# REPORT — controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true (2026-09-23)

Night shift 2026-09-23, Part A. R-650, R-640, R-499, R-518; R-626 measured. MinAgent 0.131.0 (unchanged).
No hub change. Full night record: `felhom.eu/documentation/audits/DRILL-night-2026-09-23.md`; evidence
`felhom.eu/documentation/audits/night-2026-09-23/A*`.

## Not done, or changed
- **R-518:** the brief said the page promises „csak néhány másodpercre". It does not — v0.243.0 removed
  that. The remaining vague „általában néhány perc" is replaced by the measured ~8 minutes.
- **R-626:** not reproduced, so not "fixed" — closed by measurement (below).
- R-640's "narrowed" scope held: the undo copies folders; only the three restore paths load dumps.

## What shipped
- **R-650:** `internal/dockerexec` (`Command`/`CommandContext`/`RunWithStub`). 77 docker exec sites routed
  through it. The sweep (trace of the guard's refusals, `A1-r650-sweep.txt`): `web` 67× `docker compose
  version`, 19× `docker ps`, 19× `docker info`, 10× `docker inspect felhom-samba`, 2× `docker exec
  felhom-samba`; `backup` 46× `docker ps`; `stacks` 11× `compose ps`, 4× `docker ps`, **1× `docker-compose
  down`**; `appexport` 7× `docker ps`; `system` 1× `docker info`; 8 `api` tests FAILED on the refusal
  (they built a real Manager). `api`/`stacks`/`web` → `TestMain` + `RunWithStub`; the rest pass on the refusal.
- **R-640:** `appbackup.CheckDumpComplete`; `incompleteDumps` gate in `RestoreFromRecoveryUnit` and
  `ReconstituteFromOffsite` before the first mutation; a second check in `reimportDBDumpsFrom` before any
  load. Test fixtures' fake dumps now end with the real markers (they did not — 38 tests red first).
- **R-499:** `systemBackupFact(resolveBackupTargetState)` → four branches on the Tier-2 page.
- **R-518:** two bundle strings, both languages, state the measured stop.

## Red-proofs (8, each seen failing, then restored; `git diff` clean on the reverted file)
1. R-650 guard disabled → `TestR650_RealDockerIsRefusedUnderGoTest`: `got <nil>`.
2. R-650 one bare `exec.CommandContext(ctx, "docker"…)` put back in dbdump.go → the sweep names `dbdump.go:140`.
3. R-640 replay check removed → `a cut-off copy was LOADED`.
4. R-640 unit gate removed → `stopped=true calls=[stop recreate startsvc:immich-postgres start]`.
5. R-640 off-site gate removed → the replay check still caught it, then a rollback — not the clean refusal.
6. R-499 handler not passing the fact → three branches missing on the page.
7. R-499 old sentence in the same-disk branch → `promises the backup protects this app`.
8. R-518 bundles back to v0.243.0 → measured downtime appears 0 times, old wording present.

## R-626, measured on 9202 (v0.266.0)
navidrome deployed and removed through the product; `docker events` for its compose project 390 s:
kill/stop/die/destroy seen (the positive observable), **no create**. Controller restarted at +150 s;
guest rebooted after. 0 containers, 0 volumes at every check. Leftover: `applied-compose.yml` +
`applied-meta/` stay in the stack dir after a remove (row filed).

## Gates
`go build/vet` rc 0; `go test -count=1 ./...` rc 0; `controller_gates.py` all OK (golden-notice advisory).