Second review of the night's own code: a stray clears when a later removal works (N2), the start-up check never removes this process's own copy (N3), one copy per destination at a time (N4), RunTier2 refuses during a restore for every caller (N5), the import refusal no longer advises removal (N9); red-proved, race-clean; README; REPORT; unreleased

REPORT.md

@@ -1,30 +1,41 @@
-# REPORT — night 2026-10-22: four fixes on `main`, not released
+# REPORT — night 2026-10-22 → 23: the stray-copy fix and the review fixes, nothing released
 
-**What:** the night brief's controller parts. Nothing released (the brief forbids a controller release tonight).
-Design read: `07-backup-architecture.md` §6.1.1 (catch-up), §6.2 (capture set), §10.2; `09` §6.5 (drill catalog).
-Next release **0.340.0**, **MinAgent 0.158.1** (unchanged).
+**What:** the night brief's controller parts (Part 1, the controller findings of Part 3). No release, no floor change.
+Design read: `07-backup-architecture.md` §6.3, §8 (R-1180's guard), now §8.2b.
 
-- **R-49 (operator D21 = B), `6a17c95`.** `.felhom.yml` `backup.volumes: [{name, class: excluded}]` leaves a named
-  volume out of every backup (`appbackup.ExcludedDockerVolumes` → `backup.Manager.dumpableVolumes`); declared names
-  only, a list that would exclude every named volume is refused whole. Red-proved (`TestR49_*`, both packages) and
-  the R-591 deep-copy alias test caught a shared slice (fixed in `deepCopyStack`). 9202: Immich unit
-  1 160 553 832 → 336 788 031 B; with the cache volume removed Immich's ML answered after 9.2 s.
-- **R-1187 (c), `d5f88a2`.** A `.fab` import over an installed app that is not running merged the old volume data with
-  the bundle's. Reproduced on 9202 rc.1 (a marker written after the export survived the import; the running control
-  replaced it); now refused with a Hungarian sentence, the app untouched (rc.2: markers unchanged; the running path
-  still replaces). Red-proved (`r1187c_test.go`). Evidence felhom.eu `audits/night-2026-10-22/P3-candidates/r1187c-9202.txt`.
-- **R-1189 (d), `d5f88a2`.** The off-site proof (05:30) and integrity check (06:00) never ran on a box that is off
-  then. `nightchain.CatchUp.After` now runs both once after the catch-up's legs; the false comment in `main.go`
-  corrected. Red-proved (`nightchain/r1189d_test.go`, `cmd/controller/r1189d_wiring_test.go`).
-- **R-1214, `03c0a69` + `ae39467`.** The 03:30 second-drive copy's page cache pushed the apps out of memory.
-  `rsyncMirror` runs rsync in a 512 MB memory-capped container of the controller's own image, only for clean `/mnt/`
-  paths with no symlink (a security review found the symlink case; fixed and tested). 9202 (4 GB, 1.8 GB held, 6 GB):
-  full stall 5.7 / 2.5 s → 0.37 / 0.32 s; peak „full" 16.8 / 6.9 % → 0.9 / 1.0 %. A real `POST /api/backup/tier2` on
-  rc.4: 6 capped containers, each exit 0; Immich's copy equals its source (0 differences, 44 = 44 files).
-  `docker_run_volume_path_gate.py` allow-list entry with its WHY.
-- **Gates:** `controller_gates.py --fast` green before each push; CI by commit — see felhom.eu
-  `REPORT-night-2026-10-22.md`.
-- **Teardown (9202):** throwaway uptime-kuma removed through the product (`.fab` deleted); hog container and 19 GB of
-  test files removed; memory 25898 MB / swap 512 MB again; Immich's `.felhom.yml` back to its pre-night file; controller
-  back on **0.339.0** (healthy); the drill catalog equals live main again. Host: `/tmp/r1214*` removed on demo-hp. Hub:
-  9202 has no hub link — nothing.
+## Part 1 — the stray-copy fix (`66a69d4`, `912e592`)
+
+The capped second-drive copy (R-1214) runs `rsync -a --delete` in its own container. A timeout, a controller restart
+or a self-update killed only the `docker` CLI — the container went on deleting, outside every guard the controller
+holds. Now:
+- each copy container has a fixed name (`felhom-tier2-copy-<app>-<8 hex>`) and the label `felhom.tier2-copy=1`;
+- a leftover of the same copy is removed before a new one starts; on any error, the timeout included, it is removed by
+  name;
+- at start, BEFORE the scheduler and the web server, every labelled container is removed (each logged; retried every
+  minute until it succeeds; restores refused meanwhile);
+- a restore is refused while any second-drive copy runs or a leftover may run;
+- review C4/C7 in the same function: `--mount` (a path the daemon does not see is refused instead of created empty),
+  the controller's image ID with `--pull never`; `--no-healthcheck` (the 9202 proof showed the inherited health check).
+
+**Tests** (Docker-free seams): `TestStrayCopy_*` — 8 in `internal/backup`, 1 web, 1 wiring; each seen failing with its
+mechanism removed. **9202 proof** (felhom.eu `audits/night-2026-10-23/P1-straycopy/`): rc.5; a controller restart in
+the middle of a 16 GB copy → the new controller removed `felhom-tier2-copy-immich-948f2280` at start; a restore probe
+during the copy was refused; the redone copy equals the source (54 s); a 15 s test build (rc.5 + a binary with the
+limit set by ldflags, never pushed) → the timed-out container removed, the partial copy stopped growing. 9202 back on
+0.339.0, test files and the test image removed.
+
+## Part 3 — review findings (controller), verified at file:line
+
+| # | Finding | Verdict |
+|---|---|---|
+| C1 | the copy container outlives the CLI | REAL → fixed (Part 1) |
+| C2 | two more import paths merge old and new data | REAL, pre-existing in 0.339.0 → R-1187 (recovery code: red-proof + 9202 proof first); not a hold |
+| C3 | the R-1187 (c) refusal also catches an unhealthy app, with wrong advice | REAL → text fixed (`943c517`); the import path → R-1187 |
+| C4 | `-v` creates a missing path on the daemon side | REAL → `--mount` (`66a69d4`) |
+| C5 | the catch-up holds the whole-guest backup while its slow checks run | REAL → fixed (`943c517`, `TestC5_*`, red-proved) |
+| C6 | two comments overstate the proof's catch-up | REAL → fixed |
+| C7 | the image tag, not its ID; no `--pull never` | REAL → fixed; „no memory cgroup → uncapped": NOT-A-FINDING (every Felhom guest is an LXC on a cgroup-v2 Proxmox kernel; the guest's own memory figures come from it) |
+| C8 | README: „out of every backup" | REAL → fixed (the `.fab` export and the whole-guest snapshot still hold it) |
+
+**Images:** `0.340.0-rc.5` (= `66a69d4`), `0.340.0-rc.6` (= `943c517`, on tonight's test box). CI: `66a69d4` 2227,
+`912e592` 2228 green; `943c517` and the docs commit: see felhom.eu `REPORT-night-2026-10-23.md`.