100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	a28db2d17f	REPORT + CONTEXT: v0.348.0 the global floor; clear_hold proven on the release build	2026-10-29 15:11:17 +01:00
admin	2a0a17a760	v0.348.0: CHANGELOG heading — the release build's commit	2026-10-29 14:35:30 +01:00
admin	99fac06aa7	R-1340 second producer: a restore_mixed hold's Why() names the cause from its record (found live on rc.1: the hub's Held apps line said off-site/database for a local restore with no database) — test red first	2026-10-29 14:35:07 +01:00
admin	6077ac0083	R-1343 fallback: the box command's own settings.json edit (no controller running) goes through the same clear door, so a waiting put-back is dropped from the marker there too — test red first	2026-10-29 12:59:41 +01:00
admin	5b3b541602	clear_hold (D64 = B) + the box command through the running controller (R-1343), R-1340, R-1341 — tests red first; commit only ... - clear_hold: a fifth verb in the closed operator-action list; lifts a hold of any reason in the RUNNING controller (memory + settings.json together), forgets the update's held flag, drops a waiting put-back from the app-stop marker (copy kept). Refused on a bad name or no hold. No new event type. - --clear-restore-hold asks the running controller over <data dir>/ctl/hold.sock (unix, 0600, peer uid checked, no TCP); edits settings.json only when no controller answers, and says so (in-guest restart). - R-1340: the operator's HELD STOPPED mail is built from the hold record (restore kind, mixed cause, failed put-back step, database replay or not, kept copy) — never the option-C database story by default. - R-1341: the OOM WARN line once per new kill (container, start time, kill count); event unchanged.	2026-10-29 12:49:46 +01:00
admin	c7bb776e00	REPORT: R-1342 after the release (fixed on main 652a690, not released)	2026-10-29 11:16:36 +01:00
admin	652a690e5d	R-1342: a restore copy under the stable-start watch is not deletable (D62 gap); an app removed during the watch raises no alarm — tests red first; commit only	2026-10-29 11:16:13 +01:00
admin	6c72e3ff34	v0.347.0 RELEASED (the global floor, MinAgent 0.158.1): CHANGELOG heading, CONTEXT, REPORT	2026-10-29 10:48:22 +01:00
admin	fd75c7c717	v0.347.0: CHANGELOG heading (D62, R-1256 all proven live, R-1254 controller half, R-528, 404) — the release build's commit	2026-10-29 09:55:42 +01:00
admin	e3fce09d96	D62: restore copies kept 30 days, listed with their date, deletable by hand (typed name, never a needed copy, operator event); D63: a test-build-only fault switch for the R-1256 H4/H5 live proofs — tests red first	2026-10-29 08:50:59 +01:00
admin	a815b37fbd	Night 2026-10-28 docs: REPORT (H5 + H8 live on 9202, teardown), README (restore edges, host OOM count — unreleased), CONTEXT, CHANGELOG live line	2026-10-29 05:14:05 +01:00
admin	20c5877056	An action on a name that is no app answers 404, not 'settings cannot be saved' (found walking capability map B2 on 9202) ... Test TestAnActionOnANameThatIsNoAppIsA404 red first. Commit only.	2026-10-28 23:56:36 +01:00
admin	eed23e7594	R-528: the 30-s OOM scan also reads the host's per-container kernel counter (agent GET /guest/oom-kills) ... A count above 0 in a running container's current run fires the existing app_oom line (source cgroup/docker in the details), whatever Docker's OOMKilled says. Old agent: 404 back-off; no agent: Docker's flag only. Tests TestR528_* red first / red-proved. Commit only.	2026-10-28 23:22:46 +01:00
admin	e33cffaee1	R-1254 (controller half): escrow claim/confirm outwait the agent (60 s); an unknown confirm outcome promises nothing ... 504 from the agent (it cannot learn which package the hub holds) or a failed call -> api.escrow.confirm_store_unknown (hu+en); only 502 keeps 'your previous code still works'. Tests TestR1254_* red before the fix. Commit only.	2026-10-28 22:59:52 +01:00
admin	342a394bff	R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first ... H4: a failed definition write in the off-site restore writes the live definition back before the start; a failed write-back holds the app (restore_mixed). H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut); a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge). H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu; every web handler and the kept loads begin through it; install-time kept load asks about the mirror too. H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore running, and older than 14 days. Commit only; rides the next controller release.	2026-10-28 22:24:16 +01:00
admin	ed3927f03a	REPORT: controller v0.346.0 released; R-1250 fixed the same day	2026-10-27 15:49:59 +01:00
admin	5ba1b86293	v0.346.1: SECURITY — traefik v3.7.16, the file manager 1.5.8-stable, cloudflared 2026.10.4 (felhom.eu R-1304, R-1305); test TestEnsureTraefik_ANewImageRecreatesTraefik (red first) ... Built from the v0.346.0 release commit b1b9be3 + this one commit. MinAgent 0.158.1 (unchanged).	2026-10-27 15:48:38 +01:00
admin	b1b9be3a8e	v0.346.0: CHANGELOG header — the release (MinAgent 0.158.1, unchanged)	2026-10-27 15:07:25 +01:00
admin	710ceace12	fix(R-1250): the line-test hold waits until the held app has really slowed down before asking the agent ... Measured on demo-hp 2026-10-27: qBittorrent 5.2.4 kept sending at full speed for ~14 s after its limit fell to 1 KiB/s; the agent reads the uplink 5-15 s after the call, so every test on request was refused "not quiet" (four tries in an hour, 4.0-4.2 Mbit/s). waitDrained polls each held app's own upload (qBittorrent up_info_speed, Transmission uploadSpeed) until <= 16 KiB/s twice, 2 s apart, at most 90 s; an unreadable speed waits 20 s. Tests TestR1250_* (five), red-proved by four mutations.	2026-10-27 13:23:00 +01:00
admin	9b5bb0a9a6	REPORT-security-watch: the pin list for the security watch (felhom.eu R-1303). Docs only.	2026-10-26 23:55:06 +01:00
admin	e01eb64b25	R-1303: every pin names its security-notice source (upstream.txt, # upstream: above each FROM); gate upstream + decoys. No runtime change.	2026-10-26 23:23:36 +01:00
admin	37f7e40b18	CHANGELOG: the unreleased header names every fix it carries (D53, R-1220, R-1218, R-1219, R-1187, R-1298, R-972)	2026-10-26 22:21:29 +01:00
admin	90a2530689	fix(R-1187): the .fab import loads the database through the backup side (mariadb-admin/mariadb, the container's own credentials) ... Found live on 9202: every MariaDB 11+ import timed out (mysqladmin/mysql absent). Red-proved.	2026-10-26 21:58:11 +01:00
admin	5d07c4e923	REPORT-cloudflared-0.345.1: the v0.345.1 security release (R-1300) — a sibling of REPORT.md (the night session owns it). Docs only.	2026-10-26 21:44:07 +01:00
admin	a3ed63ee9a	fix(R-1187): the import's compose runs get the controller's path variables; a compose warning is never read as the container id ... Found live on 9202 (grimmory import timed out on the DB step and left the app down). Red-proved.	2026-10-26 21:38:47 +01:00
admin	a1c65b3d81	R-1300: SECURITY — cloudflared 2026.10.3 on main (same change as tag v0.345.1); build.sh may push from the pushed tag v<VERSION> ... infra.CloudflaredImage 2026.9.3 -> 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20) and TestEnsureCloudflared_ANewImageRecreatesTheTunnel (red-proved). build.sh: a --push may build from the tag v<VERSION> as the server has it, pointing at HEAD (operator's yes 2026-10-26); four new cases in test_build_push_once.sh, red-proved both ways. MinAgent 0.158.1 unchanged.	2026-10-26 21:01:40 +01:00
admin	2560cf1779	build(R-972): Go 1.27.3 + golang:1.27.3-trixie builder (GO-2026-6809) — govulncheck 1 → 0 called	2026-10-26 20:42:35 +01:00
admin	cccb9aee84	fix(R-1187 b): restored links point only downward — no absolute target, no '..', no link on the way ... Third automated security review finding, red-proved.	2026-10-26 20:33:26 +01:00
admin	f24233c829	fix(R-1187 b): refuse a link whose parent path passes through a link; born keys listed; psql --set ... Second automated security review finding, red-proved. The go-parity and docker -v gates that refused the push are green.	2026-10-26 20:30:34 +01:00
admin	106325de43	fix(R-1187 b): the import writes only through os.Root — never through a link that leaves the app's folder ... Found by the automated security review of dfd0f8e. Red-proved. Commit only.	2026-10-26 20:28:04 +01:00
admin	b156e4526a	fix(R-1298): held-app reports only for installed apps (a restore hold always) ... Red-proved. Commit only.	2026-10-26 20:26:44 +01:00
admin	dfd0f8ec53	fix(R-1187 a,b,d,f,g): .fab — links carried and restored safely, FIFOs refused, owners kept, busy and bad-path refusals, postgis + ON_ERROR_STOP ... Red-proved (6 tests). Commit only.	2026-10-26 20:26:02 +01:00
admin	1170b48e59	fix(R-1218, R-1219): stage the off-site password when its file exists; no recovery ceremony during a recovery offer ... R-1218: escrowStart stages when OffboxRepoPasswordOnBox() (not OffboxConfigured()). R-1219: the top bar hides during an offer; the start handler answers 409 (api.escrow.recovery_offer_open, hu+en) before staging. Red-proved. Commit only.	2026-10-26 20:20:59 +01:00
admin	7e15a374b2	fix(R-1220): an unreadable app.yaml counts as installed — its folders are never kept data ... liveDriveBinds(drives): an app whose app.yaml exists but does not parse binds every folder its compose names on every drive (fail closed); WARN per app. Red-proved (the live folder was listed). Commit only.	2026-10-26 20:13:44 +01:00
admin	e333477b11	docs: REPORT — D53 (committed, not released; live-proven on 9202 against a test hub)	2026-10-26 19:16:59 +01:00
admin	5bd03ad152	feat(D53): the hub learns which apps are held — app_held / app_hold_cleared, daily repeat ... internal/holdreport: one observer of the hold store, ticked every minute; app_held for a new or changed hold (stack_name, reason, since, why), app_hold_cleared when gone (also while the controller was down: settings.reported_holds), every hold again daily and at start. Severity info. RestoreHold.Why/WireReason (holdWhy calls it). 8 tests, red-proved (inert Tick; unwired scheduler line). Commit only (felhom.eu 08 §10).	2026-10-26 18:23:54 +01:00
admin	20cf4bccfd	docs: CONTEXT — D53 ruled, the held-app report is next (felhom.eu 08 §10)	2026-10-26 18:07:22 +01:00
admin	5ce54a5076	REPORT: the 2026-10-26 afternoon run. Docs only.	2026-10-26 14:37:53 +01:00
admin	6bfb784c4d	v0.345.0: release header (R-1292, live on Tester 1); README	2026-10-26 14:12:37 +01:00
admin	26191911c4	R-1292: qBittorrent's 50 % rule owns the NORMAL limit only (up_limit through app/preferences), never the current speed mode's slot. Test with the alternative mode on, red-proved. Commit only.	2026-10-26 13:01:31 +01:00
admin	3d711ee611	REPORT: the 2026-10-26 attended release run; CHANGELOG: v0.344.0 RELEASED (floor 09:07:47 UTC). Docs only.	2026-10-26 10:37:41 +01:00
admin	0a59044105	v0.344.0: release header (upgrade note: the file manager restarts once); README — R-1261, R-1281, R-1288, R-1278, R-1286, R-1282	2026-10-26 09:04:30 +01:00
admin	9c1dfdd71f	REPORT: the 2026-10-25 night — committed fixes, CI by hash, teardown. Docs only.	2026-10-25 23:53:46 +01:00
admin	fbec5cb499	R-1278: the install page says when a backup of an earlier install is kept and links the restore page (HU and EN). Red-proved. Commit only.	2026-10-25 23:32:01 +01:00
admin	7ea942a118	R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.	2026-10-25 22:26:45 +01:00
admin	838c834169	R-1286: a held app says why it is held — each hold reason gets its own sentence in the start gate, the boot sweep and --restore-holds (an unhealthy stop read as a failed restore). Red-proved. Commit only.	2026-10-25 22:05:23 +01:00
admin	b5863a96eb	R-1288: a restore of a set-aside unit sets the replaced install's unit aside at once, with no alarm. R-1282: the later media restart time is stored and resumed at start, once. Red-proved. Commit only.	2026-10-25 21:37:55 +01:00
admin	a79a292d72	R-1261: the line hold holds every running seeder, drops the record of an app removed while held, and puts back the qBittorrent slot it held (alternative speed). Red-proved. Commit only.	2026-10-25 20:38:28 +01:00
admin	fe9837708a	v0.343.0 released (global floor 17:53:42 UTC on the operator's yes): CHANGELOG header, REPORT	2026-10-25 19:02:08 +01:00
admin	e2a976198d	v0.343.0: release header; README — fix A (stable start), fix B (.fab downloads first), D47 set-aside line	2026-10-25 18:02:52 +01:00
admin	935e624f10	D47 follow-up: a set-aside tells the operator once (backup_run_failures, leg unit-set-aside, both identities, own run id). Red-proved. Commit only.	2026-10-25 17:19:08 +01:00
admin	3a1f09d29f	Fix A (found live on 9202): the container sampler reads docker inspect JSON — a -f template stopped at 'no entry for key Health' for every app without a healthcheck, so a healthy restore read 'not started'. Commit only.	2026-10-25 17:02:32 +01:00
admin	1ee0353dbd	Fix A: the container sampler keeps Docker's stderr in its error (a live run on 9202 logged only 'exit status 1'). Commit only.	2026-10-25 16:56:04 +01:00
admin	35232de80d	Fix A: the stable-start sampler says at DEBUG why a sample is not ok (a live run on 9202 judged a healthy app unstable; the reason was not logged). Commit only.	2026-10-25 16:43:57 +01:00
admin	2149a13378	Fix A, the page too: the restore's first verdict needs a stable 45 s after the 90 s health wait on every path, so an app that runs, crashes and restarts reads „not started yet”; the copy still waits the full 3 minutes. Red-proved. Commit only.	2026-10-25 13:06:06 +01:00
admin	7720439440	D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.	2026-10-25 12:45:33 +01:00
admin	e8d2151a77	Restore-truth run close-out: REPORT (D47, D48, R-1270, R-1271; CI by hash; live proofs on 9202). Commit only.	2026-10-25 11:00:09 +01:00
admin	1f8295918e	R-1270 follow-up (found live on 9202): remove with „delete its backups too” deletes the app's restore-undo folder too — a not-started restore's kept copy outlived the remove; the wiring test also pins the D47 set-aside removal. Red-proved. Commit only.	2026-10-25 10:36:20 +01:00
admin	1f9c863f79	D47 follow-up (found live on 9202): the kept-copies list („Megőrzött másolatok”) shows on a box without off-site too — it sat only inside the off-site card, so 9202 never listed a set-aside unit or a D25 copy; one named template, two call sites, parity fixtures unchanged. Red-proved. Commit only.	2026-10-25 10:01:56 +01:00
admin	bd9f4f7b74	R-1271 (P2): „use my kept data” never takes a copy dated in the future — a copy more than 10 minutes past the box's clock never counts as the newest (the newest true date wins, tie local); alone it is still offered, said and not recommended. Red-proved. Commit only.	2026-10-25 09:44:56 +01:00
admin	2d71270858	D48: a restore downloads first — every restore path resolves and pulls every image of the definition that will run before the stop, under the image-work lock held until the restore returns; a failed pull refuses with the app untouched (a deleted version and a busy registry read differently), one operator line. Red-proved. Commit only.	2026-10-25 09:38:28 +01:00
admin	b680db85cb	R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.	2026-10-25 09:33:26 +01:00
admin	02daebe9c5	D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.	2026-10-25 09:27:48 +01:00
admin	e1613aea8d	Restore-holes run close-out: README, CONTEXT, REPORT; the interrupted-restore log line names a waiting put-back. Commit only.	2026-10-24 21:03:34 +02:00
admin	c9b4b82dc7	R-1253 (P2): an export that stops its app refuses while another operation (a restore) holds the app-stop marker — its Undo is never replaced. Commit only.	2026-10-24 20:29:59 +02:00
admin	518a13592d	R-1252 (P2): a rejected or absent backup block never deletes second-drive copies — reconcile only on a valid classification; a rejected block is said on the app's status and once a day to the operator (backup_run_failures); kept copies stay kept (H2); Remove drops the kept records it deleted (H9). Commit only.	2026-10-24 20:07:16 +02:00
admin	062f9b41d9	R-1251: sync the restore copy's folders before the marker names it (a cut left undo.json as .tmp on Tester 1); the interrupted-restore record says the put-back waits, not 'run it again'. Commit only.	2026-10-24 19:36:32 +02:00
admin	bb2809dc68	R-1251 (P1): a pending put-back blocks every start — a cut restore's copy on an unbound drive waits (a restore hold), is poured back when the drive binds before any start; a failed put-back holds the app (H2); Stop during a restore still puts back (H7). Commit only, unreleased.	2026-10-24 19:07:02 +02:00
admin	2449223f10	Review round 2 docs: REUSE.md — D22 released (v0.338.0), recordInstalledImages callers, a row for the stray-copy seams; no code change	2026-10-24 16:00:25 +02:00
admin	b01bb4b88d	Review round 2: a media restart no longer starts an app the household stopped (R-721); the file manager's header name file appears whole (R-1100 race, 44/300 -> 0/300); both red-proved; unreleased	2026-10-24 15:26:56 +02:00
admin	321df1f87a	README §8e + REPORT: R-1250 hold, live proof on demo-hp	2026-10-24 13:48:15 +02:00
admin	046b808792	upwatch: hold a seeding torrent app for one line test, then put its limit back exactly (R-1250) ... When the agent waits for quiet and qBittorrent or Transmission runs: record the limit first, hold at 1 KiB/s, ask the agent for a test on request, put the old limit back (deferred; a household change during the test stays). Start-up puts back a limit a killed controller left; the 50 % rule skips while a hold record exists. Commit only.	2026-10-24 13:19:07 +02:00
admin	bddc477e22	CHANGELOG: v0.342.0 released (the upload and CPU watch, the tested line, qBittorrent's limit); REPORT	2026-10-24 10:28:53 +02:00
admin	42cda07b42	v0.342.0 (unreleased): the watch's start line no longer says the line is learnt only from the off-site push	2026-10-24 09:58:13 +02:00
admin	ed1011b088	v0.342.0 (unreleased): the upload watch reads the host's weekly line test (GET /host/line-test, agent >= 0.164.0); qBittorrent's limit = 50 % of the TESTED line only (D41), the watch uses the higher of test and push floor, the system page names the source; red-proved	2026-10-24 08:59:57 +02:00
admin	60e487db51	docs: v0.342.0 (unreleased) — CONTEXT note and REPORT for the upload watch; live proofs on scratch 9202	2026-10-23 22:56:39 +02:00
admin	a9c1997fbc	v0.342.0 (unreleased): the upload and CPU watch — an app that sends or burns far more than its own numbers explain is one operator-only alarm; the line learnt from the off-site push; qBittorrent's default upload limit (never over the household's) ... internal/upwatch: exact per-container counters from the Docker Engine API, per-app judging (upload >= max(5 Mbit/s, 25% of the line) for 15 min; CPU >= max(150%, 50% x cores) for 30 min), explainers qBittorrent / Transmission / Plex, app_unexplained_upload / app_unexplained_cpu + _cleared (hub 0.169.0). The off-site push is sampled once a second for the line (a lower bound). qBittorrent limit = 50% of the line, the household's limit always wins. 20 red-proofs. Spike + design: felhom.eu audits/SPIKE-upload-watch-2026-10-23.md, architecture/08 section 9. Not released.	2026-10-23 21:26:09 +02:00
adminandClaude Opus 5.5	277e99839d	docs: v0.341.0 released — global floor 11:24 UTC on the operator's yes, MinAgent 0.158.1; the live proofs in REPORT (no code change) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:30:54 +02:00
adminandClaude Opus 5.5	63dcccfeec	v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:09:52 +02:00
admin	32e61d5d1d	REPORT: day 2026-10-23 — controller 0.340.0 released (floor 06:41 UTC, MinAgent 0.158.1)	2026-10-23 11:07:44 +02:00
admin	caaa86eb3c	v0.340.0: release — the capped night copy that never outlives the controller (R-1214 + stray-copy fix), Immich's model cache out of backups (R-49), no import over a stopped app (R-1187 c), the catch-up checks (R-1189 d, C5); MinAgent 0.158.1	2026-10-23 08:19:45 +02:00
admin	23f77f93ba	night 2026-10-23 docs: CONTEXT (0.340.0 candidate), REPORT (both review rounds, rc.8 re-proof), the OffsiteStateAwaitingRecoveryKey comment corrected (its hub claim was measured false: felhom.eu R-1230); no behaviour change	2026-10-23 00:05:34 +02:00
admin	1babfe94f6	Second-drive copy: two races closed — the start-up/retry removal holds the destination's lock (a copy this process starts is never removed), and a run records itself in one step with the restore check, every leg asking again; red-proved, race-clean; unreleased	2026-10-22 22:58:33 +02:00
admin	9d9e4041c9	Second review of the night's own code: a stray clears when a later removal works (N2), the start-up check never removes this process's own copy (N3), one copy per destination at a time (N4), RunTier2 refuses during a restore for every caller (N5), the import refusal no longer advises removal (N9); red-proved, race-clean; README; REPORT; unreleased	2026-10-22 22:45:42 +02:00
admin	943c517550	Review fixes for 0.340.0: C5 a catch-up releases the whole-guest backup when its backup legs end (red-proved); C3 the R-1187 c refusal text fits an unhealthy app; C6 two comments; C8 README backup.volumes wording; unreleased	2026-10-22 21:25:48 +02:00
admin	912e59210d	Stray-copy fix: the copy container runs with --no-healthcheck (the image's controller health check showed it as starting on the 9202 proof); unreleased	2026-10-22 20:39:05 +02:00
admin	66a69d4954	Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased	2026-10-22 20:20:35 +02:00
adminandClaude Opus 5.5	df78b6caae	night 2026-10-22: README (backup.volumes excluded, the capped second-drive copy), CONTEXT, REPORT — four fixes on main, not released (0.340.0 next) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-22 18:11:45 +02:00
admin	ae394670c1	R-1214: the capped copy refuses any path with a symlink in it (security review: a link under /mnt pointing outside resolves elsewhere for the daemon); red-proved; unreleased	2026-10-22 17:51:14 +02:00
admin	03c0a693b8	R-1214: the second-drive copy runs in a 512 MB memory-capped container for /mnt paths (its page cache no longer evicts the apps) — measured on 9202; guarded against a path the daemon sees differently; unreleased	2026-10-22 17:47:19 +02:00
admin	d5f88a2182	R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased	2026-10-22 17:27:56 +02:00
admin	6a17c95815	R-49 (D21 = B): a template may exclude a named volume from every backup (backup.volumes, class excluded) — Immich's model cache; guarded, red-proved; unreleased	2026-10-22 16:21:38 +02:00
admin	cbc944c3c0	REPORT: v0.339.0 released (R-1199 reopened, R-1216)	2026-10-22 13:15:42 +02:00
admin	fc5a20f40a	v0.339.0: release — the household's mail list never overwritten (R-1199 reopened), the swap sentence only when swap is really short (R-1216); MinAgent 0.158.1	2026-10-22 12:57:24 +02:00
admin	add310c80a	R-1199 reopened: a box with no list of its own reads the household's from the hub and adopts it, pushes its default once only when no household saved one; every push names its source; an empty saved list stays empty; R-1216 (D28 = A): the install page's swap sentence only when host swap is really short (shared case table); unreleased	2026-10-22 12:13:26 +02:00
admin	08fa440d04	REPORT: v0.338.0 released (operator yes 2026-10-22): 3 test boxes through the floor, checks green, global floor set	2026-10-22 10:39:43 +02:00
admin	7900a32695	v0.338.0: release (operator yes 2026-10-22) — D22 restore put-back, first-hour words, swap sentence, R-1199; MinAgent 0.158.1	2026-10-22 09:51:27 +02:00
admin	1de8a559ed	REPORT: the night of 2026-10-21 (D22, words, R-1199; rc.2), unreleased	2026-10-22 00:06:36 +02:00
admin	f0abdd0eda	CHANGELOG: blank line before v0.337.0	2026-10-21 23:41:10 +02:00
admin	ba22f9b2d9	R-1199: a box whose household never saved its notification choice pushes the default list its page shows at start, so the hub mails by it; unreleased	2026-10-21 23:40:21 +02:00