2.7 KiB
REPORT — controller v0.336.0: a failed off-site restore puts the app back exactly (R-893 option A) — 2026-10-20
Task: night brief part 2 (run by day, 2026-10-20), Parts 2 and 7. Operator answer: „D20 A". Architecture:
felhom.eu/documentation/architecture/07-backup-architecture.md §6.3; 09 §3 decision 192.
What changed: internal/backup/offbox_restore_undo.go + offbox_reconstitute.go. Before the stop, the live volumes the
snapshot will replace are measured and the copy is added to the restore's own free-space need (too little room or an
unmeasurable volume refuses with nothing stopped). Right after the stop they are tarred into
<namespace>/backups/restore-undo/<app>/<stamp>/. On any failure after a volume or the definition moved, the copies are poured
back, a volume the snapshot added is removed, the live definition is written back and the app starts; the household reads
„…sikertelen. Nem változott semmi…"; the operator gets backup_run_failures leg restore-put-back. A put-back that fails holds
the app and keeps the copy. On success the copy is removed. R-1169: the held sentence says only what is certain.
Tests: 7 new (r893_putback_test.go) + 4 moved to option A (r893_mixed_restore_test.go); nine mutations, each red
(felhom.eu audits/night2-2026-10-20/P2/redproof-unit.txt). controller_gates.py --fast green; go test ./... green.
Live proof on 9202 (rc.1, a helper with the brief's fences; audits/night2-2026-10-20/P2/live/): Rallly + postgres 18, a
forced failure after the volume was replaced → the copy (69 MB, 0.9 s) poured back: 36 tables, markers A–D, the table only the
backup had ABSENT, schema/data/row-count md5 EQUAL to before, the app running, no hold, the copy gone. Then a normal restore of
the same snapshot: the snapshot's content, the app running, the copy gone. 9202 back on 0.331.0 as found.
Release: image sha256:93cd67d871125877e935a024765075b5a0b7c0e7683e1165976ff7a654fe8d73 (clean clone 93fb251); per-box
floors → the three test boxes on 0.336.0 within a minute → box walk green (0 unhealthy, 0 allow-list refusals, catalog in
sync, https-only 28 OK, „Fájlok ↗" one sign-in on demo-hp and Tester 1) → global floor 0.336.0 / MinAgent 0.158.1 at 08:54:35
UTC; per-box floors cleared. Evidence audits/night2-2026-10-20/P7/.
Not measured live: the version-change branch, the _files sentence, the refusals before the stop, a failing put-back —
each pinned by a red-proved unit test. Found: a successful put-back is logged at ERROR by the web handler, and an empty
backups/restore-undo/ folder stays — one register row (small; a version is pushed once, so it waits for the next release).