From 1b660102988d3b815ed85b90ed059536701bfa33 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 12 Aug 2026 14:05:45 +0200 Subject: [PATCH] REPORT: v0.212.0 orphan card second promise --- REPORT.md | 141 ++++++++++++++++++------------------------------------ 1 file changed, 47 insertions(+), 94 deletions(-) diff --git a/REPORT.md b/REPORT.md index 6d0ef75..07cd17f 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,113 +1,66 @@ -# REPORT — v0.211.0 built, baked and published; AWAITING THE DAY-0 VOUCH (2026-08-10) +# REPORT — v0.212.0: the orphan card's second promise (2026-08-12) -**Parts 1, 4b and 5 of the tester-visit task. Code is on `main` and CI-green, the image is published, -and golden 0.211.0 is baked and published. The ONE remaining step is the operator's Day-0 vouch — -until that is saved, a fresh install still receives 0.210.0.** +Commit `68f3e12`. Green gate: build/vet clean, **28 packages ok, 0 FAIL**; all ten controller gates OK. +Golden 0.212.0 baked and published; **the Day-0 vouch is the operator's and was not made here.** -Commits: `b762a37` (Part 1), `86a78c6` (Parts 4b + 5). CI runs confirmed by id: **296** and **297**, -both `success`. Green gate: `go build`/`go vet` clean, **28 packages ok, 0 FAIL**; all ten controller -gates OK. +## R-299 — the same claim, one paragraph up, in the plural ---- +`internal/web/templates/backups_remote.html` line 98 — the **always-visible** half of the orphan card — +still ended *„a hozzájuk tartozó helyreállítási kóddal később **visszaállíthatók lehetnek**"*. The +paragraph fixed in v0.211.0 renders only after the customer clicks „Új távoli mentés indítása…", so on +first view **the sentence a customer actually read was the one still promising.** -## What shipped +It survived for two independent reasons: -**R-280 — the drive can be re-attached after a reinstall.** `attach` now also carries the -controller's own mounted-but-unregistered filesystems (`internal/web/attach_sources.go`), read from -its own mount table. `initialize` is untouched, so the format wizard's system/backup protection is -unchanged. These candidates are REGISTERED in place (`POST /api/storage/register-mounted`, path -re-derived server-side and refused if not currently offered). The „két kattintás" sentence is -conditional on the picker being non-empty; the false branch says what is true and names a route. +1. `SPEC-orphan-card-copy-2026-08-10.md` §1 listed the line as *"Accurate; keep"* — corrected. +2. **The regression guard matched one inflection.** It asserted `visszaállítható lehet` (singular); the + card carried `visszaállíthatók lehetnek` (plural), which does not contain that substring. **A guard + matching one inflection of a Hungarian verb guards one sentence, not the claim.** -**R-294 — the orphan card stops promising restorability.** Copy replaced verbatim from -`SPEC-orphan-card-copy-2026-08-10.md` §4. +Guard now matches the stem `visszaállíthat`. The plain forms the rest of the UI uses („visszaállítás", +„visszaállítani") do not contain it, so it does not over-match. -**R-295 (controller half) — one name per secret.** „Visszaállító kód" retired; the dashboard code is -„Beállító kód" on both branches and in both operator-facing strings. Naming only. +**Shipped copy** (the two knowable halves kept — declining a promise must not become telling the +customer less than we know): -**Instrument fix.** `secret_in_markup_gate.py` no longer convicts Go template comments (stripped -before render); `` comments deliberately still convict. Proven both ways: passes the comment, -still convicts a planted `{{.RecoveryPassword}}`. +> A távoli tárhelyen lévő mentések egy korábbi, már nem elérhető kulccsal készültek (jellemzően +> újratelepítés után). Emiatt új mentés jelenleg nem írható a tárolóba. **A meglévő mentések nem +> sérültek. Azt viszont ez a gép nem tudja megállapítani, hogy később megnyithatók-e — ez attól függ, +> megvan-e még a hozzájuk tartozó kulcs. Ha szükséged van rájuk, írj nekünk.** ---- +Bytes verified as hex: `á/é/ő/ü/ú/í/ó` and `—` all correct, no double-encoding, no replacement chars. -## The Part 1 mechanism, corrected against live source +## Plant → convict → remove → pass -The prompt's mechanism is real but **mislocated**, and the fix it proposed would not have worked. +| step | result | +|---|---| +| plant the exact shipped plural | stem guard **FAILS**, quoting the sentence back | +| would the OLD narrow guard have caught it? | **No** — `"visszaállítható lehet" in plural` is `False`, shown as a pure string fact rather than a source grep (my first attempt at that check was contaminated by my own template comment) | +| remove the plant | 5/5 orphan-card tests pass | -- `handleDiskCandidates` is in **felhom-agent** (`internal/localapi/disks.go:425` → - `internal/storage/candidates.go:33`), not the controller. -- **Widening the agent's scan would have offered the wrong drive.** The filesystem a rebuilt box must - re-register is an IN-GUEST one — on demo-hp `/mnt/sys_drive`, the guest's own 70 GB data volume, - which is what the escape hatch registered. The agent enumerates HOST block devices and would have - offered the 1 TB NVMe (`/etc/pve/storage.cfg`: `dir: felhom-backup` → `/mnt/nvme-1tb`). -- Verified the controller container sees `/mnt/sys_drive` in its own `/proc/mounts` (`/mnt` is - bind-mounted in), so the source and the action agree. -- **Consequence for the session's shape:** no agent release. `agent_version` 0.128.0 and MinAgent - 0.127.0 are both unchanged. +Two branches of the gate are covered: card shown, and a healthy store seeing none of it. -**One deviation from the spec, stated:** the attach list is a **union**, not a replacement. A pure -replacement fixes the reinstall and breaks the case the wizard was built for — a fresh external drive -carrying a filesystem, not yet mounted, which a mount table cannot report precisely because it is not -mounted. +## Instrument defect fixed in the guard itself ---- +Its failure message sliced the rendered HTML at a **byte** offset, which cuts Hungarian mid-character +and printed a replacement char — a garbled failure message reads like an encoding bug in the product +rather than in the message. It now slices on rune boundaries. -## Red-proofs — every one failed against the mutated tree, mutation asserted applied +## Does the card read coherently as a whole? -| # | Mutation | Failure observed | -|---|---|---| -| 1 | attach reverted to the unclaimed scan | `attach candidates: 0, want 1 (/mnt/sys_drive) — got []` — **yesterday's exact wall** | -| 2 | `initialize` switched to the new source too | `/mnt/sys_drive` present in the FORMAT list; protection breaking in the open | -| 3 | `{{if .HasAttachDestination}}` removed | all three assertions; the false „két kattintás" promise returns | -| 4 | rootfs-alias guard disabled | `/mnt/rootcopy` offered as a data store | -| 5 | old orphan-card sentence restored | the restorability promise quoted back | -| 6 | `{{if .IsReset}}Visszaállító kód…` restored | reset branch shows the retired name | +**Mostly yes, with one thing I did not touch and one I introduced.** -**The Part 1 proof failed against today's tree** (red-proof 1) — that is the answer to the question -asked explicitly. +- **Not touched, and reportable: `layout.html:143`.** The abandon countdown says *"Addig még + visszaszerezheted őket a helyreállítási kóddal"* — the retired promise a third time and **un-hedged**. + It is probably TRUE where it renders (gated on an active abandon of a recovery offer that exists), + which is why I left it; but it renders on **every page**, and a rebuilt box can have an active + countdown while its store is orphaned. **Filed as R-301** with the wording question, not improvised. +- **Introduced: a repetition.** Once the customer clicks through, "we cannot determine / depends on the + key / write to us" appears in both the explanation and the confirm block. On first view — the common + case — only the explanation shows, and each is self-contained. I read this as reinforcement at the + decision point rather than a defect, and left it rather than churn customer copy. -Guard 4 was not in the spec. It was found while building the live reproduction: a bind mount -republishes a filesystem under a second path, so a bind of the guest rootfs under `/mnt/` would -have been offered as a data store. +## NOT DONE ---- - -## STOP 2 — the route used - -Neither of the two bad options. **The live store was not unregistered and no reinstall was needed.** A -fresh loop-backed ext4 filesystem was created on demo-hp's guest; loop devices turned out to be -unavailable in an unprivileged LXC, which is what surfaced guard 4. Artefacts cleaned up (verified: -directory gone, 0 matching mounts). The endpoint-level live check needs the new image and therefore -belongs after the bake. - ---- - -## NOT DONE — and none of it is "nearly done" - -- **The Day-0 vouch (STOP 3).** Not made, deliberately — it is the operator's. All three values are - verified fetchable AND selectable; see `felhom.eu/documentation/tests/golden-0.211.0-2026-08-10/`. - `golden_currency_gate` went from RED to GREEN with the bake. **No `--no-verify` anywhere.** -- **The Part 1 endpoint-level live check** — the image is published but was NOT deployed to a box in - this session, so the new picker has not been exercised through a live endpoint. Unit- and - render-proven only. -- **Part 2 (installer removal leaves dnsmasq)** — dropped first, per the task's own drop order. -- **Part 4a (hub half of the naming)** — dropped second. Filed as R-295 PARTIAL. -- **Part 3's "establish before changing"** — a fresh install was never watched taking a stale local - golden. The installer fix is pushed to `felhom.eu` `main`, which publishes nothing (R-110); the - `installer-v1.26.0` tag is deliberately NOT cut for that reason. - -## Observations, not acted on - -- **R-298** — `/storage`'s unregistered list is gated on `role==='user-data'` (`storage.html:363`), so - a drive that is also the backup target renders locked with no actions. This is the SECOND, - independent reason that page was empty on the rebuilt box; R-280's fix does not touch it. -- **R-296** — `backups_remote.html:98` makes the same unevaluable promise the spec calls "Accurate; - keep", in a conjugation the spec's own guard does not match. Left unchanged deliberately: not - improvising Hungarian at the customer. - -## Deliberately out of scope (so they do not read as forgotten) - -The CI runs that fail with no log; the twenty facts the machines report that nothing reads; the nine -claims still honestly grey; and proving that a *retained* key can actually open an old store — the one -thing the retention fix has never been shown to do. +- The Day-0 vouch (the operator's). +- No box was deployed to, so this is unit- and render-proven only, not exercised through a live endpoint.