controller v0.296.0 REPORT

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,18 +1,35 @@
-# REPORT — controller v0.295.0 (2026-10-05, afternoon): a box that is not always on
+# REPORT — controller v0.296.0 (2026-10-05, late afternoon): a cut-off backup run is said; honest "Mentés most" wording
 
-Brief: the 2026-10-05 catch-up brief (operator), Parts A and B. Full session report: `felhom.eu/REPORT-catchup-2026-10-05.md`.
+Brief: the 2026-10-05 hub-safety brief (operator), Part E (R-518, R-519). Full session report:
-Architecture: `felhom.eu/documentation/architecture/07-backup-architecture.md` §6.1.1 (new), `09` decisions 109–110, 112–114.
+`felhom.eu/REPORT-hub-safety-2026-10-05.md`. Architecture: `felhom.eu/documentation/architecture/07-backup-architecture.md`
+(the restore-record paragraph and the R-518 lane-1 note), `09` decision 123.
 
-| What | Proof |
+## Baseline and commits
-|---|---|
-| `internal/nightchain`: the night ledger + ONE catch-up 15 min after a start or a host resume, backup legs only (R-871) | 9 tests + 9 red-proofs; live on 9202 (twice) and demo-felhom |
-| `scheduler.DailyLateLimit`: a daily timer firing > 60 min late is skipped | test + red-proof |
-| the whole-guest cycle waits for a running catch-up (`quiesce.SetCatchUpFn`) and the catch-up waits for a quiesce | test + red-proof |
-| wiring (`catchUpLegs`, start + resume triggers, no update leg) | 2 tests + 2 red-proofs (one test strengthened after its first red-proof did not convict) |
-| the missed-backup banner (decision 110): rule, page, durable dismissal | 8 rule tests + 2 page tests; 7 red-proofs; served live on 9202 |
-| the household's timeline line `backup_catchup_done` | live: reached the hub from demo-felhom, no mail |
 
-Delivered: image `felhom-controller:0.295.0` (commit 635c33d); floor 0.295.0 (MinAgent 0.131.0) for demo-hp, demo-felhom,
+- Baseline `477e2548db` (v0.295.0). Commit `ff69074` → image `gitea.dooplex.hu/admin/felhom-controller:0.296.0`.
-tester-1 — all three run it; 9202 by hand. Golden 0.295.0 baked + vouched. `go test ./...` rc 0; `controller_gates.py`
+- **MinAgent 0.131.0** (unchanged). Golden 0.296.0 baked + vouched (`felhom.eu/documentation/tests/golden-0.296.0-2026-10-05/`).
-OK (after registering six new Go-side keys as "born as a key"). Red-proofs: `felhom.eu/documentation/audits/
+- Delivered by per-customer floors (demo-hp, demo-felhom, tester-1 at 0.296.0): both demo boxes ran 0.296.0 (healthy)
-catchup-2026-10-05/part{A,B}/red-proofs.txt`. Found: R-878 (P4, a daytime catch-up stops a volume app ~1 s for its dump).
+  ~30 min later.
+
+## What changed
+
+- **R-519.** `internal/backup/run_record.go`: the app-data run is on record (`appdata-run.json`) while it runs; a start
+  that finds it running turns it into a notice on /backups and /backups/apps, kept until a run ends with every step OK.
+  After a restart the synthesised "last database backup" no longer reads OK over a cut run. Restore points were already
+  dated by their OLDEST part (v0.275.0). Wired in `main()` (`loadRunRecordAtStartup`, AST-pinned).
+- **R-518.** The whole-system "Mentés most" text and confirm now state two measurements: ≈6 min / 9 apps (demo-hp
+  today: 09:19:08Z → last app back 09:24:55Z, local tier only) and ≈8 min / 12 apps (2026-09-14); "minutes, not seconds";
+  longer when the off-site copy runs in the same run.
+
+## Tests
+
+`go build/vet/test ./...` green; controller gates green (golden-notice advisory before the bake). New: `TestRunRecord_*`
+(3, incl. the production path through `runDBDumpsInternal`), `TestRunRecordAtStartup_FindsACutRun`,
+`TestMainWiresRunRecord`, `TestR518_*` (both measurements, both pages and confirm), parity cases
+`backups_interrupted_run`, `backups_apps_interrupted_run`; six parity fixtures re-captured for the changed copy (only the
+copy lines differ). Red-proofs (4, all convict): `felhom.eu/documentation/audits/hub-safety-2026-10-05/partE/red-proof.txt`.
+
+## NOT yet live-validated
+
+- **The live cut on 9202** (restart the controller in the middle of a backup run, then read the page): the permission
+  check refused restarting the controller mid-backup. The operator is asked; R-519 stays narrowed until then.