# REPORT — controller v0.296.0 (2026-10-05, late afternoon): a cut-off backup run is said; honest "Mentés most" wording

Brief: the 2026-10-05 hub-safety brief (operator), Part E (R-518, R-519). Full session report:
`felhom.eu/REPORT-hub-safety-2026-10-05.md`. Architecture: `felhom.eu/documentation/architecture/07-backup-architecture.md`
(the restore-record paragraph and the R-518 lane-1 note), `09` decision 123.

## Baseline and commits

- Baseline `477e2548db` (v0.295.0). Commit `ff69074` → image `gitea.dooplex.hu/admin/felhom-controller:0.296.0`.
- **MinAgent 0.131.0** (unchanged). Golden 0.296.0 baked + vouched (`felhom.eu/documentation/tests/golden-0.296.0-2026-10-05/`).
- Delivered by per-customer floors (demo-hp, demo-felhom, tester-1 at 0.296.0): both demo boxes ran 0.296.0 (healthy)
  ~30 min later.

## What changed

- **R-519.** `internal/backup/run_record.go`: the app-data run is on record (`appdata-run.json`) while it runs; a start
  that finds it running turns it into a notice on /backups and /backups/apps, kept until a run ends with every step OK.
  After a restart the synthesised "last database backup" no longer reads OK over a cut run. Restore points were already
  dated by their OLDEST part (v0.275.0). Wired in `main()` (`loadRunRecordAtStartup`, AST-pinned).
- **R-518.** The whole-system "Mentés most" text and confirm now state two measurements: ≈6 min / 9 apps (demo-hp
  today: 09:19:08Z → last app back 09:24:55Z, local tier only) and ≈8 min / 12 apps (2026-09-14); "minutes, not seconds";
  longer when the off-site copy runs in the same run.

## Tests

`go build/vet/test ./...` green; controller gates green (golden-notice advisory before the bake). New: `TestRunRecord_*`
(3, incl. the production path through `runDBDumpsInternal`), `TestRunRecordAtStartup_FindsACutRun`,
`TestMainWiresRunRecord`, `TestR518_*` (both measurements, both pages and confirm), parity cases
`backups_interrupted_run`, `backups_apps_interrupted_run`; six parity fixtures re-captured for the changed copy (only the
copy lines differ). Red-proofs (4, all convict): `felhom.eu/documentation/audits/hub-safety-2026-10-05/partE/red-proof.txt`.

## NOT yet live-validated

- **The live cut on 9202** (restart the controller in the middle of a backup run, then read the page): the permission
  check refused restarting the controller mid-backup. The operator is asked; R-519 stays narrowed until then.