REPORT + CONTEXT: v0.270.0 (floor 0.270.0, both demo boxes arrived)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -7,7 +7,14 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-09-24 night (v0.269.1 — the whole restore from the second drive, the unhealthy stop, digests)
+Last updated: 2026-09-24 evening (v0.270.0 — R-679, R-681, R-669, R-674; floor 0.270.0)
+
+> **2026-09-24 evening — v0.270.0, floor 0.270.0.** `UpdatePreflight` refuses `already_current` (R-679).
+> `stacks/install_interrupted.go`: `.felhom-install-pending` marker + `RecoverInterruptedInstalls` at start (after the
+> deploy-done hook) → compose down, stale pins cleared, `app_deploy_failed`, `.felhom-install-interrupted` → the
+> apps page sentence (R-681). The recovery unit captures `stacks.AppliedMetaFile`; a restore calls
+> `RecordRestoredAppliedMeta` (R-669). Next: part 7 (the update leg, `09` §6.4.2), R-678, R-680, R-682.
+
 
 > **2026-09-24 night — v0.269.0 + v0.269.1. Fleet floor 0.269.1 (MinAgent 0.131.0; needs hub v0.123.0).**
 > `backup.RestoreTier2Whole` (`tier2_whole.go`, decision 26): `mergeRestoreFiles` by the four file rules

REPORT.md

@@ -1,31 +1,28 @@
-# REPORT — controller v0.269.0 + v0.269.1 (2026-09-24 night shift, run in daytime)
+# REPORT — controller v0.270.0 (2026-09-24 evening, Part D of the R-672 brief)
 
-Full record: `felhom.eu/documentation/audits/DRILL-night-2026-09-24.md` (evidence under `night-2026-09-24/`).
-Architecture read: `09` §3 decisions 11–30, §6.4; `07` (the whole-copy table); `08` §6.2.
+Full record: `felhom.eu/documentation/audits/r672-2026-09-24/README.md`. Architecture read: `09` §3/§6.4, `07`.
 
-## Shipped
-- **v0.269.0** (`3c6b49b`): the second drive's whole restore for a file app (decision 26, R-661); the same-disk
-  check fails closed (R-668); keep-data-only Remove while support is informed (decision 27, R-666); the box stops a
-  crash loop / OOM storm, Start = one more try (decision 28, R-667, threshold decision 29); each step judged by its
-  own `.felhom.yml` (R-664, R-665); R-662 removed; digests rendered + the badge from the tested digest (§6.4 part 6).
-- **v0.269.1** (`5b1b191`): `CarryDigests` — an installed app keeps its digest until a guarded Update (decision 30).
-  Found live in Part B; a second release in the session, on purpose.
-- MinAgent 0.131.0 (unchanged). Needs hub v0.123.0. **Floor 0.269.1** set with the declared MinAgent; N100
-  arrived (~16 s); demo-hp 9201 did not (read-only disks, R-672 — operator).
+## Shipped — floor 0.270.0 (MinAgent 0.131.0), both demo boxes arrived in ~12 s
+- **R-679:** an Update on an app already at the head → `409 already_current` (hu + en) before anything moves.
+- **R-681:** an install cut off by a controller restart is finished through the failure path and reported
+  (`app_deploy_failed`, the apps page sentence, what it started removed, stale pin records cleared).
+- **R-669:** the recovery unit keeps the PINNED version's `.felhom.yml`; a restore makes it the applied record.
+- **R-674:** the ladder log says "AT THE HEAD" for a pin at the head.
 
-## Red-proofs (each seen failing, then passing; files in `night-2026-09-24/redproofs/`)
-A1 file rules (three mutations: no newer-check → the newer copy overwritten; no keep-beside → the older copy gone;
-no bring-back → the missing file not restored), R-668 (fail-open → the removed folder chosen), R-666 (the guard
-removed → data deleted), decision 28 detector (the old clock → never trips) and its skips (a held/updating app
-judged), hub routing, R-664 catalog gate + R-665 (the stack dir's file judged), digests (`B-digests.txt`), and
-v0.269.1's carry (`B-sync-carry.txt`: "the sync MOVED the running digest").
+## Red-proofs (each seen failing, then passing; `…/r672-2026-09-24/redproofs/D-*`)
+D1 R-679 check removed → "an app at the head was allowed to update"; D2 head branch removed → "the head was called
+older than the ladder"; D3 restore not resetting applied-meta → "the next undo would judge with the failed step's
+probe", and the unit capturing the stack dir's file → "the unit carries the failing step's probe"; D4 recovery a
+no-op → "an interrupted install was not reported"; D5 page line removed → "the apps page is silent about an
+interrupted install". Full suite green; gates OK; one new parity fixture (`stacks_install_interrupted`), no
+existing fixture changed.
 
-## Live (9202, endpoint level — no browser on DooPlex)
-Whole restore: restored 1 / kept-newer 1 / unchanged 137, 3/3 volumes + 1/1 db, 38 s, account + files read
-back; again from a hold naming the second drive; again in chaos rounds 3 (power cut) and 11 (disk + 1 GB).
-Keep-data-only: 409 hu/en. Unhealthy stop: gokapi trip 1 → Start → trip 2 („support informed"), chaos rounds 1,
-7, 8, 12. Digests: a floating tag's newer tested digest → badge → Update pulled it; on v0.269.1 the sync left the
-running file alone. Full suite `go test ./...` rc=0 and `controller_gates.py` OK before each commit.
+## Live on 9202 (endpoint level; no browser on DooPlex)
+R-679: privatebin at the head → 409 in both languages, no backup, no pull. R-681: mealie killed during its pull →
+"INTERRUPTED … reporting it", `app_deploy_failed` (dropped — 9202 has no hub), page sentence hu + en, no container
+left; reinstall cleared it; actualbudget killed after its install finished → left alone. R-669: the unit captured
+after the sync wrote a bad probe kept the good one; a second-drive restore turned stack 8999 / applied 3000 into
+3000 / 3000. R-674: no product path (R-679 refuses that case first) — unit test only.
 
-## Found (rows)
-R-669, R-670, R-671, R-674, R-675, R-677, R-678, R-679, R-680, R-681, R-682, R-683 (controller); R-676 (watch).
+## Changed
+A test comment called a same-version Update "the repair path"; R-679 removes that path. Restart is the repair path.