REPORT: v0.241.0 delivered by the floor and proven live; R-491 filed

REPORT.md

@@ -1,34 +1,33 @@
-# REPORT — controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation (2026-09-13)
+# REPORT — controller v0.241.0: a bind-data app leans on off-site before its own unit (2026-09-13, evening)
 
 *Overwritten each run. This records the most recent implementation only.*
 
-> **Shipped as v0.240.0 and delivered to both demo guests by the managed floor** (declared MinAgent
-> 0.129.0): demo-hp at +16 s, demo-felhom at +18 s from the save. Every row proven live on demo-hp
-> with a throwaway adventurelog. Evidence: `felhom.eu/documentation/audits/v0240-2026-09-13/`.
+> **Operator ruling R-479, shipped as v0.241.0 and delivered by the managed floor** (declared MinAgent
+> 0.129.0): demo-hp +16 s, demo-felhom +18 s. Proven live on demo-hp with a nextcloud throwaway on the
+> registered drive. Evidence: `felhom.eu/documentation/audits/v0241-2026-09-13/`.
 
-## What changed (`bdcbd50`)
+## What changed (`3e81330`)
 
-| Row | Change | Live proof |
-|---|---|---|
-| R-486 (P1) | removal keeps the Tier-2 record unless `remove_backups` | remove-keep → record kept → „Teljes visszaállítás" restored 2 volumes + the DB, data identical |
-| R-484 | `postgis`/`pgvector`/`timescaledb` are Postgres | `db-dumps/adventurelog-postgres.sql` (8 MB) in the unit and mirror |
-| R-485 | the backup card sizes the unit + mirror(s) | `244M` + `244M`, `has_backups:true` |
-| R-480 | a held update's sentence leaves the card with the hold | card clean after a restore |
-| R-477 | the Tier-3 lookup is one `snapshots` call | unit-tested; the R-408 walk registers the shared reader |
-| R-478 | a copy older than `deployed_at` does not count | unit-tested (the leftover unit R-474 now removes) |
-| R-474 | "delete backups" deletes the unit, mirror(s), prefs | 244M + 243.6 MB removed, nothing left, prefs `None` |
+- `UpdateTierOrderFor` / `DataOutsideUnit`: an app with classified binds walks 2 → 3 → 1; a volume app
+  keeps 2 → 1 → 3. `UpdateRestorePoints` reads it.
+- `RestoreHold.CopyHolds` + `UpdateCopyHolds`: the hold sentence ends with what the chosen copy holds;
+  the adapter passes it through `HoldAfterFailedUpdateHolding`. Holds from v0.239.0–v0.240.0 keep the
+  tier-only sentence (`UpdateHoldTierFmt`).
 
-## Gates, tests, red-proofs
+## Gates, tests, red-proof, live
 
-- `go build ./... && go vet ./... && go test ./...` green (28 packages); `controller_gates.py --fast` green.
-- Red-proofs, all valid (RUN > 0, FAIL > 0, file restored byte-identical): `rp-v240-R486-…`, `R484`,
-  `R485`, `R480` (first attempt inert — the mutation did not compile; rerun with a compiling one),
-  `R478`, `R477`, `R474`.
-- `internal/backup` takes 5½ minutes on its own (89 tests with real waits) — R-488.
+- `go build ./... && go vet ./... && go test ./...` green; `controller_gates.py --fast` green.
+- `internal/backup/r479_tier_order_test.go`: order per layout, the consequence (Tier 2 absent, unit
+  and off-site both fresh → the bind app leans on off-site), the phrases, the sentence verbatim, the
+  older sentence; the adapter wiring test demands the phrase.
+- Red-proof: a layout-blind order fails the bind case (`rp-v241-R479-order-layout-blind.txt`).
+- Live (`13-R479-live.txt`): nextcloud with `HDD_PATH` on the drive (2 classified binds), Tier 2 off,
+  backup now (unit with db-dump and volume tars), a never-healthy update → held, the sentence names
+  „saját meghajtó, 2026-09-13 21:51 — ez a másolat csak a beállításokat és az adatbázist tartalmazza,
+  a fájlokat nem." The 2→3→1 preference is unit-proven only: a live off-site run would touch the
+  standing apps' leg.
 
 ## Observations
 
-1. **Two concurrent `go test` runs of the backup package looked like a hang; the package is slow alone.** FILED: R-488
-2. **`volumes_removed: null` still reported over removed volumes.** FILED: R-489
-3. **The first R-480 red-proof was inert (a non-compiling mutation, RUN=0).** NOT-A-FINDING: harness discipline, caught by the RUN count rule and rerun; recorded here so the pattern stays visible.
-4. **`GET /api/system/info` is shadowed by the web layer's `ServeSystemAPI` (404 „ismeretlen végpont"), so the monitoring page's memory-distribution card never renders and `systemInfo` is unreachable; it is also the one reader of the empty `cfg.Paths.HDDPath` with no fallback.** FILED: R-490
+1. **A removed app keeps its `update_failed` hold in the store; a reinstall under the same name would start held.** FILED: R-491
+2. **The 2→3→1 preference was not exercised live (no off-site run on a box with standing apps).** NOT-A-FINDING: the unit test and red-proof pin it; a live pass belongs to a night whose throwaway has off-site of its own.