v0.286.1: CHANGELOG (R-772 order fix found live; 0.286.0 never floored)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,19 @@
+## v0.286.1 — R-772 found live: a stopped probe container is seen on the next tick (2026-10-01)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings. **v0.286.0 was never floored**
+(scratch 9202 only); the fleet goes from 0.285.0 to 0.286.1 and takes everything in v0.286.0 below.
+
+- **R-772, measured live on 9202 with v0.286.0:** with a HEALTHY record 2 minutes old, stopping paperless-webserver
+  left the record `healthy: true` until its 5-minute interval ran out — the not-checked branch sat behind the interval
+  check. Finding the probe container costs no network call, so it now runs first: a stack with nothing to probe is
+  recorded not-checked on the very next tick. Test `TestRunHealthProbes_AStoppedContainerIsSeenAtOnce`; red-proof
+  RP-D1b (the 0.286.0 order fails it). Evidence `felhom.eu/documentation/audits/visitors-2026-10-01/D/`.
+- **Live on 9202 with v0.286.0 (unchanged in .1):** Part A — a stranger's 5 wrong dashboard logins through the simulated
+  tunnel, rotating a forged leftmost address, locked only him; the household signed in at once; a LAN or impostor
+  forgery counted as its own address (`…/A/L1-9202-live.txt`). R-773 — Karakeep removed (keeping backups) and restored:
+  record `opened_by: restore`, block file present, a stranger's `/signup` and `users.create` 403, the data back
+  (`…/D/r773-live.txt`).
+
 ## v0.286.0 — the box tells visitors apart (R-753); a health check that could not run is not "healthy" (R-772); a restore keeps the sign-up lock (R-773) (2026-10-01)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `login.msg.*` (3, both languages).

controller/internal/stacks/healthprobe.go

@@ -38,6 +38,16 @@ func (m *Manager) RunHealthProbes() error {
 			continue
 		}
 
+		// R-772 (measured live on 9202, v0.286.0): a container that stops is seen at once, not when the interval of the
+		// last HEALTHY result runs out (up to 5 minutes later) — finding the container costs no network call, so it is
+		// done before the interval check, and a stack with nothing to probe is recorded "not checked" on this tick.
+		containerName, candidates := findProbeContainerMeta(name, &stack.Meta, stack.Containers)
+		if containerName == "" {
+			skippedNoContainer++
+			noProbe = append(noProbe, noProbeStack{name: name, candidates: candidates})
+			continue
+		}
+
 		// Check if interval has elapsed since last probe.
 		// Fast 10s probes until healthy, then normal interval (default 5m).
 		// When HealthProbe is nil (just started/restarted), probe immediately.
@@ -58,16 +68,8 @@ func (m *Manager) RunHealthProbes() error {
 			}
 		}
 
-		// Find the main container to probe. R-630: a stack whose check resolves to no container
-		// used to be skipped SILENTLY — paperless-ngx's probe had therefore never run on any box,
-		// and nothing on any screen could say so. It now gets a RESULT that says why, so the app
-		// page can tell "checked and healthy" from "never checked".
-		containerName, candidates := findProbeContainerMeta(name, &stack.Meta, stack.Containers)
-		if containerName == "" {
-			skippedNoContainer++
-			noProbe = append(noProbe, noProbeStack{name: name, candidates: candidates})
-			continue
-		}
+		// R-630: a stack whose check resolves to no container used to be skipped SILENTLY — paperless-ngx's probe had
+		// therefore never run on any box. It gets a RESULT that says why (above, before the interval check).
 
 		targets = append(targets, probeTarget{
 			stackName:     name,

controller/internal/stacks/r772_not_checked_test.go

@@ -78,3 +78,16 @@ func TestProbeSaysUnhealthy_NotCheckedLeavesTheStateAlone(t *testing.T) {
 		t.Fatal("nil / healthy must not override")
 	}
 }
+
+// Measured live on 9202 (v0.286.0): with a HEALTHY record 2 minutes old, stopping the probe's container left the record
+// "healthy" until its 5-minute interval ran out. The missing container is now seen on the very next tick.
+func TestRunHealthProbes_AStoppedContainerIsSeenAtOnce(t *testing.T) {
+	m := r772Manager(time.Now())
+	st := r772Stack()
+	st.HealthProbe = &HealthProbeResult{Healthy: true, LastCheck: time.Now().Add(-2 * time.Minute)}
+	m.stacks["karakeep"] = st
+	_ = m.RunHealthProbes()
+	if hp := m.stacks["karakeep"].HealthProbe; hp.Healthy || !hp.NotChecked {
+		t.Fatalf("a stopped probe container must be recorded not checked on the next tick, got %+v", hp)
+	}
+}