4 Commits

Include renames

Author	SHA1	Message	Date
adminandClaude Opus 5.5	5b8656974b	R-717: after_setup open_command — the family window reopens an app's DB-held sign-up switch ... The command form ran only when the lock was SET, so a database switch closed by `command` stayed closed through the household's 15-minute window. New twin fields `open_command` + `open_success` (same service/user/args_env and the same argv-safe expansion and success-marker rules as `command`/`success`). - liftNativeLock (the window, via OpenSignupWindow → goNativeLock(false)): marks the gate record native_lock "opening" BEFORE anything opens, lifts the env, runs open_command; only full success records "lifted". A failed open closes the switch again at once and records after_setup {ok: false, step: open}; the app page shows its own line (app_info.signup_native_open_failed). - The close: reconcileSignupBlocks (every 20 s and at controller start) runs `command` for any non-"applied" state once no window runs. A failed close after a window is logged ERROR ("may still be OPEN past the household's window") and retried every nativeLockOpenRetry (2 min) instead of 30. - After a successful app update, verifyAndConclude → markNativeLockForReapply sets native_lock "" so the loop closes the switch again. - A template with `command` but no `open_command` keeps today's window (env only) and logs once per app that its own switch cannot be reopened. Tests: internal/stacks/after_setup_r717_test.go (7), web render + parity case. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 15:15:33 +02:00
adminandClaude Opus 5.5	5a3437669f	v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741) ... Image retention: after a done/undone guarded Update and at remove, an app's images older than its running and previous one are deleted — never an image any container, installed compose or installed/previous record names (box-wide keep set read at delete time); exact id, never forced or pruned; paused while any update runs; a one-time sweep of catalog app images at the first start. Install hold: an after_install app is installed behind the setup gate's door and opens when after_install succeeds or the household says it changed the login. Tests TestImageRetention_* and TestInstallHold_* with red-proofs; parity fixture for the held card. MinAgent: 0.131.0 (unchanged). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-30 22:29:33 +02:00
adminandClaude Opus 5.5	149467c795	v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64} ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-29 09:57:58 +02:00
adminandClaude Opus 5.5	0c702f834a	v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706 ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-28 18:38:30 +02:00