4 Commits

Author	SHA1	Message	Date
admin	80e6ad8c47	controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true ... R-650: internal/dockerexec — every docker exec routed through it; under go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub under the temp dir is allowed). api/stacks/web tests run under a silent stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide. R-640: a dump without its engine's completion marker is refused before the first mutation (unit + off-site restore) and again before any load. R-499: the Tier-2 page's system-disk sentence has four true branches. R-518: the backup button states the measured ~8 min stop. R-626: measured on 9202, not reproduced. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-23 20:25:28 +02:00
admin	7c05b59708	v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B) ... 179 Hungarian sentences were built deep inside a package with fmt.Errorf and printed by whoever caught them: too late to translate where they are shown, too early where they are made. Every one now carries its key across that gap. ZERO Hungarian error literals remain. util.MsgError does three things at once, each earned: - Error() is the Hungarian, byte for byte, so every un-converted printer is unchanged; - errors.Is answers for the kind AND for a wrapped cause (KindErrorf dropped the cause); - an error ARGUMENT renders recursively, so "formázás sikertelen: %w" translates whole. A foreign error — restic, docker, ssh, the stdlib — prints verbatim. It is not ours. 76 display sites go through errText, and TestNoErrErrorInPageOutput convicts any that do not. memoryVerdict returns an error rather than a sentence, so the deploy's 409 and the household's language come from one value; UpdateRefusal gained a Cause to carry it. Plurals, one rule, stated once: a key with .one/.other takes its COUNT first. Not a per-call-site flag — the producer somebody forgot would read "3 app is not running". The guard caught a real key collision (alert.deadapp.one) the day the rule landed. TWO DEFECTS FOUND IN MY OWN TOOLING, recorded rather than quietly fixed. The bulk converter silently dropped multi-line concatenations, damaging 7 producers — and the parity gate could not see it, because every surviving fragment WAS a real base literal while the CALL had lost text; two behaviour tests caught it. And the counting script was case-sensitive, so it said "0 left" while five remained. MinAgent: 0.131.0 (unchanged). No hub release needed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-18 11:44:30 +02:00
admin	fcef8e069c	one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a) ... THE WALK FOUND THREE MORE ENTRY POINTS THAN THE REPORT DID. R-411 named one missing acquireRunning. Fixing it and then pinning the invariant with an AST walk surfaced FOUR in total, all of which issued restic commands with no flag: RestoreOffboxScratch - the reported one OffboxRestorePrepareFull - the SECOND request in the customer's own two-step full-restore flow, and the one that actually shells `restic stats`. The UI reaches it FIRST, so flagging only the restore would have left the collision reachable by the ordinary path. RestoreSharesScratch - R-411's exact shape on the shares tier: unlockStale + resticStep, a live web caller, and its sibling PlaceSharesRestore has always taken the flag. RestoreOffbox - no production caller today, but the same dangerous pattern. Flagged rather than left for a future caller to inherit. OffsiteInventoryList is REGISTERED EXEMPT with its reason: it issues only `restic snapshots --json`, measured on demo-hp 2026-08-31 not to take a lock, and flagging it would make browsing a page refuse during a backup for no safety gain. THE REAL DELIVERABLE IS THE WALK, not the acquire. offbox_integrity.go:28 asserted "Every off-site operation takes acquireRunning" since v0.227.0, nothing checked it, and it was false for months - the ninth instance of this project's most-repeated class. The walk is an AST pass, not strings.Contains, because a commented-out call still contains the string. Red-proofed twice: removing the acquire fails it naming RestoreOffboxScratch; an unregistered fake entry point fails it naming the fake. R-407: "It NEVER writes to the repository" corrected in place, not deleted (R-360's rule). `check` takes a lock - and so does `restic stats`, which is the fact nobody had and the one that made R-411 possible. Both recorded where the next reader will meet them. R-414: the proof could not run at all on a box with no registered drive. Part 2.1's determination came out as neither "missed" nor "deliberate": R-356's own test comments say the scratch resolver "still resolves ... only the DESTINATION moves", so it was OUT OF SCOPE, and it was never ruled out on state-only grounds - the one comment about a systemDataPath fallback belonged to PlaceOffsiteRestore, concerned bulk USERDATA, and R-356 overruled even that. So 07 section 6.3's rule applies and now has a fourth consumer. The fallback is SCOPED, because the two callers ask different questions and one predicate answering both is the R-356 defect itself: a UNIT-ONLY restore may fall back to the system data path (07 section 7 records as FACT that a driveless app's unit already lives there indefinitely, and that the same-device placement is intended); a FULL restore keeps today's refusal, because it pulls bulk userdata onto a state-only tier. And the silence ends either way: a proof that cannot start now records ProofResultCannotRun rather than an Err, so last_proof_result is never ABSENT - absent already means "controller too old", and a second meaning on the same field is the StatsKnown trap one level up. It is recorded WITHOUT advancing per-snapshot due-ness, so the app stays retryable once a drive is registered. R-412 leg 1: a per-app push whose unit carried no dump and no tar now says so, at WARN. Wording only - no guard, and the capture is untouched (08 section 8.2). Leg 2 stays OPEN. 16 new tests, 1689 -> 1705. Full suite 28 packages rc=0, all 13 controller gates OK. Red-proofs run and reverted byte-identical for A3/B1 (twice), C1 and D1.	2026-09-01 10:19:36 +02:00
admin	900c870212	feat(shares): R-7b Parts 4-6 — shares restore, samba liveness, UI truth-up ... Part 4 — restore: RestoreSharesScratch + PlaceSharesRestore as SIBLINGS of the per-app scratch/place pair. Files merged missing-only (never overwriting), each destination PREFIX-ASSERTED against registered LIVE storage roots; definitions merged with existing-wins; ReconcileSamba via a seam (backup must not import stacks); credential restored best-effort into the samba named volume. New routes POST /backup/shares/{restore,place} + a restore-page entry that renders 'Megosztasok', never the raw reserved key. Also adds scratchJoin: reconstructing an absolute captured path under a scratch must strip the volume name rather than rely on filepath.Join. Part 5 — liveness: EffectiveProtected gains a settings-backed dynamic extra so the samba CONTAINER (not the stack name — they differ) is watched exactly while sharing is on. FINDING: the issue -> health 'fail' -> existing health_critical event -> alert -> Hungarian degradation e-mail path needs NO further change, and introduces no new event type, so the allowlist gotcha does not apply. Part 6 — UI: per-tier backup status lines on the Megosztas page (amber only on deviation). Verified the two warning-prose sites (offbox_capture/tier2_capture) only ever receive per-app stack names, so no mapping is needed there. RED-PROOFS RUN AND REVERTED (both fired): 4. prefix-assert removed -> place-guard traversal test FAILS 5. dynamic samba extra removed -> Scenario E enabled-case FAILS	2026-07-18 13:02:41 +02:00