6 Commits

Include renames

Author	SHA1	Message	Date
admin	5b3b541602	clear_hold (D64 = B) + the box command through the running controller (R-1343), R-1340, R-1341 — tests red first; commit only ... - clear_hold: a fifth verb in the closed operator-action list; lifts a hold of any reason in the RUNNING controller (memory + settings.json together), forgets the update's held flag, drops a waiting put-back from the app-stop marker (copy kept). Refused on a bad name or no hold. No new event type. - --clear-restore-hold asks the running controller over <data dir>/ctl/hold.sock (unix, 0600, peer uid checked, no TCP); edits settings.json only when no controller answers, and says so (in-guest restart). - R-1340: the operator's HELD STOPPED mail is built from the hold record (restore kind, mixed cause, failed put-back step, database replay or not, kept copy) — never the option-C database story by default. - R-1341: the OOM WARN line once per new kill (container, start time, kill count); event unchanged.	2026-10-29 12:49:46 +01:00
admin	342a394bff	R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first ... H4: a failed definition write in the off-site restore writes the live definition back before the start; a failed write-back holds the app (restore_mixed). H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut); a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge). H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu; every web handler and the kept loads begin through it; install-time kept load asks about the mirror too. H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore running, and older than 14 days. Commit only; rides the next controller release.	2026-10-28 22:24:16 +01:00
admin	7720439440	D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.	2026-10-25 12:45:33 +01:00
admin	1f8295918e	R-1270 follow-up (found live on 9202): remove with „delete its backups too” deletes the app's restore-undo folder too — a not-started restore's kept copy outlived the remove; the wiring test also pins the D47 set-aside removal. Red-proved. Commit only.	2026-10-25 10:36:20 +01:00
admin	d582feb245	D22: every restore puts the data back exactly on failure and after a power cut (R-1177, R-1195); whole restore asks the unit first (R-1178); no mirror during a restore (R-1180); W22 restore refusals in Hungarian; unreleased	2026-10-21 21:19:46 +02:00
admin	93fb251ea9	R-893 option A (operator D20): a failed off-site restore puts the app's live volumes and definition back exactly and starts it; fit check before the stop; the held sentence made true (R-1169)	2026-10-20 09:17:00 +02:00