controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

R-650: internal/dockerexec — every docker exec routed through it; under
go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub
under the temp dir is allowed). api/stacks/web tests run under a silent
stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide.
R-640: a dump without its engine's completion marker is refused before
the first mutation (unit + off-site restore) and again before any load.
R-499: the Tier-2 page's system-disk sentence has four true branches.
R-518: the backup button states the measured ~8 min stop.
R-626: measured on 9202, not reproduced.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,37 +1,43 @@
-# ADDENDUM — v0.266.0: a failed install removes what it started (R-649, operator ruling, 2026-09-23)
+# REPORT — controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true (2026-09-23)
 
-`964ae75`. MinAgent 0.131.0. `compose down` (volumes kept) on the deploy's failure branch. Red-proof seen
-failing; live on 9202: 0 containers left, volumes kept. Floor 0.266.0. Evidence:
-`felhom.eu/documentation/audits/r649-2026-09-23/`.
-
----
-
-# REPORT — controller v0.265.0: R-634's cause fixed, held apps say so, the OOM storm (2026-09-23)
-
-R-634, R-625, R-636, R-647. Commit `0054d4b`. MinAgent 0.131.0 (unchanged). Needs hub v0.121.0 (deployed
-first). **Floor raised to 0.265.0.** Full report, the brief's wrong claims, evidence:
-`felhom.eu/REPORT.md`, `felhom.eu/documentation/audits/cleanup-2026-09-23/`.
+Night shift 2026-09-23, Part A. R-650, R-640, R-499, R-518; R-626 measured. MinAgent 0.131.0 (unchanged).
+No hub change. Full night record: `felhom.eu/documentation/audits/DRILL-night-2026-09-23.md`; evidence
+`felhom.eu/documentation/audits/night-2026-09-23/A*`.
 
 ## Not done, or changed
-- R-634: the backup race is fixed; the deploy's OWN failure leaving containers is an operator question → R-649.
-- R-625: the Update button was already hidden on the list; the fix is the badge (both hold kinds).
-- R-636: the flag cannot count (sticky) — the kernel `oom_kill` counter is read instead.
-- My first test draft ran real docker on DooPlex (an empty volume) — removed; tests use seams; R-650.
+- **R-518:** the brief said the page promises „csak néhány másodpercre". It does not — v0.243.0 removed
+  that. The remaining vague „általában néhány perc" is replaced by the measured ~8 minutes.
+- **R-626:** not reproduced, so not "fixed" — closed by measurement (below).
+- R-640's "narrowed" scope held: the undo copies folders; only the three restore paths load dumps.
 
 ## What shipped
-- **R-634:** deploying apps leave `ListDeployedStacks`; the volume leg re-asks (`deployingReporter`) and
-  SKIPs; `StopStack`/`StartStack` → `ErrStackDeploying`.
-- **R-625:** badge `badge.update.held` „Megállítva — visszaállítás szükséges" / "Stopped — restore needed".
-- **R-636:** `ScanOOMKilled` reads `oom_kill`/`memory.max`/`memory.peak`; ≥20 kills in 30 min per container
-  run → one `app_oom_storm` (error, operator-only).
-- **R-647:** `readerFuncs` (every language) + `UpdateErrorKeyHeld`; `copy_holds` as a key; two log wordings.
+- **R-650:** `internal/dockerexec` (`Command`/`CommandContext`/`RunWithStub`). 77 docker exec sites routed
+  through it. The sweep (trace of the guard's refusals, `A1-r650-sweep.txt`): `web` 67× `docker compose
+  version`, 19× `docker ps`, 19× `docker info`, 10× `docker inspect felhom-samba`, 2× `docker exec
+  felhom-samba`; `backup` 46× `docker ps`; `stacks` 11× `compose ps`, 4× `docker ps`, **1× `docker-compose
+  down`**; `appexport` 7× `docker ps`; `system` 1× `docker info`; 8 `api` tests FAILED on the refusal
+  (they built a real Manager). `api`/`stacks`/`web` → `TestMain` + `RunWithStub`; the rest pass on the refusal.
+- **R-640:** `appbackup.CheckDumpComplete`; `incompleteDumps` gate in `RestoreFromRecoveryUnit` and
+  `ReconstituteFromOffsite` before the first mutation; a second check in `reimportDBDumpsFrom` before any
+  load. Test fixtures' fake dumps now end with the real markers (they did not — 38 tests red first).
+- **R-499:** `systemBackupFact(resolveBackupTargetState)` → four branches on the Tier-2 page.
+- **R-518:** two bundle strings, both languages, state the measured stop.
 
-## Red-proofs (8 here, each seen failing)
-Backup skip; StopStack guard; held badge (v0.264.0 shape); reader funcs; copy_holds phrase; health
-severity; storm escalation; counter read. Messages in `felhom.eu/REPORT.md` §3.
+## Red-proofs (8, each seen failing, then restored; `git diff` clean on the reverted file)
+1. R-650 guard disabled → `TestR650_RealDockerIsRefusedUnderGoTest`: `got <nil>`.
+2. R-650 one bare `exec.CommandContext(ctx, "docker"…)` put back in dbdump.go → the sweep names `dbdump.go:140`.
+3. R-640 replay check removed → `a cut-off copy was LOADED`.
+4. R-640 unit gate removed → `stopped=true calls=[stop recreate startsvc:immich-postgres start]`.
+5. R-640 off-site gate removed → the replay check still caught it, then a rollback — not the clean refusal.
+6. R-499 handler not passing the fact → three branches missing on the page.
+7. R-499 old sentence in the same-disk branch → `promises the backup protects this app`.
+8. R-518 bundles back to v0.243.0 → measured downtime appears 0 times, old wording present.
 
-## Live (9202)
-R-634 race run across a live deploy — the backup stopped three other apps and never the deploying one;
-held badge + no button + 409 in all four box/reader language pairs; RomM storm at 21 kills, one line at 49.
+## R-626, measured on 9202 (v0.266.0)
+navidrome deployed and removed through the product; `docker events` for its compose project 390 s:
+kill/stop/die/destroy seen (the positive observable), **no create**. Controller restarted at +150 s;
+guest rebooted after. 0 containers, 0 volumes at every check. Leftover: `applied-compose.yml` +
+`applied-meta/` stay in the stack dir after a remove (row filed).
 
-`go test ./...` rc=0; `controller_gates.py` rc=0.
+## Gates
+`go build/vet` rc 0; `go test -count=1 ./...` rc 0; `controller_gates.py` all OK (golden-notice advisory).