felhom-controller/REPORT.md

REPORT — controller v0.296.0 (2026-10-05, late afternoon): a cut-off backup run is said; honest "Mentés most" wording

Brief: the 2026-10-05 hub-safety brief (operator), Part E (R-518, R-519). Full session report: felhom.eu/REPORT-hub-safety-2026-10-05.md. Architecture: felhom.eu/documentation/architecture/07-backup-architecture.md (the restore-record paragraph and the R-518 lane-1 note), 09 decision 123.

Baseline and commits

• Baseline 477e2548db (v0.295.0). Commit ff69074 → image gitea.dooplex.hu/admin/felhom-controller:0.296.0.
• MinAgent 0.131.0 (unchanged). Golden 0.296.0 baked + vouched (felhom.eu/documentation/tests/golden-0.296.0-2026-10-05/).
• Delivered by per-customer floors (demo-hp, demo-felhom, tester-1 at 0.296.0): both demo boxes ran 0.296.0 (healthy) ~30 min later.

What changed

• R-519. internal/backup/run_record.go: the app-data run is on record (appdata-run.json) while it runs; a start that finds it running turns it into a notice on /backups and /backups/apps, kept until a run ends with every step OK. After a restart the synthesised "last database backup" no longer reads OK over a cut run. Restore points were already dated by their OLDEST part (v0.275.0). Wired in main() (loadRunRecordAtStartup, AST-pinned).
• R-518. The whole-system "Mentés most" text and confirm now state two measurements: ≈6 min / 9 apps (demo-hp today: 09:19:08Z → last app back 09:24:55Z, local tier only) and ≈8 min / 12 apps (2026-09-14); "minutes, not seconds"; longer when the off-site copy runs in the same run.

Tests

go build/vet/test ./... green; controller gates green (golden-notice advisory before the bake). New: TestRunRecord_* (3, incl. the production path through runDBDumpsInternal), TestRunRecordAtStartup_FindsACutRun, TestMainWiresRunRecord, TestR518_* (both measurements, both pages and confirm), parity cases backups_interrupted_run, backups_apps_interrupted_run; six parity fixtures re-captured for the changed copy (only the copy lines differ). Red-proofs (4, all convict): felhom.eu/documentation/audits/hub-safety-2026-10-05/partE/red-proof.txt.

NOT yet live-validated

• The live cut on 9202 (restart the controller in the middle of a backup run, then read the page): the permission check refused restarting the controller mid-backup. The operator is asked; R-519 stays narrowed until then.