# REPORT — TASK B1+B2 data migration + self-serve decommission → controller v0.65.0 (2026-06-14)

Customer-self-serve storage **migration** (move app data between drives) and **decommission** (retire a
drive), implemented trunk-based on `main` against the locked spike design
(`felhom.eu/documentation/audits/SPIKE-decommission-migration-2026-06-14.md`). Pairs with **agent
v0.32.0**. Each change carries non-hollow tests; the load-bearing companions were mutation-proven to
fail on the pre-fix code. Built + deployed both images to demo guest 9201 / felhom-pve.

> Validate against pushed source, not this report. **Live decommission/migration of real data is NOT
> yet validated — that is the supervised B3 session (see the end).**

## Confirmed baselines
- Controller `main` was `c37ee6d` = **v0.64.0** → shipped **v0.65.0**.
- Agent `main` was `8e6d00a` = **v0.31.0** → shipped **v0.32.0**.

## Commits (controller repo unless noted)
| # | Commit | Scope |
|---|---|---|
| 1 | `b57150e` | B1 migration engine (`internal/stacks/migrate.go`, MigrateAll+MigrateApp) + tests + main wiring + backup mutual-exclusion (Change 3) |
| 2 | `16a4c3e` | B1 UI — `/api/storage/migrate{,-app,/status}` + settings.html & app_info.html + progress panel |
| 3 | `f43697c` (felhom-agent) | v0.32.0 — `POST /disks/decommission` + intent-aware `ReassertGuestBinds` + `GuestBindStore.Remove` + tests |
| 4 | `f2596ea` | B2b decommission orchestration + "Hiányzó tárhely" indicator + Change 4 re-enroll fix + tests |

## What shipped
- **B1 engine** — crash-safe, resumable, journaled (`<dataDir>/migration.json`). Pipeline validate → stop
  → copy (`rsync -a --checksum`, additive, **no `--delete`**; conflict-merge walk for non-app content) →
  verify (`rsync -ani --checksum`, zero pending) → flip+redeploy (`RedeployFromEnv`) → **cleanup gated on
  all-verified AND all-redeployed**. Two entry points (whole-namespace + per-app incl. SSD→drive) over one
  pipeline. Single-flight; mutually exclusive with the backup orchestrator (migration refuses while a
  backup runs; scheduled DB-dump/Tier-2 skip while a migration runs).
- **B1 UI** — migrate-all (settings page) + per-app "Áthelyezés másik tárhelyre" (app-info page) + shared
  status poll/progress panel.
- **B2a (agent)** — self-serve `POST /disks/decommission` mirroring eject (user-data role gate, no
  signature, never formats): intent=decommissioned + bind-prune + unmount. **`ReassertGuestBinds` is now
  intent-aware** (skips non-enrolled) — the F9-reconnect correctness fix. Operator-signed path untouched.
- **B2b** — `handleStorageDecommission` (migrate-all-or-none): migrate-then-decommission via the migration
  done-hook, or decommission-anyway (stop apps, keep HDD_PATH). `agentapi.Decommission` added. Soft-marker
  retained. **Change 4:** re-enroll clears the marker (`ClearDecommissioned` had zero callers before).
  **"Hiányzó tárhely"** badge for apps on a missing drive.

## Tests (per-commit green: `go build && go vet && go test ./...`)
- `internal/stacks/migrate_test.go` — siblingName, conflict-merge (differ→`(1)`, identical→dedup, re-run
  idempotent no `(1)(1)`, 3rd→`(2)`), assert-only verify, skip-dirs, cleanup-only-after-redeploy
  (+companion: redeploy-fail → source intact), verify-catches-corruption, resume (no re-copy),
  collision-refused, backup-exclusion, single-flight, SSD→drive resolution, cleanup gate.
- `internal/backup/migration_exclusion_test.go` — scheduled DB-dump **skipped** while migrating.
- `internal/web/decommission_test.go` — finalize soft-marks + calls agent (entry retained), re-enroll
  clears marker (Change 4), missing-storage label, unflagged-migration no-op.
- **Mutation-proven companions** (fail on pre-fix, pass after revert): migration collision guard, cleanup
  gate, Change-4 re-enroll clearing, and (agent) the intent-aware reassert (`disks.go` guard removed →
  decommissioned drive re-bound → test FAILS).

## Build / deploy / verify
- Built+pushed `gitea.dooplex.hu/admin/felhom-controller:0.65.0` (192.168.0.180); deployed to guest 9201
  via golden/bootstrap → `docker ps`: `:0.65.0 Up (healthy)`, clean startup (`controller_started (0.65.0)`,
  no errors), `GET /api/storage/migrate/status` → `{"job":null}` (idle, wired).
- Built agent v0.32.0 on 180; installed on felhom-pve (`/usr/local/bin/felhom-agent`, backup
  `.bak-0.31.0`), `systemctl restart felhom-agent` → active, `--version` 0.32.0.
- **Live-proven (incidental, safe):** on agent restart the new intent-aware re-assert logged
  `F9 re-assert: skipping non-enrolled drive (intent-gated) vmid=9201 durable_id=uuid:ce9d… intent=ejected`
  — the exact drive that lingered in `guest-binds.json` (B0 spike finding) is now correctly NOT re-bound.

## NOT yet live-validated — awaiting supervised B3
The real end-to-end UI flow with actual data was deliberately NOT run (per the task STOP):
- put data on a drive → decommission (migrate-to-another OR decommission-anyway) → verify data integrity
  end-to-end → drive un-enrolled and does NOT auto-mount/re-bind on reconnect → orphaned apps show
  "Hiányzó tárhely" → re-enroll clears it. Operator-present, real UI (no agent/CLI shortcuts, per the A4
  rule). The engine/endpoint logic is unit-proven and the intent-aware reassert is already proven live by
  the restart log above; the data-bearing round-trip is what B3 covers.