# REPORT — v0.263.0 → v0.263.2: a failed update puts the app back by itself (R-637)

2026-09-23. Baseline `b9deec19077b` (v0.262.1). Commits: `8fc2b4a` (v0.263.0), `5d38573` (v0.263.1),
`2cd6666` (v0.263.2). **MinAgent 0.131.0, unchanged.** Deployed: **scratch guest 9202 only**; the fleet
floor stays at 0.262.1 (the operator's question).

## What changed

- `internal/stacks/undo.go` (new): the folder copy (`volumeCopier`, docker helper), `tryUndo`, the
  applied `.felhom.yml` record, `last_update_undone`.
- `internal/stacks/update.go`: phase `copying` after the pull; `failAndHold` undoes first; journal
  phases `copying`/`undoing` with recovery; `restoreDefinition` split from `pinBack`;
  `waitUpdateHealthyMeta` (the undo's own probe, which runs on an `unhealthy` app); seam `probeRunFn`.
- `pin.go`, `deploy.go`: every pin writer records the pinned version's `.felhom.yml` (`applied-meta/`).
- `backup/`: `RestoreHold.UndoState`; the hold sentence's undo prefix + state clause (box language).
- `web/`: the undone line on the app page (request language). `api/`: R-642 start answer.
- `delete.go`: a removal deletes the app's kept undo copies.
- i18n: 10 keys born as keys (hu + en). `docker_run_volume_path_gate`: four named-volume mounts allowlisted.

## Tests and red-proofs

`go build ./... && go vet ./... && go test ./...` → rc=0 before each commit. Controller gates rc=0.
Twelve red-proofs, each seen failing and restored — table in `felhom.eu/REPORT.md` §3. Two of them
(9, 3b) reproduce the two live-only defects verbatim.

## Live (endpoint-level, 9202)

Three apps undone by the product with seeds before/after the backup and seconds before the press read
back; a cut-off copy held honestly (hu and en prefix); a power cut during `undoing` resumed and undone;
a person's press after an undo worked; removal deleted kept copies. Evidence:
`felhom.eu/documentation/audits/undo-live-2026-09-23/README.md`.

## NOT yet live-validated

- The household mail / operator event for an undo (not built — `09` §6.4 part 2).
- An app pinned BEFORE v0.263.2 that has not been re-pinned (R-646) — its undo probes with the
  current `.felhom.yml`; reasoned, not run live.
- Any box other than 9202.