felhom-controller/REPORT.md

REPORT — v0.118.0: backup integrity (F7 atomic dumps · F6 no-single-copy · F5 stale sweep)

Date: 2026-07-12 · Version: controller v0.118.0 (from v0.117.0) · MinAgent: 0.81.0 (UNCHANGED) · Deployed: guest 9201 (0.118.0 healthy) · Source: felhom.eu/documentation/audits/CAMPAIGN-3-2026-07-11.md.

What shipped

• F7 (HIGH) — atomic volume dumps. backup.DumpAppVolumes writes the tar to <vol>.tar.tmp, fsyncs it, then atomically os.Renames over the restore point ONLY on success (+ best-effort dir fsync via atomicPromoteTar) — mirroring the DB-dump path (dbdump.go DumpOne). Any tar error / timeout / dead-NFS EIO removes only the .tmp; the last good .tar is byte-untouched. The .tar.tmp is invisible to restore-point/stale scans (ends .tmp, not .tar); orphan tmps are swept. New tarVolume seam for the red-proof.
• F6 (LOW) — no single-copy. RunAllTier2 no longer skips non-HDD apps → volume-only apps get a cross-drive tier-2 copy. sys_drive restore-point label is now clear ("Belső SSD (rendszer)"), never blank. SingleCopyWarning (honest HU banner) shows on a single-drive box with no off-drive target.
• F5 (LOW) — stale primary sweep. pruneStalePrimaryDirs (end of each backup cycle) removes an orphaned backups/primary/<app> dir on an OLD drive after an HDD_PATH move. Guards: deployed + different-current-drive only; never the current-drive dir or an undeployed app's dir; strictly under a backups/primary/ prefix.
• Part 4 — locality fork: operator chose (A) keep locality, document-only. No code change; the NAS-outage behaviour + tier-2 mitigation are documented plainly.

Tests + red-proofs (all green)

• F7: happy atomic promote (no .tmp left); truncation red-proof — pre-seeded good .tar, tar fails mid-write → original byte-unchanged, no 0-byte (revert to in-place write → fails); leftover .tar.tmp swept.
• F6: volume-only app in the tier-2 run set (revert the skip → fails); single-drive honest signal; sys_drive drive-label non-blank.
• F5: redeployed residue removed; guard red-proofs — undeployed app's restore point kept, current-drive dir kept.
• Existing TestListRestorePoints_DriveLabel/SSD updated (blank → clear label, the F6 behaviour).

Live validation (demo 9201, real pipeline, sim-NAS rails — exportfs only)

• F7 money-shot: established good tars (radarr sha 847a97ad… +4 others), then exportfs -u the NFS target 4 s into a backup during volume dumps → run success:false; all 5 nas-media volume tars BYTE-IDENTICAL (clean host-side diff), no 0-byte file, no leftover .tar.tmp; the next clean run produced fresh good tars (success:true). This is the exact campaign F7 repro, now safe.
• F6: after a tier-2 cycle, volume-only actualbudget + seerr appear under felhom-usb/backups/secondary/ (previously none); actualbudget snapshot drive_label = "Belső SSD (rendszer)"; single-copy banner correctly absent on the multi-drive demo.
• F5: a seeded stale nas-media/backups/primary/actualbudget (actualbudget lives on sys_drive) was swept by the next backup; the real sys_drive dir + radarr's nas-media dir were kept.
• Restore round-trip: calibre-web tamper → restore → BYTE-IDENTICAL (53 files), container healthy — F7's write change did not affect restore.

NOT live-validated / standing items

• Single-drive SingleCopyWarning live (the demo has enrolled drives) — unit-tested only.
• Task C (F8/F4) and Task D (ring/alerting) remain queued.
• Peti's box (controller 0.113 / agentless-on-proxmox2) reaches 0.118 + agent 0.85 at his next train — noted for the roadmap; the agentless-on-proxmox2 cluster gap stands.
• No publish/floor movement; agent untouched (MinAgent 0.81.0).

Box state at wrap

controller 0.118.0 healthy on 9201; all backups consistent (fresh tier-1 + tier-2 incl. volume-only apps); NAS re-exported; no stale test residue.