felhom-controller/REPORT.md

REPORT — any backup tier lets an app update, and the release header must state its MinAgent (2026-09-13)

Overwritten each run. This records the most recent implementation only.

Shipped as controller v0.239.0 and delivered to both demo guests by the managed floor alone (hub v0.112.0, declared MinAgent). No hand install. Scenarios G–M are tested; K, H, the failed update and the restore were walked live on demo-hp. Evidence: felhom.eu/documentation/audits/rulings-r472-r475-2026-09-13/.

1. What changed

Commit	What
f946b0d	controller/scripts/minagent_header_gate.py (fast, blocking): the newest ## vX.Y.Z block must hold a line starting **MinAgent: X.Y.Z**. Decoy test; registered in GATES, FINGERPRINTS and COVERS. Backfill: v0.233.0–v0.236.0 now read **MinAgent: 0.129.0** (unchanged) — v0.232.0's value; zero commits under internal/agentapi since 2026-09-01, highest featureMinAgent 0.129.0 (R-470).
b93c154	v0.239.0 (R-475): backup.Manager.UpdateRestorePoints walks Tier 2 → 1 → 3 and returns the first copy the caller accepts; stacks' freshRestorePoint is the one age rule; nothing anywhere → back up first; refused only when no copy AND CanBackUpApp is false. RunAppBackupNow treats a Tier-2 failure as a WARN and marks the captured unit proven current. The hold stores copy_tier and names the tier; old holds keep their sentence. A successful off-site restore now clears an update hold. The backups page still calls Tier2UnitRestorePoint.

2. Tests and red-proofs

• Go gate green per commit: go build ./... && go vet ./... && go test ./... (28 packages ok).
• controller_gates.py --fast green; test_controller_gates.py and test_gate_decoys.py green.
• New tests: internal/stacks/update_tiers_test.go, internal/backup/update_tiers_test.go, cmd/controller/r475_wiring_test.go, scripts/test_minagent_header_gate.py.

Red-proof	Mutation	Result
F	gate accepts a body mention	the decoy test fails; 4 tests ran
M	age checked only for Tier 2	3 M sub-cases fail; 5 RUN lines
L	refuse even with a copy	the L test fails
tail	the proven-current mark misses	fails on the mtime
off-site clear	call removed	the hold stays; test fails

The first run of all four Go red-proofs was inert: the harness ran outside the module (RUN lines=0). They were rerun from the module folder and each failed as intended.

3. Live — demo-hp, endpoint-level

Step	Result
Delivery	floor 0.239.0 + MinAgent 0.129.0 saved 15:19:12Z; demo-hp on 0.239.0 at +14 s, demo-felhom at +15 s
K	throwaway actualbudget, Tier 2 off, unit removed: found: none — backing up first, Tier 2 skipped, Tier 1 chosen, done
H	gokapi: precondition met — Tier 1 (own recovery unit), no backup, done
F-shape	never-healthy image: held; text ends „saját meghajtó, 2026-09-13 17:34."; start 409; record copy_tier: 1
Restore	POST /backup/restore from „helyi": hold CLEARED, gokapi v1.9.6 healthy

A first K attempt did not test K: the deploy had already written a Tier-1 unit, so Tier 1 was chosen. It is kept as 04a-…. The restore script's first read polled a 404 path and stopped early; the second read is appended to 08-….

4. Observations

1. The Tier-3 lookup pays its full 15 s bound on demo-hp and logs a misleading WARN about another app's snapshot size. FILED: R-477
2. A leftover recovery unit from a REMOVED install counted as the fresh Tier-1 restore point of a reinstall. FILED: R-478
3. For a bind-data app the Tier-1 unit holds settings only, so the route the hold names does not restore data. FILED: R-479
4. After a successful restore the card keeps the failed update's sentence, which says the running app is stopped. FILED: R-480
5. Removal with remove_backups again left both throwaways' recovery units and their backup prefs. FILED: R-474