controller v0.271.0: automatic app updates — the update leg after the off-site copy, the backup gate waits, the switch (09 6.4 part 7; R-680, R-678, R-643)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/report/builder.go

@@ -181,6 +181,10 @@ func BuildReport(
 
 	// DR recipe app-half — customer identity + per-app {catalog_ref, enabled, storage_bindings}.
 	// Allowlist-only (the boundary): NO env/secret fields. The hub assembles it with the agent half.
+	if stackMgr != nil {
+		r.UpdateLeg = stackMgr.LastUpdateLegSummary()
+	}
+
 	r.DRRecipe = BuildDRRecipeAppHalf(cfg.Customer.ID, cfg.Customer.Name, cfg.Customer.Domain,
 		stackMgr.GetStacks(), readComposeFile)
 	// fork-4: attach the non-secret offsite restic repo coordinates so DR knows where to recover from.

controller/internal/report/types.go

@@ -5,6 +5,7 @@ import (
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/metrics"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
 )
 
 // Report is the JSON payload pushed to the central hub.
@@ -53,6 +54,11 @@ type Report struct {
 	// customer e-mails can follow it (plan slice 3). Additive: the hub stores the raw report and no hub
 	// release reads it yet. Always present, never omitted: a box that never chose reports "hu".
 	Language string `json:"language"`
+
+	// UpdateLeg (v0.271.0, `09` §6.4 part 7) — the operator's one summary of the last automatic update
+	// leg on this box: steps done / undone / held / failed / skipped, each skip with its reason. Absent
+	// until a leg has run since the controller started. Additive: the hub stores the raw report.
+	UpdateLeg *stacks.UpdateLegSummary `json:"update_leg,omitempty"`
 }
 
 // SystemReport holds host-level system info.