From a9189c9dc4281450bbe70e0c49e397960071df43 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 10 Nov 2026 16:37:30 +0100 Subject: [PATCH] v0.352.0 released: global floor 0.352.0 / MinAgent 0.158.1 after rc.1 on 9202 and walk green on three boxes Notes only: CHANGELOG heading and box proof, REPORT, CONTEXT. No code change. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CHANGELOG.md | 14 +++++++++++--- CONTEXT.md | 10 ++++++---- REPORT.md | 33 ++++++++++++++++++--------------- 3 files changed, 35 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f83e093c..7b7ac54f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -## v0.352.0 (unreleased, 2026-11-10) — R-1371: one fill warning per filesystem +## v0.352.0 (2026-11-10) — R-1371: one fill warning per filesystem — RELEASED (image `sha256:3c785dd3…`, from `3dbb68c1`, CI 2615; rc.1 on scratch guest 9202); per-box floors 15:16 UTC, global floor 2026-11-10 15:31 UTC (MinAgent 0.158.1) ### 2026-11-10 @@ -28,8 +28,16 @@ file Docker keeps on its data-root and bind-mounts into the container (`/etc/hos **Red seen three times:** no filesystem check (2 warnings); the production list not wired to the real identity; an overlay keeping its own device number. -**Not proven.** A running controller with this code on a box (commit only). **Not fixed here:** the guest's own root -disk (`/opt/docker/stacks` lies on it) has no fill watcher — a design point in felhom.eu `16-storage-physical-identity.md`. +**Proven on boxes, 2026-11-10** (felhom.eu `documentation/audits/release-space-fixes-2026-11-10/controller/`). +Scratch guest 9202, filled past the warning line with one test file: the version before this one sent TWO warnings for +the one fill (two names); `0.352.0-rc.1` sent ONE, and cleared it silently when the file was gone. Tester 1, demo-hp and +demo-felhom took the release through per-box floors: each now checks 2 filesystems where it checked 3, all containers +healthy, the box walk and the https-only check green. Then the global floor, in its own save. **Correction to the +sentence above („Not seen on a box"):** it is now seen on a box, as two warnings on 9202. + +**Not proven.** A real fill on a household's box. The critical step (95 %) on a box; a test covers it. +**Not fixed here:** the guest's own root disk (`/opt/docker/stacks` lies on it) has no fill watcher — a design point in +felhom.eu `16-storage-physical-identity.md`. ## v0.351.0 (2026-11-09) — old test builds and old infrastructure images are deleted (decision 56 amended, decision 285) — RELEASED (image `sha256:1d90563c…`, from `27360d6a`, CI 2603; rc.1 on Tester 1 by hand); per-box floors 12:14 UTC, global floor 2026-11-09 12:18 UTC on the operator's yes (MinAgent 0.158.1) diff --git a/CONTEXT.md b/CONTEXT.md index 19b0103b..ecbf04b7 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -1,9 +1,11 @@ # CONTEXT.md — Project Memory -> **2026-11-10 (day, operator brief) — COMMITTED, NOT RELEASED: one fill warning per filesystem (felhom.eu R-1371).** -> `fillTargets` keeps one target per filesystem (`system.FilesystemKey`; an overlay "/" is identified by a Docker-kept -> file's device, not by its own). No version, no image, no floor: it rides the next controller release. Still open, by -> design question: the guest's own root disk has no fill watcher (felhom.eu `16-storage-physical-identity.md`). +> **2026-11-10 (afternoon, attended) — v0.352.0 RELEASED: one fill warning per filesystem (felhom.eu R-1371).** +> Global floor 15:31 UTC, MinAgent 0.158.1; rc.1 on scratch guest 9202, then the three test boxes through per-box +> floors, walk green (felhom.eu `audits/release-space-fixes-2026-11-10/controller/`). `fillTargets` keeps one target per +> filesystem (`system.FilesystemKey`; an overlay "/" is identified by a Docker-kept file's device, not by its own). +> Seen on 9202: two warnings for one fill before, one after. Still open, by design question: the guest's own root disk +> has no fill watcher (felhom.eu `16-storage-physical-identity.md`). > **2026-11-09 (attended) — v0.351.0 RELEASED** (global floor 12:18 UTC, MinAgent 0.158.1; rc.1 on Tester 1, then the > three test boxes through per-box floors, walk green; felhom.eu `audits/release-2026-11-09/`). Operator's word 2026-11-09 („go with A"): decision 56 amended diff --git a/REPORT.md b/REPORT.md index 64bb8b97..b7aa06e8 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,24 +1,27 @@ -# REPORT — one fill warning per filesystem (R-1371) — committed, NOT released (2026-11-10, operator brief) +# REPORT — v0.352.0 released: one fill warning per filesystem (R-1371) (2026-11-10, attended release run) **Plain words first.** The controller watches how full the disks are. On a box with one data volume it watched that -volume twice, under two names. One full disk would have sent two warnings. The controller now watches each filesystem -once. This is a commit only. No version, no image, no floor change. No box has it. It waits for the next release. +volume twice, under two names. One full disk sent two warnings. Version 0.352.0 watches each filesystem once. It is +released: the global floor is 0.352.0 since 2026-11-10 15:31 UTC. Every box takes it by itself. -The full report of the run is in `felhom.eu`: `REPORT-endings-kernels-fixes-2026-11-10.md`. +The full report of the run is in `felhom.eu`: `REPORT-release-space-fixes-2026-11-10.md`. | | | |---|---| -| Change | `fillTargets` / `fillTargetsBy` in `controller/cmd/controller/main.go`; `system.FilesystemKey` (new, `controller/internal/system/fskey*.go`) | -| Rule | One watch target per filesystem. The first stays: app area, then system area, then drives. A path that cannot be identified is kept | -| The trap | Inside the container "/" is an overlay. It has its own device number (139 against 64519 on demo-hp). A plain device compare changes nothing on a box. The key of an overlay path is the device of a file Docker keeps on its data volume (`/etc/hostname`, `/etc/hosts`, `/etc/resolv.conf`) | -| Measured | Read-only, 2026-11-10, demo-hp guests 9201 and 9202 and the N100: felhom.eu `documentation/audits/space-list-2026-11-10/evidence/extra/fs-identity.txt` | -| Tests | `TestR1371_OneFillSendsOneWarning`, `TestR1371_TargetsByFilesystem`, `TestR1371_ProductionListUsesTheRealIdentity`, `TestFilesystemKey_AnOverlayRootIsTheDockerDataRoot`, `TestFilesystemKey_RealSyscalls` | -| Red seen | 3 times: no filesystem check (2 warnings); the production list not wired to the real identity; an overlay keeping its own device number | -| Gates | `python3 scripts/controller_gates.py --fast` | -| Not proven | On a box. No disk was filled, so two real warnings were never seen; the double count is read from the target list and the measured filesystems | +| Version | 0.352.0, MinAgent 0.158.1 (unchanged) | +| Image | `gitea.dooplex.hu/admin/felhom-controller:0.352.0`, `sha256:3c785dd396b091f19d4c777db9d7a206e75ab018b6238b5d887e1a4c6cfd3b29`, built from `3dbb68c1` | +| CI | run 2615, `gates #558`, success, read by commit before the build | +| Change | `fillTargets` / `fillTargetsBy` in `controller/cmd/controller/main.go`; `system.FilesystemKey` (`controller/internal/system/fskey*.go`). No code change since `844f19f1` | +| Red on a box | Scratch guest 9202 on the version before, filled past the warning line with one test file: TWO warnings, two names | +| Green on a box | 9202 on `0.352.0-rc.1`, the same fill: ONE warning. The file removed: cleared silently, armed again | +| Test boxes | Tester 1, demo-hp, demo-felhom through per-box floors (15:16 UTC). Each moved in under 15 seconds. Each checks 2 filesystems where it checked 3. Containers 10 / 26 / 9, none unhealthy. The box walk and the https-only check: green | +| Global floor | 15:31:34 UTC, in its own save, MinAgent declared. The hub read back `Effective floor: v0.352.0` | +| After the floor | The 30-minute watch and the clearing of the per-box floors are in the felhom.eu report, with the evidence | +| Evidence | felhom.eu `documentation/audits/release-space-fixes-2026-11-10/controller/` | +| Not proven | A real fill on a household's box. The critical step (95 %) on a box; a test covers it | | Not fixed here | The guest's own root disk (`/opt/docker/stacks` lies on it) has no fill watcher. It is a design point in felhom.eu `16-storage-physical-identity.md` | | Side effect | A registered drive that lies on the same filesystem as a built-in area is now watched under the area's name | -| Machines | None changed by this commit. The measurement was read-only | +| Machines | 9202: one test file written and removed; it now runs the release. The three test boxes: updated by the normal path. No household box touched by hand | -**Next.** A release session builds it. Then read the watch list in the controller's log on a one-volume box: it must -name the data volume once. +**Correction.** The earlier report of this change said two real warnings were never seen. They are now seen, on 9202, +on the version before this one.