5 Commits

Include renames

Author	SHA1	Message	Date
adminandClaude Opus 5.5	6d07ca2be4	R-899: a daytime press never cancels the night's whole-guest backup (operator ruling 2026-10-08, option A); press sends trigger=manual ... Unreleased; ships with tomorrow's release. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-08 07:34:03 +02:00
adminandClaude Opus 5.5	d8c2634472	R-518 option A: one stop per backup tier (09 §3 decision 156) ... Each quiesce window now backs up ONLY the first due tier that starts and resumes the apps at its snapshotted; the upload finishes with the apps running. Any other due tier stays due and a later cycle (the next poll) takes it in its own short window - never straight after the first. This reverses R-82's 'ONE quiesce window for both due tiers'. A manual press (TriggerNow) backs up the primary (local) tier only, picked by the agent's Primary flag; the off-site tier follows at the next scheduled night run. If no available tier is flagged primary, the first available tier is backed up rather than nothing. Unchanged: marker written before any stop, one unquiesce per window, the max-quiesce bound, BUSY/start-error handling (the next tier is still tried in the same window when a tier does not start), breaker and contention. Tests: TestBothTiersDue_ExactlyOneQuiesceWindow -> TestBothTiersDue_FirstCycleRunsOnlyFirstTier; TestNonLastTierSnapshot_ DoesNotResumeApp -> TestFirstTierSnapshot_ResumesAppWhileUploadContinues (red on old code); new TestManualPress_RunsOnlyLocalTier (red on old code), TestLeftoverTier_RunsInNextCycleInItsOwnWindow, TestManualRunTiers_NoPrimaryAvailable_BacksUpFirstAvailable; TestNotify_BothFailingTiersAreReported now runs two cycles. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 15:15:33 +02:00
adminandClaude Opus 5	843b319f35	v0.243.0: FileBrowser generated admin password (R-513); per-tier whole-guest backup truth (R-517); skip absent-storage tiers (R-518); OOM-killed worker visible (R-514) ... MinAgent: 0.131.0 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-15 10:12:08 +02:00
admin	86ea482fc1	controller v0.178.0 — R-88 Part 2: only a positive 'never' fires the valve ... MinAgent: 0.105.0. scheduledRunAllowed fired on any nil age; it now requires a licence from valveLicensed, which grants it for AgeStateAbsent and for a LEGACY agent, and refuses it for AgeStateUnknown. An unreadable storage no longer masquerades as a first-ever backup and no longer quiesces apps outside the window. A missing wire field means legacy, not unknown — deliberately. Treating it as unknown would stop the valve firing on un-upgraded boxes and starve genuinely new ones. Degrade logged once; unrecognised future values also map to legacy. Caught in passing: TieredBackend is satisfied by a RUNTIME assertion, so the signature change compiled and vetted clean while quiesceBackend silently stopped satisfying it — which would have degraded every box to the single-tier path with no error. Added a compile-time witness. Also corrects the notifier comment that claimed operator-only came from a missing customerMessages entry; enforcement is hub-side operatorOnlyEvents (hub 0.79.0).	2026-07-27 18:08:56 +02:00
Claude Code	de96efc0c5	v0.174.0 — R-82 Slice B: one quiesce window, two backup tiers ... MinAgent UNCHANGED — degrades gracefully against ANY older agent. The agent gained per-target tiers in v0.97.0. The controller owns quiescing, so the multi-tier schedule is reconciled here: every due tier is collected up front and run inside ONE quiesce window (one stop, N sequential backups, one resume). Two cycles on the weekly night would mean two app outages for one night's work. Dedup rule: local-only -> one quiesce; PBS-only -> one quiesce; BOTH due -> ONE window with both backups inside; neither -> no quiesce. - quiesce.TieredBackend + BackupTier + ErrTiersUnsupported (optional extension) - agentapi: BackupTiers/BackupDueFor/StartBackupFor/BackupStatusFor; targetQuery("") yields an EMPTY suffix so untargeted hits the pre-R-82 route byte-for-byte - Loop.resolveDueTiers = the dedup rule in one place, agent order preserved - quiesceAndPollTiers + pollTier: app stays quiesced until the LAST tier snapshots (resuming earlier loses app-consistency on the DR tier). Consequence stated in the docs: both-due-night downtime = first tier's full backup + last tier's snapshot, which is why tiers run fast-first. - Manual 'Mentes most' covers EVERY tier, due-ness ignored. - Window-gate safety valve now uses the OLDEST due tier, so a stale DR tier cannot be starved by a fresher local one. Capability detection: /backup/tiers 404 = pre-R-82 agent (the documented route-probe mechanism). Not a featureProbes row on purpose — the loop needs the tier LIST, not a yes/no. Degrade logged exactly once per process. Tests +11, full suite green. Red-proofs #2 and #3 observed and restored.	2026-07-26 14:40:44 +02:00