6 Commits

Include renames

Author	SHA1	Message	Date
admin	03c0a693b8	R-1214: the second-drive copy runs in a 512 MB memory-capped container for /mnt paths (its page cache no longer evicts the apps) — measured on 9202; guarded against a path the daemon sees differently; unreleased	2026-10-22 17:47:19 +02:00
admin	93fb251ea9	R-893 option A (operator D20): a failed off-site restore puts the app's live volumes and definition back exactly and starts it; fit check before the stop; the held sentence made true (R-1169)	2026-10-20 09:17:00 +02:00
adminandClaude Opus 5.5	2caae38a71	stacks: the box converts a PostgreSQL major as a guarded-update step (09 6.4 part 10, decisions 35/37/38) ... A step whose ladder entry carries engine_conversion {service, engine, from, to} converts the database: the old engine alone, the check (owners, roles, extensions, per-table row counts), pg_dumpall validated by its completion line, the volume emptied only after the undo copy's marker is validated again, the new engine alone, the load with ON_ERROR_STOP, the check again + PG_VERSION. Any failure goes to the existing undo; a restart during converting is undone. A PostgreSQL major move without the mark is refused before anything moves. The old datadir's copy is kept until a backup is proven after the conversion. 17 tests, 9 red-proofs (audits/night-2026-09-26/B/). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-25 12:57:03 +02:00
adminandClaude Opus 5.5	8fc2b4a1a9	v0.263.0: a failed update puts the app back by itself (09 decision 15, R-637) ... The guarded update gains a folder copy of the app's named volumes, taken after the pull where the app stops anyway (decision 19, chosen by the 2026-09-23 bake-off). On a failed health check the box undoes: every copy validated by its finished-marker first, volumes refilled, definition and pin from the job's own pre-update copies, the old version checked with the OLD .felhom.yml probe. It holds only if the undo fails, and the hold sentence says so and what state the data is in. Bind-mounted folders are never touched. - R-637 built; R-638/R-640/R-641 do not arise with a folder copy; R-639 (pre-update copies incl. .felhom.yml kept until the undo is over). - journal phases copying/undoing with power-cut recovery. - app.yaml last_update_undone + one line on the app page (hu/en). - R-642: start/restart never answer "completed". - Removal deletes kept undo copies. MinAgent unchanged (0.131.0). Nine red-proofs in REPORT.md. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-23 11:12:49 +02:00
admin	c432f701dd	gate: allowlist appexport/estimate.go named-volume -v mount (R-29 leg a) ... realVolumeSize mounts the NAMED VOLUME read-only into a throwaway alpine to du it from a container view. No host path is involved — docker resolves the volume name daemon-side — so it is the same safe class as the internal/backup/backup.go entry. The gate was right to demand review; this diff is that review, on its own, because burying an allowlist widening inside a feature commit is how an allowlist stops meaning anything. Tooling only: no Go change, no build, no deploy, no version bump.	2026-08-02 15:11:08 +02:00
admin	466f42708e	controller: .fab volume legs stream via docker cp (fixes the containerized path-strand data loss, IA finding 1 HIGH) — zero shared paths both deployment shapes; export fails LOUD on any missing/empty claimed tar (no hollow bundles); import validates BEFORE it destroys (hollow bundle → app untouched); docker_run_volume_path_gate.py extinguishes the class (Tier-1/2 mounts documented host-visible) ... Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC	2026-07-13 10:42:02 +02:00