v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-05 07:13:02 +02:00
parent 69e914534f
commit 7861bf9dde
16 changed files with 607 additions and 36 deletions
@@ -1,3 +1,32 @@
+## v0.294.0 — the off-site clean-up deletes honest old copies; a first install survives the image clean-up; failed compose logs its reason; the move-aside line names its destination (R-867, R-863, R-864, R-869) (2026-10-05)
+
+**MinAgent: 0.131.0** (unchanged). No new household string.
+
+- **R-867.** The fake-snapshot guard's "young" line is now built from the SAME constants as the retention policy
+  (`keepDaily` 7 / `keepWeekly` 4 / `keepMonthly` 6 → `retentionPolicy`): a removal is refused only when its CALENDAR
+  day is fewer than `keepDaily` days before today (in the snapshot's own zone, as restic buckets it) and no newer
+  same-day snapshot of its group supersedes it. v0.289–0.293 used a fixed 8-day age, which sat inside the keep window:
+  the snapshot a keep-7-dailies policy drops each night is 7 days + seconds old, so every window on a box with more than
+  7 nightly snapshots refused, deleted nothing and mailed `offsite_prune_guard_refused` (measured demo-felhom
+  2026-10-05 02:15 UTC). Every other refusal is unchanged: future-dated, newer than the hub allows, a plan above the
+  week's cap (R-833's grant still raises it), the lab's 13-fake shape. Tests run restic 0.14.0's policy itself
+  (`restic0140Plan`, proven identical to the 0.14.0 binary over 92 snapshots): the measured shape, 60 nights × 3 apps
+  with two same-day manual runs across a month boundary, weekly windows, and a skew-window fake that the line still
+  refuses. Recorded limit: past-dated gap-fills that steer OLDER keeps stay R-822's residual (bounded by the cap and
+  the hub's count check), as before.
+- **R-863.** The image clean-up no longer runs while ANY compose command that can pull is running (`up`, `pull`,
+  `create`, `run` — install, update, restore, undo, the FileBrowser sync). New `dockerexec.BeginImageWork` /
+  `TryImageCleanup`: pulling commands hold a shared lock for their whole run; a clean-up pass takes it exclusively
+  without waiting and, when it cannot, does not run. The one-time clean-up writes its marker ONLY after a pass that ran
+  and is retried every 2 minutes (at most 30 times) instead of being skipped until the next start. Measured cause: on
+  the fresh Tester 1 box the one-time pass deleted `mariadb@sha256:…` (untagged, named by no container yet) one second
+  before `compose up` created BookStack's database container.
+- **R-864.** A failed compose command logs and returns the TAIL of stderr (new `tailStr`, rune-safe) — compose prints
+  pull progress first and the reason last; the head kept only "Image … Pulling".
+- **R-869.** The decision-78 move-aside log line now prints the destination the hub returned.
+- Tests: `TestOffsiteGuard_RealPolicy*`, `TestRetentionPolicy_BuiltFromTheGuardConstants`, `TestR863_*`, `TestR864_*`,
+  `TestR869_*`. Red-proofs (9): `felhom.eu/documentation/audits/night-fixes-2026-10-05/part{A,B,D}/`.
+
 ## v0.293.0 — the controller heals itself after the guest's Docker socket is re-created (R-860, generalises R-858) (2026-10-04)

 **MinAgent: 0.131.0** (unchanged). No new household string.