v0.347.0 RELEASED (the global floor, MinAgent 0.158.1): CHANGELOG heading, CONTEXT, REPORT

CHANGELOG.md

@@ -1,4 +1,4 @@
-## v0.347.0 (2026-10-29) — D62: restore copies kept 30 days, listed, deletable by hand; R-1256: four restore edges, all proven live (D63); R-1254 controller half; R-528: the host's OOM count; an unknown app is a 404 — built from the commit carrying this heading; rc.1 = `e3fce09` on scratch 9202
+## v0.347.0 (2026-10-29) — D62: restore copies kept 30 days, listed, deletable by hand; R-1256: four restore edges, all proven live (D63); R-1254 controller half; R-528: the host's OOM count; an unknown app is a 404 — RELEASED (image `sha256:c79b06e6…`, from `fd75c7c`, CI 2491; rc.1 = `e3fce09` on scratch 9202); per-box floors 09:57 CET, global floor 2026-10-29 10:31 CET on the operator's yes (MinAgent 0.158.1)
 
 ### 2026-10-29 (attended) — D62 and D63
 

CONTEXT.md

@@ -1,5 +1,13 @@
 # CONTEXT.md — Project Memory
 
+> **2026-10-29 (attended release run) — v0.347.0 RELEASED, the global floor (MinAgent 0.158.1).** Image `sha256:c79b06e6…`
+> from `fd75c7c` (CI 2491); rc.1 = `e3fce09` on scratch 9202. Carries the night's R-1256 (all four edges, H4 + H5's
+> failed stop proven live on Tester 1 with a `-tags faultinject` test build — D63), R-1254 controller half, R-528, the
+> unknown-app 404, and D62 (restore copies 30 days; „Törlés most" in the kept-copies list; `restore_copy_deleted` needs hub
+> ≥ 0.175.0). The fault switch (`cmd/controller/faultpoint_{on,off}.go`) is a no-op in every build without the tag
+> (`TestD63_TheReleaseBuildHasNoFaultSwitch`). Next here: R-1340 (the mixed-hold operator mail), R-1341 (the OOM WARN every
+> 30 s), R-1339 (the false „not mounted" line).
+
 > **2026-10-28 night (unattended) — R-1256, R-1254 (controller half), R-528 and the unknown-app 404 on `main`, NOT
 > released (`342a394`, `e33cffa`, `eed23e7`, `20c5877`; MinAgent unchanged).** Restore ops begin through
 > `Manager.TryBeginRestoreOp` / `web.beginRestoreOp` only (`TestR1256_H6_NoHandlerBeginsARestoreUnchecked` refuses a direct

REPORT.md

@@ -1,39 +1,44 @@
-# REPORT — restore edges, the escrow timeout, the host OOM count: on main, NOT released (night 2026-10-28 → 29, unattended)
+# REPORT — v0.347.0 released as the global floor; D62 built and proven; R-1256's last two branches proven live (2026-10-29, attended)
 
-**Plain words first.** Four commits are on main, each with CI green and each new test seen failing first. Nothing is
+**Plain words first.** The controller 0.347.0 is the floor for every box since 10:31 CET. It carries the night's restore
-released: the night brief allowed no release. The controller release goes on the morning list. It needs no new MinAgent:
+edges, the escrow wait, the host's OOM count and the 404 fix, plus D62: a restore copy nobody needs stays 30 days, and the
-with an older agent the OOM count answers 404 and the controller waits 10 minutes before it asks again.
+household sees it in the kept-copies list and can delete it with „Törlés most". D63 held: the two restore branches that
-
+had only tests were proven live on Tester 1, so nothing was reverted.
-**Decided by CC unattended — operator may reverse:** an unused restore copy goes after 14 days (options: 14 days, for
-ever, 3 days; `07` §6.3 [DESIGN] 2026-10-28). H4 and H5's failed-stop branch keep only test proofs; their live proof is
-owed to an attended session (or revert those two branches of `342a394`).
 
 ## Commits
 
 | Commit | CI (run id / #) | What |
 |---|---|---|
-| `342a394` | 2469 / #532 green | **R-1256** four restore edges. H4: an off-site restore whose definition write fails writes the LIVE definition back before the start; a failed write-back holds the app. H5: a put-back whose stop fails pours nothing, keeps the copy, holds the app; a failed definition write-back keeps the copy (D20); a `volume rm -f` that fails fails that volume (no merge on top of the old content). H6: a restore begins in ONE step with the check for a restore, the backup run and a second-drive copy (`TryBeginRestoreOp`); every restore button and both kept loads begin that way. H8: `SweepUnusedRestoreCopies`, every 6 h. |
+| `e3fce09` | 2486 / #537 green | **D62** — `restoreCopyUnusedAge` 30 days; `backup.RestoreCopies` / `DeleteRestoreCopy` (check + removal under `m.mu`, path guard); the list rows and the typed-name form (`POST /backup/restore-copy/delete`, JSON 200/400/404/409/500); `restore_copy_deleted` event. **D63** — `faultPoint` (test builds only, `-tags faultinject`). Tests `TestD62_*`, `TestD63_*`, each seen failing by a mutation. |
-| `e33cffa` | 2472 / #533 green | **R-1254** controller half: escrow claim/confirm wait 60 s (the agent's own upload wait is longer than the old 15 s); an unknown outcome is 504 `api.escrow.confirm_store_unknown` („keep both codes"), hu + en. |
+| `fd75c7c` | 2491 / #538 green | the v0.347.0 CHANGELOG heading — the release build's commit. |
-| `eed23e7` | 2474 / #534 green | **R-528**: the 30-s OOM scan also reads the host's per-container `oom_kill` (agent `GET /guest/oom-kills`); a counted kill raises `app_oom` whatever Docker's flag says; `source` in the details. |
-| `20c5877` | 2475 / #535 green | An action on a name that is no app answers 404, not „settings cannot be saved" (found walking the capability map). |
 
-Red-proofs: felhom.eu `documentation/audits/night-2026-10-28/redproofs/README.md`.
+## Release
 
-## Live proof (test build `0.347.0-rc.n1028`, local tag only, never pushed)
+- rc.1 (`e3fce09`, digest `b6640c0a…`) on scratch 9202: walk green.
+- 0.347.0 (`sha256:c79b06e6…`, from `fd75c7c`): per-box floors for Tester 1, demo-hp, demo-felhom at 09:57 CET — all three
+  moved within a minute; walk green on all three (controller healthy, every container up, 0 refusals, 0 errors, login and
+  file manager 200, https-only OK); one local restore on Tester 1 (2/2 volumes, the app ran, no hold); the OOM line (one
+  `app_oom`, one mail); global floor 10:31 CET, MinAgent 0.158.1, read back from the hub page and its log.
+- The release image carries no fault switch (`grep -c "FAULT INJECTED"` = 0; 2 on the test image).
 
-- **H5, scratch 9202:** vikunja's first volume held by a created-only container, the household's restore pressed through
+## Live proofs (Tester 1; felhom.eu `documentation/audits/d63-2026-10-29/`)
-  the page: „Failed to remove volume vikunja_vikunja_data before the restore … (not written into)", the restore failed,
-  the put-back poured the live copy of both volumes, the app ran, no hold; a project from before the restore point AND
-  one from after it read back.
-- **H8, scratch 9202:** three copies planted by hand (2026-10-01, 2026-10-05, 2026-10-28); the first sweep at 03:29 UTC
-  removed the two older than 14 days and kept the young one (8 ms). The young one was then removed by hand.
-- **R-528, Tester 1:** one `app_oom` „seen by docker,cgroup", one mail with `"source":"docker,cgroup"`.
-- **Not live:** H4 (off-site only; 9202 has no off-site target), H5's failed stop and crash put-back, H6 (the old
-  code also refused at the early check, so a live press cannot tell the two apart). Tests only.
 
-Both boxes put back after. **Scratch 9202** (2026-10-29 04:14 UTC): controller 0.346.1 healthy, the test image removed, the
+- **H4** (test build): the snapshot held 3.8.1, the app ran the true 3.8.0; the fault failed the definition write after
-live catalog (config byte-identical to the saved copy), no throwaway app, no planted restore copy, no volume made
+  the compose was written; „the live definition is written back before the start", then the start; the app ran 3.8.0, no
-tonight. **Tester 1** (2026-10-28 23:30 UTC): controller 0.346.1, agent 0.167.0 (sha256 `28bdd282…`), the test app
+  hold, both seeded events read back.
-removed. The bench is stopped. Hub: nothing provisioned.
+- **H5's failed stop** (test build): a busy volume was not written into; the put-back's stop failed; nothing was put back,
+  the copy stayed, the app was held with the D20 sentence; the held copy's „Törlés most" was off with its reason.
+- **D62** (test build, then the release build with hub 0.175.0): the copy listed with its date and „automatikusan
+  törlődik"; a wrong name 400; the right name 200; gone; the hub stored `restore_copy_deleted`.
 
-Evidence: felhom.eu `documentation/audits/night-2026-10-28/` (`r1256-restore/`, `r528-oom/`).
+## Teardown
+
+Tester 1: throwaway Radicale and Gokapi removed through the product; the 21 empty anonymous volumes this session's backup
+presses left (R-1267's PrivateBin class) removed by name — 268 volumes, as before; controller 0.347.0 (the release).
+**Radicale's restore hold record stays — clearing it is the operator's.** Scratch 9202: controller 0.347.0 (from rc.1),
+359 volumes as before. Hub: nothing provisioned.
+
+## Rows
+
+Filed: felhom.eu R-1340 (the mixed-hold operator mail tells the option-C story for any cause), R-1341 (the OOM WARN every
+30 s). Closed by this release: R-1256, R-528 (with the agent).