fix, for the H1 disconnect→reconnect roundtrip).
|
||
- **v0.36.3 — DetachDrive loop-umounts** ALL stacked binds (full detach → fail-close intact).
|
||
- **v0.36.4 — mutex** serializes AttachDrive/DetachDrive (no TOCTOU double-bind race).
|
||
- **v0.36.5 — AttachDrive normalizes to exactly one bind** (`countHostMounts`).
|
||
- **v0.36.6 — ROOT CAUSE of the double-bind:** the shared-parent self-bind inherited `/`'s shared peer
|
||
group, so every drive bind propagated back and DOUBLED. `make-private` (own group) BEFORE `make-shared`.
|
||
- **v0.36.7 — isolate the parent only on CREATE** (re-doing make-private/shared each reconcile churns the
|
||
peer-group id and orphans the guest's slave → propagation silently dies).
|
||
|
||
Non-hollow tests + companions updated: decommission/eject keep the raw mounted (`d.unmountCalls==0` +
|
||
DetachDrive called); the boot-id parser; etc.
|
||
|
||
## Acceptance sweep highlights (live)
|
||
- **HOST REBOOT live-validated (×2):** `journalctl -b` proves felhom-shared-parent FINISHED before
|
||
pve-guests STARTED; the guest auto-started (onboot=1); both drives re-propagated; all 8 apps converged
|
||
via the gate with no manual intervention; data intact.
|
||
- Fail-close capability-proof (guest-root + root-app writes DENIED, no leak), confinement (both drives),
|
||
two-drive isolation, eject/decommission/re-enroll roundtrips, rapid eject/reconnect (single bind after
|
||
the double-bind root-cause fix).
|
||
|
||
## End state
|
||
Both external drives on the intermediary model, **single bind each**, propagation live, **25 containers
|
||
healthy**, felhom-flash default. agent v0.36.7 deployed (backups at /usr/local/bin/felhom-agent.bak-*).
|
||
|
||
## Known residuals
|
||
- Pre-start hook vs an agent restart can race the parent-bind churn (exit 255) — resolved by the
|
||
on-create-only isolation (parent no longer churned); operationally, don't restart the agent and reboot
|
||
the guest in the same instant.
|
||
- "Safely removable" fs-flush before a physical pull is the separate "remove from system" action's job.
|