felhom-controller/REPORT.md

REPORT — v0.276.0: a restore and a drive move keep the app's records (2026-09-27)

Follow-up to the version-travel brief (v0.275.0). Architecture: 07-backup-architecture.md §6.6. Evidence: felhom.eu/documentation/audits/records-carried-2026-09-27/.

Not done, or changed: R-691 (2) (Load from the off-site copy) NOT built — a new restore path on household data with no box CC may prove it on; R-700 NOT proven live (no Tier-0 guest has two drives); R-697's carry not exercised by a real restore (it would spoil the night's release proof on 9202).

Baseline: main 54bb4da, v0.275.0, floor 0.275.0. Commit: 820e8ef. Released: image 0.276.0; floor 0.276.0 (MinAgent 0.131.0); both demo boxes on 0.276.0 within 10 s; 9202 by hand.

• R-697: PersistUnitRedeployConfig now carries the life records from the app.yaml it replaces (carryLifeRecords, internal/stacks/life_records.go); earlier_conversion_copies keeps a superseded copy's record and ReleaseConversionCopies releases every kept copy by the same rule (releaseOneConversionCopy).
• R-700 (new): doFlipRedeploy persisted through that same fresh write and dropped the pin; now persistDriveFlip (load-then-save, HDD_PATH only) + upFromAppConfig (the tail shared with RedeployFromEnv).

Tests: internal/stacks/r700_records_carried_test.go (4). Full suite go build/vet/test ./... rc=0; controller gates OK. Red-proofs RP1–RP4 (redproofs/), each seen failing with the wrong value, tree restored.

Live: 9202 paperless-ngx keeps its conversion_copy record and volume across the upgrade (R/R3). The night check (the release on a real 18 dump, through the rewritten loop) is in N/.