# REPORT — storage lifecycle completion + acceptance sweep (controller half) → v0.68.1 (2026-06-15)

## Type
Finished the storage lifecycle on the intermediary-mount model + drove a full live acceptance sweep
(incl. a real host reboot). Built + Linux-gated + deployed to guest 9201 per commit. Pairs with agent
v0.36.7. Full audit: `felhom.eu/documentation/audits/storage-lifecycle-acceptance-2026-06-15.md`.

## What changed (controller)
- **v0.68.0** — H2/H3/M1/M3 + deterministic boot-id:
  - **Boot-id determinism** (`processGuestBootChange` + `settings.LastGuestBootID`): the agent reports
    `guest_boot_id`; on change the controller recreates drive-backed apps deterministically (replaces the
    fragile container-uptime sample, which missed apps stopped at the sample instant).
  - **H2** decommission UI button (migrate / decommission-anyway type-to-confirm); **H3** one-click
    re-enroll of a decommissioned drive (`handleStorageReconnect` decommissioned branch); **M1**
    `defaultPromotionTarget` (auto-promote on decommission-of-default, BLOCK if it's the only drive);
    **M3** migrate merge-walk re-asserts 2775 setgid on userdata dirs (`isUserdataDir`).
  - Fixed the H1 `{path}`/`{where}` JS body mismatch.
- **v0.68.1** — boot-id recreate ALL deployed drive-backed present apps **state-independent** (v0.68.0
  filtered on container state and **missed 5 apps** docker hadn't auto-restarted yet — caught in the live
  host-reboot test).

Non-hollow tests + companions: `TestShouldRecreateOnBoot` (old sample missed a stale/stopped app),
`TestDefaultPromotionTarget`, `TestIsUserdataDir`.

## Acceptance sweep (live) — per-item PASS in the audit doc
HOST REBOOT (✅ ordering + auto-start + convergence, no manual intervention), guest reboot ×3, drive-yank
fail-close (no leak), capability-proof fail-close, confinement, controller redeploy (rslave explicit),
two-drive isolation, **H2 decommission**, **H3 re-enroll** (after the agent v0.36.1 raw-stays-mounted
fix), **M1 default reassignment**, rapid eject/reconnect (single bind after the agent double-bind
root-cause fix). E14/E15 migrate-all not re-run live (M3 unit-tested + 2775 convention verified live).

## End state
Both external drives registered at `/mnt/felhom-drives/<name>`, felhom-flash default, 25 containers
healthy. controller v0.68.1 deployed (golden/bootstrap image tag mechanism).

## Known residuals
- Boot-id first-sight bounce (fresh controller recreates apps once on first start — one-time per
  data-volume lifetime).
- E14/E15 full migrate-all round-trip not re-run live (data-merge risk; M3 unit-tested).