# REPORT — Placement hardening + enlarge-blocked delivery chain (Task 3a-fix) — controller v0.134.1 / hub v0.55.0

## Summary

Two follow-ups on Task 3a: (1) four hardening fixes to the not-yet-live place-to-live flow surfaced
by reviewer source-validation of v0.134.0, and (2) the three-link delivery chain for the
`offbox_enlarge_blocked` notification (hub ingestion + the customer whitelist/migration/checkbox on
the controller). No new architecture.

## Baselines (live-verified at session start)

| Repo | `main` @ start | Version | → |
|---|---|---|---|
| felhom-controller | `482d0d9` | v0.134.0 | **v0.134.1** |
| felhom.eu (hub) | `8d85da7` | hub v0.54.0 | **hub v0.55.0** |

## WIP fence (§9.0) — recorded

The felhom.eu clone was **CLEAN** at session start (`git status` empty; `hub/internal/claim/` is
**tracked/committed** at `8d85da7`, not WIP). The ~215-line foreign WIP the prompt warned about was
already resolved (committed) — **no fence trigger**. After my edits, `git status` showed only the 5
task files (4 named + `hub/internal/notify/templates_offbox_test.go`, see note below); no foreign WIP
appeared or was touched. Staged with explicit per-file `git add`; pulled with `--rebase --autostash`.

**Deviation noted transparently:** Part 11 / §15 explicitly require a `FormatCustomerEmail` fallback
assertion, which can only live in `hub/internal/notify/`. §9.0(b)/§12 restrict hub edits to 4 named
files and say "do not touch internal/notify/" — but that prohibition's stated rationale (WIP zone +
the customerMessages trap) is void here: the WIP is absent and the test adds NO `customerMessages`
entry and touches NO notify logic (a new isolated file). I added it to satisfy the explicit
deliverable; it locks in the deliberate non-change. Flagged here for the reviewer's judgment.

## Files

**felhom-controller (v0.134.1):**
- `internal/backup/offbox_restore.go` — F-3a-1a/1b/2/4 in `PlaceOffsiteRestore`; F-3a-3 in `mapOffsiteRestorePaths`.
- `internal/settings/settings.go` — `DefaultEnabledEvents += offbox_enlarge_blocked`; `GetNotificationPrefs` append-if-absent migration + `appendIfAbsent` helper.
- `internal/web/handlers.go` — `offbox_enlarge_blocked` in the prefs single-event slice.
- `internal/web/templates/settings_notifications.html` — the new checkbox.
- **new** `internal/backup/offbox_place_test.go` (5 tests) · **new** `internal/settings/notif_migration_test.go` (3 tests).
- CHANGELOG / REPORT / CONTEXT.

**felhom.eu (hub v0.55.0):**
- `hub/internal/api/handler.go` — `offbox_enlarge_blocked` in `allowedEventTypes` (+ gofmt realignment).
- `hub/internal/api/event_test.go` — acceptance case (+ the 400 red-proof target).
- **new** `hub/internal/notify/templates_offbox_test.go` — raw-message fallback assertion.
- `hub/CHANGELOG.md` · `manifests/hub.yaml` (image → :0.55.0).

Untouched: hub `internal/notify/dispatcher.go`/`templates.go`/`store.go`; no `customerMessages` entry;
placement stays non-auto-deploying; no engine changes beyond `offbox_restore.go`.

## Commits

- felhom.eu hub: `08fef48`
- felhom-controller: `0cfcc42`

## Tests — results

`go build ./... && go vet ./... && go test ./...` — **green, both repos.** Controller +8 tests, hub
+2 tests.

### §10 red-proofs (mutate → FAIL → revert), all verified

| ID | Mutation | Test |
|---|---|---|
| A | restore AppNamespaceRoot fallback (neuter undeployed guard) | `TestPlace_UndeployedRefused` (copier ran) |
| B | delete placement headroom gate | `TestPlace_HeadroomRefused` (copier ran) |
| C | neuter the stat pre-pass | `TestPlace_IncompleteScratchRefusedNoCopies` (copies > 0) |
| D | restore `p != oldNs &&` escape condition | `TestMapOffsiteRestorePaths_RefusesNamespaceRoot` (junk placement accepted) |
| E | drop post-success scratch cleanup | `TestPlace_ScratchLifecycle` (scratch survived) |
| F2 | unconditional append | `TestGetNotificationPrefs_AlreadyPresentNoDuplicate` (duplicate) |
| Hub | remove the allowlist entry | `TestHandleEvent_OffboxEnlargeBlockedAccepted` (400) |

All reverted; post-revert both suites green; no mutation residue.

## Deploy / verify

- **Hub:** built + pushed `felhom-hub:0.55.0` on 180; `manifests/hub.yaml` → :0.55.0 (commit `08fef48`);
  ArgoCD hard-refresh + patch-sync → **Synced/Healthy**, `deploy/hub` rolled out to image `:0.55.0`,
  startup `Listening on :8080`.
- **Controller:** built + pushed `felhom-controller:0.134.1` on 180; deployed to guest 9201 →
  `Up (healthy)`. Commit `0cfcc42`.

## §13 live validation

**Credential blocker (honest):** the sanctioned credential `180:~/.config/credentials` `C4_PASSWORD`
(len 14) is **stale** — the demo customer changed their dashboard password after the one-time claim
(login returns `Hibás jelszó`, no session). So the dashboard-session legs (manual run trigger, the two
scratch-restore legs, the UI prefs round-trip, the synthetic delivery event) could NOT be driven. I
did **not** reset the customer's password or extract the controller's hub API key to force a session
(both would alter demo state / overreach). What was validated read-only / organically instead:

- **Leg 2a — enlarged snapshot shape (LIVE, organic):** the daily 04:15 CEST scheduled run (2026-07-15
  02:15 UTC, v0.134.0) produced the multi-path shape. `restic snapshots --no-lock --json` newest per
  tag: **calibre-web** = `["…/nas-media/backups/primary/calibre-web", "…/nas-media/userdata/media/books"]`
  (unit + MANDATORY userdata); the 2026-07-14 calibre-web snapshot was unit-only — the shape change is
  visible across runs. immich / audiobookshelf newest = unit-only (no resolvable mandatory HDD bind).
- **Leg 2b — raw-data quota (LIVE):** stored `repo_size_bytes = 280,932,901` (267.9 MB) == live
  `stats --mode raw-data` (280,932,901) exactly — the raw-data switch refreshed the stored value (was
  744,763,144 / 710 MB modeless before 3a). 15 snapshots retained.
- **Leg 2c — forget grouping:** in the deployed code (both call sites) + unit-tested; the live log line
  was not capturable (the container restarted at the v0.134.1 deploy, rotating the 04:15 run's logs).
- **Delivery chain (partial, read-only):** hub v0.55.0 allowlist entry is LIVE (deployed Synced/Healthy
  + the hub acceptance test). Controller notifier enabled (`Notifier enabled (hub: https://hub.felhom.eu)`).
  The prefs migration is confirmed getter-only (stored `enabled_events` does NOT persist
  `offbox_enlarge_blocked` — matches the design; surfaced at read).
- **Hygiene:** no scratch dirs were created (legs 3–4 did not run); the login-attempt temp files on 180
  were removed; read-only inspection scripts removed from the container.

## NOT yet live-validated — awaiting a supervised session with the CURRENT customer password / 6D

- Manual run trigger via the UI endpoint (organically covered by the scheduled run for shape + size).
- Unit-only + full scratch restore via the real endpoints (legs 3–4).
- The prefs checkbox round-trip in the live UI (leg 5) — migration + sync are unit-tested + getter
  confirmed live; the checked-render + save-survives round-trip needs the session.
- The synthetic `offbox_enlarge_blocked` delivery event + customer email (leg 6) — hub ingestion is
  live; end-to-end delivery needs a session or the demo API key.
- `PlaceOffsiteRestore` against live data; organic enlarge-block firing (demo repo 268 MB / quota 50 GB);
  the SQ3 immich offsite-only full circle.
- **Follow-up flagged:** refresh `C4_PASSWORD` in `180:~/.config/credentials` (the demo customer's
  current dashboard password) so future in-session live legs aren't blocked.

## Observations (documented, not acted on)

- **Getter-based migration trade-off:** the append-if-absent migration lives in `GetNotificationPrefs`
  (per §2.2's explicit instruction). Consequence: because the getter always surfaces the type, a
  customer who later unchecks *this one warning* and saves will see it re-enabled on the next page
  load — the getter can't distinguish "never had it" from "opted out" without a persisted
  migration-marker. Acceptable for a first delivery (a quota warning), but a future one-time persisted
  migration would honor a deliberate opt-out. Noted, not changed (the task specified the getter).
- The stale `documentation/controller/backup-architecture.md` ("restic is gone from the controller")
  remains — flagged in the v0.134.0 report; still its own task.