felhom-agent/REPORT.md

REPORT — v0.156.1: after a power cut the box clears up (R-1006, R-1008) (2026-10-14)

Evidence: felhom.eu documentation/audits/power-cut-fixes-2026-10-14/ — the spike (C1 the night's leftover, C2 a killed worker, C3 a real power cut, C4 a full disk), the 17 red-proofs.

What the spike showed

• A power cut mid-backup leaves vzdump-lxc-<vmid>-<date>.tar.dat + .tmp/ (root, in /var/lib/vz/dump); Proxmox never lists it as a backup; nothing removes it; every later backup is skipped „not enough space".
• The dead vzdump task stays in Proxmox's active list ~30–60 s after the boot — long enough for the agent's start-up pass to call it „genuinely in flight" (R-1008). Short, so R-1008's harm is small.
• A killed worker leaves tar/zstd writing into the .tar.dat for minutes, none named „vzdump" — the reason the root helper checks open files, not only process names.
• On „No space left" vzdump removes its own partial (both paths): the preflight's sizing stays. But a full host root breaks LVM's own metadata writes (a half-removed snapshot; the janitor cannot clear it — new row).

0.156.0 is superseded — do not vouch it

A background security review of the pushed 0.156.0 flagged „fail-open state drift": its in-flight rule compared a task's wall-clock start with the kernel's btime, which moves when the clock is corrected after the boot (an NTP step after a power cut) — a live backup could then look „from before the boot" and its lock be cleared. 0.156.1 uses Proxmox's own liveness rule instead (the UPID's pid + pstart against /proc/<pid>/stat start tick and state; no clock), and fails safe when this agent cannot see root's processes (PID 1 not visible).

What changed

See CHANGELOG.md v0.156.0: vzdumpInFlight behind the one BackupRunning; internal/vzpartial at start-up and before each backup; the root helper felhom-vzdump-partial-clean + one sudoers line + the bundle entry.

Gates

go build ./... && go vet clean; go test ./... -count=1 rc 0; agent_gates.py all OK; visudo -cf parsed OK; the config bundle tests (55) and the helper's tests (21) pass. 17 mutations, 17 red.

Next

Released: tag v0.156.0, binary sha256 8db22788…, bundle a2160521…, step bundle 0.156.0-step1 8be2bb8f…. Then the operator's vouch + floor, then the live proof on demo-hp (a cut mid-backup) and delivery to Tester 1 and the N100.