v0.263.0: a failed update puts the app back by itself (09 decision 15, R-637)

The guarded update gains a folder copy of the app's named volumes, taken
after the pull where the app stops anyway (decision 19, chosen by the
2026-09-23 bake-off). On a failed health check the box undoes: every copy
validated by its finished-marker first, volumes refilled, definition and pin
from the job's own pre-update copies, the old version checked with the OLD
.felhom.yml probe. It holds only if the undo fails, and the hold sentence
says so and what state the data is in. Bind-mounted folders are never
touched.

- R-637 built; R-638/R-640/R-641 do not arise with a folder copy; R-639
  (pre-update copies incl. .felhom.yml kept until the undo is over).
- journal phases copying/undoing with power-cut recovery.
- app.yaml last_update_undone + one line on the app page (hu/en).
- R-642: start/restart never answer "completed".
- Removal deletes kept undo copies.

MinAgent unchanged (0.131.0). Nine red-proofs in REPORT.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,39 @@
+## v0.263.0 — a failed update puts the app back by itself (2026-09-23, R-637)
+
+**MinAgent: 0.131.0** (unchanged). New strings, all born as bundle keys (hu + en): `app_info.update_undone`,
+`err.stacks.update_undo_copy_failed`, `err.stacks.update_undo_space`, `hold.update.undo_failed`,
+`hold.update.undo_state.{untouched,half,not_started}`, `update.phase.{copying,undoing,undone}`.
+
+**`09` §3 decision 15, built.** Until now a failed health check after an update stopped the app and
+held it, and the household's only way back was a restore. Now the box UNDOES it: the previous version
+and its data exactly as they were seconds before the update, checked with the previous version's own
+probe. It holds only when that undo fails too — and the hold then says so, and what state the data is
+in. This protects the manual Update button today and the automatic one later.
+
+**How (decision 19, chosen by a bake-off — `felhom.eu/documentation/audits/undo-bakeoff-2026-09-23/`).**
+A new phase `copying` between the pull and `up`: the app stops (it stops there anyway to be
+recreated), each named volume is copied `cp -a` into `<volume>.pre-update-<stamp>` by an `alpine`
+helper that writes a finished-marker last, and the new version starts. On failure: `undoing` — every
+copy validated before anything is put back, volumes refilled, definition and pin restored from the
+job's OWN pre-update copies (R-639 — the recovery unit is never read: measured re-captured with the
+failed definition 10 s after a hold was lifted, R-645), the OLD `.felhom.yml` probe, then `undone` or
+the hold. Bind-mounted folders are never copied or touched. Measured cost on 9202: 1–5 s extra
+downtime, ~420 MB/s, disk = the volumes (refused before anything moves near the 2 GB floor).
+
+- **R-637** built (the eight-point list): pre-update copies kept incl. the old `.felhom.yml` (R-639);
+  the undo in `failAndHold` with `captureHoldLogs` first (R-621 unchanged); the copy is folder-level, so
+  the dump loader's two traps do not arise (R-638, R-640) and apps with no database server get their
+  last-second copy by construction (R-641); `app.yaml` `last_update_undone`; journal phases `copying`
+  and `undoing` with recovery (a cut while copying puts the old version back; a cut while undoing
+  resumes the undo — never "done").
+- **R-642**: start/restart answer `requested — state now: <state>`, never "completed".
+- `UpdateGuards.HoldAfterFailedUpdate` gains `undoState`; `settings.RestoreHold.UndoState`; the hold
+  sentence opens with the undo prefix + state clause in the box's language.
+- A removal deletes the app's kept undo copies (label `felhom.undo-copy-of`).
+- `docker_run_volume_path_gate`: the undo's four named-volume mounts allowlisted with their why.
+
+Red-proofs (REPORT.md): nine mutations, each seen failing.
+
 ## v0.262.1 — the busy refusal is a CONFLICT, not a server error (2026-09-22, R-633)
 
 **MinAgent: 0.131.0** (unchanged). No new strings.