# Session 2026-06-13 — backlog-Medium cleanup + doc currency + live-drive runbook

Working/checkpoint log. Commit/push after each Part. Controller-only (agent v0.30.0 left alone).

## Progress log

- 23:1x — Start. Controller main `d6aacf2`, demo 9201 on v0.59.0 healthy. Verified the 6 backlog Mediums.
- **Backlog-Medium verdicts (commit d6aacf2):**
  - **M4** (SubdomainInUse I/O under RLock) — **FIXED** @ stacks/deploy.go:67-80 (collects dirs under RLock, RUnlock, then LoadAppConfig with lock released).
  - **M5** (MigrateEncryption encKey nil-check race) — **FIXED** @ stacks/manager.go:129-131 (nil-check now inside `m.mu.Lock()`; SetEncryptionKey writes under same lock).
  - **M6** (MigrateEncryption holds lock across I/O) — **FIXED-in-practice** @ stacks/manager.go:128-191 — lock still spans the I/O loop, but runs once at startup (main.go:154) strictly before scheduler (`sched.Start`) and HTTP server; nothing concurrent to block. Acceptable, no action.
  - **M18** (ListDumpFiles re-validates every dump every 5min) — **LIVE** @ appbackup/dbdump.go:469. Perf; cross-package-entangled (settings cache has no size/modtime; signature change + bridge). → escape-hatch branch.
  - **M19** (deriveStackName naive suffix-strip) — **LIVE** @ appbackup/dbdump.go:536-551. Low-incidence correctness (misattributes a stack literally named `<x>-cache`/`-db`); needs deployed-stack list injected into appbackup. → escape-hatch branch.
  - **M25** (Server integrationMgr data race) — **LIVE** @ web/server.go:119-120 (constructor launches `go SyncFileBrowserMounts`) vs :162 `SetIntegrationManager` (post-construction, unsynchronized) read at handlers.go:358,360,1433. Real race. → clean fix (atomic.Pointer), ship in v0.60.0.

## Plan
- Ship **M25** (atomic.Pointer) in controller **v0.60.0** + concurrency `-race` test.
- **M18 / M19** → `fix/m18-*` / `fix/m19-*` branches (pushed, NOT deployed) with implemented fix + notes (escape hatch: entangled cross-package changes, not forced at 2am).
- Part 2 docs, Part 3 runbook.

## PART 1 — DONE
- M4/M5/M6: FIXED (no action). M25: fixed (atomic.Pointer) `6953899`; CHANGELOG v0.60.0 `7dd1aba`.
- M25 `-race` proven clean on the build server. M18/M19: notes + fix plan on `fix/m18-dump-validation-cache` / `fix/m19-stackname-crossref` (pushed, NOT deployed).
- **Deployed v0.60.0** to demo 9201 (rollback ref v0.59.0). Verified: `0.60.0 Up (healthy)`, self-test 6/0, "Controller elindult (0.60.0)", public `/api/health` 200, no errors. No rollback.

## PART 2 — docs: DONE
- `felhom-agent/CLAUDE.md`: stale v0.13.0 banner → v0.30.0 current-state summary (agent `238ec02`).
- `felhom-controller/CLAUDE.md`: corrected the WRONG "bulk strip has NOT happened" status → de-priv DONE (slice 8C); `CONTEXT.md` → v0.60.0 banner (ctrl `c67c53b`).
- Doc-gaps closed (felhom.eu `4c0eb2f`): hub v0.6.3→v0.11.0 (05 doc); onlyoffice:nextcloud occ internals (auth-hub-sync doc); metricsDBPath **verified** on the live guest (coincides with volume-backed data_dir → persists; hardcoding is latent fragility only) + storage doc note. REORG-NOTES updated (gaps 2/3 closed, 5 partial). Remaining gaps (volume-dump-consistency #1, selfUpdateAuthMiddleware #4, design-drafts 01/03/04) left flagged.
- controller/README.md slim-down: DEFERRED again (1987-line rewrite; banner already points to central docs — safety/budget).

## PART 3 — runbook: DONE
- `felhom-controller/RUNBOOK-e2e-live-drive.md` written for tomorrow's supervised drive. 8 sections, non-destructive first (baseline → deploy happy → **CTRL-T2-1 crash-window probe** → **CTRL-001 import + traversal-negative** → backup 3-2-1 → **AGENT-001 wipe-gate refusals**), then **[DESTRUCTIVE] restore** last. Each step: exact UI path/API call, what "good" looks like, what to watch for. All routes verified against current source.

## ALL PARTS DONE.