87 lines
6.2 KiB
Markdown
87 lines
6.2 KiB
Markdown
# REPORT — v0.124.0: backups IA restructure (four sub-pages, Felhom-offsite status card, .fab browser download)
|
|
|
|
**Date:** 2026-07-13 · **Version:** controller v0.124.0 (from v0.123.0) · **MinAgent:** 0.81.0 (UNCHANGED) · **Floor:** untouched (rides the next train) · Controller-only.
|
|
|
|
## What shipped (commits `0ece2ba`, `aa967fb`, `753cd83`)
|
|
|
|
1. **IA split** — `/backups` (Áttekintés), `/backups/remote` (Távoli mentés), `/backups/apps`
|
|
(Alkalmazások), `/backups/restore` (Visszaállítás), sidebar children (Tárhely pattern).
|
|
Sections MOVED verbatim from the v0.123.0 page — the committed one-shot
|
|
`scripts/backups_split_move_check.py` verifies all 15 blocks against baseline `df7ad37`
|
|
(whitespace-normalized; the two allowed divergences — tier-3 anchor retarget + the
|
|
restore-to-verify relocation — are encoded explicitly). Shared handler builders extracted
|
|
(`backupsCommonData`/`backupsOffboxData`); flash redirects, tier-3 anchors and the
|
|
tier2-config back-link retargeted per page.
|
|
2. **Felhom-offsite status card** — three honest states from local data, display-only by
|
|
construction (no form/button inside the card; unit-enforced). Decision 2 honored: the card
|
|
never changes anything.
|
|
3. **.fab browser download** — existing export pipeline + staging dest + guarded streaming exit
|
|
with estimate-first UX, post-stream cleanup and a 1h TTL sweep; per-app sequential batch;
|
|
portability framing everywhere (decision 3). Import stays drive-scan.
|
|
|
|
## Tests + red-proofs (run → FAIL → restored)
|
|
|
|
- **Move check red-proof:** one moved block reworded → exit 1 ("1 block(s) rewritten"); restored → 0.
|
|
- **Traversal guard red-proof:** guard loosened to raw prefix-matching → `../decoy.fab` came back
|
|
**200 serving the decoy** — the test caught it (got 200, want 400). Restored → green.
|
|
- **Round-trip + corruption (data-mutation red-proof):** real `executeExport` → bundle →
|
|
real `executeImport` → byte-identical restored content; a mid-file-corrupted copy is REFUSED
|
|
(job fails, app not started, nothing restored). Integrity = gzip CRC + manifest segment
|
|
validation — there is NO per-file checksum (documented; the spec's "manifest checksum" wording
|
|
adapted to reality).
|
|
- Nav/state tests (marker per section, present on exactly one page; `.Page` ids), status-card
|
|
state tests, TTL sweep test (fake mtimes/now). Full green gate + all five template gates green
|
|
per commit.
|
|
|
|
## §13 live validation
|
|
|
|
- **Deployed:** 0.124.0 on the drill guest (qm300) AND demo 9201, both healthy.
|
|
- **Four-page walk (drill, screenshots in session record):** every moved control clicked once —
|
|
tier-2 Beállítás (+ retargeted back-link), tier-3 toggle (off→on), restore-to-verify from its
|
|
NEW home (`/backups/restore` flash), manual-target form open/close. Old `/backups` bookmark →
|
|
Áttekintés on both boxes; sidebar active states correct.
|
|
- **Status card:** state 3 (no card) and state 2 ("Aktív — nincs kijelölt alkalmazás") both
|
|
live-rendered on the drill box; state 1 by unit render test (demo has a managed target — spec
|
|
says do NOT unconfigure).
|
|
- **.fab download:** drill ActualBudget — estimate 3.6 KB shown first, bundle 2102 B streamed,
|
|
staging bundle removed (server log). Demo ActualBudget — downloaded to the operator machine,
|
|
sha256-identical after placement on `felhom-usb/exports` (`e2a1233f…` both ends).
|
|
- **Supervised import (Viktor GO):** ON DEMO (see finding 2 for why not drill): scan found the
|
|
bundle, manifest read (exported-by 0.124.0), "Importálás kész! Az alkalmazás sikeresen
|
|
visszaállítva.", ActualBudget Up (healthy). **The round-trip surfaced finding 1.**
|
|
|
|
## FINDINGS (both pre-existing, surfaced by this task's first real containerized round-trip)
|
|
|
|
1. **(HIGH — data-loss trap) Containerized .fab export ships EMPTY volume data.**
|
|
`exportVolumeData` runs `docker run -v <volDir>:/out alpine tar …` where `<volDir>` is the
|
|
controller-CONTAINER's `os.MkdirTemp` path — the guest's docker daemon resolves it against the
|
|
HOST filesystem, so the tar lands stranded on the guest host (`/tmp/felhom-export-*/…`, found
|
|
with ActualBudget's 66 KB tar in it) and the bundle's `data/volumes` is empty while the
|
|
manifest claims volume data and the export reports SUCCESS. Import then wipes the app's
|
|
volumes and brings it up EMPTY. Affects every golden/bootstrap (containerized) box for
|
|
volume-backed apps; HDD-data apps are unaffected (direct FS copy). Demo's ActualBudget was
|
|
repaired from the stranded tar; both temp dir and staged bundle cleaned. **Fix direction:**
|
|
stage the docker-run output under a host-visible bind (e.g. the controller data volume) or use
|
|
`docker cp`/stdout streaming; plus a post-export assertion that manifest-claimed volume tars
|
|
exist in the bundle (fail LOUD).
|
|
2. **(MEDIUM — agent-side, out of this controller-only task) Drive wizard offers zero candidates
|
|
on a legacy-boot PVE.** With LVM root and no ESP mount, every system mount resolves to
|
|
device-mapper, `storage.SystemDisks` finds no raw disk → `sysKnown=false` → `isSystemBacked`
|
|
fail-safes EVERYTHING to system → `ListCandidateDisks` is always empty (drill box; a hot-added
|
|
blank 5G disk stayed invisible). The fail-safe is right to exist but overreaches here — needs
|
|
an agent ruling (e.g. resolve device-mapper parents to their PVs' disks).
|
|
|
|
## Observations
|
|
|
|
- **.fab browser-UPLOAD** remains the noted follow-up (import is drive-scan only — downloaded
|
|
bundles return via a drive/share, exactly as exercised here).
|
|
- **Combined mega-zip** stays parked (decision; per-app sequential batch shipped instead).
|
|
- **appexport packages LIVE state** (fresh config copy + DB dump + live data), NOT the tier-1
|
|
recovery unit — §8's "stale unit" concern is moot; no "futtass előbb mentést" needed.
|
|
- The import page's drive-label mojibake ("TÃ˘rhely (felhom-usb)") is the KNOWN open fix-5 item.
|
|
- `NoUserDataBackupWarning` is referenced by the per-app section but never set by any handler
|
|
(dead conditional, pre-existing); `DBDumpTotalBytes` was computed but never rendered — dropped
|
|
in the split.
|
|
- Drill box left as found: hot-added disk detached + LV removed; ActualBudget re-toggled; demo
|
|
exports dir + stray export temp cleaned.
|