Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased

CHANGELOG.md

@@ -1,3 +1,20 @@
+## Unreleased — the second-drive copy can no longer outlive the controller (the stray-copy fix), 2026-10-22 night
+
+**MinAgent: 0.158.1** (unchanged). Committed, not released.
+
+- **The stray-copy fix (night brief 2026-10-23 Part 1).** The capped second-drive copy (R-1214, below) runs `rsync -a
+  --delete` in its own container; killing the `docker` CLI — the copy's 60-minute limit, a controller restart or a
+  self-update — did NOT stop it, so the copy went on deleting outside every guard the controller holds (R-1180). Now
+  every copy container has a fixed name (`felhom-tier2-copy-<app>-<8 hex of the destination>`) and the label
+  `felhom.tier2-copy=1` (+ `felhom.tier2-copy.app`); a leftover of the same copy is removed before a new one starts;
+  on any error, the timeout included, it is removed by name; at controller start, BEFORE the scheduler and the web
+  server, every labelled container is removed (each logged; on failure retried every minute). A restore is refused
+  while any second-drive copy runs, capped or in-process, or while a leftover may still run („Éppen fut a második
+  meghajtóra készülő mentési másolat…"). The same night's review also moved the capped copy to `--mount` (a path the
+  Docker daemon does not see is refused — exit 125, the in-process copy — instead of created empty, where `--delete`
+  would empty the copy) and to the controller's image ID with `--pull never`. Tests `TestStrayCopy_*` (backup, web,
+  wiring; Docker-free seams), each red-proved; 9202 proof in felhom.eu `audits/night-2026-10-23/P1-straycopy/`.
+
 ## Unreleased — the second-drive copy no longer squeezes the apps' memory (R-1214), 2026-10-22 night
 
 **MinAgent: 0.158.1** (unchanged). Committed, not released.