From aa9e09e817344daf61bf953d3be1e02b48a43ad7 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 20 Oct 2026 10:56:59 +0200 Subject: [PATCH] CHANGELOG + CONTEXT + REPORT: v0.336.0 released (floor 08:54 UTC, MinAgent 0.158.1) after the 9202 proof and the three test boxes --- REPORT.md | 52 +++++++++++++++++++++++----------------------------- 1 file changed, 23 insertions(+), 29 deletions(-) diff --git a/REPORT.md b/REPORT.md index 2ed21cd..7754074 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,35 +1,29 @@ -# REPORT — controller v0.335.0 (2026-10-19 evening/night brief, Part 1 + Part 9) +# REPORT — controller v0.336.0: a failed off-site restore puts the app back exactly (R-893 option A) — 2026-10-20 -## What changed +**Task:** night brief part 2 (run by day, 2026-10-20), Parts 2 and 7. Operator answer: „D20 A". Architecture: +`felhom.eu/documentation/architecture/07-backup-architecture.md` §6.3; `09` §3 decision 192. -**R-921 — no app stop for an off-site (or any whole-guest) tier the agent will refuse because its host is busy.** -Before any app is stopped the quiesce loop reads the agent's new `host_busy` answer on `GET /backup/status` -(felhom-agent, Unreleased `56aabc7`, operator answer „add one field" 2026-10-19). Held → no app stopped, no backup -asked, each due tier recorded as contention (skip 15 min, one „BLOCKED" alarm after 3 h). Free, an older agent, or a -failed read → the old order (stop, ask, resume at once on 409). The window's own tier in flight attaches as before. -The race (free at the read, busy at the start) keeps the old behaviour: one short stop, resumed at once. +**What changed:** `internal/backup/offbox_restore_undo.go` + `offbox_reconstitute.go`. Before the stop, the live volumes the +snapshot will replace are measured and the copy is added to the restore's own free-space need (too little room or an +unmeasurable volume refuses with nothing stopped). Right after the stop they are tarred into +`/backups/restore-undo///`. On any failure after a volume or the definition moved, the copies are poured +back, a volume the snapshot added is removed, the live definition is written back and the app starts; the household reads +„…sikertelen. Nem változott semmi…"; the operator gets `backup_run_failures` leg `restore-put-back`. A put-back that fails holds +the app and keeps the copy. On success the copy is removed. R-1169: the held sentence says only what is certain. -## Tests (red-proved) +**Tests:** 7 new (`r893_putback_test.go`) + 4 moved to option A (`r893_mixed_restore_test.go`); nine mutations, each red +(felhom.eu `audits/night2-2026-10-20/P2/redproof-unit.txt`). `controller_gates.py --fast` green; `go test ./...` green. -- `TestR921_NoStopWhileTheHostIsBusy` — without the branch: 3 apps stopped, the start refused. -- `TestR921_HostBusySkipsStillAlarmAfterTheCeiling` — a gate that never lets go still alarms once. -- `TestR921_HostBusyOtherAnswersKeepTheOldOrder` — free / older agent / failed read / own tier in flight. -- `TestHostBusy_ReadsTheAgentsGate` — the wire shape; no field = „not known", never „free". +**Live proof on 9202** (rc.1, a helper with the brief's fences; `audits/night2-2026-10-20/P2/live/`): Rallly + postgres 18, a +forced failure after the volume was replaced → the copy (69 MB, 0.9 s) poured back: 36 tables, markers A–D, the table only the +backup had ABSENT, schema/data/row-count md5 EQUAL to before, the app running, no hold, the copy gone. Then a normal restore of +the same snapshot: the snapshot's content, the app running, the copy gone. 9202 back on 0.331.0 as found. -## Release (decision 250) +**Release:** image `sha256:93cd67d871125877e935a024765075b5a0b7c0e7683e1165976ff7a654fe8d73` (clean clone `93fb251`); per-box +floors → the three test boxes on 0.336.0 within a minute → box walk green (0 unhealthy, 0 allow-list refusals, catalog in +sync, https-only 28 OK, „Fájlok ↗" one sign-in on demo-hp and Tester 1) → global floor 0.336.0 / MinAgent 0.158.1 at 08:54:35 +UTC; per-box floors cleared. Evidence `audits/night2-2026-10-20/P7/`. -- `0.335.0-rc.1` on demo-hp 9201 by hand (18:08 UTC): healthy, 0 `[ERROR]`. The live agent's `GET /backup/status` - carries no `host_busy` (read inside 9201) — so until the agent release every box keeps the old order. -- `0.335.0` image `sha256:262831f97cec39ecc3fad9bd198de5cb4ee59fc398cdf828604df5de84d4daae` (from `15ea002`). -- Per-box floors 18:22:21 UTC; all three moved by 18:37:36 UTC (demo-hp from rc.1). -- Box walk 18:38–18:39 UTC: 0 unhealthy, 0 allow-list refusals, catalog in sync on all three; https-only 28 OK, - 0 FAIL; „Fájlok ↗" with no second sign-in on demo-hp and Tester 1. -- **Global floor 0.335.0 / MinAgent 0.158.1 at 18:39:26 UTC**, read back from hub.db + WAL; per-box floors cleared. -- Evidence: `felhom.eu/documentation/audits/night-2026-10-19/P9/`. -- i18n: no page changed, no fixture changed. - -## Also tonight (tooling, no release): the security-scan gate (R-986) - -`controller_gates.py` registers the shared `felhom.eu/scripts/security_scan_gate.py` (fast set: hook and CI), -warn-first; `.security-accepted` holds the first scan's 4 accepted hits (test constants, decoy values); decoys in -`controller/scripts/test_gate_decoys.py` (55 cases OK). Commit `a03c25a`, CI 2109 success. +**Not measured live:** the version-change branch, the `_files` sentence, the refusals before the stop, a failing put-back — +each pinned by a red-proved unit test. **Found:** a successful put-back is logged at ERROR by the web handler, and an empty +`backups/restore-undo/` folder stays — one register row (small; a version is pushed once, so it waits for the next release).