REPORT/CONTEXT: 2026-10-08 day (R-899, R-304 on main, unreleased)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -9,6 +9,12 @@
 
 Last updated: 2026-10-04 (v0.293.0 — the Docker-socket self-heal, R-860)
 
+> **2026-10-08 (day) — UNRELEASED on main, ships with tomorrow's release (no release today: kernel night 8→9, `09` §3
+> decision 178).** R-899 (decision 177): a daytime press never cancels the night's whole-guest backup —
+> `internal/quiesce/nightowed.go` ledger, owed tiers never fire the valve; a press reaches the agent as `trigger=manual`.
+> R-304: the agent's new 424 `older_unchecked` → `RecoveryOlderUnchecked`, bundle key `recovery.older_unchecked` (hu+en).
+> MinAgent unchanged (0.131.0): both changes degrade safely against an older agent.
+
 > **2026-10-04 night — v0.293.0 (R-860; floor 0.293.0 on the demo customers only, golden 0.293.0 vouched):**
 > `internal/sockheal` — the controller exits after 60 s of socket REFUSALS (never timeouts, only after Docker answered
 > once) so Docker restarts it on the current socket, then restarts any other socket user on an older inode (traefik).

REPORT.md

@@ -1,11 +1,19 @@
-# REPORT — controller v0.303.0: after a restart, a backup capture waits for the drive (2026-10-07, late evening)
+# REPORT — controller, 2026-10-08 (day): R-899 and R-304 on main, unreleased
 
-- R-897 (closed): for 10 minutes after the controller starts, a recovery-unit capture for an app on a drive runs only
-  once that drive is a live mount in the controller's own namespace (`/proc/self/mountinfo`); the 5-minute refresh
-  skips the app until then, a data run waits (5 s polls); after the window it runs and logs once at WARN. The agent's
-  bind order is unchanged. Measured cause: demo-hp 2026-10-07 15:16:28, `permission denied` in the second the agent
-  normalized the drive bind after a reboot.
-- `controller/internal/backup/driveready.go`; tests `TestDriveReady_*` (3; red-proved without the call).
-- MinAgent 0.131.0 (unchanged). Image `felhom-controller:0.303.0`; delivered by per-customer floors (demo-hp,
-  demo-felhom, tester-1; declared MinAgent; global floor untouched) — all three ran 0.303.0 at 18:50.
-- First live check: the kernel night 2026-10-07→08 (both demo boxes restart).
+**No release, no delivery today** (kernel night 8→9; `09` §3 decision 178). Both ship with tomorrow's release.
+
+| Item | Commit | Tests | Red-proof |
+|---|---|---|---|
+| R-899 — a daytime „Mentés most" press never cancels the night's whole-guest backup (decision 177) | `6d07ca2` | `TestR899_*` (6, quiesce), `TestR899_PressCarriesTriggerManual` (agentapi) | rule off → the 2026-10-07 replay started nothing on night 2 (`started=[local local]`), plus 2 more failures; without the owed-tier valve guard an owed night ran outside the window (`started=[local local]` at 15:00) |
+| R-304 — „we do not know whether your code is wrong" when earlier packages were not all checked (agent 424) | `75b3b39` | `TestR304_OlderUnchecked_IsNotAWrongCode` (hu + en), `TestR304_Classify424` | without the handler case the page fell to the safe default „A művelet nem fejeződött be…" in both languages |
+
+**Design:** `07` §6.1 (R-899 paragraph), `09` §3 decisions 177–178. The ledger is
+`<data>/whole-guest-ledger.json`, successes only, read only to decide due-ness. **MinAgent unchanged (0.131.0).**
+
+**Gates:** `go build/vet/test ./...` rc 0; `controller_gates.py --fast` rc 0. **CI:** job 1528 (`6d07ca2`) success; job
+1531 (`75b3b39`) success.
+
+**Seen, filed (not fixed):** the recovery screen's other 14 messages are Hungarian-only Go literals and show in Hungarian
+on an English page — appended to R-516.
+
+**Not done:** no live validation (no delivery today); the first night after a press is read back after tomorrow's release.