felhom-controller/REPORT.md

REPORT — 2026-09-28: v0.277.0 (kept data from the off-site copy, R-691 (2)) and v0.278.0 (leftover holds, R-704)

Architecture read first: felhom.eu/documentation/architecture/07-backup-architecture.md §6.5 (kept data), §6.6 (which version a restore brings back); 06-offsite-connectivity.md (what the off-site copy holds per app).

What changed

• backup.KeptBestCopy: the newest usable LOCAL copy (own unit, second drive) or the OFF-SITE copy when it is newer or the only one (a tie goes local). One snapshots --json, bounded 20 s; the kept list asks once per page.
• The install choice and the kept list name the copy and its date (kept.choice.use.desc_from, kept.backup.offsite).
• backup.LoadKeptOffsite: download the unit ALONE (the proof's restoreUnitReadOnly, proof scratch) → judge (this drive, holds data, data version RECORDED — 07 §6.6, else refused; mixed/mismatched refused by unitVersionCheck) → prepare (a dated folder's files move back) → the one unit restore → scratch removed BEFORE the outcome is reported.

Tests and red-proofs (felhom.eu/documentation/audits/kept-offsite-2026-09-28/redproofs/)

test	red-proof	failed with
TestR691_OffsiteCopyIsOfferedWhenItIsTheOnlyOrNewest + TestR691_InstallChoiceNamesTheOffsiteCopy	RP1: KeptBestCopy = KeptDBCopy (0.276.0)	ok=false; use_offered=false use_off="There is no backup…"
TestR691_OffsiteLoadRefusalsLeaveTheKeptFilesAlone	RP2: the data-block refusal removed	"the load reported success"
TestR691_OffsiteLoadDownloadsJudgesThenRestores	RP3 (seen in the first draft): scratch removed in a defer	"the downloaded copy was left behind"

go build/vet/test ./... green; controller_gates.py all OK (go-parity needed the 4 new keys listed).

Live

• 9202 (endpoint level, the calls the pages make): Tier 1 route unchanged — the choice named „saját mentés, 2026-09-28 10:06"; "use" loaded 3/3 volumes + 1/1 database; the seeded nextcloud user and file read back. Tier 2 not runnable live (9202 has one drive). 9202 has no off-site target, so the off-site path is not asked there.
• Floor 0.276.0 → 0.277.0 (MinAgent 0.131.0) at 08:11Z; both demo boxes on 0.277.0, healthy, within a minute.
• Off-site route PROVEN LIVE on demo-hp 9201 (0.278.0). The choice named "távoli mentés, 2026-09-28 15:40"; "use my kept data" downloaded the unit alone and loaded 3/3 volumes + 1/1 database in 55 s; the seed and files read back (felhom.eu/documentation/audits/kept-offsite-2026-09-28/E/).

v0.278.0 — R-704 (a second release this session; the rule is one)

• Found live: a 2026-09-13 update hold on demo-hp outlived its nextcloud; the fresh nextcloud was then skipped by the backup leg (no volumes, no unit) and its off-site snapshot held no data. On 9202 a calcom crash-loop stop outlived two removals and refused the new install's update.
• Fix: removal clears the crash-loop stop too (settings.ClearUpdateHold); a new install (plain or "use my kept data") drops a leftover update/crash-loop hold of an app that is not installed (Router.dropLeftoverHold). Restore holds (R-379) untouched. Tests TestR704_*; red-proofs RP4–RP6 each seen failing. Floor 0.278.0, both boxes healthy.
• Not proven live: the install-time drop itself (the demo-hp hold was cleared by the removal, R-491's path).