v0.278.0: a hold left by an earlier install no longer holds the new one (R-704)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/api/kept_install_test.go

@@ -3,12 +3,16 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"go/ast"
+	"go/parser"
+	"go/token"
 	"io"
 	"log"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -151,3 +155,135 @@ func TestR691_InstallChoiceNamesTheOffsiteCopy(t *testing.T) {
 		t.Fatal("something was installed")
 	}
 }
+
+// R-704 (v0.278.0) — a hold an EARLIER install left under the app's name is dropped when a new install
+// begins; the consequence measured on demo-hp was a fresh nextcloud whose backups skipped its volumes and
+// unit because of a 2026-09-13 update hold. Driven through the real „use my kept data" path (the off-site
+// copy, restic and the unit restore behind their seams — no Docker).
+// COMPANION RED-PROOF: remove the dropLeftoverHold call from keptDataAtInstall → the hold is still there
+// after the 202 and the first assertion fails; remove it from deployStack → the AST check fails.
+func TestR704_AFreshInstallDropsALeftoverHold(t *testing.T) {
+	dir := t.TempDir()
+	drive := filepath.Join(dir, "drive")
+	cfg := &config.Config{}
+	cfg.Paths.StacksDir = filepath.Join(dir, "stacks")
+	cfg.Paths.DataDir = filepath.Join(dir, "data")
+	cfg.Stacks.ComposeCommand = "docker compose"
+	app := filepath.Join(cfg.Paths.StacksDir, "cloudapp")
+	for _, d := range []string{app, filepath.Join(drive, "appdata/cloudapp"), cfg.Paths.DataDir} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_ = os.WriteFile(filepath.Join(app, "docker-compose.yml"), []byte("services:\n  cloudapp:\n    image: busybox:1\n    volumes:\n      - ${HDD_PATH}/appdata/cloudapp:/data\n"), 0o644)
+	_ = os.WriteFile(filepath.Join(app, ".felhom.yml"), []byte("display_name: Cloud App\n"), 0o644)
+	_ = os.WriteFile(filepath.Join(drive, "appdata/cloudapp/old.txt"), []byte("old"), 0o644)
+	m, err := stacks.NewManager(cfg, log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := m.ScanStacks(); err != nil {
+		t.Fatal(err)
+	}
+	sett, err := settings.Load(filepath.Join(cfg.Paths.DataDir, "settings.json"), log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = sett.SetOffboxTarget(&settings.OffboxTarget{Enabled: true, Host: "nas.local", Port: 22, User: "felhom",
+		RepoPath: "/srv/repo", Schedule: "daily", EscrowState: "escrowed"})
+	if err := sett.AddStoragePath(settings.StoragePath{Path: drive, Label: "HDD", Schedulable: true}); err != nil {
+		t.Fatal(err)
+	}
+	bm := backup.NewManager(cfg, sett, log.New(io.Discard, "", 0))
+	if err := bm.WriteOffboxSecrets("KEY", "nas.local ssh-ed25519 AAAA"); err != nil {
+		t.Fatal(err)
+	}
+	bm.SetOffboxFreeFn(func(string) int64 { return 100 << 30 })
+	unitPath := drive + "/backups/primary/cloudapp"
+	bm.SetOffboxRunner(func(_ context.Context, _ []string, args ...string) ([]byte, error) {
+		var target string
+		isRestore := false
+		for i, a := range args {
+			if a == "snapshots" {
+				return json.Marshal([]map[string]interface{}{{"short_id": "ab12cd34", "time": time.Now().Add(-time.Hour),
+					"tags": []string{"cloudapp"}, "paths": []string{unitPath}}})
+			}
+			if a == "restore" {
+				isRestore = true
+			}
+			if a == "--target" && i+1 < len(args) {
+				target = args[i+1]
+			}
+		}
+		if isRestore && target != "" {
+			u := filepath.Join(target, strings.TrimPrefix(unitPath, "/"))
+			_ = os.MkdirAll(filepath.Join(u, "compose"), 0o755)
+			_ = os.MkdirAll(filepath.Join(u, "db-dumps"), 0o755)
+			_ = os.WriteFile(filepath.Join(u, "db-dumps", "cloudapp.sql"), []byte("x"), 0o644)
+			_ = os.WriteFile(filepath.Join(u, "compose", "docker-compose.yml"), []byte("services:\n  cloudapp:\n    image: busybox:1\n"), 0o644)
+			_ = os.WriteFile(filepath.Join(u, "compose", "app.yaml"), []byte("env:\n  HDD_PATH: "+drive+"\n"), 0o600)
+			man, _ := json.Marshal(map[string]interface{}{"schema_version": 2, "app_name": "cloudapp", "db_dumps": []string{"cloudapp.sql"},
+				"data": map[string]interface{}{"at": time.Now().UTC().Format(time.RFC3339), "image_pins": []string{"busybox:1"}}})
+			_ = os.WriteFile(filepath.Join(u, "manifest.json"), man, 0o644)
+		}
+		return nil, nil
+	})
+	done := make(chan struct{}, 1)
+	bm.SetKeptUnitRestoreFn(func(app, unitDir string) (backup.UnitRestoreResult, error) {
+		done <- struct{}{}
+		return backup.UnitRestoreResult{}, nil
+	})
+	r := &Router{stackMgr: m, backupMgr: bm, sett: sett, logger: log.New(io.Discard, "", 0)}
+
+	// A leftover update hold from an earlier install (the demo-hp shape): the new install drops it.
+	_ = sett.SetRestoreHold(settings.RestoreHold{Stack: "cloudapp", At: "2026-09-13T19:56:32Z", Reason: settings.HoldReasonUpdateFailed})
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/api/stacks/cloudapp/deploy?lang=en", nil)
+	if !r.keptDataAtInstall(w, req, "cloudapp", drive, "use") || w.Code != http.StatusAccepted {
+		t.Fatalf("use: code %d body %s", w.Code, w.Body.String())
+	}
+	if h, held := sett.GetRestoreHold("cloudapp"); held {
+		t.Fatalf("the earlier install's hold survived the new install: %+v", h)
+	}
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Fatal("the load never reached the unit restore")
+	}
+
+	// A restore hold (R-379) is NEVER dropped by an install.
+	_ = sett.SetRestoreHold(settings.RestoreHold{Stack: "cloudapp", At: "2026-09-13T19:56:32Z", Reason: settings.HoldReasonRestoreFailed})
+	r.dropLeftoverHold("cloudapp", "install")
+	if _, held := sett.GetRestoreHold("cloudapp"); !held {
+		t.Fatal("an install dropped an R-379 restore hold")
+	}
+	_, _ = sett.ClearRestoreHold("cloudapp")
+
+	// The plain install path drops it too — before DeployStack (AST: the call precedes it in deployStack).
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "router.go", nil, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var dropAt, deployAt token.Pos
+	for _, d := range f.Decls {
+		fn, ok := d.(*ast.FuncDecl)
+		if !ok || fn.Name.Name != "deployStack" || fn.Body == nil {
+			continue
+		}
+		ast.Inspect(fn.Body, func(n ast.Node) bool {
+			if s, ok := n.(*ast.SelectorExpr); ok {
+				switch s.Sel.Name {
+				case "dropLeftoverHold":
+					dropAt = s.Pos()
+				case "DeployStack":
+					deployAt = s.Pos()
+				}
+			}
+			return true
+		})
+	}
+	if dropAt == token.NoPos || deployAt == token.NoPos || dropAt > deployAt {
+		t.Fatalf("deployStack must call dropLeftoverHold before DeployStack (drop=%v deploy=%v)", dropAt, deployAt)
+	}
+}