felhom-controller/REPORT.md

REPORT — controller v0.270.0 (2026-09-24 evening, Part D of the R-672 brief)

Full record: felhom.eu/documentation/audits/r672-2026-09-24/README.md. Architecture read: 09 §3/§6.4, 07.

Shipped — floor 0.270.0 (MinAgent 0.131.0), both demo boxes arrived in ~12 s

• R-679: an Update on an app already at the head → 409 already_current (hu + en) before anything moves.
• R-681: an install cut off by a controller restart is finished through the failure path and reported (app_deploy_failed, the apps page sentence, what it started removed, stale pin records cleared).
• R-669: the recovery unit keeps the PINNED version's .felhom.yml; a restore makes it the applied record.
• R-674: the ladder log says "AT THE HEAD" for a pin at the head.

Red-proofs (each seen failing, then passing; …/r672-2026-09-24/redproofs/D-*)

D1 R-679 check removed → "an app at the head was allowed to update"; D2 head branch removed → "the head was called older than the ladder"; D3 restore not resetting applied-meta → "the next undo would judge with the failed step's probe", and the unit capturing the stack dir's file → "the unit carries the failing step's probe"; D4 recovery a no-op → "an interrupted install was not reported"; D5 page line removed → "the apps page is silent about an interrupted install". Full suite green; gates OK; one new parity fixture (stacks_install_interrupted), no existing fixture changed.

Live on 9202 (endpoint level; no browser on DooPlex)

R-679: privatebin at the head → 409 in both languages, no backup, no pull. R-681: mealie killed during its pull → "INTERRUPTED … reporting it", app_deploy_failed (dropped — 9202 has no hub), page sentence hu + en, no container left; reinstall cleared it; actualbudget killed after its install finished → left alone. R-669: the unit captured after the sync wrote a bad probe kept the good one; a second-drive restore turned stack 8999 / applied 3000 into 3000 / 3000. R-674: no product path (R-679 refuses that case first) — unit test only.

Changed

A test comment called a same-version Update "the repair path"; R-679 removes that path. Restart is the repair path.