# REPORT — controller v0.268.0 (2026-09-24)

Full record: `felhom.eu/documentation/audits/ladder-2026-09-24/README.md`.

## Not done, or changed

- The operator's English hold sentence lost „please" (house rule); Hungarian verbatim (R-516 ceiling 18 → 19).
- The hold names the newest whole copy, not a list of them (a list would need new copy).
- `TestR475_AdapterReadsEveryTier` asserted what R-659 changes on purpose; its assertion was replaced.
- `TestUndo_EveryPinWriterRecordsTheProbe` now checks `advancePinTo` (the writer moved there).

## Baselines

controller `80e6ad8c4772` (v0.267.0) → **`206b035`** (v0.268.0). MinAgent 0.131.0 (unchanged). Needs hub v0.122.0
for `app_hold_no_whole_copy`.

## What shipped

- **R-658:** `DeclaredVolumeNames` + `appVolumes` (definition selects, label cross-checks); restore creates labelled
  volumes (`composeVolumeLabelArgs`); `appVolumeSet` for the remove report.
- **R-659:** `backup.WholeOnTier`, `HoldCopies`, `HoldAfterFailedUpdateWhole`, `HoldNoWholeCopy`; `RestoreHold.NoWholeCopy`
  + `CopiesSeen`; `hold.update.no_whole_copy` (hu + en); Mentések button gated on both pages; `NotifyAppHoldNoWholeCopy`
  (critical) from the held-event sink; the held event's copy details now name the hold's copy.
- **R-660:** `backup.UpdateHeldStacks` + `updateHeldSet` unioned in `scanDeployedAppRunStates`.
- **R-651:** remove deletes `applied-compose.yml` and `applied-meta/`.
- **Ladder (`09` §6.4 part 5):** `stacks/ladder.go` (`LoadLadder`, `StepKey`, `StepFile`, `nextLadderStep`,
  `ladderStepsLeft`); `advancePinTo(src)`; `Stack.LadderStepsLeft`; the app page's steps line
  (`app_info.ladder_steps_left`, parity fixture `app_info_ladder_steps`).

## Tests (new) and red-proofs

`r658_undo_volumes_test.go` (3), `r658_restore_labels_test.go` (2), `r651_r658_remove_test.go` (2),
`r659_whole_copy_test.go` (9-case table + 2), `r659_held_page_test.go`, `r659_no_whole_copy_test.go`,
`r659_wiring_test.go`, `r660_held_not_down_test.go` (2), `r660_update_held_test.go`, `ladder_test.go` (6). Every
correctness test red-proofed — mutation and failing line in the audit's table. Green: `go build/vet/test` rc 0
(31 packages); `controller_gates.py` all OK.

## Deployed

9202 (scratch) by hand at 06:16Z; fleet by floor 0.268.0 at 06:47:13Z — demo-felhom and demo-hp healthy at +30 s.

## Live-validated (9202, endpoint-level)

A (undo after a v0.267.0 restore: 2 volumes copied by name, A+B read back; v0.268.0 restore labels), B (round 11:
sentence hu/en, no button on either page, event line), C (no `app_start_failed` for the held app; control fired;
applied files gone), D (romm two presses, two steps). **Not live-validated:** the event's delivery through a real
hub (9202 has none — the R-620 line is the observable); an engine step that FAILS and is undone.