admin 1e216d3468 R-773: a removed app restored from its backup gets its sign-up lock back (record opened_by restore + block, before anything starts) ...

An installed app the household never closed keeps what it had (decision 49). Red-proof RP-D2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-01 21:01:42 +02:00

..

testdata/catalog

v0.257.0: the app catalog can speak English (R-560, slice 5 Part A)

2026-09-20 14:31:52 +02:00

after_install_test.go

v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

2026-09-29 09:57:58 +02:00

after_install.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

after_setup_test.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

after_setup.go

R-773: a removed app restored from its backup gets its sign-up lock back (record opened_by restore + block, before anything starts)

2026-10-01 21:01:42 +02:00

captureset_wiring_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

classify_binds_test.go

…

classify_binds.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

classify_wiring_test.go

…

controller_image_retention_test.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

controller_image_retention.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

datapaths_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

datapaths.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

degraded_test.go

v0.222.0: ask whether a supervised member is DEAD before whether one is UNHEALTHY (R-384), and stop promising an undo copy nobody looked for (R-383)

2026-08-23 07:25:00 +02:00

delete_r442_test.go

v0.236.0: "delete my data too" deletes the data, or says that it could not (R-442)

2026-09-13 08:52:25 +02:00

delete.go

v0.284.1 — the image clean-up runs on the household's Remove button too; one summary line per pass (decision 53, R-736)

2026-09-30 22:54:15 +02:00

deploy_crashsafety_regression_test.go

…

deploy_errors.go

kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

2026-09-25 13:32:30 +02:00

deploy_secretgen_test.go

…

deploy.go

R-773: a removed app restored from its backup gets its sign-up lock back (record opened_by restore + block, before anything starts)

2026-10-01 21:01:42 +02:00

desiredstate_test.go

v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

2026-08-02 18:40:17 +02:00

desiredstate.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

digest_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

digest.go

v0.269.1: an installed app keeps the image digest it runs until a guarded Update moves it

2026-09-24 13:01:31 +02:00

downstate_test.go

…

export_mounts_test.go

R-203: the export-mount resolver takes the namespace root too (its own commit)

2026-08-04 18:21:17 +02:00

filebrowser_password_test.go

v0.243.0: FileBrowser generated admin password (R-513); per-tier whole-guest backup truth (R-517); skip absent-storage tiers (R-518); OOM-killed worker visible (R-514)

2026-09-15 10:12:08 +02:00

filebrowser_password.go

v0.243.0: FileBrowser generated admin password (R-513); per-tier whole-guest backup truth (R-517); skip absent-storage tiers (R-518); OOM-killed worker visible (R-514)

2026-09-15 10:12:08 +02:00

guestnet_test.go

R-66: the box's own address becomes visible (v0.159.0)

2026-07-22 13:49:57 +02:00

guestnet.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

hddpath_agreement_test.go

…

healthprobe.go

R-772: a health probe that could not run records not_checked + NOT healthy, is looked at again on the 10 s cycle, and the app page says so

2026-10-01 21:01:42 +02:00

image_retention_test.go

v0.284.2 — the image clean-up sees digest-pulled (untagged) images (decision 53, R-736)

2026-09-30 23:03:32 +02:00

image_retention.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

import_root_classify_test.go

v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

2026-07-26 08:15:47 +02:00

infra_test.go

…

infra_tunnel_test.go

R-753: the box tells visitors apart — cloudflared at a fixed address, traefik trusts only it, the controller reads the hop traefik saw

2026-10-01 21:01:42 +02:00

infra.go

R-753: the box tells visitors apart — cloudflared at a fixed address, traefik trusts only it, the controller reads the hop traefik saw

2026-10-01 21:01:42 +02:00

initialcreds_test.go

…

initialcreds.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

install_hold_test.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

install_hold.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

install_interrupted.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

installed_test.go

v0.237.0: the Update button takes a backup first, and tells the truth (update arc slice 4 — R-448, R-443, R-439)

2026-09-13 11:41:31 +02:00

installed.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

kept_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

kept.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

ladder_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

ladder.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

life_records.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

lifecycle_orphan_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

lifecycle_test.go

catalog: app lifecycle states - available/hidden/abandoned (v0.158.0)

2026-07-21 16:19:58 +02:00

mailenv_test.go

…

mailenv.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

manager.go

R-772: a health probe that could not run records not_checked + NOT healthy, is looked at again on the 10 s cycle, and the app page says so

2026-10-01 21:01:42 +02:00

metadata_i18n_test.go

v0.257.0: the app catalog can speak English (R-560, slice 5 Part A)

2026-09-20 14:31:52 +02:00

metadata_i18n.go

v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

2026-09-29 09:57:58 +02:00

metadata_test.go

…

metadata.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

migrate_fs3_test.go

…

migrate_setgid_linux_test.go

…

migrate_setgid_test.go

…

migrate_test.go

…

migrate.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

oom_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

oom.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

pgconvert_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

pgconvert.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

pin_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

pin.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

portable_secrets_test.go

D5: an app restore works from the drive alone (v0.188.0)

2026-07-30 16:33:06 +02:00

r480_r478_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r485_backup_card_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r489_volumes_removed_test.go

controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

2026-09-13 22:50:18 +02:00

r536_deploy_done_hook_test.go

v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

2026-09-16 16:55:55 +02:00

r553_deploy_error_kinds_test.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

r630_r634_v0262_test.go

v0.262.1: the busy refusal is a CONFLICT, not a server error (R-633)

2026-09-22 21:48:01 +02:00

r634_deploying_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

r649_failed_deploy_cleanup_test.go

controller v0.266.0: a failed install removes what it started (R-649, operator ruling)

2026-09-23 18:06:29 +02:00

r650_main_test.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

r651_r658_remove_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r658_undo_volumes_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r665_verify_meta_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

r669_restore_meta_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r670_probe_meta_test.go

controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

2026-09-25 11:19:27 +02:00

r674_head_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r679_already_current_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r681_install_interrupted_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r694_restored_login_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

r700_records_carried_test.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

r721_leg_stopped_test.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

r772_not_checked_test.go

R-772: a health probe that could not run records not_checked + NOT healthy, is looked at again on the 10 s cycle, and the app page says so

2026-10-01 21:01:42 +02:00

r773_restore_signup_lock_test.go

R-773: a removed app restored from its backup gets its sign-up lock back (record opened_by restore + block, before anything starts)

2026-10-01 21:01:42 +02:00

samba_classify_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

samba_classify.go

docs(shares): R-7b v0.145.0 — CHANGELOG, CONTEXT, REUSE, README; caveats cleared

2026-07-18 13:06:41 +02:00

samba_lanaddr_test.go

v0.151.0 — the Megosztás page stops reloading, and says how to connect

2026-07-20 10:46:21 +02:00

samba_test.go

…

samba.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

setup_gate_test.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

setup_gate.go

R-773: a removed app restored from its backup gets its sign-up lock back (record opened_by restore + block, before anything starts)

2026-10-01 21:01:42 +02:00

signup_block_test.go

v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

2026-09-29 09:57:58 +02:00

signup_block.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

skeleton_derive.go

v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

2026-07-26 08:15:47 +02:00

start_services_test.go

v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

2026-07-20 17:01:52 +02:00

unattended_test.go

v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706

2026-09-28 18:38:30 +02:00

unattended.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

undo_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

undo.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

unhealthy_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

unhealthy.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

update_events_test.go

controller v0.264.0: the household is told when an update is undone or held, in its language

2026-09-23 13:51:21 +02:00

update_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

update_tiers_test.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

update.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

updatelock_test.go

v0.261.0 — the controller no longer swaps itself out from under an app update (R-608, R-609)

2026-09-21 14:23:59 +02:00

updateorder_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

updateorder.go

controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

2026-09-25 11:19:27 +02:00

userdata_belt_gate_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

userdata_belt_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00

userdata_path_r203_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00