CHANGELOG + CONTEXT + REPORT: v0.336.0 released (floor 08:54 UTC, MinAgent 0.158.1) after the 9202 proof and the three test boxes

REPORT.md

@@ -1,35 +1,29 @@
-# REPORT — controller v0.335.0 (2026-10-19 evening/night brief, Part 1 + Part 9)
+# REPORT — controller v0.336.0: a failed off-site restore puts the app back exactly (R-893 option A) — 2026-10-20
 
-## What changed
+**Task:** night brief part 2 (run by day, 2026-10-20), Parts 2 and 7. Operator answer: „D20 A". Architecture:
+`felhom.eu/documentation/architecture/07-backup-architecture.md` §6.3; `09` §3 decision 192.
 
-**R-921 — no app stop for an off-site (or any whole-guest) tier the agent will refuse because its host is busy.**
-Before any app is stopped the quiesce loop reads the agent's new `host_busy` answer on `GET /backup/status`
-(felhom-agent, Unreleased `56aabc7`, operator answer „add one field" 2026-10-19). Held → no app stopped, no backup
-asked, each due tier recorded as contention (skip 15 min, one „BLOCKED" alarm after 3 h). Free, an older agent, or a
-failed read → the old order (stop, ask, resume at once on 409). The window's own tier in flight attaches as before.
-The race (free at the read, busy at the start) keeps the old behaviour: one short stop, resumed at once.
+**What changed:** `internal/backup/offbox_restore_undo.go` + `offbox_reconstitute.go`. Before the stop, the live volumes the
+snapshot will replace are measured and the copy is added to the restore's own free-space need (too little room or an
+unmeasurable volume refuses with nothing stopped). Right after the stop they are tarred into
+`<namespace>/backups/restore-undo/<app>/<stamp>/`. On any failure after a volume or the definition moved, the copies are poured
+back, a volume the snapshot added is removed, the live definition is written back and the app starts; the household reads
+„…sikertelen. Nem változott semmi…"; the operator gets `backup_run_failures` leg `restore-put-back`. A put-back that fails holds
+the app and keeps the copy. On success the copy is removed. R-1169: the held sentence says only what is certain.
 
-## Tests (red-proved)
+**Tests:** 7 new (`r893_putback_test.go`) + 4 moved to option A (`r893_mixed_restore_test.go`); nine mutations, each red
+(felhom.eu `audits/night2-2026-10-20/P2/redproof-unit.txt`). `controller_gates.py --fast` green; `go test ./...` green.
 
-- `TestR921_NoStopWhileTheHostIsBusy` — without the branch: 3 apps stopped, the start refused.
-- `TestR921_HostBusySkipsStillAlarmAfterTheCeiling` — a gate that never lets go still alarms once.
-- `TestR921_HostBusyOtherAnswersKeepTheOldOrder` — free / older agent / failed read / own tier in flight.
-- `TestHostBusy_ReadsTheAgentsGate` — the wire shape; no field = „not known", never „free".
+**Live proof on 9202** (rc.1, a helper with the brief's fences; `audits/night2-2026-10-20/P2/live/`): Rallly + postgres 18, a
+forced failure after the volume was replaced → the copy (69 MB, 0.9 s) poured back: 36 tables, markers A–D, the table only the
+backup had ABSENT, schema/data/row-count md5 EQUAL to before, the app running, no hold, the copy gone. Then a normal restore of
+the same snapshot: the snapshot's content, the app running, the copy gone. 9202 back on 0.331.0 as found.
 
-## Release (decision 250)
+**Release:** image `sha256:93cd67d871125877e935a024765075b5a0b7c0e7683e1165976ff7a654fe8d73` (clean clone `93fb251`); per-box
+floors → the three test boxes on 0.336.0 within a minute → box walk green (0 unhealthy, 0 allow-list refusals, catalog in
+sync, https-only 28 OK, „Fájlok ↗" one sign-in on demo-hp and Tester 1) → global floor 0.336.0 / MinAgent 0.158.1 at 08:54:35
+UTC; per-box floors cleared. Evidence `audits/night2-2026-10-20/P7/`.
 
-- `0.335.0-rc.1` on demo-hp 9201 by hand (18:08 UTC): healthy, 0 `[ERROR]`. The live agent's `GET /backup/status`
-  carries no `host_busy` (read inside 9201) — so until the agent release every box keeps the old order.
-- `0.335.0` image `sha256:262831f97cec39ecc3fad9bd198de5cb4ee59fc398cdf828604df5de84d4daae` (from `15ea002`).
-- Per-box floors 18:22:21 UTC; all three moved by 18:37:36 UTC (demo-hp from rc.1).
-- Box walk 18:38–18:39 UTC: 0 unhealthy, 0 allow-list refusals, catalog in sync on all three; https-only 28 OK,
-  0 FAIL; „Fájlok ↗" with no second sign-in on demo-hp and Tester 1.
-- **Global floor 0.335.0 / MinAgent 0.158.1 at 18:39:26 UTC**, read back from hub.db + WAL; per-box floors cleared.
-- Evidence: `felhom.eu/documentation/audits/night-2026-10-19/P9/`.
-- i18n: no page changed, no fixture changed.
-
-## Also tonight (tooling, no release): the security-scan gate (R-986)
-
-`controller_gates.py` registers the shared `felhom.eu/scripts/security_scan_gate.py` (fast set: hook and CI),
-warn-first; `.security-accepted` holds the first scan's 4 accepted hits (test constants, decoy values); decoys in
-`controller/scripts/test_gate_decoys.py` (55 cases OK). Commit `a03c25a`, CI 2109 success.
+**Not measured live:** the version-change branch, the `_files` sentence, the refusals before the stop, a failing put-back —
+each pinned by a red-proved unit test. **Found:** a successful put-back is logged at ERROR by the web handler, and an empty
+`backups/restore-undo/` folder stays — one register row (small; a version is pushed once, so it waits for the next release).